As the importance of the Internet increases for citizens, corporations, and governments, so does the danger posed by attacks to and through these new systems. Awareness of the dangers posed by cyberthreats has increased gradually in tandem with their frequency and sophistication, and to a large extent, current government institutions have adapted existing capabilities to this new context.
This project explores the current shape of the institutional structures in the United States devoted to cyberthreat detection, mitigation, and response, and questions whether other structures might be more effective and/or better serve important non-security government goals. This project does not undertake to describe or classify the different types of cyberthreats based on perpetrator or motive. While the issue of threat taxonomy is an interesting one, at the level of institutional response it is often irrelevant. A cyberattack poses the same immediate issues of response whether it was launched by a country or a wayward teenager. There are of course some issues of threat classification, but these are closely linked to the distribution of authority among agencies-- an attack on military networks will raise different issues and provoke a different response than an attack on the servers of a private corporation.
Some questions to keep in mind when considering these materials:
- How do different institutional arrangements affect other important rights and government interests, such as privacy?
- How much weight should these rights and interests receive as compared with security concerns?
- What relative weight should be assigned to each of the institutional responsibilities in this area?
While an increasing number of statutes and executive decisions organize agencies, allocate responsibilities and create inter-agency relationships, the current structure principally reflects historical and bureaucratic decisions by the agencies themselves rather than an overarching institutional design decision. As a result, the government structures for responding to cyber-threats are complex, with a number of agencies sharing authority in occasionally overlapping areas.
This chart, while by no means an exhaustive survey of government action in the realm of cybercrime and cyberwar, attempts to plot several of the major actors in those areas as well as the key relationships linking those actors together.
One consequence of this lack of centralization is the lack of agreed-upon categories and terms for discussing types and threats and forms of response.
Various government and private actors participate in preventing, detecting, and responding to various cyber-threats. Broadly speaking, these actors fall into four different categories:
- Cyber-specific federal agencies (e.g. Cyber Command)
- Defense and investigation agencies (e.g. Department of Defense, FBI, CIA, NSA, DOJ)
- Independent agencies with relevant concerns and vulnerabilities (e.g. Department of State, Federal Communications Commission)
- Private corporations
Under federal law, every agency has at least some cybersecurity responsibility: the Federal Information Security Management Act, U.S.C § 3541 et seq., requires the head of each federal agency to ensure compliance with information security standards promulgated by the National Institute of Standards and Technology (NIST).
One of the many uncertainties inherent in this discussion is how to go about classifying the types of responsibilities we want to allocate among the various federal agencies. The White House Cyberspace Policy Review (the 60-Day Review) notes that it considers "Cybersecurity policy" to include the following activities:
- threat reduction
- vulnerability reduction
- deterrence, international engagement
- incident response
- recovery policies and activities,
"including computer network operations, information assurance, law enforcement, diplomacy, military, and intelligence missions as they relate to the security and stability of the global information and communications infrastructure." The 60-Day Review offers no explanation of what each term might entail (and in fact this might just be a throwaway list), but this provides at least a starting point for thinking about the array of responsibilities agencies may be saddled with in addressing potential and actual cyber-threats.
The different actors in the cybersecurity context are connected through a variety of structural links and formal and informal agreements. These connections take four general forms:
- Structural (e.g. official subsidiary agencies, as the Secret Service is a component of DHS)
- Negotiated cooperation
- De facto cooperation (history of communication and coordination between Department of Defense and State Department)
There are few formal agreements and statues explicitly governing relationships between agencies in the cybersecurity realm. Some examples of current agreements between agencies, depicted in the above chart as lines between actors, include:
- The Enduring Security Framework, which is intended to operate to encourage cooperation between the public and private sectors, is ill-defined and little publicized.
- National Cyber Response Coordination Group (NCRCG)
- National Cyber Investigative Joint Task Force (NCIJTF)
Other opportunities for cooperation have arisen through slightly less formal processes. For instance, the DHS and NSA in October 2010 announced a coordinated response to cyber threats. Under this agreement, both agencies will assign staff and officials to permanent exchange posts in the other agency's offices, and the NSA will provide additional support to the DHS's cybersecurity efforts.
A Government Accountability Office report discussing the Comprehensive National Cybersecurity Initiative sums up one of the major problems with the current organizational situation thus: "Federal agencies have overlapping and uncoordinated responsibilities for cybersecurity, and it is unclear where overall responsibility for coordination lies."
The scarcity of official coordination between different government agencies raises a number of issues. Agencies may claim overlapping jurisdiction, leading to inefficient staffing and funding decisions (as well as inter-agency tension). At the same time, gaps in coverage between the jurisdictions of various agencies may emerge elsewhere. The inability of agencies effectively to share intelligence about possible threats in new technological contexts contributes to slower and less successful government responses.
As one example, this New York Times article describes how one hacker, Albert Gonzalez, was able to evade capture by the police for a number of attacks on different commercial websites while he was simultaneously under protection as a Secret Service informant.
Agency Organizational Strategies
The apparent weaknesses in the current agency structure suggest two major organizing strategies.
First, agency cyber-security responsibilities have largely evolved in a bottom-up manner as agencies often unilaterally expanded their spheres of operation onto the Internet. In some cases this approach resulted in seemingly natural allocations, such as the Department of Justice and FBI taking responsibility for investigating computer crimes. But in other cases the result was overlap between disparate agencies responsible for performing substantially similar operations. For example, the Department of Defense has its own investigative office — the Defense Cyber Crimes Center; the Secret Service adds a another layer of investigative authority with its Electronic Crimes Task Forces (which coordinate between federal, state, and local law enforcement activities).
Second, management of cyber-threats is still largely decentralized, though the Department of Homeland Security has slightly increased the degree of centralization (and it's still unclear how Cyber Command is going to fit into the agency framework). There is no cybersecurity version of the Director of National Intelligence to centralize agency information and activities relating to cyber-threats, nor is there a mechanism for determining who is initially responsible for responding to a newly-discovered incident or threat. Given the difficulty in identifying the actor behind a particular attack, interested agencies will be generally unable to classify the nature of an incident — criminal, espionage, terrorist, or something else — prior to commencing the investigation and response. In the absence of centralization, this means that agencies must decide among themselves who should mount the response — or that they will risk the inefficiency and inconsistency of multiple agencies independently acting.
Top-down vs. Bottom-up Allocation of Responsibilities
- Clarity of organization: little overlap of responsibility when externally allocated
- Accountability: when actors have externally defined roles, they are more likely to be held to account for their performance in pursuing these goals.
- Flexibility: allows actors to adapt and respond to changing threat environemnts
Centralization vs. Decentralization
The current system is extremely fragmented and decentralized: until the creation of Cyber Command, allocation of responsibilities happened by default or necessity. With the advent of Cyber Command, however, there is great potential to rectify the problems of fragmentation--but correspondingly, there are potential risks to concentrating power in one agency. There are a few options for centralization versus decentralization that a cyber institutional structure could take.
- moving to this structure would cause little disruption
- responsibility for responding to an attack would be allocated either to the first agency that is alerted or to the one that has the right technical tools
- there is less risk of agency over-reach into places like civilian networks, since practically speaking, no agency will have the tools, or perhaps agencies will check each other
- the practical allocation of responsibilities may make the most sense in a decentralized system, assuming that agencies have adopted issue areas that are close to their core missions (though this is not always the case)
- decentralization may breed creativity and more innovation in responding to attacks
- however, one problem is that responses might not always come from the right agency.
- for example, the first agency to learn of an attack is not necessarily the ideal one to respond, but it may not want to give up responsibility to another agency (reflecting inter-agency competition)
- under a decentralized structure, agencies may not share information (for an example of these flaws and a reaction to them, see pre- and post-9/11 counter-terrorism responsibilities)
- connecting-the-dots problems--if attacks are handled by different agencies that do not share information, it's possible that no agency will be able to piece together enough clues to find out who the perpetrator is
- there may be competition among agencies to keep the best technical resources--agencies will not want to share with others if they want to take credit for handling more attacks
- for example, other agency heads have criticized NSA dominance of cyber issues
- overlapping responsibilities and inefficiency: there may be multiple agencies with the resources to respond to a certain kind of attack
- Leadership from the Cyber Command
- agencies would report all attacks to Cyber Command
- there would be a threshold of what kinds of attacks were significant enough to warrant reporting, so that Cyber Command would not be inundated with low-level attacks
- or alternatively, there could be a reporting system that prioritizes high-risk attacks and that simply submit low-level attacks in compiled form
- Cyber Command would then transfer responsibility for dealing with the attack to the agency with the technical expertise to handle it
- problem: this could reduce reaction time
- Cyber Command would also be the direct liaison to the President for all cyber issues when explaining attacks or developments
- upon request, Cyber Command could provide other agencies with technical resources
- a potential problem is that the coordination between agencies could be difficult to regulate--some agencies may be unwilling to give up problems to Cyber Command
- this structure may also be the trickiest to attain, since it would involve balancing centralization and decentralization: it may take a few years to get the coordination right
- agencies that already deal with cyber threats will probably want to have a say in how this structure is formed
- agencies would report all attacks to Cyber Command
- Cyber Command could hold most or all of the responsibilities for cyber-related issues: including threat detection, vulnerability reduction, capabilities to respond to attacks and perhaps capabilities to engage in them
- this agency would also have regulatory powers--it could dictate how other agencies respond to cyber threats
- centralization reduces inefficiency and concentrates resources and technical abilities within one agency
- information-sharing problems would be solved
- responses to attacks would be faster
- it may be easier to counter-strike in response to an attack when the two capabilities are housed in the same agency
- this structure could create a dangerous power imbalance, however: because the scope of cyber issues can be very broad, it may be unwise to give one agency control over all of them
- NSA has already caused some concern over its far-reaching programs
- it may not make sense for one agency to handle the diverse set of cyber-related issues
- some cyber crimes may be small-scale and easily handled by other agencies
- other crimes may tie directly into another agency's core mission
- centralization may also cross the negotiated boundaries that define agency reach (e.g., military action in domestic settings)
Involving the Private Sector
Since the vast majority of critical Internet infrastructure is in private hands, the private sector clearly has a role to play in addressing cyber-threats, especially when it comes to ensuring the resiliency of our networks. Indeed, the record shows that attacks are levied against private companies and government alike. But effective cooperation between government and the private sector is burdened by a variety of hurdles:
- Communication: Under the current framework, it's unclear how agencies and private companies should interact. For example, if a federal agency detects an intrusion into a private system, should that agency immediately notify the company? If so, how? On the flip side, if a private company detects an intrusion into its own systems, how do we ensure that an appropriate agency receives that information?
- Information sharing: This is closely tied to the communication issue. Government may be reluctant to share information with the private sector in general for fear of disseminating sensitive information (for example, sharing information about a detected intrusion may reveal the nature of the detection systems that are in place). The prevalence of multinational corporations further complicates this issue; U.S. agencies may be especially wary of sharing information with a company based in China, even when that information may otherwise address a security problem. And from companies' perspective, providing information to government agencies may be seen as a risky activity—they are likely to worry about sharing trade secrets, business strategies, and other sensitive data that may eventually leak out (some of which may be subject to FOIA requests absent clear exemptions). Companies may be similarly reluctant to provide information regarding recent or ongoing cyber-attacks.
- Coordination: How can government agencies work together with the private sector to proactively improve security and network resiliency?
The Enduring Security Framework
According to testimony by James N. Miller, Principal Deputy Under Secretary of Defense for Policy, "[t]he Enduring Security Framework is a public-private partnership between the Director for National Intelligence, DoD, the Department of Homeland Security, and the private sector; its goal is to provide a permanent forum for USG-industry dialogue."
Further information on the Enduring Security Framework is currently scarce, however, so it's unclear precisely what exactly this process entails. But what "should" be involved in the government-industry dialogue?
The Defense Industrial Base
Certain private companies classified under Homeland Security Presidential Directive 7 (HSPD-7) as "critical infrastructure and key resources" (CIKR) work together with the Sector-Specific Agencies (SSAs) to establish information-sharing and analysis programs. The Defense Industrial Base is the set of CIKRs for which DoD is the relevant SSA. The DIB is primarily focused on ensuring that industries necessary to supplying and maintaining the military are protected and resilient against harms ranging from natural disaster to intentional attacks. The DoD's Sector-Specific Plan has this to say about cyber-threats:
"While [the Assistant Secretary of Defense for Networks and Information Integration] is responsible within DoD for assuring the availability of the [Global Information Grid], those responsibilities do not extend to the private sector portion of the DIB. There is no specific cyber asset characterized as part of the DIB Sector. Individual DIB assets likely have cyber elements within them, but they are the responsibility of the asset owner/operator. Cyber security is part of the critical asset risk assessment process, and the expertise of ASD(NII) will be sought for development and distribution of best practices to be shared with all DIB security partners."