Cybersecurity in Context

Technology, Policy, and Law

Chris Jay Hoofnagle

Golden G. Richard III

Copyright © 2025 by John Wiley & Sons, Inc. All rights reserved, including rights for text and data mining and training of artificial technologies or similar technologies.

Published by John Wiley & Sons, Inc., Hoboken, New Jersey.
Published simultaneously in Canada.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 750-4470, or on the web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permission.

Trademarks: Wiley and the Wiley logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates in the United States and other countries and may not be used without written permission. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Further, readers should be aware that websites listed in this work may have changed or disappeared between when this work was written and when it is read. Neither the publisher nor authors shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.

For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic formats. For more information about Wiley products, visit our web site at www.wiley.com.

Library of Congress Cataloging-in-Publication Data Applied for:

Hardback ISBN: 9781394262441

Cover Design: Wiley
Cover Image: © posteriori/Getty Images

About the Authors

Chris Jay Hoofnagle is Professor of Law in residence at the University of California, Berkeley. He is affiliated faculty with the Simons Institute for the Theory of Computing and the Center for Security in Politics and an elected member of the American Law Institute. Author of Law and Policy for the Quantum Age (Cambridge University Press, 2022, with Simson Garfinkel) and Federal Trade Commission Privacy Law and Policy (Cambridge University Press, 2016), Hoofnagle is also of counsel to Gunderson Dettmer Stough Villeneuve Franklin & Hachigian, LLP, and serves on boards for Constella Intelligence and Palantir Technologies.

Golden G. Richard III is a Professor of Computer Science and a Fellow of the American Academy of Forensic Sciences. He has over 40 years of practical experience in computer systems and computer security and is a devoted advocate for applied cybersecurity education. He is Professor of Computer Science and Engineering and Director of the Cyber Center at Louisiana State University, where he also directs the Applied Cybersecurity Laboratory. He works mostly in memory forensics, malware analysis, exploit development, reverse engineering, systems programming, and operating systems. His first floppy drive cost $600 and required financing; despite that, he’s still very much alive.

Preface

Chapter image: John William Waterhouse, Penelope and the Suitors (1912), Aberdeen Art Museum.

Source: Aberdeen Art Gallery and Museums Collections/Public domain/https://emuseum.aberdeencity.gov.uk/objects/2543/penelope-and-the-suitors?ctx=3a10837e3d37278fd9e6a15f386c4aabaee1455e&idx=3.

Cybersecurity is a grand challenge of modern society. This textbook introduces the challenge as a highly complex and interdependent social problem, meaning that cybersecurity can only be managed, not solved. This is partly because the integration of computing into every aspect of our lives will imperil our safety in unpredictable ways. Furthermore, the complexity of both computing devices and the attacks against them is continuously increasing. Terrorists in the last decade created chaos by forcefully commandeering physical assets. Attackers of the future might confuse our self-driving cars, cause our appliances to catch fire, or even change our perception of reality.

We also believe that cybersecurity requires multidisciplinary training in order to understand its contours; thus this textbook attempts to capture the rich complexity of cybersecurity by incorporating insights from economics, political science, computer science, information theory, and psychology.

We wrote this textbook in order to reduce cybersecurity students’ workload. Learning cybersecurity from primary literature is labor intensive and often results in confusion because of latent disciplinary assumptions. For instance, literature in the political science field might proceed from assumptions very different from computer science. This textbook helps the student see these assumptions and how people of different disciplines talk past each other.

Because cybersecurity changes so rapidly, we have attempted to set down the basics here. The textbook sets up instructors to discuss the controversies of the day in the classroom. Our goal is to explain both the technological realities of the Internet and how those realities interact with cybersecurity policy and regulation. We have omitted many of the specific statutes and regulations underlying those policies because they change so rapidly. Instead we focus on the reasons, purposes, and history of cybersecurity policy. We think that students who know these elements will be better analysts.

A note on secrecy, classification, evidence, and language. Much of cybersecurity is a “dark art.” No one really knows the true extent of cyberattacks and cyberespionage. We do our best to relate what is publicly known, but at times we rely on speculative sources. We tend to emphasize evidence that has external signals of legitimacy, such as when knowledgeable insiders specifically point to publicly available material. However, much of what we know comes from law practice, our personal experiences, and discussions with people in the field. Caveat lector!

Many of our students hold security clearances, and so this textbook relies only on open-source information. There are no Snowden or Manning documents in this textbook.

Elements of this textbook are designed to assist in making assignments and driving discussion questions.

Question — Discussion Questions. Invitations to discuss an issue appear in boxes like so. Students: Be ready to discuss these questions in class.

Exercise — Assignments. Assignments are formative evaluation opportunities. Assignments appear in boxes and typically require the student to prepare some kind of writing for discussion or grading.

▄

▄ Example — Key Anecdotes. Stories about cybersecurity incidents appear throughout the book to address the problem that vulnerabilities are abstract and analysts often need a concrete example of an exploitation to understand the associated risks.

▄

We have decorated the book with many images from the ILIAD and the ODYSSEY. Why? Both works illustrate an important value in cybersecurity: the Greek concept of mētis. Mētis, the Greek Titan mother of Athena, represented both wisdom and cunning. As James Scott observed, “Broadly understood, mētis represents a wide array of practical skills and acquired intelligence in response to a constantly changing natural and human environment.”

Mētis presents a dilemma: we are ambivalent about tricks and tricksters. On the one hand, we admire tricksters. Thucydides observed, “it is generally the case that men are readier to call rogues clever than simpletons honest, and are as ashamed of being the second as they are proud of being the first.”

Yet on the other, tricksters can wreak havoc. Homer put the clever and their tricks at the center of the story—Penelope’s loom, Circe’s potions, Athena’s disguise as Mentor, Achilles’s disguise at the court of Skyros, Patroclus’s donning of Achilles’s armor, Helen’s perfidies, Athena’s interference with the Trojans’ strategic deliberations, and Odysseus’s too-many-to-enumerate schemes. These are sources of delight as much as fear.

Emily Wilson, in her recent translation of the ODYSSEY, opens the work by describing Odysseus as “complicated.” And so are our feelings about the modern tricks detailed in this book.

December 2023
Berkeley, CA
Baton Rouge, LA

Acknowledgments

We are grateful to everyone who supported this work. They are Elsa Hahne, Victoria Bradshow, Nandhini Karuppiah, Gaurav Lalsinghani, Sakthivel Kandaswamy, Bruce Schneier, Kavin Shanmughasundaram, and Aileen Storry.

Chris Jay Hoofnagle: Many thanks to the students who have participated in Cybersecurity in Context and the Future of Cybersecurity Working Group.

Golden G. Richard III: Thanks to all my students in the Applied Cybersecurity Laboratory, to LSU for providing an amazing work environment, and to Elsa Hahne for basically everything.

About the Companion Website

This book is accompanied by a companion website:

www.wiley.com/go/hoofnagle/cybersecurity

On this website, you can find the teacher’s manual, which contains discussion prompts and guides to elicit points from students, and summaries as well as model outcomes for the exercises.

On the book’s author-maintained site, you can find the virtual machines and lab exercises: https://cybersecurityincontext.com/.

Introduction

Chapter image: Odysseus offers Polyphemus the Cup, DALL-E V3 (2023)

Why Cybersecurity?

Imagine a future you. You work in cybersecurity. It’s Monday morning and you:

Analyze whether a series of posts on social media are the product of authentic user activity or part of a coordinated attempt to influence understanding of a political issue.

Help a client investigate a security incident to determine its severity

Inspect a suspicious software package that was emailed to your COO. Within the software, you find that malicious code seeks to steal valuable trade secrets from your company.

Inspect the logs of recent voter registration changes at the Secretary of State’s office. You learn that someone has systematically changed the registration records of voters from poor neighborhoods around the state.

Test a network to determine whether an adversary can access devices on the network and take them over.

All of these functions are performed by analysts, digital forensics investigators, malware analysts, and penetration testers. Such positions are widely available with employers often desperate to hire qualified candidates. Not only are these functions critical in realizing the value of free speech and privacy—the hallmarks of liberal democracy—they also pay well. The median pay for information security analysts is just over $110,000.¹ Highly-skilled candidates may make several times this much, or more. And even better: the U.S. government projects that the field will grow over 30% in the next decade.²

Cybersecurity offers a ladder to the top ranks of corporations. Nowadays, chief security officers are executive vice presidents—top level executives—rather than subordinates to a chief information office. Some cybersecurity experts now sit on corporate boards of directors.

Cybersecurity is an intellectually stimulating field where experts are struggling to develop theory that accurately captures what the field means for governments and society. To illustrate this, we draw your attention to the artwork that decorates the chapters of this book, taken from the ILIAD and ODYSSEY. This chapter is decorated with Odysseus’s plan to escape the cave of the giant cyclops Polyphemus. Recall from the story that Odysseus convinces Polyphemus that his name is “Noman.” Odysseus intoxicates Polyphemus with wine while his soldiers sharpen a stake and use it to blind the giant once he loses consciousness. Polyphemus calls for help, but makes the mistake of telling his friends “Noman is killing me,” and thus the rescuers leave confused. Once Odysseus has escaped, he announces his true identity to Polyphemus, setting the story in motion. Odysseus’s self-attribution is an act of hubris, as irresistible as it was injudicious. Polyphemus hurls a rock at Odysseus, nearly hitting his ship, which is drawn back to the shore by the impact of the rock. While Polyphemus fails to capture Odysseus that day, knowledge of Odysseus’s name tightens a net around the hero’s fate, imperiling his future and causing many losses of his soldiers.

Conflicts in cybersecurity often have these same dynamics—anonymity, the tricking of a victim into creating a vulnerability, rapid action that serves the attacker’s goal, misleading the victim about the identity of the attacker, sometimes attribution of the true identities of attackers, along with many avenues of pursuit against the wrongdoer. As you consider the allegory, know that thinkers in cybersecurity are not certain whether cyberattacks are most like the deception surrounding Odysseus’ name, the wine, or the stake. As cybersecurity evolves, it may take the form of one or all three of these elements.

There are numerous roles for cybersecurity experts with a focus on policy and law. Security disputes among nations require careful study of country characteristics, history, and national security policy. But more broadly, policy students can find stimulating careers at the local, state, and federal levels in scores of agencies that have security sensitivities.

Both lawyers and technically trained students can have a rich future advising clients on security breaches and helping them secure their systems.

You can do good in cybersecurity in the setting of your choice. The military, the intelligence agencies, private companies, non-profits—in particular, human rights groups, and consulting firms all need cybersecurity analysts.

While sometimes “security” is used to smash freedoms, at the same time, we cannot have any freedoms without some amount of security. We cannot have freedom of speech or freedom of association or freedom from privacy intrusions or even freedom to do business when people can threaten our bodies and minds. Nor can we have a functioning government and military that is safe from adversaries without cybersecurity. This means that as a cybersecurity professional, others’ freedoms are in your hands. Whether one can speak, find friends to speak with, get treated by their physician, or just operate a business without getting ripped off is up to cybersecurity experts.

We want you to keep an open mind about security as a key societal value. Providing security for people is a core responsibility of governments. Governments must change their security policies as society and technology evolve and create new threats to personhood. At a high level, much of this textbook is about the struggle—even the failure—of governments to adapt to the new security problems brought about by the Internet.

The private sector performs many government-like roles in security and it has been profoundly effective. Yet, the private sector owes people different duties and has different responsibilities than government. Problems in security have dragooned the private sector into many situations—such as investigation of cybercrimes and even conflicts with other governments—that imperil revenue and raise tricky ethical issues.

Why Cybersecurity in Context?

As much as we need security to secure our freedoms, too much security—or the wrong security—obliterates freedom. This is one reason why this book is titled Cybersecurity in Context. Security as a value can be problematic. It has to be applied with care. Here is the balance we have to achieve: We need enough security so people can enjoy their freedoms and rights. At the same time, we must prevent the creation of a security state, a political body that prioritizes itself over citizens’ welfare.

We will show how not all problems need to be thought of as security issues. In fact, there are a wealth of alternative ways to approach insecurity that do not involve police or militaries. We will see security solutions that use markets, psychology, consumer law, and even concepts drawing from public health.

Finally, we want you to excel in cybersecurity as a professional who understands the technology and the policy of the field. The need for technical analysts to understand these issues is obvious, but managers and executives also need to understand both the technological capacities and limits of systems, and be able to balance capabilities with larger organizational priorities. Those larger priorities range from straightforward economic incentives to the increasingly complex politics of operating an organization. It might seem esoteric today, but we promise that a grounding in international relations, legal principles, and even individual psychological forces will help you better understand cybersecurity.

To help you understand the technology, we have created a series of technical exercises that illustrate fundamental problems in cybersecurity. These exercises are separate from the book and standalone, but will be useful to readers looking for a more technical grounding in cybersecurity and for cybersecurity classes with a hands-on, technical flavor. These exercises are available on this book’s website, https://cybersecurityincontext.com. The exercises require access to a set of virtual machines that we have created, which are available via the website. These exercises are optional and the book can stand on its own as an introduction to important topics in cybersecurity.

Outline of This Book

The first part of this book explores the most important elements that shape the playing field on which cybersecurity problems emerge and are managed. We begin with an overview introducing the meaning of cybersecurity. We then turn to the technology of the Internet, with the aim of explaining why it is so difficult to secure complex networks. The following chapters explain how economics and psychology affect security investment and shape attack and defense. We include a chapter on the military in this first part because the military, we argue, was the first major actor to wrestle with cybersecurity, and it made profound insights in the field in the 1960s and 1970s. It’s humbling to learn that some of the challenges realized by the private sector in cybersecurity were first encountered and addressed by the military 40 years earlier, yet many of the lessons learned were obscured by classification. The first part concludes with an overview of the different theoretical approaches applied to cybersecurity problems.

The latter half of this book delves into the most important substantive cybersecurity regulations—the consumer law, criminal law, critical infrastructure protection, intellectual property rights, security breach notification, and public company regulation. We use a framework approach that identifies key principles and approaches because laws and policies constantly change. Our goal is to prepare you for the uncertainty and change inherent in this field, because no one has fully worked out the best way to manage cybersecurity.

The book concludes with cybersecurity conflicts and futures: scenarios to provoke thought on how security—and your career—might change.

Notes

1 See https://www.cyberseek.org/heatmap.html.

2 See https://perma.cc/7QQW-M2VS.

I
What Is Cybersecurity?

1 What Is Cybersecurity?

1.1 What Is the Cyber in Cybersecurity?

1.2 What Is the Security in Cybersecurity? The “CIA” Triad

1.3 Encryption Is Critical in Cybersecurity

1.4 Cyberpower: How Insecurity Empowers and Undermines Nations

1.5 Is Disinformation a Cybersecurity Concern?

1.6 International Views

1.7 Conclusion: A Broad Approach

2 Technology Basics and Attribution

2.1 Technology Basics

2.2 Attribution

2.3 Conclusion: An End to Anonymity?

1.
What Is Cybersecurity?

Chapter Image: François Morellon La Cave and Nicolas Vleughels, The Shield of Achilles (18th Century).

Source: FG Waller Fund/Rijksmuseum Amsterdam/Public domain/
http://hdl.handle.net/10934/RM0001.COLLECT.413649.

Chapter Learning Goals

What is cyberspace?

What is cybersecurity?

How do concepts of confidentiality, integrity, and availability relate, and are these concepts expansive enough to encompass cybersecurity concerns?

What is encryption and why it is a central technology in cybersecurity?

What are the politics of labeling a challenge a “security” problem?

What is cyberpower?

What does it mean to conceive of information problems like disinformation as a security problem?

This chapter discusses key framing questions: What are the contours of cybersecurity? How do different stakeholders understand cybersecurity and how may these conceptions conflict? Are there principled ways to bound cybersecurity? As we surround ourselves with networked technologies, does cybersecurity become a universal form of public regulation? How should we manage the phenomenon that as we see Internet communications through a security lens, we tend to downplay concerns about due process and free speech?

As these questions make clear, we cannot understand cybersecurity without also studying other disciplines. There are risks from a blinkered approach: those who ignore the larger contexts may be analyzing some element in cybersecurity, but they are not seeing the whole picture.

There are other reasons to pursue a multidisciplinary approach. Multidisciplinarity is important for understanding cybersecurity and for understanding other actors in the field. In cybersecurity, experts from different disciplines agree on facts and yet come to different conclusions about implications and policy impact. We will visit examples of disciplinary disagreement throughout this text.

Cybersecurity is an unbounded problem that cannot be cleanly extricated from an array of other social problems and interests. What this means is that cybersecurity has to be managed. In fact, cybersecurity will never be “solved.” Instead, concerns about whether we can trust devices, networks, and the information present in them will persist and we will need to adjust to manage the problems that arise.

Cybersecurity professionals need to be flexible. In managing cybersecurity, one finds few approaches that all stakeholders accept as good. Instead, one finds that management approaches must accommodate competing interests and values. This means that leadership and even management positions in cybersecurity require soft skills, such as negotiation and compromise, as much as hard skills, such as programming and technical design.

In formal terms, cybersecurity exists in a conceptual category known as a “social mess” or “wicked problem.”¹ Problems of this type tend to have common elements, such as a lack of structure, unclear boundaries, and dynamic effects that require adjustments to policies. Cybersecurity’s deep complexity, its “messiness,” requires it to be understood in different contexts.

Definition 1.0.1 — Wicked Problem. A wicked problem or “social mess” is a kind of challenge characterized by contradictory and changing requirements. Such problems are insoluble or difficult to solve. Yet, such problems can be decomposed into smaller, more tractable challenges.

Whether one approaches cybersecurity from the lens of the military or from that of an ordinary user will skew the conception of cybersecurity problems, the fit of solutions, and the balance of compromises among important values embedded in communications systems. We believe no single discipline or profession can bring cybersecurity problems to heel.

1.1 What Is the Cyber in Cybersecurity?

The very definition of cybersecurity is unclear and shifting. Understanding cybersecurity requires a discussion of what cyberspace and security might mean. Here, we explain the complexity and tradeoffs involved in defining cybersecurity’s contours (Table 1.1).

Let’s start with the term cyberspace. This term is dated, but we are stuck with it. Cyberspace is a dominant social, economic, and even emotional force in our lives. Cyberspace is an artificial, highly complex, human creation. Thus, cyberspace changes with time, and those changes will have political, economic, and social consequences.²

Cyberspace is broader than just the Internet, but a discussion of the Internet is helpful to define the larger, growing concept of cyberspace.

At the highest level, the Internet can be thought of as decisions by people to connect their computers to each other. Instead of a local network or a private network used by a single corporation, the Internet is a network of publicly available networks. This means the Internet is both publicly and privately owned by communications companies (AT&T, for instance), governments, content companies (from the New York Times to Google), and even by homeowners in the form of their personal computers. This mixture is not static; it is ever changing as people connect devices to the public Internet. If you buy a camera today and connect it to the Internet, you have just embiggened the Internet.

Table 1.1 Competing definitions of cyberspace sometimes include the user and a concept of how information shapes users’ ideas.

United States Department of Defense, DOD Dictionary of Military and Associated Terms (2021)
“A global domain within the information environment consisting of the interdependent networks of information technology infrastructures and resident data, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers…”

Israel Government Resolution 3611, Advancing National Cyberspace Capabilities (2011)
“…the physical and non-physical domain that is created or composed of part or all of the following components: mechanized and computerized systems, computer and communications networks, programs, computerized information, content conveyed by computer, traffic and supervisory data and those who use such data.”

The Ministry of Foreign Affairs of the Russian Federation, Convention on International Information Security (2011 draft)
Russia styles cyberspace as an “information space,” defined as “the sphere of activity connected with the formation, creation, conversion, transfer, use, and storage of information and which has an effect on individual and social consciousness, the information infrastructure, and information itself.”

National Research Council/National Academies
“…the artifacts based on or dependent on computing and communications technology; the information that these artifacts use, store, handle, or process; and how these various elements are connected.”

This might sound banal, but extraordinary abilities to communicate and control emerge from these connections. We will revisit these powers as “network effects” later in the text. Under the most limited definition of cybersecurity, different networks, their servers, and connective media (from fiber optic to satellite carrier signals) are the “cyber” of cyberspace.

Question 1.1.1 — Technological Change. Can you think of an innovation or new service that will fundamentally change how people use the Internet? What new security implications might it raise?

▄

The early consumer Internet was dominated by companies that provided access to walled-garden style services (we seem to be returning to this today in the form of Facebook/Meta and various apps that cabin the user). Membership in early service providers CompuServe or Prodigy meant a connection to many thousands of other users, news, and even in-network email, but initially, these services did not connect users to what most think is the Internet—the World Wide Web (Web). Instead, users stayed within the offerings provided by the service. These were private networks.

Definition 1.1.1 — Walled Garden. Closed-platform security approaches called “walled gardens” restrict users to certain content, applications, or devices.

The Web emerged in the early 1990s and it competed with private networks such as America Online—in fact, the private network companies portrayed the Web as dangerous and licentious. Companies like America Online claimed to offer a safer, walled-garden experience.

Definition 1.1.2 — The Web. The World Wide Web is an Internet information system typically accessed through a web browser.

Most people think the Web is the Internet. And most people spend most of their Internet time on the Web. But it is important to know that the Web is just one application of the Internet.

Consider How Technological Change Alters “Cybersecurity”

As a human invention, cyberspace is not a static thing. It changes and, as a concept, has grown. Consider how its changes have widened the scope of cybersecurity, and how future changes might alter our sense of what is needed for cybersecurity.

Dialing in The early private “walled gardens” and early Internet required users to take action to connect, by dialing in, using a modem connected to a phone line. Nowadays, most users are connected by default, providing attackers with more opportunity to exploit our devices when they are constantly on and connected to the Internet.

Evolving connections Early Internet users connected by phone line, later by cable TV service, fiber optic cable, wireless (LTE and 5G), and satellite. Each change in physical media changes the risk landscape in cybersecurity and incorporates new actors in the cybersecurity mélange. For instance, with the advent of wireless and satellite connections, computer security has to contemplate radio-frequency attacks, solar flares, and even outages caused by rain or other environmental factors.

The cloud Cloud computing enabled users to outsource—that is, use someone else’s computer—for their data storage and processing. This means user data is controlled by third parties that, on the one hand, may be more expert in security than the average user, but, on the other hand, the cloud company becomes a more enticing target for attackers because of massive centralization of user data.

Internet of things (IoT) Cybersecurity reaches into every aspect of our lives as we connect a wide variety of devices, from light bulbs to door bells to “smart” refrigerators, to the Internet. These devices typically are inexpensive and many are vulnerable to attack, and, in turn, they can be organized into botnets to infiltrate networks and attack other services. One disturbing trend is that many devices do not allow users to opt out—for example, a “smart” stove might not function correctly without an Internet connection, even though Internet connectivity clearly isn’t required for a gas oven to bake something.

Apps Apps often make functions on mobile phones more convenient. But every installed app gives adversaries new “threat surfaces” to attack. Many apps are accidentally insecure, but some are deliberately so in order to enable spying on the user!

Body-wide networks In what Andrea Matwyshyn has termed the “Internet of bodies,” people may eventually have a network of corporeal devices. Thus far, devices like fitness trackers just collect data, but in the future, computer–brain interfaces and other devices may act on data by affecting the physical functions of the body.

Dominant platforms As vendors gain dominance and serve many clients, they become attractive targets of hackers—single points of failure that enable compromises at scales impossible before computing. For instance, imagine if the most widely used word processing software were compromised. Pretty much every institution in the world might be affected.

Spread of Internet Protocol (IP) Legacy devices—from industrial control systems to decades-old satellites—are moving from proprietary software systems to IP. With the transition to IP, it becomes easier to attack these systems because vulnerabilities are more general and more well known than those in obscure legacy systems, most of which were never designed to be connected to a broader network.

In the early days of the consumer Internet (the 1990s and early 2000s), users “went online.” That is, they took some affirmative step to connect a device to the Internet, typically by using a phone line to connect a computer to an Internet service provider. Thus, decades-old phone networks, then cable television, fiber optic, and then wireless phone access became key mechanisms to reach the Internet, each raising new cybersecurity concerns. As companies develop satellite-based broadband for consumers, that infrastructure will also become a fundamental part of cyberspace.

Nowadays, we are constantly connected to the Internet, perhaps through several devices and through various ways of connecting.

Question 1.1.2 — Real World Versus the Virtual World. Do you consider the “real world” to be different than your online experiences? If so, why? If not, what key factor would have to change in order for you to consider cyberspace as being completely integrated with your existence?

▄

So, what is cyberspace? As important as the concept is, there is no international consensus defining its exact contours. Different nations conceive of cyberspace differently, and this can lead to different policy outcomes.

1.1.1 Cyberspace’s Places and the Problem of Internet Sovereignty

Whatever cyberspace is, it exists in “places.” That is, the constituent parts of the Internet are physical devices that exist in physical places. When we use the Internet, data originate in a physical place: in a computer that runs in a specific nation-state. As data traverse the world, the data are copied at other places.

The Descriptive and the Prescriptive

Cybersecurity presents difficult public policy issues that are challenging to discuss. Just take the debate surrounding racist hate speech. Some think hate speech is a cybersecurity problem, because it can foment violence and thus undermine collective security. Others might oppose such framing, for fear that efforts to suppress hate speech will result in dangerous forms of censorship.

Our models for engaging in such a debate are poor, even debased. On television, we see exemplars that model argument as personal, on both left- and right-wing news shows. These models may be entertaining, but they are often not enlightening. Instead, we must seek to understand other people; not just their arguments, but also the assumptions that they operate from. We ought to make arguments with evidence. We should never make policy discussions personal, in part for pragmatic reasons. We all disagree some of the time, but to be effective in a work environment, we need to build coalitions among people who cannot always agree.

There are several techniques to engage a difficult question without personalizing the argument. One key approach is to distinguish between description and prescription. That is, we should start by analyzing the communicative intent of a speaker. Is the speaker attempting to describe a situation, that is, state what the situation is? Many listeners hear a descriptive narrative and mistakenly believe that the speaker endorses the narrative.

A prescriptive or “normative” account is different than a descriptive one. When a speaker prescribes, they say what they think the world should be like. For instance, in an academic article, an author may start out with a dispassionate description of a phenomenon, but later in the writing, make a normative argument (an argument that uses norms) to prescribe how the phenomenon should be dealt with.

We suggest the following approaches to have civil discussions:

Understand intent Start from the presumption that we are all earnest, participating with goodwill, and persuadable. Is your classmate intending to describe or prescribe?

Understand the different uses of words Are you certain that you understand others’ uses of words? Could key terms have a different meaning to others? You can start by just asking, what do you mean by “x”?

Understand assumptions Might the other have fundamentally different assumptions about the world? Disagreements over core values, such as the bounds of “personal responsibility,” may underlie higher-level positions about policy.

Seek to understand before arguing Before you counter a description or prescription, ask yourself: have you taken the time to understand it? Can you restate another’s argument accurately and charitably?

Argue with evidence Once you understand the other side, marshal evidence to argue. Identify whether your evidence challenges the descriptive or the prescriptive account.

Be humble No one knows all the facts and no one has universal experiences. Reflect on times that you have been wrong. It’s okay to be wrong; the world won’t end!

People are not their arguments People can change their minds. And one thing this book will make clear is that even if you disagree with someone on a certain issue, there may be other areas where you can work together. Don’t allow a disagreement on x stop you from collaborating on y.

Understand that people often cannot change their mind in the moment Argument is a process that changes minds over time. In the moment, one may not be able to just immediately change their mind. One might need to reflect and interrogate one’s ideas in private. The need to maintain dignity might cause people to appear to be inflexible during an argument. Remember: it’s a brave act to say “you know what, now that I’ve considered your point, I was wrong.”

Turning back to racist hate speech, imagine how this method could de-escalate an otherwise contentious disagreement. One might find that everyone agrees on the descriptive account that hate speech is dangerous and stokes violence. Evidence instead of emotion could be marshaled to support the extent of the danger. The participants might ultimately disagree about the prescription for hate speech, but we can find common ground in its description and in our assumptions.

Some conceive of cyberspace as placeless, as a kind of abstract layer that emerges from the physical components of the Internet. For instance, science fiction writer William Gibson wrote about cyberspace as a “mass consensual hallucination.” Many civil libertarians adopt this “nonspace” metaphor for cyberspace in order to remove the Internet from the traditional power rationale of states: physical jurisdiction.

Yet, the framing is deceptive for a reason that is obvious today: the Internet cannot function without a physical reality nor can it work without complex agreements among nations for interconnecting networks. The physical reality of the Internet means nations can degrade, deny, disrupt, and even destroy the Internet.

The Internet sovereignty nations, such as Russia and China, use geography to police the Internet. Internet sovereignty nations attempt to control the Internet by using power over infrastructure to control content. In this way, Internet sovereignty nations are pursuing information security goals rather than computer security ones. For instance, a nation may favor a domestic competitor or it may even require a foreign competitor to house user data in-nation so police can easily access records and data.

Definition 1.1.3 — Internet Sovereignty. A series of legal and technical requirements that vests control over computers, networks, or data based on geographic borders. The goal of these nations may be to secure information rather than computers, networks, and data.

Many Internet sovereignty states are kleptocracies with values and worldviews different from western governments. Western governments hope kleptocracies will liberalize if exposed to western values and marketplaces. However, kleptocratic leaders may care more about local control than enriching or improving their country. Keeping up the struggle against the West may itself be rewarding, as it solidifies their power and relevance even as citizens suffer.

The Internet sovereignty states have learned to use language that sounds as if they are advancing individual human rights and freedoms to advocate for more local control over the Internet. That is, kleptocratic nations like Russia will invoke local self-determination and the value of decentralization—notions supported in principle by civil libertarians—to argue for more control over Internet governance. It is important to recognize that the language may be classically liberal, but the intent is illiberal. The Internet sovereignty nations intend to use local Internet governance to “secure” their citizenry from information these nations do not like—this is cybersecurity as censorship.³ At the same time, these same nations use disinformation to undermine democratic norms.

The Internet sovereignty debate leads to a paradox. Cyberspace as a “nonplace” is nonsense from a technological perspective. But from the perspective of political economy, understanding cyberspace as a nonplace, one not subject to Westphalian sovereignty (meaning, each nation has exclusive sovereignty over its own territory), may be a good hedge strategy to promote freedom. If any nation can exercise control of the bits that traverse its borders, we could find ourselves with a censornet, with China, Iran, or Russia filtering political discussion, the United States filtering copyrighted content, and other nations blocking pornography and so on. Thus, believing in a placeless cyberspace is a useful political myth that might promote more collective freedom. It is as Elliott Smith once said: a distorted reality is now a necessity to be free.

Exercise 1.1 — Cybersecurity in China, Iran, and Russia. How do the government leaders of China, Iran, and Russia conceive of “cybersecurity,” and are their conceptions congruent or incongruent with the discussion in this book? To answer this question, your instructor will divide you into three groups.

Group A Focus on China. Please read this article and be prepared to present the motivating logic of “cybersecurity” to the Chinese: Lindsay JR. The impact of China on cybersecurity: Fiction and friction. International Security 2014; 39:7–47 available at https://perma.cc/E86Y-UE9G a

Group B Focus on Iran. Please read this article and be prepared to present the motivating logic of “cybersecurity” to the Iranians: Eisenstadt M. Iran’s Lengthening Cyber Shadow. Washington Institute for Near East Policy, 2016 available at https://perma.cc/P3QE-LG2F

Group C Focus on Russia. Please read this article and be prepared to present the motivating logic of “cybersecurity” to the Russians: Connell M and Vogler S. Russia’s approach to cyber warfare (1rev). Technical report. Center for Naval Analyses Arlington United States, 2017 available at https://perma.cc/E2PC-98S2 b

As you prepare for class, here are some sample questions you should be ready to discuss. At the highest level, these questions probe the “why” (why does the nation use cyber) and the “what” (what are the capabilities) of the studied nation.

What are the highest-level policy issues that shape your assigned nation’s use of cyber attack and defense?

What are your assigned nation’s policy priorities in cybersecurity?

What are your assigned nation’s biggest threats (i.e., what is the threat model—only focus on strategic-level threats, the kind that could destroy a nation)?

How much offensive cyber does your country use?

What are the most clever attacks used by your assigned country? What do these tell us about the nation’s capabilities?

The China–Iran–Russia articles are aging. They are the most teachable articles we can find on the subject. Are there relevant developments we should discuss that update these articles?

▄

a Optional reading: An important, lengthy work in this space is Liang Q and Xiangsui W. Unrestricted Warfare. PLA Literature and Arts Publishing House, 1999 available at https://perma.cc/PDG9-ZYJ2. This 1999 work written by two PLA colonels contemplates how China—technologically inferior to the United States—might nevertheless develop a series of new conflict techniques to overcome American power. Much of the book’s argument can be understood by just reading its 8th chapter.

b Optional Readings: for those who want to go deeper on Russia, here are the documents that define the so-called Gerasimov Doctrine. If you read Russian, the original report is Gerasimov V. The value of science in prediction. Military-Industrial Kurier 2013; 27 available at https://perma.cc/D7QR-HBFX. Two commentaries are valuable: Bartles CK. Getting Gerasimov right. Military Review 2016; 96:30–38 available at https://perma.cc/HZ6V-2935 and this translation with commentary by Russia expert Mark Galeotti: https://perma.cc/AXS5-85Y9

Now that we have considered the changing thing/nonthing that is cyberspace, we can turn to the “security” of cybersecurity.

1.2 What Is the Security in Cybersecurity? The “CIA” Triad

Traditionally, computer security focuses on the confidentiality, integrity, and availability of computers, data, and networks. This is known as the Confidentiality–Integrity–Availability (CIA) triad. Each CIA value has broad and narrow interpretations.

Definition 1.2.1 — The CIA Triad. There is a widespread consensus that computer security should seek to protect confidentiality, integrity, and accessibility.

Confidentiality could be thought of narrowly as secrecy, or more broadly as the set of rules surrounding who is authorized to access information. In either conception, security overlaps with privacy concepts about selective disclosure of information.

Confidentiality’s different interpretations make it an ambiguous term. To lawyers, confidentiality refers to a legally protected interest that imposes duties and can be enforced with penalties. Under a legal approach, the purpose of disclosure matters a great deal. Confidentiality might allow liberal disclosure of information, yet the information would still be considered protected. For instance, a doctor might disclose medical information to other doctors, to insurance companies, and to pharmacies for treatment purposes without violating confidentiality. But gossiping about a patient does not serve the purpose of treatment and is a violation of the duty of confidentiality.

To computer scientists, confidentiality can mean something very narrow: whether information is secret or not.

Question 1.2.1 — Injuries from Confidentiality. What injury does a person suffer when an unauthorized person obtains confidential information? What if the attacker obtains the data, but does not realize it, or never reads or looks at it? How about this: what if an attacker obtains confidential information, and then posts it somewhere online for others to see. Have those other people who looked at the stolen information wronged the victim?

▄

Integrity refers to the quality of data. Integrity can be conceived of narrowly as data free from corruption. In this sense, integrity means data have not been deleted or altered in a way that is inconsistent with the expectations of the data’s owners.

Broader conceptions of integrity also bring in privacy and data protection interests. From a privacy lens, the word “integrity” includes concepts such as whether data are accurate. Thus, even if an attacker did not change the data, integrity could be poor if the data were inaccurate. Relatedly, integrity can pertain to whether data are up-to-date (data might be too old to be used) and whether the data are relevant for some use (for instance, to decide whether to issue credit to a consumer) (Table 1.2).

Question 1.2.2 — Injuries from Integrity. What injury can a person suffer when an unauthorized person changes data? Is this worse than confidentiality attacks?

▄

Table 1.2 With the triad in place, we can discuss attacks as affecting just one or more of the interests in data and services. But are these concepts expansive enough to address society’s concerns?

Confidentiality
An attacker might obtain access to information meant to be secret to a small group of people.

Integrity
A malicious program might subtly change values in spreadsheets or other documents, resulting in difficult-to-detect business disruptions or failure of a kleptocracy’s ICBM program.

Availability
An attacker might use a “denial-of-service” attack to make it impossible for legitimate customers to reach an e-commerce website. Ransomware, special software that blocks access to a computer until a ransom is paid, is now a major problem for businesses, governments, and even hospitals that need to service patients.

Extortion through computing
As a variant of a confidentiality concern, an attacker uses data perhaps stolen from a personal device to extort another person. Even lawful, socially acceptable private information could be used to extort. Imagine, for instance, an attacker who captures a couple’s self-filmed video of a sex act and threatens to send it to coworkers.

Media influence
As a variant of an integrity attack, smart actors inject false information or outright lies in order to magnify certain opinions or notions about the world. They may also pay others to do the same as “influencers.”

Corporate control
Confidentiality concerns arise from foreign ownership of certain kinds of Internet infrastructure, such as Huawei’s 5G networking equipment or even foreign ownership of a data-intensive company that might reveal citizens’ private and potentially compromising activity, such as the social media app Grindr.

Finally, availability is concerned with whether computers or services can be accessed in an expected, timely fashion by users. Historically, availability attacks are quite common. In such an attack, the attacker makes it impossible for users to access a computing resource or important data. An example of an attack on availability involves generating large amounts of requests to overwhelm a company’s web server, making the server nonresponsive to customers. This is known as a denial-of-service attack and can be ruinously disruptive to a business.

Question 1.2.3 — Injuries from Availability. Can you think of recent computer attacks that involved availability?

▄

Question 1.2.4 — The Limits of the Traditional Model. Computing is everywhere. Increasingly, computers collect data on their own and make sense of the information. Systems of such computers could soon be entrusted with our safety. For instance, self-driving vehicles use computer vision, LiDAR, and other devices to make sense of the world, make decisions about it, and then move a two-ton vehicle in the presence of pedestrians and bicyclists.

As computers are directly responsible for sensing and sense making, there will be new ways to “hack” them. For instance, suppose a city uses a sophisticated set of sensors to manage traffic. Could you imagine ways that such systems could be attacked without a computer?

▄

1.2.1 The Internet’s Threat Model

Threat modeling is an important step in considering security risks. Threat modeling is a process where one considers likely adversaries, their motivations, their capacities, and one’s own vulnerabilities. By carefully exploring these factors, one might better anticipate and respond to computer attacks.

Let us clarify some definitions first:

Vulnerability  A vulnerability is simply any weakness in a system. Vulnerabilities can be technical (e.g., a bug in software) or procedural (e.g., a terminal that does not log out when the user walks away from the computer). Vulnerabilities can be known or unknown. All systems are vulnerable in some way, but this is okay, because not all vulnerabilities can be used by an attacker. To take a physical security example, almost all locks can be picked; they are vulnerable to opening by a nonauthorized person.

Threat  A threat is anything that can imperil CIA. Threats can be intentional (e.g., an attacker who hacks a vulnerable system) or unintentional (e.g., a user who loses a laptop) or even natural (e.g., a weather event that floods a server room and damages it). Actors who threaten CIA can be motivated by ideology, financial greed, or just maliciousness. Threats to computers can come from nonelectronic means. For instance, a threat actor may pick a lock in order to gain physical access to computers in a server room or communications facility.

Exploits  Exploits are tools or techniques that take advantage of a vulnerability. The concept of exploits is confusing because the word can be used as a noun or verb, but here we use exploits as a noun: Exploits are tools or techniques that make it easy to take advantage of a vulnerability. Thus, exploits make vulnerabilities more dangerous because they transform the potential for an attack into a concrete plan. To return to the physical example of lock-picking, lock-picking tools and mechanical “pick guns” are exploits. These exploits intensify the probability of an attack because anyone—even someone who does not understand how locks work—can open a locked door in seconds with a pick gun.

The designers of the Internet contemplated threat models and chose an approach suggested by the intelligence community (IC), since almost all the inventors of the Internet were entangled to various degrees with the IC. In his discussion of designing a next-generation Internet, David Clark recounted how early Internet designers relied upon contacts within the IC for their initial Internet threat modeling.⁴ According to Clark, two salient principles emerged: endpoints should be the focus of security (because it was hopeless to provide security for the voluminous infrastructure between endpoints) and endpoint security had to resist nation-state-level determination and ingenuity. Endpoints here mean the computers that users own and control. Today’s endpoints include your laptop and mobile phone.

Definition 1.2.2 — Endpoint. Internet endpoints are devices that communicate through a network. Endpoints include laptops, mobile phones, servers, and IoT devices.

Definition 1.2.3 — Intelligence Community (IC). Today, the IC refers to a group of federal bodies—military and executive agencies—that develop forecasts and assessments in support of national security and foreign policy.

The IC threat model has had a profound effect on today’s Internet. The result of the emphasis on endpoints is that there is little trust for confidentiality and integrity “in the network.” That is, the various routers and networked devices that relay our communications could be owned and operated by anyone. These devices are notoriously, stubbornly insecure for legal, economic, and political reasons.

To address this trust gap, even ordinary users protect data with encryption at endpoints (for instance, when their Internet browser encrypts a session between their home computer and their bank), and then send this information over the untrusted public Internet.

This encryption was not as widely available in the past. And so, practically speaking, many users sent information over the Internet without encryption, allowing even the most unsophisticated surveillants to peek at it. From the IC’s perspective, the threat model nevertheless made sense because it faced different adversaries than most users. The IC was primarily concerned with high-resource nation-state attackers and defenders sophisticated enough to use encryption.

Definition 1.2.4 — Threat Modeling. Threat modeling can be simply summarized as a process where engineers imagine “what could go wrong” with a system. Threat modeling includes the process of identifying likely adversaries and their motivations. In computer security, the STRIDE framework is often used. STRIDE stands for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.a Attackers can “spoof identity” by logging in as another user. Attackers can tamper with data by modifying it or deleting it. Repudiation threats are situations where a user can deny they have taken some action; this is a failure to prove who has done what on a system. Information disclosure threats are the traditional confidentiality problems of the CIA triad. Denial-of-service attacks make it impossible for valid users to gain access to data or a program. Finally, elevation of privilege attacks are where a user gains “superuser” status or otherwise gains more power to use a computing system than they should.

a Shostack A. Threat Modeling: Designing for Security. John Wiley & Sons, 2014.

How Well Has the IC’s Threat Model Aged?

The IC threat model barely fits consumer and business Internet user needs. Most users do not have the resources or the level of commitment to take proper precautions, such as encrypting individual emails or dutifully using a VPN, and thus operators of the public Internet can surveil both the traffic data and sometimes the content of users’ activities.

It is not even clear whether the IC threat model serves the IC—now we know that mere traffic metadata can both be identifiable and reveal content of user activities. Much can be inferred from the IP addresses users visit, the ports used, and the size of the content transferred from a service. For instance, assume metadata reveal that a user visited a medical website on port 443 (signaling an encrypted communication), downloading a webpage of exactly 856.4 kb. One could then download every webpage on that medical website searching for the matching 856.4 kb-sized page. Turning to identification, the advertising technology industry has made many tools to link individuals to the IP addresses of their homes, and even to match them when they switch devices.

Ordinary businesses and consumers also have different, less-resourced, relatively unsophisticated, and nearby adversaries. Ordinary businesses’ threat actors tend to be financially motivated. For most ordinary people, daily confidentiality threats come from close contacts, such as a lover or employer. These adversaries may be dangerous (motivated by jealously or maliciousness) but also unsophisticated. Thus, they could be deterred by the weakest forms of encryption, perhaps even rotate-1 (also called ROT1—a cipher that involves substituting each character in the alphabet with the one following it, wrapping around at “Z”; e.g., “A” becomes “B”, “C” becomes “D”, …, “Z” becomes “A”.)

The word “cybersecurity” appears hundreds of times in the United States Code. Yet, it is never directly defined. Congress uses the word to describe programs but without precisely explaining what it means. Congress, however, has provided some contours:

Cybersecurity mission  The Cybersecurity Enhancement Act of 2014 defines cybersecurity mission as “activities that encompass the full range of threat reduction, vulnerability reduction, deterrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network operations, information assurance, law enforcement, diplomacy, military, and intelligence missions as such activities relate to the security and stability of cyberspace.” 15 U.S.C. §7421(1).

Cybersecurity threat  The Cybersecurity Information Sharing Act of 2015 defines cybersecurity threat as …“an action, not protected by the First Amendment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system.” 6 U.S.C. §1501(5)(A).

Cybersecurity risk  The Homeland Security Act of 2002 defines cybersecurity risk as “threats to and vulnerabilities of information or information systems and any related consequences caused by or resulting from unauthorized access, use, disclosure, degradation, disruption, modification, or destruction of such information or information systems, including such related consequences caused by an act of terrorism.” 6 U.S.C. §659.

In summary, one might conclude that cybersecurity, like the concepts of justice and democracy, does not have a precise definition, in part because cybersecurity must change to address an evolving set of technologies and our own perception of what factors endanger our security. As networked communications and its infrastructure become ubiquitous, so too does the scope of concerns conceived of as cybersecurity issues. Today, we may be primarily concerned about websites and services like online banking. In the future, cybersecurity might be refocused upon devices that manage our bodily health. As cybersecurity professionals, we must operate with a changing definition of cybersecurity.

Question 1.2.5 — Who Is a Threat?. Organizations typically prioritize outsider threats, that is, attacks by criminals, governments, and perhaps even their own customers. Insider threats come from one’s own employees. Can you think of industries or companies where insider threats may be more worrisome than outsider ones?

▄

1.2.2 Computer Security Versus “Cybersecurity”

The “Copenhagen School” developed critical security studies, a field that explores what “security” is in a political sense. One of the Copenhagen School’s most important thinkers, Ole Wæver, recognizes that in history, security was the field where “states threaten each other, challenge each other’s sovereignty, try to impose their will on each other, defend their independence…”⁵ Wæver continues, “the basic definition of a security problem is something that can undercut the political order within a state and thereby ‘alter the premises for all other questions.”’

Wæver’s high bar for security—those problems so severe that they change our assumptions about other questions—helps us focus on the most important challenges to society. But consider this: Societies are so complex and interdependent that many issues seem to imperil the political order. For instance, environmental destruction creates refugees that flee and create tensions, even wars. Globalization makes it easier for nations to steal each other’s intellectual property, thereby endangering the economic security of creators. Even foreign propaganda now seems to imperil the politics of all free nations. Wæver’s work attempts to respond to the proliferation of nonmilitary and yet serious social issues that we refactor into security problems.⁶

Definition 1.2.5 — Securitization. A concept from international relations, securitization is the process by which actors convert a social problem into a security problem, thus enabling extraordinary—even illegal—means to quell the problem.

Wæver and others see securitization as a process constituted by speech acts, where powerful people (securitizing actors) attempt to persuade the public that a problem is a security issue. For instance, in Europe, politicians clamor to make refugee migration a security issue, but migrants could just as well be seen as a public health or humanitarian issue. Securitization tests when the public is convinced to embrace security-like interventions for the problem.

Securitization formally requires a thing to be secured, what theoreticians call a referent object.⁷ For instance, in environmental security, a specific dam or the purity of water in a river might be the object to be protected against ruin, whether accidental or intentional. The theory also contemplates “functional actors,” the people who are entrusted to manage the referent object. For our imperiled dam, that would be the dam’s regulators, owners, and operators.

Definition 1.2.6 — Referent Object. The referent object in securitization is the thing or interest that actors intend to protect.

We are less interested in the speech act elements of securitization than the normative critique of security levied by Wæver. Wæver rightly noted that security has its own logic of threat–vulnerability–defense, an instinct that can trample civil liberties.⁸ As Wæver and colleagues put it, securitization legitimizes “the breaking of rules.”⁹ To be clear, securitization is a pejorative term. Wæver is warning the public that security approaches can be abusive.

At the same time, as sociopolitical changes occur and technology changes our lives and economies, security has to evolve. Throughout history, societies have used their militaries as police forces. The feudal system had knights. The early middle ages used the “hue and cry” (essentially, calling on bystanders to assist in the apprehension of a suspected criminal). For the past two centuries, border control has served as a security measure to protect populations from threats. All of these security approaches were imperfect, even abusive, in different ways.

We cannot use the policies of previous millennia and centuries to secure people nowadays, because we have the Internet. Historically, security protection was based on physical space and jurisdiction. But the Internet obliterates borders in some respects, and enables hostile, foreign powers to affect people regardless of distance. The Internet presents central challenge that requires new forms of security.

Philosopher Helen Nissenbaum nicely applies securitization theory to cybersecurity. Her article, an elegant and classic piece, explains that the purpose of cybersecurity is ambiguous.¹⁰ The two meanings of cybersecurity can be separated into a technical field (the CIA of computers and networks) that is distinct from a broader, collective interest in security. Nissenbaum suggests that the difference between the two is one where policy diverges from a rights-securing approach into a security state approach.

At the core of Nissenbaum’s argument is the problem of referent object: just what exactly should we be protecting with cybersecurity? Traditionally, security is focused on the collective in the form of preserving the nation-state itself. That is, the security policy of a nation-state makes survival of the state itself the referent object, not any particular individual or business interest. But, security policies could make the referent object a sub-national community (a kleptocracy would make its inner political circle the referent object); a common good, such as the environment: or the well-being of the individual.

In Nissenbaum’s framing, technical computer security is concerned with the goals of defending computers and users from attacks. The computer is the referent object of security. On the other hand, cybersecurity has a more collective focus. Cybersecurity encompasses not just computer intrusion, but also concerns such as antisocial and pernicious uses of computers. Threats to critical infrastructures and the network itself get top billing.

The collective interpretation is concerning for two reasons: First, recall that securitization describes the process of convincing people that a risk is existential. Securitized risks, such as the prevention of terrorism,¹¹ become privileged, commanding public policy interests. When actors credibly invoke securitized interests in policy debates, competing interests—even rule of law—often must yield. Not only that, we entrust the management of security issues to executives and secretive centralized powers rather than courts and Congress.

Thus, security claims are powerful ones that override competing interests, often in situations with great deference and little transparency and, as a result, uninformed discussion and debate. Nissenbaum highlights how cybersecurity could erode liberal governance. Securitization is bound up in risk; we might think it protects us from adversaries, but what will protect us from ourselves?

Second, securitization implies the existence of a collective cybersecurity interest. However, articulating collective interests is fraught—the process naturally raises the question, “security for whom?” We may disagree about whose interests most need security, what the collective interests are, and whether these actors and interests are important enough to be imbued with the power of a security interest.

We can all agree governments have a moral duty to protect people from physical harm. But, as cybersecurity is invoked to secure interests untethered from the protection of individuals, its moral justification frays. Cybersecurity, as the exercise in this chapter on Russian, Chinese, and Iranian understanding of the term will show, may be invoked to promote economic protectionism, to protect intellectual property, to protect against emotional discomfort, or even to promote notions of national “harmony.”

Wæver himself is a security skeptic. His writing warned that security frames militarized thinking.

Question 1.2.6 — On Nissenbaum. To provoke thought about why Nissenbaum’s distinctions matter, consider what would be the difference between a Federal Computer Security Agency and a Federal Cybersecurity Agency?

▄

Nissenbaum helps us see how cybersecurity comes with certain political presumptions and forms. But others critique cybersecurity more directly in pointing out that some claims of security are merely risk-shifting. That is, security claims can just move risk from one population to another.

One common justification for security measures is the need to “balance” interests in security with civil liberties and privacy. This rarely is a balance in the sense of a weighing of values, but rather a plea to treat security as more important than competing values. There are indeed times when, as a technical or physical matter, we must abrogate some privacy or some freedom. But, in many cases, a political claim of security is lurking behind technical and physical claims.

Mireille Hildebrandt provides an insightful framework for evaluating security claims, which she argues should be presented as tradeoffs that include balancing elements: “freedom infringement impact assessments.”¹² Taking security tradeoffs seriously requires a modified cost–benefit analysis, one that likely will slow down the debate and more fully elucidate the values at stake.

In Hildebrandt’s framework, a security threat must be precisely articulated (e.g., a terrorist might smuggle a bomb onto a plane). Once articulated, measures used to counter the threat must be explicit in fit (modern airport security “puffers” can smell bomb ingredients—and illegal drugs), but also be shown to be effective. Hildebrandt invokes Jeremy Waldron to emphasize the point that many security measures are imposed without any real empirical examination of their efficacy. But, to be fair, such testing is difficult to do.

There is an important limit to the Hildebrand–Waldron critique: even identifying security interests can be difficult. Consider that on September 11, 2001, our collective model for airplane attacks was financially motivated hijacking rather than their use as missiles. Similarly, many “high-tech” cyberthreats appear seemingly out of nowhere as attackers probe and successfully exploit extremely complex systems in ways that defenders have never considered. We have to have a clear understanding of threats to react proportionately and with sufficient scope.

Hildebrandt, pointing to European tradition, argues that in order to have a real balancing, security incursions must be offset with legal accountability. Later, in this book, we expand on one such framework imposed by the European Convention of Human Rights (ECHR).

1.2.3 Security, Innovation, “Hacking”

In 1988, Cornell graduate student Robert Tappan Morris released a worm, a self-replicating software package, onto the early Internet. Morris’s intent was unclear; some reports indicate he was trying to measure the size of the Internet. Whatever his intent, an error in the code caused the “Morris Worm” to replicate much more quickly than the author intended, leading to Internet disruptions. Morris tried to remediate the infection, but it was too late. Reactions were panicked, and Morris was the first person convicted under a hacking law passed just two years earlier in 1986.

Morris is now Professor Morris, an MIT computer scientist!

The field of computer “hacking” abounds with anecdotes about curious, ingenious youths who break into systems—who break the law—and who later grow up to be fantastically successful, model citizens. Consider Apple co-founder Steve Wozniak. Wozniak was photographed in his college dorm room using a telephonic “blue box,” a device that circumvented the security of telephone networks, enabling free long-distance calls. Wozniak used the device to call the Vatican pretending to be Henry Kissinger!¹³ Along with Steve Jobs, Wozniak’s first business plan was to sell blue box devices—the duo wanted to go into business to help people make unauthorized phone calls!

To be clear, we could understand what Wozniak proposed to do as illegal network access and theft of services. The blue box emitted tones that manipulated the in-band signaling used in telephone networks of the day. In effect, these tones were passwords to make free calls, and in the days of the blue box, long-distance calls were fantastically expensive.¹⁴

Yet, we as a society have ambivalent feelings about “stealing” services. If Wozniak had created a technology that enabled one to eat at a restaurant and not pay the bill, the moral implications would be clear. But, when the theft of services is against a monopoly (the telephone company) where services have zero marginal cost (once the network is built, extra calls may in effect have no measurable cost to the telephone company), many of us think there’s no harm. In fact, in a criminal prosecution of one of the first phone network hackers, Lapsley relates, the judge sympathized with the defendant: “When I was a kid …we used to freeze water into the shape of nickles to put into pay phones to make long-distance calls. This is nothing more than a new and ingenious way to do the same thing. I can’t see making a big case out of this…”¹⁵

The word “hacking” itself reflects the ambivalence society has about transgressive experimentation. With a genesis in MIT’s Tech Model Railroad Club, “hacking” was used to describe the creativity—the mētis—necessary to work on and improve the club’s magisterially complex model railroad. In his classic history of the hacking phenomenon, Levy called hackers “heroes” of the computing revolution.¹⁶ In computer security communities, the word hacker has become celebrated, but this nuance may not be shared outside technical circles.

As we securitize computer security challenges, do we risk making criminals of our next generation of innovators? Imagine the social and economic loss if public policy in the 1980s put Steve Wozniak and Steve Jobs in jail instead of on the path to build Apple, at times the most valuable company in the world?

1.2.4 Security from a Private Sector Perspective

Thus far, our discussion has focused on national security viewpoints. The private sector’s relationship to cybersecurity is as important as it is nuanced. That is, the private sector is both deeply expert in cybersecurity and subject to different incentives than the public sector.

Security is a major focus and even source of expertise and excellence in some corners of the private sector. Specialist cybersecurity firms have deep wells of knowledge about attacks and attackers—often these companies know more about these topics than government agencies. Indeed, law enforcement, intelligence agencies, and militaries subscribe to information feeds from private-sector “cyberintelligence” firms to investigate attackers.

Companies that provide large-scale consumer services also know a great deal about attacks and these firms parry a majority of attacks against their systems. Some companies have an expansive view of attacks and have developed deepening protections for their users. Google and CloudFlare are two notable examples. The dominance of Google gives the company a huge aperture on Internet activities, and over time, Google has offered increasingly sophisticated security tools even to free-level users of its services. Similarly, CloudFlare can “see” a huge portion of the Internet; attacks that were crippling just a few years ago can be recognized and filtered by CloudFlare automatically. Again, free-level users can enjoy CloudFlare’s defensive shield.

On the one hand, the private sector can be seen as a source of excellence in cybersecurity, even outperforming traditional security actors like government agencies. But, on the other hand, outside specialist security firms, companies may simply see the security problem differently. After all, from a general business perspective, security is just one more risk that enterprises have to deal with. Security is not some sacred value. Security can be put at risk in the interest of business operations and moneymaking.

Businesses deal with risk in several different ways, including by accepting it (making the risk a potential operating expense), by mitigating it (lessening the downside of the risk), or by eliminating the risk (perhaps by solving the security problem or even avoiding some operations altogether).

Question 1.2.7 — Business Risk Mitigation. Can you think of examples where businesses mitigate, accept, eliminate, or shift risks?

▄

Author Hoofnagle has explained that “security” often falls into a fourth category: transferring the risk without mitigating or eliminating it. He argues that the performances used to secure credit card transactions, such as collecting a signature at the register, are in fact a liability-shifting regime. If the dramaturgy is successful, a credit-card accepting merchant can shift the risk of a transaction to another party (here, the credit card issuer). But, signature or not, the procedure does nothing to reduce fraud risk. The credit card signing ceremony is what Bruce Schneier calls “security theater,” a procedure that hassles people but in reality, is just a kabuki.¹⁷

Question 1.2.8 — Applying the Trade-off Analysis. Could you apply the questions in Table 1.3 to a contentious security issue? For instance, try applying the trade-off analysis for a physical security issue, such as when people carry a weapon, say pepper spray or a handgun, for use in self-defense. Does the framework challenge your initial opinion about carrying a weapon?

▄

Table 1.3 How might we replace security “balancing” with a consideration of tradeoffs? Mireille Hildebrandt offers some guidance. This table synthesizes arguments from Hildebrandt, Jeremy Waldron, and Bruce Schneier.

What is the security interest at stake? | Are we protecting confidentiality, integrity, availability, or physical safety? Or is the security interest something outside the traditional CIA triad, such as Facebook/Meta’s conception of “authenticity?”
How does the measure claim to promote security? | Might the security measure be ill-fitting, overly broad such that it empowers an actor disproportionally, or an example of Bruce Schneier’s concept of “security theater”—acting out a security protocol without actually securing anything?
Does the measure in fact promote security? | Evidence of efficacy is often missing from security measures.
Are people being asked to trade a good, an interest, or a right to accommodate security? | We may weigh these things differently, including when they are private or public (collective) goods, interests, and rights.
What are the costs of the measure? | Costs might include time, inconvenience, and infringements on fundamental rights.
How are the costs distributed? | Sometimes, security simply shifts risk from one party to another or imposes a cost on a certain sub-population (for instance, racial profiling shifts police attention to minority groups).
What is the incentive structure? | Those implementing the measure might have incentives to be too risk adverse.
Does the measure enable opportunism or guile? | Facebook asked users to provide phone numbers for security authentication purposes but then used the numbers for advertising purposes.
What are the knock-on effects? | If one party takes up the security measure, how are other parties likely to react?
What legal safeguards address costs, opportunism, and guile? | Immutable audit logs along with oversight, sunsetting security powers, and many other approaches might curb abuse and policy drift.
Political context | Is there real accountability for rule-breaking, or are formal legal rules a mask for autocracy?

1.2.5 Building on the CIA Triad

As cybersecurity challenges have intensified, policymakers have identified several other interests to add to the CIA model. Some add attribution to the model, meaning the ability to determine and prove responsibility for some online behavior (Table 1.4).

President Obama’s administration emphasized resilience as a cybersecurity interest. Resilience carries with it several abilities: the ability to recognize that a system has failed, the ability to operate even with degraded systems, the ability to recover quickly, and the ability to learn from cyberattacks. The embrace of resilience is a mature,¹⁹ pragmatic policy that recognizes that defenders cannot stop all attacks. The policy has radical implications that might upset moralists in the field. What resilience means is that even if an institution is attacked, it should still soldier on, rather than allow the attack to become an excuse for interrupted service.

Table 1.4 Contours and consequences.

Limit “cybersecurity” to Internet-connected systems | Limit might exclude air-gapped systems, such as Iran’s nuclear enrichment program, which was attacked in the Stuxnet/Flame/Olympic Games program.
Limit “cybersecurity” to intentional wrongdoing | CIA degradations can occur because of accidental coding mistakes or just incompetence. Consider that the UK’s report on Huawei technologies concluded that vulnerabilities were the result of company procedures rather than state interference.¹⁸

1.2.6 Cybersecurity Definitions

Table 1.5 presents several examples of cybersecurity definitions.

Table 1.5 Definitions of cybersecurity differ greatly among the most important stakeholders.

National Research Council/National Academies
Security in cyberspace (i.e., cybersecurity) is about technologies, processes, and policies that help to prevent and/or reduce the negative impact of events in cyberspace that can happen as the result of deliberate actions against information technology by a hostile or malevolent actor.

European Union Agency for Network and Information Security (ENISA)(Dec. 2015)
Cybersecurity shall refer to security of cyberspace, where cyberspace itself refers to the set of links and relationships between objects that are accessible through a generalized telecommunications network and to the set of objects themselves where they present interfaces allowing their remote control, remote access to data, or their participation in control actions within that cyberspace.

National Institute of Standards and Technology (NIST), NISTIR 7628
“Cybersecurity [for the smart electricity grid] must address not only deliberate attacks launched by disgruntled employees, agents of industrial espionage, and terrorists, but also inadvertent compromises of the information infrastructure due to user errors, equipment failures, and natural disasters.”

Palo Alto Networks
Cybersecurity involves protecting information and systems from major cyberthreats, such as cyberterrorism, cyberwarfare, and cyberespionage.

Question 1.2.9 — Cybersecurity Definitions. What gaps are left by the definitions in Table 1.5?

▄

Narrowing one’s definition of “cybersecurity” results in significant pruning of events similar to traditional concerns of information security experts.

Question 1.2.10 — What About Privacy?. How do the concepts of privacy and cybersecurity relate?

▄

1.3 Encryption Is Critical in Cybersecurity

Encryption is so central to protecting systems that it is almost synonymous with cybersecurity. We use encryption to protect both the confidentiality and the integrity of data.

Definition 1.3.1 — Cryptosystem. A cryptosystem is a set of algorithms for converting unencrypted messages (“plaintext”) to and from encrypted messages (“ciphertext”). The algorithms often ingest a set of keys that guide this transformation.

Both “classical” (precomputer age) and modern cryptography typically rely on sets of secret and shared information, including cryptographic keys and details of the cryptosystem in use. Classical systems differ from modern systems in many ways, but a very important difference is that most classical systems relied heavily on “security by obscurity,” where the details of the cryptosystem in use were kept secret. For example, one classical system in use in Ancient Greece that relied heavily on security by obscurity involved the use of scytales, which are wooden cylinders around which a strip of parchment is tightly wound. A message is written across the cylinder and then unwound and transported to the recipient. A recipient who is aware of the system and the diameter of the scytale can simply wrap the parchment around a scytale of the same diameter and read the message. The diameter of the scytale is the “key” in this method, but even without the key, if the details of the method are known, given the small number of reasonable diameters for the scytales, brute-forcing a solution is straightforward.

Another example is a simple substitution cipher like the Caesar cipher, which involves replacing each letter in the plaintext by a letter some fixed number of positions away in the alphabet, wrapping back around to “A”. For example, using a shift (a “key”) of 11, the plaintext “cybersecurityisfun” becomes “njmpcdpnfctejtdqfy.”

Many classical systems relied on a human to carry out the encryption and decryption processes entirely by hand. Moreover, they relied on the difficulty of brute-forcing a solution. While there was brief period where electro-mechanical devices such as the Enigma machine (used by the Axis powers in World War II) very significantly increased the strength of classical systems, with the advent of modern computers, most classical systems can be broken quite easily and therefore offer essentially no security at all. Another interesting difference exhibited by classical systems is that they typically operate directly on the symbols of human languages, e.g., letters like “A,” “B,” “C,” are translated directly into other letters or symbols.

1.3.1 Modern Cryptosystems

Unlike classical systems, modern cryptosystems like Data Encryption Standard (DES), Advanced Encryption Standard (AES), RSA, and elliptic curve cryptography operate on blocks or streams of bits or bytes, the native representations of data in modern computer systems.²⁰ Modern systems are also typically “open source,” in that the workings of the cryptosystem are made publicly available and may be scrutinized by experts around the world, to evaluate the security of the system against common (or perhaps not so common!) cryptographic attacks. Modern techniques also require enormous amounts of computation. Unlike classical systems, where humans essentially are the “computer,” only toy examples of encryption and decryption can be demonstrated by hand with modern systems.

Definition 1.3.2 — Cryptography. Cryptography is the study and practice of creating new cryptosystems.

1.3.1.1 Symmetric Key Cryptosystems

The DES is a symmetric key cryptosystem designed in 1973–1975 by IBM and released as a potential candidate for the United States national encryption standard in 1975. It became a federal standard in 1976–1977. It uses 56-bit keys, a controversial decision that was apparently a compromise to achieve “good enough” security while ensuring brute-force attacks by government agencies with access to enormous amounts of computational power remained at least theoretically possible. Modern computer systems can break DES in a relatively short amount of time and FPGA-based solutions are even available online. One of these, crack.sh, claims a peak speed of 768,000,000,000 keys per second and can brute-force the entire keyspace in about one day. Interestingly, a clever cryptographic attack called the “meet in the middle” attack, whose description is beyond the scope of this book, results in two rounds of DES being only slightly better than a single round. However, a version of DES involving three rounds of encryption—3DES or Triple DES—is still in use, as the use of three rounds increases security proportional to the use of a 112-bit key.

Definition 1.3.3 — Symmetric Key Cryptosystems. Symmetric key (also called “private key”) cryptosystems rely exclusively on shared private keys. A message encrypted with a specific private key can only be decrypted by someone in possession of the same private key.

Crypto “Backdoors”

Cryptosystems’ designs are public so that cryptographers can inspect them for errors. The system generally works, because there is a community of mathematicians and cryptologists looking for vulnerabilities in systems, and discovery leads to prestige.

Errors can be accidental or intentional. Errors may in fact be “backdoors,” deliberate system vulnerabilities that enable governments to decrypt data. A masterful intelligence agency might disguise an intentional vulnerability as a mere accident to gain access to cleartext, but would then also have to ensure it is the only agency that knows about the vulnerability.

Sometimes encryption is degraded through interference with the randomization functions in encryption processes. But, cryptosystems are complex and vulnerabilities could be introduced in many stages of the process. For instance, in 2019, two Russian-designed systems came under suspicion for having vulnerabilities in the “substitution box” process.a

a Perrin L. Partitions in the S-Box of Streebog and Kuznyechik. Cryptology ePrint Archive, Paper 2019/092. https://eprint.iacr.org/2019/092, 2019. Available from: https://eprint.iacr.org/2019/092

AES, another symmetric key cryptosystem, was designed by Joan Daemen and Vincent Rijmen and replaced DES as the United States standard in 2002. AES offers key sizes of 128, 192, and 256 bits. AES can be deployed on a wide variety of hardware, from low-powered smart cards or IoT devices to very powerful computer systems. Importantly, many modern CPUs have dedicated instructions to aid in the development of secure implementations of AES and also to speed up AES encryption and decryption operations. While there are some known attacks against AES that are faster than brute force approaches, there are no known practical attacks against AES that would allow an attacker to read AES-encrypted data. In fact, AES encryption using 256-bit keys is considered sufficient by the National Security Agency to protect TOP SECRET classified information and is the first “open source” encryption standard approved by the NSA for this purpose. In addition to offering more security, AES is faster than either DES or 3DES. It is also tremendously faster than public key systems like RSA, which we discuss next. AES is also thought safe against attacks that might be possible someday by large quantum computers.

1.3.1.2 Public Key Cryptosystems

RSA is one of the most widely used public key cryptosystems. Named for its inventors, Ron Rivest, Adi Shamir, and Leonard Adelman, RSA was released in 1977. While it is not the first working public key cryptosystem—other systems were discovered earlier and not made public—RSA has had a profound impact on secure communication. While we will not explore the math behind RSA in this book, it’s also notable that someone with a grasp of abstract algebra can understand the basic workings of RSA, although it is important to understand that concrete implementations of RSA are typically much more complex than “textbook” RSA.

Using RSA involves several steps. First, a set of keys is generated, with one becoming a public key that can be distributed and one that must be protected and kept secret. If Chris wanted to send a (short! see below) encrypted message to Golden, Chris would first obtain Golden’s public key. The public key would be used to encrypt the message and Golden’s private key could then be used to decrypt the message in private.

The security of RSA is ultimately based on the assumption that factoring a very large number n that is the product of two prime numbers p and q is extremely computationally intensive. This assumption is exactly that—we don’t know for sure whether an efficient factoring algorithm to solve this problem can be devised, but so far, one hasn’t been discovered. It is also important to be cognizant of the rapid advances in computing. For example, RSA, using key sizes of a few hundred bits, can be cracked using commonly available hardware. Even 1024-bit RSA is considered potentially insecure, with key sizes of 2048 or 4096 currently recommended.

Definition 1.3.4 — Public Key Cryptosystem. A public key cryptosystem relies on pairs of associated public and private keys. The public key in a pair can be distributed and anyone in possession of the public key can create an encrypted message that can only be decrypted by someone in possession of the corresponding private key.

Poor implementations and uses of encryption can undermine confidentiality and integrity. For instance, with RSA, unlike some other public key cryptosystems, it’s mathematically possible (though generally not advisable) to use the decryption and encryption keys interchangeably. That is, Chris could issue (short) announcements and “prove” to others that they were produced by him by encrypting the announcements with the private key—anyone with possession of the public key could then decrypt these messages. The problem with this strategy in practice is that the RSA public key, which is meant for encrypting messages, is deliberately generated in a way that minimizes its size, to optimize the performance of encryption. Because of the mathematical relationships between the keys, this necessarily makes the private decryption key much larger. While it’s perfectly safe to use the smaller key as the public key, using the larger key as the public key and the smaller key as the private key potentially compromises security. There are also other mathematical tricks used to optimize performance that make the keys not as interchangeable as they might appear without damaging security. Why discuss this at all? The point is that the devil really often is in the details with cryptosystems and they should be designed by experts, implemented by experts, and used in the ways experts direct mere mortals to use them.

Definition 1.3.5 — Cryptanalysis. Cryptanalysis is the study and practice of breaking cryptosystems, with the general goal of reducing (or eliminating) the expected difficulty of converting a ciphertext into the corresponding plaintext.

Definition 1.3.6 — Cryptology. Cryptology is the study and practice of creating and breaking cryptosystems. It is therefore a combination of both cryptography and cryptanalysis.

Elliptic curve cryptography is another type of public key cryptosystem based on some fairly complex math. We won’t explore the details, but specifically, the cryptosystems are based on properties of elliptic curves over finite fields. Rather than a curve with real coordinates, these curves have positive integral coordinates and the coordinates “wrap around” back to 0 beyond the value of a prime number p—that is, coordinates begin at 0 and are computed modulo the prime p, yielding a range of 0.. p − 1. Elliptic curve cryptography was first proposed by Neal Koblitz, author of a popular book on number theory and cryptography, and independently by Victor Miller. One advantage of elliptic curve cryptography is that keys can be an order of magnitude smaller than RSA keys while maintaining similar levels of security. Like RSA, the security of elliptic curve cryptography depends on a hard problem (based on discrete logarithms) remaining hard and not yielding to a heretofore unknown efficient algorithm. Unlike RSA, where associated patents have expired, some aspects of elliptic curve cryptography are still covered by patents. Because of smaller key sizes, elliptic curve cryptography is now widely used in many applications, including digital signatures (discussed below), authentication, and encryption.

1.3.1.3 Public Key Crypto, Meet Symmetric Key Crypto

Public and symmetric key cryptosystems are often used in tandem to capitalize on the advantages of each. Public key systems obviously make key distribution simpler. But, all public key systems are much slower than symmetric key systems and also have other disadvantages. For example, public key systems typically generate ciphertexts that are much longer than the corresponding plaintext and, without additional effort, they also impose maximum sizes on the data that can be encrypted using a specific key size. For example, 2048-bit RSA can be used to encrypt just short of 256 bytes of data, because of some padding that is introduced in the encryption process.

In practice, public key systems are not used to encrypt large data, but instead to securely exchange encryption keys for symmetric systems. Imagine that Chris wants to securely and efficiently send a large message to Golden (perhaps a package of potential solutions for exercises in this book). Rather than trying to use a public key system to handle the data encryption chores, Chris can generate a random AES encryption key k, look up Golden’s RSA public key, encrypt k using the public key, and then transmit the encrypted message to Golden. Now Chris and Golden both have k and can use it to transmit messages securely (and without having to meet in a dark alley at midnight to exchange k!). Another nice feature of this method is that k can be securely destroyed by both parties when it is no longer needed.

When you connect securely to a website (e.g., https://google.com), the process is much the same. Your web browser communicates with the web server hosting google.com and uses public key cryptography to securely establish a shared, private key called the “session key.” Symmetric key cryptography is then used to encrypt and decrypt web traffic between the browser and server, and when the connection to the web browser is broken, the session key is destroyed.

1.3.2 Hashing

Hashing is another important tool that cryptography provides. Cryptographic hash functions map an input of arbitrary length into a fixed-size output (e.g., 256 bits of binary data). Hashes are often used as “fingerprints” for data, since a hash function always outputs the same value for a given input and any slight modification of the input results in very different output (at least for good hash functions). It is also desirable that, given a specific output, it is computationally infeasible to determine which inputs generated that output. Of course, it is possible that two inputs generate the same “fingerprint” since the size of the cryptographic hash function’s output is fixed, but good hash functions are designed to make discovering two inputs that result in the same output infeasible (Table 1.6).

Table 1.6 Changing input in any way creates a (very) different hash value of the same length.

Input | SHA256 Hash value
cybersecurity | e23cd6ca0ee37a4df5d5ba10ed7e12d3c431d71c6d56dddc110f640393f9ae25
cyber security | 86e3f8a24b71f056d79f5acb12897e6112b991b43ef93c186ec3827dae342f71

Cryptographic hash functions have many uses, but consider a simple example that illustrates the basic idea. Imagine that Golden claims to have solved a very difficult crossword puzzle and wishes to prove to Chris that he did so without revealing the answer. Golden can copy the letters in the solution to the puzzle row by row, left to right, and then top to bottom, into a long string s. Golden then computes hash = H (s)and sends hash along with the puzzle to Chris. Chris can fill in the answers to the puzzle and compute the hash in the same fashion. If the hash values match, the solutions also match (with extremely high probability). This same idea applies to any sort of data. For example, websites that offer files for download may also post the cryptographic hashes of the files. After downloading one of the files, a user can locally compute the cryptographic hash of the file and compare the hashes to verify the authenticity of the file.

Cryptographic hash functions have numerous applications in digital forensics, which involves acquisition, safekeeping, analysis, and presentation of digital evidence that might be used in civil or criminal proceedings. A digital investigation often starts with making a copy of a storage device associated with civil or criminal litigation. By computing the cryptographic hashes of the data both on the storage device and in the copy, the copy can be verified as an authentic representation of the original storage device—in other words, the process ensures data integrity.

Furthermore, by recording the cryptographic hash on an evidence tag, it is possible to later establish that no data within the copy have been modified, simply by recomputing the hash and performing a comparison. A good hash function will make it computationally infeasible to modify the data in such a way that the hash function’s value does not change.

In a similar vein, these hash functions are used to actively target data, instead of simply establishing authenticity. For example, law enforcement agencies often store vast databases of cryptographic hashes associated with contraband—e.g., cryptographic hashes of photographic images that depict child sexual abuse (known as “child sexual abuse material,” CSAM). The original images then do not need to be stored by investigators. By comparing the cryptographic hash of each file on a storage device with each of the hashes in the CSAM dictionary, images associated with child pornography can be quickly identified.

But, even when the hashes match, investigators must visually verify the images. This is because of the risk of hash collisions, a situation where two different inputs result in the same hash output. A good hash algorithm with a relatively large output size minimizes the chances of this happening, but since there are an infinite number of possible inputs and a fixed-size output from a cryptographic hash function, collisions are inevitable. What’s important is that strategically creating collisions should be extremely difficult. Otherwise, hash collisions could be a disaster—for example, if a malicious actor can identify one, it could be used to disguise malware as a legitimately-signed software update.

1.3.2.1 Digital Signatures

We’ll now consider one final important application of cryptography in cybersecurity, digital signatures. Digital signature schemes allow verification of the authenticity of digital data, e.g., documents that are shared on the Internet. Digital signature techniques are based on public key cryptography and have several components. One component is key generation, in which a private key and associated public key are generated. A signing algorithm can then be used to sign a digital document, based on a user’s private key. A verification algorithm can be used by recipients of the document to verify its authenticity. The verification algorithm accepts the document, the user’s public key, and the digital signature as inputs and yields a “yes” or “no” answer regarding authenticity. Note that in practice, the signing algorithm does not operate directly on the document contents, but rather a cryptographic hash of the contents, to allow the signing algorithm to operate on a smaller, fixed-size input that is nevertheless directly associated with the data in the document.

Federal law recognizes electronic signatures as legally binding. However, when the law was passed in 2000, Congress did not specify that parties had to use an identity-based digital signature system like one based on public key cryptography! As a result, an image of a wet signature, or just typing one’s name on a website, can be the “signature.” The problem is that parties can easily “repudiate” such signatures and claim they didn’t actually sign the document, because it is so easy to fake these signatures.

Repudiating a properly implemented digital signing system—one based on cryptographic keys—is more difficult. The repudiating party would have to argue that someone stole their private key. The repudiating party might also argue that the contract somehow changed after the signature was affixed. Thus, implementing a digital signature system that is resilient to repudiation requires careful thinking about both identity and a hashing procedure that verifies the content of the document when the party signs.

This discussion of cryptography and its relationships to cybersecurity demonstrates why cryptographic schemes are so pervasive in this field: cryptography has numerous use cases in security and elsewhere. There is also a political aspect: so many actors depend on cryptography in so many different contexts that “tinkering” with cryptographic techniques, e.g., allowing a government to have a “master key” that allows decryption of all messages, may foment broad opposition to policy mandates that weaken or complexify the technology.

NSA DIANA

This is a real cryptosystem used by the United States military in the field during the Vietnam War called DIANA.

Cryptosystems like RSA are based on computationally secure processes; that is, they rely on functions that are difficult for a computer to reverse. DIANA, on the other hand, is information-theoretic secure. That is, even with unlimited computing power—even a quantum computer—an attacker cannot decrypt messages properly encrypted with DIANA.

DIANA produces random ciphertext that is the same length as the plaintext. This means that an attacker has no way of knowing what the true text is, even if every permutation of the text is computed using a brute-force technique. DIANA is a “one time pad,” with its security tied to its one-time use of a particular key.

One can use DIANA by hand—in fact, that’s why it was an appealing system for use in the Vietnam War. The left-hand side is the key. The table used to convert plaintext to ciphertext (and reverse it) is on the right.

Notice that the key starts with the letter “L.” This corresponds to the L row on the table. Assume that Golden wants to say “The Magic Words are Squeamish Ossifrage” to Chris. To encrypt, Golden notes the first letter from the key, left-hand pane, which is L. Turning to the table, row L, and then to the letter T, the corresponding ciphertext underneath the T is a V. To encrypt the next letter, Golden would use F from the key to locate the letter H and choose the ciphertext N, and so on. The process would eventually render VNOGBURCLKZFUCYVJXAALZSHZQQDJNZKRD.

Notice that every character in the ciphertext is the product of a different, randomly chosen key. For the process to be secure, Golden and Chris must have identical DIANA keys and must destroy them after the process—reusing the key makes it vulnerable to cryptanalysis. It’s also imperative that the key be random—it’s not acceptable, for example, to concatenate shorter strings of bits together to construct a longer key.

Definition 1.3.7 — One-Time Pad. A one-time pad is an unbreakable cryptosystem, in that as long as practical requirements associated with the generation and use of keys are met, no amount of computational power can definitively establish which plaintext was used to create a given ciphertext. Properly used, one-time pads are truly secure.

1.4 Cyberpower: How Insecurity Empowers and Undermines Nations

Later, in this book, we will dive more deeply into the military and cybersecurity. But, for now, consider this: The Internet has ended a centuries-old norm that has kept the military and intelligence agencies (mostly) out of the average person’s daily life. Now even foreign military and intelligence agencies monitor and influence users.

At the nation’s founding, the Third Amendment to the Constitution limited the ability of government to impose troops in homes.

Federal law makes it a crime to use the military to enforce domestic policies, absent special circumstances.

The United States regulated wiretapping in the 1930s after concerns were raised about civil liberties.

America’s first secrecy laws were adopted in the early twentieth century. America did not even establish a government-wide, coordinated, permanent intelligence agency until after World War II.

From a technological perspective, our daily written and telephone communications were practically out of reach of both law enforcement and intelligence agencies. The postal mail is sealed and protected from opening by both law (a warrant requirement) and volume (opening mail is labor intensive and does not scale). Communications were simply too voluminous and dis-aggregated to be collected, and no one had computers that could analyze the data. This began to change with the emergence of digital telephony.

Nowadays, because of several geopolitical factors²¹ and the presence of the Internet, our daily expressions and activities are viewed with suspicion. The Internet makes it possible for foreign powers to monitor us and intimidate people by making threats against their loved ones back in their home country.²²

America too has seen the Internet as a tool to spread its influence. Joseph Nye, a giant in the international relations field, defines cyberpower as “the ability to obtain preferred outcomes through the use of the electronically interconnected information resources of the cyberdomain. Cyberpower can be used to produce preferred outcomes within cyberspace, or it can use cyber instruments to produce preferred outcomes in other domains outside cyberspace.”²³

Under Nye’s framework, cyberpower can be exercised in hard or soft ways in the cyber domain or outside it. Government development and funding of privacy-enhancing communication services, such as The Onion Router (Tor), is a form of intra-cyber domain soft power. The tools enable human rights activists in repressive countries to communicate, furthering the United States’ soft power in spreading liberal enlightenment values. Bombing a communications facility is an example of a hard instrument of power outside the cyberdomain.

Definition 1.4.1 — Tor. Tor enables people to use the Internet with strong security and good, but imperfect, anonymity.

Because it is difficult to trace uses of cyberpower to a political entity quickly and with certainty, policymakers have looked to cross-domain deterrence as a solution. A cross-domain approach seeks to punish with other tools, which could be diplomatic, economic, legal, military, or even nuclear.

Definition 1.4.2 — Cross-Domain Deterrence. The use of different types (land, sea, air, space, or cyber) of threats or force. For instance, a nation may respond to an Internet attack by using physical force against the attacker.

While cyberoffense is sometimes presented as precise and calibrated, the reality is that cyber “weapons” share traits with kinetic ones. Imagine firing a tear gas canister during a riot. Once the weapon fires, you have little control over what happens next. The canister could fail or veer out of control. New, unforeseen actors could enter the area and be harmed by the gas. Your target could escape. A strong wind could blow the gas onto noncombatants. A target could throw the canister back at you. And so on. Essentially, all of these things have happened to governments that use cyberweapons. The use of offensive cyberpower—despite fantasies to the contrary—is complex and uncertain.

Cyberpower requires intelligence capabilities and patience.²⁴ Systems have to be studied for vulnerabilities, and those vulnerabilities must be developed into usable exploits. Good security personnel might discover these vulnerabilities and patch them. Even when a good cyberattack plan is designed, it might be rendered useless because of regular patching or if the target changes network design. Once used, a cyberattack might be mitigated, it might have no apparent effect, or it might have major, unforeseen side effects.

For these reasons, cyberattackers benefit from practice, meaning that belligerent countries may get ahead of more peaceful ones.²⁵ Russia in particular has had several opportunities to practice its offensive cyber skills in conflicts with Estonia, Georgia, and Ukraine.²⁶ United States practice has been far more secretive, focusing on the extraction of information (later, we will learn that this is called computer network exploitation, or CNE) rather than attacks (computer network attack, or CNA).

The major United States concerns in the cybersecurity area are its competitive rivals—China, Iran, North Korea, and Russia. Sometimes mentioned in United States reports are the mysterious “country a” and “country b.” This reflects the reality that even allies hack each other’s systems for intelligence purposes.²⁷ We will see that our traditional allies, such as Israel and France, sometimes represent a cybersecurity threat and, at other times, valuable sources of information for United States protection.

But, back to the key point: modern offensive cyberattacks target civilian populations. They are “counter-value” (civilian) attacks rather than “counter-force” (military) attacks. Whether the goal is to turn off the power or the telecommunications stations, ordinary people are the intended target of disruption. This fact is often skipped over in discussions of cyberconflict.²⁸ We wish to emphasize how nation-states plan to impose costs on civilian populations through Internet attacks. This is a form of backsliding from international commitments to maintain distinctions between civilian and combatant targets.

1.5 Is Disinformation a Cybersecurity Concern?

In a word, [slanderers] invent and say the kind of thing that they know will be most irritating to their hearer, and having a full knowledge of his vulnerable point, concentrate their fire upon it; he is to be too much flustered by rage to have time for investigation; the very surprise of what he is told is to be so convincing to him that he will not hear, even if his friend is willing to plead.

—Lucian of Samosata, On Slander, second century CE

It is generally true that what we want, we also believe, and what we think, we hope other people think, too.

—Julius Caesar, Commentary on the Civil War, first century BCE

In the extended discussion that follows, we use concepts from information theory, political science, psychology, law, and economics to unpack the dynamics underlying disinformation. The goal of this discussion is to explore what it would mean to securitize disinformation: should cybersecurity’s scope include deterrence of intentional efforts to mislead people?

Recall Nissenbaum’s warning that a society that concerns itself with cybersecurity instead of computer security will drift from traditional CIA concerns into policing noisome uses of computers and networks. Such a society would have good reasons to. Consider this anecdote: On April 23, 2013 at 1:07 PM, the following message appeared on the verified Twitter account of the Associated Press (Figure 1.1).

Within three minutes, the Dow Jones Industrial Average lost almost 1% in value, an amount corresponding to over $100 billion. Apparently, automated trading bots could react to the “news” and send markets downward slightly. At 1:10—just three minutes after the original message, AP employees tweeted that the account had been hacked. The market started regaining the losses and had recovered by 1:17.

The Obama bomb tweet is clearly a technical computer security concern under Nissenbaum’s framework. It involved an attack on confidentiality and integrity on the Associated Press’ account. But, its point was to create effects through cyberspace in the quality of information we consume to make decisions.

Figure 1.1 Attackers posted this Tweet to the account of AP News in 2013.

Consider a different set of facts. The same attackers create an impostor account that looks like AP News, perhaps @APNews instead of simply @AP. The attackers send the same false message about the bomb. There is no technical computer security concern, but the markets act on the Tweet. Have we not just moved from Nissenbaum’s technical computer security to the broader social concern of cybersecurity?

Definition 1.5.1 — Misinformation and Disinformation. Misinformation is simply incorrect information; an unavoidable phenomenon in a world of uncertainty and errors in communication. Disinformation is misinformation that is deliberately spread to deceive by actors we call fabricators.

We might call this hypothetical “fake news” or “disinformation” as opposed to accidental or simply ill-informed “misinformation.” Fabricators are people who deliberately spread disinformation. Strategic use of fabrications is an ancient tactic²⁹ given swifter, stronger legs by the Internet.

1.5.1 From Information Scarcity to Glut

The discipline of information science helps us understand a key dynamic in disinformation: our information environment is different today from previous generations.

The past was governed by information scarcity. Information used to be difficult to get. News of an emergency could take days or weeks to reach audiences. We run marathons today in homage to Pheidippides, who died after running 26 miles to report the Athenian victory over the Persians at the Battle of Marathon.

We now live in an information glut. We are bombarded with data. The challenge is no longer information acquisition but information attention: what information should we ignore and what should we value?

What are the implications of a change from information scarcity to glut? Consider that liberal enlightenment theory is based on an information scarcity environment. Enlightenment theory favors a “marketplace of ideas.” Under this notion, more information is better because the marketplace sorts the best ideas, creating truth among diverse discourses.

But, if we take the marketplace of ideas metaphor seriously, we might explore how markets fail and how these failures might be reflected in the search for truth. Turning to economic markets, markets do not always produce the best of anything. Often, markets produce “good enough” things of adequate but middling quality. Turning to information, what if markets produce poor-quality information products, perhaps “news” that only affirms the viewers’ political views?

The market metaphor might also help us see information inequalities. Perhaps rich people will pay for bespoke, high-quality information. Poor consumers might have to satisfice with whatever news advertising can support.

Modern psychological theory establishes that we are not all perfectly objective in our day-to-day thinking. We cannot carefully collect and examine all data, while subjecting our experiences to hypothesis testing. Instead, we are constantly taking shortcuts, because rigorous thinking requires energy and comes at an opportunity cost—we can’t scrutinize everything, and so, we have to choose what is important.

Emotion and mood play a major role in the information domain. As users are bombarded with news snippets, they are asked to react by liking or forwarding this information. We may even feel compelled to react, in order to find closure for troubling news or to signal to others our moral stance. But, there is so much bad news that it is impossible to carefully evaluate it all; such evaluation would leave us in a rut where we do not enjoy closure from troubling news.

There are other psychological factors better understood today about how humans make sense of information. For example, repetition is convincing—this phenomenon is well known among advertisers. People begin to believe even false assertions if these are repeated enough. For instance, in the run-up to Operation Iraqi Freedom, Vice President Dick Cheney repeatedly associated Iraq with the September 11, 2001 attacks. The repetition of this false assertion convinced the American public that it was fact and public opinion polls showed a majority of Americans believed Saddam Hussein was somehow behind 9/11.

Definition 1.5.2 — The “Truth Sandwich.”. Our memory is imperfect. Sometimes we assign truth to falsehoods because we remember the falsehood. This is a reason why one should not use “myth-fact” sheets, strategies where one identifies a myth and counters it with the truth. In repeating the myth, some readers will remember the wrong information and forget the truth!

Berkeley cognitive linguist George Lakoff has advocated the use of the “truth sandwich” to manage misinformation: First say the true fact, then distinguish it with the falsehood, followed by repetition of the true fact.

Even our bodies influence how we interpret information. An obvious example comes from injuries to the brain that affect cognition. Consider how far we might press the relationship between health and cognition. The physical feelings of ill-health may make us more scared of other people, more risk adverse, and more desirous of security.³⁰

Optimism obscures part of the information domain problem. Internet optimists believed that connecting everyone would bring about world peace and a society of the mind. But, stop for a moment and consider this: why would connecting people through information networks bring about harmony instead of discord? Can services like Facebook stand in for the connections we make in person?

Modern testing reveals a troubling challenge in realizing the utopian Internet vision: A huge portion of Americans lack the reading comprehension skills to participate in a polity. The Program for the International Assessment of Adult Competencies (PIAAC), a literacy scale, finds that only 13% of Americans operate at the highest levels of reading literacy.³¹ On a scale of 1–5, about 50% of Americans perform at level 2 or lower. One component of PIAAC tests problem-solving in technologically rich environments. In that context, only 36% of Americans reach a level that requires “[s]ome integration and inferential reasoning” or higher. The remainder exist in a fog where their understanding is limited to contexts where there is “no need to contrast or integrate information” or no “categorical or inferential reasoning, or transforming of information.”

For people with weak reading skills, reading is hard, unpleasant work. Just understanding a text is difficult; applying a higher level analysis to determine the text’s truthfulness adds cognitive burden.

Information glut operates atop the emotional forces, the information processing limits, and the comprehension challenge. Glut means that, increasingly, we have to rely on other signals to understand information—the reputation of its publisher, its source, whether the information aligns with our understanding of the world, and our own gut emotion. These challenges may drive us toward thinking that disinformation is a security problem.

1.5.2 The Power of Influence Campaigns on the Internet

Influence campaigns find fertile ground in an environment with information glut and the complications of emotion and cognition. It thus makes sense that many nation-states use both hacking and propaganda strategies to amplify desired messages as part of their public diplomacy. Information glut changes the underlying strategies of disinformation fabricators: instead of censoring information, states seek to shape our worldview by selective attention to facts and framing effects.³²

Thomas Rid on Disinformation

Thomas Rid wrote a comprehensive, nuanced, enlightening history of twentieth century disinformation.a In the book, Rid characterizes fabricators’ goals in using a special kind of organized disinformation campaign he termed “active measures.” The goal of fabricators is: “to engineer division by putting emotions over analysis, division over unity, conflict over consensus, the particular over the universal.”

a Rid T. Active Measures: the Secret History of Disinformation and Political Warfare. New York: Farrar, Straus and Giroux, 2020.

Consider how Russian forces have been found to use hacking to interfere with international bodies investigating the poisoning of Sergei Skripal with the Novichok nerve agent and the killing of passengers on Malaysia Airlines Flight MH17. Those hacking activities are traditional cybersecurity issues that involve CIA concerns, whereas the Russian government’s use of the Internet to spread propaganda could be considered something different. Like hacking, it happens in and through the Internet, but this propaganda does not affect traditional CIA concerns.

Instead, the Russian propaganda could be classified as what we call “information domain” concerns. Because information shapes our worldview, this propaganda could be dangerous. Information informs our decisions and even deeper than that, information shapes what we consider as possible decisions to take. When information is corrupted, there can be serious consequences, such as money lost in markets, bad business decisions, bad policy decisions, false historical and news narratives, compromised elections, and perhaps even genocidal rage.

There is also a deeper epistemological consequence: the Russians are particularly good at fabricating multiple, incompatible explanations of events. The result is narrative denying. One cannot determine what the truth is because so many conflicting hypotheses are floated and supported. To take the poisoning of Sergei Skripal as an example, the Russian government has floated several strange hypotheses about the event, including the notion that the UK government itself poisoned Skripal.

The Russians’ Outrage Machine

In October 2016, Russian Internet trolls organized under the Internet Research Agency (IRA) paid about a dollar to circulate this ad under the moniker “Army of Jesus.”

Many were outraged by this and other less awkward attempts to sway public opinion in the United States and sow divisions prior to the November 2016 election, where Donald Trump was elected. But, very few people actually saw or forwarded this confusing ad. It attracted just 14 clicks and 71 “impressions.” (An “impression” is a metric defined by the Media Rating Council that interprets that an ad was seen if just 50% of it appears on a screen for one second. This means that many of the “impressions” Facebook booked the Russians for probably only impressed part of a computer screen.) The ad was targeted to people interested in highly charged Donald Trump allies—hardly the kinds of interest that signal support for Hillary Clinton.

So who exactly did this ad influence, either against Clinton or for Trump? What does it say about us that we are concerned that Americans might be confused by such material?

The Internet utopians believed we would all become contributors to a marketplace of ideas that created truth. Yet, one can “research” and find “facts” that support multiple narratives about Skripal. What is the truth? Who knows?

1.5.3 Libicki’s Disinformation Framework

Nations—including the United States—have long used information to manipulate others. For instance, an adversary may drop flyers on enemy troops to invite them to retreat before a battle. Martin Libicki provided a high-level overview of the phenomenon, which he labeled “psychological warfare,” in 1995.³³ Such manipulation “encompasses the use of information against the human mind (rather than against computer support).” Libicki described four categories of human-mind influence:

Counter-will  Attempts to influence national will in its policy commitments.

Counter-commander  Attempts to befuddle specific military and other leaders.

Counter-forces  Attempts to spread fear and confusion among troops.

Kulturkampf  The stoking of cultural struggle among those with opposing values.

When Libicki wrote this, the United States was seen as a major winner of the kulturkampf. The United States was largely resilient against foreign cultural influence while exporting material goods (e.g., blue jeans, rock, and roll LPs) coveted in resource-constrained foreign regimes, and along with them, the promises of a free polity and market.

The Risk of Counter-force Disinformation

NATO’s StratCom performed an experiment in 2019 with troubling implications. During a military exercise, it implemented a counter-force social media attack against members of an allied country “to evaluate how much data we could collect about exercise participants, to test different open-source intelligence techniques, and to determine if we would be able to induce certain behaviours such as leaving their positions, not fulfilling duties, etc. using a range of influence activities based on the acquired data.”

The attack involved just a month of preparation and relatively basic methods (i.e., no computer hacking) within the reach of anyone who can create fake accounts and entice others to “friend” them. Facebook quickly spotted the activity and disabled some of the experimenter’s infrastructure. Nevertheless, the experimenters leveraged advertisements and honeypot pages to attract combatants to private groups, where personal information was elicited.

The researchers concluded, “we identified a significant amount of people taking part in the [military] exercise and managed to identify all members of certain units, pinpoint the exact locations of several battalions, gain knowledge of troop movements to and from exercises, and discover the dates of the active phases of the exercise. The level of personal information we found was very detailed and enabled us to instill undesirable behaviour during the exercise […] We managed to get an approximate location (±1 km) for exercise participants, including soldiers from high value units, i.e., units that were required to complete a mission. We obtained phone numbers, email addresses, and pictures of equipment from all participants targeted using social engineering.”a

If you were a field commander and you read this report, how might you anticipate and prevent a future attack on your troops? What policies could you reasonably implement and what would the tradeoffs be?

a Bay S, Biteniece N, Bertolin G, Christie EH, Dek A, Fredheim RE, Gallacher JD, Kononova K, and Marchenko T. The Current Digital Arena and its Risks to Serving Military Personnel. Riga: NATO Stratcom, 2019.

Definition 1.5.3 — PSYOP. Psychological operations involve the use of information to shape the emotions and worldview of an adversary.

For a time, kulturkampf was conceived of as a branch of information warfare, but in recent years, other terms have been used to describe this activity because such manipulation is not inherently violent in the sense bullets and bombs are. Governments may call information warfare active measures, information operations, or PSYOP, for psychological operations, to distance it from armed conflict.

Indeed, as we will see in Chapter 4, PSYOP is widely considered within the bounds of ordinary tussles among states. For PSYOP to be unlawful, it would have to rise to the level of coercion. That is, the disinformation would have to deprive the targeted state of a choice in an area where it has sovereignty.³⁴ Persuasion, propaganda, and the like simply do not qualify as intervention in state affairs. Disinformation is considered a form of influence rather than intervention.

Question 1.5.1 — Libicki’s Framework. Libicki identifies four categories of disinformation strategies—counter-will, counter-commander, counter-force, and kulturkampf. If a government had resources to counter just one category of disinformation, which should it attempt to deter?

▄

1.5.4 The United States Approach: Free Speech First

“One uses information to destroy nations, not networks…That’s why we’re happy that you Americans are so stupid to build an entire Cyber Command that doesn’t have a mission of information warfare!”

— Attributed to Russian General Nikolai Makarov³⁵

The United States approach has been to prioritize free expression rights even when adversaries use propaganda that proposes violence. The United States chose not to sign a 1936 League of Nations convention that sought to ban fake news and broadcasts “of such a character as to incite the population of any territory to acts incompatible with the internal order or the security of a territory.”³⁶ Despite the experiences with Nazi use of radio and newspaper propaganda, which it called Weltanschauungskrieg, literally worldview warfare, the United States approach has been to oppose rules that categorize propaganda as illegal.

For almost a century, the United States has promoted its political voice abroad and modulated messages and approaches. Since the 1940s, the United States has operated the Voice of America to broadcast news about the country, maintained reading rooms overseas featuring the richness of American literature, offered international educational opportunities (including the Fulbright Scholarship) and, for a time, had an agency devoted to promoting United States policy and policy dialogue.

Thomas Rid explains that the CIA had a period of intense political warfare that reached its apogee in the 1950s. During this time, the United States engaged in extensive disinformation efforts aimed at the East Germans and Russians. After that, the agency de-escalated as Soviet and Stasi efforts intensified.

In enacting the 1948 United States Information and Educational Exchange Act, Congress empowered the Secretary of State to broadly disseminate information about America, its people, and policy interests. However, this authority was for foreign rather than domestic consumption.³⁷ Later, Congress amended the law to explicitly prohibit the United States Information Agency (USIA) from using its funds to influence public opinion in the United States or distribute material in the country.³⁸ By the 2010s, this prohibition had become irrelevant because of media convergence. Voice of America started distributing its materials via Gopher and FTP as early as 1994, and launched a full website in 2000, thus making its materials easy to obtain inside the United States.

A society could see terrorism as crime. Or it could securitize terrorism. After the September 11, 2001 attacks, much of the developed world treated terrorism as a securitized threat. We take terrorism so seriously now that even speech that supports it can trigger dramatic technical and kinetic interventions. Specifically, counter-value PSYOP against ordinary Americans created problematic, new demands to monitor Americans and even more Orwellian incentives to “deprogram” them.

The killing of Anwar al-Awlaki, an American citizen, is a prime example of how far presidents are willing to pursue a securitized objective, like the prevention of terrorist recruiting. al-Awlaki was killed in Yemen by a targeted UAV strike in 2011, under orders by President Obama. al-Awlaki was reportedly the mastermind and inspiration for a number of terrorist attacks worldwide, including the “underwear bomber,” the attempt to down an international flight as it approached Detroit on Christmas Day in 2009. But, al-Awlaki was known for another reason: his PSYOP. al-Awlaki used Facebook and, in particular, YouTube to give lectures of unusual influence.³⁹ An astonishing number of homegrown United States extremists cite watching al-Awlaki as inspiration for making attacks. In 2017, Google blocked al-Awlaki’s videos on YouTube, but they persist on other websites.

As the Islamic State of Iraq and the Levant (ISIL or ISIS) mastered social media marketing, the group used the Internet to romanticize the cause to establish a caliphate. ISIL even used standard storyline tropes, such as the “reluctant hero” so popular in Disney and other popular films, to inspire viewers.

Over 40,000 people from liberal, western nations answered this call, traveling to Syria and Iraq, with some taking up arms. Western militaries were trapped in a strange situation: they were free to kill their own citizens fighting in foreign theaters but United States law blocked the government from using information to stop these citizens from traveling to Syria in the first place.⁴⁰ In 2013, Congress loosened the reins on dissemination, allowing VOA and other outlets to distribute material in the United States in an apparent attempt to deprogram. However, the VOA may not attempt to influence domestic popular opinion⁴¹ nor establish a domestic audience.⁴²

1.5.5 Election Interference

The 2016 election presented another information domain emergency. It is fair to say that the United States is now roiled by counter-will and kulturkampf activities.⁴³ The 2016 election, where President Trump emerged with a surprising win over Hillary Clinton, was the focus of an intense, pro-Trump foreign influence campaign.⁴⁴ In some cases, the foreign campaign involved hacking, but in others, the influence came from agent provocateurs who used accounts they created using false American names to foment kulturkampf. Russians even engineered an in-person protest and counterprotest in Texas, with one side worried about “Islamification of Texas,” the other cajoling to “Save Islamic Knowledge.”

The 2016 election has renewed consideration of whether information domain concerns should be part of cybersecurity.

RT Versus PBS

Author Hoofnagle recalls buying a Roku Internet television device and finding Russia Today preinstalled and free to watch. On the other hand, PBS required a download and establishment of an account.

Suppose cybersecurity policy made information itself a referent object. Security issues concerning information might include questions about the quality of information and access to controversial material. In the liberal West, this means child sexual abuse material (CSAM), misleading propaganda, services that are politically biased, and infringing uses of copyrighted material. Elsewhere, controversial material might include anything that creates “disharmony,” including adult pornography, but also truthful political tracts and anti-authoritarian organizing activities.

Network information economics also sheds light on the disinformation problem. As the web has become dominated by platforms, platforms become the focus point for information domain concerns. That is, policymakers begin to ask: to what extent should a video-hosting platform like YouTube be responsible for terrorist recruiting videos, material that suggests suicide to children, false advertising, or pro-anorexia content?

In the United States, the urge to make platforms responsible for such content comes from the right and left: Conservatives suspect Internet platforms are systemically biased against conservative news and narrative frames. Liberals are concerned the Internet has enabled activation and organization of authoritarian movements.

We could just as well categorize these problems as platform management issues. That is, instead of taking a security lens, we could reconceive of these problems as business-economic problems. The platforms of today, such as video-distributing YouTube and Facebook/Meta, have an economic model just like the television stations of yesteryear. Platforms make money when they can attract eyeballs, and just like television shows, platforms are valued based on how many eyeballs they attract, the people attracted, and the amount of time those people keep their eyeballs on the screen.

Unlike the Internet, television and radio broadcasts have public interest standards. Public interest requirements and even pressure from advertisers provided a floor for uncouth content. Turning to the Internet, web platforms need not think about content quality in a positive or negative sense. All content, even videos depicting torture, can be monetized by platforms. YouTube need not do anything in the public interest, and it can monetize ISIS recruiting, pro-anorexia, or even “pickup artist” content.

Shoshana Zuboff nicely describes the incentive problem: platforms are indifferent to meaning, facts, and truth.⁴⁵ That is, platforms can monetize any content regardless of quality. Platforms’ main concern is that you keep watching. This makes platforms different from television. A television station that acted like YouTube would lose its advertisers, be fined, and lose its license!

Platforms measure audiences through a metric called “engagement,” which is evidenced by how and whether people click on links or scroll through updates, just as consumers used to “channel surf” and settle upon desired content. Platform incentives lean toward ignoring content quality issues because filtering at scale is impossible, and because manual filtering is expensive and requires humans to watch atrocities as part of the process.

Engagement is the coin of the platform realm. The measurement of engagement is full of tricks and an underlying mendacity not understood by Silicon Valley outsiders. The technical tricks are many. Automated bots are the most obvious. These are programmed to “engage” with desired content. Platforms, especially in early stages, tend to ignore such bots because bots make their business appear healthy and overflowing with desirable engagement. These bots present a cybersecurity threat: today, they may “click” to defraud advertisers; tomorrow, they may click to promote disinformation or computer attacks.

There are also social and institutional forms of trickery at play. The technology press tends to be optimistic but also, strangely, inexpert in evaluating technology.⁴⁶ Finally, Silicon Valley companies often attract users through enormous, uneconomical subsidies and quickly lose these customers through churn. Startups can appear wildly successful until one asks how much was spent to acquire a user on average (customer acquisition costs), and how long that user stayed. Unlike traditional platforms for speech, such as newspapers, accountability mechanisms have not evolved to systematically erode this gamesmanship.⁴⁷

The business-economic problems with platforms are then magnified by news media organizations. Many such organizations are looking to these platforms to identify news trends. This news trend cycle is why Twitter was so important to President Trump—reporters were on Twitter. The platform allowed Trump to trumpet messages while the news media slavishly repeated them.

The tactic of controlling the news through journalist-focused communications is not limited to President Trump. Anyone in control of a bot army can falsify engagement on a platform and magnify a certain topic as “trending.” News reporters might then decide to report on that topic, further popularizing an idea. It is this cycle of online clicking that enables fabricators of disinformation to shape the facts we pay attention to and the frames we use to filter facts.⁴⁸ Modern censors do not gag, they gush. Censors prevent access to truth by overwhelming the public with disinformation.⁴⁹

1.5.6 Is There Really Reason to Be Concerned?

A skeptic might argue there is nothing truly new to disinformation tactics. This section started with examples of disinformation from antiquity—there’s nothing really new about lying. Public relations firms and clever marketers have always been able to gin up buzz around products or ideas. Reporters and cultural gatekeepers recognize hype and temper its influence. In this view, we ought to recommit to First Amendment principles and resist the instinct to securitize disinformation or make it the focus of cybersecurity efforts.

Exercise 1.2 — Does the Internet Make Disinformation Different? If you are struggling with disinformation and have an instinct that there is a new problem with bad information in the Internet age, what exactly is the factor that makes disinformation different today? Which of these (if any) elevate disinformation to a security concern—one that, as Ole Wæver explained, is so serious it “can undercut the political order within a state and thereby ‘alter the premises for all other questions.”’

Although the Internet is not anonymous, it is easier to speak without attribution online.

Relatedly, it may be easier to deny that speech belongs to a specific actor—for instance, the suspect can claim their account was hacked.

It is possible to falsify the popularity of ideas.

Computer-mediated communication lacks social signals such as facial expression. This makes it easier to “test out” racist or other objectionable speech and later claim the speech was a joke.

The worldwide reach of the Internet makes it possible to target disinformation from the comfort of home, rather than having to be stationed in the target country, as was the case during the Cold War.

The systematic weakening of journalism displaced a truth-aspiring profession with platforms run by nonprofessionals indifferent to truth. That is, platforms like YouTube make money on all content, even if that content is deliberately untruthful.

▄

What if we are at the dawn of organized disinformation efforts? Disinformation in antiquity was not institutionalized in the sense it is today. And we may be at a golden moment where our disinformation concerns focus on just a handful of countries with information operations (China, Iran, North Korea, and Russia). Many of these efforts are immature and awkward. For instance, analysts easily spotted a 2022 campaign where Chinese actors attempted to block creation of a strategically important rare-earths plant by fabricating local “not-in-my-backyard” opposition in Texas.⁵⁰

The United States State Department estimated in 2022 that Russia spent over $300 million since 2014 to influence foreign politics.⁵¹ To compare, consider that successful candidates to the United States House of Representatives typically spend about $1.5 million per election, and candidates for Senate spend about $10 million.

Imagine a world where China, Iran, and a dozen other nations master United States-directed propaganda? Even allies might get in on the action—consider the audacious intelligence trickery used by the British to get America to enter World War I.⁵² Could pervasive and effective disinformation cause us to securitize Internet communication?

One way to view the disinformation problem is that it is a natural consequence of an immature medium. Newspapers, radio, and telephone all went through periods of abuse and reform, resulting in rules being adopted to address the problems presented by the medium.

In this alternative frame, we could look at Internet disinformation as a business-economic problem. We might not need to use cybersecurity, with its complex and problematic politics, as a remedy, and instead focus on straightforward business regulation. Business regulation offers many tools to promote honesty. These other interventions are less heavy handed: consumer law, securities law, and even copyright law could erode the business-economic problem. The history of newspapers provides many examples of interventions that could be applied to Internet companies:

The problem of bots  Newspapers and magazines are required to provide audited statements of their subscriber base. Telemarketing callers must identify automated calling technologies as bots. Securities law might create disincentives (such as shareholder suits) when platforms tweak their numbers by passing off bots as real users. In particular, foreign-controlled bots could become a liability that investors might want purged.

The problem of profiting from falsity  Newspapers also can be held liable for false advertising, although this rarely happens.

Pay-for-play content  Newspapers have to mark advertisements and advertorials as non-news content.

Doctored content  In France, doctored photographs that make models look thinner must be marked with “photographie retouchée.”

False endorsements  Individuals’ “publicity rights” require publishers to obtain consent and compensate people if they use photos of them to promote products and other commercial benefits.

Corporate accountability  Companies are under legal requirements to file their true name and “doing business as” designations.

Recordkeeping that helps with enforcement  Most print advertising is archived so enforcers can inspect it later. Similarly, many telemarketing transactions have to be documented in careful ways so telemarketers cannot lie about obtaining consumers’ consent.

Protecting original content creators  Copyright law could require licensure of news content or limit its republication on platforms (where it is easy for malign users to mischaracterize).

Information integrity  One could imagine a cryptography framework to verify the original publisher of a photograph and ensure the photograph has not been significantly altered. Copyright law creates powerful remedies that could be used by private parties to deter those who copy photographs and republish them.

What if we were to apply some of these transparency mechanisms to platforms, through requirements to identify bots, the true name of companies that pay for advertising, or those who are paying to “amplify” content (Figure 1.2)?

Consumer, intermediary-liability, securities, and copyright law have their costs, of course. The question is whether these approaches are the “best bad choice” to manage disinformation. Civil liberties groups may dislike these approaches, but their opposition results in a choice we are living with: dominant web firms use algorithms to decide what can be said. Thus, doing nothing is a choice—a choice to allow platforms to decide the rules.

1.6 International Views

This work is predominately United States focused. The United States government invented and commercialized the Internet, and this invention has spread to every corner of the planet. As it has done so, the Internet has provided the United States with more opportunities and power to influence the entire world.⁵³ The Internet has even solidified English as the global lingua franca. The result is that the United States has some asymmetric advantages from the Internet’s cultural effects. In fact, the Internet is conceived of as a force for liberal democracies. Other nations may resent or be threatened by these effects, which they may see as United States kulturkampf against nations with illiberal values.

Figure 1.2 Under 39 USC §3685, publishers with access to special, discounted postal rates must make a disclosure on the publication’s ownership, operations, and paid subscriber circulation. Here is part of the Postal Service form. Online platforms need not make similar disclosures.

On the other hand, the Internet has provided adversaries with asymmetric advantages. The Internet has made it easier for other countries to steal trade secrets and valuable information from the United States private sector. This advantage is asymmetric because there are relatively few other nations the US business community would benefit from hacking to learn trade secrets, and those nations with great innovations tend to be United States allies. Modern democracies are also vulnerable to election interference in ways autocratic leaders are resilient against, since autocrats control the outcomes of elections.

We may perceive our security protections as woefully inadequate—cybersecurity intelligence companies warn there are tens of thousands of breaches each year, many of which spill personal information into online markets for criminals. But, there is no reason to believe the situation is better in China or Russia. China has an even weaker regime for “vertical” privacy relationships (state-to-citizen) as China’s regulation of government data collection on citizens is weaker than the United States framework. Writing about the Chinese social credit system, Xin Dai has characterized the Chinese landscape as having systemic risks. He explains that rapid growth has contributed to general insecurity, leading to even established players falling victim to rudimentary security breaches. In addition, he characterizes the black market for personal data as rampant, with government platforms highly vulnerable to attack.⁵⁴

Definition 1.6.1 — Vertical and Horizontal. Vertical relationships are between individuals and states; horizontal ones concern relationships among individuals.

Critics may say the United States is hypocritical. While the United States does not censor religious movements like China does, United States free speech still does not consider filtering of child sexual abuse material or even copyrighted material as censorship. Furthermore, the United States IC’s capabilities are fantastic. Fantastic capabilities trigger concerns, many of which are not well founded.⁵⁵

Yet, we believe context matters. Intellectual property enforcement does indeed cause a kind of censorship, but one done for economic goals and to create incentives for the spread of new ideas. In addition, all sophisticated nations have intelligence agencies. The United States system is among the most transparent, most regulated, and it exists—even if in tension—with meaningful constitutional safeguards. It is the avowed policy of the American IC not to directly advance domestic commercial interests with intelligence. We’ll later explain why the IC has incentives to adhere to this policy.

1.7 Conclusion: A Broad Approach

A multidisciplinary view is necessary to understand cybersecurity.

Cybersecurity is a relatively new challenge and seems intractable. We characterize cybersecurity as a messy social problem. Cybersecurity is also under-theorized. But, to keep things in perspective, other modern challenges suffer from similar dynamics. Societies can decompose messy problems and make incremental progress on them. Consider atomic weapons; deterrence theory and other tools to contemplate and reduce risks took years to emerge.⁵⁶ We should not expect cyber risks to be easily solved; it will take decades to conceive of the problems and develop strategies to manage cybersecurity.

This book attempts to synthesize the many different policy approaches to insecurity. The obvious ones are law: imposing security requirements, notification of security incidents, and responsibility for insecurity in software. But, many other approaches, market-based and indirect, could also make the Internet safer. Standards bodies, such as Underwriters Laboratory, have articulated a Cybersecurity Assurance Program for products that could become as established as the “UL” stamp attesting to the quality of an electronic device. Governments also intervene indirectly through industrial policy by investing in more secure technologies, or by using purchasing power to require services and products to have security certifications.

The following chapters cover the basic elements that shape cybersecurity: the technology of the Internet (Chapter 2), the economic and psychological dynamics involved in security (Chapter 3), the history of the military’s role in the development of computing and computing security (Chapter 4), and, finally, cybersecurity theory (Chapter 5).

Notes

1 For a discussion of the concept of wicked problems/social messes, see Mitroff II. Technology Run Amok: Crisis Management in the Digital Age. Palgrave MacMillan, 2019 and Rittel HWJ and Webber MM. Dilemmas in a general theory of planning. Policy Sciences 1973; 4:155–69.

2 Deibert RJ. Black code: censorship, surveillance, and the militarisation of cyberspace. Millennium 2003; 32:501–530.

3 Klimburg A. The Darkening Web: The War for Cyberspace. Penguin, 2018.

4 Clark DD. Designing an Internet. MIT, 2018.

5 Wæver O. Securitization and Desecuritization. Centre for Peace and Conflict Research Copenhagen, 1993.

6 Buzan B, Wæver O, and Wilde Jd. Security: A New Framework for Analysis. eng. Boulder, CO: Lynne Rienner Publishers, 1997.

7 Id.

8 Wæver O. Securitization and Desecuritization. Copenhagen: Centre for Peace and Conflict Research, 1993.

9 Buzan B, Wæver O, and Wilde J. Security: A New Framework for Analysis. Lynne Rienner Publishers, 1998.

10 Nissenbaum H. Where computer security meets national security. Ethics and Information Technology 2005; 7:61–73.

11 This will be developed later, but another way to manage the risk of terrorism is through the lens of crime. Yet another is through psychology.

12 Hildebrandt M. Balance or trade-off? Online security technologies and fundamental rights. Philosophy and Technology 2013; 26:357–79

13 Lapsley P. The Definitive Story of Steve Wozniak, Steve Jobs, and Phone Phreaking. The Atlantic, 2013.

14 Phil Lapsley’s book on phone hacking notes that a 1955 call between Miami and Denver would cost almost $6—$66 in today’s dollars!

15 Lapsley P. Exploding the Phone: The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell. Grove Press, 2013.

16 Levy S. Hackers: Heroes of the Computer Revolution. Volume 14. Doubleday Garden City, NY: Anchor Press, 1984.

17 Schneier B. Beyond Fear: Thinking Sensibly About Security in An Uncertain World. New York: Copernicus Books, 2003. Nevertheless, security theater does have value. It can fool unsophisticated attackers or make them nervous and thus more likely to be intercepted by other layers of security.

18 Huawei Cyber Security Evaluation Centre (HCSEC) Oversight Board. A report to the National Security Adviser of the United Kingdom. Government Document, 2019

19 Consider the automobile industry pre-safety movement. Auto accidents used to simply be blamed on drivers and the policy remedy was driver education. As the issue matured, we understood that just blaming the driver did not work; cars themselves had to be designed to anticipate or mitigate driver error and crashes.

20 For a short and masterful introduction to encryption, see chapters 6 and 7 of Schneier B. Secrets and Lies: Digital Security in a Networked World, 15th Anniversary Edition. Wiley, 2015.

21 Two factors loom large: the rise of terrorism makes individuals suspect as agents of foreign powers, and because skilled terrorists compartmentalize and work in small trust networks, efforts to penetrate these groups with standard human intelligence are difficult. Link analysis and signals intelligence have filled the void. The second factor relates to the rise of what is sometimes called “hybrid war,” which is not really new, but has new relevance with the Internet.

22 In fact, dear student, it is unfortunate but several nations commonly use graduate student status as a cover meaning that some of your colleagues live in fear that they may be reported by a fellow student.

23 Nye JS. The Future of Power. New York: PublicAffairs, 2011

24 Brantly AF. The decision to attack: military and intelligence cyber decision-making. University of Georgia Press, 2016, Schmidle Jr R, Sulmeyer M, and Buchanan B. Nonlethal weapons and cyber capabilities. Understanding Cyber Conflict: 14 Analogies 2017:31–44

25 Sanger DE. The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age. Crown, 2018

26 Blank S. Cyber war and information war a la russe. Understanding Cyber Conflict: Fourteen Analogies. Washington, DC: Georgetown University Press, 2017:1–18

27 Olson JM. Fair Play: The Moral Dilemmas of Spying. Potomac Books, Inc., 2006

28 “If the aim is to retaliate for a hostile attack in a limited way, while limiting the risk of escalation to all-out confrontation, it might be much more prudent to launch cyberattacks on civilian infrastructure. The point is occasionally acknowledged in public…” Rabkin J and Yoo J. Striking power: How cyber, robots, and space weapons change the rules for war. Encounter Books, 2017

29 Odysseus uses a forgery during the siege of Troy in the Iliad, Plutarch describes the mob massacre of second century BCE reform politician Tiberius Gracchus and supporters by patricians who were enraged by false accounts that Tiberius sought a crown. Plutarch. Lives. Vol. 10, Agis and Cleomenes, Tiberius and Caius Gracchus, Philopoemen and Flamninius. Loeb classical library. Heinemann, 1921. Second century CE writer Lucian devoted an entire essay to analyzing the nature of slander that rings familiar to a modern ear. Harmon AM, Kilburn K, and Macleod MD. Lucian. Cambridge, MA: Harvard University Press, 1913.

30 Davies W. Nervous States: Democracy and the Decline of Reason. New York: W.W. Norton Company, 2019.

31 National Center for Education Statistics (NCES). Program for the International Assessment of Adult Competencies (PIAAC), 2017.

32 Cheng D. Cyber Dragon: Inside China’s Information Warfare and Cyber Operations: Inside China’s Information Warfare and Cyber Operations. ABC-CLIO, 2016.

33 Libicki MC. What Is Information Warfare? National Defense University, 1995.

34 Schmitt MN. Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. 2nd ed. Cambridge University Press, 2017.

35 Gordon S and Rosenbach E. America’s Cyber Reckoning. Foreign Affairs 2022 Jan.

36 League of Nations, International Convention Concerning the Use of Broadcasting in the Cause of Peace. Statute, 1936.

37 United States Information and Educational Exchange Act of 1948. Statute, 1948.

38 Foreign Relations Authorization Act, Fiscal Years 1986 and 1987. Statute, 1985.

39 Shane S. The enduring influence of Anwar Al-Awlaki in the age of the Islamic State. CTC Sentinel 2016; 9:15–9.

40 The French took a surprisingly aggressive approach: they hired Iraqi troops to target and kill French citizens “to ensure that French nationals with allegiance to Islamic State never return home to threaten France with a terror attack”. El-Ghobashy T, Abi-Habib M, and Faucon B. France’s Special Forces Hunt French Militants Fighting for Islamic State; French citizens have been killed by Iraqi artillery and ground troops using location coordinates and other intelligence supplied by French forces during the battle to drive the extremist group from Mosul, Iraq. Wall Street Journal (Online), 2017.

41 National Defense Authorization Act for Fiscal Year 2013. Statute, 2012.

42 Conference Report on The National Defense Authorization Act for Fiscal Year 2013. Statute, 2012.

43 “I’m warning you: We are at the verge of having ‘something’ in the information arena, which will allow us to talk to the Americans as equals.” – Senior Kremlin Advisor Andrey Krutskikh as quoted in Ignatius D. Russia’s radical new strategy for information warfare, 2017 Jan. Krutskikh also said, “You think we are living in 2016. No, we are living in 1948. And do you know why? Because in 1949, the Soviet Union had its first atomic bomb test. And if until that moment, the Soviet Union was trying to reach agreement with [President Harry] Truman to ban nuclear weapons, and the Americans were not taking us seriously, in 1949 everything changed and they started talking to us on an equal footing.”

Russia has long used disinformation and funding of extremist groups to sew discord in the West, particularly focusing on racial division. In the 1980s, Russia, perhaps in league with the Stasi, falsely reported that United States government scientists created the AIDS virus and were testing it in Zaire (now the Democratic Republic of Congo). United States Department of State. Soviet Influence Activities: A Report on Active Measures and Propaganda, 1986–87. Government Document. 1987. In typical fashion, this false allegation did not seek any particular political outcome. Instead, it undermined trust in the government, particularly in raising suspicion among minorities that some plots exist to exterminate them.

44 Jamieson KH. Cyberwar: How Russian Hackers and Trolls Helped Elect a President—What We Don’t, Can’t, and Do Know. Oxford University Press, 2018.

45 Zuboff S. Big other: surveillance capitalism and the prospects of an information civilization. Journal of information technology 2015; 30:75–89.

46 Consider the success of Theranos, a company that proposed to perform myriad tests using just a drop of blood, a claim that appears on its face impossible when researching publicly-available literature on minimum blood volume requirements for basic tests.

47 The problem of newspapers misrepresenting circulation rates, and thus gaining more advertising dollars, has been understood and regulated for a century. Lawson L. Truth in Publishing: Federal Regulation of the Press’s Business Practices, 1880–1920. Southern Illinois University Press, 1993.

48 Prier J. Commanding the trend: social media as information warfare. Strategic Studies Quarterly 2017; 11:50–85. Available from: http://www.jstor.org/stable/26271634.

49 Cheng D. Cyber Dragon: Inside China’s Information Warfare and Cyber Operations. Bloomsbury Publishing USA, 2016.

50 Tucker P. China’s Disinformation Warriors May Be Coming for Your Company. A recent attack on a rare-earths processor shows a new facet of information warfare: weaponized NIMBYism. Defense One, 2022 Jun. Available from: https://perma.cc/T6FB-S3Z4.

51 Wong E. Russia Secretly Gave $300 Million to Political Parties and Officials Worldwide, U.S. Says. New York Times, 2022 Sep.

52 The Zimmerman Telegram, a message from the German government to Mexican officials, promised that Mexico would regain territory lost to the United States if Mexico joined the German cause. The British intercepted and decrypted this telegram and then developed a cover to release the telegram to the United States under guise of human intelligence spying. The telegram’s publication unified public support; about a month later, the United States joined the war effort. Kahn D. The Codebreakers: The Comprehensive History of Secret Communication from Ancient Times to the Internet. Simon and Schuster, 1996.

53 Martin Libicki explains how hosting the platform on which others engage gives the host influence over relationships and increases dependence of the platform users. This can lead to soft power dynamics. Libicki MC. Conquest in Cyberspace: National Security and Information Warfare. Cambridge University Press, 2007.

54 Dai X. Toward a Reputation State: The Social Credit System of China. Unpublished Work, 2018.

55 For instance, some suspect the United States of using the IC to advance domestic commercial interests, as is common in many other nations, but this is illegal and impractical in America. Burton M. Government spying for commercial gain. Unclassified Extracts from Classified Studies—CIA 2007; 37(2).

56 Schelling TC. The Strategy of Conflict. Harvard University Press, 1980.

2.
Technology Basics and Attribution

Chapter image: With a formal speech and beauty enhanced by Athena, Odysseus convinces Nausicaa to assist him. Joachim von Sandrart, Odysseus and Nausicaa (1630–1688).

Source: D. Franken/Rijksmuseum Amsterdam/Public domain/
https://www.RijksmuseumAmsterdam.nl/nl/collectie/SK-A-4278.

Chapter Learning Goals

Understand the basic technologies and topology of the Internet.

Understand how technical design of the Internet raises security issues.

See through popular Internet mythologies.

Understand the evolution of cyberattacks: actors, motives, techniques, and surfaces.

Understand the relationship between Internet technologies and attribution (proving who was responsible for activity online).

Understand how structural, legal, and economic factors influence the amount of “anonymity” one has on the Internet.

Understand the different kinds of attribution and their dynamics.

Understand how companies, law enforcement, and intelligence agencies approach attribution differently.

Users are rarely truly anonymous—in the United States, the private sector, not the government, tends to know users’ identities.

This chapter sets forth the technological basics necessary to understand the cybersecurity-relevant aspects of the Internet. Once those are elucidated, the chapter turns to the attribution problem—the challenge of proving responsibility for Internet events.

We start by dispelling a myth: what we know as the “Internet” today is the outgrowth of decades of big-government, space-race investment. Today’s Internet has its roots in a Department of Defense research project to connect computers with a “packet-switched” network,¹ Unlike a circuit-switched network, like the telephone network, a packet-switched network does not require a circuit to be established and maintained in order to communicate. Instead, individual packets can find multiple, changing paths to a destination, and these different paths can convey data even if no direct end-to-end circuit is established.

The Department of Defense project, nested in its Advanced Research Projects Agency (ARPA, now known as DARPA, the D is for Defense), was called ARPAnet. The research labs and DoD-funded universities worked on ARPAnet throughout the 1970s.

What is the myth? That cyberspace is some autonomous creation that is somehow independent of governments and their suasion. That enduring popular view held by many civil libertarians has never been true in terms of technology or political science. The Internet was the creation of government; governments are the original “digital natives” with tremendous power online (Figure 2.1).

2.1 Technology Basics

This section sets forth the basic technology of the Internet that is most relevant to cybersecurity.

2.1.1 Fundamentals

At the highest level, the Internet could be conceived of as a network of privately owned networks. Because so many privately owned networks, from Berkeley.edu to The New York Times are linked, anyone can connect and send requests to obtain some kind of service from these private networks. As more people connect, more information and more utility can be derived from the network.

Figure 2.1 ARPAnet/MILNET geographic map, April 1984.

Definition 2.1.1 — Internet Protocol (IP). IP refers to a suite of technologies (Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and IP, among others) that specifies the underlying rules applied by computers to run the Internet. IP associates all computers on the Internet, giving them a way to exchange “datagrams” and assigns an address much like a postal address. Internet Protocol addresses (“IP address”) are key to attribution. The IP address of google.com is 142.250.191.78. If you type that numerical IP address into your browser, Google should load.

For computers to communicate, there must be an agreed-upon set of rules or protocols to connect and exchange data. In the case of Internet, IP was designed so that any computer, regardless of its operating system or architecture, could exchange “datagrams.” These datagrams are portions of our Internet communications, whether they are email, attachments, or requests to visit a webpage. Here, we refer to them as “packets.”

Definition 2.1.2 — The Web. The World Wide Web is what most people think is the Internet. Instead, the web is just one of the protocols (formally hypertext transfer protocol, thus the http:// in website addresses) and related software suites (e.g., web browsers and web servers, etc.) that are part of the modern Internet. The most popular “Internet” companies are actually Web companies. The actual Internet companies are relatively unknown among consumers: companies that connect users to the Internet itself (AT&T, Comcast, and Verizon), run critical low-level services (Neustar, Verisign), or are in charge of connecting networks or running the “autonomous servers” in charge of routing (Packet Clearing House).

The Internet divides our activities into packets and forwards them to other routers where they are reassembled at their destination. To make this routing possible, the Internet is divided into regions based on IP addresses, which are much like postal addresses. When a user connects to the Internet through an Internet service provider (ISP), the ISP assigns the user an IP address. That acts as a return address for whatever requests that user makes. The user makes requests or uses services, which in turn each have their own IP address. Routers make sense of these addresses and find multifarious paths to carry the user’s data from its origin to its destination. In the process, a user’s data may be broken up, copied, and multiple copies could travel along several different paths.

Recall from Chapter 1 that the Internet’s threat model contemplates strongly protected endpoints connected by unknown and untrusted networks. These untrusted networks route datagrams and could try to read them. But, such surveillance is becoming more complex because of the spread of encryption technologies.

Even in the presence of encryption, router operators and ISPs can still monitor communications and try to make sense of them. To borrow a metaphor from the paper mail, a postal service cannot read the contents of a sealed envelope. We could see the envelope as a form of encryption for paper mail. But, the postal service can read the outside of the envelope—the to and from addresses, the amount of postage paid, the weight and shape of the envelope, and so on. Router operators and ISPs can similarly examine the “envelope” of Internet packets. Technically called “metadata,” they are data about data. Metadata can be quite revealing, even if a surveillor cannot read the content of the packets.

Encryption systems are becoming more sophisticated. Clever techniques obscure metadata from some traffic analysis.² What this means is that threat actors “in the middle” of our communications (think Google’s Gmail or an Internet service provider that connects different networks) can inspect less and less of user traffic.

When packets are not encrypted, Internet operators can use “deep packet inspection,” technologies enabling the operator to see the source, destination, and content of communications. Deep packet inspection is like opening a postal mail envelope. A good example comes from Google’s Gmail. Among the reasons, Gmail was not end-to-end encrypted until 2023—and then only in a limited way—is that such encryption would make it impossible for Google to analyze users’ email and target advertising based on message content.

Table 2.1 Significant “wake up” moments in Internet insecurity.

Incident | What happened | Why it matters
Morris Worm (1988) | A graduate student released one of the first worms on the Internet, apparently to enumerate the size of the network, but it replicated out of control, clogging the early Internet | The worm’s fast propagation and need for coordinated response resulted in the creation of the Computer Emergency Response Team (CERT). The worm’s author was charged criminally, but is now a professor at MIT
Heartbleed (2012) | A security defect was found in OpenSSL, a widely used technology for secure communication | Unintentional mistakes can create security problems in widely used software, and these vulnerabilities can persist for years or decades
Meltdown and Spectre (2018) | Two bugs affecting almost all processors made in the previous 20 years were discovered. These bugs made the processors vulnerable to an attack where a low-level process could access data in a secure, high-level process | The bugs were a consequence of optimizing for speed; fixes for Meltdown involved 20–30% speed reductions. Cloud users faced the risk that data could be stolen by other users of the same cloud system, meaning that shared computing posed risks thought to be well-managed

The anecdote about Google reveals an underlying economic problem of the Internet: computing hardware, electricity, and bandwidth are expensive. So, how should all the network operators get paid for routing all of your Internet traffic? You don’t pay them for this service; whereas in the telephone network, a complex set of billing agreements distributes user payments to different network operators based on calling patterns. For some network operators, monitoring communications can provide a revenue stream, ranging from aggregate reporting (lists of the most popular websites) to micro-targeting (such as Google’s analysis of individual emails for ads). In our view, revenue models based on traffic and content analysis are security threats (to confidentiality and integrity) but often are quietly overlooked. Here’s an example: suppose your company wanted to develop a service that competed with AT&T, Comcast, Deutsche Telekom, Sprint, and Verizon. Might your business model be imperiled by the fact that these companies are the largest backbone operators of the Internet?

When the Internet was first designed, visibility into communications wasn’t a severe problem. Memory was expensive, so routers forwarded packets and then deleted them. But, nowadays, memory and storage are so inexpensive that intermediaries can copy and store packets to try to make sense of them.

Definition 2.1.3 — Metadata. Metadata are data about data. For instance, if you visit a website, data are recorded about the information you request. The metadata might include your IP address, the IP address of the server, the size of the page requested, and when you visited the page. Metadata, easily structured in databases, can be quite useful for link analysis (examination of who is connected to whom) and other forms of investigation. Link analysis is a powerful investigative technique because all complex crimes involve group coordination, leading to communications, financial, and even location records that can be linked across the criminal network.

Two quotes help explain the importance of metadata. Former National Security Agency (NSA) General Counsel Stewart Baker once said, “Metadata absolutely tells you everything about somebody’s life. If you have enough metadata, you don’t really need content.” Georgetown Professor David Cole relates an interesting anecdote about Baker’s quote: “When I quoted Baker at a recent debate at Johns Hopkins University, my opponent, General Michael Hayden, former director of the NSA and the CIA, called Baker’s comment ‘absolutely correct,’ and raised him one, asserting, ‘We kill people based on metadata.”’a Presumably, Hayden was referring to the CIA’s “signature strike” UAV program.

a Cole D. We Kill People Based on Metadata. The New York Review of Books, 2014; 10.

Computers on the Internet have IP addresses, such as Google’s 142.250.191.78. But, it is much easier to remember Google.com than 142.250.191.78, and so early in Internet history, the Domain Name System (DNS) was added to ease this translation from numeric to semantic identifiers.

The DNS was not part of the original Internet, yet it is now critically important and the focus of many cybersecurity and privacy concerns. The DNS could be thought of as a “phone book” of the Internet, ensuring a user’s request for Google is delivered to 142.250.191.78 rather than some rogue website. Thus, from a cybersecurity perspective, corruption of the “phone book” could be disastrous, as malicious governments or hackers could capture data from the user, redirect the user, or present the user with false information.

Why Can’t We Just Use Software to Secure Software?

We cannot use software to verify the security of other software because of the “halting problem.”

In 1936, Alan Turing invented a modern concept of computers when he proved that it is impossible to create a program that can analyze another arbitrary program and determine if it will halt or run forever—the “halting problem.” His finding is a fundamental limitation to computing and has had significant implications in the fields of computer science, mathematics, and logic. Among them: it is impossible to write a program that verifies that another is secure. This is why antivirus programs, for example, must use heuristics or pattern matching to attempt to identify malicious software—there is no possible solution that will work 100% of the time.

From a privacy perspective, the DNS also presents a confidentiality risk because tracking DNS reveals the list of websites users visit. Thus, marketers have incentives to keep DNS requests unencrypted so they can read them.

The DNS is hierarchical in two senses. First, DNS is divided into top-level (e.g., .edu for educational sites and .com for commercial sites), second-level (lsu.edu or nytimes.com), and third-level domains (known as subdomains, such as cct.lsu.edu or archive.nytimes.com). Second, a small number of authoritative “root zone” servers specify routing for top-level domains, and the information from this trusted group of computers is distributed to hundreds of root servers across the world.

The nonprofit Internet Assigned Numbers Authority (IANA) has responsibility for the DNS root—the authoritative source “phone book.” Most root zone servers are run by American government agencies (Department of Defense, NASA Ames, Army Research Lab) or by American companies and educational institutions, some of which are closely affiliated with the government (Verisign, Cogent Communications, University of Southern California, University of Maryland, Internet Software Consortium).

Smaller ISPs copy these authoritative root zone DNS tables and may add their own specifications for security purposes. For instance, major ISPs AT&T and Comcast hard-code their own DNS servers into users’ modems (so users can’t be tricked into changing them to a corrupted version). AT&T and Comcast could have good cybersecurity reasons for requiring their own DNS. The DNS could be customized, and the ISPs could monitor when users are looking up malicious domains and block these services. However, the custom DNS also means the user has to rely on the root zone providers and their ISP to deliver honest DNS services. The ISP could also use the DNS to spy on their activities, including for advertising purposes. Or a court could order AT&T to change a specific user’s DNS table so the user visits a website containing malicious code spread by a law enforcement agency for investigation purposes.

Question 2.1.1 — ISP as Threat Actor. Chapter 1 included a discussion of Internet threat actors. As you read Chapter 1, did you consider how service providers, such as your Internet Service Provider (Comcast/Xfinity, AT&T) or other service providers (Google Gmail, Facebook/Meta) could be threat actors? How might these companies threaten confidentiality, integrity, and/or availability (CIA)?

▄

2.1.2 Reliance Is a Fundamental Element of Computing and the Internet

We have learned that DNS is a key cybersecurity concern, as its corruption could result in dramatic attacks on the confidentiality, integrity, and quality of the information we receive. Nowadays, the operators of the DNS follow an elaborate security procedure to ensure its integrity. But, this was not always the case. In 1998, Jon Postel, as part of the ARPAnet team, convinced eight of the twelve root zone DNS operators to treat Postel’s DNS database as the definitive version.³ Postel did this by emailing the other operators.

The Jon Postel anecdote illustrates that, “[t]he Internet is as much a collection of communities as a collection of technologies…”⁴ In this human-technical system, users must rely on the processes and individual decisions that system administrators make. This reliance pervades Internet transactions.

Consider the act of visiting Google.com from a desktop computer. The user types in Google.com into the browser. At this stage, the user must rely upon teams that designed the computer, the operating system, and the browser software to all have the proper incentives for security. As the user tries to visit Google, the browser queries the DNS to find Google’s IP address, and multiple ISPs route the DNS request and the call for Google.com. At this point, the user must trust that DNS is accurate and that the ISPs routing these requests do not misdirect or spy on the communication. Finally, as the browser renders Google.com, the website distributes an encryption key to the user to prove its legitimacy. But, how is this key verified? That is, how can one be sure that some malicious person has not created a look-alike version of Google to capture the user’s login details? An entity known as a certificate authority, such as Comodo, attests to the validity of Google.com. Ultimately, the user has to rely on the certificate authority having proper procedures to attest to Google’s identity. But, how do you know which certificate authority to use? This question is left to technology companies. Apple, Microsoft, and Google have policies for including certificate authorities as trusted root providers of identity. Periodically, these certificate authorities have failings that cause Google and others to distrust them (Figure 2.2).

This short thought experiment is abstract and omits many details. But, it illustrates the larger point that humans and human-designed processes are relied upon for the most basic Internet transactions. Alone with one’s computer, it is easy to conceive of Internet use as a form of automated perfection. Under the hood, the reality is different.

Figure 2.2 A trusted root certificate (Apple later removed this certificate). The company was implicitly trusted to verify the identity of websites visited.

2.1.3 Internet Layers

The Internet can be conceived of as a series of dependent technology “layers.” Users typically experience only one layer of the Internet, the highest layer, where applications work. But, experts know there is a lot more “under the hood,” and for cybersecurity purposes, it is important to know how these more fundamental technologies can be attacked in clever ways to deny confidentiality, integrity, or availability. In addition, multiple layers can be attacked simultaneously. As we walk through the different layers of the Internet, it should become clear that Internet security is an immense task that involves everything from software engineers to locked doors to rodent-resistant tubes. We also use this section to introduce important Internet technologies.

2.1.3.1 The Physical Layer

We start with the physical layer of the Internet, the tangible technologies that take packets of information and move them across the globe. Under the Open Systems Interconnection (OSI) model, the first layer of the Internet is physical. The Internet’s physical presence is multifarious and broad ranging. It includes the electromagnetic spectrum, because so many of us connect using wireless signals. The Internet also includes tubes. Although the idea of tubes was derided by many,⁵ much of the physical Internet consists of tubes containing fiber optic cables. Some connect distant continents, while others connect data centers.

The core technology of the Internet, the IP suite, is agnostic to the physical layer, and thus, the Internet can run on almost any medium. The current medium of choice is fiber optic and copper cabling, but TCP/IP can operate over telephone lines, microwave, satellite, and even radio.

The necessity of a physical layer is the chief reason we argue that cyberspace is a place. And where the physical is layer matters because attackers can levy dramatic CIA attacks on the physical layer. Attackers can monitor fiber optic cable even at the bottom of the sea, tamper with them, or cut them.⁶ Thus, nation-states with lots of Internet infrastructure (e.g., the United States, the United Kingdom, and the Netherlands) have home-field advantages in intelligence gathering and offensive cyber because they have physical access to fiber that can be tapped, degraded, or simply disconnected. The Internet’s dependence on physical place also means cyberwar might be primarily fought with physical means. A country facing an adversary with talented hackers might bribe construction workers to “accidentally” sever lines with a backhoe, shoot down the adversary’s satellites, or blow up its Internet infrastructure. Having the best offensive hacker team in the world does little good if they cannot use the network.

Definition 2.1.4 — Dark Fiber. This term refers to fiber optic cable that has been installed but not connected to the public Internet. Sophisticated companies might buy up dark fiber and use it to establish private network connections between their computers around the world. This is thought to be more secure, but of course, attackers can dig up dark fiber and wiretap it.a

a Savage C, Miller C, and Perlroth N. NSA said to tap Google and Yahoo abroad. The New York Times, 2013 Oct:10–30

Domestic physical layer infrastructure and services also contribute to cyber resilience. In a large country like America, China, or Russia, most Internet traffic might be domestic. As a result, large countries, in an attack, might simply disconnect from international connection points and most users would be unaffected.

Places and Interception

A 2019 profile of the UK Government Communications Headquarters (GCHQ) reported that analysts were using machine learning to determine the “best Internet access points for collecting data.”a “At the moment the decision on where to position the bearers, or ‘clips’, that enable the transmission of data between networks, is taken by GCHQ operatives, depending on the location of the target and the type of device and network they are using.” The place that communications occur and the physical locations where data are routed matter.

a Bond D. Inside GCHQ: the art of spying in the digital age. Financial Times, 2019 May 23.

The desire for cyberpower is driving demands for greater Internet sovereignty and data localization. Internet sovereignty is the idea that a nation has legal jurisdiction and control over the Internet communications flowing through it and the services provided. Practically speaking, this means an American company doing business in China would have to follow local Chinese law and legal demands.

Data localization is a strategy to enhance Internet sovereignty by requiring that businesses physically place data and infrastructure in a specific country. By doing so, the host country has more options for getting data out of a company. For instance, a company executive might think that a foreign government cannot access data because the data are encrypted on foreign servers. However, a foreign government might jail the company’s local employees or disconnect its infrastructure. In smaller countries with limited ISP choices, a judge could just order the ISP to block all of the company’s traffic. Technology cannot ensure security—governments and people still matter.⁷

Weaker cyberpowers have less ability to compel companies and users. They also have less resilience. An Internet discussion between users in different countries in central Africa, despite a short distance as the crow flies, is far more subject to surveillance. Traffic on the African continent is likely to be routed by satellite, perhaps many times around the world, before it is delivered to its destination. Thus, limited physical options often means more opportunities for surveillance and control. Nations with fewer and narrower tubes are easier to attack with availability-denying strategies, such as distributed denial of service (DDoS).

2.1.3.2 The Link Layer

Once two computers have a connection over the physical layer, the next layers establish rules so data can be exchanged. Layer number two, the data link layer, associates computers with media access control (“MAC”) addresses that are unique, so data can originate from an identifiable machine and go to another. As users, we experience this when we connect to a Wi-Fi access point. That access point has to enumerate our computer so when we visit a site, the result is returned to the proper computer instead of another user’s device (Table 2.2).

Table 2.2 Attacks can happen at any layer (or across different layers) of the networking stack.

Layer
Attack vectors
Mitigations: technical, procedural, and legal

Physical: the fiber optic cables and other infrastructure that carry the electrons that form Internet communications
These physical infrastructures can fail or be destroyed in myriad ways, from being chewed up by rats, cut by road workers, or blown up by bombs
Fiber optic cables are buried, routed to locked cabinets, and switched in high-security buildings. Laws protect the physical layer by prohibiting trespass and destruction of property

Data link: provides the identifiers (media access control “MAC” address) and the transmission method for devices to communicate on the physical layer
One might confuse a switch by giving it instructions to send or copy information to the wrong computer, or knock a wireless computer off a Wi-Fi access point by sending a command to disconnect the target computer
Intrusion detection software can monitor MAC address tables and access requests, and then block suspicious, high-volume requests. Computer crime and wiretapping laws prohibit hacking and intentional interception of data

Network: this layer takes data from the link layer, organizes it into packets, adds IP ad-dresses, and is responsible for forwarding packets to other routers and computers
Border Gateway Protocol (BGP) determines how routers find connection paths among computers; the DNS converts semantic domain names (e.g. Google.com) to its IP address for routing (142.250.191.78). Both protocols could be attacked to send data to the wrong computer
Significant efforts have focused on developing secure versions of BGP and DNS, but often Internet actors have disincentives to adopt these protocols. For instance, encrypted DNS would deprive advertisers of information about users’ Internet activities. Computer crime and wiretapping laws prohibit hacking and intentional interception of data

To accomplish that enumeration, all computers have at least one MAC address. Modern devices have several, associated with their ethernet, Wi-Fi, and Bluetooth connections. These are physical (hardware-defined), rather than logical (software-defined), identifiers, although it is possible in some cases to override the default MAC addresses in software. For many devices, these identifiers cannot be changed. They are openly broadcast over local-area networks so connecting to other computers is easy. The combination of uniqueness, immutability, and promiscuous advertisement of availability makes MAC identifiers attractive to those interested in presence sensing (has this MAC address been in my store before?) and for security (we can trust that this MAC address is our employee’s mobile phone, at least to a point). Thus, MAC identifiers have become relied upon both as a tracking mechanism (for identification) and as a security one (for authentication of identity). Attackers might take advantage of this reliance and pretend to be a legitimate user by “spoofing” their MAC address. By doing so, the attacker may be able to get a network to send them data intended for the legitimate user.

Definition 2.1.5 — MAC Addresses. The media access control address (MAC address) is a 12-digit hexadecimal identifier assigned to the network devices in a computer.

To see your MAC address, on an Apple, open a Terminal and type ifconfig. The string of hexadecimal numbers (e.g., 00:00:0A:BB:28:FC) appearing after ether is your MAC address. The “dotted decimal” address appearing after the word “inet” is your IPv4 IP address; the value after inet6 is your IPv6 IP address.

On a PC, click on the Start menu item, select Run or type cmd (for command) into the search bar near the Start menu item. Then, type ipconfig/all.

You’ll see that your computer has several MAC addresses. There is one for each network interface in your computer and MAC addresses are intended to be globally unique. MAC addresses are structured and you can find information about their syntax online. Notably, the initial portion of the MAC address indicates whether the address is managed locally or globally. Global addresses are “baked into” the device by its manufacturer and the first three bytes of the address identify them. For example, MAC addresses beginning with 24:5E:BE or E8:43:B6 are associated with devices from QNAP Systems, a Taiwanese manufacturer of network-attached storage devices, routers, etc.

Other attacks at this level might look like electronic warfare. For instance, one might stop any user from connecting to a Wi-Fi access point by sending many false MAC addresses along with requests to connect. These false requests might overload the access point, making it impossible for legitimate users to connect.

2.1.3.3 The Network Layer

Once a device is enumerated, the network layer can do its work of taking data from machines, associating them with IP addresses, and finding routes to send information to its proper destination.

Definition 2.1.6 — IP Address. The IP address associates your device with the network. You have to have one, otherwise the network would not know what data to send to your computer.

There are public and private IP addresses. Typically, when you connect to a network, such as your school’s Wi-Fi, you are assigned a “private” (private in the sense of privately owned, not private in the sense of the right to privacy) IP address on the network. When you use your computer, your school sends your requests over the public network, using its public IP address to fetch your content. Once your school’s network obtains the content, it routes it back over the local network to your private IP address.

You can see your public IP address by visiting a service such as What’s My IP (https://www.whatsmyip.org/more-info-about-you/). You can find your private IP address by opening a terminal and running ifconfig (MAC) or ipconfig/all (PC). Your private (IPv4) address will be listed after the word inet.

IP addresses are a key element in cybersecurity. IP addresses are the prime routing mechanism for devices and data. Typically, they are the first element used to understand a cyberattack, because IP addresses can signal the identity of machines attacking a network.

In ordinary operation, an IP address indicates to a router whether information is supposed to be sent to a local or remote computer. Routers then forward this information to the intended destination.

The Border Gateway Protocol (BGP) determines how routers calculate paths to destinations. Thus, BGP is of core importance to Internet security. If BGP data is corrupted, information could be sent to the wrong place, nowhere, or through jurisdictions where governments copy and spy on data. For instance, in advance of protests organized in Iran with a communications service call Telegram, state-owned Iranian ISPs “hijacked” traffic associated with Telegram, redirecting it through the country. Doing so gave the Iranian ISP the opportunity to inspect, block, and even pretend to be the Telegram service.

Definition 2.1.7 — BGP. BGP is responsible for identifying viable paths among servers. These are distributed and managed by the Internet’s “autonomous servers.” If one can manipulate BPG, one can redirect traffic for mischief. For updates on possible BGP hijacking, follow the Cisco @BGPstream Twitter account (https://twitter.com/bgpstream).

As certain nations develop muscular spying skills, and to avoid jurisdictional conflicts, Internet users might want to override the path-sending functions of BGP and specify their own paths. For instance, an American business might want its data to never leave the United States, or traverse Europe instead of China on its way to Turkey. Path selection could be considered an element of quality of service (QoS). Attempts to provide QoS elements, such as priority treatment to latency-sensitive data (voice and video), run into economic incentive conflicts and concerns that QoS interferes with network neutrality (discussed further below). Large Internet companies such as Google own significant amounts of “dark fiber,” that is, fiber optic network infrastructure that is not connected to the public Internet. Such companies can use dark fiber for super-fast, path-controlled connections.

2.1.3.4 The Transport Layer

The transport layer manages the division of data into smaller segments, and the proper reassembly of those segments when they reach the destination computer. This layer uses Transmission Control Protocol (the TCP in TCP/IP) and the User Datagram Protocol (UDP).

The transport layer is a frequent target of DDoS attacks, although such attacks can occur at other layers. TCP has procedures to establish a connection between two computers, and these procedures can be abused. For instance, an attacker might send a request to initiate a communication with a target computer. But, when that target computer responds, the attacker remains silent. The target computer politely waits for the attacking computer to converse. In so doing, the attacking computer ties up the target’s resources. If there are enough attackers (the “distributed” in DDoS), the target becomes overwhelmed waiting for attacking computers to “talk,” and legitimate users cannot connect to the target (Table 2.3).

Table 2.3 Attacks can happen at any layer (or across different layers) of the networking stack.

Layer | Attack vectors | Mitigation: technical, procedural, and legal
Transport: this layer is commonly governed by the Transport Communication Protocol, which handles the transmission and assembly of packets so they are in the correct order | An attacker could flood the target with incomplete requests to accept data, so the requests occupy all the memory TCP has to operate | Floods of requests can be filtered, or the recipient can impose costs on the sender by requiring some processing before accepting new requests. Computer crime and wiretapping laws prohibit hacking
Session: as computers connect, the connection itself has to be started, managed, and terminated | An attacker could hijack another user’s session, and intercept or tamper with data | Session hijacking can be mitigated by encrypting sessions and limiting the number of session establishment attempts. Computer crime and wiretapping laws prohibit interception and tampering with data
Presentation: this layer converts session data so the application layer can understand it and application-level data can be sent. This often involves compression, encryption, and decryption | An attacker might input data that causes an application to behave in unexpected ways—for example, sending more data than the application expects or deliberately formatting the data incorrectly | Input data can be filtered for dangerous requests. Computer crime and wiretapping laws prohibit hacking and intentional interception of data

The DDoS problem reflects the end-to-end nature of the Internet. The network itself is tasked with delivering packets with best effort, even if these packets are malicious. It is up to the hosts to filter or “drop” these malicious packets (end-to-end principle) instead of having the network automatically filter them. In recent years, powerful anti-DDoS services have arisen, such as the reverse proxy, that can absorb enormous demands on servers. Reverse proxies stand “in front” of a company’s actual web servers and are expertly configured to serve content while blocking all sorts of malicious traffic. The best-known service is Cloudflare, a company that now plays a huge role in deciding how to move data around the world and can “see” attacks in ways others cannot.

▄ Example 2.1 — Cloudflare. Cloudflare is among the most important companies for cybersecurity nowadays. Many businesses use Cloudflare’s network to provide content distribution (to have a server with the content in close physical proximity to the user) and to filter out attacks. Because Cloudflare has servers in over 200 cities, Cloudflare “sees” many more attacks than the average network user. It’s worth checking out Cloudflare’s model: https://perma.cc/PEE4-PFAG.

▄

2.1.3.5 The Session Layer

The session layer is responsible for starting, managing, and terminating a user’s session on a service. As such, the session layer can be targeted for hijacking or integrity attacks. In hijacking, the attacker takes over a user’s session and pretends to be the user. In doing so, the attacker gains control of the user’s current interaction with a service, possibly gaining access to credit card numbers and other data.

▄ Example 2.2 — Firesheep. In 2010, a simple-to-use browser extension known as “Firesheep” became available that made session hijacking possible for anyone. The extension intercepted unencrypted session cookies and simplified the process of hijacking user accounts associated with those cookies. Users checking their Facebook or Twitter accounts in coffee shops could be rudely surprised by pranksters posting false information or stealing private information from their accounts. The advent of easy-to-use session hijacking tools drove many companies to adopt encryption more pervasively.

▄

2.1.3.6 The Presentation Layer

The presentation layer translates information from the network to the application layer. This layer is responsible for encryption, decryption, and compression. Attacks on the presentation layer include degradation of encryption. For instance, an attacker might convince a service into using less secure encryption, or no encryption at all.

▄ Example 2.3 — Kevin Mitnick’s FBI Crypto Hack. A real-life example of cryptography denial came from famous hacker Kevin Mitnick. On the run from the FBI, Mitnick overwhelmed the agency’s encrypted communications systems so the FBI had to use a less secure system that Mitnick could monitor.⁸

▄

2.1.3.7 The Application Layer

A major point of IP was to allow computer operators to make diverse applications that nevertheless still could exchange data with any other computer. On the application layer—the layer most people experience as “the Internet”—there are a wealth of applications, from the web, to email, to FTP, to database access, to games, and so on.

Because anyone can make an application, the scope of programs is unlimited, but so are the vulnerabilities. These range from insecure web pages, to browser extensions with vulnerabilities, to games that run on platforms that are systemically insecure, to macros in the Microsoft Office suite, to backdoors in software, to poorly written applications that are not resilient to attackers inputting data in an unexpected format. Vulnerabilities in code are often not easy to spot, even for seasoned programmers, and tiny mistakes can be amplified by an experienced and determined attacker into full system compromises.

Mobile “apps” now constitute a major cybersecurity problem. These programs are often just a website service “reskinned” into an application that can be downloaded on a mobile phone. But, mobile apps are different from webpages. Apps have a greater ability to manipulate or extract information from devices, particularly on the Android platform. For instance, the IMEI address, the precise GPS, and clipboard data (copy and paste data, which often contains passwords) of a device remains private when one visits a website. However, an app can extract these unique device identifiers and information. In addition, many mobile apps are poorly coded, with both accidental and intentional security problems. For instance, researchers found a mobile application library that scanned local networks for other devices’ MAC addresses and collected clipboard information, GPS, and IMEI identifiers. The library was included in several Koran-study applications and appears to have been deployed by a US-based defense contractor.⁹ Suspicious, huh?

Question 2.1.2 — App-layer Data Leakage. Please read this short, helpful memo from our government about minimizing location data. National Security Agency. Limiting Location Data Exposure. 2020 Aug available at https://perma.cc/9Z9M-Z44R

Be prepared to discuss the motivations and implications of the recommendations in class.

▄

2.1.3.8 The Human Layer and Social Engineering

While not a part of the so-called “OSI stack,” we think there is another layer: the human layer.

Computers are used by people. Often, it is easier for an attacker to trick a computer user into creating a vulnerability, or degrade CIA, than figure out some technological hack. In recent years, social engineering has become a prime method of tricking people into revealing passwords or changing settings to allow hackers into systems. Social engineering simply means using interpersonal relationships to persuade a user to grant an attacker access. In a series of books, notorious hacker-turned-security-consultant Kevin Mitnick detailed ingenious ploys to trick insiders at companies into revealing their passwords, and even the temporary codes generated by multi-factor tokens.¹⁰

These social engineering attempts typically involve an attacker who learns the “lingo” of a company and investigates its employees and their working relationships. Mitnick would typically urge an employee to quickly reveal a password or take some step (usually to “save the day” in a fabricated emergency) that granted Mitnick access to information or a computer.

Aside from tricking people, attackers might bribe them, or coerce them financially, politically, or with violence.

Governments need not use artifice to elicit information from companies. Some governments will harm or jail employees who refuse to provide information. No matter how good one’s security is, few of us could withstand what’s known as a “rubber hose” attack—where an attacker physically beats a person to extract a password (Table 2.4).

2.1.4 Cybersecurity Depends on Generations of Legacy Technologies

Communications technologies have “affordances,” a fancy term for the activities a technology facilitates and the limits and side-effects that technology has. Different technologies have different affordances, including different capacities to protect CIA. For instance, encryption has been used for millennia to protect the confidentiality and integrity of messages hand-carried by couriers or flown by courier pigeons. As new communications technologies were invented, CIA concerns continued, but were shaped by the affordances of the underlying technologies.

Table 2.4 Attacks can happen at any layer (or across different layers) of the networking stack.

Layer
Attack vectors
Mitigations: technical, procedural, and legal

Application/Cloud: this layer is the one the user regularly sees and experiences, including web, email, and any kind of app a developer can make, such as those hosted in the “cloud”
There are myriad attacks on the application layer because there are so many applications, and because almost anyone can develop an app. Application-level attacks range from repeatedly sending bogus data to a website (DDoS) to worms, viruses, and backdoors
Applications need to be monitored to set careful access controls, filter input, and impose costs on users who are making repeated requests to the application (such as requiring a CAPTCHA). Computer crime and wiretapping laws prohibit hacking and intentional interception of data

Human: people use computers and cause insecurity through error or malicious activity
Phishing, the practice of fooling a user into revealing some secret, such as a password, or taking some action, such as sending money, is a key attack on the human layer
Users are trained to recognize trickery online. High-value accounts might require two people to authorize a transaction. Increasingly, users have two-factor authentication systems so if a password is stolen, it cannot be used without the second method of authentication. Again, computer crime laws provide privacy as well

CIA for content and metadata depend a great deal on the affordances of a given communications technology. Consider some historical examples.

The early postal mail lacked confidentiality and integrity because communications were sealed with wax. Robert Ellis Smith, in his historical account of privacy, notes how original message carriers would lift seals, read private communications, and sometimes add mischievous messages to others’ letters.¹¹ In creating the Post Office Department in 1792, Congress forbade the opening of mail. But, this legal protection was greatly enhanced by a technical one that we take for granted now: the advent of the envelope.

For much of history, paper was expensive; so much so that it was often reused. But, in the mid-nineteenth century, envelopes became popular and recognized as vessels for postal mail, making the content of letters more secure against tampering. Of course, the metadata of letters was vulnerable. Postal carriers and the postal system can easily engage in traffic analysis by examining who is writing to whom, how frequently, and how weighty the letters are.¹²

The optical telegraphs of the eighteenth and nineteenth centuries also lacked confidentiality, but contextual social conditions made this less relevant. Optical telegraphs were signaling mechanisms, typically built on a hill so they could be viewed by another telegraph operator miles away (e.g., “telegraph hill”). Anyone could observe the optical telegraph, and thus there were more opportunities for interception of both content and metadata. In addition, every “network operator” in charge of relaying semaphores (signals) could copy and decode them.¹³ Interestingly, illiteracy of the population—even of some signal operators—reduced the risk to confidentiality.¹⁴

Optical telegraphy disappeared quickly after the advent of the electronic telegraph. With it, different CIA challenges and countermeasures emerged. Unlike the optical telegraph, the electrical telegraph was widely used by businesses and ordinary people.

The electrical telegraph had a political feature worth noting: Some nations terminated telegraph communications at national borders and required messages to be retransmitted. This practice gave nation-states the ability to impose more control over domestic messaging. As we think about Internet security, some world leaders have concluded that the Internet makes it too easy to send information over international borders. Their nations may create or recreate institutions to control such communications.

There were other confidentiality risks associated with the telegraph. Endpoints were connected by thousands of miles of wires, which provided many opportunities to discreetly wiretap the telegraph. Thus, users quickly developed elaborate codes to hide their communications from telegraph operators, protect against wiretapping, and also minimize the cost of their messages by making them shorter.

Radio, too, was as indispensable as it was useful. Its use in World War I was secured, unsuccessfully, by encryption, as described by Herbert Yardley.¹⁵ The metadata from radio in the form of direction finding also created new opportunities to locate adversaries. Thus, radio created a new kind of security risk.

The telephone went through several technological revolutions, all of which had security and privacy implications for metadata and content. The first telephone services, like the electronic telegraph, were expensive, point-to-point networks. Company managers might have a telephone line to discuss business with a remote facility. Over the twentieth century, the technical infrastructure evolved from point-to-point closed networks, to manual switching by switchboard operators (who could listen in to calls), to mechanical switching by great machines, to electronic and eventually digital switching towards the end of the century.

In addition to different generations of technology, the way in which national telephone providers emerged—by buying smaller companies and then integrating their technology—created another layer of complexity and new forms of insecurity. To this day, the problem of systems integration generates situations where companies cannot access information in their own systems. Why? Because these systems came from multiple companies using different technology that was not fully compatible. Thus, in the telephone system, artful hackers found ways to pass their calls through older-generation technologies that lacked modern tracking. This made it possible for some to make completely anonymous, un-logged calls. ¹⁶

The first Internet access occurred over phone lines, and to this day, Internet security is shaped by the structure of telephone networks.

Question 2.1.3 — Technology Convergence. Many of our technology policy issues are related to convergence, the merging of different generations of technology. For instance, SMS originally only traveled among subscribers to the same mobile network (e.g., AT&T subscribers). But, eventually, consumers wanted to send text messages to users of other services, and so, phone companies integrated SMS across carriers. This led to a rise in SMS spam. Finally, carriers connected SMS gateways to the Internet. It is now possible for scammers to send unwanted text messages in bulk from anywhere in the world, and the user has no practical way of tracing or blocking these messages.

What other technologies are likely to converge, and what are the security implications?

▄

As traditional switched telephone networks converged with packet-switched Internet ones, the technology made it possible to fake the origin of calls in new ways. Nowadays, scammers can compound the complexity of the Internet and phone networks to make calls anywhere in the world. Thus, recent years have seen an increase in foreign scam calling that is seemingly unstoppable.

Undersea cables have played an enormous role in the relative security of telegraph, telephone, and now Internet-based communication. Submarine cables and repeaters that boost signals along the way can be wiretapped for both metadata and content by the so-called “pre-positioned devices.” They can also be damaged (this sometimes happens intentionally or unintentionally with ships (Figure 2.3),¹⁷ leading to communications blackouts.

Nations with many cables are more resilient against attack. But at the same time, countries that see speech and Internet content as presenting “cybersecurity” issues are less able to censor content in a geography with many cables. This is because more cables provide more routes for service, more service providers, and so on. Diverse, private ownership of such infrastructure is key to freedom on the Internet. If all such infrastructure were controlled by one entity—public or private—censorship becomes trivial. Private ownership, particularly when those owners hail from businesses with diverse incentives, provides a competitive environment that promotes free speech and diversity of content.

In the United States, submarine communications cables are regulated by the Federal Communications Commission. Their placement has become subject to more scrutiny. In 2020, the FCC, relying on its “Team Telecom,” blocked Google from terminating a transpacific cable in Hong Kong (but allowed this same cable to branch to Taiwan). Team Telecom is a consultative process where national security, law enforcement, trade policy, and foreign policy bodies provide feedback on the risks of telecommunications licensing. In 2019, Team Telecom blocked China Mobile from offering phone services on domestic providers’ networks.

Figure 2.3 This world map of submarine communication cables illustrates several aspects of the Internet. First, cyberpower can come from having many connection points. Second, the many cables to the United States means the nation has an advantage by intermediating much of the world’s Internet traffic. Routing at the least cost can cause foreign communications to pass through facilities in Miami, FL, for instance. Third, the map shows the intricacy, interdependence, and even delicacy of the Internet’s physical layer. Cable data by Greg Mahlknecht as of 2015, world map by Openstreetmap contributors. This file is licensed under the Creative Commons Attribution-Share Alike 2.0 Generic license. TeleGeography maintains up-to-date analyses of submarine cables.

Definition 2.1.8 — Team Telecom The Committee for the Assessment of Foreign Participation in the United States Telecommunication Services Sector (“Team Telecom”) is an FCC-led task force that draws upon expertise from the Department of Justice and national security officials to oversee foreign investment in US communications systems. Team Telecom ensures that law enforcement can obtain access to communications when needed, while preventing foreign investment from creating national security risks.

Looking ahead, we see two fundamental revolutions at hand. First, there has been a dramatic democratization of strong-encryption communication tools that most consumers now use. From Facebook’s WhatsApp to Apple’s iMessage to security-first Signal, it has never been easier for the average consumer to use strong encryption. The critical factor is that encryption is on by default, without any need to configure the service. Now, law enforcement agencies and some factions within governments want countermeasures, such as an ability to undo encryption without user consent.

Second, the private outer space industry and its satellite systems are changing the game. Companies like SpaceX Starlink are attempting to launch worldwide consumer Internet services via satellite. These systems could change the “place” where communications travel, making them physically out of reach of most countries (only a handful of nations have space launch capabilities). Presumably, nations will not be able to deny nor disrupt the ability of individuals to connect to these satellites from the ground. However, nations are racing to create anti-satellite technologies. There is a diverse set of strategies to disable spaceborne devices in reach of states without launch capabilities.

This evolution toward satellites does not mean the medium will be lawless, however. Just like ships at sea, satellites carry a national “flag.” Companies that launch space vessels domicile their operations in a host state where they ultimately can be held responsible. Starlink is licensed by the US FCC and is therefore subject to US space law regulations.

Exercise 2.1 — Personal Threat Assessment. Note: this assessment will reveal information that could be used to attack your computers and data. We suggest that you keep it private.

Background: As you have explored through the exercises, readings, and class discussion, networked devices and services create a variety of cybersecurity vulnerabilities. These vulnerabilities may be more or less costly, practical, or even possible to address.

One tool organizations use to understand their cybersecurity risk and inform decisions about addressing it is a “threat assessment.” This exercise maps vulnerabilities and assets and considers the risks they present, allowing an organization to then set policies and deploy resources to address the risks.

Please perform this on your own. You could fill out the answers and just save them as a PDF.

Note: As you think about risk in Questions 8 and 9, consider how likely a negative event is to occur and how large the downside harm if it were to occur. (You can also consider the cost of addressing the risk, but this is best thought of as a separate step.) Calculating the likelihood and severity of an attack is a traditional method of assessing how to allocate resources. For example, an unlocked car on the street in downtown Berkeley is likely to be rifled through, but if nothing valuable is in the car, the overall risk may be small. On the other hand, a database that is connected to the Internet may have only one, obscure technical vulnerability that seems unlikely to be discovered or exploited, but if that database contains the valuable medical information of all the residents of the state of California—i.e., the potential negative effects are substantial—we may still consider the risk high.

List all the machines/devices (whether owned or operated by you or by a third party) on which you might store or transmit information or communications.

Which of these machines/devices contain information you would consider valuable or otherwise in need of protection?

What protections do you have in place (encryption, password protection, etc.) for these machines/devices?

List all the communication or storage services (whether owned or operated by you or by a third party) that you might use to communicate or store information.

Which of these services maintain or use information you would consider valuable or otherwise in need of protection?

What protections do you have or these services have in place? For example, you might have certain privacy settings, the service might use encryption, etc.

Is there anything you do not know about the protections (or lack of protections) provided by these services that would help you understand the threat to information on those services?

What do you think are the most concerning cybersecurity threats associated with using the devices and services you listed above? Be sure to think about the varying risk profiles for different kinds of information, devices, and services. In addition, think about the ways in which you would learn whether or not cybersecurity has been breached and by whom.

What strategies might you taking to mitigate the risks identified in Question 8? Are there any behavioral or economic impediments to employing these strategies? Any incentives for or against?

▄

Question 2.1.4 Filtering — “In the Network”. This description begins to bring out an important policy issue: should there be filtering “in the network” against malicious traffic such as DDoS attacks? At what point might we consider it more economical to perform these functions centrally? What would we need to know to make that decision? And what cost to innovation and freedom would such a decision impose?

▄

2.1.5 “Controlling” the Internet

Civil society advocates often warn that so-and-so is attempting to “take over the Internet.” But, this begs a question: who is “in control” of the Internet? For our purposes here, it suffices to say that many, and often legally and economically interdependent, stakeholders run the Internet. Thus, the mantle of “protecting the Internet” is a simplification used to motivate users to care about some policy goal.

Consider these different views of Internet control:

The tube owners control the Internet  The physical infrastructure of the Internet is controlled by many companies and governments who own and regulate the tubes, satellites, and towers that connect different networks.

The people in charge of the routers control the Internet  The different Internet exchanges route data through tubes; therefore, entities such as the Packet Clearing House control the Internet by deciding what protocols and routes will be used to transfer data to their destinations.

The standards body groups control the Internet   Technical governance groups, such as the Internet Engineering Task Force (IETF), decide what protocols are used. Thus, they control the technical operation of the Internet.¹⁸

DNS controls the Internet  The web is semantic (for instance, one enters the easy-to-remember “google.com” instead of the company’s IP address, 142.250.189.174). Thus, the Internet Corporation for Assigned Names and Numbers (ICANN) controls the Internet by deciding how to translate IP addresses through the DNS.

Platform oligopolies control the Internet  At the application level, large companies control the Web by deciding how to route users to search results (Google); by defining “authentic” user behavior and “fake news” to be blocked (Facebook/Meta); by hosting most of the email sent and received (again, Google); by controlling cultural content consumption and production (Netflix); or by offering a large portion of application-level services (Amazon).

Consumers control the Internet  Every device one buys and connects grows the size of the Internet.

A government cabal controls the Internet  At the policy level, governments can be said to control the Internet through identification requirements, censorship, surveillance, computer crime law prosecutions, or through aggressive application of intellectual property law.

The lesson here is that no one controls the Internet. Many institutions have powerful roles that can shape Internet operation and policy. But, more often than not, if one of these actors takes some troubling action, other actors can implement countermeasures. For instance, as much as policymakers think control of the DNS gives control over the Internet, private companies and governments can offer alternative DNS services if they distrust a root provider. Governments cannot even totally control the physical layer of the Internet—a compelling example comes from Russia’s invasion of Ukraine. Satellite Internet provider Starlink has played a crucial role in connecting Ukraine to the Internet despite Russia’s cyberpower.

Controlling the Internet

Jack Goldsmith and Tim Wu have written the most important work on Internet control a. In the United States, it can be said that no one controls the Internet; control is shared among an almost unfathomably complex set of actors. But, in other countries, Internet access may be governed by one chokepoint enabling mass filtering or other forms of control. Sometimes nations’ chokepoints are imperfectly made, allowing users to change their DNS settings, or use a VPN or an overlay network like The Onion Router (ToR) to circumvent the control. Another exception elucidated by Goldsmith and Wu concerns specific aspects of control, the “little brothers” of the Internet. Copyright enforcers can control the Internet through filtering and liability shifts, or by simply suing intermediaries that control the assets of suspected pirates. Law enforcement agencies can exert control by pressuring intermediaries to scan for illegal content, such as child abuse material. In China, the Great Firewall censors, while the “Great Cannon” can be used to attack those who transgress government norms.

a Goldsmith J and Wu T. Who Controls the Internet?: Illusions of a Borderless World. Oxford University Press, 2006.

2.1.6 Why Not Start Over?

So many cybersecurity problems find their root cause in the structural assumptions of the Internet. The fundamental goal of ARPAnet was to interconnect heterogeneous computers and maximize use among them. Security did not appear in the first- or second-order goals.¹⁹

Why not redesign the Internet with security and other values as a first-order priority? The National Science Foundation posed this question years ago in creating its Future Internet Architecture Project. Coordinated by the Massachusetts Institute of Technology’s David D. Clark, the NSF marshaled researchers to propose and implement different architectures. Security was listed as a top-level design requirement. Several teams created working prototypes (Figure 2.4).

Even if a better architecture is proposed, changing the Internet is a very difficult problem. Simply put, the current Internet works well enough for most. Untold billions were spent on the current infrastructure, and thus alternatives would have to have a compelling economic logic to support a change. David Clark himself reflected on the National Science Foundation effort in a 2018 book, where he detailed several requirements for a future architecture to be successful: longevity, security, availability, economic viability, management and control, and meeting the needs of society.²⁰

Question 2.1.5 — Next Generation Internets. Are Clark’s requirements sufficient? What might you add? What do you think is included in “meeting the needs of society?”

▄

2.2 Attribution

In May 2019, the Israeli Air Force responded to a cyberattack in real time, launching a missile at a building it claimed housed Hamas hackers.²¹ An online video of the Israeli attack shows an explosion emanating from three of the building’s walls.

The Israeli response marks a new era in cyber deterrence. As we will see when we discuss deterrence theory in more detail (see Chapter 5), deterrence by punishment is complicated when one is unsure of the identity of an attacker. But, as governments become more certain about attribution and public trust in attribution determinations, punishment, including cross-domain deterrence, becomes a viable option.²²

Figure 2.4 In 1970, in a now declassified document, Willis Ware and colleagues reported to the Department of Defense about the multifarious challenges to computer security. Fifty years later, the “threat points” identified by Ware continue to exist in modern computer systems. Ware W. Security Controls for Computer Systems. Rand Corporation for the Office of the Director of Defense Research and Engineering, 1970.

Definition 2.2.1 — Identification. Identification is the act of determining the identity of a user.

Definition 2.2.2 — Attribution. Attribution is the act of proving responsibility for some online behavior. The quality and depth of that proof may vary.

Definition 2.2.3 — Cross-domain Deterrence. A nation can respond to a cyberattack with the intent of punishing and preventing further attacks with some other policy tool than the Internet. That policy tool can be political (expel diplomats), economic (levy sanctions), criminal (indict the hackers), or military-kinetic (use physical coercion as the Israelis did against the putative Hamas hackers).

Attribution is important for some, not all, deterrence. Attribution is both a technical process, in that it seeks to tie evidence from attacks to particular computers, and a political one, in that political judgment must be applied to ascribe an attack to a state or criminal group. Depending on the investigation, attribution efforts can be purely technical, or a hybrid process where legal requests are made to unmask computer users and political analysis is applied to determine the goals of an adversary.

Only the most sophisticated and careful users can hide their identity. Even militaries and intelligence agencies fail.

For most users, their true identity is known. The question is: Who knows? The answer is a bit counter-intuitive. Google and Facebook, even if you signed up with a “fake email,” probably know who you are in a personally identified manner. Why? Because you eventually tell these companies who you are by making payments, accepting deliveries, leaking information associated with your real-identity accounts and other devices, and identifying people related to you who use the same networks. Thus, often the private sector knows more about your identity online than governments!

And here’s a surprising fact: if, for some reason, Facebook or Google cannot recognize you, they buy data about your IP address to merge your online and offline identities.²³

Turning to governments, your local police department might have no training in attribution and no tools to help. Even state law enforcement may lack the training and resources to attribute Internet attackers, and so many states have created specialized “e-crimes” divisions that concentrate on forensics and online investigation. At the federal law level, the Federal Bureau of Investigation and the United States Secret Service have deep expertise in Internet investigations, but they do not know individuals’ identities online in a general sense. Even the most sophisticated law enforcement agencies rely on private-sector platforms—from Xfinity and AT&T to Google and PayPal—to determine a user’s identity.

It is often said attribution is difficult online, but this claim is subject to political and technological change, and overly broad and completely inaccurate with respect to some cyber actors, such as the Israeli military, major private-sector Internet platforms, cyber-intelligence firms, and the most capable intelligence agencies. In addition, the most consequential cyberattacks receive sustained attention from researchers. Work by Georgia Institute of Technology scientists found a majority of state-sponsored cyberattacks had been attributed.²⁴

In fact, we suspect that the attribution problem has largely been solved by the NSA, based on public statements and articles written by IC-connected authors.²⁵ For context, do keep in mind that there are significant barriers between intelligence and law enforcement agencies in the United States making the NSA’s insights restricted to the IC in most situations.

Back in 2010, the director of the NSA urged Congress for support because it needed “…to develop an early-warning system to monitor cyberspace…and locate the source of attacks…in milliseconds….” But, urgency receded by 2015, when (former Director of National Intelligence) General James Clapper claimed, “Although cyber operators can infiltrate or disrupt targeted…networks, most can no longer assume that their activities will remain undetected. Nor can they assume that if detected, they will be able to conceal their identities. Governmental and private sector security professionals have made significant advances in detecting and attributing cyber intrusions.”

General Clapper’s statement was a declaration of success and a signal that Congress need not be as concerned anymore. Other actors, including ordinary law enforcement, companies, and private users of the Internet, still have a great deal of difficulty—or no capabilities at all—in attributing cyber activity. This is because they generally lack the most sophisticated technical means of attribution and are limited to making requests for logs and other evidence through legal processes. As we will see, these processes are slow, sometimes contested, and may not reveal the true attacker.

Attribution is a forensic science. As a field, forensic science has suffered reputational injury while at the same time becoming more important to prosecutions. A 2009 National Research Council (NRC) report found that much of what was declared as criminal forensic science was unscientific in the sense that techniques lacked proof of validity and were based on the examiner’s subjective claims of proof.²⁶

At the same time, while many aspects of criminal forensics were questioned for their scientific rigor, a different trend took hold. Popular culture television shows depicted unrealistic, advanced forensics applications in crime dramas, with investigators making fantastic attributions of crimes, leading to certainty about whodunit. The so-called “CSI effect” is the expectation of juries to see such evidence in the courtroom, a standard that requires (unlikely) law enforcement sophistication, resources, and coordination.

Forensics and Police Claims

It pays to be skeptical of police—or anyone—who makes broad claims about the perfection of forensic methods. The NRC found embarrassing problems in the field. If you find yourself working with forensic evidence, remember the NRC report. It’s also important to be skeptical of forensics “experts” whose knowledge may be outdated, shallow, or just plain wrong. The field moves quickly, operating systems and applications change, and it’s hard to stay up-to-date. But, with forensics, wrong isn’t just an academic exercise—people’s livelihoods and lives may be on the line. We have personally witnessed a number of situations where the so-called experts in forensics were flat-out wrong. One interesting example occurred at a digital forensics conference, with author Richard in the audience. He was listening to a talk about a new forensics technique while keeping his laptop open to verify, in real time, the dubious assertions being made in the talk, which he found to be completely incorrect. Worse, the presenter was bragging about how these new techniques had been used in a recent criminal case. It’s also worth noting that investigators who are unfamiliar with a particular platform, such as Linux, may not even examine devices of that type. Richard attended a police training event where he overheard an investigator say “If it’s not Windows, it’s not evidence.”

The famous case Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993) can also help challenge forensic evidence. The Daubert court held that expert testimony must reflect “scientific knowledge,” thus requiring some “standard of evidentiary reliability.”

After Daubert was decided, a judge excluded expert testimony on fingerprint evidence—a forensic technique accepted by courts for a century! The judge reversed himself after the FBI presented previously secret evidence it had collected to validate the analyses of its forensic trainees. United States v. Llera Plaza, 179 F. Supp. 2d 492 (E.D. Pa. Jan. 7, 2002).

Presumably, if fingerprinting could take such a blow, the newer, less developed field of computer attribution might be vulnerable.

Attribution is as much a political issue as a technical one. The following section explains the different kinds of attributions. As you read, consider what kinds of attributions would be most important to different cybersecurity actors.

2.2.1 Types of Attribution

Actors seek different kinds of attribution based on their goals. The most complete writing on attribution comes from Herbert Lin, a scholar affiliated with the Hoover Institution.²⁷ Thomas Rid and Ben Buchanan have an important contribution in the field, offering a complex model of attribution signals and strategy.²⁸

Lin identifies three kinds of attribution: machine attribution, human attribution, and party attribution. In machine or “technical” attribution, an investigator focuses on the specific devices and networks used to levy an attack. Attribution efforts could focus on identifying a device or in simply determining its location.

Machine attribution is just that—it gives the investigator information about a device, but it does not prove who was using it. Most attributions start out as machine attributions. This is because most investigations reveal log data about what computers visited a service. The investigator must then do more work to link a person to the computer.

You must always keep in mind that as certain as your machine attribution is, the identity of the wrongdoer is not certain. We will repeat this point and its veracity will fully come into focus.

Human attribution is, as the term suggests, determining the identity of the specific person involved.

Party attribution is the identification of the ultimate adversary. Thus, human attribution could identify David Defendant as the wrongdoer, but the party attribution might be David’s employer—the Russian SVR or the Chinese Ministry of State Security, or perhaps the “loosely-organized hybrid gang” known as the “Juggalos.”

Attributing the human agent of the attack, and the party behind the agent, is a more difficult task than machine attribution. Suppose that computers in China are used to attack the servers of a major United States bank. The bank can view the publicly available IP addresses of those attacking computers. But, those attacking machines might be controlled by another layer of computers to mask the humans behind the attack.

Careful attackers break into multiple computers and stage their intrusions behind layers of compromised computers (a multistage intrusion). Thus, the human attacker might be in North Korea while controlling an infected computer in China, which in turn is controlling a computer in California that ultimately attacks the victim’s computer.

The forensic chain of these intrusions is too much for most law enforcement agencies to handle through formal processes, such as making legal requests for user information. To unpack the attack, the investigator must get logs on the California computer, which then reveals the identity of the Chinese one. The investigator would then obtain the Chinese computer’s logs (if possible), which in turn would reveal the North Korean computer. This chain of investigation takes a long time and depends on the investigator’s commitment and ability to navigate requests from foreign governments. It also depends on foreign government cooperation.

Turning to party attribution, this too can be complex. Those North Korean hackers—are they acting at the command of the nation’s military? Or are they “moonlighting” and pursuing their own profit without permission of the government? Or are they really Iranians pretending to be North Koreans—participating in what is called a “false flag” operation?

Definition 2.2.4 — False Flag Attacks. Some hackers use techniques to falsify the origin of an attack so blame is imputed to some other party. For instance, at the 2018 Winter Olympics, South Korea experienced a cyberattack originally attributed to North Korea. But, forensic analysis shifted attribution to China, and eventually to Russia. Just imagine the angst political leaders must have experienced as blame for the attack shifted among these nations!

2.2.2 Attribution Process

Attribution involves any information that points to a machine, person, or party behind an incident. Like in any criminal investigation, literally any piece of evidence can be relevant.²⁹ Generally speaking, the process proceeds from network forensics, the collection of information about what machines accessed networks such as Internet service providers and then device forensics, which focuses on the specific computer the attacker used. In computer crime cases, device-level forensics is important, because the government is interested in prosecuting an individual user. But, in cybersecurity, network-level forensics tends to be the focus.

Should You Get a Security Certification?

Security and privacy certifications do have value, but one has to be smart about them. Certifications have two primary sources of value: First, certifications signal your interest and commitment to a field. That signal can move your resume into the right pile.

Second, some certifications also signal expertise in specific skillsets, but these are variable in quality and may be inapt for the career you want.

There are an impossible number of security certifications now. Wikipedia lists over 300 of them online: here (https://en.wikipedia.org/wiki/List_of_computer_security_certifications), a cybersecurity expert maintains this “Security Certification Roadmap” here: https://pauljerimy.com/security-certification-roadmap/

So, how should one choose? Here’s a proposed method:

Find people on LinkedIn who have the kind of career you want to pursue. Check whether they (or their direct reports) have certifications in privacy or security.

As you look for jobs, make a note of what certifications job announcements explicitly call for.

From a straightforward economic perspective, one could simply compare the number of certificate holders with the number of jobs that seek that certificate. NIST’s Cyberseek attempts to do this for CompTIA, GIAC, IAPP, and other popular certifications: https://www.cyberseek.org/heatmap.html

Cost matters. Certifications typically require an upfront enrollment fee and some kind of maintenance cost. Keep in mind that IAPP’s very popular certifications (CIPP/US, CIPP/E, CIPM, or CIPT) are available at a substantial discount through the Privacy Pathways program, which some schools offer: https://iapp.org/connect/privacy-pathways/

Machine attribution is a relatively straightforward process. If malicious activity, such as unauthorized access to a server, occurs, the victim will first identify the IP addresses used to access the server. Say there is an unauthorized access to a bank’s computer. The bank will look at its logs to see what public IP address was the source of the intrusion.

Publicly available databases link IP addresses to “owners,” that is, the Internet service provider of the IP address (see ARIN, https://search.arin.net/). For instance, let’s say that the bank determined that the attack came from the IP address 136.152.15.109. That IP address is owned by the University of California. Once that fact is determined, an investigator can serve a legal demand on the University to learn which specific person was using the computer in question. Presumably, the University has logs linking users to each wi-fi access point and each Internet session.

At this first step, the investigator realizes whether the attacker is sophisticated or not. Many users think the Internet is anonymous and do not understand if they use their home connections they can be easily unmasked through legal processes. Suspects also underestimate the power of link analysis, which can connect a person to a device if the suspect makes any kind of technical error. Thus, the unsophisticated David Defendant is identified at this step, perhaps in David’s own dorm room using David’s personal computer.

Perhaps, David’s computer is seized and David arrested. Police would then perform a forensic analysis of David’s computer. However, forensic analysis of computers and other devices is becoming dramatically more difficult. As Simson Garfinkel explains, forensics enjoyed a “golden age” in the 2000s because of operating system and file format homogeneity (most computers used some version of Windows and there were relatively few kinds of file formats of interest, such as JPEG image files and Microsoft Word documents).³⁰

Definition 2.2.5 — Forensic Image. Device investigations are performed on a carefully-made copy of the suspect’s computer storage. If the police investigating a suspect fails to make such a forensic copy or “image,” the suspect may have good arguments that the evidence is corrupted.

But, since then, many factors have made device forensics more challenging. Some obvious ones are storage size (large hard drives have so much information that merely making a forensic image can take hours) and proliferation of evidence-containing devices with different operating systems and file formats. There is also encryption, use of the cloud and storage that is out of the jurisdiction’s reach, and system-on-a-chip devices with embedded memory (these devices have to be seized because traditional imaging or removal of the storage may be impossible).

A deeper problem in forensics comes from the kinds of tools that have been developed. Garfinkel explains that existing forensics systems were designed for situations where the computer contains evidence of a crime, such as in child sexual abuse material (CSAM) investigations. But computer attacks are different in that the device is used to harm other computers, rather than to act as a container for contraband.

Turning back to network forensics, sophisticated hackers levy attacks through layers of compromised computers—the above-mentioned multi stage attack. So in the multi-stage scenario, the University examines its logs and might find that the user was on the campus’ free wi-fi service, or worse, that the logs reveal malicious activity was linked to a campus computer that was itself compromised by some unknown attacker. In that case, the investigator must pursue the next computer in the compromise chain.

Examining things from a slightly different angle, innocent computer users may also pay the price for computer forensics becoming more complex. While forensics capabilities have been significantly expanded over the last 20 years with the development of a number of new tools and techniques, ground truth can still be elusive. Even technically sophisticated investigators must be extremely careful to arrive at the correct conclusions regarding digital “evidence” discovered on a computer system. Modern forensic tools can reveal data in plain sight (e.g., files containing copies of credit card statements, spreadsheets), data that was previously deleted by users (files, SMS messages, logs, etc.), illicit data (NSFW materials, sensitive documents the user is not authorized to possess, digital contraband, etc.), evidence that systems were used to attack others (e.g., command histories), geo-location information, and much more.

Because of the proliferation of sources of evidence, digital forensics tool suites support “push-button forensics,” which allows for rapid recovery of digital evidence, data correlation, creation of timelines, and selective acquisition of evidence without significant effort and, in some cases, without significant expertise on the part of investigators. Making digital forensics tools easier to use and automating tedious investigatory processes is undoubtedly useful, as it reduces investigator fatigue and case backlogs.

But, there is also a significant downside. As digital forensics techniques have evolved, so has the design and capabilities of modern malware. It is becoming increasingly difficult to conduct digital investigations correctly, and in the face of sophisticated malware, traditional storage forensics methods are no longer sufficient to refute the “Trojan defense.” The Greeks used the Trojan Horse to fool the Trojan Army and smuggle their troops inside the well-fortified walls of Troy. Today, security experts use the Trojan Horse metaphor to explain situations where an attacker has hidden some malicious code inside a file that the user unwittingly trusts and executes on their system. The Trojan Horse is both an attack and a plausible excuse: the suspect caught with contraband on their computer claims that someone else—or something else—did the crime. This defense is plausible now because attackers can use malware to make it appear that the suspect did the crime. In some cases, the malware really did do it.

Historically, malware was relatively simplistic and disrupted computer systems by deleting data or limiting the performance or capabilities of computing devices. In sharp contrast, the design and development of modern malware is usually motivated by a number of distinct factors, including the potential for monetary gain or commercial advantage, revenge, the needs of nation-state actors, and more. To this end, modern malware frequently alters the state of computing devices, infiltrates and exfiltrates data, and performs unauthorized activities “on behalf of” users, such as web surfing, sending email, and downloading files.

Detection of modern malware is neither straightforward nor certain, particularly if only traditional digital forensics techniques are used. These techniques typically examine only the contents of nonvolatile storage (storage media that retains the contents when a system is switched off, e.g., hard drives, flash drives, and floppies), whereas many strains of modern malware and attack toolkits leave absolutely no trace on nonvolatile storage devices. Thus, the impact modern malware can have on innocent users is enormous, as malware can perform virtually any action a user might perform, including the download of illicit or illegal materials, such as CSAM, without being easily detected. Furthermore, while personal security products such as antivirus programs are adept at detecting historical, well-known, and established malware, detection rates for new and emergent strains remain notoriously low. Thus, “personal computer hygiene” is insufficient as a defensive measure against modern malware.

Definition 2.2.6 — Storage: Volatile and Nonvolatile. Volatile storage, such as a computer system’s Random Access Memory (RAM), loses its contents once a device is powered down. Nonvolatile storage, such as a computer’s hard drives, retains information between user sessions. Forensic analysis of volatile storage is more difficult and, of course, there are situations where the information needed to investigate no longer exists by the time the device is seized.

Most worrisome is the fact that for individuals accused of wrongdoing involving digital devices, there is a very substantial burden in defending themselves when expensive technical expertise is required to recover exculpatory evidence such as proof of a malware infection. Digital forensics investigators with experience in malware recovery and examination often charge in excess of $500 per hour for investigative services.

As an example, the authors were provided access to a malware sample that was used in a targeted campaign against a female employee at a company in Australia. The employee was charged with accessing pornographic materials while at work, but vehemently denied these charges. Forensic analysis of the browser history on her computer clearly showed access to sites hosting pornography, and network logs at the company validated this conclusion. Yet, this employee was innocent. Deeper forensic analysis of the employee’s computer revealed that an executable with unknown functionality started each time the computer booted. Antivirus scans of this executable by dozens of antivirus packages failed to show any indication of malicious activity. A detailed reverse engineering effort, however, revealed that the application was using components of Internet Explorer to illicitly browse random pornographic web sites whenever keyboard activity was detected. The trick was that the Internet Explorer interface was never displayed, so the employee was never aware these browsing activities were occurring. It’s worth noting that the technical expertise required to conduct the reverse engineering effort is far beyond the capabilities of most IT staff, much less police investigators, and is so time-consuming that it would almost never be conducted routinely, even if the expertise was available.

A complex competitive strategy arises from computer misuse. Just as the burglar who enters a house cannot be sure whether he is heard by the homeowner or captured by a hidden camera, computer attackers cannot be sure that they are undetected or anonymous online. Computer attackers may be taking precautions or even using counter forensics. For instance, the burglar may look for cameras and steal their storage drives, and the hacker might delete logs of computer intrusion.³¹ But, countermeasures are costly in real dollars or in transaction costs and also hard to implement perfectly.

Question 2.2.1 — Computer Crime and Cybersecurity. Notice that we are drawing a distinction between computer crime investigations and cybersecurity ones. The two overlap, but we see them as different at a high level. Can you articulate what the differences between these two kinds of investigations are?

▄

There are diverse strategies for hiding one’s identity from network forensics. An attacker may misdirect investigators by using Virtual Private Network (VPN) services, which obscure the user’s true IP address by routing communications through a different computer.

One limit to counter-forensic activity is that hackers can only tamper with logs on computers that are vulnerable to the attacker. For instance, the attacker might be able to delete logs on a compromised computer, but not the logs of the router connecting that computer to the local network, or the logs linking the local network to the Internet.

Hackers may have no access to the logs of the services they use, such as the logs held by the attacker’s Internet service providers and VPNs. In fact, when law enforcement realizes that a certain VPN is being used for hacking, it can direct the VPN to start retaining logs on suspect users. This is one of the ways Lulzsec, a relatively sophisticated hacking group, was rounded up.

Intelligence agencies take a different attribution strategy. Instead of sending legal requests for data, they find clever ways to collect the data directly. Sophisticated intelligence agencies can anticipate likely bad actors and the identity of victims, and place “pre-positioned instrumentation” on networks to monitor for traffic indicative of malicious behavior. For instance, to attribute attacks to North Korea, with its relatively few access points to the Internet, South Korea might carefully monitor all of North Korea’s access patterns by positioning interception devices strategically.³² Furthermore, nations with exceptional intelligence capabilities, such as China and Russia, might then spy on South Korea’s interception devices (“fourth party” capture)!

Rid and Buchanan’s Q Model

Thomas Rid and Ben Buchanan’s Attributing Cyber Attacks presents an in-depth model of the tactical, operational, and strategic elements of attribution. The duo argue:

…first, that attribution is an art: no purely technical routine, simple or complex, can formalize, calculate, quantify, or fully automate attribution. High-quality attribution depends on skills, tools, as well as organisational culture: well-run teams, capable individuals, hard-earned experience, and often an initial, hard-to-articulate feeling that ‘something is wrong.’ …second …attribution is a nuanced and multi-layered process, not a problem that can simply be solved or not be solved. This process requires careful management, training, and leadership. …third …attribution depends on the political stakes. The more severe the consequences of a specific incident, and the higher its damage, the more resources and political capital a government will invest in identifying the perpetrators.a

We invite you to study the Q model here: https://ridt.co/d/rid-buchanan-attributing-cyber-attacks.pdf

a Rid T and Buchanan B. Attributing cyber attacks. Journal of Strategic Studies 2015; 38:4–37.

2.2.2.1 The Onion Router

The Onion Router (Tor) deserves special discussion here. Conceived of by scientists at the US Naval Research Lab, Tor has evolved into a full-blown suite that makes it easy for Internet users to have a high level of anonymity online. Tor is used by human rights activists, by spies, by governments, and has scores of legitimate use cases. Investigators might use Tor to probe suspects’ websites so targets do not detect their gaze. However, some people use Tor to buy drugs, to illegally download movies and music, to traffic humans, to support extremist groups, and to acquire and produce CSAM.

Tor is both client software and software installed on a network of servers that obscure routing information. This is done by systematically encrypting the information from relay to relay, until the user’s communication reaches its destination (say, Google.com).

Conversely, as Google responds with the requested information, such as a search result, the Tor network bounces the information among different relays until it reaches the user. One could think of Tor as similar to the childhood game of “telephone.” But, through Tor, the content is relayed faithfully to the requestor. The path to that requestor is just obscured so it is unclear who is the ultimate recipient. This multistep routing adds latency to web browsing, so most people won’t use Tor except when they care about anonymity.

Like many privacy-enhancing technologies, Tor was difficult to use properly. Adversaries developed clever ways of extracting hints about users’ true IP addresses. However, in 2014, the Tor Project released the Tor Browser Bundle, an integrated offering of a web browser that is preconfigured with strong security precautions. The developers implemented many lessons from the usable security research community to design it. The result is that almost anyone can have technical privacy that was previously only available to sophisticated Internet users.

Another interesting aspect of Tor is that the Tor infrastructure supports “hidden services,” which exist outside the traditional World Wide Web (on the so-called “dark web,” inaccessible using regular web browsers). These hidden services provide anonymity not only for users of the services but also for the service providers, whose physical location and IP addresses are secret (assuming the hidden service is implemented properly and doesn’t leak this information). Tor hidden services are identified by a long string of characters called an “onion address” (e.g., the onion address for Facebook’s service on the Tor network is “facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion.” Notably, hidden services are deployed by both legal and illegal enterprises. Facebook provides the service to allow access to the platform in countries that block Facebook’s public IP addresses. Many newspapers (as well as the CIA) provide hidden service “dropboxes,” where informants can safely deposit materials related to a whistle-blowing effort.

Of course, Tor is not immune from forensics. Websites and other services can detect Tor usage, and some block Tor users altogether. Also, a Tor user might submit information, such as a login/password, that identifies the user on the application layer.

But, the high-level lesson—and concern among investigators—is that as security gets easy, it gets democratized. There could come a day where the entire Internet is modeled on a Tor architecture, making network surveillance more difficult.

The Tor developers are constantly improving the security of the platform, including the implementation of hidden services. The older version of Tor hidden services allowed the set of onion addresses in use by services hosted on Tor to be enumerated. These addresses could then be visited one by one to determine the apparent functionality (but not the origin) of each service. Modern Tor-hidden services resist enumeration. Without knowledge of the onion address for a service, the existence of the service cannot be established. But, there are always limitations to privacy. One notable example is if memory forensics techniques can be used on a live system that is currently accessing or recently accessed Tor-hidden services. Associated onion addresses can be captured and easily analyzed from a memory capture of such a machine.

2.2.2.2 Other Anonymizing Overlay Networks

Tor is not the only anonymizing overlay network. Other systems like I2P and Freenet have also been developed, although, unlike Tor, these systems are not designed to interact with the “regular” World Wide Web, but rather coexist with it side by side. Both I2P and Freenet are truly “dark web.” Sites on I2P and Freenet do not co-mingle with each other or with the regular World Wide Web. Instead, these systems are designed to support anonymous communities where the ability to communicate in an unregulated (and unregulatable) fashion supersedes all other concerns. To quote Ian Clarke, the creator of Freenet, speaking on the importance of privacy versus the rights of content creators:

Firstly, even if copyright were the only way that artists could be rewarded for their work, then I would contend that freedom is more important than having professional artists (those who claim that we would have no art do not understand creativity: people will always create, it is a compulsion, the only question is whether they can do it for a living).

Of course, such systems can naturally be used to create communities for the purposes of “doing evil” (e.g., exchange of CSAM, and creation of malware) and this is seen by the creators of these systems as a by-product of the inviolable right to anonymous free speech.

Question 2.2.2 — Future Private? Or Future Public?. Imagine this: a single company corners the market for network advertising. To stop competitors from monitoring the network and competing with targeted ads, this company steadily builds in more and more privacy protection so the company is the only entity that can build a singular view of the user.

This scenario describes Apple and how it has connected the concept of privacy to luxury status. In 2021, Apple released its iCloud Plus service. Complementing various anti-tracking technologies in the iPhone, the new service provides a “double VPN” that masks users’ Internet use from advertisers and from Apple itself. Apple also generates “forwarding” email aliases so that, as users register for services, they do not reveal their real email address. iPhone users are also shielded from much network tracking because of cookie blocking that is on by default. Adding to this is the encryption in the iPhone, which makes locked devices more or less invulnerable to law enforcement forensics.

Now consider this: Could there be a reaction to the Apple model that could cause a radical turn toward transparency and a fully identified web? What countermeasures will be used to erode the privacy provided by Apple?

▄

2.2.2.3 Attribution Realpolitik

Turning back to attribution, every precaution by an attacker imposes transaction costs on investigators, and these costs can accrete into a kind of hacker impunity. As a matter of practice, the investigator can systematically obtain subpoenas and court orders to obtain records about VPN, Tor, and bot use. The investigator could methodically piece the evidence together one computer at a time. But, in reality, the time it takes to discover, investigate, and then serially obtain more and more orders for records makes attribution impossible for all but the most important investigations.

When the computer or service is outside the country, international legal process can add months to years of delay to the effort. Investigatory trails go cold because data logs are eventually deleted and, in many cases, the entire issue becomes moot because the investigator does not know how to interact with foreign governments.

Thus, on the one hand, attribution is difficult because of the layers of complexity involved in investigation. But, on the other, user anonymity is fragile because literally any kind of information can provide clues about Internet identity. Clever investigators have developed surprising strategies to uncover identity. Consider that in Cliff Stoll’s seminal THE CUCKOO’S EGG, Stoll wanted to know where in the world a computer hacker was. Stoll used a scientific device to time the delay he could observe between the attacker’s terminal and his own computer at Lawrence Berkeley National Laboratory and determined that the echoes indicated the attacker was 6,000 miles away.³³ Stoll’s attacker was indeed that far away, in Germany, hacking US systems in exchange for drugs provided by the Soviet KGB.

Some computer attackers will go to great lengths to hide their identities. Yet, even the most motivated make errors in their “operational security” (OpSec). For instance, many computer attackers have an emotional attachment to a username that is their “handle” online. More than a few publicly known attributions are based on such reused usernames, which hackers like to keep to maintain a reputation. The problem for the hackers is that they tend to use these handles in multiple contexts, including on resumes, social media profiles, and even as their contact information.

▄ Example 2.4 — Hacker for Hire. Legendary hacker and now professional journalist and author Kevin Poulsen relates the story of Russian hacker Alexey Ivanov who sent his hacker username, subbsta, on a resume to one of the companies he allegedly swindled. Ivanov was in the market for a regular computer security job. Knowing this, the FBI set up a fake company called Invita to lure Ivanov to America where he was arrested.³⁴

▄

WHOIS data are the registration records associated with domain names like Google.com. These records are public and maintained by the American Registry for Internet Numbers (ARIN). In particular, historical WHOIS (“WhoWas”) data have been valuable in linking pseudonyms to other information and, in some cases, directly to the identity of the suspect.³⁵ Hacker pseudonyms can indeed be such an object of attachment that one develops one in teenage years, uses it to register a domain name, and forgets that one’s home address is lurking in a decade-old WhoWas record.

The reuse of tools and tactics is another source of technical attribution. Learning how to use a tool requires significant investment of study and practice. Thus, attackers tend to reuse the same kinds of attack tools against different targets. Tools have recognizable characteristics, and if a defender studies them, the defender may understand how attackers work. For instance, in Cliff Stoll’s investigation, he observed how the attacker used an exploit, and then Stoll communicated with other system administrators who found the same approach in their own systems (Table 2.5).

Table 2.5 Just as there are different attacks possible in different layers of the network, the different layers present different opportunities for traceability.

Layer | Example | Traceability vectors
Physical | Fiber optic | No known vectors
Link | Wi-fi, Ethernet cable, LTE/phone | MAC address, IMSI/IMEI
Network | IP address | IP addresses
Transport | TCP | Port numbers
Application | Email, Websites, etc. | Logins/passwords, cookies

2.2.3 Don’t Be Surprised: Common Dynamics in Attribution

Dynamics in attribution vary because the purposes of attribution vary. Attribution can serve several different goals in deterrence and justice seeking.

Both public (publicly announced) and private (announced to the attacker) attributions can deter an attacker. Public attributions might help other victims recognize the attacker and build defenses. Public attributions also support criminal prosecutions.

Yet, there are conceptual divides among three different categories of adversaries. On the most basic level, criminal prosecution seeks to attribute in order to obtain a conviction. But, governments might have different goals when attributing misconduct to transnational criminal organizations (TCOs) and foreign governments. In those cases, the attribution standards may be lower and the attribution may be done in secret. The goal of attributing to TCOs and foreign governments is not to bring a criminal prosecution, but rather to deter in other ways.

Definition 2.2.7 — Significant TCOs. These are people who engage in “serious criminal activity involving the jurisdictions of at least two foreign states, or one foreign state and the United States; and that threatens the national security, foreign policy, or economy of the United States.” 31 CFR §590.315. The US government lists over 120 TCOs in its Specially Designated Nationals and Blocked Persons list. TCOs are dangerous because they can displace and corrupt legitimate governments and because they have capabilities similar to militaries. For instance, Mexican cartels have secured release of arrested suspects by threatening to kill police and have used armed drones to kill rivals.

In a criminal prosecution context, attribution must both conform to the rules of evidence and meet a very high standard of proof—proof beyond a reasonable doubt. Computer crime prosecutions have long faced a problem: How does one really know who was sitting at the keyboard when illegal conduct occurred? Computers sometimes have more than one user, and they can be hacked, meaning that an unknown, unauthorized user might have been the wrongdoer (Table 2.6).

Yet, the reality is that almost all computer crime prosecutions succeed. Claims that the government erred in attribution rarely work. The reason is threefold: computers—and the networks to which they are connected—amass voluminous logs of user behavior. These logs end up being powerful circumstantial evidence of a user’s identity and intent. Second, users rarely have good OpSec. Like anyone, they get distracted from their goals and use the computer for personal purchases and other activities that link the identity to the machine. Again, the logs implicate the defendant: one minute, the defendant is hacking, a minute later, the defendant is updating their dating profile.

Table 2.6 Mapping criminal suspicion onto investigatory powers.

Common legal standards | Corresponding investigatory powers
No suspicion | Preservation letter to a service provider ordering it to retain records
Reasonable suspicion: more than a hunch; a reasonable suspicion that a crime has occurred, based on facts, circumstances, and officer training | Enough to “stop and frisk” a suspect for weapons in public, or require an Internet service to identify a user
“Specific and articulable facts” about a crime | Empowers investigators to obtain IP logs and identities of email correspondents
Probable cause: more than suspicion, but less than 51% certainty | Standard for arrest, warrant for email, content, and orders for other remedies
Preponderance of the evidence: more than 51% | No corresponding powers
Clear and convincing evidence: a firm believe or conviction | No corresponding powers
Beyond a reasonable doubt | Criminal conviction

Third, it only takes one slip-up to get caught. For instance, a hacker known as Sabo, part of Lulzsec, the technologically sophisticated arm of the not-so-sophisticated hacker group Anonymous, was caught because he logged into Lulzsec’s planning chat room a single time without using his IP-address-masking VPN service.³⁶ That mistake, which he immediately realized, was enough for the FBI to locate his true IP address and arrest him (Table 2.7).

Attribution to deter transnational crime and mischief is even more difficult because the agents may be in a rogue state. The aggrieved parties may be unable to get data from local ISPs, seize computers, question suspects, or extradite criminals. In this context, the US government has developed detailed “speaking” indictments of Russian and other foreign national hacking of US systems. These indictments go into great detail, naming individual service members, and often hint at intelligence agency assistance in attributing the machines, agents, and principals. Starting in the President Obama administration, the government began publicly indicting alleged hackers.

The indict-the-foreign-bad-guy strategy appeared naive—why would a foreign country extradite their own service members to America? But, in several cases, the strategy worked as these hackers left China and Russia for vacations in rule of law countries and were arrested at the border. In one case, United States prosecutors identified Roman Valerevich Seleznev—the son of a powerful Russian politician—as a major credit card fraudster. Seleznev had arranged for a vacation in the Maldives (no extradition to the United States) but upon arriving he was “transferred” by United States police to Guam and arrested.

Table 2.7 Legal process of tracing online behavior. To this day, lawyers and law enforcement agencies focus on ISPs to obtain user identity (consider this a physical layer attribution effort). This identifies the owner of the ISP account, but as you know, this could be shared by many other users. Perhaps, this practice will shift to other layers. For instance, at the application level, Google, Facebook, and Adtech companies know who users are, even if they share an Internet connection.

Identify the relevant IP address | The victim’s computer/network logs must be examined for the public IP address that levied the attack. Of course, sophisticated hackers do not attack directly; they mask their IP address through VPNs or compromised hosts.
Identify the “owner” of the IP address | IP addresses are assigned to ISPs like Comcast, Verizon, and even schools like UC Berkeley. Or perhaps the wrongful activity happens on a third-party website like YouTube; Google can provide the IP address of the uploader of media.
Identify the user of the IP address at the time in question | This step typically requires a subpoena to the IP address owner to determine which user was active.
Obtain ISP records on user | Most ISPs know who their customers are because Internet access is a credit transaction in most of America (both wireline and wireless). So attacker strategies include using publicly available wi-fi that does not require registration.

FCC Butner

Convicts who have to go to prison might clamor for assignment to the Butner Federal Correctional Center. That’s where Seleznev ended up, along with the late Bernard Madoff.

To create deterrence, the attributor must credibly attribute the wrongdoing, and this is a difficult task. A public attribution requires revealing evidence. Possessors of such evidence are reluctant to make it publicly available, as it may be privacy-invasive and reveal “sources and methods” of intelligence gathering. Gadflies on the Internet may question the attribution, thus creating a cycle where an authority has to reveal even more data (Figure 2.5).

Figure 2.5 In the intelligence context, agencies have tried to homogenize the “estimative language” used to express relative certainty about predictions. There’s a few lessons here: First, note that intelligence agencies make predictions based on both probabilities of outcome and their confidence level in the underlying supporting evidence. Second, note how differently intelligence agencies use words like “probable” compared to law enforcement agencies. Probable means “more likely than not” in intelligence terms while courts have held that “probable cause” means something less—it does not require more than 50% certainty. A piece of advice: if you are receiving estimative language in a product from an intelligence agency, ask the analyst to express their prediction in numerical terms, e.g. 75%. From Director of National Intelligence. What We Mean When We Say: An Explanation of Estimative Language. 2007.

When making an attribution to a state, that state’s cyber conflict posture matters. States can encourage, discourage, or look the other way when cyberattacks originate in their territory. Jason Healey has articulated a spectrum of state responsibility to think through the variegated approaches nations may take. Healey’s spectrum covers nations that prohibit hacking and actively punish attackers to states that execute cyberattacks. Between are many shades of gray. Perhaps, a state prohibits hacking but has no way of controlling hackers because of law enforcement resources. States could also ignore hackers, encourage them, support them, or even hire them directly.³⁷ The so-called “patriot hackers” often operate in these gaps between full state execution and state inability to police hacking.

2.2.4 The Future of Attribution

The ability to attribute changes with political and technological developments. Several developments may lead to challenges in attribution.

First, initial attempts to make attributions involved bespoke as well as intensive investigation of a single attacker. Cliff Stoll’s investigation in THE CUCKOO’S EGG serves as a seminal example where Stoll applied his ingenuity, insight, and many hours of time to make an attribution. The problem with Stoll’s approach is that network operators simply do not have time to investigate attacks deeply (the volume of attacks allows investigators to spend just minutes on suspected attacks) nor could most be expected to have Stoll’s skill-set and motivation. Nowadays, several companies specialize in threat intelligence, using their repeat experiences and ability to analyze attacks on many different clients to recognize attackers and make technical and principal attributions.

Second, attempts are being made to formalize attribution methods.³⁸ As important as attribution is, there is no commonly accepted, scientific consensus around a method to attribute. There are also efforts to create attribution bodies, with companies such as Microsoft and think-tanks like RAND and the Atlantic Council proposing governance structures to credibly attribute attacks.³⁹

Third, companies’ interests in marketing might “solve” the attribution problem. Many private-sector companies, driven by marketing and sometimes security concerns, develop detailed databases that link individuals to computers (technical attribution). Consider that if one uses a free Wi-Fi hotspot at McDonald’s, Starbucks, or a paid one in a hotel or an airplane, the service provider can collect the unique MAC identifier of the computer used and whatever registration or payment details it requires. Traditional ISPs have this information as well and collect logs on almost all of a user’s data traffic.

Advertising companies increasingly have a view of users’ activities, identities, and location and can link users’ multiple devices. For instance, the self-regulatory body that governs mobile advertising claimed there is no anonymity in mobile phones anymore. Advertising networks, such as Google, have tracking beacons on 9 of 10 websites. This means that unless an attacker has extremely careful OpSec, ordinary marketing companies might “know” who the attacker is. For instance, the state-sponsored hacker who takes a break from breaking into systems to shop or read news online might reveal information that leads to identity linkage. There are now defense companies that leverage online advertising infrastructure to attribute activity online.

Separately from entities that provide services and advertising, many companies have developed identity verification and even intelligence services for the private sector. An identity-verification service might examine a user’s IP address and information about their device and location to make a guess of whether the user is authorized to use a credit card.

Finally, cyber intelligence firms have amassed billions of email addresses and passwords that have leaked in massive security breaches. This means an attacker—even if they have perfect OpSec—might nonetheless be exposed if the services the attacker is using are themselves breached. For instance, some attackers use publicly facing services like Twitter to “announce” their attacks or communicate with victims. Even if an attacker uses Twitter very carefully, if Twitter itself has a breach, the breach may reveal the attacker’s login information. That login information can then be used to spot the attacker in other services and erode the attacker’s anonymity.

2.3 Conclusion: An End to Anonymity?

Taken together, data collection in the private sector could upend whatever anonymity exists online. So why hasn’t it? Why are Internet users still able to enjoy some anonymity?

Competitive and regulatory concerns have tempered the amalgamation of Internet services into a single, privacy-killing killer app. Advertising companies fear they will be regulated if marketing data gets repurposed for government ends. Internet service providers fear that providing their user data will violate privacy law or give competitors in the advertising space an advantage. Identity verification companies skate on thin ice; if their services are used to assess users’ reputation (rather than just verify identity), they become subject to the credit-reporting legal regime and might have to cease operations. Cyber intelligence companies, because they sell services to law enforcement agencies and foreign militaries and intelligence services, want to lie low and market their services with mystique. Privacy laws, particularly the European Union’s General Data Protection Regulation, are aimed at defanging and even banning online targeting. These varied incentives have kept pots of data separate and maintained a delicate, fragile anonymity in practice, even if it does not exist technically in fact.

We close with a fundamental question about attribution: many people see Internet anonymity as a fundamental, defining challenge in cybersecurity. But, our narrative points out that governments make confident attributions frequently, while the private sector might even be ahead of most public-sector agencies. So, is the attribution challenge really a fundamental one?

This book began with the observation that cybersecurity is a “wicked” problem. Wicked problems can be eroded. The key is to decompose the problem and attempt to make progress on subproblems. What if governments partnered with the private sector and eliminated the “problem” of anonymity?

Question 2.3.1 — Attribution Ambivalence. Might there be downsides to perfect attribution? Civil libertarians obviously don’t want it, but could you think of reasons why governments might feel ambivalent as well?

▄

Notes

1 Internet wizard David D. Clark points to three progenitors of packet switching, all of whom had different motivations for the technology. One wished to create a network that would preserve command and control even during nuclear attack; another was interested in stoking commercial applications to revive the computer industry; yet another was interested in the mathematical theory of packet-switching and whether it could manage congestion. An additional purpose was to make it possible to share scarce computer resources. Clark, David D. Designing an Internet. MIT Press, 2018.

2 Two examples are secure DNS, which hides the websites a user visits from their ISP, and TLS plus Encrypted SNI, which hides the destinations of emails from ISPs.

3 It is not clear what Postel’s intent was in taking over the root; it could have been a protest against the President Clinton White House for efforts to reorganize control over the root DNS.

4 Leiner BM, Cerf VG, Clark DD, Kahn RE, Kleinrock L, Lynch DC, Postel J, Roberts LG, and Wolff S. A brief history of the Internet. ACM SIGCOMM Computer Communication Review 2009; 39:22–31.

5 Much of the Internet is made of tubes. As Blum explains, from underwater cables to data centers, tubes carry fiber optic cables that form the connections of the Internet. Blum A. Tubes: A Journey to the Center of the Internet. 1st ed. New York: Ecco, 2012. Available from: http://books.google.com/books?isbn=9780061994937.

6 In 2015, the FBI reported that fiber optic cables in the San Francisco Bay Area were deliberately cut 12 times over the course of a year. Federal Bureau of Investigation. FBI and Local Law Enforcement Seek Public’s Assistance Concerning Severed Fiber Optic Cables in the East Bay and South Bay. https://perma.cc/RN7D-MTQR, 2015 Jun.

7 Sreeharsha V. WhatsApp is briefly shut down in Brazil for a third time. New York Times, 2016 Jul 19.

8 Mitnick K. Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker. Hachette UK, 2011.

9 Reardon J. The Curious Case of coulus coelib, 2022 Apr. Available from: https://perma.cc/7G2F-SLM2.

10 Mitnick KD and Simon WL. The Art of Deception: Controlling the Human Element of Security. Indianapolis, Indiana: Wiley Publishing, Inc., 2002.

11 Smith RE. Ben Franklin’s website: Privacy and curiosity from plymouth rock to the Internet. Privacy Journal, 2000.

12 The US Postal Service photographs all mail routinely for service purposes (in a process it calls “mail imaging”) and, in some cases, releases these photographs to law enforcement agencies (“mail cover”).

13 Lapsley P. Exploding the Phone: The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell. Grove Press, 2013.

14 Gleick J. The Information: A History, a Theory, a Flood. 1st ed. New York: Pantheon Books, 2011. Available from: http://books.google.com/books?isbn=9780375423727.

15 Yardley, Herbert O. The American Black Chamber. Naval Institute Press, 2013. Yardley’s account was so fantastic that cryptographer David Kahn published an annotation of it. See Kahn D. The annotated The American Black Chamber. Cryptologia 1985; 9:1–37.

16 Lapsley P. Exploding the Phone: The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell. Grove Press, 2013.

17 APEC Policy Support Unit. Economic Impact of Submarine Cable Disruptions, 2012 Dec.

18 Upon realizing that the early Internet needed a steering body, wizards Vinton Cerf and David Clark created groups with “boring” names, such as the Internet Configuration Control Board, to keep it exclusive. Clark, David D. Designing an Internet. MIT Press, 2018.

19 Clark, David D. Designing an Internet. MIT Press, 2018.

20 Clark, David D. Designing an Internet. MIT Press, 2018.

21 Borghard ED and Schneider J. Israel Responded to a Hamas Cyberattack with an Airstrike. That’s Not such a Big Deal. Washington Post, 2019 May. Available from: https://perma.cc/5N6Z-LPHQ. The Israelis had identified the property as the place where hackers had levied attacks in the past, and so this was a case of delayed attribution. Some have noted that the United States has used kinetic attacks to punish people for cyber activities. However, US kinetic force has only been levied after a cyberattack.

22 Israel uses a “cumulative deterrence” approach described in Almog D. Cumulative deterrence and the war on terrorism. The US Army War College Quarterly: Parameters 2004; 34:1.

23 This is known as a “join” and is discussed in detail in Martínez AG. Chaos Monkeys: Obscene Fortune and Random Failure in Silicon Valley. HarperCollins, 2016.

24 Mueller M, Grindal K, Kuerbis B, and Badiei F. Cyber attribution. The Cyber Defense Review 2019; 4:107–22

25 “…the US has developed the capability to trace and attribute cyberattacks conducted against it and its allies, and launch punitive measures in cyberspace and across domains in response.” Wilner AS. US cyber deterrence: Practice guiding theory. Journal of Strategic Studies 2020; 43:245–80

26 Council NR. Strengthening Forensic Science in the United States: A Path Forward. Washington, DC: The National Academies Press, 2009:348. Available from: https://www.nap.edu/catalog/12589/strengthening-forensic-science-in-the-united-states-a-path-forward.

27 Lin H. Attribution of Malicious Cyber Incidents: From Soup to Nuts, 2016 Sep.

28 Rid T and Buchanan B. Attributing cyber attacks. Journal of Strategic Studies 2015; 38:4–37.

29 Parmy Olson recounts how a private-sector investigator deduced the identities of the anonymous hacker group by carefully studying their activities in a chat group and then correlating them with Facebook profiles that had indicated support for Anonymous. Olson P. We Are Anonymous. Random House, 2013.

30 Garfinkel SL. Digital forensics research: the next 10 years. Digital Investigation 7(suppl.), 64–73. Digital Investigation 2010; 7.

31 Garfinkel SL. Anti-forensics: Techniques, detection and countermeasures. 2nd International Conference on i-Warfare and Security. Volume 20087. 2007:77–84.

32 Sanger DE and Fackler M. N.S.A. Breached North Korean networks before sony attack, officials say. New York Times, 2015 Jan.

33 Stoll C. The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage. Doubleday, 1989.

34 Poulsen K. Kingping: How One Hacker Took Over the Billion-Dollar Cybercrime Underground. Crown, 2011.

35 Stone B. U.S. informant helped run theft ring. Seattle Times, 2008 Aug.

36 Olson P. We Are Anonymous. Random House, 2013.

37 Healey J. A Fierce Domain; Conflict in Cyberspace 1986 to 2012. Cyber Conflict Studies Association, 2013.

38 Caltagirone S, Pendergast A, and Betz C. The diamond model of intrusion analysis. Standard, 2013; Rid T and Buchanan B. Attributing cyber attacks. Journal of Strategic Studies 2015; 38: 4–37.

39 Mueller M, Grindal K, Kuerbis B, and Badiei F. Cyber attribution. The Cyber Defense Review 2019; 4:107–122.

II
Cybersecurity’s Contours

3 Economics and the Human Factor

3.1 Economics of Cybersecurity

3.2 The People Shaping Internet Technology and Policy

3.3 The Human Factor—The Psychology of Security

3.4 Conclusion

4 The Military and Intelligence Communities

4.1 Why Cybersecurity Is Center Stage

4.2 Are Cyberattacks War?

4.3 Computers and the Future of Conflict

4.4 Cybersecurity and the Intelligence Community

4.5 Conclusion

5 Cybersecurity Theory

5.1 Deterrence Theory

5.2 Security Studies: Anarchy, Security Dilemma, and Escalation

5.3 Economic Theory: The Tragedy of the Cybersecurity Commons

5.4 The Public Health Approach

5.5 Gerasimov and “Hybrid War:” Information Domain Revisited

5.6 Barlowism as Theory

5.7 Conclusion

3.
Economics and the Human Factor

Chapter image: Max Klinger, Penelope kijkt in gedachten verzonken naar haar weefgetouw (1895).

Source: N. Wijnberg/Rijksmuseum Amsterdam/Public domain/
https://www.RijksmuseumAmsterdam.nl/en/collection/RP-P-2011-36-127.

Chapter Learning Goals

What are the most important economic concepts that affect security?

What are the broad categories of incentive conflicts that prevent users and companies from developing secure systems?

Do attackers or defenders have systemic advantages on the Internet?

How do “human factors” shape the economic landscape for security?

Many experts claim that cybersecurity problems are economic in nature. Cybersecurity experts Richard A. Clarke and Robert A. Knake have gone so far as to say that “…With the right package of economic incentives, the technical problems can be solved.”¹

This chapter explores the economic dynamics of cybersecurity and then turns to the “human factor”—the problem that computers are programmed and used by people, who are often the target of cyberattacks and the weakest link in cyberdefense.

3.1 Economics of Cybersecurity

Writing in 2001, Cambridge University Professor Ross Anderson started a revolution in security thinking. Breaking from the common view that information security is a matter of technical measures, Anderson argued that “information insecurity is at least as much due to perverse incentives.”² A year later, he convened the Workshop on the Economics of Information Security (WEIS) with former Berkeley professor and Google chief economist Hal Varian.

What did Anderson mean by the problem of perverse incentives? In his foundational, short paper, he argued that “network externalities, asymmetric information, moral hazard, adverse selection, liability dumping, and the tragedy of the commons” explain why information security was in such a poor state. To understand his point, a diversion is necessary into network economics.

In a 1999 book, Berkeley Professors Carl Shapiro and Hal Varian explained how the rules of networked businesses differed from nonnetworked ones.³ For instance, if you were the CEO of a telegraph company, what might be different about your business strategies than if you own a chain of general stores? Shapiro and Varian explain that networked businesses are slow to grow, have high fixed costs, and have low marginal costs. Your telegraph company spent a fortune running a wire, but once installed, sending messages over it is inexpensive. Furthermore, the network becomes more and more valuable as more people connect to it. And once that telegraph wire is run, the customer is loathe to switch and potential competitors need a lot of money to create an alternative to switch to. These dynamics are network effects or externalities.

The cost to switch from one telegraph network provider to another can keep people in profoundly uneconomic relationships. Shapiro and Varian claimed these dynamics were inherent in all information businesses. Indeed, your business dealings nowadays, from your wireless phone provider to airlines to your home Internet connection, are shaped by the duo’s observations. But, none of these network dynamics is consequential in your general store. Anyone can start a competing store, and any customer can cross the street to check it out.

Leaning on Shapiro and Varian, Anderson explains how computing and software engineering have strong network effects. To illustrate his argument, Anderson used Microsoft as an example. To obtain the advantages of network effects, Microsoft distributed its software as quickly as possible, leaving security bugs unpatched: ship now, patch later. Why? Because getting to the market first could result in a “winner takes all” result. Presumably, the software could be fixed in version 2.0, after one captures the marketplace. The software/hardware combination that Microsoft enjoyed made the company more and more dominant. The consumer market did not correct Microsoft’s opportunism because consumers found it more difficult to switch and Microsoft’s strategies made it more difficult for competition to enter the market.

Companies compete with a “minimum viable product (MVP),” the most parsimonious service they can deploy. Security is not required for minimum viability!

Question 3.1.1 — First to Market Incentives. What arguments might you muster to convince a client that addressing security issues is part of a product’s “minimum viability”?

▄

Aside from network externalities, the plain-old-kind of externality is at work as well. We know that firms underinvest in cybersecurity because firms rarely shoulder the full cost of cyberattacks. In economic parlance, firms externalize the costs of attacks onto users, other businesses, and society at large. For instance, a company that loses personal information might suffer a reputational injury for a short time, but banks, users, insurers, and even the government are all likely to be saddled with some costs from the event.

Central Concepts in this Chapter

Externalities  Costs from an activity that are not “paid” by the actor are passed off to others. In security, externalities include some costs from security breaches, such as reputational harm and anxiety experienced by users. Externalities can be positive as well. Investing in good security benefits the actor and others who did not pay for the security investment.

Network externalities  Networks become more valuable as their size increases. Information industries—think security as a service—can accrete and become unaccountable monopolies.

Asymmetric information  A situation where one party knows more than the other. In security, vendors are likely to know more about security problems with their services than buyers.

Adverse selection   Information-poor actors might make systemically bad choices because they are unaware of the risk. In security, companies that offer “trust” seals suffer from adverse selection because the least trustworthy sites most need seals.a

Market for lemons  A consequence of information asymmetries, a market for lemons is produced where buyers and sellers lack quality signals. Sellers with high-quality goods exit the market because buyers cannot discern quality. The result is that only bad products—lemons—stay in the market. Ross Anderson argued the software market created security lemons.

Moral hazard  The risk that, if actors are not responsible for bad behavior, they will engage in it, externalizing the costs to others. In security, having insurance might cause “moral hazard” because the policyholder may not be responsible for their actions.

Liability dumping  Companies can use contracts to transfer liability to users and force them to “consent” to risks they otherwise would not agree to.

Tragedy of the (unmanaged) commons  When commons—like taxpayer-maintained parks that ranchers use to feed their cattle—have no rules, actors have incentives to soak up all the value of a commons and, in the process, destroy the common good. In security, Anderson gives the example of users willing to pay for antivirus to protect their own computer, but who skimp on software to prevent their computer from becoming a bot that attacks others’ computers.

a Edelman B. Adverse Selection in Online “Trust” Certifications. Proceedings of the 11th International Conference on Electronic Commerce, 2009:205–212.

To give specific examples, in regulatory situations where banks are responsible for fraudulent credit purchases (they must internalize the cost of fraud), banks pursue more security in the form of chip-and-PIN payment cards. In the United States, however, banks externalize much of the cost for fraud to merchants. Thus, banks allow charges with just a signature instead of a PIN. Another example comes from the botnet problem: We might be willing to pay for antivirus software to protect our computers from becoming infected, but the larger point of antivirus is a lot like vaccines—by immunizing our computer, we make everyone else’s computer safer. Do we care about others’ computers—or others’ immune systems for that matter when we get a vaccination? No! We’re primarily concerned with our own well-being. We might even rationally decide not to use antivirus (which slows down the computer) or buy super-cheap Internet-of-things devices that are insecure. Why should we care if these devices end up attacking others’ services as long as they work well for us?

Information asymmetries also contribute to security problems. On the most basic level, it is impossible for users to discern between secure and insecure systems. Few of us have the expertise or time or access to inspect and test code. We have to rely on other signals of security. The result is the famous “market for lemons”—without the ability to verify that software is high quality and secure and one is getting a software “peach,” people are unwilling to pay a premium for it. Because people are unwilling to pay for security peaches, software companies rationally choose not to provide higher-level security. We are left with lemons.

The perversity goes several layers deeper and complicates security efforts greatly. For instance, one cannot verify whether software is secure. However, one can verify if software has attractive features. The problem is that features require more code. And more code introduces more complexity, which increases the likelihood of vulnerabilities. The result can be a conflict between IT departments and users: IT departments might want to lock down devices and software to reduce complexity, while users might want fulsome feature sets regardless of the additional security risks they pose.

From a software development standpoint, few agree on exactly how programming errors (which can create security issues) are correlated with the number of lines of code in a software project. Some estimates are linear and assume that somewhere between 1 and 50 errors are introduced by a programmer per 1,000 lines of code, with some smaller fraction of these errors being exposed in customer-ready applications. Some have a more dim view of the situation and believe the relationship is quadratic, with many more errors being introduced as the total number of lines increases. Regardless of the exact relationship, it’s clear that huge development efforts are more likely to contain errors.

Modern operating systems are obviously more feature rich than early systems like MS-DOS. They contain fancy graphical user interfaces, networking, multitasking, sophisticated device management, and more. The number of lines of code in the Windows, macOS, and Linux operating systems now numbers in the tens of millions, with some estimates of the total code size of macOS exceeding 80 million lines. Making these systems secure is a daunting task, since even a single error can have disastrous consequences. Consider that in 2009, a zero-day vulnerability against Linux machines was discovered, which hinged on a single buffer being 1 byte too small.⁴ This vulnerability was exploited to allow non-privileged users to escalate privileges to become root (administrator) users in a few seconds. This affected essentially every Linux machine on Earth until it was patched.

It’s Reliance, not Trust

Companies are quick to use “trust” as a framing device for consumer choice surrounding privacy and security. But, is it possible for you to “trust” a company? Trust reflects a series of considered expectations surrounding competence, benevolence, honesty, predictability, and non-opportunism. These concepts apply to human relationships but less so with regard to organizations.

Professor Sarah Spiekermann explains why reliance might be a better concept than trust. This is because people cannot carefully evaluate Internet services and thus cannot actively decide to trust them in the sense that we trust people. Instead, we rely on services.a

a Spiekermann S. Ethical IT Innovation: A Value-based System Design Approach. Boca Raton, Florida: CRC Press, 2016.

3.1.1 Asymmetry and the Attack/Defense Balance

In a large sense, asymmetries in information can work to the advantage of attackers. Anderson’s work contributes to a conversation about whether the Internet gives asymmetric advantages to attackers or defenders. Advantage matters—whichever side has an advantage is in effect “running downhill.” The disadvantaged party must spend more money and effort to resist the other side.

Anderson sided with attacker advantage—as an attacker, one need only succeed once, while defenders need to resist all forms of attacks. Anderson even hints at dynamics that were obscure at the time he wrote: governments might favor an attacker advantage if they are particularly good at cyberoffense. Such governments might allow vulnerabilities to exist in order to exploit them against adversaries rather than quietly inform Microsoft or Apple of these vulnerabilities so they can be patched.

The economics of security informs fundamental debates about cyberconflict. For instance, Robert Jervis wrote an influential article in 1978 that explained the factors that make offensive operations less costly and that tend to exacerbate international relations and make war more likely.⁵ Under this view, having a first-strike advantage will pitch nations toward conflict. However, if factors favor defense, even small investments in defense will impose great costs on attackers. If defense is dominant, nations are more likely to cooperate and, if dominant enough, “aggression will be next to impossible, thus rendering international anarchy relatively unimportant.”

Jervis’s theory provokes profound questions about cybersecurity: Does the Internet have technological, territorial, or political factors that increase the likelihood of belligerence? Is it possible to erode these factors and give the Internet a defense advantage? If Jervis is correct, and if his theory applies to the Internet, a key issue is whether one could gain a first-strike advantage from cyberoffense.

Many economic factors support the consensus view that at least some attackers have the advantage over defenders in cybersecurity.⁶ Attackers can choose when and where to attack, which methods to use, and attackers only have to be successful once to get into a network. Certain attackers, such as cybercriminals, risk no retorsion for their activities because most economically motivated Internet crimes simply are not investigated. This class of attacker can act belligerently without much fear of consequences.

Definition 3.1.1 — Retorsion. An international law concept, retorsion occurs where one nation retaliates against another for an earlier aggression.

Nation-states, on the other hand, have a mixed offense–defense balance. The Internet offers wild opportunities for cyberespionage, often without response or retaliation from victim nations, and thus cyberattacks for espionage could be said to favor the offense. Similarly, cyberoperations in the information space to spread disinformation or “fake news” appear to have an attacker advantage. Like espionage and crime, proponents of information operations can choose their targets, timing, and message across a variety of Internet platforms, always choosing the newest ones before these platforms develop defenses.

But, when cyberoffense is purposed to damage or destroy things, or harm people, the dynamics change. One cannot expect a cyberattack resulting in physical harm to remain in the domain of bits. Significant cyberoffense operations, such as the United States’ plan in Nitro Zeus, would almost certainly trigger a kinetic response—bombs, not bits.

▄ Example 3.1 — Nitro Zeus. It was a well-developed and funded plan to disable most of Iran’s critical infrastructure. Supposing it was triggered, the country would lose control of its energy and communications systems, leaving it defenseless against kinetic attack. Unlike other malware attacks, Nitro Zeus was built into Iranian systems and laid dormant, waiting to be activated.

▄

The distinction between cyberespionage and cyberattack offers us a way to decompose the question of whether there is an attack advantage in cybersecurity. Consider that cyberespionage and the class of attacks focusing on short-term, tactical gains, such as cybercrime and disinformation, may be offense dominant. But, cyberattacks for strategic effect—attacks intended to destroy an adversary—cannot be bounded to online conduct. There may be some advantage to attacking first, but the victim is likely to respond with kinetic weapons.

In a provocative 2019 work, cybersecurity policy wizard Richard A. Clarke and President Obama administrative official Robert A. Knake argue that defense is poised to surpass offense, with some companies having so mastered cybersecurity that they appear to be on high ground over attackers.

The reasons why are complex and relate to attacker incentives, technological developments, and business practices. In the national security realm, the duo observe that many governments are so preoccupied with not getting caught that they act too carefully. The fear of attribution causes governments to act conservatively. At the same time, changes in the corporate world matter. Some companies are now spending over $1 billion on cybersecurity annually. Companies that adopt complex, changing network infrastructures can befuddle attackers by rearranging resources, thus imposing reconnaissance costs on an attacker. Antivirus companies have become mini-intelligence agencies themselves, finding zero-day attacks.⁷ A turn to security at Microsoft and Apple has made Windows 10 and, in particular, the iPhone very secure. Other more systemic developments could tilt the field to advantage defenders, according to Clarke and Knake. These include the development of secure operating systems with enough capacity to run a microkernel and machine-learning-enhanced development environments that help programmers write code or spot errors in their works.

Question 3.1.2 — Assessing the Clarke and Knake Hypothesis. What evidence is there that Clarke and Knake’s claims are correct? How should we expect attackers to change if a class of actors gets better at defense?

▄

Question 3.1.3 — Offense/Defense Parity. What would it mean in the broad sense if cyberdefense came into parity with—or even surpassed—the capacity of cyberoffense?

▄

3.1.2 Incentive “Tussles”

In his 2018 reflection on the creation of the Internet and alternative designs, David D. Clark observes that “all the actors in the ecosystem created by the architecture must have the incentive to play the role assigned to them by that architecture.”⁸ But, what happens when economic incentives are in tension with security? For instance, ISPs, which were understood to simply forward packets, might decide to copy them and try to make sense of them, thereby undermining the confidentiality of communications. Or various actors might oppose security improvements, such as transport encryption, because enabling it deprives intermediaries of the ability to track users as they look up and visit websites.

In the application layer, economic incentives may be in tension with security because many web businesses are paid by some other party than the user. These companies operate in “two-sided” markets, where the actual money being injected into the system is provided by advertisers and marketers. In such situations, there can be direct incentive conflicts between security and the business model. For instance, consider that over 1.2 billion people use Google’s Gmail email system. On the one hand, this could be considered a terrible centralization of dependence on a single system, one so large it would be irresistible to hackers. But on the other, with so many people communicating on the same platform, it becomes easier to distribute encryption keys and thus obscure communications from attackers. However, for some time Google chose to leave its system unencrypted, in part because it programmatically read users’ emails for advertising purposes. Finally, in 2023, Google introduced end-to-end encryption for some of its Gmail messages. Why did it take so long to secure the confidentiality of the messages? One hypothesis is that expanding privacy laws made it illegal to read users’ private messages.

At a deeper level, two-sided platforms can have incentive conflicts that are norm-eroding and even dangerous for civil liberties. In 2019, the New York Times reported that millions of photos uploaded to a photo posting service had been repurposed for face recognition.⁹ Many of the photos were of children, and there appears to have been no consent from the subjects as these photos were processed for this unforeseeable purpose. Just months later, the same correspondent covered a relatively unknown company that had scraped photographs from Facebook and other services to build a universal face recognition database.¹⁰ There is a growing awareness that anyone—including foreign governments—can buy personal information about Americans, including sensitive data about service members.¹¹

Consider the complex dynamics surrounding the protection of user information from Facebook’s perspective—the company desperately wants to stop others from scraping data from its service. In fact, Facebook crushed a potential competitor called Power Ventures that sought to unify social media in a single dashboard; to do so, the company was scraping Facebook. But, once adversaries have scraped content from Facebook (even law enforcement agencies (LEAs) have accomplished this), Facebook’s incentives are to pretend it did not happen and to not tell users. The company seemed to do exactly that in 2021, after a database of 500 million cell phone numbers scraped from Facebook circulated on the web.

Shoshana Zuboff identifies the underlying economic model of Internet platforms as “surveillance capitalism.” Surveillance capitalism is characterized by a strategy of data collection for one purpose that gives users utility, accompanied by secret, undisclosed, and sometime inscrutable subsequent uses of user data.¹² In Zuboff’s description, Internet entrepreneurs feel entitled to spy on users and extract knowledge about their life, whether it is in analyzing photos, in studying the social connections among users, in detecting the emotional content of email text, or by watching the second-by-second decisions to read material online. Consider that if these activities were done offline, they would be considered creepy, at a minimum, or even criminal invasions of privacy (stalking and communications interception).

Internet use enables predictions of users, in the short term to target advertising, and in the longer term, perhaps to influence users’ actions or alter their view of the world. As Internet entrepreneurs see surveillance capitalism approaches as the only way to monetize applications, we can expect the Internet to degrade confidentiality and integrity of data, and if Zuboff is correct, these degradations will be done secretly.

3.2 The People Shaping Internet Technology and Policy

At this point, we change gears to talk about the people behind the technologies you’ve learned about so far. It should be clear to you now that no one person is responsible for the whole Internet. Technical responsibilities are disaggregated across governments and scores of private companies.

This means a wide range of people and institutions have a role in cybersecurity. Consider how people from these different institutions might define cybersecurity differently or have interests that conflict with those of others.

Law Enforcement Agencies (LEAs)  Many LEAs have some stake in cybersecurity. The US Secret Service is responsible for financially motivated attacks. The FBI is responsible for hacking motivated by counterintelligence or espionage. The Department of Homeland Security plays a centralized, coordinating role. And to add to the complexity, within the Department of Justice, there’s an important office that sets policy for how computer crimes are investigated and prosecuted: the Computer Crime and Intellectual Property Section (CCIPS).

Military  President Trump elevated Cyber Command to a unified military command, putting it on par with traditional branches like the US Navy. Headquartered at the NSA, it is now responsible for the nation’s computer defense (e.g., defending nuclear weapons systems and secrets) and for cyberoffense. In addition, all the branches of the Armed Forces have some kind of cybersecurity-relevant unit. Oftentimes these have emerged from electronic-warfare-focused units.

Intelligence agencies  The US “Intelligence Community” (IC) is comprised of many agencies, some military, some diplomatic, some regulatory, some law enforcement, and even some independent, such as the Central Intelligence Agency (CIA). The CIA is a non-Department of Defense, civilian intelligence agency that serves the President of the United States. These agencies perform cyber-offensive activities under a different authority than the military.

International relations and trade authorities  The United States uses several tools administered by the above agencies to shape diplomatic relations and trade activities. Examples include the Department of State’s International Traffic in Arms Regulations (ITAR), the Department of Commerce’s Bureau of Industry and Security Export Administration Regulations (EAR), and the Department of the Treasury’s Office of Foreign Assets Control (OFAC), and the Specially Designated Nationals and Blocked Persons List (SDN). In addition, the Committee on Foreign Investment in the United States (CFIUS), an independent commission under the Treasury Department, is increasingly used to block foreign involvement in United States technology matters.

The regulators  The twentieth century saw the rise of the “administrative state” and an alphabet soup of industry-specific regulators from the Federal Aviation Administration to the Securities and Exchange Commission. Several of these agencies have promulgated cybersecurity rules specific to the industries they regulate.

Consumer protection agencies  A subset of the regulators, consumer protection agencies have variegated and overlapping jurisdictional responsibilities. At the federal level, the Federal Trade Commission has taken a lead role, but important policy decisions emerge from state attorneys general and even from insurance regulators (insurance is regulated at the state level). Consumer protection agencies might have policy positions that are in tension with law enforcement, intelligence, and military agencies.

Standards bodies  Another alphabet soup of institutions, some government, some non-governmental, and some mixed are in charge of deciding the protocols for the Internet and how private companies should protect systems. These range from the US National Institute of Standards and Technology (NIST) to private-sector bodies such as the Payment Card Industry Security Standards Council, which decides how people can transfer money online.

NGOs and public/private partnerships  President Clinton encouraged industries to create government partnerships for security known as the Information Sharing and Analysis Centers (ISACs).

Private companies  Some of the most important cybersecurity actors are name-brand companies in the app layer (Amazon, Apple, Google, and Microsoft). But, below the app layer are many never-heard-of companies that run the actual network, including Cloudflare, Juniper, Cisco, Neustar, Verisign, and the various Internet backbones and exchanges. Some of these same companies are literally in charge of Internet identity—“certificate authorities” issue digital certificates that prove a website is what it claims to be.

European agencies  Long before the Internet, standards and interconnection decisions were made in Europe by a body called the International Telecommunication Union (ITU)—established in 1865 to address standards in the telegraph. Many “Internet control” debates center on whether the US Department of Commerce or the ITU is at the Internet’s helm.

What’s most important to know about this listicle of people and organizations? Four points: First, cybersecurity issues are shaped by different people, institutions, and companies. They are so diverse and have such different priorities that herding them is impossible. As Paul Rosenzweig has observed, the United States lacks a policymaking structure for cybersecurity.

The Security Mindset

Cybersecurity expert Bruce Schneier writes:

Security requires a particular mindset. Security professionals – at least the good ones – see the world differently. They can’t walk into a store without noticing how they might shoplift. They can’t use a computer without wondering about the security vulnerabilities. They can’t vote without trying to figure out how to vote twice. They just can’t help it …This kind of thinking is not natural for most people. It’s not natural for engineers. Good engineering involves thinking about how things can be made to work; the security mindset involves thinking about how things can be made to fail. It involves thinking like an attacker, an adversary, or a criminal. You don’t have to exploit the vulnerabilities you find, but if you don’t see the world that way, you’ll never notice most security problems.a

As you explore these materials, consider whether you start to see the world through the “security mindset.” To some, this mindset is natural. Once adopted, you will never stop noticing insecurity in the world.

a Schneier B. Inside the twisted mind of the security professional. Wired Magazine, 2008 Mar.

Second, even if we had a policymaking structure for cybersecurity, we’d have to find a way to implement it.¹³ How in the world could anyone wrangle these different stakeholders to implement a coherent policy? Consider this: different US presidential administrations have not been able to agree on whether there should be cabinet-level coordination of cybersecurity policy.

Third, even if the structure and institutions are in place, in the United States at least, so much of Internet architecture is owned by the private sector. For policy to take hold, the government would have to find ways to coax powerful companies (some of which are ideologically opposed to helping the United States government) into compliance with various rules.

Finally, the lack of structure and implementation means we should expect a lack of policy coherence. If policy does not make sense to you, it is probably because different institutions have conflicting duties and requirements or that different government agencies are at loggerheads over Internet policy.

The way lawyers might deal with such conflicts is to introduce strategic ambiguity in legal instruments that can accommodate different parties’ policy preferences. That is, policymakers might intentionally include ambiguous terms and authorities so disagreeing institutions can do what they want to do.

Jobs Galore

If you are considering a career in cybersecurity, the above description of actors imparts some idea about possible careers. There are jobs galore in cybersecurity, from information technology (IT) to standards setting to policy. You could have a good career in an NGO, in a public–private partnership, in a government agency, or in the military. You can also “hang out a shingle” by starting your own consulting practice—plenty of people need good advice on cybersecurity. Cyberseek, a project of NIST, is a good place to start getting a feel for the job landscape: https://www.cyberseek.org/

As an example, some of the most consequential “cybersecurity” rules have emerged from unlikely sources and without coordination. For instance, Massachusetts (MA 201 CMR 17) enacted a law requiring data about its residents to be encrypted, no matter where the data are held. Similarly, California’s security breach notification laws emerged in response to a provincial controversy but have had worldwide effects.¹⁴

Question 3.2.1 — The NSA hacks the CIA. The notion that the government does not have a single view on operations is demonstrated clearly by an anecdote related by Washington Post reporter Ellen Nakashima. Please read her short article and be prepared to discuss it in class: Nakashima E. Dismantling of Saudi-CIA Website illustrates need for clearer cyberwar policies. 2010 Mar. Available from: https://perma.cc/L4PY-XVHN

▄

In sum, you should be skeptical of claims about “the government’s view.” The government is made of many people who have different and sometimes conflicting interests. Unlike how governments are portrayed in media, in reality, “the government” has no single view of facts or opinions. Different agencies have no idea what other agencies are doing (this is why a lot of executive action consists of interagency review of policy—a process of figuring out what “the government’s” interests are). Sometimes, lack of knowledge is just a communications issue, other times it is deliberate deception borne by different policy goals, distrust, or the feeling that another agency is inferior. There are opportunities in this chaos.

3.2.1 Tragedies of the Un-managed Commons

Anderson laments tragedies of the commons issues in cybersecurity. A tragedy of the commons occurs where many people have access to some shared resource, and each individual uses it according to their own self-interest, causing a degradation of the resource that harms all users. With the Internet, there is a similar phenomenon; there are technologies that could radically improve security, but it is not in any individual’s self-interest to pay for them, and their implementation requires coordination among many actors.¹⁵

Definition 3.2.1 — Un-managed and Managed Commons. The concept of tragedies of the commons was critiqued by economist Elinor Ostrom, who earned the Sveriges Riksbank Prize in Economic Sciences (what people call the “Nobel Prize”) with Berkeley economist Oliver E. Williamson. It is important to know that some use the concept of “tragedy of the commons” to attack all commons. But, Ostrom was careful to discuss the differences between un-managed commons (which become dystopias) and managed commons, which can be enjoyed by many (consider the US National Parks). We might explore whether the managed/un-managed distinction accounts for Internet security problems.

Two examples of game-changing improvements that could be made, ones that would significantly alter the risks of cyberconflict, are Secure Border Gateway Protocol (SBGP) and Secure Domain Name Service (DNSSEC). The Border Gateway Protocol (BGP) defines the “routes” that datagrams use as they traverse the Internet from users’ computers to servers and so on. The current system is not secure and nation-states poison BGP routing to block or surveil Internet traffic of interest. Similarly, attacks on the Domain Name Service can route users to impostor websites where attackers can compromise confidentiality and integrity. Both SBPG and DNSSEC require ISPs to change their architecture by adding updated encryption packages, ones that might be expensive because legacy systems might need to be upgraded to support the new architecture. Furthermore, most users have no idea what BGP or DNS are; so they are not clamoring for improvements to them.

Exercise 3.1 — Marketplace Snapshot. Most firms are inexpert in cybersecurity and need support in order to function. This is a good opportunity to start understanding the field, and we ask you to do it in two steps. Both materials for this exercise are copyrighted, and so we do not include them here.

First, venture capital firm Momentum Partners maintains the “Cyberscape,” a living document showing many companies active in cybersecurity organized under different functions, such as Managed Security Service Provider, web security, and threat intelligence. Please download and spend 10 minutes or so studying it. You can find it on the venture capital’s page https://momentumcyber.com/. The Cyberscape should give you a good idea of the meta-trends in the industry and should make clear that there are a fantastic number of opportunities in cybersecurity. It also defines “cybersecurity” from the venture capital (VC) perspective. If you want to go deeper, skim the group’s regular Cybersecurity Almanacs.

Venture capitalists tend to follow one of the three approaches in thinking about markets. The most granular approach is to do on-the-ground research with many people to determine what their needs are. For instance, someone using this approach might interview all the CISOs they can find and try to identify pain points for them within an organization, or dissatisfaction with some tool that they currently use. Another approach is to be problem oriented, as in, “I am going to solve the attribution problem.” In this approach, one would carefully map out all the component issues that together form the attribution problem and look for critical dependencies that could be addressed with a new business model. The third approach is the most theoretical, perhaps. In it, the analyst will express some goal, such as “all email should always be encrypted, yet searchable and retrievable with ease.” Similar to the second approach, one needs to deconstruct the goal, find subgoals, and then match companies that provide a path to the goal.

To drive discussion of the Cyberscape, it makes sense to start by identifying a cybersecurity industry subfield of interest to you (Momentum defines these under headings such as Network Security, Endpoint Security, and Application Security). Then consider these questions:

What companies appear to dominate this subfield?

What forces are shaping these players?

What are the products that they are offering that look most promising?

Who are their customers?

What are the methodological weaknesses of the Momentum approach?

What’s missing from the landscape?

What are the long-term prospects of your subfield? You might answer this question by considering the field’s assumptions—that is, what technological assumptions underlie the field’s demand for services? For instance, endpoint security is needed because there are so many endpoints! What could possibly change in technology that would increase/decrease the importance of endpoint security?

What is the competitive landscape for your subfield? This will be influenced by issues such as barriers to entry. Can new companies easily offer viable competing products? Is the subfield likely to be regulated for various reasons?

What do you think career options will look like? This question may be influenced by a variety of factors, including whether the subfield is going to consolidate or grow, or whether it is maturing. The kinds of customers the subfield has will affect careers (consumers, other businesses, and government) as well.

Second, former Bank of America Chief Security Scientist Sounil Yu did something brilliant—Yu developed a framework he called the “Cyber Defense Matrix.” This was so insightful that he changed focus, went into cybersecurity advising and investing, and made the Matrix a book project.

Please read the overview of Yu’s project here (https://cyberdefensematrix.com/; backup link https://perma.cc/3NZS-RFHL).

This overview will make more sense a bit later in the book. But, Yu nails a problem you probably recognize—the use of jargon to sell cybersecurity. Yu’s framework is useful because it standardizes language, situates cybersecurity into key functional areas, and then divides those functions among the things that need to be secured. It also has a context layer: it recognizes that security is a social-technological endeavor where a gradient exists between total technological control and complete human decision-making.

Optional: If you want to work for a cyber startup and sell your services to massive clients like Bank of America, you are hereby commanded to watch his RSA presentation (otherwise this is optional). Yu’s presentation is a HOWTO sell to CISOs and is available here (https://www.youtube.com/watch?v=ngp-WkXs4mc; backup link https://perma.cc/TJ4R-KJE8L).

▄

3.3 The Human Factor—The Psychology of Security

The discussion thus far has focused on macro-level consequences of security incentives, such as how firms and governments take decisions. Now we turn to the micro-level: the individual. This section discusses how individuals’ decisions affect security.

Models for human decision-making are at the center of this inquiry. There is a competition between two views of the individual: Is the individual a calculating, rational agent seeking to maximize her “utility” and the values she cares about the most? This is the rational choice view, the “homo economicus” paradigm. Or are humans not-so-calculating, limited in knowledge and decision-making prowess, and often guided by emotion and how information is framed? This latter characterization flows from the behavioral economists and is deeply informed by the field of psychology.

3.3.1 Attackers as Behavioral Economists

Social engineering is probably the most common form of “hacking.” In social engineering, the attacker tricks another person or group of people into giving access to a password or system. Thus, social engineering does not depend on technology; it depends on exploiting human psychology and even just kindness and social graces. For instance, one form of social engineering is “tailgating,” that is, following an authorized person into a building without using one’s key or keycard. Tailgating relies on the basic good grace to hold a door for a person behind you.

Phishing involves sending a target email that appears to come from a legitimate user or company. The phisher’s goal is typically to trick the user into logging into a fake website, thereby obtaining the user’s credentials. Phishing is the most common form of social engineering and perhaps even hacking more generally. It might be surprising to learn that the most sophisticated intelligence agencies regularly use phishing to get into accounts rather than more technical measures.

Successful phishing requires understanding the target’s psychology. Here is the phishing attack levied against John Podesta, the chief of staff of Hillary Clinton’s 2016 presidential campaign (See Figure 3.1). Notice how clever this attack is.

The email appears to come from googlemail.com, but this is a “spoofed” return address. It is easy to just put in any email address you’d like into the “return address” option in email

The email arrives at 4:30 in the morning—apparently the attacker knew when Podesta wakes up (he is an early-morning runner)

Podesta was using Gmail, a personal email service, rather than a more hardened enterprise-level service

The phishing email proposes an entirely plausible attack: that someone in Ukraine would try to sign in to his account

The email proposes a quick fix: change your password. This sounds sensible. However, the change-password link is a URL shortener, which takes the user to an impostor site that captures Podesta’s

Podesta recognized the email as a possible attack. Podesta forwarded the message to support staff who made a terrible blunder. The staff responded that this was a “legitimate email” and instructed Podesta to visit a Google URL to reset his password.

Apparently, the staff meant to write that it was an illegitimate email. Furthermore, staff advice to visit Google to reset the password was good in the circumstances.¹⁶ However, it appears that Podesta went back to the phishing attack email and visited the impostor bit.ly URL instead, and in so doing, revealed his email password to Russian hackers. Those hackers then downloaded all his messages, which were given to Wikileaks.

Figure 3.1 The text of the phishing email used to attack John Podesta.

AI has made the situation with phishing campaigns far worse (for users, but not for attackers). In the past, users could often dismiss phishing emails based on poor grammar, awkward language, etc. Publicly available Large Language Model (LLM) AI systems have completely changed the phishing landscape. While there are moderate safeguards in place to prevent people from using AI systems to generate exploits, craft malicious emails, etc., these safeguards are easily circumvented. For a concrete example, consider Figures 3.2 and 3.3, which illustrate portions of a ChatGPT session in which one of the authors attempts to use ChatGPT to create phishing emails. For the query in Figure 3.2, ChatGPT refuses to comply (likely because of the reference to a transfer to a Bitcoin address). But, the text generated by a slightly different query (in Figure 3.3) could be easily modified with appropriate links to craft a very convincing phishing email. An attempt to create a different kind of phishing email, to convince a user to click a link and change their password, is illustrated in Figure 3.4. In this case, the email was created with no objections from ChatGPT.

Bit.ly and Google

The Russians used Bit.ly, a free URL-shortening service, to create the fake link. This means that Bit.ly probably had logs and evidence about the hack. Presumably, the Russian attackers made many attempts against administration officials, and they probably used Bit.ly (and presumably the same Bit.ly account) for all of them. URL shorteners make money by examining user traffic, so they are not agnostic or blind to users’ activities. Should companies like Bit.ly scan for phishing attempts and warn other services like Gmail? When should a URL shortener be liable for users who repeatedly use the service to craft computer attacks?

Turning to Google, at the time this message was sent, Google used a system to read all emails in order to target advertising to message content. Given the text of this email, why didn’t Google flag it as an obvious impostor email?

3.3.2 Institutions as Rational Choice Economists

Unlike attackers, institutions often manage cybersecurity risks through procedures that make different assumptions about people: that users are rational, utility-maximizing agents. Rational choice theories (RCT) underlie the approaches taken by most institutions and policymakers. These theories assume that people are rational and deliberative, that there are mechanisms for individuals to evaluate all options, and that options are chosen in self-interest. We think RCT is fundamentally in error because it fails to understand user psychology and the actual constraints computer users operate under. But, there are good institutional and legal reasons for firms to apply RCT approaches.

With phishing as our example, a decision-maker steeped in RCT would see the problem as simple: users cannot recognize phishing attacks, so to help them make a choice in their self-interest, we should provide training and proper incentives and disincentives. This is what most institutions do, in fact: they subject employees to some kind of training and perhaps even simulated attacks where the employees are tested. If an employee clicks on a simulated bad link, they are punished with more training or some kind of warning.

Figure 3.2 A failed attempt to induce ChatGPT to create a phishing email.

Figure 3.3 A slightly modified query results in a high-quality phishing email.

Figure 3.4 Another phishing email created by ChatGPT.

Evidence suggests that training does reduce the incidence of users clicking on malicious links.¹⁷ However, training does not completely eliminate the risk and even after training, many phishing campaigns have a 2–4% click rate, making it a rewarding form of attack. The underlying reason for persistent clicking probably has to do with users being overwhelmed and distracted, and from a mental model of thinking one should click on links.

The training approach makes sense legally and fiscally. From a legal perspective, courts have difficulty in evaluating the substance of an actor’s behavior, and so courts often examine the actor’s procedures. To evaluate the substance of a security program, a court would have to compare it to programs from other companies, a task courts are not well suited for. Thus, courts might simply look to procedures, such as whether a company requires training. Fiscally, this makes sense too—training employees is less expensive than implementing cutting-edge countermeasures.

While general procedural lessons like “don’t click” can be taught, in practice, users do have to click to get their jobs done. Furthermore, it’s unreasonable to expect a modest amount of “cyber hygiene” training to bring a user’s knowledge in line with that of an attacker, who has studied both social engineering and highly technical attack vectors for years.

There are effective mitigations for phishing, but each is expensive and slows down organizations. For instance, if John Podesta were using multifactor authentication, the Russian hackers would not have been able to download his email, even if Podesta told them his email password. However, this would mean that Podesta would have to deal with extra authentication, and his organization would have to support it and have a system to help users who cannot log in or who have lost their token even at 4:30 in the morning. Other mitigations have other costs. For instance, organizations can implement comprehensive systems that scan all emails for suspicious links and quarantine them; but these systems create civil liberties risks as they could be repurposed to scan for non-security-related content.

Security decision-makers who implement mitigations risk overcomplicating things. When systems become too annoying to use, the shadow IT problem emerges: people just start doing business on their less-secure personal accounts. Presumably, John Podesta had a more secure work email account, but for whatever reason, Podesta was using his personal, consumer-grade email for confidential matters with a former secretary of state running for president.

Definition 3.3.1 — Shadow IT. Companies that impose too many restrictions on IT risk giving rise to shadow IT, systems that employees operate personally and in secret.

A hint to you future investigators—be sure to ask whether employees moved company data into their consumer-grade personal accounts, such as Google Drive.

Sections 3.3.3 and 3.3.4 discuss why phishing and other social engineering attacks against people continue to be effective online.

3.3.3 User Sophistication

Computers are like cars nowadays. You can drive a car, but do you really understand how it works? Can you fix your car? Similarly, even expert users of applications may have no understanding of programming or security problems inherent in computing. Computers have become usable, but they are not easily learnable. Even children who have no conception of computing can use an iPad or iPhone. Their facility with the technology may mask a lack of understanding of how the technology actually works and almost certainly the associated risks the technology poses.

Popular false narratives, such as the “digital natives” concept, confused policymakers about user sophistication. That narrative held that people who were born after the commercialization of the Internet were expert in it. Contrary to the narrative, testing shows there is a dramatic knowledge gap between experts and ordinary users. What we can conclude from this is that while the use of technology is up, overall sophistication is still low.

The user dynamic should not be surprising. For the nontechnical user, technical goods are instruments used to accomplish goals, rather than objects of wonder. If you drove your car to work or school today without knowing the intricacies of its engine and transmission, you might be able to relate to the average Internet user.

Among Internet users, even basic computer functions are unknown. For instance, according to a 2011 interview with Google’s lead for search quality management, 90% of users surveyed did not know that the control/command-f command can be used to find text on a page. Furthermore, 80% of users almost immediately left the “advanced” Google search page, presumably because they were intimidated by operators and other commands used by the tech literate on a daily basis.¹⁸

In 1999, Berkeley graduate student Alma Whitten and Professor Doug Tygar launched the field of usable security research by publishing a paper on encryption software.¹⁹ The paper described a small study, but the results were astounding. Whitten and Tygar studied a promising, strong security tool: Pretty Good Privacy. Known as PGP, the software gave ordinary users access to practically unbreakable encryption, protection so strong that despite being over 20 years old, it cannot be broken by today’s NSA. To be sure, “pretty good” is an understatement about PGP’s strength. To test the software, users were told they were working on a political campaign and had to send a secret message to the team by email—how prescient!

Here’s the problem: Whitten and Tygar found that the 12 people in their study couldn’t use the software properly. Three of the 12 research subjects emailed the secret message without encrypting it. More than half used the software improperly such that the intended message recipient could not open the secret message. A majority did not finish the task in 90 minutes.

Now, if you’ve ever worked on a campaign, you know you don’t have 90 minutes to futz around with security software to send a single email.

Exercise 3.2 — Try a Security-forward Application—Signal. The relative privacy and security of communications apps depend a great deal on their underlying architecture and design. Text messages (SMS) are not encrypted on the network and can be read by the service provider and others. But, several companies now offer SMS-like and voice communications systems with very strong privacy and security guarantees. The problem is that these security-forward applications tend to have some downside in design: they are difficult to use, or they lack a large network of users.

The Signal messaging app is known as an uncompromising security and privacy-forward application for voice and text communications. Download, install, and use it (https://signal.org/). Reflect upon the experience. Is Signal as usable as the other communications tools you use? Are your contacts on Signal? Could you see yourself using a tool like Signal, or are its downsides (e.g., no social media-like capabilities) too great?

▄

Whitten and Tygar’s study made clear that functional requirements of programming had to expand. Just getting software to work at all is difficult enough. Now, software has to be proven to work when ordinary users try to use it. Today, Whitten and Tygar’s paper is among the most cited works in all of computer science.²⁰

Why does lack of technical sophistication matter? Public policy currently reflects the rational choice model, assuming users are responsible for insecurity. This approach saddles users with the requirement to recognize security and privacy risks and make decisions about them. As Sarah Spiekermann observes, “privacy and security concerns are not currently the most important values for initial technology adoption, and they will not be until people have really experienced the negative effects of privacy breaches.”²¹

Despite low awareness and lack of skills, the market and policymakers persist in thinking users and services can bargain and engage in self-help sufficient to create good security. But, academics are focusing instead on the psychological limits of user security: What strategies can extricate people from decision loops where their actions can compromise computer security?²²

3.3.4 The Role of Emotion and the Body

We think emotion is a critical aspect of cybersecurity. All of the supposed rational thinking a human does is the product of inputs from the body. How we feel about the Internet, or how ITs tend to make our bodies feel, matters.

A good example comes from “Poe’s law.” This is the idea that it is impossible to understand an author’s intent online, unless the author clearly signals it. All Internet users have had an experience where they have misinterpreted another person online, perhaps by not understanding the author was joking, or by interpreting an innocuous message as hostile. These misunderstandings are far less likely to happen in person or on a phone call, because richer media accommodate subtle signaling of emotion and intent. In person, our bodies help us understand each other’s intent.

Definition 3.3.2 — Poe’s Law. “Without a clear indication of the author’s intent, it is difficult or impossible to tell the difference between an expression of sincere extremism and a parody of extremism.” Although seen as an Internet joke, Poe’s law reflects the limits of the web as a communications medium. Poe’s law also explains some of the strategies of extremists, where users can, for example, test out racist beliefs and if these are rejected, the extremist can say they were just kidding.

What does it mean that so much of our communication today is lean, devoid of this emotional signaling? Might it mean that we could be more “connected” than ever, but linked in such a way that we’re more likely to misunderstand each other?

Poe’s law is just one example of how network technologies can make us feel bad, coloring our interpretation of others’ motives and even of information we encounter online. Network technologies can just as well make us feel more secure or more knowledgeable than we really are, perhaps by implying invulnerability.

Judging You, Excusing Me

Longtime CIA officer Richards J. Heuer helped spark a revolution in professionalizing intelligence analysis in the United States. In a 1999 book, he summarizes a wide field of research into decision-making bias, observing:

A fundamental error made in judging the causes of behavior is to overestimate the role of internal factors and underestimate the role of external factors. When observing another’s behavior, people are too inclined to infer that the behavior was caused by broad personal qualities or dispositions of the other person and to expect that these same inherent qualities will determine the actor’s behavior under other circumstances. Not enough weight is assigned to external circumstances that may have influenced the other person’s choice of behavior. This pervasive tendency has been demonstrated in many experiments under quite diverse circumstances and has often been observed in diplomatic and military interactions.

Susceptibility to this biased attribution of causality depends upon whether people are examining their own behavior or observing that of others. It is the behavior of others that people tend to attribute to the nature of the actor, whereas they see their own behavior as conditioned almost entirely by the situation in which they find themselves. This difference is explained largely by differences in information available to actors and observers. People know a lot more about themselves.a

Heuer’s observation explains why cyberintelligence is so valuable—the more we understand adversaries, the more we understand their external constraints and their ultimate behavior.

a Heuer RJ. Psychology of intelligence analysis. Center for the Study of Intelligence, 1999. Available from: https://perma.cc/N534-CYVP.

In both practical and theoretic applications of cybersecurity, emotion’s role will become clear. Practically speaking, people need to feel safe online—even if they are not—in order to flourish. This is a principle well known to businesses, but discounted or overlooked by academics and policymakers.²³

Cybersecurity threats can undermine users’ subjective feeling of trust, which can have economic and social consequences and even epistemological implications.²⁴ Cybersecurity theory also highlights the role of emotion, psychology, and subjective impression. In deterrence theory, for example, actors aim to influence the cost–benefit tradeoffs of adversaries, even by getting adversaries to adopt shared norms against aggression. Understood in this way, deterrence is not just an economic strategy but also a psychological one.

Throughout this text, we will see cybersecurity influenced by subjective feelings as much as careful reason.

3.3.5 Security as Afterthought

Currently, it is far too easy to compromise even security-sensitive, well-protected systems.²⁵ Companies and governments were quick to adopt computers because digitization had obvious advantages. Security, meanwhile, was often treated as an afterthought.²⁶ Had security been treated more seriously, perhaps computerization would be more expensive and a less attractive activity.

3.3.6 RCT: The User View

In an audacious paper, Microsoft security expert Cormac Herley explained that “users’ rejection of the security advice they receive is entirely rational from an economic viewpoint. The advice offers to shield them from the direct costs of attacks, but burdens them with increased indirect costs, or externalities. The direct costs are generally small relative to the indirect ones. Since victimization is rare, and imposes a one-time cost, while security advice applies to everyone and is an ongoing cost, the burden ends up being larger than the problem it addresses.”²⁷ He concludes, “…users are never offered security, either on its own or as an alternative to anything else. They are offered long, complex and growing sets of advice, mandates, policy updates, and tips. These sometimes carry vague and tentative suggestions of reduced risk, never security. We have shown that much of this advice does nothing to make users more secure, and some of it is harmful in its own right. Security is not something users are offered and turn down. What they are offered and do turn down is crushingly complex security advice that promises little and delivers less.”

Exercise 3.3 — How Risk Averse Are You? Have you ever considered that you might be more risk averse than the average person? Maybe risk aversion explains our interest in security!

Here is a short psychological test to assess your own tolerance for risk.

Please indicate the extent to which you agree or disagree with the following statements on a scale of 1 (totally disagree) to 9 (totally agree). Don’t think about the questions a lot. Just answer them quickly.

Do you (1) totally disagree or (9) totally agree with these seven statements?

Safety first.

I do not take risks with my health.

I prefer to avoid risks.

I take risks regularly.

I really like to know what is going to happen.

I usually view risks as a challenge.

On a scale of 1 to 9, with 1 being a “risk avoider” and 9 being a “risk taker,” I would score myself as a … (risk avoider or risk taker)

To score this, you’ll have to reverse-code items 1, 2, 3, and 5. After reversing the value for those four items, average the seven choices.a

▄

a See Meertens RM and Lion R. Measuring an individual’s tendency to take risks: The risk propensity scale 1. Journal of Applied Social Psychology 2008; 38:1506–20.

In Herley’s view, one might conclude that users are calculating rational actors. Insecurity just makes sense from the perspective of the individual, rational actor. But, Herley is a diagnostician, not an advocate of a stilted economic view. Herley favors an approach that more closely tracks user interests: “How can we help users avoid harm? This begins with a clear understanding of the actual harms they face, and a realistic understanding of their constraints …. In evaluating advice solely on benefit we have implicitly valued user time and effort at zero.”

3.4 Conclusion

For a long time, privacy advocates have pondered what might be the “Exxon Valdez” of privacy, the event so visceral and publicly exposed that the average person begins to view data collection more negatively. Over the past decades, there have been numerous security disasters and businesses that have eroded privacy norms even in sensitive contexts, such as the home and in the doctor–patient relationship. We continue to muddle through security issues and have not made them a central priority

This chapter explains several reasons why we continue to muddle—we operate in a market environment that creates strong disincentives for security. Companies worry they will lose marketplace advantage if they slow down development cycles with security concerns. Buyers of companies’ technologies suffer from information asymmetries, making it impossible for them to select security peaches. Users want privacy and security, but skill limitations, conflicting priorities, and the role of emotion all operate to undermine security. Importantly, for computer users, the skill limitations aspect will not be easily solved. It’s unlikely that even an extremely diligent user could stay ahead of new, state-of-the-art social engineering efforts. For the average user, high-tech attacks will probably remain indiscernible from magic.

Economics understood in the sense it is presented in this chapter—as not just market structure and incentives but also with the psychology of actors—provides helpful insights into why insecurity is an enduring problem.

Notes

1 Knake RA and Clarke RA. The Fifth Domain: Defending Our Country, Our Companies, and Ourselves in the Age of Cyberthreats. Penguin Press, 2019.

2 Anderson R. Why information security is hard – an economic perspective. Computer Security Applications Conference, 2001. Available from: https://www.acsac.org/2001/papers/110.pdf.

3 Shapiro C and Varian HR. Information Rules: A Strategic Guide to the Network Economy. Harvard Business Press, 1998.

4 See chapter 4 in Perla E and Oldani M. A Guide to Kernel Exploitation: Attacking the Core. Elsevier, 2010 for a full explanation.

5 Jervis R. Cooperation under the security dilemma. World Politics 1978; 30:167–214. Available from: www.jstor.org/stable/2009958.

6 Schneier B. Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World. 1st ed. New York, N.Y.: W.W. Norton & Company, 2015.

7 Consider that with respect to Stuxnet, one could marvel at the National Security Agency (NSA)’s technical muscularity, but Stuxnet/Olympic Games is an example where the NSA was caught by clever people in the commercial sector.

8 Clark DD. Designing an Internet. MIT, 2018.

9 Hill K and Krolik A. How photos of your kids are powering surveillance technology. The New York Times, 2019.

10 Hill K. The Secretive Company That Might End Privacy as We Know It, 2020 Jan

11 Sherman J. Data Brokers and Sensitive Data on US Individuals. Duke University Sanford Cyber Policy Program, 2021; 9.

12 Zuboff S. Big other: surveillance capitalism and the prospects of an information civilization. Journal of Information Technology 2015; 30. Available from: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2594754.

13 Rosenzweig P. The organization of the United States Government and private sector for achieving cyber deterrence. Deterring Cyber Attacks: Informing Strategies and Developing Options for it US Policy. National Research Council, 2010.

14 Simitian J. UCB security breach notification symposium: March 6, 2009. How a bill becomes a law, really. Berkeley Technology Law Journal 2009; 24:1009–17.

15 Gupta C. The Market’s law of privacy: Case studies in privacy and security adoption. IEEE Security & Privacy 2017; 15:78–83.

16 Another email in the Wikileaks archive suggests that Podesta’s iCloud password was Runner4567. But, password complexity did not matter, because in phishing, attackers do not try to break a password. They try to elicit it from the user through trickery.

17 Jampen D, Güür G, Sutter T, and Tellenbach B. Don’t click: Towards an effective anti-phishing training. A comparative literature review. Human-centric Computing and Information Sciences 2020; 10:1–41.

18 Marks P. Google usability chief: Ideas have to be discoverable. New Scientist, 2011 Nov.

19 Whitten A and Tygar JD. Why johnny can’t encrypt: A usability evaluation of PGP 5.0. In Proceedings of the 8th USENIX Security Symposium, 1999.

20 Whitten went on to lead Google’s privacy and security efforts. Professor Tygar continued to teach at Berkeley and wrote two of the most cited papers in computer science of all time. He founded a group focused on the security of machine learning in 2004, long before people understood that problem. Alas, he died unexpectedly in January 2020.

21 Spiekermann S. Ethical IT Innovation: A Value-based System Design Approach. CRC Press, 2015.

22 Cranor LF. A framework for reasoning about the human in the loop. Proceedings of the 1st Conference on Usability, Psychology, and Security. UPSEC’08. San Francisco, California: USENIX Association, 2008.

23 Schneier B. The psychology of security. International conference on cryptology in Africa. Springer. 2008:50–79.

24 The strategic communications associated with information warfare, at a fundamental level, begin to erode the enlightenment norms surrounding the values of free speech and free inquiry.

25 Not until 2011—after the massive data dumps by Edward Snowden and Chelsea Manning—were federal agencies required to have an insider-threat mitigation system. Obama B. Executive Order 13587–Structural Reforms To Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information. Daily Compilation of Presidential Documents, 2011.

26 Willis Ware pleaded, but ultimately failed, to have security explicitly stated as a “fair information practice” to the seminal government commission on privacy in computers. Hoofnagle CJ. The Origin of Fair Information Practices: Archive of the Meetings of the Secretary’s Advisory Committee on Automated Personal Data Systems (SACAPDS). Unpublished Work, 2014.

27 Herley C. So Long, and No Thanks for the Externalities: The Rational Rejection of Security Advice by Users. NSPW Oxford, 2009. Available from: http://www.ists.dartmouth.edu/docs/ecampus/2010/herley_ecampus2010.pdf.

4.
The Military and IntelligenceCommunities

Chapter image: Charles-Clement Bervic, The Education of Achilles. The centaur Chiron teaches the young Achilles to shoot with a bow and arrow.

Source: Charles Clement Bervic/Rijksmuseum Amsterdam/Public domain/
http://hdl.handle.net/10934/RM0001.COLLECT.80319.

Chapter Learning Goals

The Internet emerged from defense projects that raised complex computer security issues. This made the military the first cybersecurity actor.

The intelligence community is distinct from the military, has a different culture, and, at times, has different goals.

What are the attributes of cyber conflict?

What is the legal nature of cyber aggression—Is it a form of “force” or something else?

The KGB officer addressed the select group of Soviet officials with his usual tone of secrecy but an unusual air of excitement:“Comrades, today I will brief you on the most significant breakthrough in intelligence collection since the ‘breaking’ of the ‘unbreakable’ Japanese and German ciphers in World War II—the penetration of the security of American computers. There is virtually (if not literally) no major American national defense secret which is not stored on a computer somewhere. At the same time, there are few (if any) computers in their national defense system which are not accessible, in theory if not yet in fact, to our prying. Better still, we don’t even have to wait for them to send the particular information we want so we can intercept it; we can request and get specific material of interest to us, with virtually no risk to our agents.

“The Americans have developed a ‘security kernel’ technology for solving their problem, but we need not be concerned—they recently discontinued work on this technology. They are aware of the potential for a computer security problem, but with their usual carelessness they have decided not to correct the problem until they have verified examples of our active exploitation. We, of course, must not let them find these examples.”

So begins Lieutenant Colonel Roger R. Schell’s article on computer security. Schell asks, “Will we apply sound technology and policy before it does happen?”

Schell wrote this work in 1979!¹

Schell captured a key human dynamic in security: we can know of vulnerabilities in the abstract, but we tend to discount them until these problems are realized in the form of an exploit. Schell’s work also demonstrates a larger point, one that caused us to include the military in the contours section of this book: the military is at the center of cybersecurity. In fact, the military is the original cybersecurity actor.² Confidentiality, integrity, and availability issues presented themselves in pre-networked defense systems³ and were spotted as network systems were adopted. The military conceived of and warned of cybersecurity problems decades before mainstream practitioners. And the military’s recommendations went far beyond just fixing software:

Providing satisfactory security controls in a computer system is in itself a system design problem. A combination of hardware, software, communication, physical, personnel, and administrative-procedural safeguards is required for comprehensive security. In particular, software safeguards alone are not sufficient.

This is the first recommendation from a previously classified 1970 report written by Willis Ware for the RAND Corporation.⁴ The report also discusses the insecurity of “time-sharing multi-access computer system[s] serving geographically distributed users”—what we would today call “cloud computing.” The report was just one analysis that set the military toward operating physically separated networks for classified information.

There is another, darker reason we put the military in the contours section of this book. The advent of cyberattacks fundamentally shifts norms of warfare, making ordinary civilians the intended targets of attack. Just War Theory, which dates to the fifth century and was formalized in the thirteenth century, requires militaries to avoid harming “innocents”—those not involved in hostilities. Using modern terminology, war is supposed to be waged counterforce against the adversary’s soldiers and war matériel (supplies). Many of the most dramatic cyberattacks, on the other hand, are targeted countervalue against civilians and their cities.

Question 4.0.1 — You Are in the Battlespace. Today, as you use your Internet-connected device, your daily activities are being watched and contemplated by foreign militaries and foreign intelligence agencies at a level of detail and comprehension unprecedented in history. Foreign governments can monitor speech and associations of people in America and control some Americans by punishing their family members remaining in their home country.

To illustrate the citizen-targeting dynamic, one need only visit the Center for Strategic & International Studies (CSIS) Significant Cyber Incidents program. CSIS has cultivated a list of “cyber incidents” going back to 2003. Please visit the program’s website and give some thought to recent attacks identified by CSIS. Are these incidents levied against civilian populations or are they counter-force or counter-command attacks? See https://www.csis.org/programs/strategic-technologies-program/significant-cyber-incidents.

▄

In this chapter, we present the most important military and intelligence cybersecurity concepts. We will explain how these two actors—the military and the intelligence community (IC)—are connected and inseparable but also different in culture, incentives, and legal regulation.

4.1 Why Cybersecurity Is Center Stage

Since 2015, the intelligence community has listed cyber threats as the biggest risk to US national security.⁵ “Cyber” is discussed before weapons of mass destruction in the 2019 assessment. There are many reasons why cybersecurity risks have come to occupy a central position. All of the regional conflicts the United States is concerned with are with powers that have significant ability to levy cyberattacks.

But, the turn to cyber has deeper historical roots. Consider the American domination of Iraq in the Gulf War. Leaders around the world watched the American-led coalition subdue the fourth-largest military in the world in less than six weeks. The loss–exchange ratio was quite one sided: The coalition suffered about 300 deaths, while the Iraqi military suffered tens of thousands, perhaps 100,000. Since then, in many other conflicts, loss–exchange ratios have been similarly one sided, with advanced militaries sometimes suffering no losses while imposing great losses on opponents. The lesson learned is that fighting an advanced military in conventional terms is like defending against aliens from space who possess Star Trek-esque transporter devices.

Thus, adversaries of superpowers need to find a new strategy that takes advantage of modern countries’ weaknesses. Computer attacks are an obvious choice, because advanced nations are so dependent on computing.

In addition to computing attacks, western democracies are particularly vulnerable to a second strategy: psychological operations (PSYOP). PSYOP is the use of disinformation and other strategies to influence the emotions and motives of adversaries. Visual information campaigns are particularly effective in swaying a democratic people against conflict.⁶ An example comes from the Somali warlord Mohammed Aideed. His forces suffered a major loss at the hands of the United States. However, as Libicki notes “…Photographs of jeering Somalis dragging corpses of US soldiers through the streets of Mogadishu transmitted by CNN to the United States ended by souring TV audiences at home in the US on staying in Somalia…” Shortly after, the US withdrew from the effort.⁷ The United States won on the battlefield but not in the larger battlespace of public opinion.

Table 4.1 Significant “wake up” moments in the military.

Incident
What happened
Why it matters

Eligible Receiver (1997)
A National Security Agency (NSA) red team, using only publicly available software, deeply penetrated Department of Defense (DoD) networks. As Fred Kaplan recounts, “…the entire defense establishment’s network was penetrated—in four days…the facility that would transmit orders from the president of the United States in wartime—was hacked on the game’s first day.”⁸
Although DoD had warnings for decades, Eligible Receiver was a big wake-up call for the military. According to Kaplan, the NSA discovered real hackers inside the network during the exercise

Solar Sunrise (1998)
Common operating system vulnerabilities were exploited, leading to the compromise of many unclassified DoD-branch computers. The attackers were a group of teenagers
Even relatively unsophisticated actors can compromise important systems. Mis-attribution risks pinning blame on a dangerous adversary (Iran). The DoD was woefully unprepared for securing its networks. Solar Sunrise demonstrated the warnings from Eligible Receiver

Operation Orchard (2007)
Israel flew jets across Lebanon into Syria undetected, bombing a nuclear reactor protected by sophisticated Russian air defenses
It is thought a combination of electronic warfare (EW) and cyberattack techniques made it possible to mislead the Syrian air defense. Future cyberwar is likely to combine EW with computer attacks

Buckshot Yankee (2008)
The military’s classified and unclassified networks were compromised by a foreign state, presumably because a soldier found a USB drive in a parking lot and plugged it into a “high side” computer
Cleaning the infection took over a year and cost a fortune. Buckshot Yankee led to the creation of US Cyber Command. Department of Homeland Security (DHS) later tested the attack risk by leaving USB drives in parking lots in 2011 and found that 60% of the drives were subsequently plugged into government computers! Ninety percent of drives that bore a US government seal were plugged in

Academics Henry Farrell and Charles L. Glaser warn that “cyber is likely the only non-nuclear capability that could inflict massive population damage or severely undermine US command and control (C2).”⁹ And, finally, the prospect that cyberattacks might cause loss of crisis control is a powerful psychological factor for the military.¹⁰ Wars are dangerous; thus, the prospect of eroding control (which itself might just be an illusion) is worrisome because of both the risk of defeat and the risk of escalation and accident.

Speed is another high-level factor driving computing to the forefront of national rivalry. The speed of conflict seemed to reach a terminal stage with the advent of intercontinental ballistic missiles, or ICBMs, which can travel at roughly 15,000 mph. Much Cold War negotiation was keyed to concerns about how many minutes the Union of Soviet Socialist Republics or the United States had to detect and react to a launch. Yet, several new weapons—from space weapons to the hypersonic glide vehicle to the rail gun—make speed and detectability even more difficult than in the ICBM era.

Speed is a central concept of military strategy that is widely used in cybersecurity strategy. Even private-sector cybersecurity experts use the “OODA Loop,” a concept developed by Air Force fighter pilot John Boyd. OODA is a process of observation–orientation–decision–action and in this framework, battles are won by moving through the loop faster than an adversary, or by interfering with an adversary’s OODA. If successful, one’s adversary will be stuck in O–O–O–O (unable to decide or act). The military foresees cyberattacks and the use of fighting UAVs as technologies with inscrutably fast OODA loops, ones that would win a conflict by foreclosing decision or action. Now the question is whether these technologies will cause upset victories, or lead to misinterpretation, mistake, and escalation (Figure 4.1).

Combining with strategic concerns are a raft of practical realities that make cybersecurity a special challenge. They include:

People challenges   The nature of assignments in the military means people are always on the move. Deployment, home leave, training, retraining, reassignment, practice, promotion—there is constant movement and turnover. This results in a dark comedy of security outcomes, such as passwords set to 00000000.¹¹ How else will we access the system after a personnel change?

Private sector challenges  The people problem is both allayed and aggravated by private-sector contractors who directly perform military functions. The reality is that many of these experts were trained by the military and then lured away from military service with great pay packages.

Legacy systems  The military has perhaps the worst case of legacy systems problems—dependence on out-of-date technologies that can’t be upgraded because they are too large, expensive, and important.

Scale and complexity  The US Armed Forces have over 1.3 million active duty personnel, another 800,000 in reserve, hundreds of oversea bases, an unimaginable amount of equipment, and so on. The DoD operates the largest, most complex computer network in the world. Imagine what it means to apply patches and maintain it.

Figure 4.1 John Boyd’s OODA framework. Military strategists have contemplated the theory of decision-making under uncertainty and in dynamic environments for decades, but sometimes these theories—like Boyd’s OODA—are articulated in slide decks instead of publications.

Source: Adapted by Wikimedia user Patrick Edwin Moran.

We will return to a series of challenges at the end of this chapter that further explain concerns about cybersecurity (Figure 4.2).

4.2 Are Cyberattacks War?

Whether cyberattacks are “war” or, in the terms of the United Nations Charter, constitute a “threat or use of force against the territorial integrity or political independence of” another state is hotly contested. Consider these views and how their underlying disciplinary backgrounds might shade their lens.

4.2.1 Cyber War Will Not Take Place

One of the most cited academic papers in cybersecurity is by a well-known and respected political scientist, Thomas Rid. Rid’s 2012 Cyber War Will Not Take Place makes a bold, complex argument that cyberattacks are not war, but rather more akin to crimes:

Cyber war has never happened in the past. Cyber war does not take place in the present. And it is highly unlikely that cyber war will occur in the future. Instead, all past and present political cyber attacks are merely sophisticated versions of three activities that are as old as warfare itself: subversion, espionage, and sabotage.¹²

How does Rid maintain that cyberattacks are not war? He tethers the definition of war to Clausewitz’s 1832 work ON WAR.¹³ ON WAR is considered a modern masterpiece on military strategy. Interpreting Clausewitz, Rid argues that cyberattacks are not violent, not instrumental, and not political. Rid means that for cyberattacks to be war, they must meet Clausewitz’s test that the activity be violent, and it must be violent in means and in ends, and it must be overtly political, in the sense that the point of war is to bend an adversary to one’s will.

Figure 4.2 To illustrate the scale and complexity, consider this matrix of cybersecurity policies and interactions with Department of Defense goals. The IN in DODIN stands for information networks.

Source: Defense Technical Information Center/Public domain. https://dodiac.dtic.mil/dod-cybersecurity-policy-chart/.

For Rid, cyberattacks do not meet all three thresholds. Cyberattacks are not violent in themselves. They cause violence indirectly, perhaps by stoking panic, or by making people vulnerable to physical violence from other, kinetic weapons. When Rid wrote, cyberattacks were also just a single tactic. This made cyberattacks unlike the kinds of total commitment governments make when they send troops to a battlefield. Finally, wars are declared, with formal political demands transmitted to the adversary. Cyberattacks, on the other hand, are often like vandalism—damage caused by masked hooligans. Cyberattacks do not present themselves as direct, true political challenges in the way an assembled army does.

Question 4.2.1 — Political Dynamics of Cyberattacks as “War” What cybersecurity actors might want to classify cyberattacks as war? Which ones might want to, like Rid, view cyberattacks as nonwar activities?

▄

Because of these differences, Rid continues, “the ‘war’ in ‘cyber war’ has more in common with the ‘war’ on obesity than with World War II—it has more metaphoric than descriptive value. It is high time to go back to classic terminology and understand cyber offences for what they really are.”

Question 4.2.2 — Rid’s Tradition Should we see Rid’s argument as an attempt to defend language; to stop an important term—war—from becoming a sloganeering tool?

▄

If cyberattacks are not war, what are they? Rid argues cyberattacks are really forms of sabotage, espionage, and subversion.

Cyberattacks are sabotage because their targets are often things rather than people. Furthermore, sabotage tends to have only tactical effects, rarely rising to operational or strategic-level activities. For instance, in Operation Orchard where the Israeli Air Force penetrated Syria and destroyed the nuclear reactor at Dayr ez-Zor without that country’s air defenses sounding an alert, cyberattacks were used as sabotage against Syria’s sophisticated (Russian-provided) radar systems.¹⁴ The good news about sabotage is that sabotage is hard to do; it requires deep sophistication, teams, and practice.¹⁵ In essence, sabotage is out of reach of most actors. Rid observes that “Only very few sophisticated strategic actors may be able to pull off top-range computer sabotage operations.”

Definition 4.2.1 — Tactical, Operational, Strategic. Military terms are widely used in cybersecurity for good and obvious reasons. Tactical concerns are immediate ones, typically delegated to front-line commanders. Strategic goals are set by generals and the political class, usually at some distance; these are the ultimate aims of a country, its aspirations and very survival. Operational concerns are for the middle management of militaries; they exist between the skirmishes of the tactical and the grand goals of the strategic fields. For tactics to be effective and repeatable, they have to be managed and synchronized as part of larger efforts. A key example (or non-example, rather) came in the form of Russia’s 2022 invasion of Ukraine; Russia stumbled in its joint operational activity among different domain forces.

Turning to nuclear weapons, the term “strategic nuclear weapons” is used to describe weapons that could subdue an entire nation, whereas less-discussed “tactical” weapons are nuclear bombs that might be used on a battlefield in a specific battle.a A vast operational effort remains in place following the “always/never” dilemma: the weapons must always be available for use within minutes of notice, but never deployed by accident nor without authorization.

a In anticipation of land wars, the US military developed a battlefield fission bomb, the “Davy Crockett.” Weighing only 50 pounds, it could be launched at enemy lines just 2 miles away. Russia and China have a wealth of such battlefield nukes.

Rid’s argument that most cyberattacks are just espionage is probably his most compelling point. We now have many examples of computer network exploitation (CNE) levied by governments to spy on others and extract information about them. Cyberattacks performed for espionage are indeed as old as statecraft—even the Old Testament describes acts of espionage.

Question 4.2.3 — Cyberattacks and Violence. When Rid wrote in 2012, no one had yet died directly from a cyberattack. Why was Rid so sure this situation would remain unchanged?

The first death directly attributed to a cyberattack appears to have occurred in 2020, where a patient was turned away from a hospital under a cyberattack and, as a result of delayed care, succumbed.a

Why did it take so long for someone to die directly of a cyberattack? Does this suggest Rid is correct—that cyberattacks simply lack the violent potential of kinetic weapons?

a Eddy M and Perlroth N. Cyber attack suspected in German woman’s death. The New York Times, 2020; 18.

▄

Finally, Rid argues that cyberattacks are a form of subversion, what we have termed information-domain problems, where “human minds are the targets, not machines.” Subversion may feel like violence, but it attacks through semantics and semiotics. Rid concludes with a warning that contains a silver lining:

…In the twenty-first century, the one type of political offence with the greatest potential to unleash instability and violence may not be technologically highly sophisticated sabotage, but technically rather primitive subversion. Yet the Internet facilitates an unexpected effect: specific social and political causes may persist in subcultures and niche groups, either temporarily or over an extended time, either violently or non-violently—and they may never cease attracting followers yet never go mainstream. These movements may be cause-driven to a significant extent, and less dependent on leaders, organization, and mass support than classical insurgent groups. Weak causes become stronger in the sense that they garner enough support to persist over an extended period of time, constantly maintaining a self-sufficient, self-recruiting, but also self-limiting number of supporters and activists.

Rid concludes with this cherry: “the heading of this article (Cyber War Will Not Take Place) should not be understood with Giraudoux’s sense of fine irony, but literally. Needless to say, Cassandra could still have the last word.”

Available empirical analysis of cyberconflict appears to support Rid’s predictions. In a study of cyber incidents documented in the Dyadic Cyber Incident and Dispute Dataset (DCID), Brandon Valeriano and Ryan Maness found that cyber conflicts among states were restrained because of concerns of how attacks could hit unintended targets and that most cyber conflict was ultimately trivial because attacks had no impact on how states interacted.¹⁶ A consensus is now emerging that cyberattacks exist as intelligence activity, or a new category of activity that is like intelligence, but short of war.¹⁷

4.2.2 Cyber War Is Coming

Rid wrote in response to clamoring and fear-mongering among defense officials over cyberattacks. Throughout the 2000s, there was agitation about cyberattacks, which Rid dismissed as alarmist fiction. Martin Libicki’s otherwise excellent 1999 book, Cyberdeterrence and Cyberwar, for instance, featured an atomic blast on its cover comprised of 1s and 0s. The loudest agitation came from Richard Clarke, a curious, devoted, and deeply expert figure who served Presidents Reagan, H.W. Bush, Clinton, and G.W. Bush.¹⁸ Clarke was Rid’s Cassandra (Table 4.2).

Others writing about the future of cyberconflict saw opportunities for less bloody warfare. John Arquilla and David Ronfeldt open their prescient 1993 work (only about 10% of Americans were even online then) with a scenario of a small force rapidly overwhelming a larger and better-defended one. They declared, “Warfare is no longer primarily a function of who puts the most capital, labor, and technology on the battlefield, but of who has the best information about the battlefield.”¹⁹ The information-superior force would know where to attack, where to avoid the enemy, and be better coordinated.

Question 4.2.4 — Information Superiority. Arquilla and Ronfeldt wrote in 1993. Can you think of subsequent conflicts or technological developments that match the duo’s prediction?

▄

Table 4.2 The Badfort Crowd does cyber (significant Russian cyberattacks).

Incident
What happened
Why it matters

Moonlight Maze (1998)
Russian intelligence services compromised unclassified and classified (SIPRNet and JWICS) networks, stealing a massive amount of information
Resulted in the creation of the Joint Task Force for Computer Network Defense (JTF-CND)²⁰

Ukraine (2005)
Russia used BlackEnergy malware to infect power stations and turn off electricity for hundreds of thousands of people
BlackEnergy represented a major threat to people everywhere that a nation could attack a civilian power infrastructure to attack or pressure citizens politically

Estonia (2007)
Russia used denial-of-service attacks on a broad set of Estonian information and bank services²¹
Strategically, the Russian government was trying to stymie nations in Eastern Europe from joining North Atlantic Treaty Organization (NATO). Cyberattacks gave Russia an ability to flummox Estonian leaders while not striking quite hard enough to attract western reprises. Operationally, attacks were so technically unsophisticated, they could be blamed on organized crime (the Russian Business Network)

Russo-Georgian War (2008)
Russia used denial-of-service attacks in concert with a physical invasion of Georgia
The synchronization of cyberattacks with a physical invasion gave the world a preview of what future cyber/physical joint conflicts might look like.²² Such efforts require exquisite mastery of military joint command and control

NotPetya (2017)
This Russian malware, based on NSA’s EternalBlue, presented as ransomware but then wiped the hard drives of targets
Intended to harm Ukrainian agencies and companies, this “wiper” malware quickly spread to multinationals doing business in Ukraine, causing billions in losses. Because it seeks a ransom but then destroys the hard drive anyway, it threatens cybercriminals in that victims might become less likely to pay ransoms. Spread through accounting software, it affected some of the most important logistics companies in the world. A patch existed for this attack, yet many companies had not applied it

Arquilla and Ronfeldt describe a series of prescient examples that suggest a blending of EW and human activity: “It implies new man–machine interfaces that amplify man’s capabilities, not a separation of man and machine.” The result might be a more humane war: “a fully articulated cyberwar doctrine might allow the development of a capability to use force not only in ways that minimize the costs to oneself, but which also allow victory to be achieved without the need to maximize the destruction of the enemy. If for no other reason, this potential of cyberwar to lessen war’s cruelty demands its careful study and elaboration.”

Electronic Warfare

EW is an important, overlooked category of physical-to-cyber attack. It has its roots in fantastic achievements of the UK and US military in World War II, as radio and radar—and countermeasures—offered new possibilities. The EW specialists of the era are known as the “old crows.” For reasons we do not understand, cyber divisions separated from the original EW units.

EW tactics using the electromagnetic spectrum could be levied against communications and control networks (e.g., signal and radar jamming), but for historic and other path-dependent reasons, EW is often omitted in discussions of cybersecurity. Yet, it would seem to make sense that confronted with a strong cyber power such as the United States, adversaries might want EW capabilities that eliminated cyber as an option. Conversely, the United States would probably want to combine EW with cyberattacks in some situations.

We know that consequential cyberattacks typically require intelligence gathering, patience, and commitment. But, on the battlefield, the EW link becomes clear: many military appliances run on Windows. There may be opportunities to exploit these computers and devices at the moment. Clever hackers have demonstrated attacks on computers and networks using infrared signals, wi-fi, and ultrasonic tones.

The US Army signaled a consolidation of EW and cyber in 2014. It released FM-3-38, the first Cyber Electromagnetic Activities field manual, and updated it in 2017. EW would seem to be a good investment for countries facing adversaries with strong cyber power.

Arquilla and Ronfeldt’s observations were borne out to some degree. Arquilla replied to Rid’s critique in Foreign Policy, showing how Russian troops used Internet deception to trick Georgia’s systems and the attack on bank systems, again performed by Russia, that made the lives of Estonians so difficult.

Question 4.2.5 — Rid Versus Arquilla. Now that you are familiar with the basic contours of Thomas Rid and the Arquilla/Ronfeldt theories, whose are most congruent with modern cyber conflict?

▄

4.2.3 The Law of War

Livy describes the scenes during the end of the Third Punic Wars, where the Romans, driven to extremes by the threat of the Carthaginian empire, siege and sack Carthage, killing or enslaving its entire population. In an anecdote that presages the violent, genocidal will of the rising Roman empire, Livy reported that the wife of Carthaginian commander Hasdrubal, upon seeing him negotiating with the enemy, threw her children and then herself into the fire. For Hasdrubal’s wife (never named by Livy or Polybius), suicide was less horrific than the ravages that would take place in a surrender. The flames consuming the city were kept alive for weeks to ensure the complete annihilation of the rival empire.

The aspiration of international humanitarian law (IHL) is to relegate the phenomenon of total wars—conflicts like the Punic Wars where no limits on methods, targets, or extent of destruction exist—to history. The effort is critical in an age of biological, chemical, and nuclear weapons.

On Just War

St. Thomas Aquinas, in Summa Theologica argued that it was not always a sin to wage war. He set forth conditions for a “just war” that influences modern law:

In order for a war to be just, three things are necessary. First, the authority of the sovereign by whose command the war is to be waged. For it is not the business of a private individual to declare war, because he can seek for redress of his rights from the tribunal of his superior…Secondly, a just cause is required, namely that those who are attacked, should be attacked because they deserve it on account of some fault…Thirdly, it is necessary that the belligerents should have a rightful intention, so that they intend the advancement of good, or the avoidance of evil…

Several other just war concepts emerge from the Christian tradition in Summa and in the thought of St. Augustine: First, the war must have proportionate cause, in that the good of going to war must outweigh the death and destruction. Second, there must be a reasonable chance of success (otherwise, war will cause more death than it prevents). Third, war must be the last resort.

The Christian just war tradition reflects virtue ethics philosophy and exists somewhere on a continuum between pacifism and realism. Interestingly, Aquinas’s discussion on war appears in the section of Summa on charity.

At the same time, idealists, realists, and nihilists have different views on the policy to avoid war. Idealists point to a kind of historical arc of justice embodied by the norms of law. If law of war rules are taken seriously, idealists think armed conflict will eventually be eliminated as a policy option. On the other hand, international relations thinkers from the realist school see the world as fundamentally anarchic and view the law as beneficial but ultimately unlikely to restrain the powerful or wicked. That is, the realists think law is a good, but imperfect, venture. Nihilists think only power matters and that law will not restrain states. That is, the strong will do what they can and the weak will suffer what they must.

Success of the legal effort sometimes requires the powerful to make sacrifices. The legal enterprise requires nations to forgo certain actions and take risks in relying on the forbearance of others. (If parties forbear from developing nuclear weapons, what if one party secretly breaks the agreement?) A legal approach also sometimes requires war. For instance, powerful nations may have a responsibility to take up arms to protect weaker nations from aggression.

On the Melian Dialogue

Beware the realists who invoke Thucydides’s Melian Dialogue to justify the notion “might makes right.” In the Dialogue, Thucydides reports on the Athenians’ exhortations to the Spartans of Melos to surrender. The Dialogue includes this text, often quoted without context, “…the strong do what they can and the weak suffer what they must.”a

Why is this out of context? Thucydides was writing descriptively, not prescriptively. He did not approve of “might makes right.” He instead was trying to explain the reasoning of the Athenians, which he saw as ruinous. See the essay in Chapter 1: Section 1.1.1.

Moreover, if we respect rule of law and the rights of others, we should not embrace this reading of Thucydides.

a Thucydides. The Landmark Thucydides: A Comprehensive Guide to the Peloponnesian War. Edited by Strassler RB. Simon and Schuster, 1998.

The law and reality of cyber conflict are quite nuanced. To understand it, one must be familiar with two legal regimes and then a realpolitik that takes advantage of gaps in these regimes.

Two legal frameworks are key to cyber conflict: First, the United Nations Charter (1945) specifies jus ad bellum rules. These rules define what conflict is and when states can initiate or use war.

The second framework is IHL or the law of armed conflict (LOAC). The LOAC specifies jus in bello rules, that is, the rules of conduct for waging war. In essence, any use of force must comply with the LOAC, even if a formal “war” is not declared.

The Tallinn Manual is a consensus statement from a group of experts in human rights and military operations. The Manual canvasses the law of war and applies those rules to cyber operations. The Manual attempts to describe, not prescribe, the legal rules. It does so by specifying 154 bright-line rules with commentary. To be clear, the Manual carries no legal authority, but it is taken seriously because of the expertise of its authors and because the Manual helps nations converge toward norms for jus ad bellum and jus in bello rules.²³

Definition 4.2.2 — Cyber Operations and Cyberattacks. The Tallinn Manual defines “cyberattacks” as a class of cyber operations: “A cyber attack is a cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to objects.” Note two implications of this definition: First, attack requires an expectation of injury. Second, activities performed for espionage purposes are not attacks at all—these are merely cyber operations.

Turning back to jus ad bellum, the United Nations Charter in essence bans war. The Charter commands members to refrain from the “threat or use of force against the territorial integrity or political independence” of another state. Thus, the Charter bans war by prohibiting the use of force against any other nation (including non-UN members). The remedy for violation is to petition the Security Council for intervention.

But, if the Charter bans war, why is there so much cyber conflict? The answer comes in disagreements surrounding the definition of “use of force.” Many cyber operations may be invasive and unsettling, yet they do not constitute uses of force. These cyber operations are called “below-threshold” activities. Covered in more detail below, the realpolitik strategy of many nations is to use below-threshold cyber operations to unsettle adversaries. As long as these are below threshold, the aggressor can operate without the stigma of UN intervention and opprobrium.

Even if a cyber operation is intense enough to be a use of force, victim nations are not automatically entitled to strike back. Instead, victim nations are supposed to employ UN-supported remedies after the fact. One might imagine a nation that suffered a use of force may prefer to take action rather than complain to the UN. Petitioning the UN may make a leader look weak, perhaps unable to respond to the use of force.

States may prefer to directly respond to uses of force. That option is provided for in Article 51 of the Charter. Nations possess an “inherent right” of self-defense if “an armed attack” occurs against a member. Armed attacks are special kinds of uses of force, ones characterized as the most “grave” forms of violence. For instance, experts agree that any kind of biological, chemical, or radiological use of force is an armed attack, entitling immediate responsive action from the victim state. This is because such attacks can cause mass suffering and death and responsive action is necessary to stem the damage.

Cyber operations can be uses of force, and even armed attacks. There are three approaches to analyzing whether a cyber operation is an armed attack, thus entitling a state to self-defense:

Did the use of force cause kinetic-like damage?  This is the most restrictive definition that attempts to cabin armed attacks to events that look like Clausewitz’s concept of traditional war: massive destruction of life and property. An example would be a cyberattack that caused a dam to fail and hundreds of people to die in the resulting flood.

What were the effects on the attacked state?  This broader definition might include many kinds of harm that do not involve traditional violence. For instance, if an attacker disabled the stock exchange and caused a trillion dollars of economic harm, resulting in people losing their homes and starving. Such effects-based approaches look to consequences in a large sense to define “armed attack.”

Attacks on certain targets are armed attacks  This approach singles out critical infrastructures as being special targets that, if damaged, mean the aggressor has engaged in an “armed attack.” Because so many infrastructures are critical nowadays, this is the broadest definition of “armed attack.” Turning back to the dam, even an attack against it that did not cause systemic failure would be an armed attack.

Question 4.2.6 — Collective Defense. Suppose a NATO ally suffers a cyberattack so severe that it is clearly an “armed attack.” Would you be willing to commit US troops under our North Atlantic Treaty Organization obligation to provide a common defense?

▄

Question 4.2.7 — The Gap Between the Use of Force and Armed Attack. All armed attacks are uses of force. But, not all uses of force are armed attacks.

One influential court decision found only the “most grave” uses of force constitute armed attacks.a But, the position of the United States is that there is no functional gap between force and armed attack—the two definitions are in effect the same: the “United States after the Nicaragua judgment, asserts that any unlawful use of force qualifies as an armed attack triggering the right of self-defence; there is no gravity threshold distinguishing uses of force from armed attacks. On this view, no gap exists between an unlawful use of force and an armed attack, although the principles of necessity and proportionality that apply to actions in self-defence may limit the responses available to a State that has been attacked.”b

Why do you suppose the United States wants the definitions of force and armed attack to have no gap?

a The “Nicaragua judgment,” Military and Paramilitary Activities in and against Nicaragua, 1986 ICJ 14 (27 June).

b See discussion of Rule 69 in Schmitt MN. Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations.

▄

▄ Example 4.1 — Uncertainty Lingers Surrounding Use of Force. In 2013, Paul Rosenzweig asked, “If, for example, cyber agents were introduced into a system for exploitation and attack, but not yet activated, should that be considered a use of force? Or, to identify another issue, is the mere destruction of data a use of force? Some in the intelligence community might even consider deep, aggressive phishing …to be a use of force. Here, we have no settled doctrine.”²⁴ Indeed, these issues are still not settled.

▄

Suppose a nation does meet the armed attack threshold against another state, thus justifying self-defense under the Charter’s jus ad bellum rules. The subsequent self-defense is governed by a different set of rules, the above-mentioned IHL or the LOAC. The LOAC requires that the self-defense, just as in ordinary tort law, be necessary and reasonable.

Any use of force must meet LOAC’s three high-level requirements, whether or not a formal war has been declared. The requirements sound in St. Aquinas’s Summa Theologica: distinction, proportionality, and necessity. Distinction is the requirement to focus attacks on military objectives, to target counterforce rather than countervalue. To be clear, LOAC allows some killing of civilians. But, civilian casualties are only tolerated when the overall goal is the pursuit of a “definite military advantage.”²⁵ The deliberate killing of civilians is a war crime.

Proportionality requires that attacks not cause excessive losses of civilian life compared to the military objective. For instance, it might be a highly valued objective to disable a power plant next to a military base, but if that energy source also powers a hospital, attacking it may be disproportionate.

Finally, necessity is the notion that uses of force are required to directly advance a military objective. Alternatives, such as diplomacy, must be foreclosed. This also raises an interesting ethical issue: Are cyberattacks a necessary to try alternative to using traditional violence?

Applying these three principles to cyberattacks only works at the edges. For instance, using a cyberattack to disable a radar system or spy satellite is an easy case. It targets military hardware rather than civilian infrastructure, is proportionate because it causes no civilian death, and may be necessary to achieve a military objective.

Now consider a cyberattack on Amazon and Microsoft for their support of military and government cloud services. Cloud services selling to governments are mixed counter-force/counter-value targets. There may be no clear way to make a distinction and focus force only on the government part of a cloud system. The cloud attack may be disproportionate if the cloud supports hospitals or other civilian-critical operations, and ordinary civilians could die in large numbers. Generally speaking, if the cloud service is known to support hospitals, it may be a legally protected entity under international law that cannot be intentionally targeted (Table 4.3).

Table 4.3 Nations design their cyber operations so they avoid triggering international law thresholds. References in this table are to the Tallinn Manual.

Type
Legal definition
Examples
Why it matters

War crime
Serious, intentional violations of the LOAC are war crimes that can be prosecuted as criminal matters
Deliberately killing civilians. The Tallinn Manual gives an example of using cyberattacks to disable the sole power source used only by a civilian population, with subsequent death from freezing (see Rule 84)
Commanders, superiors, and soldiers who participate in war crimes can be charged as criminals. Commanders have a duty to prevent war crimes

Armed attack
The most grave forms of force. Look to the scale and effects of the use of force (see Rule 71)
Biological, chemical, or radiological uses of force are clear armed attacks. “…a cyber operation that seriously injures or kills a number of persons or that causes significant damage to, or destruction of, property would satisfy the scale and effects requirement.” (see discussion of Rule 71)
A nation victim of an armed attack may use self-defense. LOAC rules still apply. The self-defense must be proportionate and necessary to quell an immediate threat

Use of force
Operations where “scale and effects are comparable to non-cyber operations rising to the level of a use of force” (see Rule 69)
“Acts that injure or kill persons or physically damage or destroy objects are uses of force.” (see Rule 69)
Constitutes a violation of Article 2(4) of the UN Charter. A nation victim of a use of force has legal recourse under international law. That is, a use of force alone does not justify a use of force in response

Below threshold operations
Look to scope, intensity, and duration to determine if an operation constitutes a use of force
Inconsequential violence, espionage, PSYOP, persuasion, criticism, public diplomacy, undermining confidence in a government, fake news, economic suasion, mere inconvenience or annoyance, and so on are below threshold (see Rules 13, 69) “…merely funding a hacktivist group conducting cyber operations as part of an insurgency…” (see Rule 69)
This below-threshold-of-force activity can have force-like effects, while not triggering the risk-reducing LOAC rules. Some below-threshold activity may be unlawful under other legal rationales, for instance, if the activity interfered with fundamental rights to free speech and privacy (see Rule 35).

▄ Example 4.2 — Self-Study on Cyber Operations and Attacks. The Cyber Law Toolkit is “a dynamic interactive web-based resource for legal professionals who work with matters at the intersection of international law and cyber operations. The Toolkit may be explored and used in a number of different ways. At its core, it presently consists of 28 hypothetical scenarios. Each scenario contains a description of cyber incidents inspired by real-world examples, accompanied by detailed legal analysis.” The Toolkit is online: https://cyberlaw.ccdcoe.org/wiki/Main_Page

▄

4.2.4 Cyber Realpolitik

The UN Charter in effect bans uses of force. But, the ideals underlying it have failed in cybersecurity. On the one hand, deterrence strategies have appeared to prevent total war scenarios in cyber conflict—indeed, cyber war has never taken place. On the other, nations are in a constant “below threshold” form of conflict, where nations use Internet attacks that do not rise to the level of force but still achieve goals traditionally met through force!²⁶ To be clear, nations constantly use cyberattacks, and these are below threshold in the sense that we do not interpret them to be uses of force. At the same time, these operations can have consequential and scary, war-like effects.

Lucas Kello calls the situation an unpeace. As Kello puts it, nations are involved in a “midspectrum rivalry that is more damaging than traditional peacetime activities (such as economic sanctions), but not physically violent like war.”²⁷ Jon Lindsay characterizes cyber as “a form of cheating within the rules” rather than a warlike struggle.²⁸ Nations regularly use cyber operations to steal data and set the stage for kinetic attacks on other nations. In this gray zone, nations levy cyberattacks against adversaries, but ones that are not serious enough to trigger the legal standard of “use of force” or “armed attack.” The strategy deprives the victim of a lawful response, either in petitioning the UN or in taking up arms in self-defense. Making things worse, there are not enough technical resources to stop the volume of below-threshold attacks. Taken together, this means that neither law nor technology can deter below-threshold attacks. We do not have a deterrent strategy!

Definition 4.2.3 — Below-Threshold Conflict. The greatest challenge in cyber conflict today is the notion of cyber operations that are below the legal threshold of a “use of force” or “armed attack.”

Among the most exasperating “below-threshold” activities is PSYOP—psychological operations. To be clear: it is legal for governments to use information to manipulate and intimidate adversaries. This is not force under the LOAC. The fake news and disinformation that so roiled the American public in 2016 may change attitudes toward the regulation of PSYOP.

Frustration with PSYOP is exacerbated by the very nature of information nowadays. For most of human history, we have existed in information scarcity. Information was hard to find and possessed by an elite of literates. Today, we live in an information glut, with users overwhelmed with the volume of information and the feeling that one needs to respond to it quickly. In an information glut, censorship and propaganda strategies change. From a cybersecurity perspective, the censor might attack information availability in an information scarcity world. But, in an information glut world, the censor changes tactics to focus on information integrity—the I in CIA. Modern censors are propagandists who compete to shape reality by introducing many different narratives so no one knows what to believe. For instance, the Russian GRU (a military intelligence service) has been implicated in a series of cyberattacks on law enforcement agencies investigating serious Russian misdeeds.

Question 4.2.8 — Treaty-Seeking. As early as 1998, Russia sought a treaty to cause nations to forbear from cyberattacks while the United States and other nations have remained reluctant.a Why would Russia, a notorious user of hacking and disinformation, seek a treaty, while other nations, such as the United States, resist forbearance that comes with a treaty?

Jeremy Rabkin and John Yoo offer a prediction: “…the history of technology and war suggest that nations will not agree to significant limits until they have gained experience with the weapons and understand their strategic implications.”b

What experiences might drive the United States to seek a treaty?

▄

a Korzak E. Russia’s Cyber Policy Efforts in the United Nations. Tallinn Paper No. 11, 2021.

b Rabkin J and Yoo J. Striking Power: How Cyber, Robots, and Space Weapons Change the Rules for War. Encounter Books, 2017.

Computers begin to shift the contours of conflict, however. Wars of the future may not look like wars past. Suppose the United States and China were to initiate a war. The first likely targets in that confrontation would be the nations’ satellites. In fact, this is why we have the US Space Force. Derided by the unimaginative as some kind of Star Trek adventure, its real purpose is to deal with the increasing anti-satellite (ASAT) capabilities of China, Russia, and others.

Question 4.2.9 — Satellite Attack. Given what you have learned about armed attacks and the waging of conflict, what would your analysis be of a justified exchange of aggression limited only to US and Chinese satellites? Is the LOAC framework adequate? What would the knock-on effects be of a satellite attack?

▄

Finally, the modern US military uses a lot of outsourcing. Some systems have become so complex that only experts from defense industrial base (DIB) companies can understand them. This means contractors may be performing functions like loading munitions onto warplanes, which previously were done by service members. Turning to cyberattacks, the private sector may be even more engaged than in kinetic attacks. In the Russian invasion of Ukraine, for instance, foreign and civilian volunteers joined the IT Army of Ukraine and private companies played a public role in improving Ukraine’s security.²⁹

Definition 4.2.4 — Defense Industrial Base (DIB). A nation’s most important companies that engage in research and production of military matériel form the “defense industrial base.” Lockheed Martin is a classic example of a crucial DIB company.

Question 4.2.10 — Cyber Contractors as Combatants. Soldiers who follow the LOAC enjoy “combatant immunity.” To be sure, soldiers can be targeted for attacks, but combatant immunity entitles soldiers to receive “prisoner of war” status and immunity from criminal responsibility for their war-waging.

Now consider that private-sector contractors today perform many military-like responsibilities. Suppose the United States was engaged in a war with Iran, and you took a job with a cyber offense contractor and then helped the NSA perform a cyberattack against Iran. Iran assesses that it cannot strike the NSA building in Ft. Meade, MD, because it is defended nicely. But, the country also determines that contractors in Northern Virginia are the ones actually carrying out the attacks.

Could Iran strike an office building in Reston, VA, because its private-sector employees have “directly participated in hostilities,” thus making them a lawful target of force?a

a For a discussion, see International Committee of the Red Cross, Interpretive Guidance on the Notion of Direct Participation in Hostilities Under International Humanitarian Law (2009). Note that civilians may participate in hostilities but are not afforded combatant immunity.

▄

4.3 Computers and the Future of Conflict

The discussion thus far has focused on the downsides on cyberattacks. But, as vulnerable as the United States is, many leaders are excited about the possibilities of EW and Internet attacks.

Question 4.3.1 — Superiority and Dominance. Governments seek technology superiority, meaning they want to be more advanced than all adversaries, and dominance, meaning the government has full freedom of operation and can deny others freedom of operation. What might dominance look like in cyber power? Consider 2034: A NOVEL OF THE NEXT WORLD WAR (2021), in which Admiral James Stavridis and Elliot Ackerman weave a scenario where the Chinese military deploys a cyber weapon that disables all American systems and enables the country to take control of the South China Sea.

▄

What is the excitement about? In theory, it is possible to use cyberattacks to perfectly implement a deterrence strategy. This is because cyberattacks could be used to realize many different tactical goals, perhaps with deniability and the ability to scale up and down levels of punishment, depending on one’s political goals. Again, in theory.

Military strategists conceptualize of attacks as fitting into several tactical goals known as D5:

Disruption  One could interfere with communications to slow down or frustrate an adversary.

Denial  One could stop their ability to communicate or operate equipment.

Degradation  One could erode the quality of communications, for instance, by interfering with secure channels and causing parties to use insecure ones, or cause their communications to be rerouted to a place where tampering is possible (consider Border Gateway Protocol (BGP) attacks).

Destruction  One could render equipment useless, perhaps by making it overheat or malfunction so it is destroyed permanently (consider Iran’s nuclear centrifuges).

Deception  Finally, one could engage in trickery, say by programming a digital device to report false information to its users (consider the unfaithful radar array).

Table 4.4 Cyber conflict may allow an attacker to choose the level of damage, the character of damage, and how visible the damage is, thus allowing maneuvers that scare an opponent while not communicating it to the general public, or, at the other end of the spectrum, a highly embarrassing, perhaps destabilizing demonstration of power. This is adapted from Fischerkeller and Harknett.

Slight damage | Moderate damage | Significant damage
No reaction necessary | Victim must transfer functions to redundant or suboptimal systems | Complete functionality loss, termination of systems
Low visibility, even sub rosa (allows “saving face”) | Perhaps, visibility to a nation’s elites, undermining trust in leadership | High visibility (conflict may be embarrassing and undeniable, destabilizing for the general public)
Attack disrupts (ultimately reversible) | Attack degrades infrastructure | Attack destroys infrastructure (ultimately irreversible)

In addition to all these tactics, if cyberattacks work perfectly (a big if), the attacker can mete out precise levels of punishment. This is an exciting capability for deterrence theorists. Precision also may mean that governments will be tempted to use cyberattacks more, because collateral damage can be avoided (Table 4.4).³⁰

4.3.1 The Changing Nature of Conflict

Many of the best-case scenario capabilities might be blunted by other developments. Adversaries will come into parity with the United States, perhaps by study and innovation, or perhaps through theft. After all, computing is not like atomic bombs, a technology we have anti-proliferation strategies for. Computers are easy to get, hard to restrict, and hard to track. People can be trained to write software.

4.3.1.1 Autonomy and Cybersecurity

Cyberdefense and offense might be the areas where we are willing to embrace automaticity in conflict in ways we might resist with other systems.

Historically, DOD policy has embraced “human in the loop” (HITL) weapon systems, meaning that a person has to review the decisions taken by the system. These systems take three independent decisions that could be subject to review: the selection of targets, the selection of “effectors”—the weapon system that can strike the target, and the decision to attack. Automation or autonomy could begin to perform any one or more of these three separate functions.

Question 4.3.2 — Strategic cyberpowers? Consider how the “fifth domain” of cyberattacks might shape states’ grand strategies. Historically, there have been nations with great power in a single domain (e.g., naval warfare) but lackluster capabilities in others. Will there be states that have first-class cyberattack capabilities but lack other, such as kinetic, ones?

▄

Already HITL has been eroded, mostly involving systems that are defensive in nature. There are several deployed systems that take one or more of the decisions with the human “on” the loop (HOTL), meaning decisions are made by the device (target selection, effector selection, and attack decision) but can be stopped by the human. Consider the Phalanx close-in weapons system (CIWS), a category of weapons known as a “sentry gun.” The CIWS is a defensive weapon. It was designed to deal with the problem of volleys of attacks against warships. As a group of missiles comes close to the ship, the CIWS automatically identifies them and shoots metal in their path until the missile is destroyed. This is necessary because missiles approach far too quickly for humans to react.

CIWS were then adapted to be used on land bases, so they could engage multiple targets bearing down on a base. The CIWS is an “on the loop” weapon, because it makes target selections and attack decisions on its own. Once activated, the human can override its operation (Figure 4.3).

Cyber conflict is poised to be an area where HOTL or fully autonomous systems defend networks or even react to attacks. The rationale is similar to the CIWS’ need for speed to react: no human can possibly recognize and triage all potential cyberattacks.

4.3.1.2 Computer Attack Strategies

Just as we learned that adversaries will use information operations to confuse commanders and crush the will to fight amongst soldiers, future conflict will involve information attacks on computers. The obvious attacks will be hacking, but once computers are more fully in control over target identification, effectors, and the decision to attack, countermeasures will be levied against computer decision-making processes. Presumably, our computers will study not how to confuse people but how to confuse other computers.

As the importance of computer decision-making becomes clear and its vulnerabilities surface, we may have to revisit assumptions and policies in technology law. Consider a future national security concern raised by Berkeley political scientist Steven Weber:

…will the US government permit autonomous vehicles made by Chinese firms to drive on American roads? Behind this question lies the deeper decision: should the data stream coming off autonomous vehicles be free to cross borders and be stored and used in research and development centers owned by Chinese firms in Beijing? This might be viewed narrowly as a national security concern, since autonomous vehicles are also mobile sensor units that would provide massive, unprecedented intelligence to a strategic adversary (imagine knowing the precise condition of every road and bridge, and having real-time granular information about travel patterns in an adversary’s country). But it’s equally a critical economic development question, since the firms that win the race to develop and build autonomous vehicles over the next decade will probably be some of the highest value-creating entities of the first half of the century.³²

Figure 4.3 Militaries have developed multiple generations of autonomous “sentry guns.” For instance, Raytheon’s Phalanx close-in weapons system (CIWS) is a human-on-the-loop system to destroy in-bound threats, such as volleys of missiles approaching a ship. Arguably, autonomy in weapons systems began in the 1940s with guided bombs. Systems such as the Tomahawk included early computer vision capabilities to match targets. Scores of systems exist today with some level of autonomy. Defensive systems, like rocket-intercepting PATRIOT missiles, are not so controversial. However, the newest dynamic comes from offensive weapons, such as UAVs that can “loiter” for extended periods of time before attacking.³¹ Here, Fire Controlman 2nd Class Josiah Jackson loads rounds into the CIWS aboard the guided-missile destroyer USS Nitze (DDG 94). Nitze is deployed as part of the Enterprise Carrier Strike Group to the US 5th Fleet area of responsibility conducting maritime security operations, theater security cooperation efforts, and support missions for Operation Enduring Freedom.

Source: US military/Wikimedia Commons/Public domain.

In this scenario, Weber connects both national security and national competitiveness concerns to computer decision-making power. The intelligence implications run even deeper: with ground-level collection from cars, China will be less dependent on its satellite constellation. Autonomous vehicles could collect everything from imagery to radio signals undetectable from space.

To further extend the scenario, if Beijing-based autonomous vehciles (AV) makers succeed, there are probably knock-on benefits for China’s UAV companies. Do we want potential adversaries using data about Americans to train their computer vision systems so they can have more performant attack drones?

As computers become more important in conflict, attacks on them will expand into every possible opportunity for corruption. We have already seen both “supply chain” attacks, situations where computers are somehow degraded in the manufacturing process before they reach the user, and design attacks where cryptographic systems, for example, are subtly designed to make decryption easy for governments.

Hacking Computer Vision

Computer vision is a key technology for future conflict, but it is important to know that computers do not interpret the world the way people do. Some have characterized computer vision as a kind of “alien intelligence” rather than “artificial intelligence,” because what is important to a computer may be completely different from the cues humans pay attention to. In adversarial machine learning, scientists have demonstrated that simple perturbations of data can fool computers into classifying images incorrectly. In other demonstrations, simple tricks such as holding up a piece of paper with an abstract design on it cause a computer to think the person is armed with a weapon. In one clever approach, Carnegie Mellon University researchers fooled a computer vision program by using “glasses” that cause the researchers to be recognized as celebrities.³³ When the adversary is a computer system that watches video feeds for attackers, such trickery might be an essential tactic.

These changes will test the limits of LOAC. Traditional measures of aggression include not-so-subtle events, such as amassing troops at a border. But, in a world where cyber offense is the first step, we will need to recognize different kinds of battle preparation. Instead of mass troop movements, perhaps noticing that key software engineers from Booz Allen Hamilton have moved to Ft. Meade will be the signpost of attack. We will need different institutions and procedures to anticipate and stop armed attacks.

4.3.1.3 The Nation State Assumption

But, the changes might strike at an even deeper layer. The discussion above assumes the importance of the nation-state. But, the modern era is characterized by an erosion of Westphalian Sovereignty—the notion that nation-states are autonomous, should enjoy freedom from interference, and are ultimately responsible for citizens’ actions. Westphalian norms fray when states cannot perform their basic functions. Superpowers intervene in the domestic activities of other nations as they experience humanitarian disasters and as other nations lose control over organized crime and domestic terrorism.

Erosion of sovereignty poses challenges for modern militaries. Cybersecurity presents some of the most vexing sovereignty issues. The sovereign approach assumes wars are fought amongst nations acting in their own best interests. But, terrorism, organized crime, and political extremism drive people to use the Internet in harmful ways that are disconnected from the ordinary priorities of sovereign nation-states. Terrorists, significant criminal organizations, and extremists may seek goals incongruent with normal statecraft, because the groups elevate their concerns over that of the nation they are operating in. Such groups may not hold land or other assets that can be targeted. They may have no qualms about targeting civilians or using private infrastructures to effectuate attacks. They may have advanced information warfare tactics, so they can win battles in the media even as they lose in the battlespace. They may use the Internet to recruit adherents from anywhere in the world.

Erosion of nation-state sovereignty also complicates traditional spycraft. The availability of personal data from so many sources is presenting new challenges for intelligence agencies that are hiding their operatives with cover. The lack of data about the supposed cover, or inconsistent data about the cover, could trigger suspicion. And complementary data feeds can be used to evaluate the consistency of covers. Consider for instance the “GEOINT Singularity,” conceived as “the convergence, and interrelated use, of capabilities in artificial intelligence, satellite-based imagery, and global connectivity, where the general population would have real-time access to ubiquitous intelligence analysis.”³⁴ In a world with GEOINT singularity, a government could buy satellite imagery of any place in the world. Such intelligence allows anyone to ask questions such as: Did you really spend the weekend with your family at Colonial Williamsburg, or were you at the CIA’s nearby “Farm”? Let’s check the satellite feed to see whether your car was parked there…

4.3.1.4 US Cyber Institutions and Posture

Under President Trump, US Cyber Command (USCYBERCOM) was elevated from its subordinate position under Strategic Command to a unified military command. This signaled US commitment to cyberspace as a conflict domain and made Cyber Command more independent. The elevation also gave Cyber Command a direct report to the Secretary of Defense.

In a series of reports released in 2018, the President Trump DoD articulated a new, more aggressive cyber framework. The Trump administration proposed a more belligerent posture for the joint armed forces, stating they will be “more lethal, resilient, and rapidly innovating.”³⁵

Cyber Command used the metaphor of an iceberg to explain the cybersecurity challenge and articulated a change in posture: nations and non-state actors are persistently attacking the US military and private sector with “below threshold” actions, meaning these activities are damaging and threatening, but not so severe to be conceived of as uses of “force” for purposes of law. To counter foreign cyberspace aggression, the Trump administration advanced two related policy concepts: defend forward and persistent engagement. Neither is precisely defined, allowing some opportunity for opportunistic interpretation.

Defend forward is the idea that one should move defenses closer to an adversary. In physical space, this might mean maintaining a military base in an allied country that is close to an adversary. In cyberspace, this means having intelligence and attack capabilities in third-party networks around the world, because attacks are often staged on computers in other nations. For instance, the United States might monitor computers in the Netherlands that have been compromised by an adversary. In so monitoring, the United States can better understand an adversary’s intent, and possibly stop an attack before it reaches US services.

Persistent engagement is the strategy of “persistently contest[ing] malicious cyberspace actors to generate continuous tactical, operational, and strategic advantage.” The idea is to give the military more operational freedom to engage in mini-conflicts. The hope is that by bringing more fight to adversaries outside US systems, attack will become costlier. Cyber Command argues that “Through persistent action and competing more effectively below the level of armed conflict, we can influence the calculations of our adversaries, deter aggression, and clarify the distinction between acceptable and unacceptable behavior in cyberspace. Our goal is to improve the security and stability of cyberspace…” For instance, that server in the Netherlands being operated by Russians may be “hacked back,” disabled, or reported to the Internet service provider (ISP) so it can be patched. Persistent engagement might also involve simply identifying Russian sock-puppet accounts and informing Twitter, Google, and Facebook/Meta of them so they can be closed.

There is much excitement in policy circles surrounding the defend forward/persistent engagement posture, for reasons that will become clear in Chapter 5. As a theory of deterrence, it does more closely fit the contours of cyberspace, where conflict is constant and often no accountability or costs are imposed on attackers. The policy fully departs from the specious nuclear deterrence analogies.³⁶ But, whether the approach is effective is not yet known and there is reason to worry that more conflict, because of the ambiguity of cyberspace, will cause escalation rather than stability.

Furthermore, the doctrine stretches the meaning of “defense” in the sense that defend forward requires US forces to monitor many third-party systems and shut down adversarial activity, even on computers of allies. This means that US hackers will break into computers in our allies’ jurisdiction. The bet is that our allies will find more value in the United States reducing Russian and Chinese cyber capacity than the loss experienced in sovereignty and confidentiality.

4.3.1.5 Cyber Accidents Will Take Place

In a wide-ranging report originally written for the Intelligence Advanced Research Projects Agency (IARPA), former Secretary of Navy Richard Danzig warns the characteristics of the military combined with the development of inscrutably complex technologies would lead to predictable failures.³⁷ These normal accidents Danzig presented as a kind of Russian roulette, but with technologies that could have a global effect. Although Danzig focused on artificial intelligence and genetic engineering, his observations share characteristics with cyber offense: “…military systems have attributes that make them especially prone to human error, emergent effects, misuse, and misunderstanding. These include the secrecy associated with advanced weapons development and use; the unpredictability of operational interactions and environments; the mismatch between experts’ skills and military assignments; the interdependencies and vulnerabilities that exist between military systems, especially on the scale of the US military; the urgent deployment of new technologies to meet battlefield operational needs; and finally, the unconstrained nature of military competition.”

Question 4.3.3 — Cross Domain Deterrence. President Obama declared that sufficiently destructive cyberattacks on the United States could trigger a kinetic response. President Trump in 2018 signaled an intent to authorize nuclear weapons in response to cyberattacks. This suggests that policymakers in the United States now see cyber as a “strategic” threat, on par with nuclear weapons.

Presumably, Presidents Obama and Trump could envision a cyberattack that was so severe that it clearly qualified as an “armed attack,” justifying self-defense. Could you imagine a sufficiently catastrophic cyberattack, one so terrible that it would be proportionate to respond with a tactical or strategic nuclear weapon?

▄

4.3.1.6 Cyber and Space

Over 1,800 satellites orbit Earth, and they are operated by about 50 nations and by private companies.³⁸ Satellites are critical for communication and for positioning, navigation, and timing (PNT). Satellites are strategically important to the defense of many countries.

Space-power nations are developing ASAT weapons. Some ASATs are kinetic (both ground-launched and on-orbit deployed), but others use EW and cyberattacks. In addition to ASATs, some nations, including the United States, developed “space forces.”

Several factors are making outer space a more conflict-ridden domain. The United States enjoys powerful intelligence, surveillance, and reconnaissance capabilities from its satellites, including platforms dedicated to missile-launch detection. The United States and a handful of other nations should be able to spot strategic threats from space, making satellites a likely target in the early stages of invasion.

As much as satellites help us sense the world, we have become dependent on them in complex ways, thus attacking them could cause crippling effects. Timing is critical to computer security, and an unfathomable number of systems rely on the US Global Positioning System (GPS) network. The number is unfathomable because the United States opened its GPS technology for civilian use, and enabled devices “catch” the signal from the satellite. That is, devices receive the signal but do not report back, so no one knows just how many devices depend on PNT from US GPS. PNT is so important that Europe, China, and Russia have created their own systems (Europe’s Galileo; China’s BeiDou-3 now provides PNT globally; Russia’s system is called Global Navigation Satellite System, GLONASS).

In addition to PNT and strategic warning capabilities, some communications are satellite dependent, and this dependency may be growing. With the growth of the commercial market for satellite services, countries without a space program can buy both imagery and communication services. Many nations impose “shutter control” on satellite providers, meaning providers agree to limit the collection and quality of information (e.g., to only sell images at degraded resolution). Nations such as the United States also buy up commercial service capacity to prevent adversaries from using for-profit satellites during conflicts.

The US government also relies on commercial satellites, and thus relies upon the cybersecurity of the private sector. Military leaders were roiled in 2009 when they learned Iraqi militants were using off-the-shelf software to intercept footage from Predator Unmanned Aerial Vehicles (UAVs).³⁹ In December 2011, the Christian Science Monitor reported that the Iranian military had stolen a US RQ-170 Sentinel unmanned aerial vehicle by spoofing the GPS signals the vehicle received.⁴⁰

US company Starlink will deepen ordinary users’ dependence on satellites as it deploys its network to provide global broadband coverage. The company plans to deploy over 10,000 satellites that it will rent to ordinary users and governments. Starlink satellites were a key factor in the defense of Ukraine.

Finally, in a development discussed later in this book, Chinese scientists demonstrated quantum encryption key distribution using the country’s Micius satellite system in 2017. This means the Chinese can reliably achieve the holy grail of communications security with its satellites: the one-time pad. By linking base stations via satellite, China can distribute new one-time pads without the standard transaction costs that have caused other nations to reuse such pads.

For all of these reasons, future conflicts may include—even start with—attacks on satellites, and so, satellites are becoming a key cybersecurity concern. The security outlook for the devices is not good. Many satellites have been in orbit for decades and use industrial-control-system-like proprietary software. Because of their custom software, only certain adversaries are likely to invest the resources to attack them. Yet, some open-source reports reveal troubling attacks.⁴¹

Exercise 4.1 Country Cyber Assessment. Back in Chapter 1, you analyzed how China, Iran, and Russia conceived of cybersecurity. For this exercise, please assess the cybersecurity posture of a country of your choosing.

Be careful in choosing a nation, because the analysis you perform here can form the foundation for future assignments. Choosing a large nation, like China, Iran, Russia, or the United States might be overwhelming, because of the amount of information available. On the other hand, choosing a very small nation may give you little publicly available research and reporting to base your assessment on.

To write this analysis, you will need to locate authoritative, up-to-date literature about the country, and assess the nation’s intentions and capabilities at the highest level (the strategic level).

Suppose that the audience for your assessment is an executive official. This means that the report should be brief—just 2–3 pages. Please do include footnotes to your sources. For a model, you might look at the US DNI’s Threat Assessment that was released in 2021: https://perma.cc/RTD4-4KM5.

There are several methods of risk assessment. The most important topics to consider are the country’s motivations, capabilities, and examples of provocative activities. To motivate your investigation, you could try to answer the following questions. There may be no publicly available information on some of them, so do your best:

What are the highest-level policy issues that shape the country’s use of cyberoffense and defense?

What are the nation’s policy priorities in cybersecurity? Another way to think about this: What are the biggest threats to the nation (i.e., what is their threat model)? Only focus on strategic-level threats, the kind that could destroy a nation.

This is the “why” of the report—what are the motivating reasons why this country acts?

How much offensive cyber does your country use—Are there provocative actions in cyber? The most provocative activities surround attacks on leaders, on sensitive government databases, and those on critical infrastructure. Pay attention only to high vulnerability/high consequence activities: attacks that could threaten a population, the economy, or infrastructure (crime is interesting, but not strategic, unless cybercrime is so out of control that it threatens the nation’s ability to function).

What are the most clever attacks used by your assigned country? What do these tell us about the nation’s capabilities? This is the “what” of your report—what is happening in your nation. You might also discuss “so what?” That is, why does this offensive activity matter?

▄

4.4 Cybersecurity and the Intelligence Community

This chapter combines a discussion of intelligence and military cybersecurity issues, because of the complementarity of the two subjects. Intelligence gathering is often done to support or avoid military action. Conversely, in recent decades, military action has become intelligence driven, with satellite and other information marshaled to identify targets and assess outcomes from use of force.

But that high-level complementarity masks theoretical, structural, cultural, and legal differences between the intelligence and military bodies. Intelligence agencies may have different priorities, leading to different assessments of similar problems in cybersecurity. Structurally, the field is complicated because, in the United States, the National Security Agency (NSA), the nation’s elite cyber force, is a DoD entity rather than a civilian one, like the Central Intelligence Agency (CIA). Further complicating things is that the NSA has a dual mission of computer attack and defense of government systems. The NSA is both the National Security Agency and the Central Security Service!

The law imposes divisions that are consequential. Title 10 of the US Code governs the armed forces when performing military activities, while Title 50 governs intelligence activities (and many other issues related to national defense). The Title 10/50 divide is often invoked in discussions of cyberattacks, imposing awkward limits and formalities in a field where lines blur between military and intelligence activities.

As we will see, the demands placed on militaries to make discriminate attacks require greater dependence on intelligence and surveillance, but for historical reasons, Congress has treated the armed forces differently than intelligence agencies.

The intelligence community’s goal is to provide objective analyses to decision-makers and, in particular, to prevent surprises. This requires analysis of foreign states and non-state actors’ capabilities, intentions, and activities, and even the predilections and misconceptions of leaders.⁴² Historically, capabilities were scoped by geopolitical realities, the number of fighting-aged people a country has, and a nation’s natural resources. The advent of cyber power has changed the fundamental elements of conflict in some ways because cyberattacks do not require masses of fighting-aged men people nor rich natural resources (Tables 4.5 and 4.6).

Table 4.5 Significant “wake up” moments in the intelligence field.

Incident
What happened
Why it matters

Cuckoo’s Egg (1986)
Clifford Stoll, an intellectual, curious, and resourceful computer manager at Lawrence Berkeley National Laboratory, noticed a small accounting error and went to extraordinary efforts to determine its cause, leading to the exposure of a German computer hacker who was stealing information from US military bases and selling it to the KGB
Stoll briefed the NSA and others, and wrote a book about the incident, opening the world’s eyes to the future of cyber espionage

Stuxnet AKA Olympic Games (2010)
Believed to be a collaboration between the NSA and Israel’s 8200 force, Stuxnet was a sophisticated, multi-domain attack on Iran’s nuclear enrichment program. Stuxnet infected centrifuge control systems unconnected to the Internet and then caused the centrifuges to become unstable and fail, befuddling the Iranian government
The NSA can infect even air-gapped systems. Information integrity attacks may be a key strategy of US cyber warriors. Stuxnet gave the US options to address a strategic political issue without committing battlefield troops

Anwar al-Awlaki (2011)
The extremist terrorist planner Anwar al-Awlaki used Google YouTube and Facebook extensively to promote recruitment for al-Qaeda. He also helped plan specific attacks, such as the “underwear bomber” who failed to detonate a bomb in his pants (incurring severe burns) while flying on Christmas Day to Detroit. The US killed Awlaki, an American citizen, with a UAV strike
Awlaki’s YouTube videos, for reasons lost on the authors of this book, were profoundly compelling to both foreign and domestic terrorists. Awlaki thus fomented a turn in terrorism: instead of radicalizing people through in-person meetings, many were convinced to travel to fight for al-Qaeda, and later Islamic State of Iraq and Syria (ISIS), or make attacks domestically, based entirely on online recruitment

OPM Breach (2015)
Chinese hackers exfiltrated millions of records from the US agency that acts as a human resources center—The Office of Personnel Management. Background check data for security clearances, fingerprints, and other personal data of tens of millions of people linked to the US government were stolen
There are so many security breaches that we only discuss ones of strategic importance. The Office of Personnel Management (OPM) breach means China knows the identities of all members of the US military and most of the intelligence community. Thankfully, CIA did not use OPM

Table 4.6 Significant “wake up” moments in the intelligence field—continued.

Incident
What happened
Why it matters

Shadow Brokers (2016)
This hacker group leaked NSA-developed malware that was repurposed by criminals and other governments
As if to taunt the United States and spread the idea that the country is out of control, nation-state hackers used an NSA tool, known as EternalBlue, to stage many significant attacks, including the Petya and NotPetya events. The incident raises a fundamental question of whether capacious American cyber powers are uncontrollable and will inevitably used against the United States

Equifax Breach (2017)
The credit records of almost all American households were stolen from consumer reporting agency Equifax
This breach is significant because of its relationship to the OPM breach. Presumably, with these financial records, China can identify Americans who are in financial trouble and might be open to bribery. This is particularly powerful information when cross-referenced with the OPM data on security clearance holders

Vault7 Leak (2017)
Wikileaks released a cache of documents describing attack tools used by the CIA
The CIA had tools to translate software code into Russian, Arabic, and Farsi to frustrate attribution. Another tool enabled the CIA to eavesdrop on “SmartTVs.” You might think about that when you buy your next television for your home or your corporate boardroom

Like law enforcement, IC has tradecraft, techniques learned in the course of solving investigative problems that are shared in person among social networks. Risking over-generalization, the IC has a complicated set of incentives surrounding surveillance: it might have to overlook preventable wrongdoing in order to preserve secrecy of its collection activities. Protecting “sources and methods” means the IC may forbear from revealing important information from others. There are many historical examples of this incentive conflict and it can be particularly difficult when the secret information places soldiers at risk.

4.4.1 The Intelligence Community

The “intelligence community” is a group of 17 organizations⁴³ charged with delivering “products” elucidating developments to the executive branch and Congress focusing on cyber intelligence, counter-terrorism, counter-proliferation, and counterintelligence.⁴⁴ The IC is a “community” because many different agencies have responsibilities. The diffusion of intelligence responsibilities is a result of several factors. For one, different actors need different intelligence products. Although the Navy and Army are both military branches, they need different information to operate. There are also path dependencies driven by historical technology developments. And frankly, some of these agencies do not trust each other.

It is important to know that different IC agencies have different constituencies, and thus different incentives and priorities. The CIA is an independent executive agency with “all-source” intelligence (meaning it integrates all kinds of collection and analysis) to support the President. Other IC entities are under the DoD (NSA, Defense Intelligence Agency, National Reconnaissance Office, the intelligence arms of the military branches). Still others have primarily a domestic, law enforcement role (FBI) or general security role (DHS). And others have diplomatic (Department of State) or financial specialization (US Treasury, Department of Commerce).

The purpose of intelligence gathering, at the highest level, is to help states avoid “surprise.” From a strategic standpoint, surprise is not astonishment. Instead, the purpose is to anticipate transformative developments or capabilities that render existing strategy less effective, futile, or that imposes tremendous costs on it. Military historians recount many examples of strategic developments, such as the invention of the chariot and the crossbow.

Consulting for the CIA

Robert Jervis earned his PhD at Berkeley, was part of the campus free speech movement and went on to become one of the most prominent political scientists in America. He consulted extensively for the CIA and wrote about academics’ hesitation to do so:

…I have some sympathy for these positions but believe that over the long run it is better for the country and the world that the American government be as competent and well informed as it can be.

The obvious reply is that improvement will just enable the United States to do greater harm to others (and, as in Iraq, to itself). Better guidance toward a bad or even evil goal is not good. This view has some logic but has to rest on a root-and-branch rejection of American foreign policy. A Marxist would argue that American policy is driven by the exploitative needs of the capitalist class and will inevitably bring misery to the world. Others with a more realist bent could argue that exploiting the rest of the world serves the interests of the entire American population, not just a class, but the result would be the same infliction of harm.

A narrower argument against consulting with CIA is that the Agency tortures prisoners, engages in covert action, immorally meddles in others’ affairs, and overthrows governments. But this position makes little sense. Not only is analysis separate from interrogation and covert action, but these are matters of national policy, established by the president (and perhaps Congress). CIA carries out the policy but does not make it, and I find it surprising that people refer to CIA’s undermining or overthrowing other governments, which is like calling the wars in Vietnam and Iraq actions of the army. It is particularly odd that radicals attack CIA in this way, since doing so implies that policy would be better if it were under national direction and obscures the fact that credit or blame should go to the elected leaders, if not to the broader American political system and the American people…a

a Jervis R. Why Intelligence Fails: Lessons from the Iranian Revolution and the Iraq War. Cornell University Press, 2010.

Strategically important news could also find sources in political realignments or economic developments. Thus, much of intelligence simply involves understanding the worldview of other nations and their leaders. What is happening in the world and why? What are others’ motivations, and what actions do they consider acceptable or unacceptable? What is likely to happen in the future? And how might the world change in fundamental ways?

America has been skeptical toward intelligence agencies throughout its history, spinning up institutions for spycraft during war and then dismantling them. The notion that “Gentlemen do not read each other’s mail,” the famous 1929 saying of President Hoover’s Secretary of State Henry Stimson, reflected a genuine discomfort Americans have had toward intelligence services. Unlike continental nations, the United States did not have a permanently established, general intelligence body—the CIA—until the mid-twentieth century.

As ambivalent as Americans have been about spying, generally, political leaders accept intelligence gathering as a part of statecraft.⁴⁵ The reason is pragmatic and reveals that much of intelligence is less exciting than portrayed in the movies: it helps to know how and what others think.⁴⁶ Without that knowledge, we will see in Chapter 5, innocent behavior or accidents can contribute to a security dilemma where ambiguity or ignorance causes actors to interpret others’ actions as hostile.⁴⁷ Thus, for all the costs that espionage imposes on civil liberties, leaders tend to think espionage makes us safer in the aggregate. Theoreticians in cybersecurity explore whether digital espionage changes this dynamic—that is, whether hacking reduces strategic stability.⁴⁸

US political leaders characterize many security breaches as espionage activities rather than as cyber “attacks,” even under extreme scenarios. For instance, after hackers penetrated the US Office of Personnel Management, obtaining dossiers on over 20 million people, including sensitive background check information, Director of National Intelligence James Clapper observed that the event was not a cyberattack but rather “a form of theft or espionage.”⁴⁹ Clapper was speaking descriptively, not normatively, but the description Clapper made illustrates the underlying acceptance of espionage. That is, the US government sees it as advantageous to characterize even dramatic security breaches as espionage activities rather than as military ones.

Question 4.4.1 — Clapper’s Tempered Response to Office of Management and Budget (OMB). Why would Clapper and other US officials interpret such a consequential compromise of US systems as espionage rather than as an attack?

▄

As much as leaders accept intelligence gathering, ordinary citizens have been mostly in the dark about it. As a spotlight shines on intelligence efforts, the methods and capabilities used by intelligence agencies create a surprise of their own. For decades now, leakers and journalists have lifted the covers on espionage activities that are so dramatic they appear to be just conspiracy talk. Take for instance the 1972 interview of “Winslow Peck” in Ramparts magazine, where a former NSA employee using a pseudonym claimed, “As far as the Soviet Union is concerned, we know the whereabouts at any given time of all its aircraft…its naval forces, including its missile-firing submarines. The fact is that we’re able to break every code they’ve got, understand every type of communications equipment and enciphering device they’ve got. We know where their submarines are, what every one of their VIPs is doing, and generally their capabilities and the dispositions of all their forces.”⁵⁰

Such transparency of the intelligence community has been on a low simmer since the 1970s, with periodic flashes, but concerns never reached the mainstream because the capabilities seemed like science fiction. This changed with an indiscriminate document dump in 2013 by Edward Snowden, a low-level IT contractor who had access to volumes of NSA documents, for several reasons. The material was released long after the Soviet threat dissipated and in a context where Americans were angry about reliance on weak intelligence evidence that led to the second war in Iraq.

The dump landed on fertile ground. With skepticism of the US government so high, newspapers published stories surrounding the documents, often making the NSA’s capabilities appear magical and omniscient. Tactical and operational realities, along with strategic concerns that temper the use of spy tools, were omitted from this reporting. Furthermore, this kind of reporting was once limited only to left-wing newspapers and generally ignored by the public. But, something had changed causing mainstream newspapers to embrace leaks and leakers and frame these actors as heroic. Leaking, an activity that used to be seen as deeply problematic, had been reconceived as one of the only tools of justice against powerful institutions.

Snowden’s release gravely harmed US and allied foreign policy and intelligence capabilities. Unlike a “leaker” who points the public to a specific wrong that begs for reform, Snowden was not a “whistle-blower.” Snowden made a general release of capabilities, without any attempt to use the political system to investigate the NSA. The documents were an unfathomably huge giveaway to adversaries and are studied carefully by foreign adversaries. The documents have helped them develop countermeasures to allied efforts and given them ideas for capabilities adversaries might develop.

Months after Russia’s invasion of Ukraine, the Russian Federation granted Snowden citizenship, and he resides in Moscow.

“Intelligence Failures” and Intelligence Failures

A prime reason we have true intelligence failures—the legitimate type where we misapprehend a strategic world event—is often attributable to not understanding others. There are several notable examples of this: we failed to spot Saddam Hussein’s invasion of Kuwait in part because Hussein’s decision to invade was motivated by his inability to pay back a huge debt to the nation, which seemed an implausible option to western eyes. America left such “gunboat diplomacy” behind in the early twentieth century. Similarly, US analysts tended to see all communists alike, resulting in us not understanding the roots of the Sino-Soviet split.

Richards J. Heuer, Jr., a longtime CIA officer who was influential in professionalizing intelligence analysis, notes:

…it is so difficult to understand the mental and bureaucratic processes of foreign leaders and governments. To see the options faced by foreign leaders as these leaders see them, one must understand their values and assumptions and even their misconceptions and misunderstandings. Without such insight, interpreting foreign leaders’ decisions or forecasting future decisions is often little more than partially informed speculation. Too frequently, foreign behavior appears “irrational” or “not in their own best interest.” Such conclusions often indicate analysts have projected American values and conceptual frameworks onto the foreign leaders and societies, rather than understanding the logic of the situation as it appears to them.a

As you consider the new opportunities made possible by CNE, are we likely to have less true intelligence failures? Or will the information glut cloud our perceptions, causing us to project our own rationality on others?

a Heuer RJ. Psychology of Intelligence Analysis. Center for the Study of Intelligence, 1999. Available from: https://perma.cc/N534-CYVP.

The acceptance of espionage, and the distinction between cyber exploitation and attack, creates dynamics that might seem dangerous: because intelligence-related malicious computer activity is indistinguishable from attack-related activity, leaders must always ponder whether discovery of their espionage activities will be interpreted as a form of unacceptable attack or “preparation of the battlespace” instead of routine listening. The adversary must furthermore contemplate the problem that if the NSA can find cyber exploitations, what is stopping them from converting that access into preparation for attack? After all, if the adversary can listen to a network, can they not repurpose the vulnerability so it harms systems?

Definition 4.4.1 — CNE and Computer Network Attack. There is a tendentious distinction in cybersecurity between computer network exploitation (CNE) and computer network attack (CNA). CNEs are intelligence uses of a computer or network vulnerability, that is, they are intelligence gathering in intent. CNAs use a vulnerability for some D5 purpose, that is, they are destructive in intent. Here’s the problem: often, CNEs and CNAs use the same underlying vulnerabilities and methods. A CNA will presumably be preceded by a CNE. Thus, whether a victim is suffering espionage or attack may not be clear.

The exploitation–attack uncertainty may be changing norms surrounding espionage. Traditionally, espionage required skin in the game. Agents often had to be physically detailed to target countries and while they caused risk to target nations, the agents themselves faced arrest and harm. Nations knew of each other’s spies and signaled line-crossing by sometimes expelling them. But, turning to cyber espionage, a great deal of spying can be done without leaving the country or otherwise putting human assets at risk. CNE could be seen as equivalent to aggressive forms of collection, similar to burglary or sabotage. Signaling the problem of line-crossing might come in the form of “hack back” scenarios, perhaps escalating the conflict.

1920s SIGINT

Herbert O. Yardley headed the US decryption efforts during World War I and recounts the contours of secrecy surrounding interceptions of diplomatic cables:

We were of course well aware that if our activities were discovered there would be no protest from foreign governments, for we knew that all the Great Powers maintained Cipher Bureaus for the solution of diplomatic telegrams. This was a sort of gentlemen’s agreement. Just as in warfare armies do not attempt to bomb each other’s headquarters, so also in diplomacy statesmen do not protest against the solution of each other’s messages. However, if foreign governments learned that we were successful they would immediately change their codes, and we would be obliged after years of struggle to begin all over again.a

a Yardley HO. The American Black Chamber. Bobbs-Merrill, 1931.

In other contexts, at-a-distance collection activities are considered less threatening. For instance, satellite reconnaissance is considered less hostile than recruiting insiders with bribes or flying spy planes over a target nation (the Soviet Union doesn’t try to shoot down US satellites, but it did shoot at the U-2 and SR-71 overflights). Of course, the comparison is inapt—whether monitoring by satellite or plane, aerial photography does not influence its target, while cyber exploitation deeply does. Norms are continually developing that separate tolerated versus unacceptable cyber intelligence gathering.

In fact, while international law has developed an intricate ruleset to address armed conflict, international law is silent on intelligence gathering.

Chancellor Merkel’s Mobile

With a dour look, German Chancellor Angela Merkel held her specially prepared Blackberry mobile phone for news media cameras. What led to this display of the device? It was not iPhone envy. Instead, an article in Der Spiegel reported Merkel’s phone had been the target of American spying for a decade. Merkel reportedly confronted President Obama about it, who denied the allegation. But, other factors caused Obama’s denials to lack credibility.

Thomas Rid suggests the allegation may have been a Russian active measure intended to sew divisions between America and one of its closest allies. Rid points out that the Snowden documents did not contain evidence of the alleged spying, and the atmosphere created by the Snowden documents created a perfect opportunity for adversaries to introduce new disinformation to damage America. A top German law enforcement official even declared the allegation was not sourced in the Snowden archive.

Why didn’t Merkel react more severely, by taking official action over the allegation? One hypothesis comes not from outrage, but jealousy surrounding collection methods. Germany is not part of the “Five Eyes” arrangement among Australia, Canada, New Zealand, the United Kingdom, and the United States to share intelligence information. The Five Eyes have their historical roots in the allied powers in World War II, which explains Germany’s exclusion. Membership in the Five Eyes confers fantastic intelligence advantages. Merkel’s tempered response is part of a larger game to be the sixth eye.

The purposes of intelligence differ among nations. The United States engages in economic espionage and business intelligence, but the avowed purpose of this is to supplement military and national strength assessments of other countries. That is, the economic espionage performed by the United States is not performed for the commercial gain of private companies. What this means is that US intelligence agencies will spy on private businesses and use that information for strategic posture in trade agreements and negotiations, but they will not pass on the details to domestic companies (Figures 4.4 and 4.5).

Question 4.4.2 — Spying for Domestic Advantage? How do we know that intelligence isn’t a stalking horse for domestic competitors—that is, why wouldn’t the US government steal secrets from foreign companies and leak the secrets to domestic companies? For one, there is no basis for declassification for the purpose of advancing a company’s interests. It is in fact a crime in the United States to do so and CIA officers have long been trained not to leak classified information this way. But, there are practical reasons, too. Consider this: If you were tasked to reveal a tip to a domestic company, how would you do it? Which company would you inform? What if the nation’s best competitor is a multinational or has leadership with only weak or instrumental ties to the United States?

▄

The IC can be confusing because its use of language has been undisciplined (e.g., “When Intelligence Community analysts use words such as ‘we assess’ or ‘we judge,’ they are conveying an analytic assessment or judgment.”⁵¹) with nested elements (“judgments” in common parlance are typically the conclusions of an investigation, but the following statement suggests judgments form assessments: “An assessment of attribution usually is not a simple statement of who conducted an operation, but rather a series of judgments…”).⁵²

Figure 4.4 The designs for Lockheed Martin’s F–35, the most expensive weapons program ever, were allegedly stolen by Chinese hackers.

Source: Department of Defense/Wikimedia Commons/Public domain.

Figure 4.5 The suspiciously similar Shenyang J-31 is thought to be based on the Lockheed Martin design.

Source: Danny Yu/Wikimedia Commons/CC BY SA 4.0.

Why is this language so stilted? There has been a decades-long attempt to homogenize reports so leaders do not think minor changes in language represent some significant political change. Thus, reports have become formulaic. But, the formulaic approach has a downside, famously highlighted by President Trump, who told Fox News that he did not always read intelligence reports because “…you know, I’m, like, a smart person…I don’t have to be told the same thing and the same words every single day for the next eight years. It could be eight years — but eight years. I don’t need that.” Those same words are an attempt at uniformity.

The IC also uses estimates of likelihood of events paired with statements of confidence about the underlying evidence. This, of course, not only reflects the world’s contingent complexity but also creates confusion amongst consumers of intelligence products. And because there is a constellation of intelligence agencies, they may disagree or agree at a different level of confidence. Consider this statement:

We also assess Putin and the Russian Government aspired to help President-elect Trump’s election chances when possible by discrediting Secretary Clinton and publicly contrasting her unfavorably to him. All three agencies agree with this judgment. CIA and FBI have high confidence in this judgment; NSA has moderate confidence.⁵³

It is easy to conclude that for some reason, CIA and FBI have high-quality information consonant with this statement, while the NSA is less sure. The source of the NSA’s qualification is unclear; it could go to the identification of Putin or the Russian government, the subjective intent of the actors, or the facts underlying their actions. And what does it mean that the agencies have confidence in the “judgement”? Why didn’t they say they have confidence in the assessment? Does that mean the agencies trust the judgments but not the overall assessment? (Table 4.7).

4.4.2 The Power of the Platform

Recall from Chapter 2 that the physical reality of the Internet has political consequences. One involves intelligence: The presence of so much fiber optic Internet infrastructure in the United States gives the nation an enormous data collection advantage, see Figure 2.3. The advantage comes from the routing of purely foreign communications through US infrastructure. That is, a communication from Brazil is likely to route through Miami on its way down the West coast of South America to Chile. Similarly, traffic from China and Europe and Russia finds its way through American infrastructure because of the number of routes available through the United States. Furthermore, American dominance in technology firms makes it likely that two foreigners with no connection to the United States at all may be communicating with each other through Apple, Facebook, Microsoft, or Google. These communications often flow through the United States as well.

Table 4.7 The intelligence community uses “estimative language” and signals of confidence to convey its certainty in an uncertain world. This language can be confusing because it sometimes mixes probability that an event will occur with confidence signals in the underlying information surrounding the event. The IC may make claims based on inferences. This table is assembled from multiple sources, including Intelligence Community Directive 203 (2015).

Language | What this (may) mean
Almost certain | “nearly certain,” a 95–99% chance
Very likely | “highly probable,” a 80–95% chance
Probably, likely | Better than 50% chance
Roughly even chance | “even odds,” a 45–55% chance
Unlikely | “improbable,” 20–45% chance
Very unlikely | “highly improbable,” 5–20% chance
Almost no chance | “remote,” 1–5% chance
High confidence | A judgement is based on high-quality information
Moderate confidence | Credibly sourced and plausible evidence that nonetheless may be interpreted differently, or its interpretation is in dispute internally
Low confidence | Information that provides some signal but is not sufficient for solid conclusions, or there are concerns with the underlying information sources or plausibility
Maybe, suggest | Impartial assessment evidence available
We cannot dismiss, we cannot rule out | An unlikely, yet high-consequence event

Data of foreign persons flowing through the United States are irresistible to intelligence agencies. Instead of having to use covert action, bribes, or hacking to get into foreign networks, the data come to the United States for the taking. A federal law, the Foreign Intelligence Surveillance Act (FISA), gives the US government the authority to collect and use this information when it pertains to non-US persons outside the United States, and where data are relevant for foreign intelligence.⁵⁴ Agencies provide “selectors,” such as an email address or even a password that an investigatory target uses, and federal agencies can then access other Internet information about the target.

Known as the Section 702 authority, cabining or ending the program is a major priority of civil liberties organizations, while law enforcement and intelligence agencies sing its praises forcefully. Although one might imagine that the program primarily concerns terrorism and espionage, a significant amount of 702 activity helps the government spot and investigate cyberattacks.

4.4.3 The Vulnerabilities Equities Process

As part of its mission, the NSA amasses computer vulnerabilities, which are problems in software and devices that might be exploited. NSA must make a decision about what to do with these vulnerabilities: keep them secret so they can be used for CNE or CNA, or disclose them to software and device vendors for remediation.

This is a modern version of the age-old intelligence problem: your nation has cracked another nation’s codes and can anticipate adversary activity. Do you save the convoy carrying 1,000 civilians and risk tipping off the adversary to your intelligence capabilities, leading the adversary to change their codes and blind your systems? Or do you keep the knowledge secret to get even more secret information? Throughout the twentieth century, changing codes was a laborious process, and so, a cracked code might pay off for a long time. Nowadays, code-changing is automatic, and some systems even rotate encryption codes during a single conversation. But, what doesn’t change much now is software—software is the modern version of the difficult-to-change encryption code. Upgrading is time-consuming and risky in itself. So vulnerabilities in software can be quite valuable in a conflict.

Built It and They Might Get It …

This chapter has several examples where computer attack capabilities developed by the United States have been stolen and later used against the US government and private sector. These anecdotes raise a difficult conundrum: if the United States uses its significant resources and technical might to build a new, special weapon, how long will it take for adversaries to steal or copy it? Are there capabilities too dangerous to develop because of this dynamic?

Former IARPA Director Jason Gaverick Matheny set forth a method to think about this conundrum. It asks analysts to consider:

What is your estimate about how long it would take a major nation competitor to weaponize this technology after they learn about it? What is your estimate for a non-state terrorist group with resources like those of al Qaeda in the first decade of this century?

If the technology is leaked, stolen, or copied, would we regret having developed it? What if any first-mover advantage is likely to endure after a competitor follows?

How could the program be misinterpreted by foreign intelligence? Do you have any suggestions for reducing that risk?

Can we develop defensive capabilities before/alongside offensive ones?

Can the technology be made less prone to theft, replication, and mass production? What design features could create barriers to entry?

What red-team activities could help answer these questions? Whose red-team opinion would you particularly respect?

This method appears in a seminal report written by former Secretary of the Navy Richard Danzig that explores the aggregate dangers coming from different technological research streams.a

a Danzig, Technology Roulette: Managing Loss of Control as Many Militaries Pursue Technological Superiority.

The Vulnerabilities Equities Process (VEP) is a key cybersecurity issue that shapes our collective security. It can stand in for scores of other intelligence community issues because VEP illustrates the basic security-versus-security dynamic so endemic to this field: a security decision-maker controls the ability to allocate security. Should it allocate it to provide more intelligence, and thereby more national security and decision-making power for the executive branch? Or should it release the vulnerability to industry, where it will be quickly patched for the benefit of collective technical computer security?

The VEP decision is made in an interagency process that includes all the important government stakeholders, but no company or citizen representation.⁵⁵

The NSA has claimed that it released “more than 91 percent of vulnerabilities discovered in products that have gone through our internal review process and that are made or used in the US.” It’s reasonable to believe the NSA is likely to remediate vulnerabilities that are less valuable to the agency (for instance, old vulnerabilities, vulnerabilities already known by adversaries, and vulnerabilities of systems used only in the United States) while keeping high-value assets, such as hooks into operating systems. For instance, EternalBlue, the NSA malware stolen by the Shadow Brokers and later used in the WannaCry and NotPetya attacks, took advantage of a vulnerability in Microsoft Windows Server. The NSA knew about this vulnerability for at least five years.⁵⁶

Exercise 4.2 — Implementing the VEP. A 2017 policy document explains with Vulnerabilities Equities Process.a Annex B, quoted below, enumerates the possible equity factors. Imagine that you are a NSA employee who has discovered a vulnerability in how web encryption is implemented, meaning that with it one could spy on or alter secure browsing sessions. Be sure to consider how the different agencies that make up the VEP body might agree or disagree. What considerations does the VEP overlook?

Part 1—Defensive Equity Considerations

1.A. Threat Considerations

Where is the product used? How widely is it used?

How broad is the range of products or versions affected?

Are threat actors likely to exploit this vulnerability, if it were known to them?

1.B. Vulnerability Considerations

What access must a threat actor possess to exploit this vulnerability?

Is exploitation of this vulnerability alone sufficient to cause harm?

How likely is it that threat actors will discover or acquire knowledge of this vulnerability?

1.C. Impact Considerations

How much do users rely on the security of the product?

How severe is the vulnerability? What are the potential consequences of exploitation of this vulnerability?

What access or benefit does a threat actor gain by exploiting this vulnerability?

What is the likelihood that adversaries will reverse engineer a patch, discover the vulnerability, and use it against unpatched systems?

Will enough United States Government (USG) information systems, US businesses and/or consumers actually install the patch to offset the harm to security caused by educating attackers about the vulnerability?

1.D. Mitigation Considerations

Can the product be configured to mitigate this vulnerability? Do other mechanisms exist to mitigate the risks from this vulnerability?

Are impacts of this vulnerability mitigated by existing best-practice guidance, standard configurations, or security practices?

If the vulnerability is disclosed, how likely is it that the vendor or another entity will develop and release a patch or update that effectively mitigates it?

If a patch or update is released, how likely is it to be applied to vulnerable systems? How soon? What percentage of vulnerable systems will remain forever unpatched or unpatched for more than a year after the patch is released?

Can exploitation of this vulnerability by threat actors be detected by USG or other members of the defensive community?

Part 2—Intelligence, Law Enforcement, and Operational Equity Considerations

2.A. Operational Value Considerations

Can this vulnerability be exploited to support intelligence collection, cyber operations, or law enforcement evidence collection?

What is the demonstrated value of this vulnerability for intelligence collection, cyber operations, and/or law enforcement evidence collection?

What is its potential (future) value?

What is the operational effectiveness of this vulnerability?

2.B. Operational Impact Considerations

Does exploitation of this vulnerability provide specialized operational value against cyber threat actors or their operations? Against high-priority National Intelligence Priorities Framework (NIPF) or military targets? For protection of warfighters or civilians?

Do alternative means exist to realize the operational benefits of exploiting this vulnerability?

Would disclosing this vulnerability reveal any intelligence sources or methods?

Part 3—Commercial Equity Considerations

If USG knowledge of this vulnerability were to be revealed, what risks could that pose for USG relationships with industry?

Part 4—International Partnership Equity Considerations

If USG knowledge of this vulnerability were to be revealed, what risks could that pose for USG international relations?

a White House. Vulnerabilities equities policy and process for the United States government. White House Report, 2017.

▄

4.4.4 Cyber Soldiers and/or Cyber Spies?

Should CNE and CNA be performed by the military or by intelligence agencies? You might think: both! And both are indeed involved today. But, tensions between these two stakeholders are real and the decision to lead with the military or spy agencies has consequences.

One of the principal implications is legal. If we seat cyber conflict with the military, presumably its activities would fall under Title 10 of the US Code, which sets forth the organization of our armed forces. Title 10 entities must answer to Congress and are subject to international laws.

But, if cyber conflict is nested in intelligence, it is regulated under Title 50. Title 50 entities, vested with protecting national security and a mandate for covert action, are less supervised by Congress and less impeded by international law concerns.⁵⁷ In essence, espionage is not regulated internationally. But spies can be tried for their activities as criminals in other nations. Thus, a hacker in Northern Virginia who causes damage in Russia, could in theory be charged criminally and jailed, if that hacker made the mistake of traveling to that country.

Militaries are regulated. Recall that if the military takes action properly under IHL, even the killing of others is not murder. And so, military actors fear taking illegal, shadowy actions crafted by intelligence agencies that jeopardize their status as combatants, shielded from other nation’s criminal law. The military cares a great deal about its independence and integrity and has to answer for its activities in ways spies won’t.

Suffice it to say that the military and intelligence communities disagree about who “owns” cyber. And practically speaking, it is unclear who should. Many traditional military activities, such as destroying enemy communications, might be useful as part of an intelligence operation that does not involve the military at all. Conversely, espionage-like hacking is useful in advance of a traditional military attack.

Adding to the complexity is the LOAC itself. As explained above, the interests in distinction, proportionality, and necessity tie intelligence gathering to war making. And this tie becomes tighter as technology enables faster conflict at greater distances. This means intelligence systems will be necessary for taking precautionary steps, such as vetting a target for civilian harm. Intelligence agencies will also be key to identifying opportunities to disrupt adversaries’ command and control, erode the will of their populations by circulating unfavorable news, and engage in forms of economic conflict.

The American Black Chamber

Herbert O. Yardley’s Black Chamber cracked the codes of over a dozen nations and decoded tens of thousands of communications during World War I. Throughout the 1920s, his “Black Chamber” decoded diplomatic communications. But, in 1929, when the new Secretary of State Henry L. Stimson received Yardley’s reports, Stimson was horrified by their source and declared “Gentlemen do not read each other’s mail.” Because the Black Chamber was heavily dependent on State Department funding and the ethics of the time precluded simply moving the Chamber to the “black budget” under the Department of War, Yardley had to fire his whole staff and roll up the operation.

Having little else to do, Yardley published a book that would have caused him to be jailed if published today. In it, in a conversational tone, he reveals many of the cryptanalytic secrets of the Chamber, along with many decrypted diplomatic cables.a He relates a dozen hilarious anecdotes, including this one:

The new Director, his executive officer and I were lunching at the Army and Navy Club, when the Director asked: “Yardley, what code do you plan to solve next?’

“I don’t know, but the Vatican code telegrams rather intrigue me…”

I noticed with amazement that the Director’s face went very white. At the same moment the executive officer gave me a vicious kick under the table. It scarcely needed the injury to my shins to make me realize that the Director was a Catholic…

My voice was a bit tremulous, but I began again: “Our preliminary analysis shows that they can be read, but I personally feel that it is unethical for us to inquire into the Vatican secrets. I hope you concur with my view.”

The word unethical sounded a bit strange in its association with the activities of the Black Chamber, but in this case it was effective, for the blood slowly returned to the Director’s face.

“You are quite right, Yardley,”

Yardley was awarded the Distinguished Service Medal and rests in Arlington Cemetery.

a Yardley HO. The American Black Chamber.

Another problem is resources. The government attracts great talent but is in a constant competition with much more lucrative jobs in the private sector that do not impose noisome government requirements like flying coach. To fully staff top-tier experts in both the military and the intelligence agencies would be expensive.

Cultural norms also matter. As discussed above, intelligence agencies might be willing to impose risks on soldiers to gain information that the military might reject or even resent. Recall from Chapter 1 the anecdote about the CIA hosting an extremist recruiting site that the NSA hacked because of concerns the site was producing battlefield violence.⁵⁸ Conversely, intelligence agencies fear that military focus on the short term will burn their collection capabilities.

4.5 Conclusion

This chapter gives a high-level overview of the military and intelligence community roles in cybersecurity. It argues that the military was the first cyber actor. In fact, the military developed concepts and procedures that were not recognized in the private sector until decades later.

The military and intelligence community have different norms, laws, and cultures. But, as military action becomes more intelligence dependent, the lines between the institutions blur. The norms that bind the military and intelligence community, we will see, diverge from other government cybersecurity actors.

Notes

1 Schell RR. Computer Security: the Achilles’ heel of the electronic Air Force? Air University Review 1979; 30:16–33.

2 Schell’s work is thoroughly modern and his team was taking steps considered cutting edge in the corporate world in the 2010s. Schell explains how offensive “tiger teams” (we would call these “red teams” today) were able to use unclassified-level access on multi-tenant systems to extract classified information, while also altering audit logs to make the exfiltration impossible to detect. The teams were able to trick systems assumed to be secure into revealing plain-text passwords (this was before passwords were routinely hashed, but even today, many businesses store passwords in plain text—if you request a password reset and the system responds with your password instead of a chance to reset the password, then the system is storing passwords insecurely). The teams even introduced vulnerabilities into the source code of operating systems that vendors then copied and propagated over different systems. When the vendor was told of the vulnerability and how it worked, it could not locate the malicious addition.

3 Hoffman D. The Dead Hand: The Untold Story of the Cold War Arms Race and Its Dangerous Legacy. Anchor, 2009.

4 Defense Science Board Task Force on Computer Security. Security Controls for Computer Systems. Government Document, 1970.

5 Director of National Intelligence. Worldwide Threat Assessment of the US Intelligence Community. Government Document, 2019.

6 Imagery from the Vietnam War represented a turning point in how media could change a democracy’s commitment to waging war. Consider the evocative photograph known as “napalm girl,” the nine-year-old child running naked from a recent incendiary attack, or the photograph of a South Vietnamese officer summarily executing a Viet Cong agent in the street during the Tet Offensive. These photographs eroded the will of the American people to continue the Vietnam War. Contemporary examples come from Laurie Blank, who documents examples of adversaries “faking” media to sway public opinion. Blank LR. Media warfare, propaganda, and the law of war. Soft War: The Ethics of Unarmed Conflict. Cambridge University Press, 2017:88–103.

7 Libicki MC. What Is Information Warfare? National Defense University, 1995.

8 Kaplan F. Dark Territory: The Secret History of Cyber War. Simon and Schuster, 2016.

9 Farrell H and Glaser CL. How effects, saliencies, and norms should influence U.S. Cyberwar doctrine. Bytes, Bombs, and Spies: The Strategic Dimensions of Offensive Cyber Operations. Edited by Zegart HL and Amy. Brookings Institution Press, 2018.

10 “Analysis of the Vietnam War suggests leaders fear the loss of control more than they fear the loss of war.” Libicki MC. Cyberdeterrence and Cyberwar. RAND, 2009.

11 Minuteman Launch officer Bruce Blair revealed in a 2004 report that Strategic Air Command (SAC) had programmed the “Permissive Action Links” on the nuclear arsenal to 00000000. Why? SAC was concerned that the security feature might prevent a needed launch! The DoD later contested Blair’s claim. What is uncontested is that the Minuteman III ICBM carried three nuclear warheads and could travel 8,000 miles.

12 Rid T. Cyber war will not take place. Journal of Strategic Studies 2012; 35:5–32.

13 Von Clausewitz C. On war. Princeton University Press, 2008.

14 Kaplan F. Dark Territory: The Secret History of Cyber War.

15 Rabkin J and Yoo J. Striking Power: How Cyber, Robots, and Space Weapons Change the Rules for War. Encounter Books, 2017.

16 Valeriano B and Maness RC. Cyber War Versus Cyber Realities: Cyber Conflict in the International System. Oxford University Press, USA, 2015.

17 Chesney R and Smeets M, editors. Deter, Disrupt, or Deceive: Assessing Cyber Conflict as an Intelligence Contest. Georgetown University Press, 2023.

18 Clarke may have been the only official who directly apologized for 9/11: “…your government failed you. Those entrusted with protecting you failed you. And I failed you. We tried hard, but that doesn’t matter because we failed. And for that failure, I would ask, once all the facts are out, for your understanding and for your forgiveness.”

20 Healey J. A Fierce Domain; Conflict in Cyberspace 1986 to 2012. Cyber Conflict Studies Association, 2013.

21 Blank S. Cyber war and information war a la russe. Understanding Cyber Conflict: Fourteen Analogies. Washington, DC: Georgetown University Press, 2017:1–18.

22 Rabkin J and Yoo J. Striking Power: How Cyber, Robots, and Space Weapons Change the Rules for War. Encounter Books, 2017.

19 Arquilla J and Ronfeldt D. Cyberwar is coming! Comparative Strategy 1993; 12:141–65. Arquilla and Ronfeldt also defined netwar, what we would recognize as the information-domain conflict introduced in Chapter 1.

23 Schmitt MN. Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. 2nd edition. Cambridge University Press, 2017.

24 Rosenzweig P. Cyber warfare: how conflicts in cyberspace are challenging America and changing the world. ABC-CLIO, 2013.

25 Protocol Additional to the Geneva Conventions of August 12, 1949, and Relating to the Protection of Victims of Non-International Armed Conflicts (Protocol II), 1125 UNTS 609, entered into force Dec. 7, 1978, 1977.

26 Kello L. Cyber legalism: why it fails and what to do about it. Journal of Cybersecurity 2021; 7.

27 Id.

28 Lindsay JR. Restrained by design: the political economy of cybersecurity. Digital Policy, Regulation and Governance 2017; 19:493–514.

29 Grossman T, Kaminska M, Shires J, and Smeets M. The cyber dimensions of the Russia-Ukraine war. https://perma.cc/VE2Q-ZNFT, 2023.

30 Acton JM. Cyber weapons and precision-guided munitions. Understanding Cyber Conflict: Fourteen Analogies, 2017:45–60.

31 Verbruggen M and Boulanin V. Mapping the development of autonomy in weapon systems. 2017.

32 Weber S. Bloc by Bloc: How to Build a Global Enterprise for the New Regional Order. Harvard University Press, 2019.

33 Sharif M et al. Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition. CCS ’16. Vienna, Austria: Association for Computing Machinery, 2016.

34 Koller JS. The Future of Ubiquitous, Realtime Intelligence: A GEOINT Singularity. Center for Space Policy and Strategy, 2019.

35 Mattis J. Summary of the 2018 national defense strategy of the United States of America. Technical report, Department of Defense Washington United States, 2018.

36 Miller SE. Cyber threats, nuclear analogies? Divergent trajectories in adapting to new dual-use technologies. Understanding Cyber Conflict: Fourteen Analogies. Edited by Perkovich G and Levite AE. 2017:161–79.

37 Danzig R. Technology Roulette: Managing Loss of Control as Many Militaries Pursue Technological Superiority, 2018.

38 Defense Intelligence Agency. Challenges to security in space, 2019. Available from: https://purl.fdlp.gov/GPO/gpo116298.

39 Gorman S, Dreazen Y, and Cole A. Insurgents Hack U.S. Drones. Wall Street Journal, 2009 Dec. The footage was originally sent to a military satellite, but then related to a commercial one that sent an unencrypted feed. The software used to intercept the feed, normally used to watch television from commercial satellites without paying, could also process the footage coming from the Predator.

40 Peterson S and Faramarzi P. Exclusive: Iran hijacked US drone, says Iranian engineer. Christian Science Monitor, 2011 Dec 15. Available from: www.csmonitor.com/World/Middle-East/2011/1215/Exclusive-Iran-hijacked-US-drone-says-Iranian-engineer.

41 Rajagopalan RP. Electronic and Cyber Warfare in Outer Space. Government Document, 2019.

42 For a classic discussion of intelligence, see Handel MI. Leaders and intelligence. Routledge, 2012:3–39.

43 Office of the Director of National Intelligence (ODNI), CIA, DoD entities Defense Intelligence Agency (DIA), NSA, National Geospatial Intelligence Agency (NGA), National Reconnaissance Office (NRO), and intelligence missions of the armed services (Army, Navy, Marine Corps, and Air Force); and the following departments of executive agencies: Department of Energy Office of Intelligence and Counter-Intelligence, Department of Homeland Security Office of Intelligence and Analysis, US Coast Guard Intelligence, Department of Justice Federal Bureau of Investigation, Drug Enforcement Agency Office of National Security Intelligence, the Department of State Bureau of Intelligence and Research, and the Department of the Treasury Office of Intelligence and Analysis.

44 Rosenbach E, Peritz AJ, and LeBeau H. Confrontation or Collaboration?: Congress and the Intelligence Community. Harvard Kennedy School, Belfer Center for Science and International Affairs, 2009.

45 Brown G. Spying and fighting in cyberspace: what is which. Journal of National Security Law & Policy 2015; 8:621. (“Armed forces assume that other countries seek information about them, and politicians and diplomats accept some foreign intelligence coverage of them as part of the trade.”)

46 Rovner J. The elements of an intelligence contest. Deter, Disrupt, or Deceive: Assessing Cyber Conflict as an Intelligence Contest. Edited by Chesney R and Smeets M. Georgetown University Press, 2023.

47 Herman M. Intelligence Power in Peace and War. Cambridge University Press, 1996.

48 Devanny J, Martin C, and Stevens T. On the strategic consequences of digital espionage. Journal of Cyber Policy 2021; 6:429–50.

49 Nakashima E and Goldman A. CIA pulled offices from Beijing after breach of Federal personnel records. Washington Post, 2015.

50 U.S. Electronic Espionage: A Memoir. Ramparts, Vol. 11, No. 2, August 1972. Berkeley, CA, 1972.

51 Director of National Intelligence. What We Mean When We Say: An Explanation of Estimative Language, 2007.

52 Office of the Director of National Intelligence. Assessing Russian Activities and Intentions in Recent US Elections. Government Document, 2017.

53 Office of the Director of National Intelligence, Assessing Russian Activities and Intentions in Recent US Elections.

54 50 U.S. Code §1881a.

55 Participants are: Office of Management and Budget, Office of the Director of National Intelligence, Department of the Treasury, Department of State, Department of Justice, Department of Homeland Security, Department of Energy, DoD, Department of Commerce, and the CIA.

56 Knake RA and Clarke RA. The Fifth Domain: Defending Our Country, Our Companies, and Ourselves in the Age of Cyberthreats. Penguin Press, 2019.

57 For a discussion, see Wall AE. Demystifying the title 10-title 50 debate: distinguishing military operations, intelligence activities & covert action. The Harvard National Security Journal 2011; 3:85.

58 Nakashima E. Dismantling of Saudi-CIA Web site illustrates need for clearer cyberwar policies, 2010 Mar. Available from: https://perma.cc/L4PY-XVHN.

5.
Cybersecurity Theory

Chapter image: Cassandra treurt over de verwoesting van Troje, Jan Swart van Groningen, 1550–1555.

Source: Jan Swart van Groningen/Rijksmuseum Amsterdam/Public domain/
http://hdl.handle.net/10934/RM0001.COLLECT.29542.

Chapter Learning Goals

Understand the challenges in applying theory to cybersecurity issues.

Understand the gap between the fast-moving practice of cybersecurity and the struggle to develop coherent theories.

Understand and apply the leading theoretical frameworks used in cybersecurity: deterrence, defend forward/persistent engagement, security studies, securitization, economic approaches, public health approaches, the Gerasimov Doctrine, and Barlowism.

Develop a deep understanding of deterrence theory in particular, as national security leaders tend to view policy options through the lens of deterrence.

Chapters 1–4 present the defining contours of cybersecurity: what it is, technology basics and the attribution problem, economic and psychological views, and the outsize role played by the military. This chapter canvasses some theories that can be used to conceptualize cybersecurity.

Just as defining cybersecurity is a difficult and not entirely satisfying exercise, theorizing cybersecurity presents similar challenges. Cyberspace is such a large concept, one that is growing and becoming relevant to every part of modern life, that analyzing it on a theoretical level does some harm to the details. Practice has outrun theory¹ and some practitioners remark that academic contributions to cybersecurity are not useful for praxis.

We should not feel badly that cybersecurity lacks a neatly cohesive theoretical framework. Cybersecurity is a relatively new problem. It may take decades to find workable, coherent theoretical approaches that can inform practice.

5.1 Deterrence Theory

The field of international relations (IRs) and its sub-fields, security studies and strategic studies, provide insightful, widely used theoretical framing for cybersecurity.

Deterrence theory is a centrally important concept. In addition to deterrence, IR scholars study several other concepts important to cybersecurity: What is “power”? How does the Internet allocate it? How is sovereignty conceptualized and reconceptualized with the advent of the Internet and the concept of “securitization,” which was first introduced in Chapter 1?

IR’s most important contribution to cybersecurity is deterrence theory. At the highest level, deterrence theory concerns the power to prevent another party from taking some action. Usually, this is done through threats of some sort. Conversely, compellence concerns how power can be used to cause another party to take some desirable action. In compellence, typically some coercion is continuously levied until the adversary complies with some preference.

Definition 5.1.1 — Deterrence. A strategy that coerces another party from taking some action.

Definition 5.1.2 — Compellence. A deterrent strategy that coerces another party into taking some action the party would not otherwise take.

Threats are an instrument of deterrence, not the goal of deterrence. Delivering on a threat typically helps no one. In fact, deterrence theory distinguishes among the intensity of threats, from deterrent threats to disciplinary threats to extortionate threats.

When parties use violence, this means that some aspect of their deterrence strategy has failed. Perhaps, instead of choosing a deterrent threat, a party chose a disciplinary or extortionate one, leaving the adversary no options but to use violence. A balanced deterrence strategy uses enough threat to discourage unwanted action and encourage wanted action without provoking violence.

Deterrence sounds simple but the nuance and details go deep. A complex deterrence policy may deter, compel, and even shape an adversary’s subjective perception about what strategies are worth considering. Thus, deterrence theory can be seen as a psychological strategy as much as one about physical force.²

Before wading into those details, it is important to understand the context of deterrence theory. Deterrence theory was developed and refined to address the threat of nuclear annihilation. Thus, sometimes users of IR concepts borrow terms from nuclear conflict, often inaptly, by conflating denial of service attacks with weapons of mass destruction, for instance.

More than 10 years ago, theoreticians elucidated the poor fit with the atomic-weapons-developed deterrence theory and cybersecurity problems.³ In 2017, in an influential short paper, Michael P. Fischerkeller and Richard J. Harknett wrote a definitive critique of cybersecurity deterrence, arguing that the theory simply does not fit the contours of cyberconflict. The duo’s piece enjoyed a remarkable policy victory—or at least a resonance with—a developing, more belligerent US cyberconflict strategy (“persistent engagement”). As a result, Fischerkeller and Harknett—as of this writing—are perhaps the most successful policy entrepreneurs in cybersecurity.

5.1.1 Deterrence Theory Contours

Parties can achieve deterrence through punishment, by imposing costs, or by denying benefits to an actor. Many mechanisms can create deterrence. Classically, one considers violence, but, in a complex world with nuanced interdependencies among political actors, other mechanisms can deter. For instance, norms against aggression or even the subjective desire of a political leader to appear to be fair can deter an actor from cyber conflict. Deterrence can be general, in the sense that it prevents any actor from unwanted courses of action, or specific, in targeting a certain actor or class of actors.

5.1.1.1 Credible Threats

To deter, an actor must be able to credibly threaten punishment, the imposition of costs, or the denial of benefits. Credible threats require signaling of power while commitment to a policy typically requires costly demonstrations of one’s might. And therein lies a problem: actually delivering on a threat makes one appear unfair and cruel. Thus, credibility in deterrence often involves expensive proxy measures for violence. In the nuclear conflict arena, credible signaling included weapons testing, military maneuvers, and the maintenance of a continuously airborne fleet of nuclear-equipped bombers.

Game theorist Thomas Schelling explains many of these dynamics in deterrence. For instance, consider one reason why delivering on a threat is a policy failure. Schelling gives the example of the pedestrian: How can pedestrians intimidate drivers in 4,000-pound cars? This is because normal people would be appalled by the driver who runs over the pedestrian, even if the pedestrian is breaking the law.⁴ In deterrence theory terms, driving over the pedestrian is so disproportionate a punishment that drivers cannot credibly threaten pedestrians. People experience this dynamic in all kinds of conflicts, for instance, when a party “pulls a gun” on an unarmed person and that person says, “What are you going to do, shoot me?” The dynamic extends to nation-states. Nuclear weapons are so destructive that their use is almost always a disproportionate threat that no one wants to actually deliver on.

Using a targeted hacking attack would appear to be a perfect fit for the credible threat challenge. A skillful cyberattacker could choose appropriate targets and scale up and down the intensity of offense to match the deterrent situation. This would appear to give cyberattacks a massive advantage in deterrent threats, because one would never appear to be disproportionate and cruel.

Yet, the reality is more complex.

On Schelling

Thomas Schelling once observed:

If I go downstairs to investigate a noise at night, with a gun in my hand, and find myself face to face with a burglar who has a gun in his hand, there is a danger of an outcome that neither of us desires. Even if he prefers just to leave quietly, and I wish him to, there is danger that he may think I want to shoot, and shoot first. Worse, there is danger that he may think that I think he wants to shoot. Or he may think that I think he thinks I want to shoot. And so on. ‘Self-defense’ is ambiguous, when one is only trying to preclude being shot in self-defense.

If deterrence theory interests you, we suggest that you read Thomas Schelling’s THE STRATEGY OF CONFLICT. It was reprinted in 1980 and remains a classic exposition of the complexities of deterrence. The book is a root of modern game theory. Schelling shows, for instance, that the “game” of surprise attack is theoretically identical to the problem of how one assures partnership trust.

Some sniff at Shelling as not rigorous, but Schelling’s work is so compelling because it is not strictly formal and because Shelling anticipates modern theories of psychology. It recognizes that strategy in real life cannot follow an inflexible plan and that “rationality” is a subjective construct informed by personal values.

The book is also raucously humorous, as Schelling explains why his complex theories, so effective against nation-states, do not work on his own children. The reasons why come in Schelling’s notions of rationality—advanced for its time. Shelling saw people not as the rational actors one finds in economics, but existing on a continuum of rationality.

In fact, irrationality can be rational in conflict.

Here’s an example: coercion requires that victims receive a threat. Thus, the putatively irrational step of cutting one’s communications might be rational in conflict. The strategy might even apply in cybersecurity. Consider that the scourge of randomly-targeted Internet scams requires the aggressor to contact the victim, and for the aggressor to know, the victim has received the threat. A world with strong anti-spam enforcement might make business impossible for scammers by blocking their emails from reaching their intended victims.

Irrationality can also make unthinkable threats thinkable. The cage-rattling, brinkmanship, and propaganda of Kim Jong Un and Vladimir Putin make the unthinkable act of using a nuclear weapon quite real to the residents of Seoul and Kyiv.

Consider how one could credibly signal one’s abilities—the hard and soft cyber powers described by Joseph Nye—online?⁵ Weapons testing and joint exercises might come to mind as signaling tools.

But, here’s the problem for cybersecurity threats: signaling by demonstrating capabilities informs the adversary of vulnerabilities and exploits. The adversary may patch or remedy those vulnerabilities.⁶ Some cyberattacks are asset specific, meaning they are painstakingly developed with intelligence support against a particular target. Because they are specific to an “asset,” these exploits have a “one-shot” quality. For instance, temporarily disabling electricity in Moscow might be a credible, scary demonstration of power, but the demonstration would quickly motivate Russia to study the exploit and fix the vulnerabilities. The demonstration would motivate other countries to secure their power grids, too. Honest signaling through demonstration might endanger cyberattacks’ future potency.

Definition 5.1.3 — Asset Specificity. Asset specificity refers to the extent that a resource is tailored to a certain purpose or use, thus making it difficult—or impossible—to adapt it for alternative uses or other contexts.

As a result, cyber power is often signaled through mystique and through leaks to the press where officials “at the highest level” (typically meaning the speaker is the Secretary of Defense) suggest involvement in an attack without admitting it.

The mystique approach also means dishonest signaling is possible, meaning actors might “fake” their cyber power to deter adversaries.⁷

Definition 5.1.4 — Signaling: Honest and Dishonest. In biology, an honest signal tells other animals about a costly energy investment that demonstrates the animal’s strength. The peacock’s tail is an honest signal. These signals help other animals make decisions about dominance without direct conflict. But, animals also have dishonest signaling—attributes that imply strength. For instance, a butterfly may have wings with coloration that looks like large eyes, to confuse and intimidate predators.

5.1.1.2 Healey’s Signaling Framework

Cybersecurity expert Jason Healey offers a useful framework for signaling cyber power. “Loud shouts” are scary demonstrations of cyber power, such as a simulation of an attack on a power grid. Healey notes the loudest shouts in cybersecurity have been real attacks, such as the “Olympic Games” (also known as Stuxnet) campaign to sabotage the Iranian nuclear enrichment program.⁸ Olympic Games put the entire world on notice that the United States could penetrate well-guarded, air-gapped systems.

“Loud organizations” provide credible signaling by revealing their structural might and resources. For instance, the National Security Agency (NSA) loudly signals its prowess by announcing that it is the largest employer of mathematicians in the United States. In fact, the NSA is rumored to have 10 times the number of computer scientists than the UC Berkeley faculty.

A “quiet threat” is a private signal to an adversary that some system is at risk. An attacker might place a file in a sensitive system to prove the system is vulnerable, for instance.

Finally, in a “symmetric counter,” a nation develops a cyber capability to match one possessed by an adversary.⁹ As Nicole Perlroth explains, the Olympic Games/Stuxnet attack motivated many nations, including weak cyber powers, to acquire cyberattack capabilities once only in the hands of superpowers.¹⁰ Symmetric counters are rife in defense thinking. For instance, China and Russia’s development of hypersonic weapons has triggered the perception that the United States should have similar weapons, but it is unclear why the United States needs them.

5.1.1.3 Deterrence and Attribution

One often hears that deterrence does not work online because of the attribution problem. The logic is that since the adversary cannot be identified, they cannot be deterred. That claim is overbroad. Of course, one should not punish an adversary unless one can credibly attribute a wrong to that adversary. But, punishment is only one form of deterrence. Recall that cost imposition and denial of benefits are additional options, and these can be used even when the adversary is unknown.

If an attack can be attributed to a nation-state, prosecutorial, diplomatic, economic, or even military punishment can be levied against that state even if the specific individual involved is unknown.

One can punish without knowing the identity of an attacker. In the physical world, the barbed-wire fence can punish any intruder who attempts to climb it. Turning to cybersecurity, one could imagine a (probably illegal) barbed-wire fence strategy: One could allow the attacker to exfiltrate a malicious file that causes damage to the attacker’s computer when the attacker tries to inspect it.

When a defender does not know the attacker, it is still possible to impose costs and deny benefits. By investing in defense, one can impose costs on all adversaries—known or unknown—by making it harder and riskier to attack. By making systems more resilient so attacks are rendered edentulous, one can deny benefits to any attacker. For instance, using redundant systems might keep a service online even if a primary system is disabled.

Denial of benefits is a powerful strategy that can deflate all adversaries’ will to attack by preventing them from declaring victory. French President Emmanuel Macron used a clever denial of benefits strategy in response to cyberattacks during the 2017 election. Macron anticipated an attack on his campaign and so commingled fake information with real documents in campaign computers. Indeed, the Macron campaign systems were hacked, but when the documents were released on the eve of the election, no one could discern the truthful documents from the deliberately planted fake ones. The strategy denied the attackers the benefits of negative news cycles, because no one could tell what the news really was.

Macron’s strategy depended on assumptions not all candidates can rely on. Macron’s strategy deflated the attack because of the circumstances surrounding the election. Journalists did not report on the documents because they cared about their reputations. But, we could imagine a media environment where publishers did not care or were willing to spread the false documents because they disliked Macron. Macron was successful, in part, because the release appeared to serve Russian interests in installing a pro-Putin candidate.

Schelling provides an example of benefits denial in modern democracies that show how restricting one’s own options can be protective of broader freedoms. One point of the secret ballot, a bedrock right in American democracy, is that voting secrecy makes it impossible to verify how any individual voted. This means extorting voters in America is difficult. How will the aggressor verify the vote?

To realize this advantage, we all have to forbear from instincts like photographing our ballot for social media performances. We might also reconsider popular policies such as vote-by-mail, because such conveniences make it possible for intimidation by spouses and spies alike.

Challenges in creating deterrence in the cyber domain have resulted in nations formally adopting cross-domain deterrence policies. This means that in reaction to a cyberattack, some nations will punish adversaries using some non-cyber-related method.¹¹ The United States under President Obama formally announced that it might respond to consequential cyberattacks with physical violence in the form of kinetic weapons. President Trump announced the United States could use a nuclear response.

5.1.1.4 Commitment

A nation’s willingness to punish, impose costs, or deny benefits is referred to as commitment.¹² A nation that lacks commitment may not be able to credibly threaten others.

But, adversaries can undermine commitment by strategically applying uncertainty or ambiguity in a situation. Uncertainty about attribution provides one way to avoid deterrent actions of an adversary. Adversaries can also undermine commitment by manipulating the population of a democracy. After all, democratic leaders may lose power if they rush into wars without the support of the public.

Typically, commitment requires dedicating troops and resources to conflicts, a costly endeavor in economic, political, and emotional senses. Thus, a wily actor might understand that some cyberattacks against a nation could be abstract and hidden from the general public, yet still strategically costly. Such an actor may be able to attack without raising resentment among the populace. This dynamic is captured in “below threshold” attacks, ones that are not so serious to be considered an armed attack or the use of force under international law. Most people in the United States are simply not aware of these attacks and are not affected by them in their day-to-day lives.

Leaders use many techniques to signal commitment. In fact, belligerence and irrationality, seemingly bad traits in a leader, can create powerful, credible signals of a commitment to punish. Here again, democracies may be at a disadvantage: belligerence is tempered in democracies, presumably because citizens have to be willing to follow a belligerent leader and go to war for them. Most people in democracies are not willing to do this. And since cyberattacks do not create widespread death and destruction, a belligerent response to a cyberattack can appear in the eyes of citizens to be unjustified, even unhinged.

The hope of an enlightened democracy is that institutions will slow the impulse to attack. Ultimately, citizen self-interest will curb the ability of belligerent leaders to commit to violence. But, this hope is stressed and even ruptured where elites do not bear costs from waging war. Nations that send their poor to fight while elites’ children opt out with medical exemptions and the like may not have “skin in the game.”

5.1.1.5 Cyber Borrowing from History

Cybersecurity threats are different from coercive strategies from the Cold War. Yet, we can use strategies from atomic conflict to think about effective management of cyber threats.

Thomas Schelling provides principles from nuclear arms conflicts to express commitment. “Automaticity” is the idea that an adversary’s action will inevitably result in some violent response. Schelling gives an example of automaticity when President Kennedy announced that any use of nuclear weapons launched from Cuba would trigger a full retaliatory response.

Another automaticity technique involves shaping a situation such that the target has no choice but to fight back. Schelling provides the example of burning the bridges behind troops so that they cannot retreat. Finally, there are even psychological strategies for automaticity. Consider the leader who tethers feelings of national honor to an automatic response. In such situations, the need to save face and preserve one’s pride signals the willingness to commit to a costly campaign. That is, if the leader does not respond with attack, the leader will lose esteem (and maybe an election).

It is unclear how to adapt these strategies from nuclear and other conflicts to cybersecurity. Perhaps, automaticity could be implemented with a technological tripwire—an attack against an important asset such as a power grid might trigger an automatic, violent response. A violent response might indeed be justified, but an automated one risks targeting the wrong actor.

Going back to the eighteenth century, landowners used “spring guns” to automatically fire at people burglarizing barns in the remote countryside. This had the unfortunate effect of killing children and other innocents. Turning back to cyber, acting too quickly will result in harm to innocents. There are several well-known examples where serious cyberattacks were initially attributed to a hostile foreign power that turned out to be a result of clever teenagers (for instance, the Solar Sunrise intrusion was originally attributed to Iran but was committed by high school students).

▄ Example 5.1 — Solar Sunrise. A series of cyberattacks code-named “Solar Sunrise” in 1998 targeting US Department of Defense systems led the government to believe it had been compromised by Iran. Later investigation showed the attackers to be American teenagers.

▄

The other approaches suggested by nuclear deterrence present challenges as well. Cyberattacks do not easily fit into physical concepts involving physical retreat or constraint more generally. The abstract nature of cyberattacks also makes it difficult to tether feelings of national honor to them. For instance, the 2015 hack of the US Office of Personnel Management (OPM) was among the most consequential cyberattacks ever, with the adversary, presumably China, acquiring millions of records of security clearance applications and deliberative files concerning the most sensitive aspects of clearance holders’ lives. Yet, the incident remained cabined among those interested in national security policy. No broader public concern arose.

▄ Example 5.2 — The OPM Hack Perhaps, the most important computer attack ever is unknown to most—the 2015 hack of the US Office of Personnel Management. Believed to have been committed by China, the attackers exfiltrated the personnel files of tens of millions of US government employees. In some cases, the attackers obtained lengthy disclosure documents (the SF-86) used to apply for a security clearance, fingerprint records, and information of US service members.

▄

5.1.1.6 Compellence

Schelling also provides a useful explanation of compellence, an idea often overlooked in discussions about deterrence. As he puts it, “Compellence… usually involves initiating an action (or an irrevocable commitment to action) that can cease, or become harmless, only if the opponent responds… To compel, one gets us enough momentum… to make the other act to avoid collision.” Schelling continues, “The threat that compels rather than deters… often takes the form of administering the punishment until the other acts, rather than if he acts.”¹³

In cybersecurity, compellent threats could come through regulation that denies the user access to the Internet unless they take some step. For instance, a nation could compel its people to have a “driver’s license for the Internet,” a requirement to register their true name and identify themselves across services. In the United States, many people convicted of predation crimes must register their true address and subject themselves to Internet monitoring.

We might even conceive of a market economy with a weak social safety net—like America—as a compellent threat. In such an economy, one is compelled to work at the threat of losing one’s access to food and shelter. All of us are held at risk of homelessness, and, for some, the risk is quite near: a single paycheck missed or a health emergency can destroy one’s economic security.

Question 5.1.1 — Compellence in Cyber. Can you think of other examples of compellence in cybersecurity?

▄

5.1.2 Deterring with Entanglement and Norms

Adversaries can be deterred through “entanglement,” that is, the creation of interdependencies that result in harm to both aggressor and victim. The most salient entanglements are economic. If maintaining the status quo is good for trade and business, an adversary may self-deter and not attack in order to avoid shared economic losses.

Schelling notes the ancient use of hostage exchange as a form of conflict management: when parties agree to trade hostages, they ensure violence will come with a high price. As a thought experiment, Schelling offers the idea of a modern, entangling foreign exchange program: imagine a future where all Americans exchange their kindergartners with Russian families for a year. Aside from the rich cultural interchange, the program would in effect be an exchange of hostages. Schelling observes that neither Russia nor the United States would be willing to attack each other in such a relationship.

A scary realization from Schelling’s hypothetical is that we have lived in it since the 1960s—alas, without the benefits of living abroad. In a world with always-ready-to-launch intercontinental ballistic missiles (ICBMs), all children are held hostage at home.

Question 5.1.2 — “Hostage-exchange” in cybersecurity? Imagine if nations traded some kind of critical Internet asset instead of their children. Perhaps the primary backup for essential systems could be exchanged, with Washington and Moscow holding them at risk. Could you envision a form of cybersecurity “hostage exchange?”

▄

Economic hostage exchange was among the strategies of neoliberal thinkers. That is, as nations entangle their economies, the “golden handcuffs” created by interdependent banking, manufacture, and service economies may create a pacifying force. We are all hostage in the sense that we participate in global capital markets and banking. It is thought that extremists have not been able to fundamentally disrupt the Internet and capital markets because even organized crime is entangled in these same markets and wants them to function. Thus, if we assume rational economic behavior, the core of the financial system shouldn’t be attacked.¹⁴

But, the financial services as hostage assumption fails with regard to regimes outside western banking networks and with kleptocratic states like Russia. North Korea, for instance, has been accused of targeting financial fraud schemes at Americans and other westerners to raise state revenue. Similarly, Iran has taken up offensive cyberattacks because it allows the country to project power in ways it cannot through conventional weapons.¹⁵

Question 5.1.3 — Enforcement against hacktivists. Might hostage-exchange assumptions explain why law enforcement agencies so doggedly pursued not-so-important but ideological hacktivists? As an example, consider the antics of “Anonymous,” a hacking group that tried to disable PayPal in order to punish it for cutting off payments to Julian Assange.

▄

Norms and taboos can also shape the subjective option space of attackers, in effect taking some options off the table. The primary physical example of this comes from nuclear weapons, the horror of which created a “nuclear taboo” and forbearance from their use in conflict since 1945. Other norms include forbearance from assassinations for portions of the Cold War, a norm that appears to have been abandoned by many nations in the war on terror.

Turning to cybersecurity, several norm entrepreneurs have attempted to establish norms and taboos in cyberconflict. One important effort is the United Nation’s “Group of Governmental Experts” (UNGGE).

In the private sector, Microsoft has championed what it calls a Digital Geneva Convention. The core provisions of the Convention prohibit cyberattacks on systems that might physically harm people or cause financial disruption. The Convention also calls for the elimination of election interference and intimidation of journalists. These norms entrepreneur efforts are in their early stages and have not had great success. The Carnegie Endowment for International Peace has devoted substantial efforts to promote cyber norms.

5.1.3 Cyber “Power”

IR scholars interrogate the question of power: What is the nature of cyberpower? Can it be measured in any objective way in the same method of counting troops and tanks? Or is cyber power just a proxy for existing military and economic strengths? Does cyber power create new asymmetries? What is the offense/defense balance in cybersecurity? Is cyber conflict likely, costly, or harmful?

Owning a network platform would seem to grant one cyber power. The controller of any network can specify the rules and shape the transaction costs to deter or compel users. In 2019, Henry Farrell and Abraham L. Newman noted how dependence on international economic networks, such as the SWIFT value-transfer system, enabled governments to impose policy on actors worldwide.¹⁶ SWIFT, the Society for Worldwide Interbank Financial Telecommunication, is the central mechanism used by banks to transfer money, and thus exclusion from it severely limits nations and individual banks. Accordingly, access to the financial network and lucrative American business has indeed become a prime mechanism to punish cybercriminals.¹⁷

At first glance, cyber power does change dynamics. Individuals can levy basic attacks, such as Distributed Denial of Service (DDoS) and document stealing, even against sophisticated adversaries. However, these attacks are rarely consequential. High-consequence actions generally require intelligence, planning, operational competence, and commitment that only nation-states can afford. Even terrorist groups seem to lack the right stuff to levy consequential attacks.

As a fundamental matter, no amount of cyber power trumps kinetic force. (Recall Thomas Rid’s point that cyber war “will not take place,” in part because cyberattacks lack the lethality of traditional war fighting.) From a military perspective, cyberattacks have been force enhancing, rather than a force in themselves. For instance, it is hard to imagine how US forces flew helicopters undetected into Pakistan to kill Osama Bin Laden without using cyberattacks and electronic warfare against a nearby military base. Yet, no amount of cyberattacks could have actually killed Bin Laden.

In a contest between superior cyber forces and kinetic ones, physical violence wins the day—so far. An example comes from the Anonymous hacker group and its conflicts with the Zetas, a Mexico-based transnational criminal organization. Anonymous had scored some impressive computer intrusions and threatened to reveal the identities of the Zetas and its cronies. But, Anonymous quickly dropped its plan. Why? In response to the cyberattacks, the Zetas simply announced they would behead people if its members were outed by Anonymous. The Zetas thus “won” the strategic outcome of the conflict by using a credible threat of violence against an adversary with superior cyber power.

▄ Example 5.3 — Operation Cartel. In 2011, the Anonymous hacking group announced it had obtained a database revealing the true identities of the Zetas, a dangerous gang. Anonymous threatened to reveal the information unless the Zetas released one of its members the Zetas had kidnapped. Rosenzweig explained the Zeta’s response: “The Zetas’ response was chilling, but effective. They warned Anonymous that if it published the names of the collaborators, Zetas would retaliate by conducting a mass killing of civilians—10 people for every collaborator named. Faced with that threat, Anonymous withdrew its threat and closed down its program…”¹⁸

▄

This anecdote about the Zetas reveals another aspect of cyber power: cyberattacks can be useful on a tactical level, but no one has achieved a significant strategic victory using cyber alone. Instead, cyberattacks play a force-enhancing or force-supporting role, but one still needs coercive power to achieve strategic objectives, like the Zetas.

5.1.3.1 Nonpolarity

The Internet has contributed to nonpolarity,¹⁹ that is, a power arrangement characterized by many actors with significant influence. The alternatives are a unipolar world (e.g., dominated by the United States), a bipolar world (e.g., dominated by the United States and China), or even a multipolar arrangement with a handful of great powers. In a nonpolar world, many more actors can be the cause of problems in other nations.

Power has also diffused to nongovernmental actors, such that terrorist groups and even transnational criminal organizations can exercise some power through the Internet. Yet, there is a consensus that nation-states are still the most dominant actors in a nonpolar world.

Cyberspace is widely understood to have given the US asymmetric benefits, despite the rise in nonpolarity. The Internet’s roots are firmly embedded in US military innovation, inextricably tied to US companies, and the Internet’s affordances often align with the propagation of liberal enlightenment values. Various revolutions are assisted by access to Internet technologies and the spread of information has been inconvenient and dangerous to authoritarians. Thus, movements to balkanize or fracture the global Internet in various forms (in China, through filtering and a robust internal market; in Russia, through filtering and attempts to separate infrastructure at national gateways) are a logical strategy for repressive or endangered nation-states worried about US power.

There is an emerging economic argument for balkanization as well, discussed in Chapter 12. Here, we can preview it by simply stating that data may share characteristics of other natural resources. Consider this comparison: If your nation is oil rich, you could export it as crude and then buy it back from refining nations. Or you could vertically integrate and sell a refined resource.

We do not refine data, but massive amounts of data are needed to refine machine-learning models. Thus, there may be a parallel between weak, oil-exporting states and states that export their citizens’ data. In both cases, oil-importing and data-importing nations may be more powerful. The data-importing nation will have the raw material necessary to get ahead in machine learning. Data-exporting states will always know less than nations like the United States and China, because these countries can take raw data and build better and faster machine-learning models.

Nations are reacting to these risks through Internet sovereignty strategy known as “balkanization,” where states break off connections or limit how services work to limit foreign access and competition. Both liberal and illiberal nations use balkanization policies. In the United States, starting with President Trump, the government sought to restrict many Chinese applications from consumers’ phones because these programs can silently exfiltrate sensitive information and could be used to subtly shape Americans’ attitudes. In Europe, in theory at least, the law prohibits moving the data of citizens outside the European Community, unless special procedures are in place. In Russia, the nation has experimented with disconnecting from the global Internet entirely. In China, the “Great Firewall” limits most citizens’ access to information while elites have methods to enjoy greater access.

Balkanization maximizes benefits by giving these nations access to connected technologies while minimizing the risk of foreign influences. And perversely, this balkanization can be presented as an attempt to liberalize. Balkanization has to be evaluated critically—it can enhance human rights or be a cover for censorship.

5.1.3.2 Does CyberPower Make Conflict More Likely?

Cyberspace certainly has changed power relationships, but does this mean cyber conflict will be likely and harmful? We live in a world where superpowers have hypersonic weapons that can be anywhere in minutes, possibly decapitating a government with little notice. Some describe cyberattacks in similarly dramatic terms, but this is as misleading as the nuclear analogy.²⁰ Cyberattacks do not neatly fit into “fast” or “slow” attack methods. While cyberattacks are transmitted with light and thus appear to be fast, consequential cyber operations require careful planning and preparation.²¹ Preparation even includes attempts to assess whether an attack, once executed, had any effect (the battle damage assessment problem).

Critically, most commentators believe cyber conflict favors attackers and defenders have a difficult task. Just like storming the castle, the attacker gets to decide when, where, and how to attack. They might even breach the walls by bribing a guard. Defenders must anticipate and counter all such attacks. For this reason, as we will discuss later, cybersecurity has embraced multilayered security models known as “defense in depth.” Like the castle, the walls are not the only form of defense. High-value assets are behind more walls, are segmented, or have other, special defenses.

Modern cybersecurity experts now expect attackers to be in their networks; and thus, the current approach is to protect high-value assets in the presence of attackers. That is, to not rely on “castle walls,” but assume an attacker is inside the castle. This more mature and realistic focus requires defenders to think of the vaults within the castle walls—and more seriously contemplate that the attacker may be an “insider,” such as a disgruntled employee.

5.1.4 The Deterrence Theory Critique

Deterrence theory does have explanatory power for cybersecurity. But, deterrence frameworks must be reworked to fit cybersecurity.

Theoreticians developed and deepened deterrence theory in the nuclear context, but the context shift from nuclear to cybersecurity results in crazy talk.²² The use of a nuclear device is a clear red line, one that is now easily attributable, a capability limited to a small number of sophisticated nations, impossible to use secretly, and horrific, even genocidal, in destructive power. Cyberattacks are the opposite. Cyberattacks are often secret, in the sense, they are intelligence driven; often undetected, in the sense, they may be duds that fail to produce any effect; yielded by non-state actors and marginal nations; and almost never the cause of physical harm (Table 5.1).

Returning to Rid, he observes, “unlike the nuclear theorists in the 1950s, cyber war theorists of the 2010s have never experienced the actual use of a deadly cyber weapon, let alone a devastating one like Little Boy. There was no and there is no Pearl Harbor of cyber war. Unless significantly more evidence and significantly more detail are presented publicly by more than one agency, we have to conclude that there will not be a Pearl Harbor of cyber war in the future either.”²³

Fischerkeller and Harknett deliver the most syncretic critique of deterrence theory. The duo argue that deterrence theory simply does not fit the characteristics of cyberspace.²⁴ They argue that cyberspace is “perpetually contested,” meaning an ongoing low level of conflict pervades the domain. In nuclear deterrence, actors seek to prevent a clear, terrible event. But, in cyberspace, there are so many actors and so many vulnerabilities that one cannot possibly expect no adverse events.

Cyber conflict cannot be deterred in the sense a nuclear strike can; cyber conflict must instead be managed. In fact, nations are in “agreed competition” in cyber conflict, meaning adversaries have some kind of understanding of interactions that are routine or escalatory.

The duo argue that “if cyber means are to have unique strategic value, it will come from operations short of armed attack equivalence that cumulatively enhance one’s own power or degrade and destabilize others’ sources of national power.”²⁵ This is the “below the threshold” activity that does not have the violence associated with traditional armed attacks discussed in Chapter 4.

Table 5.1 The nuclear analogy, so popular in cybersecurity thinking, is a bad fit and should be abandoned.

Key factors | Nuclear analogy | Cyber fit
Raw materials | Require substantial physical investment, scientific expertise | Off-the-shelf exploit packages are available; however, consequential attacks usually require intelligence, planning
Speed of attack | Slow, expensive to develop, can be stealthily delivered | Slow to develop; tends to enable surveillance or play a force-supporting role
Is there a first-strike advantage? | No longer, because modern nations have redundant, second-strike deterrence | Yes, because attribution takes time; first strike might disable complex, interdependent defenses
Can one disarm an adversary? | Some nations’ nuclear stockpile could be reduced or destroyed | There is no way to eliminate a “stockpile” of cyber capabilities
Who are the adversaries? | Limited number of nations with nuclear weapons; few have ICBMs | Nation-state and non-state actors alike, including criminal groups, with cyber capabilities
What are consequences of attack? | From megadeaths to complete annihilation | Often undetected and unnoticed. Yet, physical attacks enabled by cyber are noticed.
Can one attribute an attack? | Complex systems detect launches and chemical analysis indicates nuclear material source | Mixed bag. NSA can probably attribute all Internet activity. Others’ capability varies.
Can one distinguish between offensive and defensive actions? | Careful signaling takes place | The technical methods used for espionage are nearly identical to computer attack and worrisome “preparation of the battlespace”
Usage dynamics | Nuclear weapons are principally strategic, countervalue weapons | Cyberattacks are often tactical, counterforce, or even counter-commander
Power dynamics | Populations of some nations might not hold any political sway over its leaders | Cyber could be used to focus on a political class or leader rather than the general population
Is the technology escalatory? | Nuclear devices are the ultimate escalation | Low-level computer attacks occur all the time; these attacks create indecision and uncertainty more than escalation.
What are the dual use dynamics? | Peaceful uses of nuclear technologies exist, but intelligence and surveillance can reveal weaponization | Hostile computer code can be undetectably similar to legitimate code
Can adversaries stockpile weapons? | Nuclear weapons can be stockpiled, yet intelligence and surveillance likely reveal activity | A simple USB drive could contain a stockpile of cyber-offensive software
What norms are in place? | For some there is a nuclear taboo | No taboo has emerged against using many kinds of cyberattacks

For years, commentators have pointed out the problems with deterrence theory that Fischerkeller and Harknett articulate. The duo is important for taking the next step: proposing a conflict posture they claim is congruous with the Internet. Fischerkeller and Harknett argue that because there is so much low-level cyber conflict, we should embrace it and “persistently engage” with adversaries. We should fight sorties with adversaries so regularly that even automation is used in this conflict. We should shift from passive deterrence by denial approaches to defense activities that seek cost imposition or even punishment. This idea departed radically from the more cautious approach set by President Obama and embraced by President Trump as part of its persistent engagement and defend forward posture. These strategies are discussed in Chapter 4.

5.2 Security Studies: Anarchy, Security Dilemma, and Escalation

In the GALLIC WARS, Julius Caesar writes of extinguishing entire tribes of people. The Gallic tribes outnumbered Caesar’s forces, but they were confronted with well-equipped Roman legions who fought in organized formations. No court, superpower, or divine redeemer punished Julius Caesar for this. Caesar himself recounts the killing in factual terms, seemingly unconcerned with the lives and cultures ended. His power was bound only by the speed and capacities of his legions.

Caesar’s anecdote nicely sets up our second theoretical framework: that of security studies and how it conceives of “anarchy” and related concepts: the security dilemma and escalation.

5.2.1 Anarchy

The field of security studies sees the world as anarchic. Anarchy describes the conditions of nations’ relationships. Security studies interpret the world as being governed by states’ relative powers, the subjective belief of their leaders in having an attacker advantage, and the capacities of a Julius Caesar rather than some moral restraining force. In an anarchic world, if a true emergency arises, no one else can be relied upon except one’s own state to protect a population. To protect sovereignty, all nations need to be self-reliant.

Anarchy results in a paradox: to have peace amidst anarchy, one needs the capacity to commit violence. Thus, states need militaries and intelligence services. Anarchy suggests states cannot simply assume norms and international law will keep them safe.

Question 5.2.1 — Ukraine and Anarchy. Is the Russian invasion of Ukraine consistent with what we know of the security studies’ concept of anarchy?

▄

Critics of the paradox might say, “well what about the international community and common self-defense? Can we not overcome this notion of anarchy?” Realists might point to examples of recent aggression: Russia’s continuing aggression in Georgia and Ukraine or China’s contest to control the South China Sea. Both of these conflicts share a high-level dynamic: realistically, the world community is not willing to use direct military force to stop aggression in adversaries’ spheres of influence. The world community is willing to provide moral and matériel support, but directly facing off with nuclear powers is beyond most states’ will. Security studies suggest that Georgia, Ukraine, and Taiwan are fundamentally on their own (Figure 5.1).

5.2.2 The Security Dilemma

Anarchy in the security studies sense means states will systematically invest in military capacity as adversaries gain more power and threaten a peaceful existence. One can see where this leads and how it is relevant to cybersecurity: Do investments in cyber defense, cyber intelligence, and cyber power trigger a security dilemma; the perverse result that investments in security cause adversaries to compete, resulting in a “arms race” of ever-growing defensive and offensive powers?

Question 5.2.2 — Cybersecurity Dilemma. If investments in cyber-offensive capabilities trigger a security dilemma, what steps can we take to mitigate it? Is this an area where we can borrow from the nuclear analogy?

▄

Figure 5.1 The Great Seal of the United States has always featured an eagle clasping an olive branch and a clutch of arrows. The eagle faces the olive branch. Is it an allegory for the security studies concept of anarchy?

Source: U.S. Government/Wikimedia Commons/Public domain.

The answer is: it depends. Security studies scholars provide a framework for answers in different contexts and ways to mitigate security dilemmas. One framework element relates to the meaning of a military investment. Armaments that are clearly defensive are unlikely to provoke escalation. For instance, in physical space, building a moat around a castle communicates no threat to others. A network firewall would be an example of a purely defensive cyber capability.

Then again, even some “defensive” investments can trigger a security dilemma because their meaning is ambiguous or because the defense alters attack incentives. The seminal example comes from anti-ICBM capabilities. Even defensive capabilities against ICBMs are escalatory because the balance of power depends on the assumption that we will all destroy each other in a nuclear war, thus no rational person will start one. But, this assumption changes if one party can use nuclear weapons while blocking others—in effect, that nation has “freed” its hostages from all other adversaries’ peril. In fact, if an adversary even suspects that one party is building an ICBM shield, it might conclude a first strike is rational. Turning to cybersecurity, imagine a situation where a network firewall was so exquisitely tuned that no adversary could attack. Those possessing such a defensive capability might attack more.

▄ Example 5.4 — Able Archer 83. Misinterpretations of military action can move adversaries close to disaster. Take for instance ABLE ARCHER 83, an extensive military exercise centered in Belgium to simulate a conventional weapons conflict in Europe that escalates into a nuclear confrontation. The US airlifted 19,000 soldiers to the theater for the simulation.

Militaries need to practice to ensure systems work and people know what to do in an emergency. But, large-scale exercises trigger fear and conspiracy theories among the public (e.g., JADE HELM).

The 1983 exercise occurred in a political context where the Soviet Union genuinely interpreted President Reagan’s rhetoric as presaging a nuclear first strike. The KGB searched for evidence of aggression and Able Archer provided plenty of it. The KGB thought the United States could disguise its first strike under the cover of an ordinary exercise.

The USSR went on high alert, preparing bombers and European-theater nuclear missiles for immediate launch. The USSR remained on hair-trigger alert status for months. And the United States never realized it.

The Able Archer incident is considered as dangerous as the Cuban Missile Crisis, yet few know of it.

▄

Some investments in security that are ambiguous or signal offense can stoke fear in adversaries. And this dynamic makes cyberattacks dangerous because they are inherently ambiguous. From a victim’s perspective, it is not easy to know whether an attacker is just testing out a capability, just listening, or earnestly trying to destroy the victim’s facilities.

We know governments consider hacking done for espionage as different from attacks done for computer damage. But, from the victim’s perspective, how can one tell the attacker’s intent? If the United States can eavesdrop on a communications system, could it not use that same capability to deny, degrade, disrupt, deceive, or destroy it?

5.2.3 Escalation and the Security Dilemma

If security investments are read ambiguously, they can create a security dilemma. Ben Buchanan argues nation-states should adopt a strategy to build trust and reduce the risk that misinterpretation could cause a spiral of escalation.²⁶ One such strategy was implemented in 2013 when President Obama established a “cyber hotline” with Russia, modeled on the “red telephone” used to communicate with Russia during a nuclear crisis (the Washington–Moscow Direct Communications Link). More generally, Buchanan argues nation-states could make a point of developing costly, credible signaling, such as increasing the transparency of their cyber operations, perhaps by allowing verification and inspection of activities by others.

Escalation is a separate but related issue to the security dilemma. Scholars vigorously disagree on whether cyberattacks are escalatory, in the sense that their use inherently risks a spiral of increasing violence. Here, we revisit material from Chapter 4 on what constitutes uses of force and armed attacks.

Recall from that chapter that there are several ways to decide whether a cyberattack is a use of force or an armed attack (entitling the nation to reasonable self-defense): First, a focus on effects—did the cyberattack create kinetic-like damage? Second, even if the cyberattack did not create kinetic damage, did it have other, broadly destructive effects? Third, a nation could consider cyberattacks on some targets, such as critical infrastructure, as categorically wrongful and entitling the victim to self-defense.

From a coldly rational perspective, leaders might evaluate attacks from the second perspective and examine the consequences rather than the methods. From this perspective, if an adversary destroyed a dam and flooded a city, whether the attacker used a truck bomb or a cyberattack should not matter. No matter the method, the victim has suffered broadly destructive effects.

Under this view, cyberattacks are regulated the same way kinetic forms of attack are—the focus is on the ends rather than the means.

But, from a strategic perspective, means matter. Consider this view: A dam destroyed by a bomb might be a less threatening attack because one can increase defenses of other dams, and because it takes real commitment to levy a bomb attack. Just imagine the resources and opportunities for failure presented by building a truck bomb and driving it hundreds of miles to the target, or the complexities of acquiring a missile with sufficient range and accuracy.

Using a means-of-attack-based method, Internet-based attacks against the dam is a more terrifying event. The means of attack matter, because methods speak to future consequences. If it is possible to cause one dam to fail with a cyberattack, perhaps others could be attacked in the same way. If the attack was made possible by corrupting control components during the production and building phase of the dam, the vulnerability may be difficult to identify and mitigate. The uncertainty about defenses alone causes worry. And because the cyberattacker does not have to risk their own neck, attacks require less commitment and are more likely to be levied.

The lack of signaling or the ambiguity of signaling in such an attack could cause escalation. The victim might not understand whether the cyberattack was a retorsion for an earlier wrong or whether the attack is the first step in a larger offensive. Nations need tools to understand other nations’ intent, and one-way nations signal intent is through “escalation ladders.”

Escalation ladders help define options and send messages to others about the scope and objective of a conflict. Paired with “tripwires,” which are clear, detectable signals of wrongdoing, an escalation ladder can help adversaries limit a conflict.

Signaling is a central requirement for escalation ladders. Nation-states have to understand what is escalatory, and what is escalatory may depend on the target of conflict. In the United States, for instance, we would see false news and propaganda as an annoyance and an interference, whereas, even truthful, derogatory news would be seen as hostile and escalatory in China and Russia.

Control is also a major factor, as is relinquishing control or leaving things to chance. One way nations test adversaries is by loosening control to see what happens. But, the key here is that loosening control must itself be controlled: skirmishes must not spiral out of control. Schelling describes states as encouraging “breaches of limits, manifestations of ‘irresponsibility,’ challenging and assertive acts, adoption of a menacing strategic posture…spoofing and harassing tactics, introduction of new weapons…” Defend forward and persistent engagement is a doctrine that loosens control but has not triggered escalation thus far.

Escalation ladders are “vertical.” They describe steps nations can take to directly intensify competition. But, there are also “horizontal” strategies. Instead of vertically escalating, a nation could intensify a conflict horizontally by opening up a different avenue of conflict. For instance, a nation might involve its allies to pressure an adversary, or rope in some unrelated conflict. For instance, in the 2022 invasion of Ukraine by Russia, Ukraine’s vertical escalation options were limited, because Russia is a belligerent, nuclear state. Ukraine cleverly used horizontal options—roping in regional allies so they understand that if Russia won, the country might attack other countries in the region. Ukraine also used horizontal escalation globally, by triggering an expansion of North Atlantic Treaty Organization (NATO) membership and by securing weapons donations from global allies. Russia may intensify horizontally as well, perhaps by opening a new front of conflict in the South China Sea or in Eastern Europe.

Question 5.2.3 — The Invasion of Ukraine. As you study the escalation ladder, consider the changing positions of the United States and Europe on delivering aid to Ukraine. Directly fighting the war is clearly too escalatory. The ladder helps us see other options.

▄

Sub rosa or secret actions also play a large role in international conflict. An attacker may choose a total secrecy strategy or one where the target state has some knowledge of an attack. Clandestine attacks can psychologically terrorize adversaries. Secret cyber operations can undermine trust inside organizations. These organizations may mistake the effects of the attack as a malfunction, incompetence, or perhaps even treasonous sabotage.²⁷

Nations may choose a sub rosa retaliation to send a message to a foreign leader while allowing that leader to “save face,” for instance, by revealing the attack to leadership but hiding it from the general public. Providing face-saving alternatives to adversaries, particularly authoritarian ones, is an important strategy for de-escalation. Without such options, an adversary may martial resources and escalate a conflict simply to preserve personal authority or national honor (Table 5.2).

Lived experience suggests cyberattacks are not escalatory—cyberattacks have not triggered outsize responses. Emerging empirical evidence bears this out. For instance, “In a study of crisis war games, [Jacquelyn] Schneider finds that across six years of games, US decision-makers chose not to retaliate to cyberattacks. Discussion about decisions during the game suggests players did not view the cyberattacks within the same psychological frame as conventional or nuclear attacks.”²⁸

Schneider and Sarah Kreps performed a human subjects study on perceptions of conventional, nuclear, and cyberattacks, concluding that, “Americans’ propensity for escalatory responses to cyberattacks cannot be explained solely by the effects created by attacks. Just as other scholars have argued a nuclear ‘firebreak’ exists, it appears a cyber firebreak exists at the bottom of the escalation ladder.”³⁰ A firebreak stops wildfires from spreading; in this context, a cyber firebreak stops decision-makers from “spreading” conflict from cyber to kinetic warfare. To make this clear, the duo argue that just as policymakers avoid the use of nuclear weapons at the “top of the ladder,” there is also reluctance to escalate based on cyberattacks, which are toward the bottom of the ladder.

Table 5.2 Herman Kahn developed the concept of an escalation ladder to order the seriousness of interventions in conflict.²⁹ Here, we have adapted the approach to elucidate a cyber escalation ladder. This is developed from many sources, including Kahn, Schelling, Loch Johnson, and Martin Libicki. As one can see, cyberspace activities offer a range of options below military conflict, some of which can be performed sub rosa.

Nuclear | No possible higher escalation
Military (maybe sub rosa) | Damage to critical infrastructure
| Assassination
| Broad range of damage to adversary
| Defensive/police action
| Training foreign groups in combat
| Arms sales
Cyber (maybe sub rosa) | Corruption of important data
| Brandishing some cyber threat
| Developing new weapons
| DDoS on noncritical systems
| Website defacement
| Releasing patches for adversaries’ attacks
Economic | Sanctions
| Listing of individuals on Office of Foreign Assets Control Specially Designated Nationals list (OFAC SDN)
| Funding of foreign opposition groups
Legal | Pursue remedies with international bodies, such as the World Trade Organization
| Indict or otherwise legally pursue attackers
Diplomatic | Embassy closure
| Expulsion of diplomats
| Démarche
| “Naming and shaming”
| Misleading propaganda
| Truthful propaganda
Espionage | Espionage is the default state of affairs. Politicians, diplomats, and representatives of major companies expect to be spied on. But, sometimes, overly intrusive investigative methods can be escalatory.
| Maintenance and training of a cyber force
| Sharing sensitive secrets

Question 5.2.4 — Connecting Empirics with Theory. Suppose Kreps and Schneider are correct. Can you tie their empirical findings to theory we’ve visited so far?

▄

The counterintuitive observation to be made here is that uncertainty may cause more restraint than escalation.³¹ The multiple uncertainties surrounding cyber—from attribution to ensuring a properly graduated response—appear to cause decision-makers to want more and higher-quality information before action is taken.

5.2.4 Securitization: Nissenbaum Revisited

We introduced securitization in Chapter 1 and revisit it here with more details about the theory.

The Copenhagen School of International Relations developed the concept of securitization. Securitization is the process by which we come to accept concerns or events as important security issues, ones so important we consider them existential. Accepting the notion that securitization is a process means threats are not inherently security issues. Threats could be seen as public health challenges, as criminal behavior, or as risks managed through the private sector with contracts and insurance.

Consider airplane hijacking as a once criminal threat that is now securitized. In the 1970s and 1980s, criminals hijacked airplanes for financial gain. This was viewed as a crime and was on a low simmer for decades. The relative laxity of airport screening was a testament to the rarity of hijacking and its resolution involved money rather than lives. Airlines resisted security upgrades such as hardening cockpit doors and intense searching of bags in favor of “security theater” processes (e.g., asking passengers whether they packed their own bags).

Things had not changed much by September 11, 2001. Airport screening was relatively lax and most people probably thought hijacking a dangerous crime rather than a terrorist act. This may help explain why just one of the four planes crashed that day before reaching its target. The victims on that plane learned the attack was not financial but rather a form of ideologically motivated murder–suicide. They vigorously fought the hijackers, leading to the plane crash.

The searing experience of 9/11 caused societies worldwide to securitize the problem of airline hijacking and terrorism more broadly. No longer just a daring crime, hijacking became a threat to our collective existence. Thus, instead of treating hijacking as a crime that can be investigated and punished using an ex post law enforcement framework, we now have to take extraordinary, costly measures to stop it in advance, using a more intelligence-like ex ante framework. It becomes impossible to consider basic questions about the cost of these preventative actions. Consider that over one million Americans fly in a plane every day. All are asked to arrive at the airport two hours early for security screenings. The cost of such a requirement goes unquestioned.

Turning back to cybersecurity: Helen Nissenbaum has commented on the forces and the process by which we have accepted cybersecurity as an important threat.³² Her analysis is both a warning and paints a possible different path for how we understand and approach cybersecurity.

Securitization lends itself to the collective understanding of cybersecurity, because securitization requires one to convince the public to embrace a threat as existential. Nissenbaum points to cybersecurity expert Richard Clarke, who served in appointed positions in the President Reagan, George H.W. Bush, Clinton, and George W. Bush administrations, as one of the cheerleaders of securitization (recall that Clarke was Thomas Rid’s Cassandra of cybersecurity in Cyber War Will Not Take Place).

5.2.5 The Problem of Referent Object

As a first matter, securitization requires a referent object, an important target at risk of destruction. But, what is the referent object of cyberspace? Recall from Chapter 1 that cybersecurity has both a narrow meaning sounding in the integrity of individual computers and a broader one surrounding the collective values of society. Technical computer security cannot be the referent object, because we practically cannot be concerned with the integrity of every single computer on the Internet.

Question 5.2.5 — Cyber’s Referent Object. Since it is impractical to treat individual computer security as the referent object, what is the referent object of cybersecurity?

▄

According to Nissenbaum, securitizing cyberspace creates opportunities for opportunism. Because cyberspace’s referent object—the collective meaning of cybersecurity—is so vague and broad, powerful people might be able to use it to privilege their pet priorities as needing extraordinary protection. For instance, owners of intellectual property might weave a narrative that since we live in a knowledge society, threats to trade secrets or the trading of movies online threaten vital interests. Financial services companies will argue any hiccup in cyberspace could disrupt global capital markets.³³ Religious zealots might see cybersecurity as a tool to protect the moral fabric of society, using it to demand censorship. Authoritarian governments will expand the referent object to the minds and social consciousness of citizens, making the very distribution of ideas a matter of cybersecurity.

Securitization thus requires us to ask, “security for whom?” Without that critical inquiry, cybersecurity as a securitized value becomes dangerous because once securitized, referent objects enjoy the privileges of security interests. Civil liberties, ordinary public processes of policy development, and transparency lose their cachet when faced with claims of security.

Securitization requires an intelligence approach to the referent object. Thus, security demands compromises from the public, compromises the public cannot evaluate or even intelligently discuss because of the perceived need for secrecy. Managing a securitized threat means leaving the realm of law enforcement, with its focus on ex post punishment, and embracing intelligence approaches, with ex ante detection and preemption activities that rest uneasily with civil liberties.

5.2.6 Nissenbaum’s Alternative Vision: Cyberattacks Are Just Crimes

Nissenbaum’s article is among the most powerful expositions of a different, de-escalated conception of cybersecurity. She challenges the reader to consider conceptualizing even dramatic cyberattacks as crimes rather than as existential threats.

The cybersecurity as crime approach, in her account, emphasizes technical computer security and the protection of the collective by making individuals more resilient. In this approach, greater societal protection is an emergent property from insulating individual devices from attack.

Nissenbaum’s approach is harmonious with American civil liberties. We are presumed innocent and enjoy freedom from arbitrary surveillance in this account, whereas the securitized approach flips government’s posture, causing it to treat everyone as a suspect. The securitization approach means more surveillance and identification of individuals, because we have to know everyone’s actions and intents to preempt wrongdoing.

Question 5.2.6 — Nissenbaum and Rid. Do you see connections between Nissenbaum’s normative argument and Rid’s Cyber War Will Not Take Place?

▄

Nissenbaum signals a preference for the crime approach, arguing that we do not have the data to justify a securitized cyberspace. She also argues we should be skeptical of the data that do exist, as these can be framed opportunistically to support a securitization narrative.

Question 5.2.7 — A Tweak on Nissenbaum. Most cybercrime goes unreported, un-investigated, and unsolved. Perhaps calls for securitization flow from a systemic failure to police online mischief. If this mischief were to be policed, there would be knock-on effects for cybersecurity. For instance, it is well known that organized crime networks involved in hacking can be pressed into service by nation-states for political hacking. Might a breakup of those networks deflate the cyber power of Russia and other states that have cozy relationships with cyber criminals?

▄

5.2.7 A Response to Nissenbaum: Strategic Risks Do Exist

Nissenbaum’s observations are powerful in several domains. But, there is one domain—critical infrastructure—where we do have data to justify securitization. Security risks to critical infrastructure are existential in the terms defined by Ole Wæver: an attack on these assets could “undercut the political order within a state and thereby ‘alter the premises for all other questions.”’³⁴

Perhaps, the best way forward is to securitize elements of cyberspace that could lead to massive causalities, the undermining of democracy, or permanent environmental destruction. Under this approach, society would use powerful, preemptive tools to prevent critical infrastructure attacks. Attacks against other resources would be treated as mere crimes.

This approach could only work if these two categories of systems can be meaningfully separated, that is, if attacks on noncritical systems will not affect critical ones. It also forces us to really focus on what is important. As we’ll read later, the United States treats over a dozen sectors of the economy as critical. Not everything can be critical.

5.3 Economic Theory: The Tragedy of the Cybersecurity Commons

Economics provides a theoretical framework to conceptualize cybersecurity problems and solutions. The notion of “commons” has some explanatory power for cybersecurity problems.

Nobel Prize winner Elinor Ostrom describes the World Wide Web as a common pool resource (CPR).³⁵ CPRs are “natural and human-constructed resources in which (i) exclusion of beneficiaries through physical and institutional means is especially costly, and (ii) exploitation by one user reduces resource availability for others.”³⁶

The Internet appears to be a CPR. Indeed, it is difficult to exclude individuals from the Internet. But, the second factor, whether one user’s exploitation of the CPR diminishes others’ use (known as subtractability) is less clearly applicable to the Internet. At the margins, there is subtractability where one user deploys computer attacks that make it impossible for others to use the Internet. But, in general terms, the Internet’s network capacity is now so great that ordinary Internet use and even major attacks do not substantially reduce resource availability.

But, there is another sense that Internet use could be subtractable: quality. That is, the Internet may work just fine but be a service that no one wants to use. Malicious exploitation of the Internet and noxious uses of it, such as online harassment, may reduce the quality of the Internet as a CPR. Ostrom gives the example of jet skis. Of course, jet skis are awesome and fun for the operator, but for most everyone else, jet skis are loud and annoying, spoiling the calm of lakes and even imposing dangers on other waterway users. In a similar way, we can conceive of some Internet mischief as being entertaining for trolls, while also degrading the experience for most users.

Definition 5.3.1 — Common Pool Resource (CPR). A resource, such as a lake, that is both (1) difficult to exclude others from using, and where (2) one person’s use comes at some cost to other users. It is difficult to exclude people from a lake, and once a user catches a fish, that fish is not available to others. The degree to which one person’s use of a CPR diminishes others’ use is subtractability.

▄

CPRs can suffer from lack of investment and be degraded by rational people acting in their own self-interest in a way that advantages no one. Ostrom focused on fisheries and water resources, arguing that resource collapse is more likely with “very large, highly valuable, open-access systems when the resource harvesters are diverse, do not communicate, and fail to develop rules and norms for managing the resource.”³⁷ Other factors associated with collapse include resources with unclear boundaries, resources that are movable, groups that lack leadership experience or lack a history of shared norms, and groups that lack autonomy to make decisions about the resource.

Question 5.3.1 — Ostrom and Cybersecurity. Turning to the Internet, could Ostrom’s framework be used to consider cybersecurity development and whether the Internet is likely to fail as a CPR?

▄

Ostrom’s framework for the management of CPRs points in different directions. The Internet is a large, highly valuable, open-access system, with unclear boundaries and contested ideas about whether boundaries exist at all. However, problems in Internet security are observable and measurable. Individuals do communicate about these problems, and an expert core of leaders work together to address them. Despite the size and importance of the Internet, there is a surprising level of decision-making autonomy in governance groups.

Ostrom’s scholarship points to the value of local decision-making in managing CPRs. Distantly imposed solutions tend to not fit the local circumstances of how CPR problems articulate themselves. James Scott, in SEEING LIKE A STATE comes to similar conclusions, finding that central control rarely contemplates local needs and that individuals using clever trickery find ways around centralized control.³⁸

Question 5.3.2 — Ostrom’s Local Control. What does the notion of local decision-making mean for the Internet, given that the Internet Protocol (IP) is in effect a worldwide governance rule? Is there room for local control elsewhere in the technical and policy protocols?

For some nations, local governance is profoundly illiberal. Nations use sovereignty as a justification for attacks on confidentiality, integrity, and availability. How do we stop local governance from pursuing illiberal goals?

▄

5.3.1 The Free Problem

One puzzle presented by Ostrom is why the Internet is not better cared for, because technically, much of it is privately owned and managed. Author Hoofnagle and Jan Whittington suggest lack of care comes from the incentive structure of “free” business models.³⁹ Free creates several interrelated quality dynamics: once the consumer is anchored to a zero price, it is difficult to get the consumer to ever pay. Free degrades quality; in fact, offering a lesser-quality service “free” is a standard tactic to undermine a competitor.⁴⁰ And finally, free means someone else pays; that someone else is the quality arbiter.

Turning to Internet platforms, consumers have been trained on the free model, and so, platforms have to squeeze value out of anything other than user payment. This leads to several bad dynamics. For instance, as Shoshana Zuboff has explained, platforms can monetize any kind of information, including profoundly harmful content.⁴¹ Platforms also know that most of the user-generated content on their systems is of low quality.

Platform owners know they can make a lot of money with schlock. This is because the quality arbiters are buyers of advertising whose terminal goal is to sell products rather than deliver quality content. These quality arbiters do not care so much about what you are reading so long as you see their ads.

Zuboff explains that platform owners are generally indifferent to user activity as long as it is on the platform. So the economic incentives are to amass the largest audience and keep them locked in because that results in the most advertising opportunities. Through surveillance and ads, the platform owner can make money even if the content is low quality (e.g., disinformation), awful (e.g., hate speech and mugshot sites), insecure (malvertising) or even illegal (e.g., child sexual abuse material and IP theft).

And there is so much information, good and bad, that attempts to remediate the information quality problem rob the platform of its profitability. That is, actually filtering low-quality information is labor intensive. Some companies deploy advanced machine-learning tools to filter, but even sophisticated companies like Facebook/Meta have to employ thousands of human reviewers to manage the filtering process.

Hoofnagle and Whittington argue that free business models are at the root of the pollution of the Internet with hate speech, fake news, defamation, and pornography. Under this view, the Internet’s quality problems (including a lack of security) are not technical ones, but rather a business model problem.

The question then arises: how could one get Internet users to start paying for content, once they have had it free for so long. One comparison comes from water and our perceptions of its quality. When the authors were children, people drank from water fountains. Water was free. Sometime in the 1990s, consumer preferences started to change and public drinking fountains became distasteful. In some circumstances, lead was detected in public fountains. People started drinking bottled water, ordering it like one does wine at restaurants, and, of course, started carrying around status-symbol water containers. Water went from being free and public to expensive and private; in the process, we started paying attention to the quality of water.

Newspapers had the opposite trajectory in the early 2000s. They went from being subscription subsidized to free and advertising supported. Newspapers also joined the public markets, but at the same time, lost classified advertising revenue to websites.

Newspaper publishers deliberately took up the free strategy, reasoning that they would make up for subscription loss on mass advertising revenue. But, collectively, the shift resulted in a collapse of the industry, with thousands of newspapers folding in just 15 years. The Pew Research Center found in 2018 that subscription rates (print and digital) were the lowest since 1940.

Adding to that, newspapers used to control their advertising. Most newspapers screened their advertising for falsity and poor taste. But, in the switch to adtech, newspapers lost control of advertising quality and platforms captured half the revenue from ads. We now have free news but the quality arbiter is tethered to the same model as social network platforms—clicks, not quality.

The point of all this is: once the consumer expects a product “for free,” it is difficult to get them to pay. Since the only prospect for pay is ad-clicks from platforms, news media perform for that metric, leading to clickbait and low-quality news and lots of opportunity for disinformation. For media to reform, it needs a quality revolution similar to what water experienced: people need to be disgusted by the free version and be converted into consumers seeking quality and even status.

How do web platforms deal with the pathologies of a CPR? Companies like Facebook and Apple create “walled gardens,” members-only, more private clubs on the web. These in effect impose the order of private management on a disorderly system. Facebook can monitor its users and punish or exclude them. Apple’s App Store establishes a high bar for entry and security policy violations mean one’s software is weeded from the garden.

Another more inclusive approach is to create a walled-garden, top-level domain for important web services. Consider a top-level domain called.secure. It could limit registrations to banks and Fortune 1,000 companies. Such companies could pay for extra vetting, agree to only send encrypted email, have adequate cyber insurance, pledge to patch their services against vulnerabilities in a timely way, and agree to limit services placed on .secure to just those that are customer facing in order to reduce vulnerabilities.

Question 5.3.3 — .secure. Is this a good idea? What are the upsides and downsides? What would have to go right to avoid going wrong?

▄

5.4 The Public Health Approach

Deirdre K. Mulligan and Fred B. Schneider suggest an approach that is something like a mirror to Nissenbaum’s warning about cybersecurity and also captures Ostrom’s public goods perspective: the duo suggest that we embrace cybersecurity as a collective, public good, but that we take a public health perspective. They explain, “Public health is a logical outgrowth of disease detection and prevention mechanisms, which transformed societal perception of health from a primarily private concern to a concern of the collective. Ultimately, this development led to the perception of public health as a public good the government should enable.”⁴²

Definition 5.4.1 — Public Goods, Private Goods, Club Goods. Public goods include activities such as national defense and education. Formally, public goods are those things that are non-rivalrous and non-excludable.

Rivalrous goods are those that are diminished by a person’s consumption of it. For instance, the fish caught in Ostrom’s waterways cannot be enjoyed by others. One person’s enjoyment prevents another person’s use of the good. But, some goods like education are non-rivalrous, because no one person’s education diminishes the ability of others to also learn.

Non-excludable goods are those we cannot prevent others from enjoying, like breathable air, and the waterways that Ostrom wrote about.

Private and semiprivate properties, however, are excludable. A private home is a private good because it is both rivalrous and excludable: the homeowner’s enjoyment of the home reduces the utility of the home to others, and the homeowner has a right to exclude guests.

Club goods are an interesting intermediate category: these are non-rivalrous but excludable. For instance, movie theaters can allow masses of people to enjoy a film, but, at the same time, exclude those who do not pay.

Club goods can be an effective security strategy because they harness the power of the private sector to exclude, while allowing members to fully enjoy a shared resource. On the Internet, “walled gardens” are an example of a club good strategy for security. In a walled garden, the provider can exclude bad actors, while allowing subscribers to share access to Internet resources.

But, it then becomes obvious that liberal governments, which are bound by duties of equal protection and due process, have difficulty executing club good strategies. Also, club good strategies operate in tension with values such as inclusion.

The public health frame has some attractive advantages. Public health attempts to remove the stigma from illness and this, too, has a parallel in cybersecurity: everyone has security breaches just as everyone falls ill from time to time. Instead of treating illness as some personal morality issue, public health treats people as needing help. Turning to cybersecurity, the Mulligan/Schneider view shifts from a punitive compliance approach to one where the terminal of regulators is to promote overall network health and hygiene.

Question 5.4.1 — Public Good. Do you agree that cybersecurity fits the mold of a public good? That is, the notion that cybersecurity is non-rivalrous and also not excludable?

▄

To reach those terminal goals, there are consequences. On the basic level, there is education about public cybersecurity risks and structured disclosures about incidents. There are precautionary obligations. Just as children must be vaccinated, operators of computing services must spend time and money making their computers safe for a public network. This would mean patching and responsible maintenance of the computers.

Surveillance is a major part of public health. Dozens of viral infections must be reported to the Centers for Disease Control and Prevention, from Anthrax to Zika and sexually transmitted diseases. This means that if one tests positive for gonorrhea, one’s contact information is forwarded to state and federal authorities, and a case worker is assigned to help the patient track down sexual partners and notify them. In public health emergencies, the state can take fantastic, martial-law-level steps to isolate and treat the sick. This includes forced treatments.

Question 5.4.2 — Public Health Implications. What other implications travel with the public health metaphor? Why might businesses resist the metaphor?

▄

Turning to computing, a public health framework would require some ability to contact a computer owner and get them to remediate a problem or remove a computer from the network.

In the United States, Internet service providers have resisted such obligations. At any given time, about 5% of computers are infected by botnets. Internet Service Providers (ISPs) know this because of the peculiar traffic botnets cause on a network. The situation is likely to get worse as consumers fill their homes with Internet of Things devices with weak security.

But, ISPs don’t want to tell customers about infections nor disconnect them from the network. Why? Just imagine the problem from the ISP’s perspective—picture yourself calling a subscriber and telling the user a computer on their connection is infected. The customer might think they are being swindled, or simply misunderstand the purpose of the call. The customer might have no capacity to address the infection, and thus, the ISP would have to find some way to do remote computer support for the customer’s (potentially dozens of) devices. The ultimate solution in some cases might involve the ISP telling the user to disconnect and throw away impossible-to-secure devices! Taken together, the process is likely to annoy customers, putting the ISP at a competitive disadvantage against those that don’t do the cleanup.

As a student, you are probably subject to such a regime—many campus information technology departments require students to prove their computer meets a basic level of security before it can connect to the network. Some campuses regularly scan users’ computers and remove them from the network if the computer is infected.

Definition 5.4.2 — Botnet. Botnets are collections of compromised computers used by others to perform attacks. Internet of Things devices, such as networked cameras and doorbells, can be part of a botnet. Such compromised devices may work properly, and so, the user may have no idea about the infection or just not care.

Germany has developed an innovative solution to the ISP botnet problem. It funds a public/private partnership called Botfrei (https://botfrei.de/) that provides support to users with infected devices. Botfrei enables ISPs to refer the user to security experts, and thus, the customer does not blame their security problem on the ISP.

There are other benefits to a public health model. The public health model accommodates variegated responses to security problems based on their severity. A public health model can start with educational interventions before shifting to more coercive ones. A society pursing a public health approach could shape incentives by creating liability shields for good practices, by giving subsidies to low-resource actors, and even by encouraging professionalization of software engineers.

Public health approaches do have consequences for civil liberties—the COVID-19 pandemic proved that! What would public health mean for computing? Mulligan and Schneider explain “…a doctrine of public cybersecurity could dictate responses that deprive individuals of actions, but only if those responses benefit the collective. Punishments solely for retribution could not be part of a public cybersecurity doctrine.”

Presumably, Mulligan and Schneider would desire a formal separation between public cybersecurity-promoting activities and coercive law enforcement. But, we all know those separations sometimes are permeable—and rightly so. The child who checks in to the hospital with a broken arm will primarily be treated as a patient, but the physicians will inquire about abuse and report suspicious findings to law enforcement.

Question 5.4.3 — The Weber Critique. Political scientist Steve Weber retorts: “…if Internet society wants to treat many cybersecurity issues as public goods, then what public health metaphors demonstrate is that it may be necessary to accept a higher level of coercion on behavior than Internet society is accustomed to. That will seem to many a counter-cultural argument that will cause profound friction, particularly with regard to the ‘free and open’ cultural trope that has emerged to supplant techno-libertarian ideologies of an earlier era. It may also run up against resistance from contemporary ‘innovation’ discourse, which generally portrays innovation as something desirable that individuals and private firms achieve, and coercive authority tends to quash.”a

▄

a Weber S. Coercion in cybersecurity: what public health models reveal. Journal of Cybersecurity 2017; 3:173–83.

5.5 Gerasimov and “Hybrid War:” Information Domain Revisited

…wrong may be done…in either of two ways, that is, by force or by fraud, both are bestial: fraud seems to belong to the cunning fox, force to the lion; both are wholly unworthy of man, but fraud is the more contemptible. But of all forms of injustice, none is more flagrant than that of the hypocrite who, at the very moment when he is most false, makes it his business to appear virtuous.

— Cicero⁴³

A prince…being compelled knowingly to adopt the beast, ought to choose the fox and the lion; because the lion cannot defend himself against snares and the fox cannot defend himself against wolves. Therefore, it is necessary to be a fox to discover the snares and a lion to terrify the wolves.

— Machiavelli⁴⁴

Chapter 1 introduced the issue of whether cybersecurity should include “information domain” concerns. Here, we revisit that topic through the lens of the so-called “Gerasimov Doctrine.” The Gerasimov Doctrine refers to a curiously titled article by General Valery Vasilyevich Gerasimov, a close advisor to Vladimir Putin.⁴⁵

The Gerasimov article nicely synthesizes the concept of “hybrid war.” As such, the article is not new nor does it propose a doctrine. The article instead reinterprets ordinary politics as a form of soft conflict.

Some background brings Gerasimov’s thought fully into light: Russian President Putin was terrified by the Arab Spring revolutions and feared popular protest could be fanned into a revolt that resulted in him being shot in the streets. Gerasimov’s introduction sets up the fear:

In the 21st century we have seen a tendency toward blurring the lines between the states of war and peace. Wars are no longer declared and, having begun, proceed according to an unfamiliar template.

The experience of military conflicts—including those connected with the so-called coloured revolutions in north Africa and the Middle East—confirm that a perfectly thriving state can, in a matter of months and even days, be transformed into an arena of fierce armed conflict, become a victim of foreign intervention, and sink into a web of chaos, humanitarian catastrophe, and civil war.⁴⁶

Gerasimov continues:

The focus of applied methods of conflict has altered in the direction of the broad use of political, economic, informational, humanitarian, and other nonmilitary measures—applied in coordination with the protest potential of the population.

It’s worth taking a moment to consider how radical Gerasimov’s view is. Under this view, the structures Americans consider inherent in democracy—charity, news reporting, public health, diplomacy, and advocacy by human rights groups—are all just covers for US aggression!⁴⁷ In this view, there is no earnest engagement in the world. Instead, engagement is really just soft conflict. If you have ever volunteered your time to help people in need in another country, you are (perhaps unwittingly) a malcontent planting seeds that the United States and its allies can exploit later. (Thank you for your service?)

If we believe Gerasimov here, hybrid war is an American invention. And going further, any liberal enlightenment activity is a form of subversion. Charles Bartles observes, “[Gerasimov’s] article and Russia’s 2014 Military Doctrine make apparent that he perceives the primary threats to Russian sovereignty as stemming from U.S.–funded social and political movements such as color revolutions, the Arab Spring, and the Maidan movement.”

The Gerasimov article gives context for why Russia would invest so heavily in disinformation and kulturkampf in the United States: the information domain allows Russia to interfere with America without triggering an armed response.

5.5.1 The US Reaction

Consistent with almost a century of doctrine, the United States ignored Russia’s disinformation efforts as that country’s power and influence declined. But, with the 2016 election, the United States awoke to the potential for information to be weaponized and have a destabilizing effect. Many people made sense of this by pointing to Gerasimov and declaring that something new was afoot.

But in reality, for Russia, the Internet was just another medium through which its tactics could be directed. A cascade of problems in the West, from the collapse of media organizations to “end of history” narratives proposing a kind of inevitability of a liberal economic order, caused us to overlook disinformation and trust that it would only have effects at the margins.

The history of twentieth-century disinformation tactics are detailed in Thomas Rid’s ACTIVE MEASURES.⁴⁸ For Rid, active measures are a category of misinformation. Misinformation is a broader category, because it can include many different kinds of problems, including information that is just mistaken.

Active measures, on the other hand, are deliberate, planned efforts conceived of and executed by bureaucracies to reshape reality. They can have a corrosive effect on populations and even result in violence. In Rid’s account of the phenomenon, the United States had the most aggressive active measures campaigns in the 1950s, directed at the East Germans. But, then the United States de-escalated, while the Russians and East Germans escalated active measures.

si irascare, adgnita videntur

One well-known active measure comes from a Russian effort to link the emergence of HIV-AIDS to American biological warfare experimentation. The Russians seeded stories in foreign media reporting that US scientists created HIV as part of a weapons program. That story was picked up by western media and repeated (something to keep in mind as we struggle with the coronavirus).

Perhaps, the HIV disinformation measure was motivated by projectiona —it was the Russians after all that had an illegal biological/chemical weapons program. This was revealed by the Sverdlovsk anthrax incident.

The New York Times published an engaging set of videos about this disinformation: Adam B. Ellick and Adam Westbrook, Operation InfeKtion (https://www.nytimes.com/2018/11/12/opinion/russia-meddling-disinformation-fake-news-elections.html) (2018).

a Meaning of si irascare, adgnita videntur: if you resent something, you probably recognize it in yourself.

The Russians intuited how they could make Americans dance to the music they provided. Using simple spear phishing, the Russians extracted documents that were embarrassing to the Democratic Party and Hillary Clinton and dumped them online in a way reminiscent of the Wikileaks disclosures. The paucity of independently generated news meant Russian trolls could flood social media with this charged content, amplify it through fake accounts, and, in turn, convert these messages into original news stories as the messages started “trending” and appeared to be discussed amongst millions of people.

In fact, the Russians could just dump the raw information online and various bloggers would sort through it to find information they thought damning. One bizarre outcome of our information democracy was “Pizzagate,” a conspiracy woven from multiple messages discussing the ordering of cheese pizza by Clinton campaign staff. Conspiracy theorists alleged “cheese pizza” was really a reference to child sexual abuse. It didn’t help that one restaurant discussed was Chevy Chase’s Comet Ping Pong (CP is a common abbreviation for child pornography and, coincidentally, similar to the initials of the restaurant). The story was so compelling to some, an armed vigilante traveled to Comet and fired an AR–15 in the restaurant in his attempt to free the children alleged to have been held in the basement by Clinton co-conspirators. Years later, another vigilante showed up and started a fire. Comet Ping Pong does not even have a basement and all associations of this sort were completely debunked by numerous agencies.

As we consider whether to include information domain problems in “cybersecurity,” we have to keep China and Russia’s intentions in mind. Both nations and their illiberal allies see enlightenment discourse as a fundamental threat and an illegitimate act motivated by guile rather than goodwill. This is why Russian trolls were comfortable with drumming up support for separatist movements of all flavors, from both the left and the right wing (in the 2016 election, Russians posed as “Blacktivists” and libertarians seeking succession from the federal government). The general strategy is to present the ambiguities and complexities of liberal pluralism as fundamental conflicts—in Gerasimov’s words, “the transformation of differences into contradictions.” This stokes grievance and dogged separatism. Russia has used the tactic broadly to support the Basque, Catalonian, and British Brexit movements. To the Russians, none of these ideas is serious or worthy of genuine adherence, they’re all simply useful.

We have to ask ourselves—what are the consequences if all our political activity is classified as “war?” Do those consequences form the best argument about keeping the information domain out of “cybersecurity?”

We began this section with the conflict between the views of Cicero and Machiavelli. Can we simply be the lion in modern times? Or does hybrid war require us to be the fox as well? If we ourselves engage in Russia-like disinformation, we fall into that category that Cicero most detested.

5.6 Barlowism as Theory

For this last section of the chapter, we make an audacious argument: Technology optimism is in effect a theory of the Internet and cybersecurity. We call this “Barlowism,” a series of conclusions about Internet technologies that are colored by optimism and a lack of historical context. Barlowism is not analysis but rather a style of thinking about technology that continues to animate popular and even expert opinion. Barlowism leads to three notions about the Internet: technology utopianism, the Internet as “placeless,” and James Scott’s concept of “high modernism.” Each of these notions is problematic, yet, many in the policy realm adhere to them in a literal sense.

5.6.1 Technology Utopianism: The Internet as Democratizing

Inherent in utopian theories is the notion that technologies are political. For instance, technology optimists think the Internet is inherently democratizing.

Whether technologies are political is explored in depth by Langdon Winner in a 1980 article, Do Artifacts Have Politics? Winner argued that “technical things have political qualities.” This is different from the popular notion that “technologies are seen as neutral tools that can be used well or poorly, for good, evil, or something in between,” he wrote.⁴⁹ Winner used the word “artifacts” to broadly refer to technologies.

Technology neutrality has a powerful hold on thinkers in our society, but if you listen carefully, you will hear people make technology neutrality arguments when it suits them and then switch to a political technology argument when discussing the Internet. The technology utopians characterize the Internet as a political technology—one that promotes democracy—while simultaneously taking a technology neutrality posture.

Technology neutrality is an appealing, intuitive outlook. After all, we could use our cars as a “tool” to get to work or to cause mayhem. The technology-neutral thinker thus observes that artifacts are just tools wielded by individuals who decide how to use them. This seems correct because the alternative view appears to be technology determinism: the notion that our tools control our futures.

But, Winner was saying something more complex. Technology changes society and relationships such that it does not grant complete autonomy nor complete control. Winner argued that tools shape both what we think is possible and the broader political landscape.

In Winner’s view, some technologies are “inherently political” for two reasons. First, technologies can settle contested issues. For instance, let’s say that Internet users prefer anonymity but system administrators prefer perfect attribution. Technology can “solve” this problem by settling on one side of the debate, perhaps by the system administrators requiring everyone to sign in with their driver’s license number.

The second way technologies can be political is that they might require a certain kind of social order. To make this point, Winner contrasts nuclear power and solar energy. Nuclear power is simply too dangerous to be entrusted to the homeowner. Instead, we have militarized institutions that guard nuclear material, and even with those safeguards, nuclear reactors can create fantastic risks.⁵⁰ Solar power, on the other hand, requires no guards, presents no opportunities for terrorists, and isn’t fundamentally dangerous.

As computer networks were adopted and the personal computing revolution started, visionaries like MIT’s Ithiel de Sola Pool and John Perry Barlow predicted the technology would promote democratization, individual empowerment, and exclusion of government power and action.⁵¹ In fact, the early Internet did enjoy a “honeymoon period of apolitical governance thanks to the victory of the liberal order in the Cold War.”⁵² These ideas, combined with enthusiasm about globalism, formed a strongly held, optimistic assumption that the Internet would promote global freedom and that governments could not control it.⁵³ Here is the text of John Perry Barlow’s A Declaration of the Independence of Cyberspace, an organizing thought piece for advocacy groups like the Electronic Frontier Foundation.

Governments of the Industrial World, you weary giants of flesh and steel, I come from Cyberspace, the new home of Mind. On behalf of the future, I ask you of the past to leave us alone. You are not welcome among us. You have no sovereignty where we gather.

We have no elected government, nor are we likely to have one, so I address you with no greater authority than that with which liberty itself always speaks. I declare the global social space we are building to be naturally independent of the tyrannies you seek to impose on us. You have no moral right to rule us nor do you possess any methods of enforcement we have true reason to fear.

Governments derive their just powers from the consent of the governed. You have neither solicited nor received ours. We did not invite you. You do not know us, nor do you know our world. Cyberspace does not lie within your borders. Do not think that you can build it, as though it were a public construction project. You cannot. It is an act of nature and it grows itself through our collective actions.

You have not engaged in our great and gathering conversation, nor did you create the wealth of our marketplaces. You do not know our culture, our ethics, or the unwritten codes that already provide our society more order than could be obtained by any of your impositions.

You claim there are problems among us that you need to solve. You use this claim as an excuse to invade our precincts. Many of these problems don’t exist. Where there are real conflicts, where there are wrongs, we will identify them and address them by our means. We are forming our own Social Contract. This governance will arise according to the conditions of our world, not yours. Our world is different.

Cyberspace consists of transactions, relationships, and thought itself, arrayed like a standing wave in the web of our communications. Ours is a world that is both everywhere and nowhere, but it is not where bodies live.

We are creating a world that all may enter without privilege or prejudice accorded by race, economic power, military force, or station of birth.

We are creating a world where anyone, anywhere may express his or her beliefs, no matter how singular, without fear of being coerced into silence or conformity.

Your legal concepts of property, expression, identity, movement, and context do not apply to us. They are all based on matter, and there is no matter here.

Our identities have no bodies, so, unlike you, we cannot obtain order by physical coercion. We believe that from ethics, enlightened self-interest, and the commonweal, our governance will emerge. Our identities may be distributed across many of your jurisdictions. The only law that all our constituent cultures would generally recognize is the Golden Rule. We hope we will be able to build our particular solutions on that basis. But, we cannot accept the solutions you are attempting to impose.

In the United States, you have today created a law, the Telecommunications Reform Act, which repudiates your own Constitution and insults the dreams of Jefferson, Washington, Mill, Madison, DeToqueville (sic), and Brandeis. These dreams must now be born anew in us.

You are terrified of your own children, since they are natives in a world where you will always be immigrants. Because you fear them, you entrust your bureaucracies with the parental responsibilities you are too cowardly to confront yourselves. In our world, all the sentiments and expressions of humanity, from the debasing to the angelic, are parts of a seamless whole, the global conversation of bits. We cannot separate the air that chokes from the air upon which wings beat.

In China, Germany, France, Russia, Singapore, Italy and the United States, you are trying to ward off the virus of liberty by erecting guard posts at the frontiers of Cyberspace. These may keep out the contagion for a small time, but they will not work in a world that will soon be blanketed in bit-bearing media.

Your increasingly obsolete information industries would perpetuate themselves by proposing laws, in America and elsewhere, that claim to own speech itself throughout the world. These laws would declare ideas to be another industrial product, no more noble than pig iron. In our world, whatever the human mind may create can be reproduced and distributed infinitely at no cost. The global conveyance of thought no longer requires your factories to accomplish.

These increasingly hostile and colonial measures place us in the same position as those previous lovers of freedom and self-determination who had to reject the authorities of distant, uninformed powers. We must declare our virtual selves immune to your sovereignty, even as we continue to consent to your rule over our bodies. We will spread ourselves across the Planet so that no one can arrest our thoughts.

We will create a civilization of the Mind in Cyberspace. May it be more humane and fair than the world your governments have made before.

Davos, Switzerland February 8, 1996

Question 5.6.1 — Barlow’s Vision. Things didn’t turn out how Barlow described them. But, could we imagine a legal and policy framework that embraces this vision? Is there a series of policy drivers that cause governments to abandon control of the Internet? What would the alternative to government involvement look like?

▄

Barlow’s sense of Internet self-actualization left out the role of government and Westphalian nation-state interests. The zeitgeist of Barlow’s moment envisioned a future where governments played a smaller role in life, where people negotiated through contracts and necessary services shifted from governments to non-profits. In this plan, Barlow seemed to overlook the Internet’s US military origins. Barlow warned governments of all kinds that “You have no sovereignty where we gather” in cyberspace. Thus, Barlowian thought suggests that governments are too simple to understand, much less regulate, Internet behavior.

But, Barlow’s idea is both deeply mistaken and ahistorical, a signal of his lack of expertise in the history of technology. Other technology experts such as Ron Deibert and Mary Manjikian looked at network technologies and came to different conclusions about likely outcomes.⁵⁴

The tools Barlow used to compose his message and travel to Davos, where he wrote it, were inventions made and mastered by governments. Even the notion of the “bit,” the fundamental datum of computing, was defined by Claude Shannon and published in a classified paper!⁵⁵

Future Perfect

Throughout the history of innovation, technology optimists have declared that new technologies will bring about a gentler future, one that results from greater interconnection among people, leading to deeper understanding and an end to war and struggle. Consider these examples:

Electric telegraph: widely proclaimed to advance social understanding and thus lessen world conflict.

Steam power: would eliminate drudgery, bring about a life of leisure.

Electricity: same.

Nuclear power: would enable a future where energy was not only clean but also “too cheap to meter.”

Jet travel: as with the telegraph, the possibility to fly great distances was thought to advance cultural understanding.

Television: Daniel Boorstin celebrated its power “to disband armies, to cashier presidents, to create a whole new democratic world.”

The Internet: in addition to John Perry Barlow’s confused pronouncements about the Internet, MIT Media Lab director Nicholas Negroponte claimed the Internet would lead to world peace.

The personal computer: Negroponte spearheaded an initiative called One Laptop Per Child to bring inexpensive computers to children in the developing world, reasoning that the devices would create universal access to knowledge.a

Social media: Facebook’s Mark Zuckerberg is known for—as late as 2016—claiming that Facebook would promote world peace using similar logic as nineteenth-century telegraph advocates.b

We live in times where technological advancement is increasing in speed, but despite many historical examples of technology development and adoption—going back to Plato—technologists grasp at narratives of world peace and a better future. But, in all of these examples, the technologies were quickly put to darker uses, from crime (indeed all of these technologies create new kinds of opportunity for crime) to use in war, and world peace has yet to emerge.

It would be wonderful if serious problems like war could be solved with a technology. But, as much as we remain optimistic about technology, we remain moored to human failings.

a Ames MG. The Charisma Machine: The Life, Death, and Legacy of One Laptop per Child. Cambridge, MA: The MIT Press, 2019.

b Matyszczyk C. Zuckerberg claims more Facebook sharing leads to world peace, 2016 Feb. Source: CNET.

5.6.2 Utopia as No Place, But as Organic

Barlow seemed to conceive of cyberspace as placeless, or as a new and different space out of the reach of traditional nation-states. Interestingly, the word utopia itself comes from Greek roots of “not” and “place” with a Latinized -ia ending.

As we have seen, cyberspace certainly does have a physical place; it cannot exist without physical servers to create the layered environment of the Internet, and the abstraction layers Barlow wrote about.

Governments can exercise hard power on those physical servers or connections to them, or by limiting access to marketplaces.⁵⁶ Furthermore, we will see that where servers—physically—not only gives nations targets but are also a source of strength, in that having fulsome Internet architecture makes more cyberattacks possible. Cyber power—if we take the concept seriously—means governments absolutely have the ability to project their interests on the Internet.

A related strand of thought presented cyberspace as organic and as having properties similar to ordinary life forms.⁵⁷ Commenting at the beginning of the commercial Internet, John Gilmore said “The Net interprets censorship as damage and routes around it.”⁵⁸ In a narrow sense, and in the context in which Gilmore spoke regarding early attempts to censor Usenet, Gilmore was correct. TCP/IP has mechanisms to ensure packets reach destinations even when intermediate servers have been turned off. However, there is no “interpretation” occurring. The Internet cannot interpret or know anything; it simply reacts to a failure mode where packets do not reach their destination. In fact, one could cause the Internet to “interpret” damage differently and route traffic to the wrong place or no place.⁵⁹ And while it is difficult to perfectly censor the Internet, governments have made great strides to do so using both technology and policy levers. Where those fail, desperate governments can still censor people by threatening them or their loved ones.

5.6.3 High Modernism and Authoritarian High Modernism

A third notion, sometimes held simultaneously by adherents to the first, is “high modernism.” High modernists believe developments in technology can reorganize and perfect social order.⁶⁰

But, perfect social orders always require coercion of some kind. In modern times, Facebook and Google are the strongest progenitors of high modernism. Facebook is attempting to perfect a social order through its platform, which should be understood as a kind of private, walled garden, completely controlled by Facebook, where, for security of the community, one has to reveal their true identity at all times. Google’s high modernist intentions are more ambitious; it is attempting to architect a similar kind of order in “smart cities,” urban infrastructure that automatically responds to individuals’ behaviors and needs. Many smart city capabilities, such as efficient traffic routines, sound wonderful. But, to be clear, for these systems to work, individuals must never violate the system’s rules. One cannot jaywalk in a smart city where traffic lanes reverse direction in unpredictable ways.

If one adheres to a strong version of the first notion covered in this section—technology utopianism—the spread of Internet technologies to repressive states will have a destabilizing but liberalizing effect. Governments, too, confused about technologies, will awkwardly but ineffectively resist. Adherence to the high modernism narrative suggests something different: that governments absolutely can achieve their vision of perfect social order through technology.

No, We Are Not Technology Determinists

Why go on with this long critique of Barlow? Barlow’s utopian thinking still illuminates the worldview of policymakers. This is a problem because optimism is not analysis. Adherence to Barlow’s optimistic assumptions skewed policy debates for decades, causing policymakers to miss a fundamental dynamic in technology.

Barlow predicted that if the Internet were just let alone, a new freedom would emerge. But, the last 30 years have shown that the Internet’s impact is dependent on implementation specifics, the social contexts in which the technology is deployed. In liberal democracies, cyberspace largely erased restrictions on speech, commerce, and intellectual property.

In nations such as China, the government has spent significant effort to transform the Internet from a technology of freedom into a technology of control—and has been largely successful.

In free nations, people use face recognition to secure their mobile phones. In Russia, the same technology rounds up protesters. Far from liberalizing, digital technologies deployed in China and Russia have strengthened autocratic political institutions.

Technology itself does not guarantee liberal or illiberal outcomes. Instead, technologies are filtered through the values of a society. The same technologies that might secure and make free the citizens of a liberal society can attack and cage the people of an autocracy.

Barlow also grossly underestimated governments’ ability to master Internet technologies. Twenty years after his essay, repressive regimes architect their networks to enable elites to enjoy Barlowian cyberspace while nearly perfecting censorship and surveillance of common people. Repressive governments even turn social media into organs of repression, directing mobs to spew ethic hate toward government opponents.

On a larger level, techno-libertarian focus on technology alone as the savior of freedom is a dead end. Techno-libertarianism depends on assumptions about technology that are overlooked or assumed away by its engagé thinkers—namely, the enabling role of the state. Computing technologies can change, and like all other technologies, they tend to depend on government-provided collective goods, such as respect for private property, electricity, and policing. As Ronald Deibert observes, the techno-libertarians’ highly individualistic “ideological outlook has rarely translated into concerted political action beyond support for unencumbered networks, strong encryption, and freedom of speech.”⁶¹ The realist outcome of the Barlowian fantasy is governments with cyber power, and a private sector slanted toward monopoly.

Exercise 5.1 — Country Assessment: Theory. Cybersecurity is informed by deterrence theory, security studies, economic views, the public health approach, the notion of “hybrid war,” and the ideologies masquerading as theory: optimism, no place, and high modernism. Now is the time to ask whether this theory is helpful.

Please revisit your country cybersecurity assessment from Chapter 4 and look at it through a new lens: please write a memo (2–3 pages) probing whether any of the theoretical frameworks studied in class provide explanatory or predictive power for your nation. It is acceptable for the answer to be that theory does not explain the nation’s actions, but be sure to say why. You need not cover all the frameworks in the chapter (indeed, the material on high modernism may simply not apply to most nations).

There is a lot of material in the theory chapter. One way to manage this assignment is to examine all the headings and key concepts. For instance, taking the deterrence section, one might ask:

What is the nation deterring?

Is it using deterrence by punishment, by cost imposition, and/or benefits denial?

Is it using compellence?

What kind of threats is it making?

Are they measured and deterrent or do they appear disciplinary or extortionate?

How does the nation make threats credible?

Does Healey’s signaling framework apply?

Is there evidence of strategic irrationality?

Does the nation attempt to entangle with norms?

Are these hostage-exchange-like aspects of policy?

Does the nation project cyber “power” and if so how?

A similar checklist could be developed to explore the security studies. For instance, is your studied nation engaged in a security dilemma with its adversaries? Is it developing capabilities to counter its adversaries? Are these leading to escalation or to uncertainty and no action? Has the nation articulated something like an escalation ladder?

In the Nissenbaum section, one might explore whether cybersecurity has been “securitized” and what “referent object” is being protected.

In the public health approach sections, you might ask whether your nation has any public-health-type solutions, like Germany’s BotFrei.

▄

5.7 Conclusion

This chapter presented the leading theoretical approaches to cybersecurity from several disciplines. Cybersecurity continues to be undertheorized. That is, a strongly predictive and syncretic explanation of cybersecurity has yet to emerge. This is not a failing of the academics working in the space, but rather caused by the expansive scope of cybersecurity problems, and the inherent wickedness of cybersecurity as a problem. One cure for the quandary is to decompose cybersecurity into smaller challenges and see whether theory helps analyze a subset of cybersecurity problems, such as cybercrime or the security challenges of critical infrastructure.

Cybersecurity’s complexity and resistance to theory should not end our efforts. Consider that it took many years to develop coherent theories for difficult challenges such as nuclear deterrence. Theory has a role to play in cybersecurity and we expect theoreticians and others to iterate increasingly relevant and comprehensive understandings of cybersecurity problems.

Notes

1 Wilner AS. US cyber deterrence: practice guiding theory. Journal of Strategic Studies 2020; 43:245–80.

2 Schelling TC. The Strategy of Conflict. Harvard University Press, 1980.

3 Libicki MC. Cyberdeterrence and Cyberwar. RAND, 2009.

4 Schelling TC. The Strategy of Conflict.

5 Nye JS. Cyber Power, 2010.

6 Buchanan B. The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics. Harvard University Press, 2020.

7 In Martin Libicki’s 1995 work on information war, he discusses how government officials leaked information about US hacking of Iraq’s air defenses by having a compromised printer added to the network. Libicki cast doubt on the technical ability for a printer to control an attached system and then remarks, “Had this incident been a good hack as the tale suggests, the United States might have wanted to do it again, so why would anyone talk about it?” Libicki MC. What is Information Warfare? National Defense University, 1995.

8 Zetter K. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon. First edition. New York: Crown Publishers, 2014.

9 Healey J. The cartwright conjecture: The deterrent value and escalatory risk of fearsome cyber capabilities. Bytes, Bombs, and Spies: The Strategic Dimensions of Offensive Cyber Operations. Edited by Zegart HL and Amy. Brookings Institution Press, 2018.

10 Perlroth N. This Is How They Tell Me the World Ends: The Cyberweapons Arms Race. eng. London: Bloomsbury Publishing Plc, 2021.

11 Schneider JG. Deterrence in and through Cyberspace. Cross-Domain Deterrence 2019:95–120.

12 Schelling TC. Arms and Influence. Yale University Press, 1995.

13 Schelling TC. The Strategy of Conflict.

14 Libicki speculates that terrorists have not disabled the core of the Internet because they, too, are dependent on Internet communications. Libicki MC. Conquest in Cyberspace: National Security and Information Warfare. Cambridge University Press, 2007. The dependence includes the use of the Internet to broadcast propaganda and for fundraising through cryptocurrencies, a key tool for North Korea and extremist terrorist groups.

15 Eisenstadt M. Iran’s Lengthening Cyber Shadow. Washington Institute for Near East Policy, 2016.

16 Farrell H and Newman AL. Weaponized interdependence: how global economic networks shape state coercion. International Security 2019; 44.

17 As part of Executive Orders 13694 and 13757, the Department of the Treasury is directed to blacklist companies and individuals involved in consequential computer attacks. These individuals are identified under the CYBER and CYBER2 programs in the Specially Designated Nationals and Blocked Persons List (SDN).

18 Rosenzweig P. Cyber warfare: how conflicts in cyberspace are challenging America and changing the world. ABC-CLIO, 2013.

19 Nye JS. The Future of Power. New York: PublicAffairs, 2011.

20 Miller SE. Cyber threats, nuclear analogies? Divergent trajectories in adapting to new dual-use technologies. Understanding Cyber Conflict: 14 Analogies. Edited by Perkovich G and Levite AE. 2017:161–79.

21 Schmidle Jr R, Sulmeyer M, and Buchanan B. Nonlethal weapons and cyber capabilities. Understanding Cyber Conflict: 14 Analogies. Edited by Perkovich G and Levite AE. 2017:31–44.

22 Postman N. Crazy Talk, Stupid Talk: How We efeat Ourselves by the Way We Talk and What to Do About It. New York: Delacorte Press, 1976. Stupid talk is easily identifiable as simply wrong or mistaken. Crazy talk can be persuasive but obscures ideas that are irrational or even evil.

23 Rid T. Cyber war will not take place. Journal of Strategic Studies 2012; 35:5–32.

24 Fischerkeller MP and Harknett RJ. Deterrence is not a credible strategy for cyberspace. Orbis 2017; 61:381–93.

25 Fischerkeller MP and Harknett RJ. Persistent Engagement, Agreed Competition, Cyberspace Interaction Dynamics, and Escalation. Standard, 2018.

26 Buchanan B. Mitigating the cybersecurity dilemma. The Cybersecurity Dilemma. Oxford: Oxford University Press, 2017.

27 Rovner J. The elements of an intelligence contest. Deter, Disrupt, or Deceive: Assessing Cyber Conflict as an Intelligence Contest. Edited by Chesney R and Smeets M. Georgetown University Press, 2023.

29 Kahn H. On escalation: metaphors and scenarios. Hudson Institute. Series on national security and international order, no. 1. New York: Praeger, 1965.

28 Kreps S and Schneider J. Escalation firebreaks in the cyber, conventional, and nuclear domains: moving beyond effects-based logics. Journal of Cybersecurity 2019 Sep; 5.

30 Kreps S and Schneider J. “Escalation firebreaks in the cyber, conventional, and nuclear domains: moving beyond effects-based logics.”

31 Lucas Kello quotes an interview with Gary Corn, a former counsel to the Joint Chiefs of Staff: “What the conditions of the grey zone do is create decision delay and often paralysis because of uncertainty in the legal interpretation of actions.” Kello L. Cyber legalism: why it fails and what to do about it. Journal of Cybersecurity 2021; 7.

32 Nissenbaum H. Where computer security meets national security. Ethics and Information Technology 2005; 7:61–73.

33 Deibert RJ and Rohozinski R. Risking security: policies and paradoxes of cyberspace security. International Political Sociology 2010; 4:15–32.

34 Wæver O. Securitization and Desecuritization. Copenhagen: Centre for Peace and Conflict Research, 1993.

35 Ostrom E. Revisiting the commons: local lessons, global challenges. Science 1999; 284:278–82. Available from: http://www.jstor.org/stable/2898207.

36 Ostrom E. A general framework for analyzing sustainability of social-ecological systems. Science 2009; 325:419–22. Available from: http://www.jstor.org/stable/20536694.

37 Ostrom E. “A general framework for analyzing sustainability of social-ecological systems.”

38 Scott JC. Seeing Like a State: How Certain Schemes to Improve the Human Condition Have Failed. Yale, 1999.

39 Hoofnagle CJ and Whittington J. Free: accounting for the costs of the Internet’s most popular price. UCLA Law Review 2013; 61:606.

40 Shapiro C and Varian HR. Information Rules: A Strategic Guide to the Network Economy. Harvard Business Press, 1998.

41 Zuboff S. Big other: surveillance capitalism and the prospects of an information civilization. Journal of Information Technology 2015; 30. Available from: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2594754.

42 Mulligan DK and Schneider FB. Doctrine for cybersecurity. DÆDALUS, 2011; 140.

43 Cicero MT. De Officiis. Harvard University Press, 1913.

44 Machiavelli N. The Prince (WK Marriott Trans.), 1908.

45 Gerasimov V. The value of science in prediction. Military-Industrial Kurier 2013; 27. Available from: https://perma.cc/D7QR-HBFX. https://perma.cc/D7QR-HBFX.

46 This is based on a translation by Rob Coalson and commentary by Russia expert Mark Galeotti. Galeotti M. The ‘Gerasimov Doctrine’ and Russia non-linear war, 2014. Available from: https://inmoscowsshadows.wordpress.com/2014/07/06/the-gerasimov-doctrine-and-russian-non-linear-war/; https://perma.cc/AXS5-85Y9.

47 Bartles CK. Getting gerasimov right. Military Review 2016; 96:30–8.

48 Rid T. Active Measures: The Secret History of Disinformation and Political Warfare. New York: Farrar, Straus and Giroux, 2020.

49 Winner L. Do artifacts have politics? Daedalus 2018; 109:1:121–36.

50 The September 11, 2001 hijackers chose symbolic targets causing great harm to the American psyche, but they could have made all of Manhattan uninhabitable by crashing a jet into the Indian Point nuclear power plant, just 36 miles from Manhattan.

51 Sola Pool I de. Technologies of Freedom. Cambridge, MA: Harvard University Press, 1983, Barlow JP. A declaration of the independence of cyberspace. Electronic Book. 1996. Available from: homes.eff.org/~barlow/Declaration-Final.html, Turner F. From Counterculture to Cyberculture: Stewart Brand, the Whole Earth Network, and the Rise of Digital Utopianism. University of Chicago Press, 2010.

52 Steed D. The Politics and Technology of Cyberspace. Modern Security Studies. Abingdon, Oxon; Routledge, Taylor and Francis Group, 2019.

53 Deibert RJ. Black code: censorship, surveillance, and the militarisation of cyberspace. Millennium, 2003; 32:501–30.

54 Deibert, “Black Code: Censorship, Surveillance, and the Militarisation of Cyberspace,” Manjikian MM. From global village to virtual battlespace: the colonizing of the internet and the extension of realpolitik. International Studies Quarterly 2010; 54:381–401.

55 Shannon CE. A mathematical theory of communication. The Bell System Technical Journal 1948; 27:379–423.

56 Nye JS. The Future of Power. New York: PublicAffairs, 2011.

57 Manjikian MM. “From Global Village to Virtual Battlespace: The Colonizing of the Internet and the Extension of Realpolitik.” International Studies Quarterly 2010; 54(2).

58 Elmer-Dewitt P. First nation in cyberspace. Time Magazine, 1993 Dec.

59 Border Gate Protocol (BGP) hijacking makes it possible to redirect small or large volumes of Internet traffic. It is a vulnerability known since BGP was implemented in 1989.

60 Scott JC. Seeing Like a State: How Certain Schemes to Improve the Human Condition Have Failed.

61 Deibert RJ. “Black Code: Censorship, Surveillance, and the Militarisation of Cyberspace.”

III
Cybersecurity Law and Policy

6 Consumer Protection Law

6.1 Federal Trade Commission Cybersecurity

6.2 FTC Adjacent Cybersecurity

6.3 The Limits of the Consumer Protection Approach

6.4 Conclusion

7 Criminal Law

7.1 Computer Crime Basics

7.2 Computer Crime Incentive Contours

7.3 The Political/Economic Cyber Enforcement Strategy

7.4 Cybercrime’s Technical Dependencies

7.5 The Major Substantive Computer Crime Laws

7.6 High-Level Investigative Procedure

7.7 Live Monitoring

7.8 Conclusion

8 Critical Infrastructure

8.1 What Is “Critical Infrastructure”

8.2 Political Challenges in Securing Critical Infrastructure

8.3 Cyber Incident Reporting for Critical Infrastructure Act of 2022

8.4 Technical Dynamics

8.5 NIST Cybersecurity Framework

8.6 Alternative Approaches to the NIST Cybersecurity Framework

8.7 The Other CISA—Cybersecurity Information Sharing Act of 2015

8.8 Conclusion

9 Intellectual Property Rights

9.1 IPR Problems: Context

9.2 Protection of Trade Secrets

9.3 Copyright and Cybersecurity

9.4 Online Abuse and IP Remedies

9.5 Conclusion

10 The Private Sector

10.1 There Will Be Blood: Risk and Business Operations

10.2 The Politics of Sovereignty

10.3 The APT Problem

10.4 The Security Breach Problem

10.5 Hacking Back: CISA (The Statute) Revisited

10.6 The Special Case of Financial Services

10.7 Publicly Traded Companies and Cybersecurity

10.8 Cybersecurity Insurance

10.9 Conclusion

6.
Consumer Protection Law

Chapter image: Jean-Auguste-Dominique Ingres, Ulysses, 1827.

Source: National Gallery of Art/Public domain/
https://www.nga.gov/collection/art-object-page.46509.html.

Chapter Learning Goals

What are the main ways consumer law protects cybersecurity?

What are the upsides and downsides of a consumer protection approach?

What elements of cybersecurity might consumer protection address, and what elements will need other approaches?

Consumer law is a vast body of regulations, statutes, self-regulatory codes, and other mechanisms that seeks to aid buyers in the marketplace. In the United States, consumer law interventions vary dramatically—some are information forcing, that is, they require a business to disclose facts to the consumer; some create choice architectures, meaning the consumer must be presented with some opportunity to take a decision; some prohibit certain kinds of options, such as taking certain choices away from the business or consumer; and some may even be motivated by protectionism or capture of a regulator, that is, the rule was really enacted to control competitors or consumers.¹

As a first matter, the law imposes general duties of due care and lawful conduct. Even if a specific law does not cover a certain cybersecurity issue, companies must still act with due care to others, avoid harming others, and respect the property rights of others. If a company harms a consumer, a smart attorney can find a way to state a cause of action under negligence or another generally applicable legal theory.

Consumer protection law is a civil, as opposed to criminal, remedy. That is, the government (and sometimes consumers) can bring consumer protection lawsuits in civil proceedings, where the penalty is fines rather than jail time. Most security problems fall into this category of a civil wrong. There are a few contexts where consumer swindles can become criminal matters, but these are rare. Criminal cases typically involve company officials who lie to regulators or investors about security issues. Thus, it is important to keep this in perspective: no job is so wonderful that it is worth lying to regulators and investors. A company that pressures its people to do so isn’t worth working for—after all, that same company will probably be willing to blame the misconduct on the employee who lied!

In addition to general legal duties of truthfulness and responsibility for the harms that our businesses may cause, there are many specific consumer protection laws and related enforcement agencies that might have bearing on cybersecurity. This chapter focuses on the most important: the Federal Trade Commission’s (FTC) power to prevent unfair or deceptive trade practices. The chapter also discusses the merits and demerits of the consumer protection approach.

Cybersecurity expert Paul Rosenzweig declared in 2014 that the “FTC’s efforts are currently the only effective aspect of a Federal program to compel the business community to adopt more stringent cybersecurity measures.” That is a strong claim and our narrative below will explain why it is likely true.

6.1 Federal Trade Commission Cybersecurity

The FTC is one of the first federal regulatory agencies in America. It is an independent agency led by five appointed commissioners who serve seven-year terms and have a tenure-like protection against being fired. No more than three commissioners can be of any one political party, so the FTC is always in a bi-partisan political conversation with Congress and relevant industries to form consensus approaches. Aside from nominating commissioners, US presidents have little interaction with the FTC.

Created in 1914, the FTC was intended to strengthen the nation’s antitrust posture. But its “true purpose” is ambiguous, because the FTC’s creation was a compromise between different legislative factions. During the George W. Bush administration, the FTC articulated these purposes: “To prevent business practices that are anti-competitive or deceptive or unfair to consumers; to enhance informed consumer choice and public understanding of the competitive process; and to accomplish these missions without unduly burdening legitimate business activity.”

Question 6.1.1 — Purposes. An early commissioner quipped, “…Congress had strongly suspected that some predatory animal was robbing the henroost. It ordered that the animal be caught and killed. But it neglected to say whether the animal ran on two legs or four, sang, howled or grunted, was carnivorous or vegetarian, roosted in trees or slept on the ground…”

Are you surprised by the purposes of the FTC as articulated by the President George W. Bush administration? What might you expect the agency’s mission to be?

▄

With roots in antitrust, the FTC’s first case took on an “unfair competition” issue: whether makers of a synthetic silk could sell it as authentic silk. Notice how unfair competition might be reframed as a consumer protection issue.

This first silk case nicely makes our first point: companies need consumer protection too. But companies call business protections “unfair competition.” Unfair competition, which included practices such as physical violence, industrial espionage, and stealing customer information from competitors, often does impose costs on consumers. Yet, businesses are better suited to express the injury in terms of economic harm and thus get attention from regulators. At a fundamental level, most businesses want a baseline of acceptable conduct, lest conditions degenerate into a law of the jungle.

Over the decades, the FTC has had its ups and downs. At some points, it was essentially an irrelevant agency. But, it shined at other moments, and was innovative in paying attention to new forms of advertising (newspaper to radio to television to Internet).² It brought its first Internet consumer protection case in 1994, long before most Americans were even online.

During the George W. Bush administration, the FTC started a business education and enforcement campaign focused on information security. The Bush administration was deeply anti-regulatory, but the leadership of the FTC reasoned there was an economic rationale to protect consumers from security problems: consumers had no real control or choice over firms’ security practices. In fact, consumers cannot even discern what these practices are nor whether they are adhered to. The Bush FTC thus concluded that a company that fails to secure personal information may have acted unfairly and caused users substantial, unjustified injury. A key subtext to highlight here is that the agency did not argue that people were deceived. Instead, consumers were injured, and consumers had no effective way to take precautions against the injury.

Using unfairness to police security was a daring, yet justified step for a conservative administration that was avowedly anti-regulation. And, it set in motion the framework praised by Rosenzweig.

6.1.1 FTC’s Legal Authority

15 USC §45(a) sets forth the FTC’s central authority:

(a) Declaration of unlawfulness; power to prohibit unfair practices; inapplicability to foreign trade

(1) Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.

(2) The Commission is hereby empowered and directed to prevent persons, partnerships, or corporations…from using unfair methods of competition in or affecting commerce and unfair or deceptive acts or practices in or affecting commerce.

…

Question 6.1.2 — Section 5’s Vagueness. This is one of the first times you have read an actual law in this book. Are you surprised by how sparse the FTC’s statute is? Did you expect more specific rules? Many laws are similarly vague, with agencies given discretion to interpret their meaning. Thus, to understand a law like the FTC Act, one might have to read many different regulations issued by the agency and, of course, the cases the agency decides.

▄

The FTC’s organic statute is vague because no one could define business misconduct. One group thought it made sense to enumerate all kinds of business wrongs, but opponents objected, noting that businesses would find wily ways around the enumeration of wrongs. Congress agreed with the opponents of enumerating wrongs and instead decided to draft a law defining high-level principles for business misconduct. Congress did this by creating two separate legal principles: unfairness and deception. These are separate theories with different legal tests, although many confuse the two. Unfairness and deception truly are principles rather than specific legal rules.

Other important dynamics in FTC operation include:

Commerce  The FTC is concerned with business dealings, not other domains like deception in politics

Acts or practices  The FTC can remediate a wrongful act—a single wrong. This means a company need not have a policy or pattern of wrongdoing, just a single act suffices

Persons, partnerships, or corporations  The FTC can sue almost anything, even nonprofits, and even single out specific business leaders in their personal capacity for wrongdoing

Targeting  The FTC gets to choose its enforcement targets. It may seem entirely unfair, but the FTC has the prerogative to go after a single company even if its practices are widespread among the company’s competitors

Prevention  The FTC is charged with preventing unfair and deceptive practices, suggesting it can act before consumers are harmed

Jurisdiction  The FTC has sweeping jurisdiction, but there are two important exceptions for security: most financial services companies (banks, insurance companies, and brokerages) and all common carriers (from airlines to wireless communications companies) are outside the FTC’s jurisdiction. Other agencies fill in those gaps. Most of those other agencies have a statute similar to the FTC’s, banning unfairness and deception in aviation, telecommunications, or the like

Aiding and abetting  The FTC generally does not have the authority to pursue those who help or encourage lawbreaking. This is important because many wrongdoers may use services to commit fraud (for instance, services that sell personal information). The FTC has to find other ways to loop in service providers to fraudsters

What does unfairness and deception actually mean? The FTC has a common-law, court-like ability to define unfairness and deception by making policy statements, by proposing rules, and by bringing cases against companies. The current landscape is a bit confusing. For path-dependent and political economy reasons, unfairness and deception rest upon “policy statements” made during the President Reagan years.

The FTC generally does not issue regulations in the privacy and security space, because to do so it must comply with procedural rules, known as Magnuson–Moss rulemaking. This is different and more burdensome than standard Administrative Procedure Act rulemaking. Thus, the FTC tends to “make policy” by bringing enforcement actions against individual companies. These enforcement actions scare marketplace competitors into compliance.

Despite the procedural difficulty of rulemaking, the agency can issue policy statements based on a simple majority vote of commissioners. That explains why the agency has issued deception and unfairness policy statements instead of specific rules. The policy statements form the root of unfairness and deception concepts while individual cases are the branches of the doctrine.

Question 6.1.3 — What Is “Deception”? The Oxford English Dictionary’s semantic classification lends insight into the difficulty of defining deception. Here are concepts mapped in the OED and the relative number of words associated with each:

freedom from error, correctness (327)

truthfulness, veracity (196)

sincerity, freedom from deceit (189)

disregard for truth, falsehood (1365)

deceit, deception, trickery (3262)

It is telling that there are over 3,000 words in English to describe deceit, while less than 200 associated with sincerity and truthfulness. What does this say about humanity?

▄

6.1.2 Unfairness

What are those practices that are “unfair?” A complex history has brought us to a simple conclusion: unfair trade practices are those that cause unjustified, substantial consumer injury.³ Substantial injuries to consumers usually—but not always—involve monetary harm, coercion into the purchase of unwanted goods or services, and health or safety risks. Substantial injury may also occur where a business act causes a small harm to a large number of people.

Why does the FTC qualify injury with unjustified? All economic activity poses some risk, and so, the FTC will overlook some externalities of business behavior.

At the core of unfairness is cost–benefit logic that was embraced by the President Reagan administration to tame business regulation (Reagan ignored cost–benefit analysis when it might have favored social regulation).⁴

Question 6.1.4 — Injuries: Objective and Emotional. Lurking in this definition is the concept that substantial injuries are objective ones, such as relating to the loss of money, while emotional injuries are not injuries because they are subjective.

A line has to be drawn somewhere. We do not want the FTC to enforce our personal tastes. The government shouldn’t punish marketing because it is offensive, for instance. But at what point are “emotional worries” recognized as objective injuries?

Consider this: would you rather (1) suffer a fraud and lose $1, or (2) realize the photo-sharing site you use runs facial recognition on your images and keeps profiles for unspecified future purposes on you, your children, and your friends? The company has not yet sold the data to law enforcement and intelligence agencies, but probably will once it runs out of venture money. Scenario 1 is clearly remediable as a deception or unfair practice, but scenario 2 might not be because it could be classified as a subjective or emotional worry.

▄

With this basic definition, one can see how insecurity fits nicely in an unfairness frame. The FTC must show that insecurity causes a substantial, unjustified injury the consumer cannot avoid. The last factor—the inability to avoid, is the easiest to establish. The consumer has inadequate tools to ensure security pre- and post-transaction. Consumers rely on companies to secure personal information, but once handed over, the consumer has no control whatsoever on how the firm secures data. The consumer is unlikely to understand security or have the tools or mechanisms to evaluate a firm’s procedures. A firm that collects data in a secure way today may at some future date have degraded security, yet the consumer has no way of knowing this and exiting (for instance, by deleting one’s account).

Insecurity presents an unjustified injury because there is no spillover (positive externality) to the economy from a lack of security. Insecurity does not result in more sales or a larger economy. In fact, insecurity might stop people from transacting.

Question 6.1.5 — Emotional Injuries. Tort law legend Guido Calabresi (writing with Spencer Smith) commented:

[Emotional damages] are frequently not compensated. Why is that? Could it be because the sufferer of such damages is deemed to be the cheapest cost avoider?

If so, it must be so primarily because the award of such damages is thought to increase their size. That is, the more a society compensates people for purely emotional harms, the more people—again, over time and perhaps even case by case—will come to feel emotionally harmed, and will, in a sense, experience them more.

To be clear, we do not mean to suggest that purely emotional harms are not real. They are real! And they should be recognized, or attended to, in some way. But in deciding whether and how legally to recognize emotional wrongs, a society may well be considering also what effect, if any, doing so will have on their occurrence. Some, such as the anguish one feels at seeing a close loved one killed, society may well not wish to diminish. Others, the feeling of distress we all have when we see an ugly traffic accident, society may prefer to reduce, by denying any recovery rights. Redress affects costs which in turn affect the right to redress.a

In law and economics theory, the “cheapest (or least) cost avoider” (LCA) is the person who can most efficiently escape a peril. Tort law tends to assign burdens to LCAs because that is considered most efficient—LCAs are often “best placed” to take precautions and avoid a harm.

But, is it always the case that the victim of an emotional harm is the LCA? Calabresi’s idea is an ancient one. Marcus Aurelius wrote in THE MEDITATIONS (~170 CE): “Choose not to be harmed—and you won’t feel harmed. Don’t feel harmed—and you haven’t been.”

▄

a Calabresi G and Smith S. On Tort Law’s Dualisms. Harv. L. Rev. F. 2022; 135.

Injury continues to be the most difficult hurdle.

Companies contest whether injury occurs from security incidents. Companies may say, guess what?—your data are already leaked online, so our breach didn’t harm you! For instance, in 2022, to fend off a class action, the Marriott hotel chain sought to enumerate all sorts of personal information it found online about the plaintiffs.⁵ Marriott’s argument was that since personal data of plaintiffs was already online in various places, Marriott’s security problems caused no additional injury. Thus, Marriott should not be liable for a security breach of this same information.

Exercise 6.1 — Commercial Surveillance and the Brave Browser. The Brave Browser is an implementation of Google’s popular Chromium infrastructure but unlike Google’s Chrome, Brave has an aggressively pro-privacy posture that has benefits for security. This is because commercial surveillance in the form of advertising technology can be used by attackers to deliver malware or to spy on users. The Brave browser blocks the tracking infrastructure used by advertisers—something that Google will not do because the company makes almost all of its revenue from advertising.

Brave’s privacy battle is an endless cat-and-mouse game, one that privacy forces are beginning to win—for now. For instance, some advertisers are sunsetting a relatively easy-to-use tracking technology, the third-party cookie, because of aggressive privacy controls in Brave and in the iPhone’s Safari browser. But, advertisers may replace the cookie with an even harder-to-block alternative to identify and track users.

One can find the Brave Browser here: https://brave.com/

Download it and use Brave for your regular browsing for a day. What do you notice about the advantages and disadvantages of Brave?

▄

6.1.3 Deception

Deception is a separate concept from unfairness. At a high level, deception exists where a business makes a (1) material (2) representation, omission, or practice that (3) is likely to mislead a reasonable consumer (4) to her detriment.

Material  Anything involving money is material, as is any factor that might make the consumer choose a competing product. The idea is that some deceptions might be immaterial, that is, the deception has no bearing on consumer decision-making

Representations  Information conveyed to the consumer or marketplace is a representation. That is, any kind of statement, and even demonstrations and symbols are “representations.” Almost all deception nowadays involves implicit claims or omissions, not express deceptions. The FTC looks to the overall context to surface implied claims. So, it is important to know that not disclosing something, or disclosing a problem incompletely, can be an illegal representation by omission

Totality of the circumstances  Because there are so many ways to deceive, the FTC looks at all the circumstances of a transaction to evaluate trickery

Intent not required  Historically, the common law (the body of law America inherited from the British) required consumers to prove that the seller subjectively intended to trick. However, the FTC Act does not require a showing that the company intended to deceive the consumer

Special populations  The FTC changes the standard for deception when the target is a special population, such as children (lower standard) or physicians evaluating drugs (higher standard for experts)

Detriment  Deception does not require injury; it requires “detriment,” meaning that deception is not limited to pecuniary loss

Deception’s contours make it easier for the FTC to use. Yet, there is some complexity in its use, because in many security cases, companies do not make specific security representations. They may say something like “we keep your data secure” or “we take your privacy seriously.”

And so, the FTC has generated a new rationale for security cases: that the defendant’s actions “taken together” violated the security of the consumer. There is a logical basis for this, and yet, we will see below that there is much anger about such a vague standard.

Question 6.1.6 — Defining Unfairness and Deception. In your own words, can you explain the differences between unfairness and deception? Which of these concepts is most relevant to cybersecurity?

▄

6.1.4 The Zoom Case—Complaint

Consider the FTC’s 2020 case against Zoom. First, here is a highly edited version of the complaint,⁶ and then we’ll look at portions of the settlement agreement.

The Federal Trade Commission, having reason to believe that Zoom Video Communications, Inc., a corporation (“Respondent”), has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges: Founded in 2011, Zoom is a videoconferencing platform provider that provides customers with videoconferencing services and various add-on services, such as cloud storage…

Users share sensitive information during Zoom meetings. This can include financial information, health information, proprietary business information, and trade secrets. For example, Zoom has been used for therapy sessions, Alcoholics Anonymous meetings, and telehealth appointments.

As reflected in Zoom’s Security Guide, the security of users’ Zoom communications relies not only on its Meeting encryption or similar features, but also on its internal network security. Malicious actors who infiltrate Zoom’s internal network could gain access to Zoom’s administrative controls and compromise Zoom users’ personal information. Despite this, Zoom, among other things, has:

Failed to implement a training program on secure software development principles;

Failed to test, audit, assess, or review its applications for security vulnerabilities at certain key points, such as prior to releasing software updates, including failing to ensure that its software is free from commonly known or reasonably foreseeable attacks, such as “Structured Query Language” (SQL) injection attacks and “Cross-Site Scripting” (XSS) attacks;

Failed to monitor service providers or other contractors who have access to Zoom’s network;

Failed to secure remote access to its networks and systems through multi-factor authentication or similar technology;

Failed to use readily available measures to safeguard against anomalous activity and/or cybersecurity events across all of Zoom’s systems, networks, and assets within those networks, including monitoring all of Zoom’s networks and systems at discrete intervals, properly configuring firewalls, and segmenting its networks;

Failed to implement a systematic process for incident response;

Failed to implement a systematic process for inventorying, classifying, and deleting user data stored on Zoom’s network; and

Been a year or more behind in patching software in its commercial environment.

Respondent’s Deceptive and Unfair Privacy and Security Practices

Zoom has made numerous, prominent representations touting the strength of the privacy and security measures it employs to protect users’ personal information. For example, Zoom has claimed on its website, in Security Guides, and in its privacy policy, that it takes “security seriously,” that it “places privacy and security as the highest priority,” and that it “is committed to protecting your privacy.”

In a January 2019 white paper…Zoom represented that it offered end-to-end encryption for Zoom Meetings as an “added layer of application security for Zoom meetings, webinars, and chat (instant messaging) sessions.”

In fact, Zoom did not provide end-to-end encryption for any Zoom Meeting that was conducted outside of Zoom’s “connector” product (which are hosted on a customer’s own servers), because Zoom’s servers—including some located in China—maintain the cryptographic keys that would allow Zoom to access the content of its customers’ Zoom Meetings. Zoom has acknowledged that its Meetings were generally incapable of end-to-end encryption…

Since at least June 2015, Zoom has made numerous and prominent claims that it encrypted Zoom Meetings, in part, by using AES, with a 256-bit encryption key.

In fact, Zoom used a lower level of encryption for securing Zoom Meetings, AES 128-bit encryption in Electronic Code Book (“ECB”) mode. AES 128-bit encryption uses a shorter encryption key than AES 256-bit Encryption, and therefore provides less confidentiality protection because there are fewer possible values for the 128-bit key than for a 256-bit key. Reflecting the comparative strength of AES 256-bit Encryption and AES 128-bit Encryption, the National Security Agency has reported that AES 256-bit Encryption may be used for securing “TOP SECRET” materials, whereas AES 128-bit encryption may only be used for securing “SECRET” communications.

Zoom’s Unfair Circumvention of a Third-party Privacy and Security Safeguard

In July 2018, Zoom updated its App for Mac computers by deploying a web server onto users’ computers—without adequate user notice or consent—in order to circumvent a security and privacy safeguard in Apple’s Safari browser. Specifically, Apple had updated its Safari browser to help defend its users from malicious actors and popular malware by requiring interaction with a dialogue box when a website or link attempts to launch an outside App.

As a result of the new browser safeguard, users who clicked on a link to join a Zoom Meeting would receive an additional prompt that read, “Do you want to allow this page to open ‘zoom.us’?” If the user selected “Allow,” the browser would connect the user to the Meeting, while clicking “Cancel” would end the interaction and prevent the Zoom App from launching.

To avoid this dialogue box, Zoom issued a manual update in July 2018 for its Zoom App for Mac desktop computers that secretly deployed a web server, called the “ZoomOpener,” as a means to bypass the new privacy and security safeguard.

In addition to bypassing the Safari browser safeguard, the ZoomOpener web server also harmed users by introducing two additional security vulnerabilities. First, the web server exposed some users to a potential Remote Control Execution (RCE) attack because the ZoomOpener web server would download and install software updates, including potentially malicious code, without properly validating that it was downloading the software from a trusted source.

In addition to bypassing the Safari privacy and security safeguard to launch Zoom Meetings, the ZoomOpener web server had a second function: to reinstall the Zoom App. Specifically, if a Mac user deleted the Zoom App in accord with Apple’s instructions for deleting apps, the Zoom-Opener web server would nevertheless remain on users’ computers. If the user later clicked on a Zoom Meeting invite or visited a website with an embedded Zoom Meeting, the web server would secretly reinstall the Zoom App—without any user interaction—and automatically join the user to the Meeting.

Consumers could not reasonably have avoided the harms resulting from the secret deployment of the ZoomOpener web server. Zoom did not inform users that it was installing the ZoomOpener web server on their computer or otherwise provide any information about its operation, and it did not inform users that the web server would remain on their computers after they uninstalled the Zoom App. Consumers also had no way of independently knowing about the web server’s security vulnerabilities. This substantial injury is not offset by countervailing benefits to consumers or competition.

The acts and practices of Zoom as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. §45(a).

THEREFORE, the Federal Trade Commission this nineteenth day of January 2021, has issued this Complaint against Respondent. By the Commission, Commissioners Chopra and Slaughter dissenting.

Question 6.1.7 — Complaint Reactions. What most surprises you about this document? What do you think about the security lapses—do they sound serious or intuitive? Isn’t it amazing that the FTC brought a case against Zoom in the midst of the COVID-19 pandemic?

▄

6.1.5 The Zoom Case—Settlement

The Zoom settlement agreement order⁷ has the legal effect of a contract. The FTC can bring a case to enforce it under standards similar to contract law. To bring a case, the FTC bears the burden to show a material and substantial violation of the agreement (therefore, Zoom’s standard of compliance is not perfect compliance, but merely “substantial compliance” with the requirements).

But if Zoom plays fast and loose with this settlement agreement, it risks large fines. The FTC can impose fantastic fines: $42,000 a day per violation. Thus, fines can be ruinous, particularly for companies with millions of users.

Question 6.1.8 — Analyzing the Settlement Order. We heavily edited the order below to include key information, and each paragraph is included for a specific reason. Try to anticipate those reasons before discussing this document in class.

In addition, think of this order from the perspective of Zoom’s chief security officer. If you were the CSO, what would you have to do to ensure “substantial compliance” with the order’s requirements? What provisions create the biggest risks for violation? What third parties might you want to hire—and how much more budget might you justify to your CFO to stay in compliance?

▄

Decision

The Federal Trade Commission (“Commission”) initiated an investigation of certain acts and practices of the Respondent named in the caption. The Commission’s Bureau of Consumer Protection (“BCP”) prepared and furnished to Respondent a draft Complaint. BCP proposed to present the draft Complaint to the Commission for its consideration. If issued by the Commission, the draft Complaint would charge the Respondent with violations of the Federal Trade Commission Act.

Respondent and BCP thereafter executed an Agreement Containing Consent Order (“Consent Agreement”). The Consent Agreement includes: (1) statements by Respondent that it neither admits nor denies any of the allegations in the Complaint, except as specifically stated in this Decision and Order, and that only for purposes of this action, it admits the facts necessary to establish jurisdiction; and (2) waivers and other provisions as required by the Commission’s Rules.

“Covered Incident” means any instance in which any United States federal, state, or local law or regulation (“Breach Notification Law”) requires, or would require if recorded or livestream video or audio content from a Meeting were included as a type of personal information covered by such Breach Notification Law, Respondent to notify any U.S. federal, state, or local government entity that information collected or received, directly or indirectly, by Respondent from or about an individual consumer was, or is reasonably believed to have been, accessed or acquired without authorization.

I. Prohibited Misrepresentations IT IS ORDERED that Respondent, and Respondent’s officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service, must not misrepresent in any manner, expressly or by implication:

A.  Respondent’s collection, maintenance, use, deletion, or disclosure of any Covered Information;

B.  The security features, or any feature that impacts a Third-Party Security Feature, included in any Meeting Service, or the material changes included in any updates thereof…

II. Mandated Information Security Program IT IS FURTHER ORDERED that Respondent, and any business that Respondent controls directly or indirectly, in connection with the collection, maintenance, use, or disclosure of, or provision of access to, Covered Information, must, within sixty (60) days of issuance of this order, establish and implement, and thereafter maintain, a comprehensive information security program (“Program” or “Information Security Program”) that protects the security, confidentiality, and integrity of such Covered Information. To satisfy this requirement,

Respondent must, at a minimum:

Document in writing the content, implementation, and maintenance of the Program, including all processes and procedures that will be used to implement all Program policies and safeguards;

Provide the written Program and any material evaluations thereof or material updates thereto to Respondent’s board of directors or governing body or, if no such board or equivalent governing body exists, to a senior officer of Respondent responsible for Respondent’s Program at least once every twelve (12) months and promptly (not to exceed thirty (30) days) after a Covered Incident;

Designate a qualified employee or employees to coordinate and be responsible for the Program;

Assess and document, at least once every twelve (12) months and promptly (not to exceed thirty (30) days) following a Covered Incident, internal and external risks to the security, confidentiality, or integrity of Covered Information that could result in the (1) unauthorized collection, maintenance, use, or disclosure of, or provision of access to, Covered Information; or the (2) misuse, loss, theft, alteration, destruction, or other compromise of such information;

[…]

III. Independent Program Assessments by a Third Party IT IS FURTHER ORDERED that, in connection with compliance with Provision II of this Order, titled Mandated Information Security Program, Respondent must obtain initial and biennial assessments (“Assessments”):

The Assessments must be obtained from one or more qualified, objective, independent third-party professionals (“Assessor”), who: (1) uses procedures and standards generally accepted in the profession; (2) conducts an independent review of the Program; and (3) retains all documents relevant to each Assessment for five (5) years after completion of such Assessment and (4) will provide such documents to the Commission within ten (10) days of receipt of a written request from a representative of the Commission. No documents may be withheld by the Assessor on the basis of a claim of confidentiality, proprietary or trade secrets, work product protection, attorney-client privilege, statutory exemption, or any similar claim;

[…]

IV. Cooperation with Third Party Assessor(s) IT IS FURTHER ORDERED that Respondent, whether acting directly or indirectly, in connection with any Assessment required by Provision III of this Order, titled Independent Program Assessments by a Third Party, must:

Provide or otherwise make available to the Assessor all information and material in its possession, custody, or control that is relevant to the Assessment for which there is no reasonable claim of privilege;

[…]

VI. Covered Incident Reports IT IS FURTHER ORDERED that Respondent, within thirty (30) days after the date of Respondent’s discovery of a Covered Incident, but in any event no later than ten (10) days after the date Respondent first notifies any U.S. federal, state, or local government entity of the Covered Incident, must submit a report to the Commission. The report must include, to the extent possible:

The date, estimated date, or estimated date range when the Covered Incident occurred;

[…]

VIII. Compliance Reports and Notices IT IS FURTHER ORDERED that Respondent make timely submissions to the Commission: A. One (1) year after the issuance date of this Order, Respondent must submit a compliance report, sworn under penalty of perjury…

IX. Recordkeeping IT IS FURTHER ORDERED that Respondent must create certain records for five (5) years after the issuance date of the Order, and retain each such record for five (5) years. Specifically, Respondent must create and retain the following records:

Accounting records showing the revenues from all goods or services sold;

Personnel records showing, for each person providing services, whether as an employee or otherwise, that person’s: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination;

Copies of all U.S. consumer complaints that were submitted to Respondent and relate to the subject matter of the Order, and any response(s) to such complaints;

All records necessary to demonstrate full compliance with each Provision of this Order, including all submissions to the Commission;

XI. Order Effective Dates IT IS FURTHER ORDERED that this Order is final and effective upon the date of its publication on the Commission’s website (ftc.gov) as a final order. This Order will terminate twenty (20) years from the date of its issuance…

Question 6.1.9 — Does Insecurity Pay? Apple, Facebook, Google, Microsoft, and WebEx all have well-established group video conferencing software services. Why did Zoom command so much attention and do so well during the COVID-19 pandemic? Could it be because several of these companies (Facebook, Microsoft, and Google) were already under FTC orders such that if they did what Zoom did, they could be subject to mega damages?

▄

Some of the decisions Zoom made are in line with the lessons we derived from Chapter 3. Recall that Varian, Shapiro, and Anderson all spoke to the idea that getting to the marketplace and enjoying network effects is worth some shortcuts.

Commissioners can vote to support or oppose a settlement agreement, and, in some cases, they issue justifications for their votes. Commissioner Slaughter dissented, arguing, “As of July 2019, Zoom had approximately 600,000 paying customers, and approximately 88% of those customers were small businesses with ten or fewer employees. In securing these customers, the Commission charges that Zoom made express representations regarding its encryption offerings that were false. Yet, the proposed order does not require Zoom to take any steps to mitigate the impact of these statements we contend are false. Zoom is not required to offer redress, refunds, or even notice to its customers that material claims regarding the security of its services were false. This failure of the proposed settlement does a disservice to Zoom’s customers, and substantially limits the deterrence value of the case.”

Question 6.1.10 — Commissioner Slaughter’s Dissent. Presumably, Commissioner Slaughter’s office lobbied the staff to include these recommendations in the settlement with Zoom. Why do you suppose they were not included?

▄

Commissioner Chopra wrote, “Today, the Federal Trade Commission has voted to propose a settlement with Zoom that follows an unfortunate FTC formula. The settlement provides no help for affected users. It does nothing for small businesses that relied on Zoom’s data protection claims. And it does not require Zoom to pay a dime. The Commission must change course.”

Question 6.1.11 — Money Damages. Commissioner Chopra’s dissent reflects the fact that most FTC settlements have no money damages. Why do you think these cases settle without compensation?

▄

6.2 FTC Adjacent Cybersecurity

The FTC is just one consumer protection entity in the United States. There are many others, some of which are cybersecurity-relevant.

In Chapter 10, we will cover retail investor cybersecurity—the protections that investors get when they invest in public companies. Here, we cover three FTC-adjacent forms of consumer protection: state-law-enforcing attorneys general, self-regulation, and product safety approaches.

6.2.1 The Attorneys General

Among the most important are the attorneys general (yes, the plural of attorney general is attorneys general (AGs), and if you were wondering, one can call an attorney general “General,” which is pretty cool).

All 50 states have consumer protection frameworks, many are broader than the FTC’s law. For instance, recall that the FTC’s unfairness authority is tethered to a cost–benefit analysis scheme. Some states go far beyond such limits and make unethical business conduct unfair. The FTC is not allowed to label a practice unfair simply because it is unethical!

These state laws are known as Unfair and Deceptive Trade Practices Acts (UDTPAs). If you are curious about your own state’s protections, the National Consumer Law Center has written a summary and critique of each one.⁸

All 50 states also have computer crime and identity theft laws, and these, too, are often broader than federal prohibitions. In some cases, citizens may use these laws as plaintiffs (private right of action). The National Conference of State Legislatures has written a guide to these laws.⁹

Thus, the AGs have a broad set of broadly written laws to draw upon. The AGs have one additional power the FTC lacks: the AG can charge wrongdoers criminally. The threat that a case that started as a civil matter could be converted into a criminal one is a scary prospect for defendants.

Combined, these fa

ctors make the AGs a potentially potent force in cybersecurity. Why potentially potent? To date, the AGs have not distinguished themselves on privacy and security.

Many AGs have sabre-rattled or taken tactical steps in privacy and security. But only General Kamala Harris’ office took a strategic one. In February 2016, her office published a report based on security breach reporting. The report takes a high-level policy view and embraces a well-accepted security standard, the Center for Internet Security’s Critical Security Controls.¹⁰ In doing so, Harris in essence set a standard for “reasonable security,” one that could be taken up by litigants.

In addition to the AGs, other federal agencies have UDTPA laws and could use them, in theory, to police cybersecurity. Recall that the FTC cannot sue common carriers. To address the gap, the Federal Aviation Administration has an unfair and deceptive trade practices power. Banks can be policed by their functional regulators. And communications carriers are regulated by the Federal Communications Commission.

Exercise 6.2 — State Laws. Massachusetts pioneered state information security laws in 2005, enacting a strong set of requirements that caused companies to comply nationwide because of the economic importance of the Boston area. The regulations have since been updated and are available here (https://www.mass.gov/doc/201-cmr-17-standards-for-the-protection-of-personal-information-of-residents-of-the/download; perma version: https://perma.cc/CF7H-9JXN).

Please read the Massachusetts regulation and consider the following questions:

What is the scope of the law? (e.g., does it apply to government only or also to the private sector?)

What is protected by the law?

At a high level, what must regulated entities do to comply with this law?

Section 17.04 of the law imposes specific security requirements. What requirements do you think are most important? What would you say is missing from the requirements?

Suppose you operate a company in a different state than Massachusetts that has covered personal information. How important is it to comply with this law?

▄

6.2.2 Self-regulation

Self-regulation has an enormous effect on cybersecurity. Self-regulation is a form of governance where businesses themselves define the rules and their scope, and are entrusted with their enforcement. Businesses themselves sometimes generate rules on their own initiative. However, in most situations, some external force, such as a threat of suit from the government or legislation, causes businesses to self-regulate.

The high-level problem is that there is no general self-regulatory standard for privacy and security. Different firms embrace various processes, but nothing like a Conformité Européenne () Mark or “Underwriters Laboratory” (UL) standard for health and safety exists in cybersecurity.

It’s easy to dismiss self-regulation as lacking teeth. But, self-regulation matters and can be force-enhancing. For instance, violation of self-regulatory standards is almost always an unfair or deceptive practice because companies make representations that they adhere to these regimes.

Self-regulatory standards also interact with other market features. Here’s an interesting example: Consumers Union/Consumer Reports magazine reviews products. Increasingly, they focus on privacy and security aspects of them. If CU/CR issues a “don’t buy” rating, some retailers, such as Home Depot, will pull the product from the floor.

Exercise 6.3 — Evaluating Self-Regulation. Created in 2008, the Cloud Security Alliance is the leading NGO “dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment.” You can find the CSA’s guidance on implementing Application Programming Interfaces here (https://perma.cc/DDL5-APA8). Skim it. Consider whether it could serve as a self-regulatory ruleset for companies. What obligations does it impose? Are they clear?

Alternatively, find another self-regulatory regime that deals with security and assess its strength and relevance.

The National Consumer Council articulated a framework to evaluate self-regulatory regimes.a It recommended the following principles:

A self-regulatory scheme must always have clear policy objectives.

Self-regulation should not inhibit the scope for competition to deliver benefits for consumers.

A strong independent element must be involved in the scheme’s design and have a controlling influence on its governance.

A dedicated institutional structure must be set up, separate from the existing trade and professional organisations.

A pragmatic approach may be inevitable. (“On some occasions—for example, where there is no realistic prospect of legislation—self-regulation on its own may be the only option.”)

There should be a presumption of scepticism toward self-regulation organised on a collective basis. (“Self-regulation that brings businesses together into a collective activity clearly has the potential for anti-competitive effects and other limitations.”)

Effective self-regulation is usually best stimulated by a credible threat of statutory intervention.

Self-regulation works best within some form of legal framework.

The NCC approach speaks both to the process and to the substance of a self-regulatory regime. NCC is also concerned that self-regulation might just be a tool to exclude competitors from a marketplace. Consider these factors as you assess a self-regulatory code.

▄

a National Consumer Council. Models of Self-Regulation, 2000 Nov. Available from: https://perma.cc/VMX9-84L9.

6.2.3 Product Recalls

Companies may face a voluntary or mandatory recall if their products have a defect that could cause substantial injury to the public. Could insecurity be a defect so severe that regulators should step in and force a company to update their products or even destroy them?¹¹

For years, rumors circulated that Vice President Dick Cheney was concerned that his pacemaker could be hacked. In a 2007 interview, Cheney confirmed the concern and said the wireless function in his pacemaker had been disabled to prevent a hacker from assassinating him. But, pacemaker manufacturers continued to build wireless capabilities into pacemakers for diagnostic and treatment convenience. Then, a 2016 report from short-selling company Muddy Waters (a firm that looks for companies that have major risks and “short sells” their stock, potentially making a fortune if the company’s value declines) claimed that hundreds of thousands of pacemakers installed in the chests of consumers were vulnerable to a simple, remote attack!¹² Anyone who acquired a “Merlin@home” device—available on eBay for just $35—could connect to any of these pacemakers remotely. The group also alleged that remote exploitation was relatively easy.

Patches were developed to harden these systems, but, in some cases, doctors were reluctant to apply the patch because of a “small chance” of malfunction. Since there was no proof that the vulnerabilities were being exploited, and because a “small chance” at scale (500,000 patients) means some pacemakers might fail, some doctors recommended against the upgrade.

Finally, in August 2017, the FDA stepped in and ordered the pacemaker company to push a curative update to devices.¹³ This was the first cybersecurity “recall” for medical devices. But, we doubt it will be the last time recall is used as a cybersecurity remedy. As software pervades consumer devices, surely other regulators will see product recall as a fix.

6.3 The Limits of the Consumer Protection Approach

Why might we favor consumer protection approaches to cybersecurity? One strong reason is that consumer protection laws can be applied equally to all competitors, whether they are US or Chinese companies. A consumer protection approach could remedy some of the concerns that motivate the investigation of foreign technologies. At the margins, however, consumer protection becomes dreadful protectionism.

Institutions like the FTC can develop expertise and concoct a normative framework using its powers that is much more agile and nicely fitting than Congress can. The FTC has taken some really smart cases, often against the largest companies in America.

But there are reasons to be skeptical. The US approach to consumer protection is mostly information-forcing. It assumes people with the right information will take the correct decisions. No matter how much this assumption reveals itself to be untrue, lawyers can’t imagine alternatives to warning labels. So we have to ask ourselves whether consumer protection can ever really work if it just gives consumers more and more information. Consumers already face information overload with respect to cybersecurity and many issues are highly technical and beyond the understanding of the average consumer (Figure 6.1).

Figure 6.1 Imagine different standards for liability for insecurity.

Another weakness comes in pursuing “reasonable security.” This standard seems high enough if we imagine the adversary to be financially motivated criminals. But what if the adversary were nation-states or determined criminals like stalkers? Might consumers need something more than reasonable security in a world where determined adversaries want to make their lives miserable?

Consumer protection law is difficult to enact. Industries lobby against such laws and, more often than not, stop them from passing—unless some emergency justifies their passage. In the United States, we did not have federal laws regulating safety of food and drugs until the public was shocked by outrageous practices. Similarly, the FTC did not get its consumer protection mission until the 1940s—after consumer product disasters could no longer be ignored. We might have to wait for a total security meltdown before Congress enacts a cybersecurity law with a consumer protection approach.

Consumer protection as noted above is a civil remedy. Companies charged with violations will only owe money for wrongdoing. In some cases, companies are so large that fines seem not to matter. Thus, consumer protection, at least with regard to very large companies, may be insufficiently deterrent.

Consumer protection agencies also see themselves as law enforcement organizations. For this reason, agencies like the FTC are unlikely to bring actions that protect consumers from law enforcement or intelligence surveillance. For instance, suppose a company promised to never reveal information to law enforcement but then broke this agreement. The FTC is unlikely to intervene in such a wrong, because the FTC often needs to request data from private companies. In addition, the wrong is to the consumer’s identity as a citizen rather than as a marketplace actor.

6.3.1 Two Litigation Moats: Standing and Economic Loss

As broad as consumer protection law is, companies that have suffered security breaches have warded off many consumer protection cases brought by private plaintiffs (they have not been successful when the enforcer is a public entity such as the FTC). Two important legal doctrines operate as “moats” protecting defendants from successful litigation: the standing doctrine and the economic loss doctrine.

Moats are a concept for business economic strategy that gives a competitor some durable advantage over others. We present these legal doctrines as moats because we think companies do not care about the values underlying these doctrines; rather, they only care about their instrumental utility in fighting lawsuits. We also present them as moats because it is likely that, over time, plaintiffs will surmount these moats. Thus, smart businesses should contemplate the time value of their legal moats and plan ahead to dig new moats once existing ones are surmounted.

Under the standing doctrine, US federal courts require plaintiffs to articulate a legally cognizable “injury” to successfully bring a case. Thus, what constitutes an injury is a key issue for cybersecurity, because as the concept of injury is expanded, companies can face lawsuits for having poor security.

The injury determination is part of legal standing, which is the basic threshold issue of whether a plaintiff has suffered a legal wrong to bring a lawsuit against another person. As such, standing is one of the only, but major, choke-points for litigation. In America, it is possible to sue almost anyone; to succeed in the suit is another matter. Standing, as a doctrine, gives defendants an ability to dispose of a lawsuit relatively early in the proceedings.

Standing has long been a contentious issue, among both liberal and conservative legal thinkers. Both liberals and conservatives have reasons to support a stringent standing doctrine that prevents plaintiffs from bringing cases. For liberals, standing can block taxpayer suits—cases where a taxpayer claims that some federal expenditure violates their rights. For instance, if standing doctrine is too loose, anyone who pays any taxes might be able to block government grants, say because they do not want a particular artist or nonprofit to receive government support.

In recent years, conservatives have championed the standing doctrine, limiting the ability for individuals to sue for environmental wrongs, and recently, for privacy and security problems. A similar logic underlies the conservative rationale: if standing doctrine is too loose, any person might sue for the most minor, diffuse environmental or privacy harm. For instance, perhaps a person can sue for noise and smog pollution from a neighbor moving the lawn half a mile away. Panning out, such a diffuse concept of harm means no one could engage in any activity without risking litigation from anyone who is “injured.”

There are deep, principled reasons for a thick standing doctrine. For one, judicial resources are limited. Thus, from a pure resource-allocation perspective, standing doctrine helps courts dispose of less important cases that might gum up the works. But then the question becomes: who decides what is important? How does a society “agree” that a minor wrong has transcended into an injury that should be remedied by a court? History provides many examples of wrongs that once were dismissed as too minor for remedy that later became legal “injuries.” When will security breaches and other security wrongs become legally remediable injuries?

Second, standing helps identify the best plaintiffs—the people who have suffered some wrong and are best placed to articulate why they were wronged. Without some notion of standing, we might imagine that weak or even fake plaintiffs might emerge to bring cases and litigate them without the vigor that true victims might pursue.

Turning to cybersecurity, wrongs are like many other modern harms in their complexity and subtlety. Like environmental harms, cybersecurity harms have no clear geographic scope because an infected computer in Cupertino could join a botnet that attacks a service in Columbia. Cybersecurity also presents creeping aggregate risk, like pollution. Information leaked today, just like chemicals spilled, may or may not accrue to some harm many years later. Cybersecurity risks can become systemic based on small decisions by individuals, but in aggregate impose large costs. For instance, if each of us makes a decision that imposes a small security risk (for instance, buying cheap IoT devices), the collective risk could be quite large (a cheaply acquired botnet of IoT devices).

The standing doctrine requires plaintiffs to prove three elements:

The plaintiff must suffer some actual or threatened injury.

The plaintiff must link that injury to a wrong by the defendant.

The injury must be redressable by the court—practically speaking, the court has to be able to do something about the injury.

The key sticking point in this test is “actual or threatened” injury. Many courts have held that a security breach alone does not create an actual injury. Courts tend to want plaintiffs to show an economic harm, but in most security breaches, the average consumer affected can show no adverse result. And even if there is an adverse result, the company with the breach might blame the injury on some other company that had a breach. The plaintiff bears the burden to prove who was responsible.

Congress can help plaintiffs by creating laws that recognize an injury. For instance, the Computer Fraud and Abuse Act recognizes the concepts of computer damage and loss and requires $5,000 of it for a plaintiff to sue.¹⁴ Similarly, under the federal anti-spam law, Internet service providers can sue senders of commercial email if they are “adversely affected.” Read in a literal sense, the law would seem to green-light millions of cases. But courts have construed this adversely affected language narrowly. Courts see processing of spam as an ordinary cost of doing business.

Turning back to security breaches, beginning in the mid-2010s, courts started to recognize some breaches as constituting an actual injury. Courts may recognize an injury where victims suffer identity theft or fraudulent charges,¹⁵ consumers spend their own money on credit protection or can show their data are being traded on dark-web crime markets, or the data are particularly sensitive, such as in medical records breaches.

What this means is that the standing moat is not as deep as it was just 10 years ago. Many plaintiffs can now surmount it, particularly when forensics shows consumer data is being traded amongst criminals.

The economic loss doctrine is a second moat that is being invoked by some defendants. Confusingly termed, the doctrine limits plaintiffs from using tort theories to recover economic losses in contractual relationships. For instance, a consumer “agrees to” terms of service contract with many websites. If one of those websites subsequently has a breach, the consumer may want to sue in tort rather than contract, because greater damages may be available. The economic loss doctrine can come to the rescue of a defendant in such cases. The defendant could argue the relationship really is a business one, and businesses only should be liable for damages that are discussed in a contract.¹⁶ Because most consumers do not bargain in their contracts with businesses, the contracts may not discuss damages at all.

Like the standing doctrine, the economic loss doctrine is based on sound principle. In essence, its purpose is to stop judicial regulation of business relationships through tort lawsuits. The point is to cabin the financial exposure of people doing business with each other and encourage parties to resolve risk through private contract. Of course, this is a powerful rationale for business-to-business deal making. But consumers cannot negotiate with businesses nor are they sophisticated risk managers. For this reason, we predict courts eventually will see the economic loss doctrine as inapt for consumer-to-business relationships.

6.3.2 The Devil in the Beltway

The conservative legal movement sees administrative agencies, like the FTC, as a problematic and perhaps even unconstitutional development in American law. Administrative agencies are not in the Constitution. These agencies also tread on the territory of the bodies that are—the executive, legislative, and judicial structures designed with careful checks and balances. For instance, the FTC acts just like all three structures: it brings enforcement cases (like the executive), it can make rules to regulate industries (like the legislature), and it even contains a mini-court where it can try its cases (like the judiciary).

At the FTC’s inception, the great Learned Hand remarked about how radical the FTC’s structure is, “A Democratic Congress has actually delegated the broadest kind of personal discretion to a commission of ‘experts,’ a commission, mind you, which combines executive, legislative, and judicial functions. Could there be anything more portentous to those who believe in the adequacy of the Logos, as it comes to us from the Fathers; could there be a more impious attack upon the triune separation of powers? The act achieves a very happy but a most amazing delegation of legislative function.” The conservative legal movement has never agreed with Hand’s conclusion.

Another objection comes from skepticism of “expertise.” Administrative agencies not only dilute legislative power, but they do so in a dangerous way: by empowering unelected experts to make rules and enforce them.

A third objection comes in the vagueness of administrative agencies’ power. You have read the FTC’s organic statute with its vague definition of unfairness and deception. Conservatives are concerned that an agency could run amok with such broad powers and impinge on freedoms. In short, FTC opponents think the agency deprives businesses of “due process” by bringing enforcement actions without first telling businesses what the law is and is not.

Yet, another objection comes in the sense that responsibility for security incidents has become “strict” liability—meaning, in practice, that any business that has a breach is guilty of some wrongdoing, no matter how careful the business was. While the legal standard is “unreasonable security,” in reality, if a client has a breach, one can virtually always locate some “unreasonable” act. Companies want to believe that if they follow procedures, they will be in compliance with the law. But when it comes to security breaches, even companies with diligent and excellent security programs can suffer reputational and legal consequences.

These concerns coalesce and have marshaled a series of challenges to the FTC’s authority—sometimes animated with religious rhetoric claiming the FTC is the devil!

FTC opponents often raise challenges in privacy and security cases, where there is a sense that the FTC’s actions are more unfair to businesses than other consumer protection areas. This is in part because of the posture of a breach where a business typically is a victim of a hacking crime. To be hacked by criminals and then be sued by the FTC is a galling experience. Imagine if your home was burglarized and the police showed up and wrote you a ticket for not locking all your windows!¹⁷

The first important challenge involved the Wyndham Hotels. In that case, the FTC sued the hotel chain after it suffered a series of security breaches. The FTC discovered Wyndham was not following basic security precautions, which the FTC found both deceptive and unfair. In the challenge, the Chamber of Commerce and other conservative legal activists argued the FTC Act was unconstitutionally vague because no one actually knows what the FTC considers to be “reasonable security.”¹⁸

The Third Circuit Court of Appeals sided with the FTC, but how it did so created a strategic complication for the agency.¹⁹ The Third Circuit held that Wyndham was entitled to “fair notice” of the FTC’s reasonable security standard. But what does fair notice mean? Previously issued FTC guidance and settlement agreements—not complaints—do form a kind of “fair notice” of the agency’s opinion.

As a security professional, you must pay attention to the FTC’s activities and keep your organization up to date. Fair notice gives the FTC an easy path forward: it could just keep on bringing enforcement actions with detailed settlement agreements that put companies on “fair notice.”

Now, here’s the strategic complexity: if the FTC creates a formal security or privacy rule, companies are entitled to a different standard: “ascertainable certainty” of the rule’s meaning. There are several interpretations of this standard. Defenders will highlight “certainty” and argue the FTC’s penalties are quasi-criminal, thus ambiguities should be interpreted in favor of their client. The agency will highlight the concept of ascertainable, because it suggests the burden is on the defendant to find out what the rule is. The FTC will argue companies can ascertain what good security is by studying competitors, security incidents, and enforcement actions.

FTC critics declared victory after the Wyndham case, and from a lawyer’s perspective, it could be a victory. This is because the case gives lawyers a new argument to challenge FTC activity. But from firms’ perspective, the victory is hollow. This is because firms suffer reputational damage and negative attention if sued by the FTC.²⁰ Every new legal filing will generate great lawyer fees along with a news cycle about your client’s bad security. If things like customer goodwill and trust matter to your client, even if they “win” the case, they’ll lose in the marketplace.

The second politically notable but practically unimportant litigation involves a medical testing company called LabMD. There is so much litigation and so many contested facts surrounding LabMD that it is best to just get to the case’s outcome in the 11th Circuit. The underlying challenge urged the court to find the FTC lacked jurisdiction to police security as well as standing. The 11th Circuit, however, focused on the remedy the FTC imposed on LabMD. The FTC required LabMD to establish a security program, but the 11th Circuit found this requirement impossibly vague: “In the case at hand, the cease-and-desist order contains no prohibitions. It does not instruct LabMD to stop committing a specific act or practice. Rather, it commands LabMD to overhaul and replace its data-security program to meet an indeterminable standard of reasonableness. This command is unenforceable.”²¹

With that, many declared victory over the FTC. But for firms, nothing much has changed, or the situation is worse for them. This is because the FTC’s response to the court is obvious: just make orders obsessively detailed so they pertain to specific acts.

In the broader context, this is Pyrrhic victory. Clients don’t want excessively detailed rules from the government; they tend to want some ambiguity to enable clever forms of compliance.

The third challenge involved D-Link, a maker of Internet-of-Things devices. Again, opponents of the FTC wanted a court to hold that the agency could not regulate security and its lawsuit was insufficiently vague.

D-Link did get a district court opinion, but the judge held the FTC had authority to police security, and “A consumer’s purchase of a device that fails to be reasonably secure—let alone as secure as advertised—would likely be in the ballpark of a ‘substantial injury,‘ particularly when aggregated across a large group of consumers.”²² But the court also required the FTC to go back and plead its injury claim with more specificity.

Victory was declared again because the FTC had to do more pleading, but like the earlier cases, the victory is hollow. It means FTC lawyers will put more words into complaints; words that previously existed only in their confidential investigative memos. And now those words will be the public record.

D-Link ultimately settled its FTC case. Instead of the standard terms, D-Link agreed to a long, detailed, prescriptive set of rules. That is the practical result of the LabMD challenge: instead of being ordered to “be reasonable and create a security program,” D-Link agreed to a quite detailed and specific set of requirements for a secure software development process.

Question 6.3.1 — Judge for Yourself. Would you rather agree to the terms of the Zoom settlement that you read about in this chapter, or to one of the post-LabMD orders? A representative comparison showing the post-LabMD approach of obsessively detailing requirements comes from D-Link, which is available here (https://perma.cc/PFB9-83WC). A key element to note: the FTC stapled a 50-plus-page-long security standard (International Electrotechnical Commission 62443-4-1) to the order. D-Link must comply with it. Is this good for security? For D-Link?

▄

Question 6.3.2 — Zoom Settled. Assume the authors are wrong and libertarian groups are correct: the FTC suffered a loss of authority in security. Why did Zoom roll over and settle its case so quickly?

▄

Exercise 6.4 — Security Representations. Please find at least one good example of a security representation that you would like to discuss with the class. Perhaps, it is one that you think is problematic, or perhaps one that artfully complies with the kinds of commands issued by the FTC. Be sure to explain why the security representation violates FTC guidance or why it artfully complies with guidance.

▄

6.4 Conclusion

Consumer law is a powerful tool to require security from private firms. The FTC is the most important consumer protection actor in security, although sometimes, consumers can sue in their own right to police security. This chapter teaches us that as cybersecurity professionals, we need to monitor cases emerging from the FTC, particularly when they involve our competitors. These cases send signals about what the evolving definition of “reasonable security” is.

Consumer law has strengths and weaknesses. Its strengths come from its breadth and the implicit notion that consumers do not have equal bargaining power with firms. Its weaknesses come in its deterrent power. The market incentives of building a platform and overtaking competitors make it economically rational to violate consumer protection norms. By the time the FTC catches up, the wrongdoing company has often become dominant. Consumer protection fines then look like a parking ticket to these companies.

A second weakness lurks in the very conception of the consumer protection approach: reasonableness. Is “reasonable security” enough protection in a world where a foreign government could hack a consumer’s oven and cause it to overheat? What if “reasonable security” is too low a standard?

Perhaps, agencies should be seeking a “maximum possible security” standard, or a standard like products liability that treats any form of insecurity as a “defect.” Another alternative would be to regulate connected devices like pharmaceuticals, requiring market testing and proven safety.

Notes

1 Consider the various regulations that target abortion providers and impose various “safety” requirements that suspiciously do not apply to other medical services.

2 Hoofnagle CJ. Federal Trade Commission Privacy Law and Policy. Cambridge University Press, 2016.

3 The legal test for unfairness involves three factors: a practice that causes substantial injury, is not avoidable by the consumer, and has an injury not outweighed by countervailing benefits. A few forces, including a 1994 law, turned the focus to injury. Congress barred the agency from pursuing general public policy goals through unfairness, e.g., by punishing unethical behavior, but rather to focus on injuries: “[the] Commission may consider established public policies as evidence to be considered with all other evidence. Such public policy considerations may not serve as a primary basis for such determination.” 15 USC §45(n).

4 Berman EP. Thinking Like an Economist: How Efficiency Replaced Equality in US Public Policy. Princeton University Press, 2022.

5 In re: Marriott International Customer Data Security Breach Litigation, 8:19-md-02879-PWG (March 30, 2022) (Grimm).

6 In the Matter of Zoom Video Communications, Inc., a corporation, d/b/a Zoom, No. 192 3167 (Final complaint), 2021.

7 In the Matter of Zoom Video Communications, Inc., a corporation, d/b/a Zoom, No. 192 3167(Decision and Order), 2021.

8 National Consumer Law Center. Consumer Protection in the States: A 50 State Evaluation of Unfair and Deceptive Practices Law, 2018. Available from: https://perma.cc/H99L-R8AC.

9 National Conference of State Legislatures. Computer Crime Statutes, 2022. Available from: https://perma.cc/X3HW-L6QR.

10 Office of the California Attorney General. California Data Breach Report, 2016. Available from: https://perma.cc/52Y7-3VNF.

11 The unfortunate “My Friend Cayla” doll, a toy that could be used as a surreptitious listening device, was labeled a security hazard, pulled from shelves, and even banned in Germany.

12 Muddy Waters Capital. MW is short St. Jude Medical, 2016.

13 Kramer DB and Fu K. Cybersecurity concerns and medical devices: lessons from a pacemaker advisory. Jama 2017; 318:2077–8.

14 It turns out that company victims of hacking can easily meet this threshold, because courts broadly construe damage and loss to include expenses such as computer forensics and employee time to repair a system, which quickly add up.

15 Remijas v. Neiman Marcus Group, LLC. 794 F.3d 688, United States Court of Appeals, Seventh Circuit 2015.

16 LaBranche NN. The Economic Loss Doctrine & Data Breach Litigation: Applying the “Venerable Chestnut of Tort Law” in the Age of the Internet. BCL Rev. 2021; 62:1665.

17 This metaphor quickly breaks down. Businesses owe a duty of care to protect their customers. Because businesses collect personal information for their own economic benefit, they have a duty to protect that information even from criminals. Think of it this way: a bank robber is a criminal who steals customers’ money from banks. Banks must still protect against bank robbers, even if the bank also is a victim of the crime.

18 They also argued the FTC had no standing to sue Wyndham under Article III and that the FTC should be subject to heightened pleading requirements typical of common-law fraud litigation.

19 FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (C.A.3), 2015.

20 Author Hoofnagle’s book, FEDERAL TRADE COMMISSION PRIVACY LAW AND POLICY explains that cases only occur after extensive consultation with the agency; if you can’t find a way to settle a matter after it has undergone extensive vetting by the FTC, your client is either completely correct and has suffered a grave injustice or your client is deluded and needs some perspective. Which do you think more likely?

21 LabMD, Inc. v. F.T.C., 776 F.3d 1275, 1278 (C.A.11), 2015.

22 FTC v. D-Link Sys., Inc., N.D. Cal., No. 17-cv-00039, 2017.

7.
Criminal Law

Chapter image: The Discovery of Achilles, Henry Rau Collection, National Museum of American History.

Source: National Museum of American History/Public domain/
https://americanhistory.si.edu/collections/search/object/nmah_582911.

Chapter Learning Goals

Learn the basic economic and practical dynamics of financially motivated hacking: cybercrime.

Understand the different roles law enforcement agencies (LEAs) play in deterring cybercrime.

Understand how some nation-states are involved directly in cybercrime.

Learn the laws that define illegal hacking.

Learn the basic procedures that LEAs use to investigate data on computers.

Computer crimes are legal wrongs so serious that we want to both prevent them and are willing to punish those who commit them. Computer crimes are the things you can do to—or with—a computer that can justify putting a human in a cage. They stand in contrast to the consumer wrongs we covered in the last chapter, which can be serious, yet are punished with fines and other remedies.

The criminal law forms a distinct part of cybersecurity. The act of defining proscribed acts, investigating them, and prosecuting them is an important part of the puzzle. This chapter discusses substantive computer crime law, which defines illegal hacking, and also procedural computer crime law, which defines how law enforcement agencies (LEAs) can obtain user data from companies to investigate crimes.

LEAs approach cybersecurity differently than security thinkers in national security, the military, and the corporate world. This is because LEAs are ultimately concerned with identifying individual wrongdoers and bringing them to justice. This individual deterrence model requires high-quality evidence to get convictions. The focus on the individual as wrongdoer can take attention away from structural security dynamics. Yet, computer crime law does have broader structural effects on cybersecurity, shaping the field in important ways.

7.1 Computer Crime Basics

We can conceive of three classes of situations where computers are relevant to crime. First, there are a few crimes where a computer or network is the “victim.” These are true computer crimes that did not exist before computing. An example is the denial-of-service attack, the flooding of a device with worthless data that flummoxes the victim and prevents it from providing services to legitimate users. Presumably, technical computer security would deter such crimes.

Second, computers can also be tools of ordinary wrongs that have been committed for millennia. For instance, computers make it easier to make threats, commit identity theft, steal intellectual property, and even steal money from bank accounts. The typical computer crime charged in the United States is a “computer as tool” offense: the possession and trading of child sexual abuse material (CSAM), a crime that used to be committed through circulation of physical magazines and pictures.

Cybersecurity as technical computer security (see Chapter 1) has less effect in deterring computer-as-tool offenses. This is because even highly secure computers can be used to steal others’ identities or acquire CSAM. That is, computer-as-tool crimes often do not require any reduction of CIA in another computer.

These two categories, pure computer crimes and computer-as-tool crimes, make up “substantive” computer crime law. The third category of issues surrounds investigative procedure.

Procedure is just as important as substance. That is because almost all crimes create evidence that is captured by some kind of digital device. Procedures include the rules applied to police when they attempt to identify someone online, and the rules for obtaining evidence stored on computers. Whether these procedures are easy or difficult to use makes a big difference in investigations and, ultimately, whether people can be traced online. Practically speaking, can an investigator get the data? If so, suspects are likely to be identified and prosecution brought to bear on them. If not, suspects are likely to operate with impunity until their activities exceed some tolerance point.

7.2 Computer Crime Incentive Contours

Several high-level deterrence theory concepts apply to computer crimes.

Computer crimes are an instrument to some terminal goal, like obtaining money or a political objective. Thus, denial-of-benefits deterrence theory strategies can be effective when focused on those terminal goals. For instance, it is easy to steal credit card numbers online, but these have limited utility and computer criminals need to find ways to “cash out” these numbers for laundered money they can spend. A denial-of-benefits strategy, such as making cash-out more difficult, through bank surveillance and other measures, can impose a ceiling on the amount of computer crime committed. In other words, we may have no deterrent options against stealing credit card numbers. But we can deny criminals the benefits of stealing credit card numbers by making the conversion of cards into usable value more difficult.

Cryptocurrencies, Russia’s WebMoney, stored value cards (known as “gift cards”) from retailers such as Walmart, and other new, less regulated “fintech” payment mechanisms make cash-out easier and computer crime more rewarding. If effective benefits-denial strategies fail or weaken, deterrence theory would predict an increase in computer crimes.

“Hacker”

Colloquially, many use the word “hacking” to describe criminal computer misuse. However, as a word, hacking has a mixed history. It emerged as a label of pride by clever engineers at MIT’s Tech Model Railroad Club, who “hacked” together complex model railroad systems.a Some of the most successful people in the world—such as Mark Zuckerberg—call themselves “hackers.” Yet, the word, particularly in the last decade, has taken on a more negative connotation, being associated with criminal misuse of computing.b

a Levy S. Hackers: Heroes of the Computer Revolution. Volume 14. Doubleday Garden City, NY: Anchor Press, 1984.

b Deibert RJ. Black code: censorship, surveillance, and the militarisation of cyberspace. Millennium 2003; 32:501–30

When computer crime is just an instrument for moneymaking, investigators find that computer criminals act a lot like ordinary business people. Financially motivated cybercriminals have suppliers and contractors and payment company relationships and advertising campaigns and employees and even customers to serve. Those running illegal pharmacies, for instance, are in competition with licensed medical providers. Thus, criminals have to pay close attention to customer satisfaction. Illegal pharmacies must advertise, maintain an open web presence so unsophisticated Internet users can reach them, take orders and charge credit cards, and deliver a product.

Paradoxically, organized computer crime tends to create noisy organizations with many critical dependencies. The paradox is that computer criminals need to have a public face to attract new customers while also operating at a level that does not attract enforcement. Upon inspection, computer criminals are not shadowy at all. Law enforcement can easily impose costs on such actors and even disrupt them—if they want to—by seizing assets and interfering with business relationship dependencies.

Exercise 7.1 — Cybercrime Dependencies. The European Cybercrime Centre (EC3) has carefully mapped out cybercrime dependencies. Please read the explanatory notes, archived here: https://perma.cc/32RL-C7E4 and the dependencies analysis here: https://perma.cc/6JL8-XH3X

▄

There are reasons why Law Enforcement Agencies (LEAs) might want to let the illegal pharmacies alone.¹ One reason is that selling pharmaceuticals is bad, but these criminal groups might turn to far worse activities if their drug selling were disrupted. Illegal pharmacies, since they are mostly Russian-run and it is difficult for US authorities to arrest the operators, might turn to the generation and sale of CSAM, human trafficking, or ransomware.

What Could Be Worse Than…?

The EC3 has documented cases where criminals direct individuals in other nations to torture people on video—in real time. The purchase and delivery of the service can be performed in a strongly encrypted environment and payment can be made through cryptocurrency.a

a Europol. Dark Web Child Abuse: Administrator of DarkScandals Arrested in the Netherlands, 2020 Mar. Available from: https://perma.cc/RHJ5-FVW6.

In some cases, the computer criminal’s terminal goal is to cause harm rather than to make money. Ideologically motivated attacks are more difficult to deter because benefits-denial strategies tend to fail. Such hackers are motivated by personal spite or sometimes even by the desire for fame. An example is an attack on data confidentiality with the purpose of embarrassing another person. A growing, newly proscribed behavior in this category is sometimes called “revenge pornography” or, more appropriately, nonconsensual image posting, where the attacker puts intimate images of other people online to harm them.

Society’s challenge in fighting computer crime has a lot to do with how American law enforcement is organized. First, most policing is local, and local police do not have the resources to train officers in computer crimes. If one were to call the local police department to complain of identity theft, most agencies will do absolutely nothing, and some won’t even take a report. These agencies simply do not know what to do.

Conversely, the LEAs that are trained—the United States Secret Service and Federal Bureau of Investigation (FBI)—are not interested in small-time cases.

Crypto Freedom DPRK?

In 2019, the Department of Justice charged Ethereum (cryptocurrency company) employee Virgil Griffith for traveling to North Korea and teaching its regime how to evade sanctions with cryptocurrency. He led a seminar wearing a North Korean military uniform. Griffith pleaded guilty to conspiracy to violate the International Emergency Economic Powers Act (the law that empowers the government to enforce trade sanctions for national security purposes) and was sentenced to five years in prison.

A 2019 United Nations report found that North Korea used cybercrime to steal $2 billion for its nuclear weapons program.

The lack of training and procedures flows from two other factors: attribution and incentives. Without training, local LEAs do not understand that people are traceable online nor will LEAs know how to trace. The burden of proof adds to the situation: LEAs must collect evidence carefully and must prove people guilty “beyond a reasonable doubt.”

The third dynamic comes from incentives: in any society, LEAs will focus on violent, in-person crimes over other wrongs. Even with a violent-crime focus, most suspects get away with crime. The clearance rate for serious violent crimes in America is just under 50%; only about 1 in 5 property crimes are cleared with arrest.² So, many computer crimes, even those where the suspect stole thousands of dollars, go un-investigated while police struggle with other priorities.

Victim behavior also stymies enforcement of computer crimes. Business victims of computer crime have more incentive to simply write off losses or even collect insurance proceeds than seek retribution against an attacker. This makes sense to businesses because of resource allocations (most attackers are in essence judgment proof) and because investigating requires maintaining the “scene of the crime” and thus isolate revenue-generating equipment for forensic inspection. Participating in prosecution also requires the victim business to make public disclosures about the incident. No business wants to testify in court that they lost millions of dollars to a scammer. Finally, businesses worry that if they open their records to law enforcement, the police will find crimes committed by employees or by the firm itself.

Just Charge the Cybercrime Intermediaries?

The US Department of Justice started criminal investigations of several companies for their roles in online pharmaceutical drug markets in the 2010s. In 2011, Google paid a $500 million settlement to quell allegations that the company knew it was servicing the so-called “Canadian pharmacies” that were marketing drugs illegally to Americans while Google blocked ads for these companies in other nations. Google also faced shareholder lawsuits and committed $250 million to prevent future uses of its ad network for pharmacies.

Both UPS and FedEx, the delivery companies, were investigated for allegedly helping illegal pharmacies route their packages. UPS paid $40 million to end the probe, but FedEx fought the investigation.

A 2014 grand jury indictment brought 18 counts of drug-related crimes against FedEx, including both conspiracy to distribute and actual distribution of controlled substances. The indictment recounted a litany of evidence that the company’s drivers and middle management knew about its shipping of illegal pharmaceuticals and other drugs. For instance, FedEx allegedly changed how it extended credit to online pharmacies so the shipping company would capture more revenue before the pharmacies were detected and shut down by LEAs. FedEx allegedly maintained a list of hundreds of such online pharmacies to manage the risk of lost revenue as a result of police activity. The Department of Justice alleged that FedEx gained $820 million in revenue from servicing illegal online pharmacies.

Alas, the case imploded at trial, and DOJ prosecutors dropped the charges. The cases illustrate the point that cybercriminals need vendors—from advertising companies to delivery services—and these vendors may know of the criminal activity.a

a Kesari A, Hoofnagle C, and McCoy D. Deterring cybercrime: Focus on intermediaries. Berkeley Technology Law Journal 2017; 32:1093.

Who Is Responsible for What?

Serious computer crime incidents that are financially motivated are handled by the United States Secret Service (USSS). Computer incidents motivated by espionage or terrorism are handled by the FBI. Some content-related computer crimes, such as the problem of CSAM, is dealt with by the Immigration and Customs Enforcement agency, and a specially created nonprofit—the National Center for Missing & Exploited Children (NECMEC).

History and path dependency created these jurisdictional divisions. The USSS, long responsible for investigating counterfeiting evolved into the financial crime authority because early computer crimes sometimes involved the printing of fake currency and ingenious schemes to skim money from banks. The FBI’s historical role as mirror of the CIA for purposes of fighting domestic espionage and serious, politically motivated threats to the polity explains its different responsibilities for computer crime. ICE’s focus on CSAM relates to the problem that so much is generated overseas, and Americans sometimes travel to certain nations to abuse children and make imagery of it.

Federal LEAs will only investigate serious computer misuse, with lower-bound thresholds of high-five-figure losses. LEAs also want the victim to participate, yet many victims would rather avoid the publicity.

Federal policy on computer crime prosecution and investigation is set by the Department of Justice’s Computer Crime and Intellectual Property Section (CCIPS). The manual that federal prosecutors and law enforcement uses to make sense of computer crime issues was written by Berkeley Law Professor Orin Kerr.

Some states, like California, have sophisticated “e-crimes” units in their attorney general office. These units typically focus on investigation and evidence recovery rather than prosecuting hackers. Some local jurisdictions have officers on high-technology task forces, again focused primarily on recovering evidence from suspects’ and witnesses’ mobile phones.

In Europe, the most important and capable computer crime organization is Europol’s European Cybercrime Centre (EC3).

Finally, jurisdictional concerns complicate computer crimes because police might interpret the wrong as occurring outside their jurisdiction. After all, a hacker’s activity might take place entirely in another jurisdiction and have effects in many different jurisdictions. Even the most sophisticated LEAs have difficulty obtaining investigatory material in other nations.

7.3 The Political/Economic Cyber Enforcement Strategy

“Criminal states,” as described by Paul Kan, “use illicit schemes to achieve foreign policy goals, such as increasing national prosperity, achieving geostrategic aspirations, and preserving the power of political elites, among other aims.”³ Nations such as Russia experience what Kelly Greenhill labels “kleptocratic interdependence,” that is, “a set of profit- and power-driven, self-reinforcing domestic and international relationships between criminal groups and government officials.”⁴ Russia’s kleptocracy overlooks criminal hacking that is directed at western governments and businesses, because these organized crime groups can be useful when Russia has nation-state hacking goals. Those criminal hackers can be retasked for nation-state hacking purposes.

Starting in the President Obama administration, the Department of Justice began using standard criminal enforcement tools against the klepto-intelligence cycle in both China and Russia. DOJ indicted foreign hackers, even when these alleged criminals lived in countries safe from extradition.

While some in the commentariat thought the indictment strategy ineffective, it netted some important arrests in two senses: First, such indictments are reminiscent of Thomas Schelling’s “hostage taking” from Chapter 5. In effect, these indictments hold the suspect hostage in their home country because the moment the suspect leaves for vacation or a business trip, Interpol or another agency will spot the suspect at the border and make an actual arrest. Believe it or not, a number of indicted hackers have done exactly this and have been arrested while trying to vacation (Figure 7.1).⁵

Second, in addition to arrest, these indictments serve other purposes. The indictments malign these individual hackers, and probably prevent them from obtaining mainstream employment. They will always be known for election interference or pill-selling. The indictments declare that the hacker’s activity is not ordinary soldiering (soldiers enjoy combatant immunity for what would normally be murder) but rather just ordinary crime (Table 7.1).

The indictments have powerful, subtle signals of America’s attribution prowess and perhaps also hacking powers. For instance, including personal photos of the suspects suggests that maybe those images were pulled from private social networks. Thus, the indictments telegraph, “we know exactly who you are, and we are watching you. Sorry, you’re not going to Ibiza this year. Or next…”

Figure 7.1 These alleged Russian hackers appear in a 2020 DOJ indictment.

Source: US Department of Justice https://www.justice.gov/media/1103691/dl/.

Table 7.1 The webs: surface, deep, dark.

Web
Characteristics
Example

Surface web
Publicly open to all, easy to find
The surface web is what you use on a day-to-day basis—basically everything that is available through a Google search

Deep web
Publicly available, but inconvenient to find
The deep web are all those services that are not advertised through regular search engines. Examples are companies’ intranets or even specialized databases such as UC Berkeley’s student directory

Dark web
Publicly available, but requires special, surveillance-flummoxing encryption software that makes it difficult to track user activity
The dark web requires special software like Tor or I2P to access an encrypted layer of information that adjacent to the surface web. Technically, these resources are public, but to find them, you typically need to know special URLs. The important point is that it is possible to have anonymity on the dark web. Thus, bad actors can run CSAM businesses and drug trafficking with deniability, and most law enforcement cannot deter them, while FBI, EC3, and intelligence agencies can

Perhaps the hackers do not care about Ibiza. After all, Russia is a big country with many places to visit. To levy other punishment, the US government uses economic sanctions against foreign hackers that effectively “arrest” their assets so they cannot participate in international finance.⁶

This punishment is exercised through the Department of the Treasury’s Office of Foreign Assets Control (OFAC), which maintains the “Specially Designated Nationals and Blocked Persons List (SDN).” This is a publicly available database that one can download to screen potential customers (Figure 7.2).⁷

U.S. persons, companies, and, perhaps most importantly, banks, are prohibited from engaging in transactions with any company or person in the database. Because of the network effects and surveillance power in international banking,⁸ being designated effectively locks sanctioned entities out of banking.⁹ Thus, the indictment strategy can impose lifelong financial harm on the accused Russian hackers.

Figure 7.2 The SDN search tool and Russian hackers sanctioned under the CYBER2 and ELECTION-EO13848 programs.

7.4 Cybercrime’s Technical Dependencies

Computer crime can be thought of as ordinary business, but cybercriminals do have some special needs. Computer criminals need to be able to communicate securely and privately, advertise their wares, and transfer value (pay people and be paid). The technologies that make these three functions possible change with time. As we write this, five technologies are crucial:

Email marketing It may seem quaint, but email continues to be an important channel for marketing (for illegal goods) and attack (for phishing) for criminals.¹⁰ Most people do not take unsolicited commercial email—spam—seriously as a problem, but if economic studies are correct, spam imposes an enormous cost on society while a small number of spam operators make money from it.¹¹ The United States has a federal law regulating spam that is widely considered to be completely ineffective and useless. Over 90% of all email is spam, and thus, the spam problem is seen as a technical problem where large email providers, such as Google, filter spam.

Why do people buy things from spam? Brian Krebs studied consumers who responded to spam offers for pharmaceuticals, finding that “The majority appear to be technologically unsophisticated people making rational (if potentially risky) choices …”¹² Krebs goes on to explain that for people faced with the need for pricey pharmaceuticals, spam offers from “Canadian pharmacies” are a logical bet. Believe it or not, most of the time, it is a good bet for the consumer.¹³

Tor The Onion Router (Tor) is a free and easy-to-use software package that makes it possible to browse the regular Internet with pretty reliable anonymity. It also enables access to the “dark web.” Tor makes two criminal goals possible: using Tor’s hidden services capabilities, criminals can advertise their wares on the dark web with deniability, that is, they can post information without revealing who they are, that they wrote it, or where the server hosting the information is. These capabilities were key for enterprises like “The Silk Road” and its descendants—websites that advertised narcotics and other drugs. The dark web is also used to sell personal information and credit card numbers and post databases of stolen personal information.

Conversely, Tor’s basic browsing capabilities make it possible for consumers of contraband to visit dark websites and place orders. These two capabilities—hidden services and anonymous browsing—can be separated and independently assessed for their value.

Tor was developed by the United States Naval Research Laboratory. Despite the criminal uses of Tor, the government remains a strong supporter of it. This is because Tor also makes it possible for intelligence assets to communicate and for people who live in repressive countries to visit American websites. Both the New York Times and the CIA operate an “.onion” version of their websites on the dark web.

Custom phones Organized criminals are willing to pay thousands of dollars for specialized encrypted phones (cameras and GPS manually removed!) and linked services that offer high levels of confidentiality. In 2017, the EC3 and national police in several European nations infiltrated one such platform, Encrochat. In combined raids, the LEAs arrested over 700 people, seized tens of millions in cash, and tons of drugs based on information gleaned from Encrochat services.

Cryptocurrencies Cryptocurrencies such as Bitcoin are speculative investment and value-transfer mechanisms that are based on a distributed ledger, a kind of shared database, that is difficult to corrupt. The shared ledger is an authoritative record of currency ownership and transfer.

When cryptocurrencies first emerged, they were touted as decentralized and anonymous value-transfer systems. But, cracks quickly emerged in this narrative. Cryptocurrencies are not anonymous, in fact, because the act of buying them and trading them creates transactions that tend to reveal identity. Additionally, cryptocurrencies are unique assets, meaning it is possible to determine that a specific coin was stolen or involved in an illegal transaction.

There are techniques to launder cryptocurrencies and mask identities. Several cryptocurrency alternatives have emerged that promise greater anonymity, such as Zcash. At the same time, commercial services study ledgers and create new techniques to identify owners of cryptocurrencies.

Low-regulation payments Practically speaking, the most challenging part of cybercrime is getting paid. Average Internet users are unlikely to have cryptocurrencies like Bitcoin, but they can easily obtain stored value cards from retailers and transfer money by revealing the secret codes on them. Thus, for some attackers, their goal is to get the victim to go to Walmart and buy Visa gift cards or the like. Any new payment system will have a moment when it becomes favored by cybercriminals, but over time, law enforcement tends to bear down and reform these systems.

All of these technologies have perfectly legitimate uses and a free society should allow people to have them. Yet, we could contemplate a spectrum of controls and accountability placed on them. For instance, we might want a system for anonymous payment as long as value transfers are small and cannot be aggregated.¹⁴ Or we might accept the anonymous web browsing capabilities of Tor while rejecting protocols for hidden services.

Exercise 7.2 — Try the Tor Browser Bundle. Tor—short for The Onion Routing—is now available as an easy-to-install and use “browser bundle” here: https://www.torproject.org/download/

Download Tor and try it out. What is it like to visit ordinary websites while using Tor? Could you imagine using Tor for your daily web browsing? Also try to find some .onion sites.

▄

7.5 The Major Substantive Computer Crime Laws

This section provides a high-level overview of federal crimes intended to deter computer-related offenses. As you read them, consider Congress’s goals and whether these crimes fit cybersecurity challenges.

7.5.1 Identity Theft

Because identity is so important to crime, we start with identity theft. The following statutes are highly edited.

18 USC §1028. Fraud and related activity in connection with identification documents, authentication features, and information

(a) Whoever, in a circumstance described in subsection (c) of this section–

(1) knowingly and without lawful authority produces an identification document, authentication feature, or a false identification document;

[…]

(7) knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, or in connection with, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law; or

(8) knowingly traffics in false or actual authentication features for use in false identification documents, document-making implements, or means of identification;

shall be punished…

18 USC 1028a

(3) the term “identification document” means a document made or issued by or under the authority of the United States Government, a State, political subdivision of a State, a sponsoring entity of an event designated as a special event of national significance, a foreign government, political subdivision of a foreign government, an international governmental or an international quasi-governmental organization which, when completed with information concerning a particular individual, is of a type intended or commonly accepted for the purpose of identification of individuals;

Question 7.5.1 — Reflecting on 1028. What does this law prohibit? What do you think Congress’s intent was? What would be the arguments for making this law broader (or narrower)? Can you see this law being applied to reduce cybersecurity problems?

▄

In addition to §1028, the US has a separate law to address fraud involving “access devices.”

§1029. Fraud and related activity in connection with access devices

(a) Whoever—

(1) knowingly and with intent to defraud produces, uses, or traffics in one or more counterfeit access devices;

(2) knowingly and with intent to defraud traffics in or uses one or more unauthorized access devices during any one-year period, and by such conduct obtains anything of value aggregating $1,000 or more during that period;

[…]

(4) knowingly, and with intent to defraud, produces, traffics in, has control or custody of, or possesses device–making equipment;

[…]

(1) the term “access device” means any card, plate, code, account number, electronic serial number, mobile identification number, personal identification number, or other telecommunications service, equipment, or instrument identifier, or other means of account access that can be used, alone or in conjunction with another access device, to obtain money, goods, services, or any other thing of value, or that can be used to initiate a transfer of funds (other than a transfer originated solely by paper instrument);

[…]

(3) the term “unauthorized access device” means any access device that is lost, stolen, expired, revoked, canceled, or obtained with intent to defraud;

Question 7.5.2 — Access Device Fraud. A similar set of questions are raised by this statute—what is its apparent purpose? Might it be useful to address Internet fraud?

▄

The identity theft laws structure the crime around specific, financially motivated misconduct—the procurement of false identification documents, credit cards, and other identity-related documents for the purpose of obtaining some benefit (typically, money or government benefits, such as social security). Such conduct can range from dangerous (fake identification documents that allow criminals to get away) to financial theft (credit card fraud). These are behaviors we all can agree ought to be illegal.

There is no general, legally enforceable regime that requires us to use our true names online. Generally speaking, we can pretend to be someone we are not online.

One could imagine an alternate regime where everyone had to register their true identity before using the Internet, much like one has to register in order to obtain a passport. Instead, we allow people to choose how they will represent their identity, even if their choices are misleading. For instance, one is free to register a domain name that is misleading, an email address that uses a pseudonym, and so on. “Catfishing,” the practice of posting the photograph of another, more attractive person to get dates is a social wrong but not a criminal one. In a broad sense, “impersonation” is rampant online. If you have ever used a friend’s password to watch Netflix or HBO, you have impersonated another to access a computer system.

Question 7.5.3 — Where to Draw the Line on Impersonation? The law’s dividing line for impersonation is mostly tied to forms of financial fraud. When should impersonation in social settings be proscribed?

▄

Our society has never fully wrestled with how to address nonfinancial impersonation. Consider the 2017 Federal Communications Commission proceeding concerning “network neutrality,” the rules that prescribe how Internet broadband providers must handle provision of websites and other services. The proceeding was quite contentious and high stakes for consumers and providers alike. In order to stop strong network neutrality rules, broadband providers hired marketing companies to recruit consumers to file comments supporting the broadband industry’s positions. Such marketing for political advocacy purposes is perfectly legal and commonplace—frequently described as “astroturfing.” However, several of the marketing firms created fake comments on behalf of real Americans and submitted these comments to the Federal Communications Commission (FCC) as genuine. One of the firms even used personal information from a data breach that was posted online to populate the fake comments!

There was misconduct on both sides of the debate—pro-network neutrality activists also created fake comments. A 19-year-old computer science student submitted over 7 million fake comments in support of tougher neutrality rules using synthetic identities (names created by fake-name generators). This misconduct was detailed by the New York attorney general in 2021, four years after the fake comment campaign.¹⁵

The New York attorney general settled with the marketing companies that created the fake comments in the names of real people in 2023—six years after the FCC proceeding. The settlement points to illegal impersonation of Americans, but reading between the lines, it is clear the attorney general did not have a solid criminal case against the marketing companies. The impersonation by the marketing companies looked like identity theft, but contextually, the state statutes did not fit their misconduct. The young computer scientist would have an even stronger defense against charges because the student did not use real identities.

The investigation raises interesting implications for the management of disinformation campaigns: are enforcers fast enough to deter disinformation, given this investigation took so many years to resolve? If a law bans impersonation, should it criminalize both the wrongdoing of the marketing companies who used real identities and the student who used synthetic identities? And if we use the criminal law to deter disinformation fabricators, might the law also criminalize the casual impersonation that is so common on the Internet?

7.5.2 The Computer Fraud and Abuse Act (CFAA)

The CFAA is America’s primary anti-hacking criminal statute. In fact, it represents the worldwide approach to computer crime because its concepts are incorporated into treaties. At the highest level, the CFAA conceives of computer crime as a kind of trespass.

Enacted in 1984, the CFAA was supported by the Reagan administration. It is rumored that President Reagan supported the law in part because he saw a popular 1983 movie called WARGAMES, where an adorable adolescent hacks his way into a nuclear command-and-control system, nearly triggering a war with the Soviet Union.¹⁶ Reagan asked his advisors whether the movie’s premise was plausible and military leaders reported back that indeed, it was not just plausible, but the condition of nuclear command-and-control was even more vulnerable than the movie presented!

The original CFAA was a narrow statute that protected just the most important computing systems, such as military computers and the computers of banks. But, a parade of noisome hacking events subsequently occurred that made it difficult for the government to prosecute the suspected hackers. Over time, the Department of Justice cajoled Congress to broaden the law to catch the “one that got away.” Today, the CFAA is a broad statute that arguably criminalizes computer uses that are routine in the private sector!

The Internet, particularly the web, poses a conceptual challenge for defining what activity is crime. This is because the Internet is fundamentally open. Users can try to connect with web services even if the user has no legitimate business with it. In effect, businesses invite people to visit their web pages, just as businesses invite consumers to visit their stores. But, in the physical world, it is clear when one has overstayed their welcome: the owner complains or kicks the consumer out.

On the web, the division between welcome and unwelcome interaction is harder to signal. The redlines can be quite subtle. All businesses want consumers to visit their stores and websites and shop. The visitor to a physical Best Buy store who brings along a camera to photograph all the products and their prices is likely to be swiftly kicked out. Yet, the exact same behavior can be automated, even at scale, on websites with simple terminal commands, such as wget -r bestbuy.com.

To use another example, if one decided to visit the Best Buy store and test all its doors to see if they were unlocked (a security vulnerability), one would be swiftly ejected, perhaps even arrested for attempted burglary. But, online, automated scanning and testing of bestbuy.com is both trivial and commonplace using a terminal command called nmap. A commercial service call Shodan.io regularly scans the entire public Internet, reporting on services that are misconfigured, vulnerable, or have a default password or no password. Turning back to the physical world, if one were to host a website that reported on all the local stores and whether they forgot to lock the front door that night, the police would see that as a form of abetting burglary.

The CFAA addresses the conceptual challenge of computer access by using principles of trespass law. At least on a surface level, the parallels seem apt. Property owners may lawfully exclude, and even use violence to expel, others. At the same time, social practicalities accommodate and sanction a wide variety of uses of others’ property. One can have social and business guests, for instance, and property owners can impose limits on these visitors based on bad behavior. The law also classifies some deviant guest behavior as trespassing. For instance, a dinner guest who sneaks upstairs into a bedroom to steal is a trespasser. Similarly, a person who tricks a homeowner into consenting to access, for example, a burglar posing as a gas meter reader, is also a trespasser.

Turning to computing, the CFAA tries to capture these contours using the language of “authorization.” Authorized users are guests who have permission to access information systems, but unauthorized ones are computer trespassers subject to criminal liability. The question becomes: what is authorization? What are the kinds of behaviors we accept from guests on computer systems, and when are those behaviors more like the dinner guest stealing from the bedroom?

Please read the statute carefully. Note that the most used provision is (a)(2).

18 USC §1030. Fraud and related activity in connection with computers

(a) Whoever—

(1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations…

(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—

(A) information contained in a financial record of a financial institution…

(B) information from any department or agency of the United States; or

(C) information from any protected computer;

(3) intentionally, without authorization to access any nonpublic computer of a department or agency of the United States, accesses such a computer of that department or agency that is exclusively for the use of the Government of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States;

(4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any one-year period;

(5)(A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

(B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or

(C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.

(6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if—

(A) such trafficking affects interstate or foreign commerce; or

(B) such computer is used by or for the Government of the United States; 3

[…]

shall be punished as provided in subsection (c) of this section.

[…]

(e) As used in this section—

(1) the term “computer” means an electronic, magnetic, optical, electrochemical, or other high-speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device;

(2) the term “protected computer” means a computer—

(A) exclusively for the use of a financial institution or the United States Government…

(B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States…

(6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;

(8) the term “damage” means any impairment to the integrity or availability of data, a program, a system, or information;

(11) the term “loss” means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service;

(f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States.

(g) Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief… .

Question 7.5.4 — CFAA Basics. This is a complex statute but there are elements we want you to be prepared to discuss:

Prima Facie Elements What are the basic elements of a CFAA claim (focus on (a)(2)(C))? That is, what must a prosecutor prove at a minimum to convict someone under the CFAA?

(a)(1) This is known as the espionage provision of the CFAA; to our knowledge it has never been used.

Private enforcement Notice that (g) creates a civil remedy. But what is special about “damage” and “loss”?

Jurisdiction Notice that the CFAA protects all Internet-connected computers—even those in foreign countries.

LEA & IC immunity Notice that (f) makes this law inapplicable to a broad scope of government hacking. Notice that the military isn’t included in the shield.

Penalties The CFAA is a “wobbler.” A basic conviction under the CFAA is a misdemeanor but it is very easy to trigger a felony enhancement. For instance, a hack that affects more than 10 computers qualifies as a felony enhancer.

▄

Here’s the most important point to consider: “unauthorized access”—the linchpin of a CFAA violation—is not satisfactorily defined by the statute. For decades, the borders of “authorization” were debated in CFAA litigation. Now, we have a case from the Supreme Court directly on point. Does it settle the matter?

141 S.Ct. 1648

SUPREME COURT OF THE UNITED STATES

No. 19–783

NATHAN VAN BUREN, PETITIONER v. UNITED STATES

June 3, 2021

JUSTICE BARRETT delivered the opinion of the Court.

Nathan Van Buren, a former police sergeant, ran a license-plate search in a law enforcement computer database in exchange for money. Van Buren’s conduct plainly flouted his department’s policy, which authorized him to obtain database information only for law enforcement purposes. We must decide whether Van Buren also violated the Computer Fraud and Abuse Act of 1986 (CFAA), which makes it illegal “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”

He did not. This provision covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them.

Technological advances at the dawn of the 1980s brought computers to schools, offices, and homes across the nation. But as the public and private sectors harnessed the power of computing for improvement and innovation, so-called hackers hatched ways to co-opt computers for illegal ends. After a series of highly publicized hacks captured the public’s attention, it became clear that traditional theft and trespass statutes were ill suited to address cyber crimes that did not deprive computer owners of property in the traditional sense. See Kerr, Cybercrime’s Scope: Interpreting “Access” and “Authorization” in Computer Misuse Statutes, 78 N. Y. U. L. REV. 1596, 1605–1613 (2003).

Congress, following the lead of several states, responded by enacting the first federal computer-crime statute as part of the Comprehensive Crime Control Act of 1984. §2102(a), 98 Stat. 2190–2192. A few years later, Congress passed the CFAA, which included the provisions at issue in this case. The Act subjects to criminal liability anyone who “intentionally accesses a computer without authorization or exceeds authorized access,” and thereby obtains computer information. 18 U.S.C. §1030(a)(2). It defines the term “exceeds authorized access” to mean “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” §1030(e)(6).

Initially, subsection (a)(2)’s prohibition barred accessing only certain financial information. It has since expanded to cover any information from any computer “used in or affecting interstate or foreign commerce or communication.” §1030(e)(2)(B). As a result, the prohibition now applies—at a minimum—to all information from all computers that connect to the Internet. §§1030(a)(2)(C), (e)(2)(B).

This case stems from Van Buren’s time as a police sergeant in Georgia. In the course of his duties, Van Buren crossed paths with a man named Andrew Albo. The deputy chief of Van Buren’s department considered Albo to be “very volatile” and warned officers in the department to deal with him carefully. Notwithstanding that warning, Van Buren developed a friendly relationship with Albo. Or so Van Buren thought when he went to Albo to ask for a personal loan. Unbeknownst to Van Buren, Albo secretly recorded that request and took it to the local sheriff’s office, where he complained that Van Buren had sought to “shake him down” for cash.

The taped conversation made its way to the Federal Bureau of Investigation (FBI), which devised an operation to see how far Van Buren would go for money. The steps were straightforward: Albo would ask Van Buren to search the state law enforcement computer database for a license plate purportedly belonging to a woman whom Albo had met at a local strip club. Albo, no stranger to legal troubles, would tell Van Buren that he wanted to ensure the woman was not in fact an undercover officer. In return for the search, Albo would pay Van Buren around $5,000.

Things went according to plan. Van Buren used his patrol-car computer to access the law enforcement database with his valid credentials. He searched the database for the license plate Albo had provided. After obtaining the FBI-created license plate entry, Van Buren told Albo he had information to share.

The Federal Government then charged Van Buren with a felony violation of the CFAA on the ground that running the license plate for Albo violated the “exceeds authorized access” clause of 18 U.S.C. §1030(a)(2).

Both Van Buren and the government raise a host of policy arguments to support their respective interpretations. But we start where we always do: with the text of the statute. Here, the most relevant text is the phrase “exceeds authorized access,” which means “to access a computer with authorization and to use such access to obtain…information in the computer that the accesser is not entitled so to obtain.” §1030(e)(6).

The parties agree that Van Buren “access[ed] a computer with authorization” when he used his patrol-car computer and valid credentials to log into the law enforcement database. They also agree that Van Buren “obtain[ed] …information in the computer” when he acquired the license-plate record for Albo. The dispute is whether Van Buren was “entitled so to obtain” the record.

“Entitle” means “to give …a title, right, or claim to something.” The parties agree that Van Buren had been given the right to acquire license plate information—that is, he was “entitled to obtain” it—from the law enforcement computer database. But was Van Buren “entitled so to obtain” the license plate information, as the statute requires?

Van Buren says yes. He notes that “so,” as used in this statute, serves as a term of reference that recalls “the same manner as has been stated” or “the way or manner described.” The disputed phrase “entitled so to obtain” thus asks whether one has the right, in “the same manner as has been stated,” to obtain the relevant information. On this reading, if a person has access to information stored in a computer—e.g., in “Folder Y,” from which the person could permissibly pull information—then he does not violate the CFAA by obtaining such information, regardless of whether he pulled the information for a prohibited purpose. But if the information is instead located in prohibited “Folder X,” to which the person lacks access, he violates the CFAA by obtaining such information.

The phrase “is not entitled so to obtain” is best read to refer to information that a person is not entitled to obtain by using a computer that he is authorized to access.

While the statute’s language “spells trouble” for the government’s position, a “wider look at the statute’s structure gives us even more reason for pause.”

The interplay between the “without authorization” and “exceeds authorized access” clauses of subsection (a)(2) is particularly probative. Those clauses specify two distinct ways of obtaining information unlawfully. First, an individual violates the provision when he “accesses a computer without authorization.” §1030(a)(2). Second, an individual violates the provision when he “exceeds authorized access” by accessing a computer “with authorization” and then obtain information he is “not entitled so to obtain.” §§1030(a)(2), (e)(6).

The “without authorization” clause, Van Buren contends, protects computers themselves by targeting so-called outside hackers—those who “acces[s] a computer without any permission at all.” Van Buren reads the “exceeds authorized access” clause to provide complementary protection for certain information within computers. It does so, Van Buren asserts, by targeting so-called inside hackers—those who access a computer with permission, but then “’exceed’ the parameters of authorized access by entering an area of the computer to which authorization does not extend.”

Van Buren’s account of subsection (a)(2) makes sense of the statutory structure because it treats the “without authorization” and “exceeds authorized access” clauses consistently. Under Van Buren’s reading, liability under both clauses stems from a gates-up-or-down inquiry—one either can or cannot access a computer system, and one either can or cannot access certain areas within the system. And reading both clauses to adopt a gates-up-or-down approach aligns with the computer-context understanding of access as entry.

To top it all off, the government’s interpretation of the statute would attach criminal penalties to a breathtaking amount of commonplace computer activity.

If the “exceeds authorized access” clause criminalizes every violation of a computer-use policy, then millions of otherwise law-abiding citizens are criminals. Take the workplace. Employers commonly state that computers and electronic devices can be used only for business purposes. So on the government’s reading of the statute, an employee who sends a personal e-mail or reads the news using her work computer has violated the CFAA. Or consider the Internet. Many websites, services, and databases—which provide “information” from “protected computer[s],” §1030(a)(2)(C)—authorize a user’s access only upon his agreement to follow specified terms of service. If the “exceeds authorized access” clause encompasses violations of circumstance-based access restrictions on employers’ computers, it is difficult to see why it would not also encompass violations of such restrictions on website providers’ computers.

In sum, an individual “exceeds authorized access” when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off limits to him. The parties agree that Van Buren accessed the law enforcement database system with authorization. The only question is whether Van Buren could use the system to retrieve license-plate information. Both sides agree that he could. Van Buren accordingly did not “excee[d] authorized access” to the database, as the CFAA defines that phrase, even though he obtained information from the database for an improper purpose. We therefore reverse the contrary judgment of the Eleventh Circuit and remand the case for further proceedings consistent with this opinion.

It is so ordered.

Justice THOMAS, with whom THE CHIEF JUSTICE and Justice ALITO join, dissenting.

Both the common law and statutory law have long punished those who exceed the scope of consent when using property that belongs to others. A valet, for example, may take possession of a person’s car to park it, but he cannot take it for a joyride. The Computer Fraud and Abuse Act extends that principle to computers and information. The Act prohibits exceeding the scope of consent when using a computer that belongs to another person.

As a police officer, Nathan Van Buren had permission to retrieve license-plate information from a government database, but only for law enforcement purposes. Van Buren disregarded this limitation when, in exchange for several thousand dollars, he used the database in an attempt to unmask a potential undercover officer.

The question here is straightforward: Would an ordinary reader of the English language understand Van Buren to have “exceed[ed] authorized access” to the database when he used it under circumstances that were expressly forbidden? In our view, the answer is yes. The necessary precondition that permitted him to obtain that data was absent.

…Van Buren’s conduct was legal only if he was entitled to obtain that specific license-plate information by using his admittedly authorized access to the database.

He was not. A person is entitled to do something only if he has a “right” to do it. Black’s Law Dictionary 477 (5th ed. 1979); see also American Heritage Dictionary 437 (def. 3a) (1981) (to “allow” or to “qualify”). Van Buren never had a “right” to use the computer to obtain the specific license-plate information. Everyone agrees that he obtained it for personal gain, not for a valid law enforcement purpose. And without a valid law enforcement purpose, he was forbidden to use the computer to obtain that information.

Consider trespass. When a person is authorized to enter land and entitled to use that entry for one purpose but does so for another, he trespasses. As the Second Restatement of Torts explains, “[a] conditional or restricted consent to enter land creates a privilege to do so only in so far as the condition or restriction is complied with.” §168, p. 311 (1964). The Restatement includes a helpful illustration: “3. A grants permission to B, his neighbor, to enter A’s land, and draw water from A’s spring for B’s own use. A has specifically refused permission to C to enter A’s land and draw water from the spring. At C’s instigation, B enters A’s land and obtains for C water from the spring. B’s entry is a trespass.” Ibid., Comment b.

What is true for land is also true in the computer context; if a company grants permission to an employee to use a computer for a specific purpose, the employee has no authority to use it for other purposes.

Question 7.5.5 — Technology or Policy? Justice Barrett uses a metaphor to explain both unauthorized use and exceeding authorization: “Under Van Buren’s reading, liability under both clauses stems from a gates-up-or-down inquiry—one either can or cannot access a computer system, and one either can or cannot access certain areas within the system.”

What do you think a gates-up-or-down signal is? Is it only technical barriers, like a password, that logically separate a system among users? Or could it be a stern, directed warning, such as a cease and desist letter?

▄

Question 7.5.6 — Attacking Computers Without Accessing Them. The CFAA conceptualizes attackers as people sitting at a keyboard. But as we are surrounded by embedding computing, could you imagine ways of attacking computers without “accessing” them?

An example comes in a seminal paper by computer scientists who showed that by placing carefully designed pieces of tape on a stop sign, they could cause computer vision systems to interpret the stop sign as a speed limit sign.a

Panning out, imagine a future where more of our safety is dependent on computers sensing the world and making decisions about it. How might attackers fool those sensors and sense-making systems? Should fooling these systems be an illegal form of hacking?

▄

a Eykholt K, Evtimov I, Fernandes E, Li B, Rahmati A, Xiao C, Prakash A, Kohno T, and Song D. Robust Physical-World Attacks on Deep Learning Visual Classification. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018 Jun.

What to Do About Bad Insiders?

After Van Buren, author Hoofnagle and colleagues warned:

Insider access abuse in large-scale databases is real (as exemplified by Officer Van Buren) and can be difficult to deter, detect, and prevent. An early 1990s case suggests multiple risks of undetected insider abuse. An IRS employee, apparently a Ku Klux Klan leader, improperly obtained tax returns on a woman he was dating as well as the district attorney who was prosecuting the employee’s father, political opponents, and others. While the IRS reportedly had audit trails intended to detect such abuse, most organizations rarely (if ever) proactively monitor them, relying instead on potential after-the-fact punishment.

[…]

Civil libertarians may cheer the court’s pruning back of the CFAA, but this victory will be a Pyrrhic one if government and private owners of intellectual property do not find other ways to deter, detect, and prevent wrongdoing. In this era of massive data and analytics capabilities, insiders and outsiders can do great damage to privacy and civil liberties if left unchecked.a

After Van Buren, how can institutions with sensitive data stop employees from, let’s say, using their technical access for stalking or political leaks?

a Cunningham B, Grant J, and Hoofnagle CJ. Fighting Insider Abuse After Van Buren. LawFare, 2021.

7.5.3 Other Computer Crime Relevant Statutes

A course in computer crime might spend weeks examining the different dynamics of various criminal statutes. Here, we limit our focus to the most important ones, summarized at a high level:

The Cybercrime Convention Also known as the Budapest Convention (2001) and signed by over 60 states, the Cybercrime Convention was the first international treaty on Internet crimes, writ broadly—it covers copyright, CSAM, and hacking, and also provides procedural mechanisms for evidence gathering. It is fundamentally modeled on the CFAA. Tensions surrounding the treaty have increased as hate-speech provisions have been added as criminal wrongs, an approach probably unconstitutional in America.

The Wiretap Act In the 1960s, Congress created a comprehensive privacy regime for telephone networks and framework was later applied to the Internet (after all, most early Internet was provided by phone companies). The Wiretap Act carries criminal and civil provisions for interferences with the confidentiality and integrity of communications. However, Internet companies have tended to escape the hard-line interpretations of the statute, perhaps because courts do not understand Internet technologies. For instance, courts stringently limited phone companies’ monitoring of call content even for security reasons, but when the Internet became popular, courts allowed providers to “listen in” on email and other communications even for marketing purposes.

Stored Communications Act (SCA) In 1986, Congress updated communications privacy laws to address electronic communications, but did so using a mental model (mainframe business computing) that was popular at the time but is confusing today. The SCA is discussed below, primarily as setting forth the procedure for law enforcement to get access to user data.

Pen Register Act This law was enacted to protect the phone numbers people dial, but it is broad enough to cover other monitoring of wireless phones. Read literally, it prohibits tracking cell phones by monitoring their signals; but only the government can enforce the law and it has not used it to stop wireless phone tracking.

Cybersecurity Information Sharing Act (CISA) Enacted in 2015, CISA—which confusingly shares an acronym with the cybersecurity agency CISA—was intended to encourage cybersecurity information sharing among companies and the government. As you have read this list of statutes, you might be concerned the Wiretap or Stored Communications Acts barred some of your cybersecurity monitoring. However, in a sweeping provision, CISA immunizes companies from privacy liability under all federal laws when companies monitor their own networks for cybersecurity purposes. Because this law is less about criminal prosecution, we discuss it in the context of cybersecurity information sharing and in private-sector cybersecurity.

The Digital Millennium Copyright Act (DMCA) DMCA and intellectual property laws are powerful tools against cybercrime because they protect property—a thing that courts recognize as valuable. Thus, DMCA can be used to “take down” images in services appropriated by others. DMCA also creates legal protections for “digital locks” used to secure content. DMCA is discussed in Chapter 9.

Electronic Espionage Act (EEA) EEA criminalizes theft of trade secrets for economic benefit or to aide a foreign nation. EEA has been used to prosecute people alleged to have stolen trading algorithms from banks. EEA is discussed in Chapter 9.

Fraud Fraud statutes typically involve a suspect who deliberately set out to trick another person out of money or property. Computer crimes can be charged as wire fraud, because they often involve the movement of significant assets over state lines. The Wire Fraud statute is a powerful law that can be used to charge people with felonies.

State Laws All states have a mini-CFAA and identity theft laws; these laws are sometimes problematically broad in scope.

Taken together, this long list of criminal statutes shows that under-criminalization is not a constraint in punishing hacking. The government has a lot of legal tools backed up by the possibility of long prison sentences. The primary constraints are the above-discussed factors and contours that have left us with untrained law enforcement, victims with conflicting interests, and an international political landscape with effective safe harbors for criminals.

7.5.4 Digital Abuse

Everyone needs security to be free, including every individual in a household—even children. While this book frames foreign actors and criminals as the principal threat actor, sometimes the threat actor is much closer—even inside one’s own home. Survivors of domestic violence and stalking often experience “digital abuse,” the use of technology to track, stalk, threaten, and harass others. Abusers use technology to intimate and impress a feeling of total control over others. Some digital abusers also use threats and manipulation to obtain nude images of children.

Much of this activity is unlawful: digital abuse can violate the criminal law, violate intellectual property laws, and give survivors rights of action under tort law (meaning the survivor can sue the aggressor for damages in civil court). Yet, survivors of digital abuse often have difficulty getting help from law enforcement and the legal system generally. Sometimes survivors of digital abuse are not protected by police for the same reasons survivors of physical domestic violence are underserved by law enforcement.

Most of the criminal laws discussed above might be used against a digital abuser.

Identity theft laws might be used against a digital abuser who impersonates another for financial gain.

Computer hacking laws could be used against a digital abuser who logs or hacks into another’s email, chat, or other service without permission.

Computer hacking laws could be used against abusers who impersonate a victim in an attempt to get records about them through social engineering and pretexting.

Using a GPS beacon or similar technology to track another without their knowledge and consent can violate stalking laws.

Using software to spy on communications of another is wiretapping and subject to major fines and imprisonment.

Federal law broadly bans making threats over the Internet (this is covered in depth in Chapter 9).

Many states have specific statutes to address stalking via technology.

Many states have statutes to prohibit the circulation of private images and the use of such images to extort people.

Deterrence theory explains why digital abusers are so difficult to deal with: Abusers frequently do not respond to threats. Abusers may be overcome with emotion and hate, and simply not comply with deterrent threats. Some abusers are not ordinary economic actors and so standard techniques, such as threat of lawsuits, simply do not work, because the abuser is “judgment proof.”

Digital abusers may take ambiguous actions to spy on others. Acts of apparent kindness, like the gift of a mobile phone, might be a tactic to get an unsuspecting person to carry what is in effect a tracking device. Shared passwords, shared accounts, and the so-called family/friend tracking capabilities offer abusers opportunities to track others in a way that appears to be consensual.

This book deals with digital abuse in Chapter 9 because intellectual property rights give survivors surprisingly strong tools to address abuse. There are other clever, nonlegal techniques to address persistent abusers, such as notifying the abuser’s employer or family members of the unwanted behavior. But, the state of the practice is best covered by non-profit groups that support survivors of digital abuse, such as the National Network to End Domestic Violence and the Cyber Civil Rights Initiative.

Remember that some forms of digital abuse are crimes. Carefully documenting digital abuse and developing a relationship with law enforcement may help getting police to take digital abuse seriously. Even if law enforcement will not help, it may be possible to sue an abuser for digital wrongs.

7.6 High-Level Investigative Procedure

At this point, we change from the substance of computer crime laws—the behaviors that are proscribed as hacking—to the procedures used by LEAs to obtain data about users.

At the highest level, LEAs must imagine where data about a crime might be. They then “preserve” the data to ensure those holding the data do not delete it. LEAs then obtain the data and analyze it. This section focuses on methods of obtaining data.

Throughout this process, LEAs must maintain a high level of quality in data acquisition and analysis. LEAs must document the “chain of custody” of the data to show a court that the data have not been corrupted. Finally, LEAs’ investigative measures must stand up to the high scrutiny of a criminal trial, complete with the burden to show that the defendant was guilty “beyond a reasonable doubt.”

7.6.1 Investigative Dynamics

Even the most minor infractions nowadays create data captured by digital devices and records, whether those are cameras, logs in cell phone towers, or transaction data from our purchases and communications. We should think of people as emitting a signature—an electronic one—all the time, leaving behind evidence of most of their activities. Much of this signature is generated by our wireless phones. In fact, it is suspicious if someone is not leaving an electronic device signal. These data tend to exist in multiple places: on the suspect’s device, with services and telecommunications providers such as AT&T, and with third-party businesses such as Google, Facebook, and Apple (Figure 7.3).

Figure 7.3 January 6 investigators used a “geofence warrant” sent to wireless phone providers to obtain the identifiers associated with all phones detected within the US Capitol building. This was a key mechanism to identify individuals in the investigation.

When LEAs are committed to an investigation, they can move heaven and earth to find data about a suspect. Consider these computer-related sources used to investigate the January 6, 2021 U.S. Capitol incident:

Cell tower data from Verizon, AT&T, and T-Mobile/Sprint for devices that connected to the Capitol’s cellular network infrastructure;

Google account subscriber information and location data from the Capitol and restricted perimeter obtained pursuant to the Google geofence warrants;

Location data obtained by the FBI from multiple data aggregation companies;

Basic subscriber information and call records obtained pursuant to applications made to twelve cell service providers under 18 U.S.C. 2703(d) for devices that, according to location data obtained pursuant to the Google geofence warrants, were present within the US Capitol on January 6, 2021;

A repository of archived Parler posts and comments from around the period of January 6, 2021, hosted by the Internet Archive Project and retrieved by the FBI;

A repository of digital media tips maintained by the FBI; and

The government’s discovery databases.¹⁷

If the data are on the suspect’s device, the investigator has to figure out how to lawfully acquire the device. Perhaps, the suspect is arrested and her devices are seized. Or perhaps, the LEA obtains a warrant and seizes the device in the suspect’s home.

After device seizure, law enforcement encounters a different problem: popular consumer devices such as the iPhone have strong encryption and anti-tampering mechanisms. While determined and well-resourced LEAs can sometimes use clever techniques and services to disable the device’s safeguards, the vast majority of state and local LEAs have no capacity to gain access using technical measures. These LEAs may use other tactics, such as watching a suspect carefully and grabbing the device right when the suspect unlocks it.

Because LEAs cannot open most consumers’ phones, LEAs have cajoled for laws that would give them access through some mechanism. For instance, the law could require Apple to have a “master key” to all iPhones that it could use when properly petitioned by a LEA.

Question 7.6.1 — The Internet Archive. LEAs investigate the web pages and other web resources that suspects, witnesses, and victims post. But what to do if the target removes the resource from the web? Investigators use a fantastic tool called the Internet Archive “Wayback Machine” at https://web.archive.org/ The Wayback Machine archives the most popular Internet websites and has captures of important sites such as the New York Times going back to 1996.

The Google “cache” might also have a deleted version of a website. Suppose your adversary removed the web page berkeley.edu/illegaldrugsforsale.html. You might be able to retrieve it by putting the following terms in Google’s search bar: cache:berkeley.edu/illegaldrugsforsale.html

▄

Civil libertarians—including some in government—abhor the idea of a master key for encryption. A policy tussle has ensued where the LEAs try to invoke the specter of terrorists and child abusers going free because of unbreakable encryption.

The reality is that local and state LEAs have rooms full of devices they cannot open. That evidence will be lost and some murderers, robbers, and rapists will go free. We will take up this topic in greater detail later.

Our focus in this chapter is on the investigative procedure to obtain data about users from service providers and companies such as AT&T, Google, and Facebook—not from devices seized from suspects. Procedural computer crime law deals with how LEAs (and even private individuals involved in litigation) can get service provider records. Our focus is mainly on government investigators using legal processes to obtain data.

Always keep in mind that it might be possible to obtain information about a suspect without legal process. The Fourth Amendment to the U.S. Constitution protects U.S. persons’ privacy. But, it only does so against the government,¹⁸ or when a private sector has acted at the direction of the government. Thus, US persons have no constitutional privacy rights against private searches and seizures of their data. In constitutional parlance, when a private person searches a suspect, the activity is not even a “search.” In most situations, this means that if an employer searches an employee’s computer for logs of misuse, the employer can simply hand over evidence found to the police.

Furthermore, a rule known as the “third-party doctrine” holds that if a person volunteers data to a business, the person loses their Fourth Amendment privacy interests in the data. This doctrine makes little sense in a modern age where all of our most personal information—from medical records to the love “notes” we send by text message—are in the hands of businesses. Yet, the doctrine survives. In many situations, businesses are free to just hand over user data to the government if asked.

Taken together, these limits on the Fourth Amendment (requirement for government action and the third party doctrine) mean that it plays only a minor role in cybersecurity. After all, most computer infrastructure is operated by the private sector, and thus, there is no government action. Many investigations can be performed based on records that users “voluntarily give” to private actors like AT&T or Google.

But, there is a further implication of the limits on the Fourth Amendment, one that is galling to civil libertarians: While we imagine that law enforcement should follow legal processes to get personal information about people, in reality, sometimes this information can just be purchased from the private sector. Service providers and companies want to make money selling users’ data. Thus, these companies might sell information about users that identify people online or reveal their activities. Companies in “cyberintelligence” might also have the user data a LEA wants for sale without the inconveniences of court orders.

To summarize a complex landscape: most data about most people are in the hands of private businesses. LEAs can directly approach such businesses and ask for data about a suspect. Depending on the situation, a business might voluntarily provide the data or refuse to help. In some cases, a privacy law might bar the business from helping, unless the LEA follows a procedure, such as obtaining a court order.

The key point here is that privacy laws really matter. Many businesses in America are not subject to any kind of privacy law because no legislature contemplated that the business implicated privacy interests. These unregulated companies can voluntarily provide or sell customer records. To give examples, dry cleaners, restaurants, corner stores, grocery stores, and dozens of other categories of businesses are not covered by a privacy law. Police could go to them and just ask about your clothing, what you ate for dinner, what brand of cigarettes you bought, what groceries you procured, and so on. Generally speaking, CCTV footage is not covered by privacy laws, and so, LEAs can go to almost any business and ask for camera footage without a court order.

But, other categories of businesses either refuse to comply with such requests, or cannot comply because privacy laws prohibit voluntary requests without some special procedure. Some of the most data-intensive companies are regulated by privacy laws that govern law enforcement requests. For instance, Internet service providers, phone providers, cable providers, services like Facebook and Google, and many websites must follow legal procedures before handing over data. The next section discusses how law enforcement can approach regulated companies and compel them to provide user data.

7.6.2 Investigative Process

As a first matter, investigators want to ensure data about a crime is not deleted. To avoid this, investigators use a “preservation order.” This is a simple request. It can be on paper or in the form of a phone call. Under federal law, providers that receive such a request must preserve records pending the issuance of a court order or other process.¹⁹

To be clear, this is a preservation order. Most companies in the United States need not preserve user data in their ordinary course of business. That is, they are under no general obligation to keep logs, subscriber records, identity information, or user content, until they are commanded to do so.

The US approach is known as “preservation retention:” retention is only required when ordered. Thus, American companies can advertise radically pro-privacy “no logging” services, but they must start logging if commanded to by law enforcement. In some cases, law enforcement has obtained orders forcing technology companies to affirmatively monitor in surprising ways.²⁰ And so, these services are not really as privacy preserving as claimed in rule-of-law jurisdictions.

In rogue jurisdictions, some businesses offer “bulletproof” services that simply ignore law enforcement or court orders.

In many other nations, a precautionary retention mandate is in place to make it easy for law enforcement to investigate crimes. Companies operating in these nations must task their engineers to maintain identity records of customers and carefully preserve logs about their use of the system for some set period of time, say 24 months. To be clear, precautionary retention laws focus on identity and metadata, not on content of services’ use—retaining the content would be too burdensome.

7.6.3 Obtaining the Data

Once preserved, the investigator can then obtain the actual data. (We say “investigator” because the actor may be a private party, perhaps a plaintiff employer suing a defendant employee for a computer crime, such as stealing the company’s intellectual property.) At this point, the most important question is whether a privacy law applies to the data sought.

7.6.3.1 Just Ask for the Data—Voluntary Requests

Generally speaking, if a privacy law does not apply, the investigator can simply ask for or purchase the data they want. This is called a voluntary access request. For instance, because there is no general privacy law regulating the conduct of retail store owners in America, a store owner is free to give law enforcement videos from security cameras, the store’s sales receipts, and even the store’s consumer database. The store owner can also sell these data to the private sector (unless she promised not to in a privacy policy, while opportunists can evade such promises, perhaps by saying the data were “shared” for “security purposes”).

When there are no privacy rules, companies can even initiate the transfer of information to law enforcement. And think about it: if you saw a crime occur, wouldn’t you be predisposed to help? Arguably, individuals and companies have a First Amendment right to volunteer information about crimes. In fact, in many states, a good-faith crime report is considered a “privileged communication” that is immune from lawsuits for defamation and invasion of privacy.

One common example of self-reporting comes from computer repair services—if these services find contraband on a user’s computer, employees can reveal this fact to law enforcement and police can seize the device. (Whether the police can then search the computer is a little more complicated; the proper path is to use an employee’s statement to support a warrant before searching the device. The computer can be seized on the theory that if released back to the user, they will delete the contraband.) This pattern is most common with CSAM material. In several states, a wide range of businesses are compelled by law to notify the government if they discover CSAM (Table 7.2).

Question 7.6.2 — Voluntary Requests. Many businesses may voluntarily reveal a crime has been committed, but ask the government to issue a subpoena before handing over relevant customer data. Why might they do that?

▄

7.6.4 Stored Communications, Metadata, Identity, and “Other”

The Stored Communications Act (SCA) is the most important law for cybersecurity investigation purposes. The SCA was enacted in 1986, long before most consumers used computers. Thus, the law does not reflect modern expectations about privacy. Students are often surprised by how much data LEAs can obtain under it.

The SCA covers services that enable storage of user data or communication among users. Under this law, many (but not all) websites and online services are regulated by the SCA. For instance, if you store your photographs or documents in Google Drive, the SCA applies because Google is holding your information in “remote storage.” Similarly, your email, chats, voice communications, and video conversations in Gmail or the like is an “electronic communication” covered by the SCA. To be clear, services that store information, such as Dropbox, Github, iCloud, and the like, are covered. So are sites that enable user-to-user communication, such as WebEx, Zoom, Slack, and Microsoft Teams. Even sites that have a minor communication function, such as Roblox and other gaming platforms that allow players to speak to each other, are covered by the SCA. But, an ordinary retail website, say bestbuy.com, is not subject to the SCA because it neither stores data for users nor implements communications among users. Bestbuy.com might store a record about a consumer, and it may be possible to post reviews of products and so on, but the real function of most retailer websites is not to store data nor enable communication.

Table 7.2 Getting data as an investigator.

Request type
Legal burden
Dynamics

Voluntary request
Just ask! Any person—even someone who is not a lawyer or private investigator—can ask for records
Many if not most companies will voluntarily provide information if a crime has happened—no one wants their business facilitating crimes. If a privacy law applies, the record holder might have to deny the voluntary request. The record holder is free to tell the suspect about the request or investigation, but most do not. Generally speaking, CCTV evidence is not subject to privacy rules, so this material can be obtained by just asking for it

Subpoena
Subpoenas require an attorney but not a judge. Subpoenas are not “judicially supervised,” which means many lawyers have pre-stamped, blank subpoenas in the desk drawer, ready to send. This means the judge doesn’t even know the subpoena has been issued
The subpoenaed record holder can go to court to “quash” the request if it is irrelevant or unduly burdensome. But seeking quashal is a burden in itself, often requiring travel; most businesses just comply. The record holder is free to tell the suspect about the request, and the suspect can seek quashal. The record holder should consider asking the government to scope or otherwise limit the request—the record holder is in a powerful position to “negotiate” about the amount and kind of material to be revealed

Grand jury subpoena
This is a subpoena drafted by a prosecutor but ratified by a secretive jury of citizens that is investigating crimes
Same quashal dynamics apply. Often, the grand jury requests that the record holder keep the request secret, but the holder is free to ignore the request. The record holder has less ability to informally negotiate the scope of the request

Court order
A court order can take many forms; the use of this term denotes a request that is supervised by a judge—that is, a judge has heard the request and ratified it
Orders could be ex parte (meaning the suspect was not represented at the court hearing). One main reason to get a court order is to obtain a gag provision that bars the record holder from telling the suspect about the investigation. At this point, bargaining over what the record holder should reveal is harder, because the judge has ratified the request

Warrant
A kind of court order where the judge has found “probable cause” that a crime has been or is about to be committed, and the subject of the order has relevant evidence
Warrants are supported by memoranda that are often quite long and detailed. The judge has reviewed those memoranda and become invested in the request; record holder resistance is more difficult. Warrants are typically issued ex parte and have a time limit for compliance

The SCA, as a statute, could be thought of as a legislative attempt to codify one’s constitutional privacy rights. Thus, there is an interaction between the Fourth Amendment and SCA standards that is in flux. As we write this, the constitutional divide appears to impose a probable cause warrant requirement for communications content, but a lower standard for “noncontent” information, such as metadata, identity information, and “other” information. The idea is that content—our ideas and thoughts—should be most protected, while other kinds of information are not as important or available to a wide number of parties, making it less privacy protected.

The classical content versus metadata example comes from a phone call: parties’ conversation is private content protected by a warrant standard, but the numbers dialed, the length of the call, and so on are all revealed to the phone company. Under prevailing legal theory, information about content is less private than content itself, and this metadata can be obtained with less than a warrant.

Building LEA Relationships

Fostering a relationship with the primary LEA actors in computer crime is easier now than ever. The USSS Cyber Fraud Task Forces (CFTF) hold regular regional events to promote trust between businesses and law enforcement. The FBI runs InfraGard, a partnership focused on critical infrastructure protection, but that provides good opportunities to meet local agents and their supervisors. Both of these organizations help with lateral networking (with other businesses affected by cybercrime) and with meeting district attorneys focused on prosecuting computer crimes. Anyone can join, although one typically has to be recommended by an existing member. One must also pass a basic background check and agree to these organizations’ information secrecy protocols, known as the Traffic Light Protocol (TLP). The TLP is a set of ground rules for distributing information ranging from TLP:RED for highly restricted information to TLP:CLEAR for information that can be publicly disclosed. The TLP gives the government a way of distributing information to companies and people who do not hold a security clearance, but agree to abide by basic confidentiality rules.

Three factors could change the balance in legal protection between content and noncontent: First, the Supreme Court is becoming more attuned to digital privacy issues and more technologically sophisticated. As the justices themselves use digital technologies, they are likely to become invested in digital privacy issues. After all, it would be quite valuable (and possible) to spy on a justice’s web browsing with online advertising technologies and target the justice with information or attempt to derive their attitudes from their consumption patterns.

Second, the Court is beginning to wrestle with the problem that the content/noncontent divide crumbles with media convergence and with new technologies such as the Internet. The content/noncontent divide breaks down in practice and strategy. Recall that the law protects the privacy of communications content because our speech reflects our thoughts and thus our intellectual freedom. But in practice, noncontent information, such as one’s GPS location, directly reveals our ideas and thoughts. If GPS shows a suspect at a church, a dialysis center, or the 7-Eleven, those places all say something about the thoughts and meanings of the suspect’s life.

In strategy, the divide between metadata and content is broken as well. LEA and intelligence agencies derive more value from metadata than content, because metadata is easier to structure in databases and analyze.

Finally, the third factor comes from record holders like Google and Facebook. LEA requests impose work on these companies and require them to maintain 24/7 law enforcement compliance offices staffed by lawyers and paralegals. These staff people need to make forensically valid captures of user data, and this is not a simple task when a Facebook profile, once printed out, takes up over a ream of paper (Figure 7.4).

Figure 7.4 Hundreds of warrant applications can be found on ECF/PACER (the database of federal litigation) for Facebook account data. The affidavit explaining the justification for the warrant is usually about 15 pages long.

Increasingly, companies have resisted LEA requests, particularly when these requests seek bulk access to information. Record holders have also moved more categories of information into the “content” category. For instance, years ago, most providers classified user photographs as “other” information that could be obtained without a warrant. But companies like Facebook understand that photographs have semiotic meaning and that people communicate content by simply sending each other images. Thus, Facebook (and Google) now classify user images as content so it is as protected as communications content (requiring a search warrant).

Why Do Technology Companies Work with Police?

Many technology companies adopt Ayn Rand-like anti-government rhetoric, but when law enforcement comes knocking, most companies help the government. Why is this? One explanation is that executives are profoundly disturbed when they see the tools they have created perverted for crime and terrorism.

Microsoft CEO Brad Smith and Carol Ann Browne detail the horror of realizing the terrorists who kidnapped Wall Street Journal reporter Daniel Pearl were using Microsoft’s Hotmail. Microsoft thus held the key clues to the whereabouts of Pearl. In their book, the duo recount:

…Our teams worked closely with the FBI and the local authorities in Pakistan for a week, trailing the kidnappers as they bounced from hotspot to hotspot accessing the Internet.

We came close but not close enough. The kidnappers killed Pearl before being caught themselves. We were devastated. His brutal death underscored the enormous stakes and responsibility that has been cast upon us, something we seldom spoke about publicly.a

History repeated itself when Smith realized the Charlie Hebdo attackers, and later, the Paris coordinated attacks also used Microsoft-provided email. By the 2015 Paris attacks, Microsoft was able to provide user information to emergency law enforcement requests in less than 15 minutes.

a Smith B and Browne CA. Tools and Weapons: The Promise and the Peril of the Digital Age. Penguin, 2021.

Question 7.6.3 — Downside Risk? The advantage of classifying photographs as content means Google and Facebook have to do less work when they get a subpoena. But what are the downside risks to this move?

▄

7.6.4.1 Stored Identity Information

In any investigation, LEAs want to know who is involved. Under the SCA, this can be done with a mere subpoena to a provider. A subpoena entitles the investigator to the “basic subscriber information” of the user, which is quite a lot of detail. It may go beyond identity to also reveal payment and other information.

7.6.4.2 “Other” Information

A wealth of noncontent information is generated through our uses of digital services. This information can be obtained by the government through what’s known as a “D” order. 18 USC §2703(d) requires the government to show: “specific and articulable facts showing that there are reasonable grounds to believe that [the requested records] are relevant and material to an ongoing criminal investigation.” Thus, the standard is just relevance, and this should make clear that D orders can be obtained concerning suspects but also victims and witnesses to a crime. D orders do require the government to actually spell out that relevance, and these orders tend to be about 12 pages long.

7.6.4.3 Content

To obtain the content of users’ accounts, such as the text of their emails, the government must obtain a search warrant. The search warrant is the “gold standard.” It is the hardest to obtain and, if properly done, means the LEA has convinced a judge that probable cause exists to believe a crime has been committed, and the target of the warrant has information relevant to the crime.

Keep this in mind: “probable cause” does not mean “more likely than not.” Courts refuse to place an estimate of probability on the term, but we know it means more than suspicion and less than 50% (Table 7.3).

Table 7.3 Legal standards for communications data.

Data
State burden
Private-sector purchasers

Basic subscriber data is name, address, local and long-distance telephone toll billing records, telephone number or other account identifier (such as username or “screen name”), length and type of service provided, session times and duration, temporarily assigned network address, means and source of payment
Subpoena
May be sold to third-party companies—this matters because the government might avoid the investigatory process by just buying the data!

“Other” information is everything that is not basic subscriber information but also not content. This includes log files (websites visited), identities of email and phone correspondents, and even passwords
2703(d) Order
May be sold to third-party companies

Content: the actual text of emails (and subject lines), content of voice conversations, and GPS coordinates and other communicative materials such as photos
Probable cause warrant preference
Cannot be sold without actual consent (i.e., informed consent)

Exercise 7.3 — Making Sense of LEA Requests. Your instructor will divide you into groups and you will analyze several high-profile and controversial law enforcement requests for data—please do note that these requests are a bit atypical, but their characteristics make is possible to provoke interesting discussions on civil liberties. Sample requests are included in the teacher’s manual.

In order to prepare, please: Read the entire assignment, including the requests that the other groups are receiving. It’s not a lot of reading—about 20 pages total.

Each of you will play the role of a company official tasked with figuring out how to respond to the request. Think about your assigned company: Is there anything special about your business model that would affect how you want to respond? What steps should you take to comply? What information should your company disclose in response to the request? What should it not provide?

Question 7.6.4 — A Facebook Warrant. To appreciate the work and complexity of obtaining a search warrant, see an example warrant for access to a Facebook account here: https://perma.cc/344A-4X6K. The investigator’s justification for access is quite detailed, but perhaps not as detailed as the amount of information that a Facebook account can reveal about its user!

▄

7.7 Live Monitoring

Most of cybersecurity is concerned with the monitoring of stored communications—historical records. In part, this is because monitoring computer activity live is difficult, and because as soon as data are stored, they are accessible under the above SCA regime. But, in some investigations, it is necessary to listen in real time.

For historical reasons, the Constitution and statutory framework create more protection for live, simultaneous monitoring of communications. To monitor noncontent, such as the websites a suspect is visiting in real time, the government needs a “superwarrant.” This is a procedure that, in addition to the probable cause determination of a standard warrant, requires federal investigators to obtain DOJ approval, identify a sufficiently serious crime that qualifies for wiretaps, explain the link between that crime and the device/service, limit the collection of data to 30 days (renewable), “minimize” data collection so noncriminal content is thrown away, and show that alternative investigative procedures already failed.

Teaching cybersecurity used to involve much more time cautioning students about live monitoring because the statute was both strict and punitive. For instance, companies that violated it by listening in to customers or selling the content of their communications could be criminally prosecuted. However, Congress enacted a law in 2015, the Cybersecurity Information Sharing Act (CISA), that created a huge loophole in the regulatory regime. Now, companies have expansive powers to monitor users live, as long as they do it for cybersecurity purposes. Because these powers were created to facilitate information-sharing to spot attacks, we address them in Chapter 8.

All the Data Facebook Has About You

This is a list of all the information the FBI sought from Facebook concerning a suspect in a July 2021 warrant application.

All emails, communications, or messages of any kind associated with the TARGET ACCOUNT, including stored or preserved copies of emails, including received messages, sent messages, deleted messages, and messages maintained in trash or other folders, as well as all header information associated with each email, and any related documents or attachments;

Records or other information stored by subscriber(s) of the TARGET ACCOUNT, related to pictures, videos, access logs, and files, and including specifically any metadata such as EXIF data associated with any pictures, photos, or videos;

All photos and videos uploaded by the user ID associated with the TARGET ACCOUNT, as well as any metadata associated therewith, including, specifically, EXIF data;

All subscriber information, including the date on which the account was created, the length of service, the IP address used to register the account, the subscriber’s full name(s), screen name(s), any alternate names, other account names or email addresses associated with the account, linked accounts, telephone numbers, physical addresses, and other identifying information regarding the subscriber, including any removed or changed names, email addresses, telephone numbers or physical addresses, the types of service utilized, account status, account settings, login IP addresses associated with session dates and times, as well as means and source of payment, including detailed billing records, and including any changes made to any subscriber information or services, including specifically changes made to secondary email accounts, phone numbers, passwords, identity or address information, or types of services used, and including the dates on which such changes occurred, for the TARGET ACCOUNT;

All IP logs, including all records of the IP addresses that logged into the account;

Any and all logs of user activity and user agent string, including: 1. web requests or HTTP requests; 2. any logs containing information such as the Requestor’s IP address, identity and user ID, date and timestamp, request URI or URL, HTTP protocol version, referrer, and other user agent string information; 3. login tracker logs; 4. account management logs; and 5. any other information concerning other email or social media accounts accessed, or analytics related to the TARGET ACCOUNT;

All records related to authenticating the user of the TARGET ACCOUNT, including use of two-factor authentication or App passwords used to allow access via a mobile device and the identity of those devices accessing the TARGET ACCOUNT;

Any information identifying the device or devices used to access any TARGET ACCOUNT, including any Android ID, Advertising ID, unique application number, hardware model, operating system version, unique device identifiers, Global Unique Identifier or “GUID,” serial number, mobile network information, phone number, device serial number, MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”);

International Mobile Equipment Identities (“IMEI”), or Apple advertiser ID or ID for advertisers (“IDFA”), and any other information regarding the types of devices used to access each TARGET ACCOUNT or other device-specific information; and

Any information showing the location of the user of the TARGET ACCOUNT, including while sending or receiving a message using a TARGET ACCOUNT or accessing or logged into a TARGET ACCOUNT.

7.7.1 International Requests and the CLOUD Act

Crimes don’t just happen in the United States. But, for billions of people, the United States is where their data are stored, and this creates bizarre complexities for law enforcement.

Imagine a serious crime that occurs in London. Let’s say two neighbors trade unpleasant Gmail/email messages and Facebook postings. One of the neighbors is killed and among the suspects is the other neighbor. For the London police to investigate a wrong that occurred entirely within its city, it must ask Google and Facebook to obtain private messages. How to do so is not so easy. Should the investigators email, fax, or call (try to find a phone number for someone at Google) and, if they do, how will Google know the request coming from a foreign LEA is valid? Should the London investigators fly to Mountain View in uniform? What if instead of a murder, the investigator is pursuing a case where a European citizen hatefully criticized a religious group, speech that is protected in the United States but may be illegal in Europe?

International law has several mechanisms to address such requests, but they trigger diplomatic procedures because prosecution can implicate complex, strategic-level international relations issues. Under the procedures, law enforcement engages a diplomatic agency, which in turn contacts the U.S. State Department, which in turn works with domestic US law enforcement and courts to process the request. The diplomatic agencies weigh the request against potentially competing national policy priorities. For instance, investigating a foreign citizen of some countries might be seen as a political act, and requires diplomatic consultation. Consider the arrest of Roman Seleznev, a notorious cybercriminal sentenced to 27 years for various credit card fraud crimes. Seleznev is the son of a powerful Russian lawmaker. His crimes and arrest had to be carefully documented to preempt claims from the Russian government that Seleznev was kidnapped.

There are several mechanisms to pursue the investigation process for foreign-held data. The best situation is where the requesting nation has a Mutual Legal Assistance Treaty (MLAT) with the United States. In such cases, a diplomatic procedure is in place. But, if there is no MLAT, investigators must look to the mutual assistance provisions of the Budapest Convention (Convention on Cybercrime) or even use an ancient mechanism known as “letters rogatory.”

Because the United States takes due process seriously, requests from foreign law enforcement for data stored in the United States are evaluated in several ways—most importantly, the United States requires “dual criminality,” that is, the request has to concern a wrong that is proscribed in the United States. A US court might even research the request to see if it is justifiable under foreign law.

International legal process takes so long (it can take over a year) that it causes problems for law enforcement—even for American agencies, which must make requests concerning foreign data centers. A mid-2010s case, Microsoft Ireland, caused a legislative fix and compromise. In the case, a US LEA served Microsoft with a warrant for email content under the SCA. Microsoft complied with data stored in the United States, but then threw American law enforcement a curve ball by refusing to provide data on the same user stored in an Irish facility. Microsoft argued the United States did not have jurisdiction over the data, and the Second Circuit Court of Appeals agreed! The decision could have caused chaos for LEAs facing sophisticated criminals. Presumably, a criminal could use a US-based service but choose a Europe-based storage option and make their information much more difficult to obtain.

Congress quickly sprang into action, passing the Clarifying Lawful Overseas Use of Data (CLOUD) Act. To help American LEAs, the CLOUD Act expands the territorial reach of the SCA internationally. To help some foreign LEAs, the CLOUD Act creates a procedure for foreign governments to get data from US cloud providers. Foreign governments do this by creating a bilateral agreement with the United States. The foreign government has to be approved by the attorney general as sufficiently in compliance with civil liberties and privacy laws. Foreign governments that meet the test can create an agreement where they directly can approach US service providers with requests for information. The requests have to comply with their domestic laws, concern serious crimes (no defaming the Queen cases), and comply with the 2703 “D Order” language of “articulable and credible facts.” Providers who do not want to comply can challenge the request in the foreign jurisdiction, not in the United States.

The first nation to negotiate a CLOUD Act agreement was the United Kingdom.²¹

Deterrence Revisited

Some in law enforcement see crime as an affirmative, economic choice of criminals. As a result, LEAs try to deny criminals the benefits of crime, even when it is economically irrational for a defender to do so. For instance, LEAs are united in recommending that companies not pay ransoms to criminals when criminals find ways to hold company data hostage, including with ransomware.

But, at what point does maintaining a deterrent posture hurt more than help? Consider this: in 2019, the City of Baltimore refused to pay a ransom to hackers who seized the city’s systems. The ransom was just over $100,000. Months later, the city estimated their recovery cost the taxpayers $18,000,000.a As a taxpayer, how do you feel about that?

For many companies, ransoms are literally rounding errors in the big picture and much less than the cost to recapture control from backups. Many companies quietly pay ransoms.

a Janofsky A. When paying a ransom is the best way out. Wall Street Journal, 2019 Jun.

7.7.1.1 Authoritarian Data Access Options

The CLOUD Act really is just for westernized nations. Other nations must find other options, and they do. The tactics taken by foreign states include:

Finding local employees of the US company and threatening them with jail. This means that if your company expands to a nation with a weak commitment to civil liberties, you might find yourself having to hire local lawyers for your employees and find ways to spring them from jail.

Finding local employees of the company and threatening them with physical violence (“rubber hose security”). Russia did this during the 2022 Ukraine invasion.

Requiring foreign companies to operate their servers in-country (a sovereign Internet policy approach known as “data localization”).

Use access to Internet infrastructure to deny/degrade users’ encryption and then get access.

Hack users’ devices, including by buying their passwords from dark web databases.

Simply order that the service be turned off in the country.

7.7.2 National Security Access Options

A controversial provision of the national security code is a key tool in cybersecurity investigations. Known as the Foreign Intelligence Surveillance Act (FISA) Section 702 (first introduced in Chapter 4, the provision allows the attorney general, acting with the Director of National Intelligence, to order surveillance of a foreign person who is using communications systems).

§1881a. Procedures for targeting certain persons outside the United States other than United States persons

(a) Authorization Notwithstanding any other provision of law, upon the issuance of an order in accordance with subsection (j)(3) or a determination under subsection (c)(2), the Attorney General and the Director of National Intelligence may authorize jointly, for a period of up to one year from the effective date of the authorization, the targeting of persons reasonably believed to be located outside the United States to acquire foreign intelligence information.

(b) Limitations An acquisition authorized under subsection (a)

(1) may not intentionally target any person known at the time of acquisition to be located in the United States;

(2) may not intentionally target a person reasonably believed to be located outside the United States if the purpose of such acquisition is to target a particular, known person reasonably believed to be in the United States;

(3) may not intentionally target a United States person reasonably believed to be located outside the United States;

…

(6) shall be conducted in a manner consistent with the fourth amendment to the Constitution of the United States.

The text of the law does not reveal its full implications or context. This provision of the FISA is meant to deal with foreign actors who are using US-based communications systems. Foreign use of US systems is common because of the dominance of America’s Internet companies. But, foreign adversaries “use” American communications in two senses: they use Gmail and similar services as communication tools, either as an account-holder or as a sender to others who use these services, and they “use” American systems when they attack them or trespass upon them.

Although 702 assigns the privilege to monitor to the highest-level officials in the United States, the standards they must meet to satisfy the law are low: the target must only be “reasonably believed” to be outside the United States, and the purpose is for any foreign intelligence purpose. That is, the authority is not limited to anti-terrorism or anti-mass violence efforts nor is it limited to suspects of wrongdoing—others somehow involved in the intelligence purpose could be monitored.

FISA 702 allows the government to send “selectors,” information associated with foreign persons, to quickly obtain information about adversaries. The selectors could be obvious: This hacking group is using email address so-and-so. But, suppose the government suspects an attacker is using several email addresses, some of which are unknown. The government can use nonobvious selectors that are quite powerful for revealing hidden accounts. For instance, if an adversary is using a certain password, the government might go to several different Internet services and request access to information about all accounts that use that password. You could use your imagination to think about other selectors that would allow cross-discovery of hidden accounts.

Once data are acquired, the government can spy on the foreign adversary. That adversary could be a terrorist group or a financially motivated ransomware gang. With eyes on the adversary, the government can anticipate attacks and perhaps even disable them. Picture it this way: perhaps, as a government investigator, you have no hope of arresting a Russia-based gang that is using ransomware against US hospitals. But, you can get into their accounts through the 702 authority. In doing so, you could see their planning and tools, the hospitals targeted, and even the negotiation from the side of the attacker. With all this knowledge, in the best of all worlds, the government could warn hospitals that are about to be attacked, disable the ransomware, or otherwise thwart the attacker’s operations.

FISA 702 is a hotly contested legal authority. It authorizes foreign intelligence surveillance inside the United States, but the focus of the surveillance has to be on foreign persons. This means the government should not use the authority to spy on US persons (this is broader than just citizens; it includes US-based companies and people who have some connection to the United States, such as undocumented workers living in the United States). To be clear, the government also cannot use this authority to spy on Americans or US-based companies abroad.

FISA 702 is so controversial that the authority “sunsets,” that is, the power expires every few years, and Congress must reauthorize it. As a cybersecurity expert, you should know about this capability and its contribution to security. FISA 702 may not exist 10 years from now, but one can bet that governments will want to have 702-like capabilities.

Cyber Terrorism?

Deterrence theory suggests cyberattacks would be an effective strategy for terrorists. Terrorists should embrace cyberattacks because terrorist groups are asymmetric powers that lack assets that can be directly attacked or held at risk. It’s difficult to deter and punish terrorists even if one has evidence that a terrorist group levied a cyberattack. The low cost of entry for attackers as well as the ambiguity and practical striking distance would also be advantageous to terrorists.

However, terrorists have chosen to use kinetic attacks in recent years. Perhaps, they emphasize kinetic attacks because cyberattacks remain abstract and difficult to portray in media images. Consider the September 11, 2001 attacks—those acts were planned to ensure many people would watch the Twin Towers as the second plane hit. The terror was palpable and broadcast across the world repeatedly to scare anyone in a modern society. Cyber terrorism simply has not (yet) resulted in the kinds of media images and personal fear evoked by kinetic attacks. Terrorist groups may be using cybercrime, however, to finance their activities.

Terrorist groups have not developed the kinds of expertise and intelligence capabilities needed to levy consequential cyberattacks. Indeed, even state-sponsored terror attempts have been relatively unsophisticated. For instance, a hacking group associated with Iran obtained access to the information systems of a dam outside New York City. At first, officials could not determine which dam had been penetrated and there was fear that the hackers had gained access to the 245-foot-tall Arthur R. Bowman Dam in Oregon. Later, it was determined that the hackers had accessed the Bowman Avenue Dam near Long Island.a At just 20 feet, Bowman Avenue hardly represented a serious threat. In any case, hackers could not control the flood gates because they had been physically disconnected for maintenance purposes. Of course, this raises the issue of why the control system was Internet-connected in the first place.

a Yadron D. Iranian Hackers Infiltrated New York Dam in 2013: Cyberspies had access to control system of small structure near Rye in 2013, sparking concerns that reached to the white house. Wall Street Journal, 2015 Dec.

Question 7.7.1 — Nissenbaum Revisited. Recall Professor Nissenbaum’s suggestion that we might conceive of cyberattacks as crimes, and thus avoid applying the heavy hand of the national security state to cure these ills. What laws and institutions would have to be developed to effectively implement Nissenbaum’s attacks-as-crime approach?

▄

7.8 Conclusion

The criminal law is one way to manage cybersecurity issues. In a narrow sense, the criminal law regulates individual and firm behavior, subjecting their computer misuse to (unlikely) punishment. In a broader sense, procedural computer crime law shapes who can get access to data that could be used for shared cybersecurity deterrence. Substantive criminal law covers many kinds of computer use. But, prosecution is rare, because of the economic and political factors relating to the Internet, challenges with jurisdiction, a lack of training among law enforcement, and law enforcement priorities that emphasize violent crime remediation.

Notes

1 Hoofnagle CJ, Altaweel I, Cabrera J, Choi HS, Ho K, and Good N. Online Pharmacies and Technology Crime. The Routledge Handbook of Technology, Crime and Justice. Routledge, 2017:146–60.

2 Federal Bureau of Investigation. Clearances, 2017.

3 Kan PR. Dark International Relations: When Crime Is the “Dime”. War Room, 2019 Jul.

4 Greenhill K. Kleptocratic Interdependence: Trafficking, Corruption, and the Marriage of Politics and Illicit Profits. Corruption, Global Security, and World Order. Washington, DC: Brookings Institution Press, 2009, 2009:96–6.

5 The indictment approach does present complexities. European states are resistant to extraditing suspects because the United States still has the death penalty and there are concerns about conditions of confinement. In some cases, the DOJ has had to promise to forbear from using the death penalty before a nation will release a suspect.

6 The executive branch has a sweeping power to use economic policy and choke-points to coerce and compel. The president does so by declaring an emergency (under 50 USC. §§1701 et seq.) that triggers economic sanction powers. As of this writing, over two dozen “emergencies” are taking place—involving everything from nuclear weapons proliferation to terrorism to transnational criminal gang activity to yes, cyber-related intrusions and influence.

7 The SDN database is now sprawling. It is used to enforce over 60 trade sanction or policy regimes. The SDN is over 1,400 pages long and contains the name Muhammad over 3,800 times.

8 Farrell H and Newman AL. Weaponized interdependence: how global economic networks shape state coercion. International Security 2019; 44:42–79.

9 Some wily actors find ways of buying goods despite being designated. For a fantastic case study of SDN evasion focusing on North Korea and Kim Jong Un’s acquisition of an armored Mercedes-Maybach S600 Guard, see Center for Advanced Defense Studies (C4ADS). Lux and Loaded: Exposing North Korea’s Strategic Procurement Networks. Washington, DC, 2009.

10 Krebs B. Spam Nation: The Inside Story of Organized Cybercrime—from Global Epidemic to Your Front Door. Sourcebooks, Inc., 2014.

11 Rao JM and Reiley DH. The economics of spam. Journal of Economic Perspectives 2012; 26:87–110.

12 Id supra fn 10.

13 McCoy D, Pitsillidis A, Grant J, Weaver N, Kreibich C, Krebs B, Voelker G, Savage S, and Levchenko K. Pharmaleaks: Understanding the business of online pharmaceutical affiliate programs. Proceedings of the 21st USENIX Conference on Security Symposium, 2012.

14 One common fraud is called “structuring,” making many small payments that escape the reporting of suspicious activity.

15 New York AG of. Fake Comments: How U.S. Companies and Partisans Hack Democracy to Undermine Your Voice. 2021 May. Available from: https://perma.cc/L8AC-E577.

16 Kaplan F. Dark Territory: The Secret History of Cyber War. Simon and Schuster, 2016.

17 The government also obtained, “anonymized location data collected by ten data aggregation companies; and basic subscriber information for Facebook/Instagram accounts linked to the anonymized advertising identifiers obtained pursuant to the data aggregation warrants.” United States v. Rhodes et al., Case 1:22-cr-00015-APM (D.D.C. 2022).

18 U.S. v. Jacobsen, 466 U.S. 109 (1984).

19 18 USC §2703(f).

20 In Company v. USA, the government sought an order to require what is believed to be ATX (an early competitor to OnStar) to turn on the microphone inside a car’s navigation system. 349 F.3d 1132 (9th Cir. 2003). The service provider won the challenge, but only because of narrow factual circumstances. Nowadays, OnStar is designed so cars can be located and remotely disabled at owner or law enforcement request.

21 See https://perma.cc/AS8D-CB3C

8.
Critical Infrastructure

Chapter Image: Pieter Jalhea Furnius and Gerard van Groeningen, The Trojan Horse (Sixteenth Century).

Source: FG Waller Fund/Rijksmuseum Amsterdam/Publicdomain/
http://hdl.handle.net/10934/RM0001.COLLECT.446197.

Chapter Learning Goals

Learn about security threats to “critical infrastructure.”

Not everything can be “critical,” so how do we decide?

Understand the incentive conflicts and dynamics that leave so much of our infrastructure insecure.

Understand the NIST Cybersecurity Framework.

Understand the different kinds of security standards and their merits and demerits.

Learn about cybersecurity information sharing and why it still has not reached its potential.

Researchers at the Idaho National Lab bought an enormous, used, 27-ton, 2-megawatt generator from an oil services company, hooked it up to a power substation, and then destroyed it in three minutes using a computer attack. Known as the Aurora Generator Test (2007),¹ the experiment demonstrated that expensive, robust hardware can be destroyed beyond repair with software.

This 2007 test made attacks on critical infrastructure (CI) palpable and accelerated diagnosis and treatment of the problem. It also demonstrated why critical infrastructure attacks can be so important—because emergency diesel generators are used as backup systems for nuclear plants, hospitals, and military installations (Figure 8.1).

Recall from Chapter 4 that a possible definition for cyberattacks that constitute a use of force or armed attack are those focused on critical infrastructure. President Biden seemed to valorize that definition in 2021 when he met with Russian President Putin and warned him of aggressive cyberattacks. Biden gave Putin a list of 16 areas where Russian hacking could create retaliatory consequences. All 16 were industries the United States considered to be critical infrastructure.

Figure 8.1 The Aurora Generator Test.

Source: U.S. Department of Homeland Security/Wikimedia Commons/Public domain/https://en.m.wikipedia.org/wiki/File:Aurora_generator_starting_to_smoke.png.

This chapter canvasses the principles of critical infrastructure protection, political and technical challenges, and sets up a discussion about the newest area of concern: voting. Critical infrastructure is increasingly regulated by cybersecurity rules that are emerging in fits and starts, rather than from a comprehensive approach. The United States now has an agency—the Cybersecurity and Infrastructure Security Agency (CISA) that has formal information-collection and threat-intelligence-distribution functions. Critical infrastructures themselves will have to report to CISA under legislation enacted in 2022, but the CISA is not a regulator like the FTC or other agencies discussed in this book.

In addition to these mandates, critical infrastructures manage security through the so-called security “standards” such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This chapter covers three core trends in critical infrastructure cybersecurity: internal preemptive efforts to manage security (through security standards), the increasing requirements to reveal information about the weaknesses of those efforts (cybersecurity incident reporting), and the need to share news of those weaknesses with others, including competitors (cybersecurity incident sharing) (Table 8.1).

Three noisome problems lurk in this material: First, cybersecurity standards focus on the implementation of rules and procedures to prevent and manage attacks. Standards, if applied without critical thinking and attention to emerging threats, become compliance exercises, turning cybersecurity into a boring field of checklist implementation.

Second, perhaps even worse: the field could become both boring and ineffective, because there is no proof that cybersecurity standards work. In fact, we think it more likely than not that a standard known as PCI-DSS not only cannot work, but is also expensive and part of a risk-transfer security approach. Security standards might stultify cybersecurity work and still not make systems more secure.

Finally, an important observation can be made about these standards efforts: They often omit privacy considerations. This omission reflects a lack of consensus on whether firms should limit data collection and use. But, this makes little sense because attackers often break into systems to steal vast troves of personal information—if companies did not hoard data, these systems would be less attractive targets.

The omission of privacy is leading to new rifts in security. For instance, a massive effort to eliminate China-controlled social media app TikTok because of its surveillance potential implicitly raises the issue of whether domestic competitors like Instagram should also be curbed. After all, any app maker could spy on Americans and sell the data to third parties that ultimately empower foreign actors.

Table 8.1 Significant “wake up” moments in the critical infrastructure field.

Incident
What happened
Why it matters

Trans-Siberian Pipeline Explosion (1982)
Thomas Reed’s AT THE ABYSS (2004) claimed that the US engineered Russian pipeline software so it would fail. William Safire, writing in the New York Times about his Nixon Administration service, validated the story
Whether or not the anecdote is true, the pipeline explosion narrative occupies the imagination of how foreign-supplied hardware or software could be engineered to cause dangerous sabotage in another country while making it look like an accident. This is a core anecdote animating concerns about “supply chain”

Maroochy Water Services (1999)
A former contractor to the company that made the software that managed water treatment released hundreds of thousands of gallons of raw sewage into public waterways
Thought to be the first publicly acknowledged critical infrastructure attack²

Aurora Generator Test (2007)
Hackers in a competition destroyed a large diesel generator in seconds
Awakened US policymakers to the possibility of irreversible critical infrastructure damage from cyberattacks

Nitro Zeus (2010)
A comprehensive plan to disable Iranian critical infrastructure using pre-positioned implants if the Iran nuclear deal failed
Nitro Zeus would have disabled Iran’s communications, transportation, energy, and air defenses. In the 1991 Gulf War, the United States subdued the fourth-largest military in the world in weeks; had Nitro Zeus been activated, Iran might have suffered a similar fate, but in days

Crypto AG (2015)
The CIA secretly owned Swiss cryptography company CryptoAG, which sold products around the world that were vulnerable to CIA access
Foreign governments relied on cryptography machines for decades that were accessible to US intelligence agencies

SolarWinds (2020)
Russian hackers compromised a widely used IT management platform by pushing a cryptographically signed software update. Over 10,000 corporate and government users were potentially compromised
Attacks on popular platforms can compromise scores or hundreds of firms. One can be secure but have vulnerabilities in one’s supply chain

Colonial Pipeline (2021)
A major fuel pipeline operator shut down its operations after experiencing a financially motivated ransomware attack on its billing systems
To be clear, Colonial could pump fuel, but stopped operations for precautionary reasons. The lack of fuel created regional disruptions

8.1 What Is “Critical Infrastructure”

The roots of critical infrastructure protection were planted in the President Reagan administration, which promulgated an executive order to create more security and resilience in communications systems.³ An executive order (E.O.) is a directive issued by the president for the management of federal resources. It requires no consent or other cooperation from Congress.

President Clinton developed the most comprehensive policy rationale and set the stage for today’s framework. Clinton’s Presidential Decision Directive–63 (PDD–63) of 1988 declared:

No later than the year 2000, the United States shall have achieved an initial operating capability and no later than five years from today the United States shall have achieved and shall maintain the ability to protect the nation’s critical infrastructures from intentional acts that would significantly diminish the abilities of:

the Federal Government to perform essential national security missions and to ensure the general public health and safety;

state and local governments to maintain order and to deliver minimum essential public services;

the private sector to ensure the orderly functioning of the economy and the delivery of essential telecommunications, energy, financial and transportation services.

Clinton set in motion a framework for three kinds of critical infrastructure protection: (1) federal government CI, (2) state government CI, and (3) the CI in the private sector. Federal and state government CI concerns operation of law enforcement, foreign intelligence, foreign affairs, national defense, and, most recently, elections.

Private sector CI is just as important and unfathomably large and diverse in a market economy like America’s. Private sector CI is now the focus of most public attention and regulatory concern. For each of the 16 private CI industries, a federal agency was assigned. For instance, the Department of Energy is responsible for liaising with the power, oil, and gas industries to encourage security efforts.

Substantively, Clinton’s directive required effort in 10 security tasks, ranging from performing a vulnerability analysis to creating a response plan and a research agenda on security.

Question 8.1.1 — Clinton’s Scope. Notice that PPD–63 concerned intentional acts. Why did President Clinton scope it so?

▄

For industries, most important was Clinton’s creation of the Information Sharing and Analysis Centers (ISACs). ISACs are nongovernmental organizations that coordinate security activities in different industries. There are now 25 ISACs. They typically are membership organizations that are fee supported. For instance, the Financial Services Information Sharing and Analysis Center (FS-ISAC) coordinates information sharing and training among a large number of different companies in banking, insurance, and payments. ISACs must be private, independent bodies to avoid competition law concerns that information sharing could enable collusion or price-fixing.

Question 8.1.2 — The ISACs. There is now a National Council of ISACs: https://www.nationalisacs.org/member-isacs-3

Please visit this page and select an ISAC to study. Try to determine:

How many members does it have?

What is its corporate structure?

What are its major activities?

What is the character of the policy documents it recommends (are these voluntary or mandatory)?

Just spend 5–10 minutes exploring that ISAC’s activities. What strikes you as interesting or special about “your” ISAC?

▄

President Obama developed the CI system in depth with E.O. 13636, Improving Critical Infrastructure Cybersecurity. Substantively, President Obama pressed for CIs to pay more attention to “resilience,” which reflected a broader paradigm shift in cybersecurity where defenders realized it was impossible to completely exclude attackers from their systems. This shift in understanding led to different defense techniques, such as the adoption of “defense-in-depth.” The idea is that under the former approach, known as the castle walls approach, defenders placed too much emphasis on protecting the outermost edges of their systems. Once an attacker got in, an institution had little ability to detect further intrusion or defend its systems.

The newer paradigm accepts the fact that some attackers will penetrate the “castle wall,” and so defenses need to be layered and inside the “castle.” Defense-in-depth requires defenders to create multiple walls and segregation of important assets.

But, a second principle is more important: the risk management approach changes focus to maintaining operations even under successful attack—the idea that one must be resilient and keep services going regardless.

Question 8.1.3 — Resilient Operation? In the 2021 Colonial Pipeline attack, the company reacted by shutting down all of its operations and performing a visual inspection of thousands of miles of pipeline over six days. Apparently, the pipeline was able to deliver fuel, but Colonial could not bill customers for it. The shutdown caused chaos for people and businesses. But, Colonial was worried the attackers could have gone beyond the billing system and compromised operational aspects of the pipeline.

If you were a lawyer at Colonial, what assurances and protections would you need to accept the risk of continued operations? That is, if the secretary of the Department of Transportation (fuel pipelines are regulated by the Transportation Security Administration, not the Department of Energy) called you and asked that you keep the pipeline running, what would convince you that maintaining resilience was worth the risk?

▄

Obama’s change was among the most important “growing up” moments in cybersecurity. It recognized that users don’t care about attacks in themselves; they care about whether their electricity works. The concept of resilience thus expands CI regulation beyond defense against intentional attacks to include accidents that threaten business continuity.

President Obama’s administration issued several directives to address problems that began to emerge in the ISACs. One was that large entities could participate in ISACs, but smaller entities could not afford to, or lacked compatible information systems. President Obama proposed Information Sharing and Analysis Organizations (ISAOs) to promote standardized information transfer among companies.⁴

The Obama Department of Commerce also took one of the most consequential steps in systemizing cybersecurity: it developed the NIST Cybersecurity Framework. Intended to press CIs into taking a systematic, comprehensive view of their security, the NIST Cybersecurity Framework has become the lingua franca of security—even startups use it nowadays to express a standardized assessment of their operations. The framework is voluntary because political economy has made it impossible for the government to enact comprehensive cybersecurity regulation.

Finally, President Obama updated George W. Bush-era regulations with Presidential Policy Directive 21. It identifies 16 CIs along with the agency that facilitates their cybersecurity efforts (Table 8.2):

President Trump largely followed the Obama administration’s approach, although Trump made a point of warning agency leaders that they could be fired if their agencies suffered cybersecurity lapses. None was.

President Biden continued the theme of goosing the private sector to disclose indicators to the government. Biden’s E.O. 14028 created a public–private “Cyber Safety Review Board” housed at the Department of Homeland Security.⁵ Formed in 2022, the Board’s initial appointees were a who’s who of cybersecurity. Biden’s E.O. also mandated that the government pursue a “zero-trust” computing infrastructure, to develop methods to better secure software as it is composed and that NIST develop a security labeling system for Internet of Things (IoT) devices.

Table 8.2 The 16 CIs and their sector-specific agencies.

Chemical | Department of Homeland Security
Commercial Facilities | Department of Homeland Security
Communications | Department of Homeland Security
Critical Manufacturing | Department of Homeland Security
Dams | Department of Homeland Security
Defense Industrial Base | Department of Defense
Emergency Services | Department of Homeland Security
Energy | Department of Energy
Financial Services | Department of the Treasury
Food and Agriculture | U.S. Department of Agriculture and Department of Health and Human Services
Government Facilities | Department of Homeland Security and General Services Administration
Healthcare and Public Health | Department of Health and Human Services
Information Technology | Department of Homeland Security
Nuclear Reactors, Materials, and Waste | Department of Homeland Security
Transportation Systems | Department of Homeland Security and Department of Transportation
Water and Wastewater Systems | Environmental Protection Agency

Definition 8.1.1 — Zero-Trust Architecture. According to NIST, zero-trust systems “usually involve minimizing access to resources (such as data and compute resources and applications/services) to only those subjects and assets identified as needing access as well as continually authenticating and authorizing the identity and security posture of each access request.”

Exercise 8.1 — Too Many CIs. Congratulations, you’ve just been appointed to be the deputy undersecretary of cybersecurity at the Department of Homeland Security (pending Senate confirmation). Budget cuts mean that Department of Homeland Security (DHS) can realistically only accommodate 10 CIs. Your job is to eliminate 6 CIs.

Federal law defines CIs as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.” 42 USC §5195c(e).

A law enacted in 2022 on information sharing suggests the following factors for critical infrastructures: “the consequences that disruption to or compromise of such an entity could cause to national security, economic security, or public health and safety; (B) the likelihood that such an entity may be targeted by a malicious cyber actor, including a foreign country; and (C) the extent to which damage, disruption, or unauthorized access to such an entity, including the accessing of sensitive cybersecurity vulnerability information or penetration testing tools or techniques, will likely enable the disruption of the reliable operation of critical infrastructure.”

Given these guardrails from Congress, which six CIs could you remove from the list? What method might you use? Does the definition at 42 USC §5195c(e) help define a method? What about using the definition of “security” problem posed in Chapter 1 by Ole Wæver, “the basic definition of a security problem is something that can undercut the political order within a state and thereby ‘alter the premises for all other questions.”’a

▄

a Wæver O. Securitization and Desecuritization. Centre for Peace and Conflict Research Copenhagen, 1993.

8.2 Political Challenges in Securing Critical Infrastructure

The critical infrastructure problem is so large and involves so many different industries and players within them, that it presents public legislation challenges. Here’s just one example: there are over 1,500 electricity providers in the United States. Thus, one has to write legislation that overcomes general industry objections but also is well fitted to diverse energy providers.

Challenges in enacting legislation are why the above Section 8.1 emphasizes executive orders. This is because the president can direct executive agencies to oversee industries, whereas moving Congress to enact comprehensive guidelines for CI cybersecurity is an intractable political challenge. That said, several emergencies have catalyzed Congress to act in limited ways.

Question 8.2.1 — The Administrative State. This is a good opportunity to reflect back on the FTC materials in Chapter 6 and the question of whether that agency provides adequate due process for the industries subject to its enforcement powers. If conservative legal movement lawyers are correct and the administrative state needs to be pared back substantially, what knock-on effects will that have on critical infrastructure protection?

▄

A series of events, including the 2016 election interference and memories of the multiday 2003 Northeastern blackout, did move Congress to create a standalone agency to address CI.⁶ In 2018, Congress created the Cybersecurity and Infrastructure Security Agency (CISA), which operates under DHS.⁷ The CISA is not a regulator. It instead plays a coordinating role, an information-sharing role, and a technical assistance role for those that accept help.

Question 8.2.2 — CISA (The Agency). We invite you to visit CISA’s CI website (https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience) to better understand the agency’s activities and strategies. A great place to start is the agency’s Services Catalog (https://perma.cc/3A4H-UX9T). Also important is the agency’s Automated Indicator Sharing (AIS) program.

▄

Second, a lot of CI is owned by the private sector. Private ownership makes it more difficult to enact regulations and tailor regulations to diverse markets.

How much CI is in the private sector? It is unclear. Commentators frequently claim that 80–85% of CI is privately owned, but as Paul Rosenzweig has argued, the provenance of that number is circular. Students Rosenzweig supervised found a much more complex landscape, with different sectors having more or less private ownership. Even in a high-private-ownership field, most people may be using a government service. For instance, the students found, “[I]n Florida, 77% of utilities are owned by the private sector, while only 23% are owned by the public (including federal and local). That said, the 23% that are owned by the public sector service 92% of the population.”⁸

A third political issue comes from scope. How do we decide what is “critical” enough to be a CI? In 2006, the Center for Strategic and International Studies (CSIS), a well-respected security-focused think tank, suggested four factors to protect against: (1) catastrophic health effects, (2) mass casualties, (3) nation-level economic effects, and (4) risks to military capacity. This seems sensible, but where does one draw the line? For instance, in many European nations, media and even art is considered a CI. In the United States, shopping malls can elect to receive CI assistance.

If everything is critical, then nothing is.

Fourth, there is political risk when governments reveal information to CIs. Agencies like DHS and CISA generate “indicators of compromise” (IOCs) and other information products that may be derived from intelligence sources. A fundamental trust problem exists between the government and employees of the private sector who might be willing to sell IOC intelligence to attackers.

A fifth trust problem is horizontal—that is, company to company. Most companies are fearful of sharing any kind of information with a competitor. Take IOCs. Could IOCs help a company spot sales strategies or weaknesses in a competitor? Might we imagine a cutthroat business that was willing to fabricate an IOC in order to trip up a competitor?⁹ The lack of trust means that who else is on an information sharing network matters. The presence of some companies will cause others to exit in fear of fraud or competitive unfairness.

Finally, information sharing does not solve all security problems, even if participants in a network do everything correctly. “Zero-day” attacks—attacks that are unknown to system developers and operators—by definition go undetected, and so, these attacks still work in the presence of information sharing. Zero-day attacks are highly prized and expensive mechanisms, typically used carefully by sophisticated actors. Because zero-day attacks are effective and desired by intelligence agencies and militaries, a marketplace for zero-days has arisen.¹⁰

8.3 Cyber Incident Reporting for Critical Infrastructure Act of 2022

Congress enacted an incident-reporting law for critical infrastructures in 2022, packing the legislation in a 2,000-page spending bill. The law, the “Cyber Incident Reporting for Critical Infrastructure Act of 2022,” reflected concerns about the Colonial Pipeline incident and worries associated with the Russian invasion of Ukraine.

The law requires CISA to promulgate a rule requiring critical infrastructure companies to report incidents and ransomware quickly after they are detected. More specifically, PPD-21 critical infrastructures will have 72 hours to report “substantial” cyber incidents and 24 hours to report ransomware payments. Covered entities must update CISA when they have new information about incidents as well.

Question 8.3.1 — Substantial Cyber Incidents. By using the word “substantial” Congress clearly intends that not all incidents must be reported. Could you craft a framework for covered incidents? Congress helpfully provided this guidance in considering substantial:

a cyber incident that leads to substantial loss of confidentiality, integrity, or availability of such information system or network, or a serious impact on the safety and resiliency of operational systems and processes.

a disruption of business or industrial operations.

unauthorized access or disruption of business or industrial operations due to loss of service facilitated through, or caused by, a compromise of a cloud service provider, managed service provider, or other third-party data hosting provider or by a supply chain compromise.

In addition to the above categories, other kinds of incidents could be substantial, based on these factors:

the sophistication or novelty of the tactics used to perpetrate such a cyber incident, as well as the type, volume, and sensitivity of the data at issue.

the number of individuals directly or indirectly affected or potentially affected by such a cyber incident.

potential impacts on industrial control systems, such as supervisory control and data acquisition systems, distributed control systems, and programmable logic controllers.

One can see that by requiring disclosure in just some circumstances, disclosure regulation becomes a direct cybersecurity regulation. For instance, this disclosure law creates incentives to invest in operations resilience, because any disruption to operations requires disclosure.

▄

CISA’s National Cybersecurity and Communications Integration Center (NCCIC), in turn, is tasked with studying incident reports and sharing relevant information.

The Cyber Incident Reporting for Critical Infrastructure Act has only weak enforcement mechanisms. Covered entities cannot be fined under it for failing to report incidents, but other laws might cover the situation. Instead of fines, covered companies can be subpoenaed and sued to reveal the information they failed to report.

8.4 Technical Dynamics

The dominance of Internet Protocol (IP) is a prime driver of CI security problems. The industrial control systems (ICSs) that run myriad industries and commercial facilities (from elevators to Iranian uranium-enriching centrifuges) used to all be disconnected and run proprietary software known only to insiders. But IP is so fantastic and enables such utility that many ICS systems now speak “Internet” and some are connected to it. This “broadens the attack surface” of CIs in two ways: first, more people know Internet programming languages, so more attackers are available. Second, the IP-enabled system then suffers from IP attack vectors in addition to legacy ones still embedded in the equipment. Attacks on ICS used to require an attacker to be physically present; now they can be anywhere.

Satellites provide an important example of the problem. The United States has over 1,000 satellites in orbit, many of which have been in operation for decades. These older satellites had a particular threat model: only certain people with bespoke equipment could communicate with the satellite, using proprietary software. All those assumptions change when satellites are upgraded to IP. Perhaps, the attacker need not break into a physical facility at Vandenberg, perhaps the attacker need not study ICSs from the 1980s that are only documented on paper, and so on.

Other technical dynamics are important with CIs and make them different from ordinary consumer services. Generally speaking, CIs need 100% uptime—constant availability. This complicates security; with some CIs, like telecommunications, uptime requirements are so strict systems must be upgraded live. This in turn requires more testing before patches can be applied, making CIs less agile.

8.4.1 What Does CI Designation Mean

Being designated as a CI doesn’t impose dramatic legal requirements—for now at least. This relates to the legislation problem: a CI designation is an executive act. In our system, a president cannot just make law by fiat.

Perhaps, the main consequence of designation is more attention from the DHS and CISA. More resources would be available to a company if it wanted them, including information-sharing. CISA also creates “sector-specific plans,” which are publicly available and somewhat underwhelming. It’s hard to see how any sophisticated business would not already know about the risks enumerated in those plans.

Question 8.4.1 — Mixed Incentives. Say you represent a non-CI industry, such as art museums. Imagine if CISA became concerned that your events were being attacked by organized cyber terrorists and CISA cajoled for your industry to be formally recognized as a CI. What would be the upsides and downsides of being designated?

▄

8.5 NIST Cybersecurity Framework

At the direction of President Obama, the Department of Commerce’s NIST developed the NIST Cybersecurity Framework, possibly the most consequential decision the federal government has taken to promote cybersecurity. The NIST Cybersecurity Framework is broadly used in the private industry, even though it was designed for CIs.

8.5.1 NIST Broken Down

To understand what the NIST Cybersecurity Framework is and is not, we must explain the different kinds of security standards. The field can be broken down into four high-level categories:

Process based These standards require the firm to declare it “has so-and-so processes” that seek some goal. The firm is entrusted with developing the processes.

Controls based These require the firm to declare it “has so-and-so controls”—safeguards or countermeasures. NIST 800-53, a standard developed by the federal government, articulates privacy and security controls that federal government contractors must meet.

Requirements based These require the firm to implement specific, enumerated steps. The most popular rules-based security framework is the Payment Card Industry Data Security Standard (PCI-DSS).

Framework based These encourage the firm to implement controls from a large selection of options. The NIST Cybersecurity Framework is a menu of options that the company can choose from.

Companies prefer the NIST framework approach because of its flexibility. It was generated based on multi-stakeholder feedback and is voluntary. It also is quite high level. Here, we illustrate some important elements, strengths, and pitfalls (Figures 8.2–8.6).

Figure 8.2 The “core” of the framework is organized around five important “functions”: identifying risks, protecting against them with safeguards focused on service delivery, detecting bad events, responding by mitigating them, and recovering—that is, maintaining operations. Notice, this isn’t about catching hackers. The framework is completely aligned with the business goal of keeping the wheels of industry turning. NIST starts with strategy, not details.

This is a good moment to revisit the discussion of Sounil Yu in Chapter 3—the creator of the Cyber Defense Matrix discussed in Exercise 3.1. You’ll now recognize that the NIST Framework provides the superstructure for Yu’s endeavor.

Figure 8.3 Drilling down one level, take the identify goal. NIST states operational outcomes in the category column and then tactical steps to meet the identify goal in the subcategory column. As CISO, the focus is on the strategic goal. Middle management focuses on the operational—the outcome that all network assets should be inventoried. Managers then have analysts execute the tactics, such as finding all the physical devices, software, and data flows and making sure they are accounted for. This is military strategy adopted for businesses, which makes sense for a large and hierarchical organization.

Figure 8.4 What’s this acronym salad in “Informative References?” The NIST people did something brilliant: they demonstrated that cybersecurity operations—here, the desired outcome that companies study their third-party suppliers for risk—aren’t some strange regulatory requirement, but rather a consensus recommendation from other security standards. The Informative References are a compliance “mapping” that shows harmony among very well established standards: COBIT, ISO, and NIST 800–53. This mapping is centrally important to businesses, because they are often required to comply with several different security instruments.

8.5.2 Electricity and Cybersecurity

What does it mean to be a CI and subject to the “voluntary” NIST Cybersecurity Framework? For some CIs, these recommendations are not so voluntary. Industries in complex and important fields like electricity generation, distribution, and retail sale are overseen by several different agencies. The combined regulatory oversight of a group of agencies can convert voluntary advice into real rules.

Figure 8.5 Executives like NIST because their organizations can be placed in “tiers” that represent their cybersecurity (un)preparedness. Bad news, students: most organizations are probably in tier 1. Accounting firms like NIST because moving an organization from one tier to another racks up millions in fees.

Figure 8.6 Finally, here is the payoff for CISOs. NIST allows them to explain in a structured way that the organization is insecure, set priorities, and then ask executives for money. The executives must use responsible business judgment in their decisions. So, a CISO can present an honest NIST assessment and press the executives for more money.

Some industries not only have important secrets about structural vulnerabilities but also have micro-level detail about how individual consumers use energy, and even sensitive personal information about their customers. This means some utilities already have privacy regulations that establish security requirements.

To take energy utilities, for instance, consumers notice power failures and a segment of consumers’ lives are imperiled by outages because they depend on medical and cooling devices. Electricity sector companies also have diverse adversaries, spanning the gamut of nation-state attackers to financially motivated hackers to their own customers trying to alter their meter readings. Electricity providers’ risk profiles include electromagnetic pulses (EMPs)! Increasingly, cybersecurity responsibilities are creeping into the ordinary rules the industry must follow.

Definition 8.5.1 — EMP Attack. Nuclear powers do not need to use computers to hack electronics—they can disable them in bulk with an electromagnetic pulse attack by exploding a nuclear bomb in the atmosphere. In the 1962 Starfish Prime nuclear test, a high-altitude atmospheric detonation caused electrical damage almost 900 miles away.

▄

In addition to the vanilla NIST Cybersecurity Framework, federal agencies tailor approaches to fit the “profiles” of different agencies. For electricity production, distribution, and sale, this is the Department of Energy’s Cybersecurity Capability Maturity Model (C2M2). The DOE insists it is voluntary, but regulators learn from each other and industries know that voluntary standards become mandatory overtime. C2M2 uses a “maturity model” describing four levels of compliance (from doing nothing to taking measures in an ad hoc fashion to having extensively managed and documented practices).

Question 8.5.1 — C2M2 Tool. The Department of Energy hosts an easy-to-use, HTML tool for assessing cybersecurity management at electricity companies here: https://c2m2.doe.gov/. The tool asks operators to respond to over 350 questions on a scale from not implemented to fully implemented. Spend some time looking at the questions—does anything about the questions surprise you?

▄

Like other critical infrastructures, electricity companies have their own ISAC: the E-ISAC (E for electricity; there is a separate ISAC for other energy sectors like oil and gas).

The Federal Energy Regulatory Commission (FERC) has commissioned the North American Electric Reliability Corporation (NERC) to create and enforce Critical Infrastructure Protection (CIP) reliability standards. A significant portion of them are direct cybersecurity regulations, because such failings can result in power loss. NERC can fine noncompliant electricity companies and order them to develop a mitigation plan. In 2019, NERC fined Duke Energy $10,000,000 for violations of the CIP standards.

Finally, in addition to federal regulatory agencies, many electricity providers are subject to state public utilities commissions, which may have separate cybersecurity regulations.

Chemical Facility Antiterrorism Standards (CFATS)

Worry about terrorist attacks on chemical facilities that could result in widespread environmental destruction or the creation of weapons caused Congress to mandate the CFATS. CFATS is a performance-based standard that now contains cybersecurity requirements.

The CISA sets a risk tier for chemical facilities, mostly focused on the presence of explosive chemicals. Chemical facilities must develop a plan specific to each facility to “Deter cyber sabotage, including by preventing unauthorized onsite or remote access to critical process controls, such as Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), Process Control Systems (PCS), Industrial Control Systems (ICS), critical business system, and other sensitive computerized systems …”a

The rules include extensive requirements for physical security as well as the duty to “Detect attacks at early stages, through countersurveillance, frustration of opportunity to observe potential targets, surveillance and sensing systems, and barriers and barricades.”

A separate regulation addresses facilities with special nuclear material—such facilities must anticipate physical attacks by well-trained and determined adversaries willing to die to commit radiological sabotage. This “design basis threat” means covered facilities must maintain military-like forces, complete with training, ballistic armor, assault rifles, and shotguns. Since 2009, facilities also have to have a cybersecurity program tailored to meet the design basis threat of a determined, sophisticated attacker.b

a 6 CFR §27.230(a)(6).

b 10 CFR §73.54.

8.6 Alternative Approaches to the NIST Cybersecurity Framework

NIST’s Cybersecurity Framework is the go-to process for security for many companies. But, other options for security assessment and governance are available. NIST’s approach is a “framework” because it sets forth required functions while giving a diverse set of options for meeting each requirement. A framework arguably is the most liberal approach for management—managers prefer it because of the variety of options provided. But other actors who are more concerned about specificity and accountability may prefer a different approach. This is because it is so difficult to pin down a violation of a framework security standard compared to a controls or requirements standard.

8.6.1 Assessments and Audits—They’re Different

Before visiting alternative approaches, it is important to clarify terminology. Many people refer to security standards as involving “audits” but they are not audits. Instead, most compliance is based on a lower standard, known as an “assessment.”

Assessment is a term of art in accounting where the client defines the basis for the evaluation, and an accounting firm certifies compliance with the client-defined standard. An audit, on the other hand, is an evaluation against a defined, externally developed standard.

Definition 8.6.1 — Assessment. An opinion issued by an accounting firm that a client has sufficiently complied with some standard of performance.

▄

Importantly, assessments are just opinions—they are only as good as the assessor. All that is required is for the assessor to obtain “sufficient evidence to provide a reasonable basis for the conclusion that is expressed in the report.”¹¹ Pursuant to assessment rules, an assessor might rely on statements from the company regarding its practices—that is, interview relevant employees—rather than engage in testing.

Definition 8.6.2 — Audit. More demanding than an assessment, an audit tests whether a firm has complied with an externally defined standard.

▄

The relatively lax “reasonable basis” standard in assessments means assessors can make fantastic claims that probably are not true. For instance, in 2012, PriceWaterhouseCoopers performed an assessment for Google that was submitted to the FTC as part of the agency’s oversight of the company. The assessor concluded, “Google’s privacy controls were operating with sufficient effectiveness to provide reasonable assurance to protect the privacy of covered information and that the controls have so operated throughout the Assessment Period, in all material respects.” It is simply hard to believe that such a complex company with billions of users could always be in compliance.

8.6.2 Requirements-based Standards

Managers like the NIST Framework approach because it gives managers many ways to comply. Other standards options tend to command management to take specific security steps. The Payment Card Industry Data Security Standard (PCI-DSS), for instance, is a requirements-based security standard that exists at the opposite end of the spectrum from the NIST Cybersecurity Framework. Promulgated by the PCI Security Standards Council in 2004, an industry group, PCI-DSS is controlled by payment network companies (American Express, Visa, Discover).

In practice, merchants and other companies that are involved in credit and debit card payments must comply with PCI-DSS, because otherwise they cannot accept most electronic payments. The network effects that payments companies enjoy essentially forces others to play by payment company rules. Compliance requires adherence to a lengthy set of specific rules in pursuit of a simple goal: to ensure end-to-end security of cardholder information.

The upside of PCI-DSS is that it is so specific in its requirements, it is easier to identify the root cause of a security incident and assign liability. Because there are so many requirements, and because the requirements are imposed on retailers that are inexpert in security, the root cause is likely to be on the retailer’s side. Compare this to the NIST Cybersecurity Framework—it is so general that assigning a security incident to a specific failure is difficult (Table 8.3).

Table 8.3 Credit cards follow a high-level pattern. Let’s analyze a test card number, 4800110000000001.

480011
Digits 1–6 identify the card network and bank issuer. All cards issued by Visa begin with 4, Mastercard with 5, American Express with 3. The number also identifies other aspects of the card. For instance, the digits 80011 signal that it is a Bank of America card issued in the United States. It is a “classic,” personal card. That fact is valuable to fraudsters because fraudsters might choose to only use corporate cards or high-credit-line cards. These first digits also reveal if the card is a debit or stored value card (gift card).

000000000
The digits in the middle are the customer account number. These are the numbers one would have to guess to create fake card numbers.

1
A “check digit” to validate the card number. All credit card numbers can be validated with freely available methods based on the Luhn algorithm.

PCI-DSS: Mission Impossible

Panning out a bit, the impossibility of PCI-DSS’ goal should be evident. The goal is to make credit card numbers secret. Secrecy is a difficult state to achieve—just look at how hard governments strive to keep classified information secret.

The challenge of credit card number secrecy is monumental. Consumers typically have credit cards with 16-digit account numbers—only 9 of which are unique. These numbers are widely shared. A consumer might use their credit card for hundreds of different merchants over the years, transmitting these “secret” codes over innumerable networks and to an inscrutable number of third parties. These numbers leak to dark web databases and some speculate that basically all credit card numbers are in the possession of organized crime rings. Yet, the payment networks are still able to force all merchants to try to keep these numbers secret.

Merchants have to capture an account number, encrypt it instantly, and pass it on through a network (the process is so involved that almost all merchants outsource this task). Clever hackers have innovated attacks on this system, including “RAM scraping” technology that copies the card in the milliseconds it is read by a terminal.

Merchants have structural incentives to undermine the secrecy of card numbers. For instance, if the merchant wants to do recurring charges (e.g., a subscription), it must find a way to preserve its ability to charge the number.

If merchants fail to follow PCI-DSS, they may have to perform a security audit (average cost in the six-figure range) or the networks can revoke access to payments.

Meanwhile, the cost of electronic payments is fantastic—a 3% tax on all transactions. It is next to impossible for retailers to economize on this expense, and, for some retailers, credit card fees are second only to employee healthcare costs. (Banks found a way to costlessly transfer value among themselves—the ACH network—but they have maintained high-fee mechanisms for retailers.)

All of this raises a simple question with a complicated answer: instead of imposing fantastic costs on merchants to pursue an impossible goal unrelated to their business purposes, why don’t we redesign payment mechanisms?

8.6.3 Process-Based and Controls-Based Standards

Two other approaches exist between the rigid command style of PCI-DSS and the à la carte menu offered by the NIST Cybersecurity Framework. Process-based approaches allow a company to identify various goals and tie processes to meeting them. The International Standards Organization 270XX series takes a process-based approach. ISO 270XX is widely used in different industries, and the approach can be used for many non-security goals as well. An outside ISO 270XX assessor reviews the goals and controls, and opines that a “reasonable” amount of compliance has occurred.

As a practitioner, you should know that ISO 270XX is only as good as the goals and processes specified, as well as the assessor’s opinion. This means one must read an ISO 270XX certification for its specific details. A 270XX assessment could assess irrelevant goals, evaluate mismatched processes, or employ a poor assessor. Thus, your client cannot just conclude “they’re ISO-assessed, so we’re good to go.” Instead, the client must read and scrutinize the assessment for fit and quality.

Question 8.6.1 — Security as Risk Shifting Revisited. Recall that businesses see cybersecurity as just another risk they face. Businesses can eliminate, mitigate, shift, or accept risks. Much of PCI-DSS involves risk shifting, with no benefits for security in the aggregate. For instance, if merchants comply with security-irrelevant procedures (e.g., collecting a signature at a point of sale), fraud risk is transferred from the merchant to the issuing bank. The insecurity of credit cards might be the product of an oligopoly of credit card networks and their powerful network effects rather than retailer misconduct.

▄

Finally, controls-based approaches impose requirements that a company have ways to address certain kinds of problems, which allow the company to show how it reaches specific goals. NIST 800-53 uses a controls-based approach, and all companies that touch a federal government information system must comply with it or a related standard.

The controls-based approach makes sense for the government, because its information systems are so diverse. A controls approach is technology neutral, thus allowing contractors to find controls that fit the CIA, auditing, and measurement goals important to the government. But like an ISO assessment, the government contracting official must scrutinize a controls-based assessment for fit and quality.

8.6.3.1 Example: Defense Contractor Cybersecurity

Any company interacting with the Department of Defense (DoD) is subject to a growing set of controls-based security standards. The DoD requires these controls through its acquisitions rules (known as DFARS for Defense Federal Acquisition Regulation Supplement). In essence, federal defense companies (and all their vendors) agree by contract to strive to comply with NIST 800-171, which specifies 110 controls.

Defense contractors are subject to a DoD-developed Cybersecurity Maturity Model Certification (CMMC) process and they have their own ISAC; the ND-ISAC (ND for national defense). DoD contractors must also notify the DoD of security breaches, and there are increasing requirements to secure the supply chain.¹²

The realpolitik of DoD contracting is that the US government is dependent on a group of companies that specialize in weapons development and high-tech innovation. The “defense industrial base” (DIB) is critical for myriad functions. As powerful as the DoD is, it practically cannot command that DIB contractors comply with so many controls. Thus, most DIB contractors are probably not in full compliance with NIST 800-171, and so, these companies seek waivers from the DOD. To manage the lacuna in compliance, contractors agree to plans of action and milestones (POAM) to commit to security improvements.

To be clear, companies seeking contracts with DoD should truthfully declare their lack of compliance with the rules and have the DoD consent to the gap. Those that do not risk litigation under the False Claims Act—a dangerous law for companies because it allows whistle-blowers to collect an award for exposing misconduct. For instance, Aerojet Rocketdyne paid a $9-million settlement for allegedly misrepresenting its compliance with cybersecurity rules in 2022. The employee that alleged the misconduct received part of that settlement.

Exercise 8.2 — Comparing Security Frameworks. To more deeply understand the differences between different kinds of security frameworks, we will divide into groups to analyze and present several different security standards. These security standards are private ordering instruments. That is, they are often required by contract, not by statute or regulation. Keep in mind that many companies are subject to multiple security frameworks, because they operate in different product/services areas or because they operate in different geographical regions.

Group 1: Study ISO 27000/27001/27002. These standards are not publicly available–they have to be licensed. However, Professor Georg Disterer has written a good overview of these standards. See, Georg Disterer, ISO/IEC 27000, 27001 and 27002 for Information Security Management, (https://file.scirp.org/Html/4-7800154_30059.htm). Journal of Information Security 2003; 4(2). Perma link: https://perma.cc/2QVL-9LFR

Group 2: Study NIST 800-53 (Rev 5; https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf) Perma link: https://perma.cc/YW2K-7232. This is a 500 page document. Suffice it to say that it would be a bad use of time to read the whole document. Instead, just read chapters 1 and 2 (just 14 pages total!), and skim appendix C of the NIST document. In the process, be sure to note any controls that you find particularly useful or under-examined in the course so far.

Group 3: Study PCI-DSS. Perma link: https://perma.cc/Q46B-YTBN. This is a 300+ page document. Just read the introduction and skim the framework of requirements in chapter 15 of PCI-DSS. PCI-DSS governs the acceptance of credit and debit cards.

Group 4: Study the NIST Cybersecurity Framework (https://www.nist.gov/cyberframework/framework). You will see the NIST framework in practice because financial regulators and the SEC have urged companies to implement it. A good starting point for understanding the framework is the FAQ on the NIST website.

All groups: Do some searching and try to determine who uses your group’s standard and why. You’ll find that many companies do state their security standard in product specification sheets and regulatory findings.

▄

8.6.4 Privacy != Security

Security is necessary for privacy, but security is not privacy. And in cybersecurity standards, privacy rules are often completely omitted.¹³ In fact, in a separate, parallel effort to NIST’s Cybersecurity Framework, the agency developed a NIST Privacy Framework.

One way to think about this is that privacy concerns limit what data institutions decide to collect and how they decide to use it. Meanwhile, security concerns determine CIA for data that are collected.

Privacy is not security. Yet, privacy could help security if we revisit the issue through the lens of deterrence theory. Imagine if privacy law dictated that companies collect far less data about consumers and delete the data after transactions are complete. Such a law would deter some cyberattacks, because the benefit of attack—stealing personal information—would be denied.

Passing a privacy law is a difficult task in Congress. Regulators do not believe they could force companies to adopt both security rules and bans on information policy issues (privacy). As a result, industries typically argue that privacy be treated separately, and, then in those separate proceedings, industries tend to wear down rules surrounding data collection and use.

Question 8.6.2 — Nissenbaum Revisited: Privacy. Can you tie the political economy of privacy versus security back to Helen Nissenbaum’s discussion of “cybersecurity?”

▄

8.6.5 Standards Critiques

There is no evidence that cybersecurity standards actually enhance cybersecurity postures. That is, companies that implement approaches such as the NIST Cybersecurity Framework have just as many security incidents as those that do not.

Why is this the case? First, standards are only as good as their implementation. Good implementation requires independent thought and judgment, and the ability to overcome firm power structures that resist security measures. A firm can do a generic, slapdash implementation of a security standard that is not tailored to its environment.

The NIST Cybersecurity Framework, because of its generality, is particularly vulnerable to inept implementation that allows executives to claim compliance while not offering genuine protections. To counter this challenge, agencies develop “profiles” to help companies in different industries better tailor security standards to their sector.

Second, even if a firm develops a nicely tailored implementation, there are always operational failures. Any one of us can make a mistake as an employee that violates a security standard and allows an attacker to get a foothold. For instance, even in a perfectly secured environment, an employee could fall for a phishing attack.

Third, vendors remain a tough problem. Even if a firm has a thoughtful security plan, its vendors may not, and first-party firms can never truly be sure of a third-party vendor’s security.

Fourth, standards that are easily implementable and measurable may not be well fitted for the security environment. That is, an straight-up, objective test (e.g., did the company implement training) may be easily measurable but say little about how secure the company is, while subjective tests (e.g., do employees have a sophisticated understanding of security threats) may be both more difficult to measure and more important.

Finally, there’s a practical problem: standards both specify too many requirements for firms to manage and fail to explain which requirements are the most important. Take the NIST Cybersecurity Framework—the first requirement is to inventory devices on the network. This task is far more expensive and complicated than it seems (imagine accounting for all the Internet-connected devices in your classroom), and even if perfected, an inventory does nothing by itself to improve security. Yet, later in the Framework, one can find less expensive and easier-to-implement protections. Thus, those tasked with implementation have to use critical thought and judgment to advance the protections with the most impact.

8.7 The Other CISA—Cybersecurity Information Sharing Act of 2015

In addition to the agency CISA, Congress enacted a law with potential for great cybersecurity improvements that has the exact same acronym: Cybersecurity Information Sharing Act of 2015. Cybersecurity information sharing could be presented in several different chapters of this book, but the main government information-sharing efforts have surrounded CI, and so they are dealt with here.

8.7.1 Information-sharing Theory

Deterrence theory and the anarchic security postures of organizations animate the rationale for cybersecurity information sharing. Through a deterrence theory lens, information sharing creates a larger “defensive shield” against attackers. That is, once company A detects attack alpha, news of its characteristics can be shared with companies B–Z, so B–Z can more appropriately defend against attack alpha. This changes attack alpha from one that could be levied 26 times—for companies A to Z—to an attack that can only work once. Such defense imposes costs on attackers: if the attacker uses an exploit just once, all defenders may learn of the exploit and the exploit becomes useless.

Question 8.7.1 — Actors Discussion. This book has emphasized the complex views of different actors toward cybersecurity. Imagine how different actors might view information sharing: what concerns might governments have about sharing information with the private sector? What concerns might private companies have about sending information to the government? And why might private companies be reluctant to share information among themselves?

▄

The logic links back to concepts in international relations theory surrounding anarchy. The anarchic security problem is that every individual online, from the consumer to the small business to the dominant platform, is responsible for their own security. Without information sharing, attackers can serially target every individual, and each attack is in effect novel and thus more likely to be successful. Not sharing information about risk is anomalous—consider information about crime. Generally speaking, we give each other advice about what not to do and where not to go in a city. But, in cybersecurity, victims experience attacks and often tell no one about it.

Question 8.7.2 — How Large a Shield? If information sharing creates a larger defensive shield, shouldn’t we require threat sharing and filtering at the lowest level of the Internet (e.g., filter at the Internet service provider (ISP) or even at Internet exchanges (such as Packet Clearing House)? Should the federal government take over the fundamental routing of the Internet to enable threat spotting using classified data?

▄

Another dynamic relates to the nature of cyberattacks themselves. Many cyberattacks have a one-shot quality or asset specificity. As soon as a defender recognizes it, the defender can implement a mitigation and render the attack edentulous. Sharing that information allows other defenders to secure assets, making the attack more universally unusable. Currently, however, because of the anarchy problem, attackers can just try the same methods over and over again and chances are they will eventually succeed.

Question 8.7.3 — Network Neutrality. The Internet was designed with the end-to-end principle (first visited in Chapter 2) and a best-effort delivery model. The idea behind the end-to-end principle is that innovation should happen at the endpoints. Features tend to be developed at the end-user’s device, allowing anyone to create new software. Combined, end-to-end and best efforts contribute to a high-level policy of “network neutrality.”

There are several flavors of network neutrality, but the basic idea is that ISPs and others that route traffic should treat data equally. ISPs should not slow down certain communications because they are from company X or Y. There are middle-way proposals for network neutrality that would allow slowing down certain kinds of communications, such as email, so latency-sensitive video might be prioritized. But, it would be improper to promote one video provider over another.

The end-to-end approach is credited with the tremendous flexibility and innovation on the Internet, because anyone can develop applications to run at the edges of a network. It means innovation can be decentralized.

Best-effort delivery levels the playing field because, if all datagrams are treated equally, the smallest business gets the same service as the largest monopoly online—at least in theory.a

At the inception of the Internet, processing power and memory were much more expensive. This is one reason why much of the most exciting computing happens at the endpoints. As memory and processing power become less expensive and more distributed, it’s natural to ask whether the network itself should do more to ensure security. But this runs into two problems: First, the sclerotic effects of centralization would rob end users of the ability to be totally free to innovate. Second, the Internet would be less “neutral” if the network starts getting smarter. To make it explicit: A smarter network might start filtering some communications based on who sent them because some packets are regarded as attacks. What if Internet companies consider new, innovative technologies as “attacks” and filter them?

Network neutrality has reached a sacred status among many Internet activists. But at what price? Innovation is indeed an important value, but the Internet is no longer a level playing field. Does it make sense to hold on to the idea of neutrality when one price is an Internet that no one can trust?

▄

a This advantage is simply no longer true because large services place redundant infrastructure close to users and obtain peering agreements to enjoy a speed advantage over less sophisticated services. Cloudflare, for instance, has servers in 250 cities worldwide, giving services hosted on it great advantages.

8.7.2 Information-Sharing Practice

We could conceive of three kinds of information sharing: a top-down approach, where the government shares indicators with the private sector; a horizontal approach, where companies and government agencies share indicators with their competitors and sister agencies; and a bottom-up approach, where companies reveal incidents and indicators to the government.¹⁴

In theory, information sharing seems like a no-brainer, perhaps so compelling that it should be mandated. But, in practice, companies are reluctant to share information. In addition to concerns about wily competitors, companies are worried they might violate privacy laws or their own privacy policies, that collaboration might be construed as a competition law (antitrust) problem, and that entanglements with law enforcement could make them “agents” of the government and subject to Fourth Amendment safeguards.

These fears are less justified now. The government has repeatedly signaled they will not pursue cybersecurity information sharing as an antitrust violation. The Fourth Amendment risk is also low, unless companies allow themselves to be directed by public officials. And Congress leveled the privacy barrier in enacting the Cybersecurity Information Sharing Act of 2015 (CISA).

When companies do share information, it tends to fall into two categories:

Threat indicators: “Indicators of compromise (IOCs)” Threat indicators are information relating to attacks, such as the network ports, protocols, and routing information used. Other examples include hashes of malware, the IP addresses from which attacks came, and suspicious domains that employees might have visited. These are less likely to be personally identifiable information.

Contextual threat information Contextual threat information is more like knowledge than data; contextual information make sense of attacks in explaining what was attacked, how, and sometimes why. This is much more likely to contain personal data about attackers and victims.

Question 8.7.4 — Anti-virus Companies. The biggest information-sharing success in cybersecurity clearly comes from antivirus companies, which liberally share IOCs. Anti-virus companies, which are in a competitive market, even share indicators with each other! Why do you think this is the case?

▄

8.7.3 Provisions of CISA (the Act)

The CISA has two high-level purposes: to facilitate information sharing from the government to the private sector and within the private sector itself. The CISA is codified at 6 USC §1501 et seq.

§1501. Definitions

(4) Cybersecurity purpose: The term “cybersecurity purpose” means the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from a cybersecurity threat or security vulnerability.

(5) Cybersecurity threat: (A) In general, Except as provided in subparagraph (B), the term “cybersecurity threat” means an action, not protected by the First Amendment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system.

(B) Exclusion: The term “cybersecurity threat” does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement.

(6) Cyber threat indicator: The term “cyber threat indicator” means information that is necessary to describe or identify-

(A) malicious reconnaissance, including anomalous patterns of communications that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat or security vulnerability;

(B) a method of defeating a security control or exploitation of a security vulnerability;

(C) a security vulnerability, including anomalous activity that appears to indicate the existence of a security vulnerability;

[…]

§1502. Sharing of information by the Federal Government

(a) In general

Consistent with the protection of classified information, intelligence sources and methods, and privacy and civil liberties, the Director of National Intelligence, the Secretary of Homeland Security, the Secretary of Defense, and the Attorney General, in consultation with the heads of the appropriate Federal entities, shall jointly develop and issue procedures to facilitate and promote-

(1) the timely sharing of classified cyber threat indicators and defensive measures in the possession of the Federal Government with representatives of relevant Federal entities and non-Federal entities that have appropriate security clearances;

[…]

§1503. Authorizations for preventing, detecting, analyzing, and mitigating cybersecurity threats

(a) Authorization for monitoring

(1) In general Notwithstanding any other provision of law, a private entity may, for cybersecurity purposes, monitor-

(A) an information system of such private entity;

(B) an information system of another non-Federal entity, upon the authorization and written consent of such other entity;

(C) an information system of a Federal entity, upon the authorization and written consent of an authorized representative of the Federal entity; and

(D) information that is stored on, processed by, or transiting an information system monitored by the private entity under this paragraph.

(e) Antitrust exemption

(1) In general

Except as provided in section 1507(e) of this title, it shall not be considered a violation of any provision of antitrust laws for 2 or more private entities to exchange or provide a cyber threat indicator or defensive measure, or assistance relating to the prevention, investigation, or mitigation of a cybersecurity threat, for cybersecurity purposes under this subchapter.

§1505. Protection from liability

(a) Monitoring of information systems

No cause of action shall lie or be maintained in any court against any private entity, and such action shall be promptly dismissed, for the monitoring of an information system and information under section 1503(a) of this title that is conducted in accordance with this subchapter.

(b) Sharing or receipt of cyber threat indicators

No cause of action shall lie or be maintained in any court against any private entity, and such action shall be promptly dismissed, for the sharing or receipt of a cyber threat indicator or defensive measure under section 1503(c) of this title if-

(1) such sharing or receipt is conducted in accordance with this subchapter; and

Question 8.7.5 — Nissenbaum’s Computer Security Versus Cybersecurity. Does the CISA fit neatly into Nissenbaum’s technical computer security or in her concept of “cyber security?” Which sections are most in line with her framing?

▄

Question 8.7.6 — Threats to Civil Liberties. Civil libertarians saw the benefits of the CISA as insufficient compared to its assault on privacy. What do you think civil libertarians’ principal concerns were?

▄

Question 8.7.7 — Privacy, Antitrust, and Lawsuits. What did industries get with the CISA? What did civil libertarians gain/defend? Would it surprise you to learn that years after the enactment of CISA, many organizations are not taking advantage of the sharing provisions?

▄

CISA’s statute requires the agency to maintain an information-sharing infrastructure: the Automated Indicator Sharing (AIS) Portal. AIS collects “cyber threat indicators” (CTIs) in structured formats (known as Structured Threat Information Expression (STIX) and the Trusted Automated Exchange of Intelligence Information (TAXII)) for dissemination. These structured formats make it more difficult for companies to send private personal information to CISA.

Congress designed rules surrounding AIS to maximize voluntary participation. For instance, submissions of CTI to the portal cannot be the basis of a duty to warn nor a duty to act. Congress also created immunities for antitrust law violations—submissions to AIS do not trigger rules about anti-competitive behavior. Yet, despite all these assurances and immunities, AIS participation remains voluntary and businesses may prefer to continue to use small, curated, informal sharing networks or ISACs instead of the CISA system.

Exercise 8.3 — A Real Threat Alert. Please review Alert (ICS-ALERT-14-281-01E), Ongoing Sophisticated Malware Campaign Compromising ICS (Update E), available here: https://perma.cc/53P4-RJ2Q

We don’t expect you to understand everything in this document. Just skim it and note what you find interesting about it. In particular, look at the indicators of compromise identified by DHS. “YARA Signatures” are a pattern-matching tool used to find malware in a system. If you scan your system for the YARAs identified in this Alert and find matches, you may have BlackEnergy!

This is a “TLP Amber” document and, technically, it is controlled by DHS. However, its full text was uploaded into a regulatory petition, and, as a result, it is formally part of the public record.

▄

Question 8.7.8 — A CISA Cybersecurity Alert. CISA regularly issues alerts giving detailed information about attacks of specific Advanced Persistent Treat groups. Please look through a recent one to understand how analysts are alerted to threats and how they should search for indicators of compromise: here (https://www.cisa.gov/news-events/cybersecurity-advisories).

▄

8.8 Conclusion

This chapter provides a high-level overview of the political economy and legal frameworks for critical infrastructure protection. Critical infrastructure cybersecurity is increasingly regulated. There is now an agency tasked with coordination and information sharing, and critical infrastructure companies will be compelled to send information to it.

In addition, it is important to know that any given CI may have sector-specific rules and norms, some of which are explored in more detail here. For instance, electricity companies and defense contractors have growing cybersecurity duties. Other important industries have similar responsibilities and are treated elsewhere in this book. For instance, banks and brokerage houses are subject to longstanding security rules as well as more recent regulatory interventions to ensure resilience of the financial markets covered in Chapter 10.

CI is important because our dependence on modern conveniences gives attackers a way to threaten our well-being, and because modern cyber warfare explicitly considers using attacks on banks, electricity, and transportation to erode a population’s will to fight.

Notes

1 The attack worked by manipulating a safety relay that held the generator in sync with the substation’s load. By increasing the speed of the generator, and then forcing it to slow down to return to the frequency of the substation, the tremendous torque tore apart the hardware. See Greenberg A. Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin’s Most Dangerous Hackers. 1st ed. New York: Doubleday, 2019.

2 See Zetter K. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon. 1st ed. New York: Crown Publishers, 2014

3 Reagan R. Assignment of National Security and Emergency Preparedness Telecommunications Functions: Executive Order 12472, April 3, 1984 [establishing the National Communications System]. Weekly compilation of Presidential documents 1984; 20:467–73.

4 Obama B. Executive Order 13691—Promoting Private Sector Cybersecurity Information Sharing. Daily Compilation of Presidential Documents, 2015 Feb.

5 Biden J. Executive Order 14028—Improving the Nation’s Cybersecurity. Daily Compilation of Presidential Documents, 2021 May.

6 A 2015 study by Lloyd’s, the insurance company, modeled an attack where Trojan malware created physical damage to just 50 (of the 700) generators in the northeastern US. It concluded that 93 million would lose power with an economic impact of $243 billion–$1 trillion! Lloyds of London. Business blackout, 2015.

7 CISA is an elevation of the National Protection and Programs Directorate (NPPD), established in 2007.

8 Rosenzweig P. Turns Out It Is Not 85 Percent. LawFare, 2023.

9 In order to unsettle competitor Lyft, Uber employees booked thousands of rides on the Lyft platform and cancelled them! See Fink E. Uber’s dirty tricks quantified: Rival counts 5,560 canceled rides. CNN Money 2014.

10 Perlroth N. This Is How They Tell Me the World Ends: The Cyberweapons Arms Race. eng. London: Bloomsbury Publishing Plc, 2021.

11 AT Section 101 Attest Engagements, American Inst. Certified Public Accountants, 2014.

12 48 CFR §239.73.

13 A security standard might require an assessor to look at a privacy policy and ensure it is followed, but standards do not set rules for what the privacy policy contains.

14 Herr T and Ormes E. Understanding Information Assurance. Cyber insecurity. Edited by Harrison RM and Herr T. Roman and Littlefield, 2016.

9.
Intellectual Property Rights

Chapter image: Odysseus and the Sirens, Otto Greiner (1902–1909).

Source: Wellcome Collection/Public domain/
https://wellcomecollection.org/works/s663jmah/images?id=gk643exh.

Chapter Learning Goals

What is Intellectual Property (IP)?

For many companies, IP is their most important asset, and intense security efforts are used to protect it.

How to protect IP?

IP laws provide criminal and civil remedies to some forms of computer attack.

IP laws can be used to deter “online abuse,” such as the posting of private photographs online.

Intellectual Property Rights (IPRs) exist in the shadows compared to the cybersecurity problems surrounding personal information (PI) and security breaches. Less is known about IPRs and cybersecurity. But, for many firms, intellectual property (IP), which consists of patents, trademarks, copyrighted material, and trade secrets, is a more important asset than customer data. (In this chapter, IP is for intellectual property instead of Internet Protocol.) For most companies, if their trade secrets and other secret business process information were stolen, competitors could arise and eat their market share. However, if they lose customer information, the companies might suffer short-term costs and embarrassment.

Data breaches rarely cause competitive disadvantage for a company. This means that for most firms, IP security is a more important goal than data security.

IP > PI.

For many, if not most, companies, IP is more important than PI. So, why do we constantly hear of PI breaches rather than IP breaches? Is it that IP security is exquisitely perfect?

No—we hear about PI breaches because state laws and some federal regulations impose broad public notice obligations when personal data are accessed without authorization. On the other hand, companies can often keep their IP breaches secret from the public. The exception to that rule concerns publicly traded companies subject to the Security and Exchange Commission’s (SEC) disclosure rules. IP breaches at such firms may require public notice if they are “material” under the SEC rules discussed in Chapter 10.

This chapter sets the context for IPRs’ relationship with geopolitical issues, discusses trade secret theft, and then turns to the Digital Millennium Copyright Act (DMCA), which is relevant to cybersecurity in several ways. It concludes with what might seem like a misplaced topic: the problem of Internet harassment, abuse, and threats. This material is included here because IPRs—particularly the DMCA—give wronged individuals powerful remedies against some forms of Internet harassment, particularly when an attacker uses sexual imagery of another person to shame them.

9.1 IPR Problems: Context

IP laws in America impart legal interests in several forms of creative expression for some limited time. During the time of protection, the owner has rights to use the protected information and has remedies against others who do so. The four major forms of IPRs relevant to cybersecurity are patents, copyright, trademarks, and trade secrets.

Patents protect inventions, such as new pharmaceuticals, new ways of solving a problem, or new designs for a product. Patents are powerful legal interests because holders can compel others to pay them for use of their inventions, at least for a limited time. Most patents are published; disclosure of the invention puts others on notice and contributes to additional innovation.

Copyrights protect a broad range of expression that is fixed in some form, like this book, whether it appears in print or a computer file. Works of art, software, movies, and music all enjoy copyright protection. Copyright law creates large civil and criminal penalties for illegal use of protected materials. We intuitively know that copying a book violates the owners’ rights, but so does publicly performing a song without paying its creator.

Trademarks refer to “marks,” which are symbols and designs that distinguish one brand from another. For instance, the “swoosh” is recognized as a symbol that sets apart Nike-brand shoes from others.

Trade secrets are similar to patents, but trade secrets are carefully guarded and never expire as long as they remain secret. For instance, the precise formula of Coca-Cola is a trade secret. Its owner can sue employees or third parties who steal the secret to benefit competitors or foreign countries.

American companies have long faced both organized and haphazard attacks on their IP. The threat actors are diverse. The notional threat comes from a nation that does not or cannot invest in the invention of products and services. Suppose a nation—like China—wants to stand up a competitive airline manufacturer. It could do the hard work of engineering airplanes and optimizing their (dis)comfort and efficiency, or it can leap ahead by stealing the designs of Airbus and Boeing. If competitors can just steal, eventually the incentives to engage in expensive research and development will dry up.

9.1.1 IP Threats

The threats to IP take many other forms. In addition to nation-states, domestic competitors may steal IP. So might one’s own employees who wish to set up a competing business. Employees who are deeply angry with their firm might leak IP to destroy the company. Customers could be thought of as IP threats as well—sometimes we simply don’t want to pay for a movie, and so, the ordinary consumer can become a pirate by illegally downloading a movie. Activists form another class of IP adversary: some believe IPRs are too strong, so much so that they censor important expression and innovation. These activists might try to destroy the exclusivity of IP by posting protected knowledge online (a key driver of the dark web).

▄ Example 9.1 — Operation Aurora. Not to be confused with the famous government Aurora Generator Test, Operation Aurora was a fantastic 2010 hack on the most important US companies.¹ Dozens of US technology firms fell victim, although Google, to its credit, made the attack public and responded to it by moving their operations out of China to (pre-assimilation) Hong Kong. It is rumored that China obtained Google’s secret search engine algorithm in the attack.²

▄

In the corporate world, China is synonymous with IP misappropriation. Companies doing business in China use almost absurd precautions, including sending employees into the country with throw-away devices—devices that were not reformatted and restored but literally thrown away after a visit to China. Companies with regular activities in China sometimes store critical systems on encrypted servers with limited access privileges so in-country employees cannot use them. Companies also use electronic countermeasures, including bug sweeping and jamming in conference rooms to prevent eavesdropping. Companies know that if they want to take advantage of Chinese manufacturing, any information sent as part of the process might be repurposed to create a competing domestic venture.

Lawyers offer legal advice for companies active abroad, but sometimes, this advice misses the seemingly obvious context of operating in other countries and cultures with not only different laws but also different ideas of lawful and acceptable behavior. Lawyers tend to operate assuming a “rule of law” environment. Lawyers thus draft papers that employees, vendors, and others sign averring compliance with the secrecy requirements. But, these offer little practical protection because companies are unlikely to be able to enforce these agreement by litigating against foreign competitors in foreign courts. (Litigation might also anger government authorities.)

Rule of law, which includes the notion that the courts are impartial and structurally separate from the political body leading a state, is a given in the United States. Here, business activity is generally governed by noncriminal, civil courts, even when business activity causes physical harm. In contrast, in many other countries, governance is rule by law, meaning that law is used by the politically powerful against others.

In rule by law nations, legal prohibitions are written so broadly that everyone is in violation of the law all the time. The approach invites bribery and political favoritism. In addition, many foreign nations subject business conduct to their criminal courts, meaning that one’s employees may be jailed for their actions. Rule by law stands in marked contrast to rule-of-law jurisdictions, like America, where anyone can use the courts, and even the police, intelligence agencies, and the president can be sued or charged with crimes.

To be sure, IP threats are not limited to China: even European nations have used their intelligence agencies to spy for domestic competitors.³

Some suspect the United States to spy on behalf of its domestic industries. But, there is good reason to believe this is not the case.⁴ First, leaking classified information to companies is a crime in America. To avoid criminal liability, there would need to be a statute exempting this activity, but none exists.

But, suppose there were a secret policy of leaking. Upon inspection, this would be impossible to administer. To run such a program, the government would have to decide to whom stolen IP should be given. This is not simple in America. Many fields have scores of competitors, making it difficult to decide who should get the tip. Suppose the US government stole a secret enabling engineering of a large quantum computer, and suppose it was leaked to Microsoft. If any of Microsoft’s competitors obtained wind of this, they would have strong incentives to demand the secret or publicly reveal the unfair scheme—how else could they explain to their investors why they fell behind?

International investment and ownership are another complexifier—many US companies are multinationals and not uniquely bound to their American identity. Finally, it would be impossible to keep the program secret. As employees switched companies or just gossiped, the program would come to light.

9.1.2 APT1

Presidential administrations knew of foreign IP theft, but pursuing other strategic priorities with China and Europe kept this theft off the nation’s public agenda. Then, in 2013, Mandiant, a cybersecurity intelligence company, released a historic report—APT1—that forced the US government to reckon with the problem.⁵ APT1 documented audacious computer intrusions against Mandiant’s American clients and strongly established China’s People’s Liberation Army as the aggressor. APT1’s details cataloged even the mundane, including Army hackers’ use of dating websites before their shifts began!

Question 9.1.1 — Relative Importance of IP This is a good point to consider the ways “national interest,” “public interest,” and “economic interest” can diverge. Should protection of IP occupy a higher priority among the national interests pursued by apex political leaders? What method should policymakers use to order the importance of IP relative to regional priorities, such as ensuring free trade in Asia, or supporting American allies in the South China Sea?

▄

The corporate community quietly supported Mandiant, long wanting someone credible to connect the dots showing trade secret theft linked to China. But, many in the US government were horrified. The Mandiant report used sophisticated investigatory methods likely also used by intelligence agencies. Now, these methods were public and, presumably, China would develop countermeasures. The report identified targets who likely were being studied by the US IC. But, worst of all: APT1 made it impossible for the president to keep IPRs off his high-level agenda with China (Figure 9.1).

In a principal summit with China, President Obama discussed commercial espionage with President Xi. The confrontation appeared to have resulted in a temporary drop in IP-related theft that later picked up again.

Jack Goldsmith warns that Americans tend to see China as a unitary force that is in full control of its society in commerce. But, China is a much more complex nation with competing political factions just like other nations. Thus, President Obama’s shaming of China may have exposed activity unknown to the Xi regime or even activities that were in competition with state economic interests. Goldsmith observed, “This is less a story of ‘coercion’ than it is of ‘cooperation’ between the United States government and Xi to serve Xi’s military centralization and anti-corruption efforts. What we don’t know is how much state-sponsored commercial theft Xi is willing to tolerate (or able to eliminate), or how the government-related China-groups will morph along China’s very fuzzy public-private sector line to avoid detection from both China’s government and the U.S. government, or to operate in a way outside China’s government that Xi does not care about. Recall that last fall’s US–China cyber deal, China agreed only not to ‘conduct or knowingly support cyber-enabled theft of intellectual property’ with the intent of bringing commercial advantage.”⁶

Figure 9.1 A year after the APT1 report, the Department of Justice indicted “uglygorilla,” an alleged hacker discussed in detail and identified by real name by Mandiant.

Source: Federal Bureau of Investigation/Public domain/https://www.fbi.gov/wanted/cyber/wang-dong/@@download.pdf.

Question 9.1.2 — State Responsibility for Hacking. Recall from Chapter 2, Jason Healey’s framework for state responsibility—nations may lack control of hackers operating in their country. Particularly, with China, westerners tend to see the nation as mastering totalitarian control over its population. Public reporting presents simplistic narratives through “social credit” schemes and the like. The reality is much more complex.a

▄

a Ahmed S. Credit cities and the limits of the social credit system. AI, China, Russia, and the Global Order: Technological, Political, Global, and Creative. JSTOR, 2018:48.

9.2 Protection of Trade Secrets

Recall that patents are published in the public record. Anyone can download these innovations and inspect them. On the other hand, trade secrets are secret. This makes trade secrets the focus of many attacks and thus a major concern in cybersecurity.

The controversy set loose by the Mandiant report also gave wind to federal legislation—the Defend Trade Secrets Act (DTSA)—that was signed by President Obama in 2016. DTSA created a federal, private right of action for trade secret misappropriation claims. It also elevated trade secret misappropriation to a Racketeer Influenced and Corrupt Organizations Act (RICO) offense and required more study of international trade secret threats. After passage, companies filed hundreds of DTSA cases, but most appear to concern former employees who allegedly took trade secrets as they left for new jobs.⁷

9.2.1 Reasonable Measures for Protecting Trade Secrets

Historically, trade secret law was governed by states—and trade secret owners can use state law to protect their secrets if they wish. However, the DTSA’s federal right of action offers advantages, including access to federal courts, which may be more sophisticated than state alternatives.

The DTSA specifies:

18 USC §1839. Definitions

(3) the term “trade secret” means all forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or in writing if–

(A) the owner thereof has taken reasonable measures to keep such information secret; and

(B) the information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, another person who can obtain economic value from the disclosure or use of the information;

As a cybersecurity professional, your main focus will be on (3)(A)—did the firm take “reasonable measures” to keep the trade secret secret? Reasonable measures need not be perfect.⁸ The requirement for “reasonable” methods signals an objective standard under the circumstances. This means a court will look to what a reasonable trade secret owner should do.

Trade secrets owners have two priorities: First, prevent the trade secret from being published in public filings (including regulatory findings) or communicated to third parties without controls. Second, trade secrets must be treated more carefully and differently from business confidential information (e.g., salary information that is confidential because it may be embarrassing). If you think business information is sensitive, consider your trade secrets to be top secret: apply a higher level of protection, a “need to know” standard for disclosure, and segregate secrets from ordinary sensitive information.

As with other issues, courts look to whether processes were in place to protect the trade secret. This means a firm must both have processes and the ability to document those processes:

Were all the trade secrets itemized and accounted for?

Were all the trade secrets properly marked as confidential?

Did the trade secret holder have a policy setting forth a plan to protect trade secrets?

Did the policy designate restricted physical areas for these secrets?

Were employees advised of this plan and required to sign nondisclosure agreements?

Were trade secrets only communicated to those who needed to know them?

Did the owner limit surveillance threats, for instance by restricting personal mobile phones and cameras in protected areas?

Did the owner have employees delete trade secret information when they separated?

Were the plan and agreements enforced by the owner?

Did the employer have careful procedures to deal with employee exit—requiring employees to return company information when they resigned or were fired?

9.2.2 Rights Under the DTSA

Turning to remedies and rights, the DTSA amended existing law (the Electronic Espionage Act (EEA) of 1996) to create a private right of action so trade secret owners can directly enforce the law. Key to enforcement is the concept of misappropriation:

18 USC §1839

(5) the term “misappropriation” means-

(A) acquisition of a trade secret of another by a person who knows or has reason to know that the trade secret was acquired by improper means; or

(B) disclosure or use of a trade secret of another without express or implied consent by a person who-

(i) used improper means to acquire knowledge of the trade secret;

(ii) at the time of disclosure or use, knew or had reason to know that the knowledge of the trade secret was-

(I) derived from or through a person who had used improper means to acquire the trade secret;

(II) acquired under circumstances giving rise to a duty to maintain the secrecy of the trade secret or limit the use of the trade secret; or

(III) derived from or through a person who owed a duty to the person seeking relief to maintain the secrecy of the trade secret or limit the use of the trade secret; or

(iii) before a material change of the position of the person, knew or had reason to know that-

(I) the trade secret was a trade secret; and

(II) knowledge of the trade secret had been acquired by accident or mistake;

Again, note the standard used here—a person who knows or has reason to know that the trade secret was acquired by improper means. This means one cannot just plead ignorance. A person who ignores signals that the information was stolen can be liable.

Here are the relevant enforcement provisions and remedies:

18 USC §1836. Civil proceedings

(b) Private Civil Actions.—

(1) In general.—An owner of a trade secret that is misappropriated may bring a civil action under this subsection if the trade secret is related to a product or service used in, or intended for use in, interstate or foreign commerce.

(2) Civil seizure.—

(A) In general.—

(i) Application.—Based on an affidavit or verified complaint satisfying the requirements of this paragraph, the court may, upon ex parte application but only in extraordinary circumstances, issue an order providing for the seizure of property necessary to prevent the propagation or dissemination of the trade secret that is the subject of the action.

[…]

(G) Action for damage caused by wrongful seizure.—A person who suffers damage by reason of a wrongful or excessive seizure under this paragraph has a cause of action against the applicant for the order under which such seizure was made, and shall be entitled to the same relief as is provided under section 34(d)(11) of the Trademark Act of 1946 (15 U.S.C. 1116(d)(11)). The security posted with the court under subparagraph (B)(vi) shall not limit the recovery of third parties for damages.

[…]

(3) Remedies.—In a civil action brought under this subsection with respect to the misappropriation of a trade secret, a court may—

(A) grant an injunction—

(i) to prevent any actual or threatened misappropriation described in paragraph (1) on such terms as the court deems reasonable;

(ii) if determined appropriate by the court, requiring affirmative actions to be taken to protect the trade secret; and

(iii) in exceptional circumstances that render an injunction inequitable, that conditions future use of the trade secret upon payment of a reasonable royalty for no longer than the period of time for which such use could have been prohibited;

(B) award—

(i)(I) damages for actual loss caused by the misappropriation of the trade secret; and

(II) damages for any unjust enrichment caused by the misappropriation of the trade secret that is not addressed in computing damages for actual loss; or

(ii) in lieu of damages measured by any other methods, the damages caused by the misappropriation measured by imposition of liability for a reasonable royalty for the misappropriator’s unauthorized disclosure or use of the trade secret;

(C) if the trade secret is willfully and maliciously misappropriated, award exemplary damages in an amount not more than 2 times the amount of the damages awarded under subparagraph (B); and

(D) if a claim of the misappropriation is made in bad faith, which may be established by circumstantial evidence, a motion to terminate an injunction is made or opposed in bad faith, or the trade secret was willfully and maliciously misappropriated, award reasonable attorney’s fees to the prevailing party.

These provisions of the DTSA give trade secret owners new access to the courts and powerful remedies.

9.2.3 The Electronic Espionage Act (EEA)

DTSA amended the EEA and builds upon that law’s criminal provisions. The first section of the EEA concerns stealing of trade secrets for some kind of foreign interest; the second deals with stealing trade secrets for competitors.

18 USC §1831. Economic espionage

(a) In General.—Whoever, intending or knowing that the offense will benefit any foreign government, foreign instrumentality, or foreign agent, knowingly—

(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains a trade secret;

(2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys a trade secret;

(3) receives, buys, or possesses a trade secret, knowing the same to have been stolen or appropriated, obtained, or converted without authorization;

(4) attempts to commit any offense described in any of paragraphs (1) through (3); or

(5) conspires with one or more other persons to commit any offense described in any of paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy,

shall, except as provided in subsection (b), be fined not more than $5,000,000 or imprisoned not more than 15 years, or both.

(b) Organizations.—Any organization that commits any offense described in subsection (a) shall be fined not more than the greater of $10,000,000 or 3 times the value of the stolen trade secret to the organization, including expenses for research and design and other costs of reproducing the trade secret that the organization has thereby avoided.

§1832. Theft of trade secrets

(a) Whoever, with intent to convert a trade secret, that is related to a product or service used in or intended for use in interstate or foreign commerce, to the economic benefit of anyone other than the owner thereof, and intending or knowing that the offense will, injure any owner of that trade secret, knowingly—

(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains such information; […]

Keep in mind here that criminal statutes only can be enforced by the government, and the Department of Justice carefully considers policy and resource allocations when enforcing. When Congress adds civil enforcement provisions, private businesses can sue using the criminal law. These private companies might have entirely different incentives than the government, and pursue cases the government would not because they may be perverse in a policy sense. For instance, the government would not devote resources to suing the former employee of a company to simply make that person less able to get a new job. But, a company might.

9.3 Copyright and Cybersecurity

Copyright law is relevant to cybersecurity because it concerns both the protection of information itself and the tools used to ensure its protection. That is, we use technical measures not only to protect information like movies and music but also to protect the “digital rights management” (DRM) technologies that attempt to secure movies and music.

To be sure, copyright owners have interests in protecting information and information-protecting tools. However, if too strongly protected, copyright interests come into conflict with fundamental security research. This is because copyright owners may claim that merely testing DRM technologies is a kind of attack on their IPRs. In formal terms, copyright owners can claim that DRM testing and security research “circumvents” controls on protected information.

Consider the provisions of the DMCA of 1999. These are the main prohibitions imposed by the DMCA—read them carefully as there are several technology categories (“access controls” and “copy controls”):

17 USC §1201. Circumvention of copyright protection systems

(a) Violations Regarding Circumvention of Technological Measures.-(1)(A) No person shall circumvent a technological measure that effectively controls access to a work protected under this title.

(2) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that-

(A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title;

(B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or

(C) is marketed by that person or another acting in concert with that person with that person’s knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.

(3) As used in this subsection-

(A) to “circumvent a technological measure” means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner; and

(B) a technological measure “effectively controls access to a work” if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work.

(b) Additional Violations.

(1) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that-

(A) is primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof;

(B) has only limited commercially significant purpose or use other than to circumvent protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof; or

(C) is marketed by that person or another acting in concert with that person with that person’s knowledge for use in circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof.

(e) Law Enforcement, Intelligence, and Other Government Activities. This section does not prohibit any lawfully authorized investigative, protective, information security, or intelligence activity of an officer, agent, or employee of the United States, a State, or a political subdivision of a State, or a person acting pursuant to a contract with the United States, a State, or a political subdivision of a State. For purposes of this subsection, the term “information security” means activities carried out in order to identify and address the vulnerabilities of a government computer, computer system, or computer network.

Congress has specific threat models in mind when enacting the DMCA: people who created tools to remove protection from movies and music and post this information online. But, contemplate just how broadly written the DMCA is—the plain text would seem to draw in many ordinary, critical computing tasks. For instance, software can be protected by copyright. Suppose you were a cybersecurity analyst attempting to determine whether software was secretly infected with malware. If you used a process to decompile the software or translate minimized code, have you “circumvented” a measure to protect the software?

When Congress enacted the DMCA, security experts warned that some circumvention of access and copy controls was necessary for cybersecurity purposes. Congress recognized three classes of exempted testing: for encryption, for protecting PI, and for security testing:

17 USC §1201 continued

(g) Encryption Research.-

(1) Definitions.-For purposes of this subsection-

(A) the term “encryption research” means activities necessary to identify and analyze flaws and vulnerabilities of encryption technologies applied to copyrighted works, if these activities are conducted to advance the state of knowledge in the field of encryption technology or to assist in the development of encryption products; and

(B) the term “encryption technology” means the scrambling and descrambling of information using mathematical formulas or algorithms.

(2) Permissible acts of encryption research. Notwithstanding the provisions of subsection (a)(1)(A), it is not a violation of that subsection for a person to circumvent a technological measure as applied to a copy, phonorecord, performance, or display of a published work in the course of an act of good faith encryption research if-

(A) the person lawfully obtained the encrypted copy, phonorecord, performance, or display of the published work;

(B) such act is necessary to conduct such encryption research;

(C) the person made a good faith effort to obtain authorization before the circumvention; and

(D) such act does not constitute infringement under this title or a violation of applicable law other than this section, including section 1030 of title 18 and those provisions of title 18 amended by the Computer Fraud and Abuse Act of 1986.

(3) Factors in determining exemption.-In determining whether a person qualifies for the exemption under paragraph (2), the factors to be considered shall include-

(A) whether the information derived from the encryption research was disseminated, and if so, whether it was disseminated in a manner reasonably calculated to advance the state of knowledge or development of encryption technology, versus whether it was disseminated in a manner that facilitates infringement under this title or a violation of applicable law other than this section, including a violation of privacy or breach of security;

(B) whether the person is engaged in a legitimate course of study, is employed, or is appropriately trained or experienced, in the field of encryption technology; and

(C) whether the person provides the copyright owner of the work to which the technological measure is applied with notice of the findings and documentation of the research, and the time when such notice is provided.

(4) Use of technological means for research activities.-Notwithstanding the provisions of subsection (a)(2), it is not a violation of that subsection for a person to-

(A) develop and employ technological means to circumvent a technological measure for the sole purpose of that person performing the acts of good faith encryption research described in paragraph (2); and

(B) provide the technological means to another person with whom he or she is working collaboratively for the purpose of conducting the acts of good faith encryption research described in paragraph (2) or for the purpose of having that other person verify his or her acts of good faith encryption research described in paragraph (2).

(i) Protection of Personally Identifying Information.-

(1) Circumvention permitted.-Notwithstanding the provisions of subsection (a)(1)(A), it is not a violation of that subsection for a person to circumvent a technological measure that effectively controls access to a work protected under this title, if-

(A) the technological measure, or the work it protects, contains the capability of collecting or disseminating personally identifying information reflecting the online activities of a natural person who seeks to gain access to the work protected;

(B) in the normal course of its operation, the technological measure, or the work it protects, collects or disseminates personally identifying information about the person who seeks to gain access to the work protected, without providing conspicuous notice of such collection or dissemination to such person, and without providing such person with the capability to prevent or restrict such collection or dissemination;

(C) the act of circumvention has the sole effect of identifying and disabling the capability described in subparagraph (A), and has no other effect on the ability of any person to gain access to any work; and

(D) the act of circumvention is carried out solely for the purpose of preventing the collection or dissemination of personally identifying information about a natural person who seeks to gain access to the work protected, and is not in violation of any other law.

(2) Inapplicability to certain technological measures.-This subsection does not apply to a technological measure, or a work it protects, that does not collect or disseminate personally identifying information and that is disclosed to a user as not having or using such capability.

(j) Security Testing.-

(1) Definition.-For purposes of this subsection, the term “security testing” means accessing a computer, computer system, or computer network, solely for the purpose of good faith testing, investigating, or correcting, a security flaw or vulnerability, with the authorization of the owner or operator of such computer, computer system, or computer network.

(2) Permissible acts of security testing.-Notwithstanding the provisions of subsection (a)(1)(A), it is not a violation of that subsection for a person to engage in an act of security testing, if such act does not constitute infringement under this title or a violation of applicable law other than this section, including section 1030 of title 18 and those provisions of title 18 amended by the Computer Fraud and Abuse Act of 1986.

(3) Factors in determining exemption.-In determining whether a person qualifies for the exemption under paragraph (2), the factors to be considered shall include-

(A) whether the information derived from the security testing was used solely to promote the security of the owner or operator of such computer, computer system or computer network, or shared directly with the developer of such computer, computer system, or computer network; and

(B) whether the information derived from the security testing was used or maintained in a manner that does not facilitate infringement under this title or a violation of applicable law other than this section, including a violation of privacy or breach of security.

(4) Use of technological means for security testing.-Notwithstanding the provisions of subsection (a)(2), it is not a violation of that subsection for a person to develop, produce, distribute or employ technological means for the sole purpose of performing the acts of security testing described in subsection (2),1 provided such technological means does not otherwise violate section 2 (a)(2).

A key point here is that security testers have to fit into the exception to avoid liability. This is a perilous posture because the exception is a defense to a legal violation: the security tester has the burden of showing that the exemption applies.

Using the DMCA, a number of companies have sued innovators, competitors, and security experts. For instance, some manufacturers of devices have sued competing companies attempting to make aftermarket parts. This is because such aftermarket parts might “circumvent” an access control—the part might have software that needs to interact with the product to work. A maker of garage door openers sued a competitor that made universal clickers under a DMCA theory, but the garage door company ultimately lost.⁹ A printer company tried but ultimately failed to block competitors from creating generic printer cartridges.¹⁰ And the Recording Industry of America even threatened a famous security researcher—Princeton’s Edward Felten—because Felten’s team found security holes in new software designed to protect music.

9.3.1 The DMCA and Critical Lessons for Software Testing

Although copyright industries failed in their cases, the DMCA is still a powerful stick that copyright holders can use to impose costs on innovators, competitors, and security experts. Just the threat of a lawsuit can dry up investment funding and intimidate another person.

There are four high-level lessons for those in cybersecurity: First, programmers who make security testing tools should never market them as intended to break access or copy controls. The explicit marketing of such functions is likely to run into trouble with the DMCA’s anti-trafficking provisions, while more generic marketing of “testing” tools is safer. This distinction might make little sense in principle—“testing” tools often do exactly the same thing as attack tools. But, the law considers marketing to be an important factor in interpreting the purpose of a tool.

Second, security experts who are testing software should obtain consent from the software developer, if possible. If this is not possible, the expert should carefully study the exemption language above and learn whether the US Copyright Office has created additional exemptions to the DMCA. These exemptions change and expire over time, so the researcher must monitor their evolving status. To be clear, without consent, the tester risks being sued, and the tester must then prove that an exception applies to the activity. Thus, consent is a much safer legal posture than relying on an exception.

Third, because the definition of circumvention is so broad, software developers may consider routine practices to be circumvention. For instance, the breadth of the DMCA’s definitions could sweep practices such as software decompilation into circumvention.

Finally, testers risk violating other laws if they probe software that is not on their computer. That is, it may be perfectly legal to test software that exists on one’s own hard drive, because one is “authorized” to use the computer. But, that exact same testing could violate the Computer Fraud and Abuse Act (see Chapter 7) if performed on cloud-based software. This is because the tester may not have authorization to attempt to break, fuzz, or otherwise manipulate software on another’s computer.

9.4 Online Abuse and IP Remedies

Internet harassment, abuse, and threats may seem out of place in a discussion of IPRs. But, in fact, IPR legal theories are some of the most powerful tools available to address Internet wrongs directed against an individual. Internet harassment and abuse often involve imagery—sometimes imagery of people naked or having intercourse that is circulated without consent. This material is protected by copyright, and the person depicted in the imagery may own rights to it.

Question 9.4.1 — Consensual Recording of Sex. What if consensual recording of sex is widespread, so much so we could expect couples to do it? The practice is common among deployed service members who must find ways to connect with their loved ones while stationed abroad. In some cases, sensitive media may be circulated by accident or in an attack, such as when an attacker gains access to private iCloud photos. What strategies should cybersecurity professionals use to destigmatize the problem?

▄

The strategic goal of the wronged party is primarily to stop the circulation of the images, but here is the problem: standard deterrence mechanisms may not work against the wrongdoer. As we learn in Chapter 5, deterrence by punishment requires an adversary with certain characteristics—rationality and assets that can be “held at risk.” But, wrongdoers who post nude images of former intimates are often blinded by rage, thus lacking common sense, and often have no assets that can be threatened.

Thus, to stop the images, the wronged party must somehow convince Internet platforms from hosting the images. Such efforts face legal and economic problems. The legal problem is that under the Communications Decency Act §230 (CDA), Internet platforms like Facebook and pornography websites are not responsible for privacy and speech wrongs of users. These platforms can simply ignore the wronged party’s privacy pleas and continue to spread the sexual imagery.

From the platform perspective, these businesses do not want to become entangled in disputes over user-generated content. There is simply too much of this content to analyze it all deeply. Getting involved in disputes requires manual review, which costs money.

But, platforms have to get involved if the wronged party can invoke an IPR. This is because platforms have immunity for privacy and speech wrongs under the CDA, but they do not enjoy full immunity from IPR wrongs. Thus, copyright theories can be used to force platforms to do a “takedown” of the material. This is because the wronged party—the person depicted nude—might have taken the photo or video. The maker of a “selfie” is its copyright owner, with attendant IPRs.

Wronged parties sometimes have a secondary goal of punishing a former partner. There are civil and criminal remedies for this, but often, the wrongdoer is judgment proof or might escalate the conflict by drawing even more attention to the material.

The following sections walk through approaches to address harassment, abuse, and threats (Table 9.1).

Table 9.1 Creative lawyers and activists have found several practical ways to deter abuse online and mitigate its effects.

Harassment
The First Amendment protects online invective that falls short of a true threat, but wronged parties can document harassment and reveal it to parties that might be willing to punish the aggressor—for instance, the aggressor’s employer may intervene if the harassment is delivered using a workplace device. Some aggressors live with their parents, and complaining to the parents sometimes helps

Abuse
The nonconsensual posting of intimate images can be punished with criminal law, copyright law, and even tort theories (breach of confidentiality or loyalty)

Threats
Making a “true threat” is a crime that is punishable by federal and state law. Although some lawyers opine that conditional threats are not true threats, there are many situations where conditional threats are illegal (“your money or your life”). It depends on context

9.4.1 Public Law Remedies for Abuse

There are legal options today to address online abuse. The DMCA takedown procedure can be used to remove images and other material. Federal and state anti-threat statutes can be used against a suspect.

9.4.1.1 The DMCA Takedown

A copyright holder (here, the person who took the photo or made the movie) can send a simple letter to an Internet service to request their material be taken down. Such DMCA “takedown” notices are made under 17 USC §512(c)(3) and need to make six simple assertions. The copyright holder must identify the material, assert ownership, provide URLs where the material exists, and swear an oath that the copyright holder has a good-faith belief the material is infringing on their rights.

Websites and services tend to take down material when they receive notices. They do so because most websites do not want pornography or to be the vessel of harassment. These activities are bad for business, and advertisers might refuse to place ads on a service that hosts pornography or harassment. Interestingly, pornography sites tend to take down material in response to DMCA notices as well. This is because pornography sites are overflowing with content; bandwidth is a greater expense to adult sites than content. From a pornography site’s perspective, taking down material is worthwhile because the cost of a lawsuit does not justify hosting any individual set of media.

Because the web is so driven by advertising business models, the so-called “revenge pornography” websites tend to fail. Advertisers have sophisticated systems to block their ads from appearing near pornography, thus depriving these sites from revenue. Over the years, several websites have arisen that invite gossip and revenge material, but most eventually fail in the marketplace. If these sites actively curate abuse material, they risk violating computer crime laws and may lose their CDA immunity.

Question 9.4.2 — Reputation Management. Michael Fertik graduated from Harvard Law in 2005 and founded Reputation.com (https://reputation.com) just a year later. Reputation specializes in both legal and technical methods to help people (and businesses) manage their online shadow. Some pay the company thousands of dollars a month to keep their Google search results on the up and up.

▄

The service may forward the takedown request to the user who posted the material—potentially the abuser. Thus, if you prepare a takedown request, be sure not to put PI about the wronged party in it (the poster might use it to locate the victim).

The user who posted can “counter notice” the takedown request—that is, challenge the takedown request. Doing so creates a period where the service can repost the material unless the victim quickly brings a copyright enforcement action in court. But again, most users do not counter notice, and most platforms have no incentive to keep abusive material up.

9.4.1.2 Federal Anti-threat Statute

We have placed the criminal anti-threat statute here, instead of in the criminal law materials, because anti-threat statues are so important in addressing online abuse. A federal law enacted in the telephone era (and applied to the Internet) is a powerful remedy for harassment victims because it broadly prohibits threats:

18 USC §875. Interstate communications

(c) Whoever transmits in interstate or foreign commerce any communication containing any threat to kidnap any person or any threat to injure the person of another, shall be fined under this title or imprisoned not more than five years, or both.

(d) Whoever, with intent to extort from any person, firm, association, or corporation, any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to injure the property or reputation of the addressee or of another or the reputation of a deceased person or any threat to accuse the addressee or any other person of a crime, shall be fined under this title or imprisoned not more than two years, or both.

This would seem to be an exceedingly broad law, strangely out of tune with American First Amendment norms. To be sure, when this law was enacted, threats were made by telephone and by mail. Thus, the speaker took steps to communicate directly to the victim. The intent of the speaker to coerce the victim is pretty clear when a treat is communicated by phone.

The rise of the Internet complicated the statute. It is possible to “threaten” other people online through indirect means. For instance, a person may publish a website with obnoxious and threatening speech, but never send the website to the target of the speech. People may also misinterpret speech as a threat, when in reality, the language is ambiguous or not targeted at that person.

The drift caused by applying a telephone-era law to the Internet caused the Supreme Court to rein in §875. In Elonis v. United States, 135 S.Ct. 2001 (2015), Elonis posted what appeared to be threatening speech to his Facebook account pertaining to many people in his life, including his estranged ex-wife. He adopted a new persona online and posted communiques like this:

Hi, I’m Tone Elonis. Did you know that it’s illegal for me to say I want to kill my wife? … It’s one of the only sentences that I’m not allowed to say… . Now it was okay for me to say it right then because I was just telling you that it’s illegal for me to say I want to kill my wife…. Um, but what’s interesting is that it’s very illegal to say I really, really think someone out there should kill my wife… . But not illegal to say with a mortar launcher. Because that’s its own sentence….

The former spouse and coworkers were gravely concerned about this speech. But Elonis was strategic—it is technically true that it is illegal to threaten someone, yet it is legal to discuss threats in the abstract. Elonis further muddied the waters by claiming his expression was part of a new, artistic identity that helped him cope with his divorce.

The district court and appellate courts did not buy Elonis’ arguments and held that the state only had to prove that Elonis intended the communication. That is, the state did not have to prove that Elonis also intended a threat. He ultimately was convicted and sentenced to prison.

The Supreme Court reversed to protect a good principle: After all, if there is no requirement to prove that a speaker intended to threaten someone, anyone might be charged with a violation of §875. The court held that the state had to prove that Elonis intended to threaten someone. The question then became: What proof is required?

In the Elonis case, the court concluded it was enough that the state proved that a “reasonable person” would understand Elonis’ communication as a threat. Known as an objective standard, the reasonable person test would ask the jury to imagine what the average person in the community would think when sending the messages. The Supreme Court held that this was not enough—the state had to prove that the speaker had a subjective intent to threaten or that the speaker subjectively knew the victim would take the speech as a threat.

Proving subjective intent is difficult. How does anyone know—and prove—what is inside another’s head? Adding to the difficulty is that in America, one cannot coerce a defendant to explain their intent. Such coercion violates the Fifth Amendment’s protection against self-incrimination. In practical terms, the state must use circumstantial evidence (the Internet posts themselves) to argue the speech, taken together, evinces a subjective intent to threaten.

In 2023, the Court weighed in on how much proof is necessary. In Counterman v. Colorado, the Court held that the state has to prove either (1) that the defendant had the subjective purpose of threatening the victim or (2) that the defendant acted recklessly. Recklessness is a complicated standard that in essence means the defendant was indifferent to the rights of the victim.¹¹ One way to think about recklessness is that it captures the person who does not have the purpose to threaten, but cares so little about another person’s rights, they communicate a threat anyway—imagine the defendant who says “I don’t care about you enough to threaten you, I just find it entertaining to write hostile messages.”

Counterman involved an angry Internet commenter who sent hundreds of messages to a local musician. The musician repeatedly tried to block the messages, but Counterman always found new ways to communicate, including by creating new Facebook profiles. Some of the messages suggested Counterman was following the victim. The musician was put in a bind: she could not just stop using social media, because the technology is key to promotion as a performing artist. Yet, she also could not find a way to block Counterman and lived in fear that he would appear at her home or performances.

Taken together, these cases mean the state can win a threats case if it can prove the defendant spoke with the purpose to threaten, knowing the victim would see the speech as a threat, or was reckless.

9.4.1.3 A Postscript on Elonis

Counterman and Elonis require the state to surmount a high hurdle, and yet, the nature of online communication makes it possible to prove purpose, knowledge, and/or recklessness. Consider the litigation after Elonis won his appeal in the Supreme Court: when the lower courts reviewed the case, the facts spoke loudly enough to justify upholding Elonis’ conviction.

The Court of Appeals held that if the jury had been properly instructed on a purposeful, knowing, or reckless standard, the jury still would have convicted Elonis. A deeper understanding of the facts makes it clear why the jury would have convicted—Elonis was on direct notice that his speech was threatening to his ex-wife, thus meeting the standard that the defendant knew the communication would be a threat. Elonis had posted Facebook messages so extreme that his ex-spouse sought and obtained a restraining order. Elonis also continued his Facebook campaign, posting a question whether the restraining order was “thick enough to stop a bullet.”¹²

After his conviction, Elonis was charged again in 2022 for new threats made between 2018 and 2021, targeting the prosecutor, his ex-wife, and a former girlfriend. In March 2023, Elonis was sentenced to 12 years in prison.

What is the takeaway from Elonis? A target of threats can place the aggressor on notice that their speech is threatening and help establish the proof necessary for the state to prosecute under §875. For people aiding victims of online abuse, this means carefully documenting the abuse and then formally informing the aggressor the speech is threatening. Victims may be reluctant to take these steps, because any interaction with the aggressor can trigger additional cycles of escalation, and too often, law enforcement does not help until physical violence occurs.

It remains to be seen what will become of Counterman. The state can continue to litigate the case and argue that the state met the purpose, knowledge, or reckless standard in prosecuting Counterman. The authors think Counterman is likely to be convicted because the victim’s repeated blocking and the content of the messages probably meet the knowledge-of-threat standard.

9.4.1.4 State Anti-abuse Laws

Over half the states have adopted criminal and civil statutes to address online abuse. Consider California Penal Code §647: It is a misdemeanor if someone “photographs or records by any means the image of the intimate body part or parts of another identifiable person, under circumstances where the parties agree or understand that the image shall remain private, and the person subsequently distributes the image taken, with the intent to cause serious emotional distress, and the depicted person suffers serious emotional distress.”

In addition, other laws can be used to prosecute abusers. For instance, the California attorney general prosecuted the operator of a “revenge pornography” website for extortion and identity theft in 2015, obtaining an 18-year jail sentence.

9.4.2 Private Law Remedies for Abuse

Public law remedies often attract more unwanted publicity. If the wrongdoer is charged with a crime, there will be public records and proceedings that might further spread the material. Thus, many practitioners in this field use private-law remedies. These range from clever self-help (e.g., telling the wrongdoer’s employer about the abuse, which can trigger firing), to simply requesting removal of materials (e.g., services’ terms of service give them broad discretion to cancel accounts and remove posts), and private law suits, primarily in torts.

Exercise 9.1 — Online Abuse Self-Help. Nonprofit group Cyber Civil Rights Initiative has developed in-depth and easy to use resources to address the posting of nonconsensual nude photos and videos: Cyber Civil Rights Initiative Safety Center (https://cybercivilrights.org/ccri-safety-center/)

The group also has a guide to state laws: Cyber Civil Rights Initiative State Laws (https://cybercivilrights.org/existing-laws/). Please visit their site and review some of these materials.

Please also examine how harassment is managed by a service of your choice. Look at a website that has a significant user-generated content component—ones similar to Facebook, Twitter, or Reddit. Can you determine what their policy is on removing material for harassment reasons?

▄

9.5 Conclusion

Cybersecurity for intellectual property is critically important, yet public attention has been drawn away from it in favor of highly publicized personal information breaches. But, institutions are under attack constantly by threat actors who wish to steal IP, and for many institutions, their IP is much more valuable than personal information.

IPRs received greater attention under the Obama administration and will continue to be a focus for legal practice.

The use of IPRs to fight online abuse and harassment is a form of creative problem-solving that offers some remedies for individuals.

Notes

1 Buchanan B. The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics. Harvard University Press, 2020.

2 Rosenzweig P. Cyber warfare: how conflicts in cyberspace are challenging America and changing the world. ABC-CLIO, 2013.

3 In the 1990s, France was accused of using its intelligence apparatus to spy against American aerospace companies. Cue E. French Riled by US Claims Of Industrial Espionage. CS Monitor, 1993.

4 The U.S. government’s view of IP is pious compared to other nations. Interestingly, the United States had a less pious view of IP at its founding. See Ben-Atar DS. Trade Secrets: Intellectual Piracy and the Origins of American Industrial Power. Yale University Press, 2008.

5 Mandiant. APT1: Exposing One of China’s Cyber Espionage Units, 2013.

6 Goldsmith J. U.S. Attribution of China’s Cyber-Theft Aids Xi’s Centralization and Anti-Corruption Efforts. LawFare, 2016.

7 Levine DS and Seaman CB. The DTSA at one: an empirical study of the first year of litigation under the Defend Trade Secrets Act. Wake Forest Law Review 2018; 53:105.

8 See AvidAir Helicopter Supply v. Rolls-Royce Corp., 663 F.3d 966 1069 (8th Cir. 2012).

9 Chamberlain Grp., Inc. v. Skylink Techs., Inc., 381 F.3d 1178 (Fed. Cir. 2004).

10 Lexmark International, Inc. v. Static Control Components, Inc, 387 F.3d 522 (6th Cir. 2004).

11 The Court expressed this as “The State must show that the defendant consciously disregarded a substantial risk that his communications would be viewed as threatening violence.”

12 United States v. Elonis, 841 F.3d 589 (C.A.3 (Pa.), 2016).

10.
The Private Sector

Chapter image: Odysseus and the Cyclops Vase Painting, WikiMedia User KDS444.

Source: Unknown/WikimediaCommons/Publicdomain/
https://commons.wikimedia.org/wiki/File:Cyclops_and_Odysseus_vase_painting.svg.

Chapter Learning Goals

Learn how companies think differently about cybersecurity.

Learn risk strategies.

Understand the complex national security dynamics that private companies are now entangled in.

Understand companies’ problems with “advanced persistent threats.”

Be able to diagnose and respond to a security breach.

Understand the basic principles of cybersecurity insurance.

Understand the incentives of corporate boards.

For many organizations, security comes down to basic economics. If the cost of security is less than the likely cost of losses due to lack of security, security wins. If the cost of security is more than the likely cost of losses, accept the losses. ¹

—Bruce Schneier

Reports that say that something hasn’t happened are always interesting to me, because as we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – the ones we don’t know we don’t know. And if one looks throughout the history of our country and other free countries, it is the latter category that tend to be the difficult ones. ²

—Secretary Donald Rumsfeld

Cybersecurity is just one of many challenges that companies must manage now. As important as cybersecurity seems to those of us who study it, companies face day-to-day problems that are more salient, such as keeping products shipping and hiring the best talent. Firms have many “important” priorities, but the most important objective for any business is maintaining operations. For some firms, fraud is the lowest line-item loss on their expense sheets, and guess what? Losses can be written off on taxes.

This chapter presents the highest-level issues for private companies in cybersecurity. It starts by framing risk. It then turns to the modern political dynamics facing Internet companies. The modern scourge of companies—the “security breach”—is covered here. Then, the chapter covers how public companies’ cybersecurity is regulated, how to interact with boards of directors, and, finally, how to think about cybersecurity insurance.

This chapter also unites observations from Chapter 5 on Security Studies, the concept of anarchy, and deterrence theory. Simply put, companies are at the center of a failed deterrence model: governments are not effectively protecting companies from economically motivated and nation-state attacks. Companies increasingly must act as anarchic nation-states. They are on their own. Companies use insurance to manage cybersecurity risks, but as nation-state attacks become more frequent and costly, insurers may refuse to pay.

10.1 There Will Be Blood: Risk and Business Operations

The work “risk” appears scores of times in this chapter. All human economic activities pose risks and sometimes cause accidents. Companies are pragmatic about accidents. They do not see disastrous outcomes as a bar to operation. In fact, we should not even think of injury events as “accidents”—sophisticated businesses know injuries will occur. They model and predict such bad outcomes. To address injuries and wrongs, sophisticated businesses develop risk management strategies.

Many people see the protection of personal information as a civil liberties and human rights issue. But businesses do not. Businesses’ role in society is to create value. And so, businesses operate with personal information as though it is just another asset, like product inventory or intellectual property. Businesses naturally resist the idea that their operations have human rights implications or that they are responsible for protecting civil liberties. To be fair, it is a lot to ask of a company to both offer excellent service and protect their consumers from governments.

What this means is that security is just another operational issue, one that should be managed by spending (not too much) money on risk strategies. An early analysis of security breaches starkly stated how businesses should think about the problem: “the optimal amount to spend on information security never exceeds 37% of the expected loss resulting from a security breach (and is typically much less than 37%). Hence, the optimal amount to spend on information security would typically be far less than even the expected loss from a security breach.”³

Businesses think about information security using risk management. To help a client think about risk, the first issue to probe is the client’s risk tolerance. Risk tolerance can vary a great deal. Startup companies and companies in intelligence and defense may intentionally take on risk. Conversely, many publicly traded companies are more risk-averse, often giving up sources of lucrative revenue to avoid negative publicity, lawsuits, or regulatory attention.

Companies tend to see risk along three dimensions: The first surrounds what is jeopardized by the risk; that is, if the risk is realized, what is likely to go wrong? For companies, some risks are more important than others. Risks that affect operations are those that threaten the business’ ability to provide their product or service. This tends to be the most important risk to companies. Reputational risks are those that somehow degrade the stature of the business. Some companies care a great deal about reputation; some don’t. Legal risks are those related to regulatory enforcement, class actions, and fines. Again, some companies may be on the razor’s edge of lawsuits, while others may escape notice. Competitive risks are those that undermine the firm’s relative performance in the marketplace. Of course, some companies enjoy deep competitive moats and may not be so worried about the competition, while others may be in a cutthroat environment where any change in advantage means success or failure. Finally, financial risks are those that directly erode the company’s capital. In a sense, all these risks are financial, but some risks are difficult to understand through a financial lens. For instance, reputational risks may be difficult to measure in a financial sense. Some companies have fantastic capacity to absorb financial risk, while others fold quickly.

Question 10.1.1 — Cyber Risks. Could you imagine different cyberattacks that implicate these five different risks? Try to think of examples that only implicate one of the five.

▄

Question 10.1.2 — Relative Risks. As you imagine different cyberattacks, which do you think is most dreaded by businesses?

▄

The second dimension is risk management. Risks must be managed—but how do firms do it? Firms can eliminate risks, perhaps by adopting procedures or a technology that is invulnerable to a certain kind of attack. Or perhaps they “eliminate” risk by simply not engaging in a certain activity. Firms can mitigate risks, that is, make the cost of realizing those risks lower, perhaps by adopting procedures and technologies that fail in a safe mode. Firms can transfer risk, that is, get someone else to pay for whatever losses occur (perhaps by buying insurance or getting another party to “indemnify” the company against a loss).⁴ Finally, firms most simply accept some risks. For instance, most companies have to accept some risk of non payment. When a restaurant serves dinner before the check arrives, there is a risk of dine and dash (Table 10.1)!

The third dimension for risk analysis focuses on probability: How likely the risk is to occur. Combined with the first dimension, companies can estimate the cost of a realized risk: probability times severity. Law students will recognize this as the famous Learned Hand framework: how likely is a risk (P for probability), and what is the severity of injury (L for loss) (Figure 10.1).

Companies prioritize cybersecurity risks with an emphasis on those that could cause strategic upset to the firm. The diner who pays with a stolen credit card poses an inconsequential financial risk to the restaurant. The most that will be lost—if anything—is the cost of a single dinner. However, the waiter who copies diners’ credit card numbers represents a strategic operational risk, because the credit card network might detect the fraud and disconnect the restaurant from their payments network. If a restaurant loses the ability to charge credit cards, the loss could be all dinners!

Table 10.1 Significant “wake up” moments in private sector cybersecurity. Note well that these events are important because they all endangered business operations.

Incident
What happened
Why it matters

Saudi Aramco (2012)
A group called the “Cutting Sword of Justice” used a wiper virus to destroy 30,000 hard drives at Saudi Arabia’s state-owned oil company, disrupting oil distribution
Adversaries can attack other nations by harming their most important companies instead of attacking their militaries. The advent of the wiper virus signaled the intent to permanently destroy computing resources and data at the target company

Sony Pictures (2014)
North Korea deeply disrupted Sony’s computing resources and released its upcoming movies online. Sony created a comedy focused on the assassination of Kim Jong Un
Unable or unwilling to strike the US military, North Korea attacked a major American company, attempting to destroy it. This revealed a new form of censorial coercion—North Korea attacked Sony Pictures for its distasteful, but legally free, expression

Las Vegas Sands (2014)
Iranian hackers wiped hard drives and attempted to destroy Sheldon Adelson’s casino empire
Like the Sony Pictures attack, this effort was made to punish Sheldon Adelson, apparently for commenting that the United States should detonate a nuclear bomb in the Iranian desert. Even rich individuals lack free speech if foreign nations can strike their finances in the United States

WannaCry (2017)
Ransomware that locks a computer’s hard drive with encryption until money is paid, WannaCry was released by North Korea. The software was a derivative of EternalBlue, an NSA-hacking tool released by the Shadow Brokers
It is bizarre for a nation-state to be engaged in economically motivated cybercrime. Only a kleptocracy like North Korea—with no relationship in the international banking system—could do so. For the private sector, WannaCry is a significant operational risk caused by a hacking tool made by the US government

Finally, security itself can be a strategic-level risk. Systems that prioritize security over goals, such as new customer acquisition, might cause a competitive risk. Imagine sitting down to dinner and being asked to pay up front—you might decide to dine elsewhere! This is why many companies assume risks or cut corners on security. Doing so can give them a competitive advantage (recall the idea from Chapter 6 about how Zoom might have pulled ahead by making its service less secure than the competition).

10.2 The Politics of Sovereignty

International relations is now a strategic risk for ordinary Internet businesses. This was not always the case.

At the advent of the web, business leaders envisioned a world without governments: labor, capital, and products could now flow worldwide. Some business visionaries claimed the world had reached a post nation-state status and their companies were no longer identified with any particular country. Such executives imagined companies as citizens of the world. John Perry Barlow’s ideology reflected this intense optimism in the private sector.

Figure 10.1 An example of a risk assessment matrix. Public domain from Wikimedia user U3115299.

But history turned out differently and in both red and blue regions; political leaders tend to view major companies as tools of domestic power. This is important for at least two reasons: First, companies’ pragmatic view of cybersecurity, where attackers are economically motivated and can be deterred by simply making their activities unprofitable, no longer fits the threat landscape.

Increasingly, technology companies must think of themselves as strategic actors in the sense of national security strategy. Adversaries see American companies as agents of the government, and some see companies as proper targets of cyber conflict. This poses a challenge to the pragmatist approach because nation-states may not be economically rational in their decisions to attack. Adversary nations might attack to create harm untethered from some criminal, financially motivated goal.

On Google “Dorking” AKA Google Hacking

Search engines like Google “overindex” websites, meaning that, when crawling the web, Google and other companies automatically collect documents website owners never intended to publish. With Google dorking, one can find inadvertently posted, confidential, and proprietary documents on many corporate websites. These techniques are core to open-source intelligence (OSINT), the skilled use of public resources to perform investigations.

As a cybersecurity consultant, you might look for inadvertently posted documents for your client. Suppose you were consulting for the Chinese technology firm Huawei. You could paste the following string into a Google search bar:

site:huawei.com "confidential" filetype:pdf

This will reveal PDF files only on huawei.com that contain the word confidential. This is how the syntax works:

site:huawei.com This tells Google to only return results from Huawei.com’s website

‘‘confidential’’ Placing a word in quotes tells Google to only return pages that contain that word. Google tends to add synonyms and other terms to searches because Google assumes you are not very good at spelling nor that you know what you are searching for. To eliminate Google’s guesses at your intent and obtain only what you are looking for, put terms in quotes or choose “verbatim” results

filetype:pdf This tells Google to only return PDF files. One can also use filetype:xlsx, filetype:docx, or even filetype:pptx

There are other useful advanced features of Google. For instance, one can use AROUND(n) to find nearby terms, as in confidential AROUND(3) proprietary.

Learning these advanced features of Google put you in the top 1% of sophisticated search users! You can find more features here: Google Advanced Search (https://www.google.com/advanced_search).

Second, the American government, in turn, has started to view companies as badly concealed foreign adversaries. National security regulation of foreign competitors, a topic on simmer in recent decades, was heated to a boil in the Trump administration and continued into the Biden presidency. President Trump used his national security powers to levy restrictions on a panoply of Chinese companies, from ByteDance’s fabulously popular TikTok to less well-known payment and communications apps.

This means your clients may no longer embrace an optimistic citizen-of-the-world posture. In a securitized landscape, companies may eliminate international relations risk by forgoing investment from foreign entities and even giving up markets in other countries.

10.2.1 Homo Economicus Meets North Korea

To illustrate the problem of seeing private companies as mere proxies for their governments, consider the Sony Pictures hack.

In 2014, a group calling itself the “Guardians of Peace” deeply infiltrated Sony Pictures’ systems and then called on Sony to stop the release of a tasteless movie called The Interview. The movie depicted the use of US journalists to assassinate North Korea’s leader, Kim Jong-Un. The movie played into the authoritarian view (recall the Gerasimov Doctrine) that journalists and media companies are really just agents of American power and perhaps even Central Intelligence Agency agents.

Under the corporate pragmatist approach, companies think the criminal is an homo economicus, an economic agent who wants money. The standard strategy to deal with the intrusion is to figure out how to satisfy the attacker. How much money do they want? From a corporate perspective, attackers often seek laughably small ransoms that can be quietly paid. A million-dollar ransom would be a rounding error for Sony, and so, a pragmatist company would just pay it.⁵ But here was the problem for Sony: the Guardians of Peace were entirely serious about their demand because they were actual North Korean hackers!

Sony failed to comply with the demand and the hackers turned up the volume, leaking damaging internal memoranda, salary figures, and even Sony movies so people could download them and avoid paying. The hackers then did something completely out of left field: they tried to kill Sony. The hackers deployed a “wiper” program to destroy the company’s information—in this case, Sony’s product, its films! A wiper program erases information so the data are unrecoverable.

The Sony Pictures hack had two high-level political implications: First, it clearly demonstrated how Americans’ First Amendment expression rights can be threatened and infringed in ways impossible before the Internet. Foreign governments that are offended by Americans’ speech can now target those individuals through the Internet or by attacking speech platforms. We should see the Sony hack as a grave threat to our expressive rights.⁶

Second, Sony executives’ email revealed pay disparities between women and men and a raft of embarrassing gossip and nasty matters. The leaks damaged personal relationships and brought details to light that the tabloid press found irresistible to publish.

This second point is an example why many companies avoid participating in law enforcement investigations. All large organizations have problem employees. Some employees are up to all sorts of embarrassing and even illegal activities. Thus, companies rightly worry that a law enforcement investigation will turn up unrelated wrongdoing.

For companies, the Sony Pictures attack marked a shift in their political status. Sony Pictures was not an explicitly political company; it created films to please consumers, not governments. But the creation of entertainment offensive to a foreign government brought Sony into an explicitly political conflict.

From a strategy perspective, North Korea and Sony Pictures were “playing different games.” North Korea pursued an ideological goal, while Sony thought the attackers were financially motivated. The mismatch opened companies’ eyes to the notion that they have a new adversary: the opponent that wants to destroy their business rather than just extract money from it. Just imagine how confusing the situation must have been for Sony executives—why would a group calling itself “Guardians of Peace” attack the company? What peace were they guarding (Figure 10.2)?⁷

While the Sony Pictures hack attracted attention in the New York Times and was subject of much reporting, similar nation-state-on-company hacking occurs below the radar of the news media all the time. For most companies, the attacks are motivated by IP theft (see Chapter 9). A particular focus is on America’s Defense Industrial Base companies, the firms that make all the equipment and services that our military is dependent upon (see Chapter 8). Such attackers attempt to go undetected because they have intelligence goals.

Question 10.2.1 — Lenses on The Interview. Ben Buchanan—among the most important international relations scholars in cybersecurity—observes that the North Koreans failed in all their strategic goals to prevent the movie from being seen. The Interview was released and got a substantial bump in viewership from the publicity. Public reporting indicates that Sony broke even on the movie itself in just a month. Other reporting claims that Sony suffered $150 million in damages, but perhaps insurance covered some of that.

Buchanan concludes: “In the end, The Interview transformed from a movie likely to have a short shelf life into a cause célèbre for democracy and freedom of speech. And the North Koreans had to come to terms with the fact that, despite all their perceived advantages, their cyber coercion attempt had failed.”a

This offers a great opportunity to think about our cybersecurity “lens.” Do you agree with Buchanan? Why or why not? If you disagree, is the basis of the disagreement a matter of assumptions or facts?

▄

a Buchanan B. The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics. Harvard University Press, 2020.

Figure 10.2 This is the bizarre threat that Sony Pictures received from the “Guardians of Peace.” If you were a film executive unskilled in cybersecurity, what would you make of this?

10.2.2 Technological Sovereignty

Long before the Internet, Soviet strategists complained the country’s satellites were full of western components. More recently, Xi Jinping declared that China needed more indigenous technology to make the country a major cyber power. Nation-states worry about foreign technology because in the design, manufacturing, and shipping processes, adversaries may introduce vulnerabilities that could lead to surveillance or sabotage. That worry has concentrated on the United States, because of its invention of the Internet, its incubation of the most popular Internet services, and because of the numerous other technologies that emerged from US government efforts to win the space race.

Much of the world has no choice but to use US innovations. They may not have the capacity to address the risk that these innovations may have fundamental designs that could be used in a conflict to disadvantage an adversary.

In addition to technical design issues, manufacture of technologies provides opportunities to introduce vulnerabilities or unwanted spying—the so-called supply chain risk. In fact, at every step of service or product creation, there are opportunities to introduce vulnerabilities. “Systems (and their components) can be penetrated in design, development, testing, production, distribution, installation, configuration, maintenance, and operation.”⁸

There are many anecdotes speaking of supply-chain cyberattacks, and most are shrouded in mystique. In his New York Times column, legendary commentator William Safire wrote of how the United States included a “Trojan Horse” in pipeline control software provided by a Canadian supplier to the Russian government. This was part of an overall scheme where the United States provided “deliberately flawed designs for stealth technology and space defense [to send] Russian scientists down paths that wasted time and money.”⁹

More recently, Bloomberg Businessweek reported that Chinese army operatives implanted tiny chips into important computers, enabling these computers to be remotely controlled for unspecified purposes in the future.¹⁰ Major U.S. companies and the defense department scrambled to remove these computers from their systems.

As nations recast companies as actors in nation-state conflicts, companies’ technologies and services become national security risks. No better example exists than the concern surrounding 5G infrastructure. 5G brings very fast, low-latency Internet connections to mobile devices and is thought to be a key enabler for all sorts of network-dependent technologies, from automated vehicles to farm equipment.

The fundamental problem in 5G is that whoever makes the hardware/software ensembles that constitute the antennas, radios, and networking of 5G can corrupt the system and threaten CIA.¹¹ Practically speaking, it is difficult to detect and prevent such corruption. Vulnerabilities could exist in software or be latent in hardware or emerge from difficult-to-foresee interactions between software and hardware. Any testing that a defender performs must be redone every time a software patch is released, or when new equipment is installed. Anyone in the supply chain could include tiny chips to convert this equipment into spy/attack devices. Taken together, these facts make supply chain a strategic threat because its vulnerabilities impose massive, new costs on defenders.

There are now two categories of risks that companies face because of the turn to sovereignty. First, foreign investment is being scrutinized with new levels of severity and some transactions are even being blocked. Cybersecurity companies are particularly vulnerable to such interference because possessing sensitive personal information is now a focus of scrutiny. Second, more nations are demanding technology-sovereign approaches, by which we mean policies that ensure a nation is in control of infrastructure and data.

10.2.3 Committee on Foreign Investment in the United States

Companies now face a risk in accepting foreign investment because of new scrutiny from the Committee on Foreign Investment in the United States (CFIUS).¹² CFIUS is an interagency government body¹³ that reviews business transactions for US national security risks.

CFIUS, because of its national security mandate, has fantastic powers and those sanctioned by the body can do little about it. Historically, it has been a sleepy regulator except when national controversies erupt. Sometimes, these controversies seem driven by concerns about American economic dominance, like when Japan’s Fujitsu proposed to buy Fairchild Semiconductor. In other cases, such as when Dubai Ports World (owned by the United Arab Emirates) proposed to take over operations of harbors in America from the British, the threat to our safety seemed very real because of the UAE’s history with al-Qaeda.

For technology companies, CFIUS might as well have universal jurisdiction. While technically, it can only address “covered transactions,” this definition encompasses mergers, acquisitions, and even investments in companies. CFIUS explicitly is focused on critical infrastructures and any company that has “sensitive personal data of U.S. citizens.”¹⁴ That’s all of Silicon Valley, because any information relating to health, finances, and biometrics is included as sensitive.¹⁵ CIFUS can intervene in transactions before and long after deals are made.

Question 10.2.2 — Reverse CIFUS? If the US government can block foreign investment and the sale of US-developed products and services, should the government compensate companies that are blocked? In other words, do we need a reverse CIFUS of US-based investment to make up for foreign investment blocked by the government? What are the upsides and downsides of such an approach?

▄

An example shows how dramatic an intervention can be—consider CFIUS’ intervention concerning Grindr. Grindr is a social networking service that some people use for spontaneous sexual activities with strangers. As a result, Grindr knows the identity of many people, their precise location, and whether they connect through the service. In 2021, a Catholic newsletter bought Grindr adtech data and outed an important Catholic leader as participating in sex with other men, leading to his resignation.

CFIUS understood this risk years earlier. In 2018, it forced a Chinese investment group to divest a $250 million purchase in Grindr it made in 2016 over fears the service could lead to blackmail and extortion of US service people, diplomats, and even spies. The company ultimately sold Grindr to an approved purchaser for $600 million. To be clear, CIFUS intervened in a company’s investment two years after the deal closed!

Imagine working for a decade to build your startup and then being told the prime investor willing to pay hundreds of millions for your work is barred from investing!

Optional: Going Deeper on CFIUS

For a political science lens overview of CFIUS, see Aggarwal VK and Reddie AW. Regulators Join Tech Rivalry with National-Security Blocks on Cross-Border Investment. Global Asia 2019; 14:40–7. For a practical legal/technical strategic practice read, see Antón AI and Hemmings J. Recognizing Vendor Risks to National Security in the CFIUS Process. LawFare 2019. And this 2021 article discusses CFIUS in the context of artificial intelligence/machine learning (AI/ML): Severin A. Keeping up with China: CFIUS and the Need to Secure Material Nonpublic Technical Knowledge of AI/ML. Duke L. & Tech. Rev. 2021; 19:59.

10.2.4 Data Localization

The second risk of technology-sovereign policy approaches is wide ranging in implementation. In some countries, nations are pursing data localization policies, which means citizen data must be stored in-nation and available to that nation’s authorities. These approaches may come with coercive legal processes, such as threats to jail local employees of the company if there is a refusal to provide data. In 2010, Italian officials charged (in absentia) and levied jail sentences against three Google executives because the company refused to remove a video from YouTube that depicted bullying of a child with autism.¹⁶

Another example comes in customized hardware/software stacks to enable foreign law enforcement access. While companies do not advertise this broadly, they often create Chinese and Russian versions of their services with a different software stack. These ensembles allow governments to enforce their policy priorities. For instance, both Microsoft and Apple create custom versions of Windows and iOS to appease Chinese government enforcers.

Some nations are simply demanding that technology companies build in access tools for their law enforcement or intelligence agencies.

10.2.5 Export Control

Finally, export control regulations will shape the future of cybersecurity. All three forms of controls are relevant. The first, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) Specially Designated Nationals and Blocked Persons List (SDN) program was covered in Chapter 7. Recall that the government adds foreign hackers to the SDN list, effectively locking them out of international banking, as a specific deterrence mechanism.

The second comes from the Department of Commerce’s Bureau of Industry and Security, which runs the Export Administration Regulations (EAR). The EAR deals with dual-use technologies, those that have both commercial and military uses. Covered technologies are enumerated in the Commerce Control List (CCL). Allowing a download of software on the CCL to a foreign person, even in the United States, could be an “export” that requires a license. Historically, encryption has been subject to such controls and, to this day, the CCL includes a category of software for defeating information security systems.

As companies specialize in creating tools that can crack the iPhone or otherwise provide remote access to devices, there will be increasing pressure on companies with export control rules. The 1996 Wassenaar Arrangement is developing into a mechanism to impose more restrictions on the international transfer of technologies that could be used to attack.¹⁷

The third comes from the State Department’s International Traffic in Arms Regulations (ITAR), which attempt to block the transfer of military technologies.

Almost all the dominant US defense firms have paid fines or settlements for ITAR violations, and these are large; often in the eight-figure range.

A wide set of technologies are now under ITAR’s “United States Munitions List,” an enumeration of technologies that is now over 33,000 words. Several cybersecurity-relevant technologies are on the United States Munitions List (USML), including communications systems that are difficult to intercept and military cryptographic and cryptanalytic systems.

10.3 The APT Problem

Cybersecurity experts within companies are concerned with “advanced persistent threats” (APTs) because these actors are not merely scanning networks looking for weak links. Instead, APTs are advanced and persistent in two ways: Actors can be advanced in the sense they are nation-states or in the sense they are sophisticated. APTs are persistent in the sense nation-state actors will continue to attack until they have reached their objective, and, in the sense, sophisticated actors can create intrusions that are very difficult to eliminate. APTs are determined adversaries. CISOs know that with enough effort, APTs will get into their systems.

APTs need not be technologically brilliant. In fact, for most organizations, phishing is the most important APT. Phishing is the practice of attempting to obtain information by pretending to be a trusted person. For instance, one might pretend to be Google and email a user suggesting they reset their password, but provide a fake link to do so where the attacker can capture the password (see the example phish of John Podesta in Chapter 3). Phishing is one of many social engineering techniques where an attacker uses social pressure and forms of psychological manipulation to elicit information from people or get them to take some desired action.

Prior to the Internet, the practice was well known as pretexting, because the attacker creates an artificial pretense to trick another person. For instance, in the telephone context, an attacker might want to locate a person in order to stalk them. The attacker might call the telephone company pretending to be the person and ask for calling records that belong to that subscriber. Telephone companies would then forward the calling records and home contact information.

Thus, security experts should not overlook attacks that occur by phone. Some of the most brilliant hackers use sublimely clever pretexts by telephone to elicit passwords and even multifactor tokens!¹⁸

Despite the technological simplicity of email phishing, its importance cannot be overemphasized. Organizations constantly face phishing attacks. A large percentage of users open phishing emails—as they are so convincingly written and because the messages create a sense of urgency in the recipient. Some users click on the malicious links contained within phishing messages. A small percentage falls for the trick and provides personal information or install software from the malicious message. That small percentage makes phishing attacks worthwhile, because many attackers are sending millions of malicious messages (Figure 10.3).

It’s tempting to deride people for falling for phishing schemes. But anyone, including you, dear reader, can be tricked. Good phishers study their victims, send them messages that appear to be from coworkers, and sculpt the situation so it is convincing and appears urgent.

Organizations often understand phishing as the most likely way their systems will be attacked and exploited. This is a profound observation for cybersecurity policy. It means that, rather than finding and exploiting technical errors in a system, it makes more sense to trick users of that system into letting an attacker in. Phishing also means insiders should be conceived of as the largest security vulnerability to any organization. Yes, outsiders attack, but insiders often let them in, and in many other cases, consequential security incidents are caused by insiders either accidentally or intentionally.

Figure 10.3 According to the Department of Justice, this email was a spearfish targeting Sony managers. Clicking on the link directed the user’s browser to an executable program.

Question 10.3.1 — Phishing and the Irrational Communication Strategy. Interestingly, the phishing problem might take advice from deterrence theory. As Schelling explains, threats need to be communicated to work. Thus, making oneself unavailable, pretending not to hear, or pretending not to understand render threats edentulous. This is because, in part, delivering on a threat offers no utility to the attacker, instead, the impending nature of the threat is what gives it coercive authority. If we can’t “hear” email threats, they might as well not exist. Thus, one potential solution to the phishing problem is massive filtering or even communications systems that operate only on authenticated whitelists. What would be the other implications of shutting out some communicants?

▄

Question 10.3.2 — Users As the Enemy. This section introduces two controversial ideas: that many (perhaps most) hackers do not use technical exploits and that people inside an organization are the most fertile ground for security problems. These two dynamics can pitch security actors into centralizing more and more information technology, and in trusting users less and less. Is there a way out of this spiral?

▄

To address phishing and other risks, institutions model likely attacker activity. Lockheed Martin and MITRE, both private entities that support government agencies, have created models, known as the Cyber Kill Chain and ATT&CK, respectively, to understand likely attacker behavior. The frameworks convey a central and important idea: by the time defenders detect an attacker, the attacker probably has been in the system for months or even years.¹⁹ The kill chain tools help defenders understand “where else” the attacker has been and “what else” the attacker might have been up to during the months it was undetected. That is, the kill chain helps the analyst reconstruct the timeline of attacker activity and ensures the analyst’s investigation is complete. Kill chains also help defenders diagnose the severity of an attack.

Kill chain models divide attacker behavior into phases, with early steps involving the study of an adversary’s network and the transmission of malicious links or software to it. In later steps, the adversary attempts to obtain control of other systems in the victim’s network by “lateral movement,” that is, by using the ability to act on one system to gain access to other systems. Attackers can also upload software that enables control of these systems. In the final step, attackers have the freedom to act as they wish on various victim systems. These models help organizations understand where to invest resources and evaluate the severity of attacks.

The models tend to focus on external rather than internal threats. Of course, no model can incorporate all the multifarious methods and goals of an attacker (Figure 10.4).

10.3.3 — ATT&CK and the Cyber Kill Chain. You can learn more about these frameworks online. MITRE has a training program with good explanatory slides on ATT&CK (https://perma.cc/Y7AJ-DL33). Lockheed has this nice guide to the Cyber Kill Chain (https://perma.cc/B9LU-Q62J). Technical analysts inside organizations use these two frameworks to conceive of how threat actors attack and decide how to invest surveillance resources.

▄

Figure 10.4 This version of the “Kill Chain” developed by the US Navy anticipates attacker goals and methods to reach those goals. Defenders can study the methods and investigate whether adversary activity is present. If it is, the Kill Chain helps the defender understand how mature the attack is and the threat it poses. Suppose an attack is detected at the “delivery” stage. The analyst should continue investigating until the attacker’s weaponization and reconnaissance is understood.

10.4 The Security Breach Problem

Most businesses and many government entities now have to tell customers, regulators, or the public if they have suffered a sufficiently serious security event. Reporting requirements reflect a revolution in security thought, one based on what Adam Shostack and Andrew Stewart proposed as the New School of information security—a school of thought that attempts to treat security as a science. The idea is that for security to become a science, it has to be informed by data and evidence. For this to be possible, security practitioners must transcend the instinct to be secretive and start revealing information about security problems.²⁰ Requiring notice of security breaches is among the first steps of creating a common, public picture of the state of insecurity. Prior to security breach notification laws, no one really knew just how often personal data were spilled.

One cyberintelligence firm estimates there are about 35 security breaches that leak consumer information a day. We should not be surprised to learn of data spills. Recall from Chapter 8 that most companies are in “Tier 1” of the NIST Cybersecurity Framework (the lowest tier), meaning they possess only “partial” preparedness.

Exercise 10.1 — Troy Hunt’s Have I Been Pwned? Some attackers steal entire customer databases and try to sell them. Sometimes these attackers post the entire dataset online for anyone else to see. Many of these databases are available on Bittorrent or so-called “paste” sites.

Security expert Troy Hunt created a service, have i been pwned?, which aggregates information from such security incidents and informs users whether their email addresses are present in these datasets. That is, one can determine if one’s email address has been part of a publicly available security incident (not all security events are made public, but many are, and some attackers even send their data to Hunt).

You can visit Hunt’s site: https://haveibeenpwned.com/, enter your email address, and see whether your email and password associated with another service have been “pwned.” This is a safe process because Hunt uses hashing to obscure your email address and it compares the hash to the services’ hashes.

How many breaches has your email been a part of? Is there any common thread among the sites? And is your email part of an incident involving a company that you have no relationship with, such as a “data broker” that was selling your information?

Now that you know this, it should be apparent why it is important to use different passwords at every service one uses. Otherwise one is vulnerable to simple, automated “credential stuffing” attacks where one’s password from a breached site is tried at a high-value site, like Google Gmail. Strategies that include a strong password plus some string to represent the site, e.g., Va3ryRand0mPa5SwOnerd-homedepot.com , are ineffective against credential stuffing because attackers can manipulate this approach to guess your password at high-value sites.

▄

The security breach problem is so prevalent and so vast that some lawyers think cybersecurity law is incident response (IR). IR is the praxis that has arisen to deal with security incidents.

The focus on IR—here, incident response instead of international relations—is unfortunate because the point of security breach notification is not notification. Notification is an instrument to the terminal goal of greater cybersecurity. But lawyers are likely to see notification as the terminal goal because, after all, the law requires notification.

Notification serves the security goal in three ways. First, airing security information will help the individual prepare and defend against possible privacy and security invasions. We could think of this as a kind of duty to warn. Second, breach notification provides inputs to public regulation of cybersecurity. As we learn about breaches, policymakers and security experts alike should learn about new problems and find ways to fix them. Finally, breach notification shapes firm incentives. Firms should react to this regulation by reducing information collection, using encryption, and investing more in security.

Question 10.4.1 — Terminal and Instrumental Goals. What factors would we look at to decide whether security breach notification is actually improving cybersecurity?

Each of the three instrumental goals (warning, information forcing, and internalizing) could be separated and made more or less intense. (For instance, we could reduce warning burdens by replacing notice to individuals with notice to just the regulator, or we could enhance internationalization by levying severe fines.) Should policymakers dial up or dial down responsibilities? What do we think is an acceptable number of security breaches in an information society? What method should be used to decide?

▄

The security incident is a term of art in corporate cybersecurity that you must pay close attention to. A security incident is any event that suggests there is a problem with CIA. Companies have security incidents all the time, because the most subtle clues can signal a security problem.

Security breaches belong to a class of security incidents covered by a security breach notification law. To state this more clearly, security incidents are events that companies do reasonable investigations of, but ultimately, these events can remain secret within the firm. Security breaches are incidents defined by statutes and regulation where the firm must give notice to the public or to regulators. Because public notification is embarrassing, firms conceive of the severity of breaches through the lens of whether public notice is required.

Definition 10.4.1 — Incident Versus Breach. Be sure to note that security incidents reflect any event that erodes CIA. Breaches, meanwhile, are incidents that rise to the level of requiring notice.

Thus, one’s IT team may properly discuss security incidents, but it is the lawyers who, after reasonable investigation and contextual analysis, declare a security breach has occurred. Security breaches are technical events that have become legal events.

There are three high-level issues to consider in security breaches: (1) What information can trigger a breach? (2) What constitutes a “breach?” (3) What reporting threshold could be applied? Institutional guile—the problem that companies are willing to massage the facts or even lie to avoid disclosure—has caused legislatures to systematically broaden duties to disclose by including more and more trigger information.

Question 10.4.2 — The Reluctant Notifier. Suppose you have determined that a client needs to give notice of a breach but the client refuses. What arguments might you use to get them to do the right thing?

▄

10.4.1 Trigger Information

“Trigger information” are the categories of data that require a breach disclosure. The scope of trigger information is constantly expanding. The original security breach notification law, enacted in California in 2003, focused on the injury of identity theft. Thus, credit-related information, such as a social security number, driver’s license number, and bank account and credit card numbers, were the kinds of information that could trigger security breach notification responsibilities.

But as companies have lost other forms of sensitive information and then finked out on telling their customers about it, legislatures have expanded trigger information to include almost any kind of data that are potentially personally identifiable. Trigger data can now include medical and health insurance information, biometric data (this category is large and could include signatures and face prints), automated license plate reader data, and genetic data. One must do a state-by-state analysis and a regulator-by-regulator analysis to be up to date on categories of notifiable personal information.

The Securities and Exchange Commission (SEC) has perhaps the broadest trigger of all—loss of any kind of information can impose a disclosure obligation on publicly traded companies if the breach itself is “material.” SEC’s rules include nonpersonal information, such as sensitive trade secrets or other important business information.

Almost all security breach laws create an exemption for encrypted trigger information. That is, if a company loses encrypted personal information, there is no breach notification requirement. Practitioners originally thought this encryption safe harbor would be an important force to reduce security breaches, but the operational reality is that businesses keep data in cleartext for many activities.

10.4.2 What Is an Incident? What Is a Breach?

Security incidents might be something as inconsequential as a hacker scanning a website. Security incidents occur constantly. It is unclear what public benefit would come from hearing about security incidents.

The challenge for policymakers is identifying the dividing line between security incidents where the public has some interest in hearing about the details and those where there is no benefit, or even a disutility from hearing about too many incidents, leading to information overload. Getting this right is difficult because regulators must anticipate opportunism and guile—companies might cheat to avoid giving notice.

Another difficulty comes from the complexity of security events. In some, hackers may have accessed a system, but perhaps not personal information. In others, the attacker might download entire consumer databases to engage in identity theft. Sometimes the attacker posts the consumer database on the dark web to embarrass the company. This makes the data available to others who might download the corpus and misuse it.

Taken together, these factors caused legislatures to write increasingly broad definitions of breach. California’s definition is:

“breach of the security of the system” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained …

Note that mere acquisition of data—“seeing it” on a screen—qualifies as a breach. There’s no requirement for the state to prove the data were downloaded, sold, or posted to the dark web.

Question 10.4.3 — Privacy “Breaches.”. Simson L Garfinkel and Mary Theofanos canvassed the various Federal Trade Commission cases and found that many involved serious privacy problems flowing from incidents that were not “security breaches.”²¹ For instance, the Google Street View program accessed unencrypted wireless frames from individuals’ home routers, stealing sensitive personal information. In another incident, Facebook performed a study on 61 million users to see if providing them different information might motivate people to vote in elections. Neither of these incidents were security breaches, but they do profoundly affect individuals’ security. Should there be a notification regime for privacy breaches?

▄

The key point to know is what constitutes a breach changes with time. In addition to state laws that define what constitutes a breach, sector-specific regulators, ranging from the SEC to the Federal Communications Commission (FCC), also have defined breach regulations. A large company could thus be in a breach notification thicket. Consider a large, national telecommunications provider like AT&T. It may have breach obligations under 50 states, under its obligations as a public company reporting to the SEC, and even under the FCC rules as a telecommunications company!

10.4.3 Notification Regimes

There are several different approaches to imposing notification responsibilities.

The original approach embodied in the California law required firms that experience breaches to give notice to the affected data subjects. If that is too expensive, firms can notify the media, on the theory the media will write articles about the breach and publicize it.

But legislatures soon innovated new approaches. Among the first was to require notice to a relevant regulator. In California, breaches involving more than 500 records must be reported to the state attorney general. Since then, many other regulators, including the SEC and FCC, require breach notification to the agency.

Health institutions regulated by the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH) have reporting duties to regulators as well. If “unsecured protected health information” of more than 500 people is breached, an entity must give notice to the Health and Human Services Department Office for Civil Rights within 60 days.

Question 10.4.4 — Required State Reporting. Please visit California’s breach reporting form here (https://perma.cc/HPG6-8K6H). Note that California collects structured data about breaches, and it then uses that information to give advice back to businesses about security precautions.

▄

Question 10.4.5 — You Are the Enforcer. Suppose that you are the supervising attorney general for privacy in California and you decide what enforcement approaches should be used. To get a feel for the enormity of this responsibility, please visit this list of breaches that have been filed with your office here (https://oag.ca.gov/privacy/databreach/list). In any given month, there are dozens of breaches. What method would you use to triage them? Are there any breaches that stand out as requiring immediate investigation and possible prosecution?

▄

Another approach is to condition notice or other obligations on a risk analysis. If the breach is low risk, one need only notify the regulator. About 20 states take this approach.

Federal bank regulators adopted a version of this approach, where banks have the option to provide notice if their investigation of the breach turns up evidence of misuse.²²

The Security and Exchange Commission (SEC) also follows a risk approach, where “material” events (this definition encompasses both incidents and breaches) must be disclosed to investors. Importantly, this means a security incident involving intellectual property or other assets could trigger a notification. SEC law in cybersecurity is so important that it is dealt with in more detail later in this chapter.

▄ Example 10.1 — The Prosecution of Joseph Sullivan. Joseph Sullivan is a widely respected security expert. He was a Department of Justice lawyer for eight years before joining a series of technology companies. In 2022, Sullivan was convicted by a jury for attempting to cover up a security breach at Uber, where he had served as CSO. According to the Department of Justice, Sullivan sought to keep one of Uber’s breaches secret by paying off the hackers using cryptocurrency, and by claiming the incident was part of the company’s bug bounty program.

The case was strange because the DOJ didn’t name the corporate entity (Uber) or its CEO and focused on Sullivan personally. The prosecution represented the first use of the criminal law to punish a corporate official for how a data breach was handled. For students of security, the lesson is that CSOs might be personally on the line for the wrongdoing of a corporation. The government can punish individual employees if it finds a cover-up.

If one is asked to cover up a security breach, a possible remedy is the “noisy exit”—find another job and announce one is leaving. The abrupt departure of a CSO should send a signal as loud as when chief financial officers resign.

▄

The European General Data Protection Regulation (GDPR) has the most interesting approach that embodies risk principles. It is broader and narrower in certain areas. GDPR concerns “personal data breach” obligations, meaning, in addition to security breaches, companies must report privacy breaches. For instance, misusing an email database by selling it could be a reportable event, even though email addresses are not thought to be sensitive.

If a privacy or security breach occurs, the company must notify their national regulator (known as a “Data Protection Authority”) within 72 hours. But notice to individuals is not required unless the breach implicates their rights and freedoms. Going back to the email database example, selling a database of business contact information is unlikely to infringe human rights. However, if the contact information was of human rights activists working to thwart Russian or Chinese wrongs, rights and freedoms would certainly be at risk.

Taken together, lawmakers and regulators have created a wide spectrum of approaches to security breach notification. The broadest appears to be the SEC’s requirement for disclosure of “material” events, as this standard could require disclosure of an attempted but failed attack. In the middle is the California approach, which requires notice if an unauthorized person merely accesses the data. Toward the narrow end of the spectrum are those states that only impose disclosure where there is some risk of harm. The narrowest approach is the bank regulators’ definition, which in essence requires unauthorized acquisition and evidence of misuse. One could easily imagine how banks might use guile and opportunism to avoid finding misuse.

Credit Card Fraud

For merchants, credit cards are fantastic. They settle a day after the transaction, meaning that merchants get their money the day after a sale. Consumers spend more money with plastic, so credit cards increase sales.

There are two prices to pay for this convenience and spend boost: merchants have to pay credit card fees (about 3% of the transaction amount) and implement the security procedures surrounding credit cards.

To deal with the security procedures, most merchants outsource their payments process. The selected vendor provides the charging terminal and handles the end-to-end complexities of collecting, charging, and crediting accounts. Merchants pay for this with a per-transaction fee and through a percentage of all sales.

So, who pays when fraud occurs? To understand this, know that banks issue credit cards. The bank is in effect the lender. Networks (Visa, Mastercard, and American Express), on the other hand, connect banks and merchants and perform many back-end responsibilities.

Suppose John steals Jane’s Bank of America Visa credit card. The issuer/lender is Bank of America. Visa is merely the network that enables transactions. Suppose John goes to Best Buy and purchases a $2,000 television set (for a realistic example of an identity theft fraud ring, watch the movie EMILY THE CRIMINAL (Low Spark Films 2022)).

Best Buy just made a big sale. And guess what—it can keep the $2,000!

As long as the Best Buy cashier collected John’s “signature”—the cashier need not even inspect it—the risk of the fraud is transferred to Bank of America. The merchant gets the full $2,000, and Bank of America eats the fraud expense. Visa is akin to an ISP; it makes money from transmitting transactions whether fraudulent or not and is not liable for the loss.

Jane pays nothing as long as she detects and reports the charge to Bank of America within two months.

If the merchant failed to obtain the signature (and nowadays, the signature can be electronic or come in some other form), the merchant pays the $2,000 (and loses the merchandise it “sold” to John).

Suppose John and Jane are coconspirators, and Jane gave John the card with plans to later claim the transaction was fraudulent. This is known as “friendly fraud,” and if banks suspect it, eventually the bank will cancel Jane’s card. But Jane will probably get away with the fraud even multiple times because for banks, cost of investigation and prosecution is not worth the $2,000.

In Internet transactions and other remote transactions (phone orders), the CVV code (the 3- or 4-digit code on the card) serves as a “password” for the credit card number. If John ordered $2,000 in goods from Bestbuy.com, as long as the site collected the correct CVV, Bank of America holds the fraud liability.

The liability rules are dramatically different for debit or ATM cards. Because debit cards are protected by a PIN, the consumer holds more risk for fraudulent use. Under the rules, consumers must report fraud within two days of fraudulent use, and even then, the consumer holds $50 of risk. If fraud goes unreported for up to 60 days, the consumer holds $500 of risk. And if the consumer misses a fraudulent charge that is more than two months old, the consumer’s fraud risk is unlimited.

The lesson for this is: one should never use a debit card for a remote transaction or give anyone the debit card PIN. Always use credit cards for remote transactions.

From E to Z: The Payments Security Tussle

Behind the credit card and debit card loss rules are two different regulations: Regulation Z for credit cards (more consumer protection) and Regulation E for debit cards (more consumer risk).

Merchants prefer that consumers use debit cards (E), because the fees are dramatically lower. Debit card interchange fees are capped by regulation, whereas credit cards can charge different, higher fees, and various surcharges. American Express tends to be the most costly card for merchants to accept, with fees up to 3.5% of a transaction!

As a consumer, be careful when you sign up for new payment services, like Apple Pay or Venmo. It may not be clear whether the service uses the strong pro-consumer protections of Regulation Z or the riskier Regulation E approach. Sometimes a service could be using both! For instance, Venmo allows users to transfer value with their credit card at a higher fee than for accounts with a linked bank account. From a consumer perspective, the experience is seamless—the transaction goes through and the consumer pays either a slightly higher amount if a credit card is linked or perhaps no fee at all if a bank account is charged.

But from a security perspective, there is a hidden cost: if an attacker gains access to a PayPal or Venmo linked to a bank account, the attacker could clear out all the money and the consumer could potentially be on the hook for the loss unless the consumer notices and detects the fraud quickly. After all, it is not the bank’s fault. The attacker broke into the payment company, and the consumer was the one who linked the bank account to it!

Key takeaway: if one uses a new payment system, turn on multifactor authentication, particularly if the payment is linked to a bank account.

Security breach notification laws require just that: notification. If a company notifies properly, it has satisfied the law. If a company does not give notice and is caught, it could experience severe penalties. The lesson for practitioners: as painful as it seems to give notice, notice is less painful than getting caught and having to explain the decision not to notify.

IR is now so complex and detailed that it is a mature specialization. Special-purpose services firms will now manage IR from soup to nuts: there are companies that will perform the whole breach notification process—from investigation to sending out notices to consumers—for a fee far lower than a law firm would charge. The lawyers are still involved, but their activities are limited to those that really need professional counsel: diagnosing whether an incident is a breach, dealing with novel situations, inquiries from regulators, and the class action cases that sometimes follow large breaches.

Exercise 10.2 — All the Triggers. Law firms vigorously compete to serve as counsel in security breach cases because the legal part of the practice—liaising with regulators and fending off litigation—is still a big moneymaker. Providing free, high-value information is one way law firms can show off their expertise and attract new clients. The Perkins Coie law firm has long maintained an up-to-date chart of all the breach notification laws and their major provisions. Please download it here (https://www.perkinscoie.com/en/news-insights/security-breach-notification-chart.html).

Skim through this 150+ page guide and focus on the “Personal Information Definition.” What kinds of personal information can trigger a breach nowadays? Look for interesting examples.

Notice that some statutes include paper records (e.g., suppose the client prints out prescription records and leaves them in a trash can?) and some, like Mississippi, have a kind of exception where there is no notification obligation if “the breach will not likely result in harm” to the data subject.

Note that how a client processes information can create trigger data. For instance, if a client has security cameras that capture images of cars and of people’s faces, they probably do not have trigger data. However, if the client is using analytics on video, the video frames might constitute “biometric” data—faceprints—and license plate data from cars.

▄

10.4.4 Does Security Breach Notification Work?

Incident response is now an accepted form of cybersecurity regulation. IR duties have only become more burdensome and more expansive. But if the ultimate end of security breach notification is better protection for computer systems, maybe there is a more effective and less costly approach to reaching better cybersecurity postures.

There are so many security incidents that we risk over-notifying individuals who might begin to believe several things: Perhaps, there is nothing to be done about security and we must just accept a deeply insecure and competitive environment.²³ Perhaps, we just ignore notices as spam. Perhaps, protecting personal data is futile.

There is little political debate about replacing security breach notification with some other approach. If incidents are ubiquitous and virtually all firms suffer them, perhaps notice is a misuse of company and regulatory resources. Consider three alternative approaches: First, we could require companies to carry some form of cybersecurity insurance and allow the insurance markets to impose costs on firms with weak security. Second, we could take a privacy approach and require firms to collect less data and delete it soon after use. Such an approach might deny the benefits of attack. Finally, tax policy could be shaped to impose costs on firms with bad security. Such firms could pay into a fund that directly remunerates victims and helps small companies improve their security posture.

10.5 Hacking Back: CISA (The Statute) Revisited

“Hacking back” is the idea that a service operator can levy some kind of retorsion in retaliation for a cyberattack. It is not self-defense, which properly construed is a privilege of an individual to use limited violence to stop some kind of in-progress physical interference.

Hacking back is different. Hacking back is punishment in retaliation for a wrong. Common terms for it include “active defense,”²⁴ which is misleading (perhaps intentionally) and masks a highly risky, unprivileged use of computer attacks.

We can look to history for analogies for technological self-defense. Tort law has a rich history surrounding the use of “spring guns,” which ultimately were rejected as a tool for defense of property. Spring guns were typically shotgun-like devices connected to a door or window. If a burglar triggered a tripwire, the spring gun fired, sometimes maiming the burglar. At least in theory. In reality, innocents were shot. A seminal case involved a young chivalrous person who jumped a wall to retrieve an errant peacock; the young person was shot by a spring gun and lost a leg. Hacking back is more akin to the spring guns of torts than the privilege of self-defense. Hacking back might also find an analogy to government licensing of privateers who hunted seaborne pirates in previous centuries.²⁵

What does “hacking back” mean in practical terms? A 2016 report from George Washington University is among the most fulsome treatments of the topic, explaining potential methods and the legal risks companies that were concerned with at the time (Figure 10.5).²⁶

Hacking back requires a revisit of the concepts of Chapter 2 because the legality of the practice depends a great deal on where the hacking back occurs. In one frequently discussed proposal, a company places an attractively named file on their server, perhaps financialprojections.xlsx. But, this file masks a “beacon.” This beacon might have some tracking functionality. In its most benign form, perhaps the company gets an alert if the file is copied or opened. This would seem to cause no legal or ethical issues because we are free to get information about files on our own computers. Such a beacon would be similar to putting a proximity sensor or light in one’s front yard.

Figure 10.5 A 2016 study plotted different kinds of “active defense” being considered in the private sector.

Source: Center for Cyber and Homeland Security/
https://cynergia.mx/wp-content/uploads/2016/12/CCHS-ActiveDefenseReportFINAL.pdf/CCBY4.0DEED

But, in a more aggressive scenario, the beacon collects information from the suspect’s computer and reports it back to the victim. Perhaps, the beacon tries to determine the suspect’s IP address after the file is exfiltrated and opened on the suspect’s computer, making it not so different from spyware. This might be like a proximity light that emits a high-frequency tone if absconded with. The owner could hear the tone and understand where it had been moved.

Question 10.5.1 — CFAA Revisited: Beacons. Recall the Computer Fraud and Abuse Act from Chapter 7. Consider whether this beacon is a violation of 18 USC §1030(a)(2): “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains … information from any protected computer.” Has the beacon creator violated this provision?

▄

In an even more aggressive scenario, the beacon opens up other files on the suspect’s computer in an attempt to identify the suspect. And then finally, in the most extreme scenario, the beacon contains software that encrypts data on the suspect’s computer—just like ransomware! Perhaps, the encryption is limited to files the company knows are stolen, or perhaps the encryption attempts to scramble the suspect’s entire hard drive. Such “whitehat ransomware” would be a “legally authorized use of malware to encrypt files on a third party’s computer system that contains stolen information in transit to a malicious actor’s system. Public–private partners then inform affected third parties that they have been compromised and are in possession of stolen property, which they must return in order to regain access to their files.”²⁷ Perhaps this is like a proximity light that, if stolen, melts and starts a fire.

Question 10.5.2 — CFAA Revisited: Encrypting Beacons. Consider whether this beacon is a violation of 18 USC §1030(a)(5): “knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage, without authorization, to a protected computer.” Has the beacon creator violated this provision?

▄

The Cybersecurity Information Sharing Act of 2015, although primarily organized around information sharing as covered in Chapter 8, also had provisions relating to “hack back,” which it terms “defensive measures.” However, CISA does not allow aggressive measures.

In defense of defensive measures, companies claim they can recognize repeat attackers—the dreaded APTs. Some defenders want to poison these attackers and cause them damage, or spy on the attacker themself.

The risks of such “hacking back” are similar to those from spring guns and self-defense:

Physical self-defense must be proportionate to the threat. What is proportionality in response to an Internet attack?

Physical self-defense invites problems of error—what if the wrong person is defended against? Or what if the defender uses violence mistakenly?

What if the self-defense is used against a special actor, like a child, police officer, or rescuer? In active defense, there is a risk that one could use tactics against a law enforcement agency engaged in a secret investigation.

Lethal force can never be used to defend property alone. And use of force to protect property is generally limited. Computers are just property, after all.

As you read the CISA’s hack back provisions below, consider whether these concerns are addressed.

6 USC §1501

(7) Defensive measure

(A) In general

Except as provided in subparagraph (B), the term “defensive measure” means an action, device, procedure, signature, technique, or other measure applied to an information system or information that is stored on, processed by, or transiting an information system that detects, prevents, or mitigates a known or suspected cybersecurity threat or security vulnerability.

(B) Exclusion The term “defensive measure” does not include a measure that destroys, renders unusable, provides unauthorized access to, or substantially harms an information system or information stored on, processed by, or transiting such information system not owned by—

(i) the private entity operating the measure; or

(ii) another entity or Federal entity that is authorized to provide consent and has provided consent to that private entity for operation of such measure.

§1503. Authorizations for preventing, detecting, analyzing, and mitigating cybersecurity threats

(b) Authorization for operation of defensive measures (1) In general Notwithstanding any other provision of law, a private entity may, for cybersecurity purposes, operate a defensive measure that is applied to:

(A) an information system of such private entity in order to protect the rights or property of the private entity;

(B) an information system of another non-Federal entity upon written consent of such entity for operation of such defensive measure to protect the rights or property of such entity; and

(C) an information system of a Federal entity upon written consent of an authorized representative of such Federal entity for operation of such defensive measure to protect the rights or property of the Federal Government.

10.6 The Special Case of Financial Services

Financial services—banking, insurance, and investment brokerages—have a mature regulatory regime in cybersecurity, decades of practice, and spend huge sums of money on security. Major banks spend over $1 billion annually on information security. Thus, a detour into financial institutions (FIs) is justified to see what other industries might learn from this field.

Recall from Chapter 8 that financial services are critical infrastructures. Like other CIs, financial services have its own ISAC, the FI-ISAC. But unlike other CIs, financial services institutions have layers of well-developed security regulations.

10.6.1 Gramm Leach Bliley Act (GLBA)

The main point of the GLBA (also called the Financial Services Modernization Act of 1999) was to formally allow banks, insurance companies, and investment houses to merge. This blessed the mega-financial institution, a structure that was banned in the United States after the 1929 stock market collapse. In the intervening decades, regulators basically allowed mega-financial institutions to reconstitute themselves. By 1999, there was a consensus that the 1920s economic and information conditions could be managed and that it was now safe to allow banks, insurers, and investing companies to agglomerate.

In enacting the GLBA, a minority faction demanded that mergers of such large institutions come with privacy and security rules. Eventually, the pro-privacy faction prevailed, resulting in a security requirement in federal law:

15 USC §6801. Protection of nonpublic personal information

(b) Financial institutions safeguards In furtherance of the policy in subsection (a), each agency or authority described in section 6805(a) of this title, other than the Bureau of Consumer Financial Protection, shall establish appropriate standards for the financial institutions subject to their jurisdiction relating to administrative, technical, and physical safeguards—

(1) to insure the security and confidentiality of customer records and information;

(2) to protect against any anticipated threats or hazards to the security or integrity of such records; and

(3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

By insure, the legislature actually meant ensure. Section 6801 directed the seven different federal banking regulators to issue privacy and security rules. Some chose to release an interagency standard, called “Interagency Guidelines Establishing Information Security Standards.”²⁸

As a historical footnote, these regulations have evolved as states have imposed tougher standards. One historically important example is the New York State Department of Financial Services (NYSDFS) cybersecurity regulation (23 NYCRR 500). Promulgated in 2017 and in effect since 2019, the NYSDFS rules require security breach notification to the agency in just 72 hours!

Turning back to the GLBA, here are its privacy and security provisions:

A. Information Security Program. Each bank shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the bank and the nature and scope of its activities …

B. Objectives. A bank’s information security program shall be designed to:

1. Ensure the security and confidentiality of customer information;

2. Protect against any anticipated threats or hazards to the security or integrity of such information;

3. Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer; and

4. Ensure the proper disposal of customer information and consumer information.

A. Involve the Board of Directors. The board of directors or an appropriate committee of the board of each bank shall:

1. Approve the bank’s written information security program; and

2. Oversee the development, implementation, and maintenance of the bank’s information security program, including assigning specific responsibility for its implementation and reviewing reports from management.

B. Assess Risk. Each bank shall:

1. Identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems.

2. Assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information.

3. Assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.

C. Manage and Control Risk. Each bank shall:

1. Design its information security program to control the identified risks, commensurate with the sensitivity of the information as well as the complexity and scope of the bank’s activities. Each bank must consider whether the following security measures are appropriate for the bank and, if so, adopt those measures the bank concludes are appropriate:

a. Access controls on customer information systems, including controls to authenticate and permit access only to authorized individuals and controls to prevent employees from providing customer information to unauthorized individuals who may seek to obtain this information through fraudulent means;

b. Access restrictions at physical locations containing customer information, such as buildings, computer facilities, and records storage facilities to permit access only to authorized individuals;

c. Encryption of electronic customer information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access;

d. Procedures designed to ensure that customer information system modifications are consistent with the bank’s information security program;

e. Dual control procedures, segregation of duties, and employee background checks for employees with responsibilities for or access to customer information;

f. Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems;

g. Response programs that specify actions to be taken when the bank suspects or detects that unauthorized individuals have gained access to customer information systems, including appropriate reports to regulatory and law enforcement agencies; and

h. Measures to protect against destruction, loss, or damage of customer information due to potential environmental hazards, such as fire and water damage or technological failures.

2. Train staff to implement the bank’s information security program.

3. Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the bank’s risk assessment. Tests should be conducted or reviewed by independent third parties or staff independent of those that develop or maintain the security programs.

4. Develop, implement, and maintain, as part of its information security program, appropriate measures to properly dispose of customer information and consumer information in accordance with each of the requirements in this paragraph III.

D. Oversee Service Provider Arrangements. Each bank shall:

1. Exercise appropriate due diligence in selecting its service providers;

2. Require its service providers by contract to implement appropriate measures designed to meet the objectives of these Guidelines; and

3. Where indicated by the bank’s risk assessment, monitor its service providers to confirm that they have satisfied their obligations as required by paragraph D.2. As part of this monitoring, a bank should review audits, summaries of test results, or other equivalent evaluations of its service providers.

E. Adjust the Program. Each bank shall monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and the bank’s own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.

F. Report to the Board. Each bank shall report to its board or an appropriate committee of the board at least annually. This report should describe the overall status of the information security program and the bank’s compliance with these Guidelines. The reports should discuss material matters related to its program, addressing issues such as: risk assessment; risk management and control decisions; service provider arrangements; results of testing; security breaches or violations and management’s responses; and recommendations for changes in the information security program.

Question 10.6.1 — Yes, That’s It. The GLBA does not go into great detail. It is up to institutions to implement these requirements. This is akin to a controls-based standard. Financial institutions must have controls for this and that (recall the discussion of different standards in Chapter 8), but the firm determines how to create those controls.

Suppose that you wanted to bring an enforcement action against a financial institution for a security problem using this regulation. What kinds of facts would be useful, and what theories are most enforceable?

▄

Question 10.6.2 — The Administrative State. Recall in Chapter 6 the material about conservative legal challenges to the Federal Trade Commission approach and to the administrative regulatory approach generally. At the core of these challenges are two issues: separation of powers (only Congress should legislate) and due process (administrative agency rules are too vague to give notice of what is illegal).

The GLBA standard seems to fit the conservative legal movement’s critique. It is issued by agencies instead of Congress and is a high-level regulation. Do you think GLBA gives “ascertainable certainty” in its requirements?

Imagine if legal challenges succeeded and security rules such as GLBAs were invalidated for both deficiencies in process and for vagueness. Could you imagine what kind of security rule would be written by Congress in response? And, how detailed would it have to be to give businesses “ascertainable certainty” of what the law requires?

The underlying problem is that both the government and businesses probably want a vague rule. Businesses generally do not want highly detailed security rules. They tend to prefer flexibility so they can innovate. Yet, lawyers love high-prescription rules, because these provide certainty. It is easier to give legal advice when there is a “paint by numbers” approach. And some want no rules at all—a kind of libertarian vision where firms compete by adopting whatever approaches their consumers want.

But this discussion ignores the most important point: Of all these approaches, varying from no rules to high-level rules to highly prescriptive rules, what is best for security?

▄

10.7 Publicly Traded Companies and Cybersecurity

Yahoo had a severe data breach in 2014. But when it was negotiating the company’s purchase by Verizon years later, Yahoo falsely claimed it had only suffered a small number of minor breaches. When the large data breach became public, Yahoo had to agree to a 7% discount on its price, a whopping $350,000,000! This was the first time a security breach complicated a major acquisition and it cost Yahoo dearly.

Section 10.6.1 discusses the cybersecurity rules of SEC-regulated businesses like brokers and investment advisors. This section turns to SEC regulation of publicly-traded companies. The key rationale for public company regulation is that investors need high-quality and accurate information about firms before they commit their money to them. A publicly traded company must comply with heightened transparency and accountability standards because investors are considered consumers who can take risks and invest their money in public firms.

Chapter 6 discusses the FTC approach to cybersecurity in detail. Some commentators believe the FTC approach is the most pervasive and consequential regulation of the private sector. However, the SEC rules arguably are stricter than other forms of cybersecurity regulation and breach disclosure. The SEC may ultimately be the most consequential regulator of cybersecurity in America.

The SEC was a bit sleepy on cybersecurity—but if sleepy, it is a sleeping giant. SEC is a giant because so much of American economic activity is based around publicly-traded firms. The most exciting technology companies are publicly traded, and there are about 4,000 additional publicly traded companies that dominate the American and world economy.

If the SEC were to step up enforcement dramatically, the knock-on effects would reach 60–70% of the economy. This is because publicly traded firms would comply with security mandates by in turn requiring their vendors and service providers to meet the same rules. Relatively quickly, any small business that touches a publicly traded one, from the cafeteria in the building to the janitorial services, would have to have security measures in place.

SEC released guidance in October 2011 recognizing that “cyber incidents” were risks to firms that needed to be accounted for and disclosed to investors.²⁹ At first, the SEC seemed to focus on computer-crime-like cybersecurity problems. The agency was concerned about insiders using computers to make favorable trades. Such cheating is noisome and costly, but not a strategic risk because, after all, if the fraudster steals too much, the favorable trades will be detected. Thus, there is no generalized threat to the financial system itself.

Cybersecurity as a systemic risk became palpable after the Sony Pictures hack. Sony showed that cybersecurity was bigger than insider trading: attacks might destroy a public company entirely. For the SEC itself, a 2016 intrusion into the agency’s EDGAR database seemed to be a turning point. By 2017, the agency started making public announcements about enforcement. In 2018, the first cases were charged, with initial penalties levied in June 2021. The SEC proposed updates to its cybersecurity rules in 2022.

The SEC relies upon its organic statute, the Securities Exchange Act of 1934, to justify its cybersecurity rules.³⁰ The SEC’s security recommendations and risk alerts come from the Office of Compliance Inspections and Examination (OCIE).

10.7.1 Material Risks and Incidents

The SEC requires publicly-traded firm to disclose material risks, events, and incidents. Material means any information that investors think is important.³¹ Would a reasonable investor make a decision to buy or sell your stock if apprised of the risk or incident? If yes, the risk or incident is material. The SEC has not issued specific guidance about costs or thresholds of expense to define materiality.

Firms operating in this environment are presented with a bind: If they hide weaknesses from investors, investors may be able to sue for lack of disclosures and the SEC will fine them. If firms fully disclose, liability may be avoided, and yet, investors might choose not to invest. The tension should result in the best-case outcome: companies try their hardest to be excellent while disclosing their imperfections.

Returning to the SEC approach, the agency requires notice of material risks, events, and incidents. Not only are risks the routine problems that can emerge from running a business, but firms must also disclose special risks that come from certain activities.

Incidents are routine problems—security challenges that happen all the time. Most are not material in reality. But herein lies a tension: if one runs a billion-dollar firm, at what point does an incident become material? Even an incident that causes tens of millions of dollars and ruins lives might not be material to an investor.

The SEC notice requirements may be broader than ordinary consumer law because material risks and incidents may have nothing to do with personal information. For instance, a loss of trade secrets could be a security incident that does not require notice to consumers (through state security breach notification law) but does require notification to investors (through the SEC). Thus, between the concept of materiality and the notion that material risks could be nonpersonal-information risks, the SEC notification regime could be much broader than ordinary consumer protection law.

Question 10.7.1 — The Investor View—What Really Is Material? Imagine you are considering investing in Apple. Suppose the company had a breach exposing the data of 100,000 users. Might that change how much or whether you invested, making the event “material?” Suppose it was 1,000,000? 10,000,000? 100,000,000? What’s worse—these personal data breaches or a situation where an employee stole the top secret design for new augmented reality glasses and sold it to a foreign competitor?

▄

Risks must be disclosed in a filing to the SEC. Firms will want to bury these disclosures in their annual report, the 10–K. These reports have so many disclosures that it’s like a listicle rather than a warning. Most readers will just skim and move on. From a firm perspective, it is more risky to put disclosures in a quarterly report (10–Q), and the worst case scenario is releasing a “current report,” an 8–K. The use of a current report signals a “major event” has occurred, so bad the firm needs to tell investors right away.

10.7.2 SEC Enforcement

The Office of Compliance Inspections and Examination guidance on cybersecurity is similar to recommendations made by other agencies. But SEC is creating new responsibilities for truthfulness with its enforcement. As a result, the SEC may become the most consequential regulator of cybersecurity, surpassing the FTC’s work. The kind of cheap talk and weasel-wording that appears in privacy policies can trigger liability under the SEC regime. Consider these cases:

This section opened with the example of Yahoo’s security breach. The SEC fined Yahoo $35 million for not disclosing it because Yahoo’s SEC filings discussed “risk of potential future data breaches” without “disclosing that a massive data breach had in fact already occurred.” The FTC has never punished a company for such a half-truth. But, in filings to the SEC, companies cannot tell half-truths like Yahoo did.

Facebook’s SEC disclosures warned that its users’ data may be improperly accessed or disclosed. The problem for Facebook was that those data were improperly used—by Cambridge Analytica, the company used to target Americans with personality quizzes in an attempt to influence voting. Facebook agreed to a $100-million SEC fine for characterizing the risk of misuse of data as hypothetical.

A 2021 settlement with UK-based Pearson PLC is notable because the company stood accused of losing data normally not protected by security breach notification laws—usernames and hashed passwords were stolen (state laws do not require notice when data are encrypted). The SEC quoted Pearson’s media statement, which claimed “Protecting our customers’ information is of critical importance to us. We have strict data protections in place…” Normally regulators see claims like “your privacy is important” as “cheap talk,” a kind of hyperbole that investors and consumers do not take seriously and therefore does not create liability. But in this case, Pearson’s claims of importance and strict protections were invoked alongside the reality that “Pearson failed to patch for six months after it was notified” and that “Pearson was using a hashing algorithm for password storage that had become outdated.”

Question 10.7.2 — SEC Cyber Enforcement. Please visit the SEC’s Cyber Enforcement Actions website and get a feel for the kinds of cases the SEC is bringing. As of this writing, the url is https://www.sec.gov/spotlight/cybersecurity-enforcement-actions

▄

Taken together, what does this mean for you as a cybersecurity professional at a publicly traded company? First, you need to know that disclosures to the SEC have to be truthful in all material ways. Telling the good half of the security story is misleading if doing so in effect covers up the bad half. The so-called cheap talk that is often in privacy policies (“your privacy and security are important to us…”) might be invoked by the regulator if the company does not actually implement responsible practices. Second, monitor the OCIE for guidance and alert advisories. Third, be sure to monitor close competitors carefully—read their SEC disclosures and any news about their security problems. If a close competitor has a security problem, chances are your firm has the same problem. Finally, err on the side of disclosure. One is always better off telling the full story rather than getting caught telling half the truth. And anyway, investors tend to ignore the bad news on security! Chances are the truthful disclosures you make will not stop investors from buying shares of your company.

Exercise 10.3 — SEC Disclosures. EDGAR, the SEC database for publicly traded company filings, has a fantastic amount of information about companies. Please visit it (https://www.sec.gov/edgar/search/) and do some searches for cybersecurity disclosures.

Recall that companies’ cybersecurity risk disclosures are likely to be found in three kinds of filings, the annual 10-K, the quarterly 10–Q, and the “current report,” the 8–K. Remember that current reports typically disclose a surprise, a major event that the company thinks it must tell investors about immediately.

Here are some suggested searches: 1) Have any companies filed an 8–K about a “cybersecurity incident” (advanced search will let you search only on the 8–K). 2) Turning to routine disclosures, look for a 10–K of a company of interest to you. How does that company disclose its routine cybersecurity risks? Do you see any special risks disclosed?

For a large-scale study of cybersecurity disclosures in EDGAR, see Kesari A. Predicting cybersecurity incidents with machine learning and mandatory disclosure regulation. Journal of Law, Technology & Policy 2022.

▄

10.7.3 The Board of Directors

Cybersecurity is now a board-level concern. This means that you might be called upon to brief the board of directors! This task is as exciting as it is stressful. The directors are the true bosses of a company; they tend to be seasoned business leaders who are powerful. Thus, a board presentation is a fantastic opportunity to demonstrate your skill, and who knows—maybe the board will start to look at you as a potential executive!

How did cybersecurity become a board-level concern? Recall earlier mention of the New York State Department of Financial Services’ cybersecurity regulations from 2017. Those regulations imposed a brilliant, dramatic requirement on regulated firms: the board of directors had to sign a certificate of compliance. This kind of responsibility strikes terror into an organization—executives and directors alike do not want to put their name on a filing that goes to a regulatory agency. Other regulators picked up the idea; most importantly, the Security and Exchange Commission (Figure 10.6).

Because of all the embarrassing security breaches, the SEC and other regulators have elevated cybersecurity to a board-of-directors-level concern. Cybersecurity’s elevation means it is no longer just an operational detail: cybersecurity can be a strategic risk.

Understanding the mind of the director is the most important aspect of briefing the board. Board members struggle with cybersecurity governance. Directors tend to be older men, often successful business people with skillsets in other areas than technology. Thus, as intimidating as board members are, their internal narrative might reflect some impostor syndrome. Board members might be pretending to know the cybersecurity story.

In briefing a board, one has to carefully tune the message. Too much detail is inappropriate; highly technical presentations may stupefy board members. Polished, fancy presentations, on the other hand, may snow board members with flashy nonsense, or worse, tell the board what it wants to hear rather than what it needs to hear.

Figure 10.6 This is the certificate that New York regulators created to certify compliance with its cybersecurity regime. Imagine the reasons why a board member would be reluctant to sign this form. If you had to get a sign-off on this form, what kind of questions should you anticipate from the board? What work do you need to do to satisfy their concerns?

To help board members develop more expertise in cybersecurity, in 2018, the United Kingdom’s National Cyber Security Center (NCSC) released five high-level questions for board members to ask:

How do we defend our organisation against phishing attacks?

What do we do to control the use of our privileged IT accounts?

How do we ensure that our software and devices are up to date?

How do we ensure our partners and suppliers protect the information we share with them?

What authentication methods are used to control access to systems and data?

Question 10.7.3 — Surprised? These questions are both basic and too general to be answered during a presentation. Their lack of sophistication reflects the general state of unpreparedness in cybersecurity. None of these questions is at the strategic level—they are all operational concerns, the stuff of middle management.

What do you think the strategic-level inquiries are? If you were to redraft the NCSC questions, what would you cover?

▄

The NCSC’s questions mirror the failures that regulators see in so many organizations: phishing, the problem of over-privileged access control, lack of patching, vendors with inadequate security, and the need for two-factor, multifactor, or similar authentication systems. Practically speaking, the NCSC is guiding board members to ask about the very problems the FTC and so many other regulators have cajoled over for years. In other words, the bar is still pretty low. The questions do not reflect higher-level strategy issues, or even threat actor considerations.

Board members have a legal duty to protect the business. Security failures can result in shareholder derivative lawsuits against the company. These are suits where investors attempt to sue directors on behalf of the company for violating their duties and causing harm to the business.

It is your job as security counselor to help board members meet their duty to protect the company. Board members do this by satisfying the “business judgment rule,” a legal standard that reflects that the board has acted reasonably. This is not a high bar, but it is an important one. To help the board meet the business judgment rule, you must act like a doctor or lawyer: you should tell the board what they need to know in an objective fashion. You should inform the board of all relevant information. Do not hide unfortunate facts. If the board is asking bad questions or seems confused, you should help the board make reasonable inquiries—that is, help them ask the questions a reasonably informed board member should ask.

There may be situations where boards should create a special committee to address complex risks. That subcommittee might include an outside expert on security to help the firm. Or, a board might even bring on a director with expertise in security.

Don’t take board decisions personally. The board is responsible for the strategic direction of a company, and, in many cases, this means other operational concerns may override security investments. Remember that businesses deal with some risk by just accepting it. The board is free to not follow your advice, even if this results in a grave incident. But a board that takes in information and advice and considers it fairly—even if the board ultimately rejects the advice—likely complies with the business judgment rule.

Shareholder derivative suits will fail if the board acts reasonably. Courts afford broad discretion to directors. Generally speaking, plaintiffs have to show fraud, bad faith, or fundamentally flawed judgment. Thus, there must be more than a bad outcome. There has to be a bad outcome from bad director behavior.

One of the main ways boards “act reasonably” is by insuring against cybersecurity risks. Section 10.8 discusses the cybersecurity insurance system, its challenges, and how to buy cybersecurity insurance.

Automated Trading Regulations

The SEC has long had to address Artificial Intelligence (AI)/Machine Learning (ML) decision-making because investment houses started experimenting with automaticity years ago. The SEC’s approach might be applied to cybersecurity, where automatic decision-making has to be used because of the volume of attacks involved.

The SEC’s 2010 Market Asset Rule imposes a series of controls to avert disaster in automated trading.a The rules themselves are high-level, but an enforcement action demonstrates their application and how sophisticated investigators had to be to bring it:

According to the SEC’s order, Knight Capital made two critical technology missteps that led to the trading incident on Aug. 1, 2012. Knight Capital moved a section of computer code in 2005 to an earlier point in the code sequence in an automated equity router, rendering a function of the router defective. Although this function was not meant to be used, Knight left it in the router. In late July 2012, when preparing for participation in the NYSE’s new Retail Liquidity Program, Knight Capital incorrectly deployed new code in the same router. As a result, certain orders eligible for the NYSE’s program triggered the defective function in Knight Capital’s router, which was then unable to recognize when orders had been filled. During the first 45 minutes after the market opened on August 1, Knight Capital’s router rapidly sent more than 4 million orders into the market when attempting to fill just 212 customer orders. Knight Capital traded more than 397 million shares, acquired several billion dollars in unwanted positions, and eventually suffered a loss of more than $460 million.b

a 17 CFR §240.15c3-5, Risk management controls for brokers or dealers with market access, 2010

b From the press release accompanying In the Matter of Knight Capital Americas LLC, No. 3-15570, Oct. 16, 2013.

10.8 Cybersecurity Insurance

Insurance would seem to be a promising way to “regulate” cybersecurity in the private sector.³² Insurance companies probably know more about cybersecurity risks than any other actor in the ecosystem: insurance companies collect data on companies’ practices before selling policies, they collect data on claims, and they investigate claims, which involves diagnosing exactly what happened in a breach. Insurance companies can in effect regulate companies by denying them insurance, by requiring preventative measures, or by simply charging high rates for disfavored practices.

Nowadays, there are many options for cybersecurity insurance. The cybersecurity insurance market is maturing and quickly evolving. The industry sees huge revenue opportunities from cyber—any business that touches the Internet is a potential buyer.

Some early strategic decisions by the insurance industry created the marketplace for special cyber offerings. All companies carry some kind of general insurance. But insurance companies acted early to exclude and deny cybersecurity claims against general insurance policies. If insurance companies had not done this, there would be a much smaller market for new insurance products!

Insurance companies were able to win cases where companies sought recovery from their general business insurance for cyber losses. The insurance industry countered claims by stating that coverage only applied to victims’ physical stores, while Internet attacks happened “off premises,” caused damages that were not physical, with no bodily injury. Another clever argument blunted losses from phishing: insurers denied claims for phishing arguing the victims failed to follow proper procedures. In insurers’ eyes, being a victim of phishing was a “controls problem,” and so, the victim was at fault. The result of these strategies was that businesses could not rely on their general policies and had to go get new cybersecurity insurance policies at additional cost.

10.8.1 Insurer Challenges

Cybersecurity insurance is a relatively new innovation and insurance companies are still getting their footing in the marketplace. They face evolving challenges: First, writing policies is quite difficult.³³ How should an insurer price a policy? How can an insurer know what a company’s practices really are? Some insurance companies have lost money in cyber because of large client losses.

Second, when there is an incident, attribution and investigation present yet more challenges. How exactly will the parties settle on the “root cause” of the breach? (As you know, many wrongs involve complex conditions, victims who somehow contribute to the injury, and multiple parties.) With how much precision do root causes need to be diagnosed?

Third, cybersecurity may be too big to insure. A cyber accident that affects critical infrastructure might cause billions in foreseeable losses. And the most consequential cyber incidents may not be covered at all: an insurer is not going to compensate a victim for a nation-state hack or anything that resembles a “use of force.”

10.8.2 Buying Insurance

As a consumer of cyber insurance, you can take steps to protect your company:

Insurance brokers A company should use a broker to find an insurance policy and determine how much insurance to buy.

You must read the policy You can’t just rely on a salesperson. You must check the broker’s work. Carefully read the policy—the written policy, not how the broker describes it, determines the coverage. Buying cyber insurance is not a consumer transaction; your company doesn’t get consumer protections. It has to watch out for itself.

What are your coverage priorities? Thinking about the size of your business and cash flow, what will you need money for? Considerations include: regulatory fines, lawyers, forensics investigations, harm to reputation, business continuity interruption, IP loss, the cost of paying a ransom and the negotiators, credit monitoring fees, and third-party losses (think credit card fees).

Named peril Cyberinsurance policies are “named-peril” documents, meaning that you must enumerate the risks you want to cover. For instance, if you do not list phishing or denial-of-service explicitly, an insurance company might refuse to pay. Think broadly about what could go wrong, including non-security breach events, for instance, if IT screws up and causes a business interruption, or if a cloud provider has an outage.

Completing the application Someone at the company will have to fill out a detailed survey about the company’s security practices. If this survey asks binary questions that cannot be answered with a simple yes or no, attach a rider with a prose explanation of the practices. If there are errors on your company’s application and the insurer discovers the errors after a claim, the insurer might rescind the policy, and this move will make it very difficult to get a new insurer in the future (because new insurers will ask whether the company has ever had a policy rescinded).

Who decides? Insurance policies often specify who gets to decide whether to litigate against whomever caused the losses. You might prefer to just get paid and have it over with. Conversely, if your client is reputation sensitive, the client may want to litigate to prove something to others. Insurance companies have a panel of law firms they refer matters out to. Your company may prefer a certain law firm.

Quickly notify when an incident occurs Companies tend to want to do an internal investigation before going to their insurer. This is a risky move—delay makes it more difficult for the insurance company to do forensics, and insurance companies may deny payment for failure to promptly notify them of an incident.

The status quo The typical policy returns the company to the status quo when the company bought the policy—policies do not provide for “betterment,” improvements to IT after the policy was issued. Consider whether a policy your company purchases in year zero will fully compensate for an incident in, let’s say, year four.

Ransoms Some insurance companies will negotiate with extortionists and even pay ransoms! Attackers know companies have insurance, and key their ransom requests to coverage levels.

10.9 Conclusion

Cybersecurity touches companies in myriad ways. This chapter gives an overview of the most pressing problems: security breaches, SEC regulation, domain-specific cyber rules like Gramm–Leach–Bliley, board of directors concerns, and the usefulness of insurance as cyber regulators. The most important point to remember surrounds risk: information security incidents are just another category of risk faced by firms, which apply risk logic, not rights logic, to information assets like personal information.

Notes

1 Schneier B. Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World. 1st ed. New York, NY: W.W. Norton & Company, 2015.

2 Rumsfeld DH. DoD News Briefing - Secretary Rumsfeld and Gen. Myers, 2002 Feb.

3 Gordon LA and Loeb MP. The economics of information security investment. ACM Transactions on Information and System Security 2002 Nov; 5:438–57.

4 Bojanc R and Jerman-Blažič B. An economic modelling approach to information security risk management. International Journal of Information Management 2008; 28:413–22.

5 Janofsky A. When Paying a Ransom Is the Best Way Out. Wall Street Journal, 2019 Jun. (Suggesting that institutions should pay when restoring backups will cost less than the ransom, when lives are at stake, and where insurance will cover the ransom. Another reason to pay is that the act of payment itself may identify the attacker. Cryptocurrencies are not anonymous and specialty cybersecurity firms have had great success in linking them to people.)

6 Companies knew about politically motivated, destructive hacks before, but they were aimed at political business leaders. For instance, Sheldon Adelson’s (1933–2021) Las Vegas Sands Corporation fell victim to a large, sophisticated, and destructive attack led by Iranian hackers. But Adelson’s case was seen as an anomaly—Adelson (a politically powerful billionaire) had advocated the detonation of a nuclear bomb in a desert outside Tehran to intimidate Iranian leaders. Most company leaders do not participate in such explicit saber-rattling.

7 A detailed account of the attack is included in the complaint against a suspected Sony Pictures hacker, see United States v. Park Jin Hyok, 18-1479 (C.D. Cal. 2018), available at https://perma.cc/62V3-QDEY.

8 National Academies of Sciences. At the Nexus of Cybersecurity and Public Policy. United States of America: National Academies of Sciences, 2014.

9 Safire W. The Farewell Dossier. New York Times, 2004 Feb.

10 Robertson J and Riley M. The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies. Bloomberg News, 2018 Oct.

11 Metzler J. Security Implications of 5G Networks. UC Berkeley Center for Long-term Cybersecurity, 2020.

12 Zimmerman EJ. The Foreign Risk Review Modernization Act: how CFIUS became a Tech Office. Berkeley Technology Law Journal 2020; 34.

13 Created by EO 11858 and with Congressional empowerment in 45 USC §4565.

14 See generally, Regulations Pertaining to Mergers, Acquisitions, and Takeovers by Foreign Persons, 31 C.F.R. §800.

15 See 31 CFR §800.241.

16 An appeals court eventually overturned the conviction; none of the three executives was ever incarcerated. Pfanner E. Italian appeals court acquits 3 Google executives in privacy case. The New York Times, 2012.

17 Korzak E. Export controls: The Wassenaar experience and its lessons for international regulation of cyber tools. Routledge Handbook of International Cybersecurity. Routledge, 2020: 297–311, Wassenaar Arrangement. Statement issued by the plenary chair on 2019 Outcomes of the Wassenaar Arrangement on export controls for conventional arms and dual-use goods and technologies. Vienna, 5 December 2019.

18 Mitnick KD and Simon WL. The Art of Deception: Controlling the Human Element of Security. Indianapolis, Indiana: Wiley Publishing, Inc., 2002.

19 According to an annual survey by security expert Larry Ponemon, the average institution discovers a breach over nine months after the initial incident.

20 Shostack A and Stewart A. The New School of Information Security. Pearson Education, 2008.

21 Garfinkel SL and Theofanos M. Non-breach privacy events. Technology Science, 2018.

22 When a financial institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused. If the institution determines that misuse of its information about a customer has occurred or is reasonably possible, it should notify the affected customer as soon as possible…

23 Romanosky S and Herr T. Understanding Cyber Crime. Cyber Insecurity. Edited by Harrison RM and Herr T. Roman and Littlefield, 2016.

24 Denning DE and Strawser BJ. Active cyber defense: Applying air defense to the cyber domain. Understanding Cyber Conflict: 14 Analogies. Edited by Perkovich G and Levite AE, 2017.

25 Egloff F. Cybersecurity and the age of privateering. Understanding cyber conflict. Fourteen analogies. Edited by Perkovich G and Levite AE. 2017:231–47.

26 Blair DC, Chertoff M, Cilluffo FJ, and O’Connor N. Into the Gray Zone: The Private Sector and Active Defense against Cyber Threats. Technical report. Center for Cyber and Homeland Security, 2016. Available from: https://perma.cc/5RWZ-D39P.

27 Blair DC, Chertoff M, Cilluffo FJ, and O’Connor N. Into the Gray Zone: The Private Sector and Active Defense against Cyber Threats.

28 Appearing in Appendix D-2 to 12 CFR Part 208.

29 CF Disclosure Guidance: Topic No. 2, Oct. 13, 2011, archived here (https://perma.cc/UYX7-VT9L).

30 Sections 7 and 19(a) of the Securities Act and Sections 3(b), 12, 13, 14, 15, and 23(a) of the Exchange Act.

31 Information is considered material if there is a substantial likelihood that a reasonable investor would consider it important in making an investment decision or if the information would significantly alter the total mix of information made available.

32 Wolff J. Cyberinsurance Policy: Rethinking Risk in an Age of Ransomware, Computer Fraud, Data Breaches, and Cyberattacks. MIT Press, 2022.

33 Romanosky S, Ablon L, Kuehn A, and Jones T. Content analysis of cyber insurance policies: How do carriers price cyber risk? Journal of Cybersecurity 2019; 5.

IV
Cybersecurity and the Future

11 Cybersecurity Tussles

11.1 A Public Policy Analysis Method

11.2 Software Liability: Should Developers Be Legally Liable for Security Mistakes?

11.3 Technical Computer Security Versus Cybersecurity Revisited

11.4 Encryption and Exceptional Access

11.5 Disinformation Revisited

11.6 Conclusion

12 Cybersecurity Futures

12.1 Scenarios Methods

12.2 Even More Sophisticated Cyberattacks

12.3 Quantum Computing

12.4 Automaticity and Autonomy: Artificial Intelligence and Machine Learning

12.5 The Data Trade and Security

12.6 The Sovereign Internet

12.7 Outer Space Cyber

12.8 Classification Declassed

12.9 Attribution Perfected or Not

12.10 Conclusion

11.
Cybersecurity Tussles

Chapter image: The Siren, Louis Loeb (1904).

Source: Smithsonian American Art Museum/Wikimedia Commons/Public domain.

Chapter Learning Goals

Learn methods of public policy analysis.

Apply public policy methods to one or more of the most intractable debates in cybersecurity.

We have now worked through what cybersecurity is, some of the technical background underlying it, the social forces shaping it, the different theoretical frameworks used to understand it, and the many forms of law that have come to constitute cybersecurity law. In this chapter, we turn to key disputes tethered to the future of cybersecurity and the Internet. Each dispute could be the topic of student projects or class discussion.

Internet wizard David Clark has termed Internet policy disputes “tussles” because these are hard contests. Tussles involve multiple actors, the uncertainty surrounding new technologies, economic characteristics such as lock-in, and the reality that technology disputes often reflect disagreements about underlying values and visions.

This chapter briefly presents some of the core tussles with security effects. As you read this chapter, reflect on the profound changes shaping our society in the last 20 years. We start with a policy analysis method that can guide your thinking.

11.1 A Public Policy Analysis Method

To structure class projects or discussion surrounding policy conflicts, we present a method that anyone can use to deeply engage. Eugene Bardach, a legend at Berkeley’s public policy school, developed a widely used method for policy analysis. Known as the Eightfold Path,¹ Bardach recommends the following process:

Define the problem Describe the policy problem in a compelling way. In this chapter, we outline important cybersecurity tussles that you can research more deeply.

Assemble some evidence Gather data about the problem. In cybersecurity, that data might be publicly available news articles, company reports, or academic publications.

Construct the alternatives Identify realistic policy solutions that policymakers might consider. Explain how these alternatives would work. Remember, keeping the status quo is an option.

Select the criteria What basis will you use to judge the alternatives? Common ones might include efficacy, efficiency, ease of implementation, clarity, equity, individual freedom, and collective safety.

Project the outcomes Judge the alternatives based on the criteria. You might use a table to compare them.

Confront the trade-offs Compare and contrast the pros and cons of each alternative. Some factors: how effective will each alternative be? How much cost does it impose? Who wins or loses under each alternative?

Decide Take a policy decision.

Tell your story Find a way to explain the process you engaged in, why the policy problem was complex and important, and how you ultimately decided what to do.

There are additional methods to decompose public policy issues and get traction on them. Some additional strategies include:

Use theory In constructing the alternatives, it makes sense to identify the theory that motivates each alternative. For instance, deterrence theory might advance some alternatives, while a public health approach might emphasize other approaches.

Think about alliances Can you imagine how different factions in the tussle may have alignment on other issues? Could those other issues offer opportunities for compromise on the principle in issue?

Question assumptions Is the nature of the tussle based on opposing factions’ assumptions? What are those assumptions? Can you identify those assumptions and are they weak or strong assumptions—that is, are they assumptions that are insoluble or assumptions that might change? Or are the assumptions just wrong?²

Question power Are there power structures dictating certain options or outcomes? Could you imagine those power structures changing or losing power, thus opening up a broader set of possibilities?

You might not have time to implement all of Bardach’s steps and our additional suggestions. Students typically spend an entire semester learning and then applying this method. But, we think you can use Bardach’s approach as a structure for improving your policy analysis.

Here’s a key hint and challenge: policy analysis is not just advocacy, or a gut reaction to a problem. Policy analysis requires dispassionate reasoning.

Policy analysis might require you to make a decision that is morally distasteful but solves a problem pragmatically. You will know you are on the right track if you seriously engage with alternatives and counterarguments to your ideas. Skipping over counterarguments is a sure sign of a weak analysis.

The policy analysis method gives one many tools to critique other policy. For instance, in the selection of criteria to judge alternatives, one might disagree on what criteria are important. For instance, a company might discount concerns over equity in favor of efficiency, while a different institution, like a school, might value equity the most. Precisely identifying factors such as selection criteria helps us understand when others come to a different policy conclusion.³

Now that we have suggested a method for analyzing cybersecurity policy tussles, consider the following issues.

11.2 Software Liability: Should Developers Be Legally Liable for Security Mistakes?

Considered a “third rail” of computing politics, the issue of software liability—that is, legal liability for deploying insecure products and services—surfaced again in President Biden’s 2023 National Cybersecurity Strategy:

Markets impose inadequate costs on—and often reward—those entities that introduce vulnerable products or services into our digital ecosystem. Too many vendors ignore best practices for secure development, ship products with insecure default configurations or known vulnerabilities, and integrate third-party software that is poorly tested or of unknown provenance. Software makers are able to leverage their market position to fully disclaim liability by contract, further reducing their incentive to follow secure-by-design principles or perform pre-release testing. Poor software security greatly increases systemic risk across the digital ecosystem and leaves American citizens bearing the ultimate cost.

We must begin to shift liability onto those entities that fail to take reasonable precautions to secure their software while recognizing that even the most advanced software security programs cannot prevent all vulnerabilities. Companies that make software must have the freedom to innovate, but they must also be held liable when they fail to live up to the duty of care they owe consumers, businesses, or critical infrastructure providers. Responsibility must be placed on the stakeholders most capable of taking action to prevent bad outcomes, not on the end-users that often bear the consequences of insecure software nor on the open-source developer of a component that is integrated into a commercial product. Doing so will drive the market to produce safer products and services while preserving innovation and the ability of startups and other small- and medium-sized businesses to compete against market leaders.

The Administration will work with Congress and the private sector to develop legislation establishing liability for software products and services. Any such legislation should prevent manufacturers and software publishers with market power from fully disclaiming liability by contract, and establish higher standards of care for software in specific high-risk scenarios. To begin to shape standards of care for secure software development, the Administration will drive the development of an adaptable safe harbor framework to shield from liability companies that securely develop and maintain their software products and services. This safe harbor will draw from current best practices for secure software development, such as the NIST Secure Software Development Framework. It also must evolve over time, incorporating new tools for secure software development, software transparency, and vulnerability discovery… .⁴

To be clear, the policy goal of this proposal is to increase the security of software and software-embedded devices. The instrument to that goal is increasing legal liability for security problems in software products and services.

Consumers cannot practically sue when a software security problem causes some kinds of damages like lost files and stolen data. Software companies have relied on every legal tool possible to avoid lawsuits for security problems and bugs:

Developers disclaim all liability in contracts.

Developers cap their liability for damages in contracts.

Developers require users to agree to arbitration in contracts.

Developers require users to agree to a defense-friendly legal jurisdiction in contracts.

Developers require users to agree to waive warranty lawsuits—that is, the user cannot sue to enforce whatever promises (warranties) the developer makes.

Developers frame software as a service rather than a product; this means product liability rules—which are quite strong and pro-consumer—do not apply.

A number of commentators have developed responses to these legal limitations. Michael Rustad offers a history of reforms and some creative ideas.

First, because contract law barriers feature so prominently in software developers’ strategy, one approach might be to limit the ability of parties to eliminate rights by contract. US law does this in several ways in other areas of law. For instance, US law prohibits the sale of human organs, in effect prohibiting a marketplace that might otherwise exist. The law allows other markets to operate, but limits how they operate. For instance, doctors cannot enforce a contract that requires the patient to assume the risk of medical mistakes.

Rustad observes that some states, such as Massachusetts, forbid companies from denying warranties (i.e., promises) in contracts with consumers. Presumably, under the Massachusetts approach, the user could sue the software developer for whatever promises it made about the quality and security of the software. The user could also sue if the software simply did not do what it was sold to do.

A second approach Rustad identifies comes in how we think of software: Is software a service or is it a product? The difference matters because there is more consumer protection for products than for services. Services, historically, have been considered more bespoke and difficult to judge on the basis of quality. Products tend to be more homogenized, and because products are physical, they can create physical injury to people. The United States has a “products liability” regime, meaning products that are “unreasonably dangerous” or defective may be subject to extensive forms of liability.

Not all dangerous products are liable, just those that are unreasonably so—after all, some products (e.g., chef’s knives) are irreducibly dangerous and there’s no reasonable way to make them safer without eliminating their utility. Presumably, unreasonably dangerous software would be programs that could have been written differently so they would be safer, while not imposing too much of a burden on the developer or the user. That is, the consumer would have to argue that some alternative design was available to the developer, and the developer acted unreasonably by not choosing it. The developer could in turn argue the alternative design was not feasible, too uneconomical, or even an approach that consumers would not want.

Again, product liability would come in two flavors: The first, described above, is where the software developer could have designed the software differently but chose not to.

The second concerns defects in design. In this second category, developers would be liable not for their design decisions, but for implementation errors. To make a product analogy, suppose a manufacturer designed a perfectly safe kitchen blender, but because of confusion on the production line, a single blender was assembled incorrectly, and that error caused someone to be harmed. This is the concept of a product “defect,” a properly designed product that nonetheless became dangerous for some production reason.

Turning to software, we might imagine a software defect as a well-developed program that contained an inadvertent error. Suppose that in a sophisticated software package, everything worked well, but an engineer inadvertently included an outdated library for the software’s encryption.

Defects concern properly designed software that for some reason was implemented incorrectly. Imagine software that was perfectly developed but, let’s say, was updated. In the update, the software’s encryption was improperly implemented by accident. This would be a security “defect,” a kind of unintentional error causing the software to deviate from its normal intended operation.

Notice how the Biden administration’s plan makes two large exceptions: for developers of open-source software and for users. The Biden administration’s proposal focuses on those “best placed” to ensure security, suggesting it is large software companies and the final integrator of components into completed products and services.

Here are some prompts to guide discussion on software liability:

What kind of security shortcomings should software developers be liable for?

What is the likely benefit of imposing liability on software developers?

What are the downsides of liability?

What knock-on effects (complex effects that emerge from the imposition of liability) are likely to emerge? For instance, is liability likely to intensify “winner take all” dynamics in software, or are developers fearing liability likely to want to work for larger software companies?

Are there clear “safe harbors,” activities that should never be subject to liability?

What opportunities for opportunism or guile might emerge for a liability system?

11.3 Technical Computer Security Versus Cybersecurity Revisited

This book began with a discussion of Helen Nissenbaum’s warning about the risk of securitization in cybersecurity. That is, the embrace of “cybersecurity” as a collective priority, and the attendant risks to civil liberties and democratic processes that could result when such a broad and undefined interest becomes valorized with the label “security.” Nissenbaum warned that the moral justification for security could fray as cybersecurity took on social issues. One social issue highlighted was disinformation. In China and Russia, as we saw in Chapter 1, cybersecurity concerns include the minds of citizens, meaning ordinary political critique and news reporting are formal security matters policed by the state.

We speculated that securitization could occur in nations such as America. Securitization could be a rational approach when other attempts to create security in cyberspace could not be tried or systematically failed. As individuals become frustrated with online crime, harassment, and poisonous speech, they may take up a security lens to manage the Internet’s warts.

Now, that you have learned a great deal about alternatives, ranging from reinvigorated criminal law to consumer regulation approaches, we invite you to reconsider Nissenbaum’s warning about securitization. We suggest several alternative frameworks below that might manage concerns about information quality. As you revisit these alternatives below, consider whether their implementation is realistic.

11.3.1 The Criminal Law Alternative

A renewed commitment to applying the criminal law to cybersecurity threats is an alternative approach to securitization of information. Recall from Chapter 7 that we have rudimentary computer crime laws based on 1980s assumptions of computing and a law enforcement establishment generally unprepared to generate deterrent pressure on criminals.

Remember the challenges faced by law enforcement in deterring cybercrime: the false belief that suspects cannot be identified online, a lack of law enforcement expertise and training, jurisdictional confusion, and incentives that favor attention toward “local” and violent crimes.

Attribution is the typical reason why law enforcement does not pursue charges in computer attack cases. But, the attribution problem has been significantly eroded, with intelligence agencies and even private companies in possession of data that reveals the identity of individual attackers. Identity is so hard-baked into mobile phones that the industry association representing mobile advertisers has declared that targeting is completely personally identifiable—meaning every website visited with a mobile device may know the true identity of the user.

Since the Obama administration, the US government has regularly made attributions and has even indicted and arrested individuals implicated in consequential hacks. These indictments were ridiculed by some at first—why would indicting a hacker in China or Romania have any deterrent value? The wisdom of the approach was soon demonstrated. A hacker can live well in Eastern Europe, but with travel restricted, would be unable to attend a conference in the United States, visit the islands of Greece on vacation, or attend a concert in London. The urge or need to travel has netted arrests in several high-profile cases, even those what would seem to be core to an adversary’s intelligence activities. For instance, in 2017, a Chinese national was arrested while traveling for business purposes to Los Angeles. Yu Pingan had allegedly provided malware used in the Office of Personnel Management (OPM) and other national-security-relevant hacks. He pleaded guilty, served time in a US federal prison, and then returned to China.

Here are some questions to consider:

What deterrence by punishment, denial, and cost impositions are possible using a criminal law approach?

What problems might criminal approaches solve?

What gaps might it leave?

How will we have to reconceptualize cybersecurity to pursue a criminal law approach?

What institutions will have to be built or adapted to rise to the challenge?

What laws would have to change?

What are the downsides of this approach?

Who wins and who loses?

11.3.2 The Consumer Law Approach

In recent years, the U.S. government has employed heavy-handed tactics to limit the security risks in Chinese-made consumer and network hardware. The U.S. government has also limited foreign investment in American firms that handle personal information.

The government interventions appeared to be so opportunistic that trade wars were threatened. What if years before the situation escalated, governments used consumer law standards to police these devices? For instance, what if the Federal Trade Commission (FTC) had found that Huawei or ZTE handsets were so insecure as to create privacy and security risks considered unfair or deceptive?

Consumer law could create a floor of country-neutral, technology-neutral standards for security. Imagine a new government approach where aggressive consumer protection demands raised the expectations of consumers to see the security of products and services on a par with safety.

What problems might a consumer law approach solve?

What gaps might it leave?

How will we have to reconceptualize cybersecurity to pursue a consumer law approach?

What institutions will have to be built or adapted to rise to the challenge?

What laws would have to change?

What are the downsides of this approach?

Who wins, and who loses?

11.3.3 The Industrial Policy Approach

“Basic research leads to new knowledge. It provides scientific capital. It creates the fund from which the practical applications of knowledge must be drawn. New products and new processes do not appear full-grown. They are founded on new principles and new conceptions, which in turn are painstakingly developed by research in the purest realms of science.” — Vannevar Bush⁵.

The United States has generously funded research and development sparking wondrous innovations. As Mariana Mazzucato showed, the seminal, compelling innovation of the twenty-first century, the Apple iPod and subsequent devices, was itself a synthesis of research funded by the Department of Defense, much of which was in basic research explorations.⁶ Even voice assistant Siri was a DARPA-funded invention of SRI International that was later acquired by Apple under Steve Jobs.

The Cold War and the Space Race gave birth to numerous consumer goods. In recent years, US research and development has continued to grow and the most recent figure pegs it at $580 billion annually. The Department of Defense’s annual Research, Development, Test and Evaluation (RDT&E) budget now exceeds $120 billion. Mazzucato characterized research as fostering an “entrepreneurial state.”

Four notable trends have emerged: First, big business has increased its investment in research and development, eclipsing the federal government as a patron in some areas. Second, other nations have adopted Mazzucato’s entrepreneurial state concept and started lavish government research and development programs. Third, in the United States, business investment has prioritized applied research and development, while the federal government invests most in basic research. Fourth, the growing share of US industry spending in research and development comes from the pharmaceutical industry, with a focus on development rather than basic research.

Mazzucato’s work describes a dirty term in US politics: industrial policy. Industrial policy is “a strategy that includes a range of implicit or explicit policy instruments selectively focused on specific industrial sectors for the purpose of shaping structural change in line with a broader national vision and strategy.”⁷ Industrial policy can be general: it can consist of tax breaks or incentives for investment shaped to broadly advantage domestic business interests. Industrial policy can also be specific: the government can aid a certain industrial sector.

Industrial policy is a dirty term because no one likes to think their success is a result of government handouts. It even seems to create reaction formation—consider that aggrieved libertarians Cliven Bundy and John Perry Barlow both hailed from cattle ranching, an intensely taxpayer-subsidized industry. As we noted earlier, Barlow read the government out of the Internet, leading to a deep misunderstanding of governments’ capabilities online.

Berkeley professors Vinod Aggarwal and Andrew W. Reddie have written a series of articles examining the industrial policy of cybersecurity.⁸ The two explain that governments pursue industrial policy to create markets, facilitate markets, modify markets, substitute for market failures, and set rules to control technologies created by markets.⁹ In cybersecurity, the US government has taken aggressive market-substitution approaches. For instance, In-Q-Tel is a privately held, not-for-profit venture capital firm that is funded by the US Intelligence Community (IC) and other federal agencies to help the government stay atop cutting-edge technology developments. Governments also substitute for cybersecurity market failures by promoting educational and workforce training efforts.¹⁰

Could the United States become superior in cybersecurity by doubling down on basic and applied cybersecurity research?

Are there technologies or capabilities that are obvious candidates for market substitution?

Are there promising technologies out there that simply need help in market creation or facilitation?

Think local: any government could adopt policies to shape markets for cybersecurity. Is there a market your school should be creating, facilitating, or substituting for? Here’s an example: the University of California system started its cybersecurity efforts with mandatory training, but in 2021, began providing password management software at no cost.

What problems might it solve?

What gaps might it leave?

What are the downsides of this approach?

Who wins and who loses?

11.4 Encryption and Exceptional Access

In 2014, technology giant Apple dramatically changed the landscape for device security. Users of Apple devices who upgraded to the new operating system would have their information scrambled with strong encryption by default.

If an adversary attempted to break in by guessing the password, the device would slow down, making it impossible to automatically “brute force” the password. Such encryption has long existed and was available to knowledgeable and motivated users of Apple and even Android devices. But what made Apple’s move consequential was that the encryption and tamper-resistant features were enabled by default. Suddenly, even the least sophisticated users had strong protection, invulnerable to forensics by most law enforcement agencies.

The democratization of strong encryption has created a crisis for government investigators, and situations where crimes and other misdeeds cannot be fully explored because relevant data are encrypted and therefore inaccessible. Law enforcement agencies call this the “going dark” problem, as in, areas that used to be lighted by their investigatory methods are now darkened by encryption and other privacy tools. Law enforcement agencies see the situation as profoundly unfair because even if they possess a warrant, which legally entitles them to seize anything relevant to a crime, suspects can still keep data hidden. This same information could not be kept secret if it existed on paper.

In December 2015, Syed Rizwan Farook and Tashfeen Malik went to a work event for Farook and started a shooting massacre, killing 14 people. The couple escaped but were soon pursued by police, dropping an Apple iPhone 5c in the process. The iPhone had sophisticated device encryption that would erase data if too many incorrect password guesses were made. The FBI desperately wanted to access the device’s data and went and obtained a court order directing Apple to unlock the device. Apple refused and ensuing legal proceedings caused delay. The FBI ultimately used other technical means to gain access to the device.

Civil libertarians quickly dismissed the FBI’s effort as using terrorism for scare-mongering. After all, Farook and Malik were killed that day, ending the threat they posed. But, what was not known then, and could not be said, was that the FBI had intercepts connecting Farook with ISIS cells. The FBI suspected Farook’s actions might accelerate or trigger similar attacks elsewhere in the world. The FBI desperately wanted to interdict further attacks.

The conflict between Apple and FBI is just one anecdote in a long-running tussle over “lawful access” to encryption systems, which are technological fixes that allow agencies access to encrypted information when they have appropriate legal authority. Law enforcement entities call this ability “exceptional access,” in the sense, access is not the norm. Privacy is the norm. Opponents call these access mechanisms “backdoors,” because when such a capacity is created, presumably others (foreign governments, organized crime) will sneak through the backdoor without authorization. Proponents reply they do not want a “backdoor,” but rather a “front door,” reserved only for them, presumably only when proper procedure has been followed. Importantly, it is not clear from a technical standpoint how such procedures could work at all—no matter what they are called—without endangering the confidentiality and integrity of devices.

Encryption has long been regulated by states. Most early users of nineteenth-century telegraphy systems were prohibited from sending coded messages, for fear that coding could obscure various forms of cheating.¹¹

But now, encryption is useful, so useful that is simply cannot be banned. It has scores of applications that provide utility to many different industries such that it is not simply a security technology. It is also ultimately based on math, a difficult thing to prohibit.

Civil libertarians try to distract from the problem that encryption protects criminals with broad appeals to freedom—“Freedom Isn’t Free”—or by warning that government is a bigger threat to autonomy than individual crimes.

But, if freedom isn’t free, what is its price? Law enforcement agencies think the price is too high because, increasingly, secure Internet protocols that obscure metadata (e.g., secure forms of DNS) and special privacy-enhancing technologies like Tor and cryptocurrencies have upset the balance between law enforcement investigative activities and criminal anti-forensics.

Worse yet, from the law enforcement perspective, these technologies are creating new opportunities for horrendous crimes. The seminal example comes from sex slavery. There are services that offer live, remote sex acts over video secured by Tor. This makes it possible for people to engage in sex slavery without traveling to nations that harbor the practice, and in the process, imperil more children around the world who are forced into prostitution.¹² Law enforcement agencies think this price is too high for the freedom of private encryption.

Civil libertarians retort that without secure communications, an even higher price could inure: a collapse of democracy. A powerful anecdote comes from the “Athens Affair.” In the Athens Affair, still unknown hackers took advantage of a telecommunications provider’s law enforcement access system—the “front door” that law enforcement uses to implement wiretaps. In the process, the attackers were able to bug hundreds of officials’ cell phones. The Greek provider had never even ordered the wiretapping capability. The manufacturer of the system, Ericsson, had installed it when upgrading the company’s software system.¹³

The Athens Affair exposes several deep problems with any kind of law enforcement access point. Not only could it be abused by powerful people, but the management of such systems is far from simple. Computer scientists and security experts have amassed the operational and technical hazards of these systems in an important critique, Keys Under Doormats.¹⁴ They refer to this overall debate as the “crypto wars,” a conflict that has gone on for decades and is analyzed in depth in Susan Landau’s LISTENING IN.¹⁵

To reframe the issue into strategic perspective, consider this: LEAs try to justify access provisions by pointing to hundreds or thousands of seized but un-searched mobile phones from ordinary street crime. It is indeed a wrong when serious violent crimes lead to a dead end while evidence-laden phones from an attacker and victim are in possession of investigators. Yet, these are not cybersecurity concerns nor even concerns of terrorism. Cybersecurity and terrorism risks are not the realm of individuals, but of networks of people.

Individuals simply cannot cause mass casualties without networks of supporters. Thus, one could see LEA access demands as a wedge strategy. The thin edge convinces people that they will be safer in their daily lives from routine crime if LEAs have more evidence. But once that access is in place, how will civil libertarians resist the argument that much broader, network-level LEA access is required? To investigate and deter on the mass security event level, one needs access to networks, not devices, because networks are critical to national-security-level problems. Turning back to Farook and Malik—they died the day of their attack. It was the network of individuals associated with the duo that so worried the FBI.

Unlocking devices exemplifies another theme through this book: the notion that there is no single “government view” of cybersecurity. Seeing the government as a monolith obscures both nuanced and dramatic differences among agencies even in the same field. Law enforcement agencies generally favor an access mechanism to encrypted data. But, this is yet another example where the government is divided against itself: Military, intelligence, diplomatic, and economic agencies side with the civil libertarians for different reasons. DoD agencies support strong encryption for myriad reasons, from protecting individual soldiers deployed in hostile places to the need for resilient security in weapons systems (recall that onion routing, the principle behind Tor, was invented by the US Naval Research Laboratory). Intelligence agencies see encryption as a technology that gives American and western forces an asymmetric benefit. That is because only top-tier intelligence agencies can break the strongest encryption, and because some nations, for reasons of national pride or industrial policy, roll their own encryption that is likely vulnerable to American attack even without a backdoor. Diplomatic and economic interests have obvious, critical needs for the secrecy and data integrity that encryption offers—they’re also major users of Tor.

How do you come out on the access debate?

Are there areas of practical compromise between law enforcement interests and civil libertarians?

Are there legal/evidentiary mechanisms that could ease the pressure and deflate the need for access mechanisms?

Are access mechanisms another area where public–private cybersecurity (i.e., Apple or Google can do the decryption at the request of the government) is the best choice among bad options?

11.5 Disinformation Revisited

…you must investigate the matter on its own merits, without regarding the years of the speaker or his standing, or his carefulness in what he says; for the more plausible a man is, the closer your investigation should be …

— Lucian of Samosata¹⁶

Lucian speculated in the second century CE that there could be an end to what he called “slander”—“if some one of the gods would only unveil our lives, Slander would vanish away to limbo, having no place left, since everything would be illuminated by Truth.” We could see Lucian’s argument as a kind of transparency fantasy. It is a timeless dream—both Mark Zuckerberg (“Having two identities for yourself is an example of a lack of integrity.”) and Google (with a mission to organize the world’s information, including personal data) adhere to the fantasy.

Chapter 1 introduced the problem that cybersecurity can be stretched so thin as to envelop concerns with accuracy of information transmitted over the Internet. Stretching the definition on its surface makes sense since the Internet is used both to hack to attack confidentiality, and to distribute confidential information or amplify false material.

In 2017, Google-acquisition YouTube blocked tens of thousands of videos created by American citizen Anwar Nasser al-Awlaki. He had created surprisingly compelling videos that inspired young people to commit terrorist violence and travel to join al-Qaeda. In 2011, the CIA killed al-Awlaki with a UAV while he was in Yemen. Yet, al-Awlaki’s videos received sustained popularity on Google, leading the company to eventually block links to them. How could Google, a company with the mission to “organize the world’s information and make it universally accessible and useful,” have come to a point where it started blocking finger-wagging lectures by a cleric?

Google’s turn to blocking information echoes in many other institutions, including some on the vanguard of free expression. Newspapers have demoted, hidden, or simply eliminated their user-generated comment sections. After resisting content filtering, social media giant Facebook now limits hate speech. Much of this filtered speech, as misguided as it is, is within the bounds of legally protected free expression in the United States.

Why have institutions normally committed to the ideal of a “marketplace of ideas” or the quip “the best answer to bad speech is more speech” done so much to constrain expression? We point to several shifts brought about by technology covered in detail in Chapter 1. First, our free speech norms and rules evolved in the pre-Internet period, with a different volume of information. The seminal free speech doctrines from the twentieth century were based on the assumption of information scarcity. Until the web took off as a consumer technology, information was costly to acquire. Information was “practically obscure” in a real sense. Even information in public records was in effect secret, because one had to know about it in the first place and then travel to distant government repositories to find it.

Nowadays, we are awash in information, much of it low quality in the sense that it is mere opinion, unsubstantiated, Postman “stupid talk” (incorrect), or Postman “crazy talk” (contextually untethered from reality).¹⁷ The modern information challenge is glut. Information glut requires us to filter out low-quality information. An economist would recognize that filtering out low-quality information is impracticable and imposes costs on people, because there is just too much of it.

But, the psychologists tell us filtering is impossible for a different reason. Even when we hear information we know to be incorrect, falsity influences us. When we hear an assertion repeatedly, even a false one, we begin to believe it (repetition of false arguments was a tactic of Goebbels).

Aside from time, many lack the skills to distinguish high-value from low-value information. Indeed, even literacy has long been in crisis. If literacy surveys, such as the Program for the International Assessment of Adult Competencies (PIAAC), are correct, less than a quarter of Americans have the skills to synthesize the information presented in this book. Despite the information revolution brought about by the Internet, according to the PIAAC, adult literacy has not improved for decades.

Consumer protection law has long recognized the idea that commercial marketplaces do not correct falsity. If falsity were automatically correcting, we would not need false advertising laws. Consumers would simply investigate and debunk specious claims. Yet they do not. And we somehow expect this debunking to occur in other contexts.

A second change is in the velocity of information. Not only are we constantly receiving new information, but platforms, and the nature of virality also demand that we have an opinion and can respond to new revelations. Consider how different today’s situation is from the age of the printing press or the telegraph, where the volume of information expanded, but was tempered by an inability to respond quickly, transaction costs in responding, and the reality that most could not respond at all. Mireille Hildebrandt explains that in such a world, much of our reaction remained private in the sense that it was unexpressed, and what we chose to express had to be tempered by the delay of typesetting or letter-writing.

A third change is economic/technical: as platforms have captured more of the advertising dollar pie, high-quality-fact-generating institutions have suffered. Many communities have no local newspaper at all; in some cases, once-robust local newspapers are simply vessels for the police blotter and recycled “news” from user-generated content (e.g., “Five local restaurants Yelp users love!”).

Consider that newspapers provide the “first draft of history.” We’ve always known them to be valuable, yet imperfect sources of knowledge. That was in their economic heyday.

A fourth technological change relates to the attribution problem. As users of news and networking sites, we cannot be sure of the identities and motivations of other users. We might imagine someone commenting on a local news story is a neighbor, but it just as well could be an agent provocateur or a bot. In fact, the people most motivated to write Internet comments might be the most aggressive and impulsive. Some may be engaging in strategic communication (speech such as public relations that is intended to reach some goal), rather than genuine social interaction characteristic of ordinary discourse. Even if one knows the identity of an online speaker, one cannot always tell whether the speech is earnest or satirical. This problem gives extremists space to float outrageous ideas and then walk them back as humor if others object.

A fifth technological dynamic surrounds the idea of community online. As Internet users, we have difficulty conceptualizing our speech audiences. This is one reason why users “overshare”; they think their social network audience consists of friends, but in reality, it also includes coworkers or others with mixed duties or obligations, as well as complete strangers. We might imagine these strangers are friendly, but they could just as well be hostile, malicious, or predatory.

In fact, looking objectively at the Internet, we might conclude it did not breed netizens as the utopians predicted. For many users, the Internet is basically just television, with users spending hours a day scrolling through videos (when the authors were children, this was known as “channel surfing” and our parents frowned on it). Pornography represents an unfathomable amount of Internet traffic. And at its worst, the Internet is an engine for extreme viewpoints, including the grounds on which ISIS recruitment was possible at scale.¹⁸

Is there anything really new here justifying interventions, or are concerns about the Internet no different than those about the telegraph, the telephone, and the television? If things have changed, what are the most important factors?

Is it possible to decompose the disinformation problem and attack one of the sub-issues identified above?

If you conclude the media has shaped discourse for the worse, are there remedies that work that also avoid the historical follies of censorship?

Deepfakes are convincing fake videos and photographs. The technology, based on deep learning, is sometimes used to place celebrities’ faces into pornography or create videos falsely portraying their speech and actions. Do deepfakes somehow change confidentiality and integrity concerns such that they should be addressed with cybersecurity law?

Similarly, software that makes it easy to convincingly edit voice now exists.

Combined, these technologies might eventually enable fake video with “no tells.” If Lucian’s advice of careful inspection becomes impossible, how could and should societies react?

11.5.1 Racist Speech and Cybersecurity

Article 3 of the Additional Protocol to the Convention on Cybercrime requires signatories to “adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally and without right, the following conduct: distributing, or otherwise making available, racist and xenophobic material to the public through a computer system.”

Racist and xenophobic material “means any written material, any image or any other representation of ideas or theories, which advocates, promotes or incites hatred, discrimination or violence, against any individual or group of individuals, based on race, colour, descent or national or ethnic origin, as well as religion if used as a pretext for any of these factors.”

The United States is a signatory to the Convention on Cybercrime (also known as the Budapest Convention) but not to the Additional Protocol.

Given that racist speech is protected communication under First Amendment case law, what options do other nations have to address such speech emanating from the United States?

What should the private sector do, if anything, to combat racist and xenophobic material?

11.5.2 What Expectations About Disinformation Are Reasonable?

Twenty-nine percent of Americans believe in astrology;¹⁹ nine percent believe vampires actually exist.²⁰

Are concerns about the information domain ultimately folly?

What would victory over disinformation look like?

11.6 Conclusion

We hope this chapter provokes lively class discussion! The next chapter turns to cybersecurity futures.

Notes

1 Bardach E and Patashnik EM. A Practical Guide for Policy Analysis: The Eightfold Path to More Effective Problem Solving. CQ Press, 2019.

2 Recall from our critical infrastructure material that the notion that most CI is in the private sector is both a misleading claim and one that cannot be sourced to any authoritative study. Maybe dispelling the false assumption could open up more policy options.

3 For more resources, see the website of the Harvard Kennedy School, https://policymemos.hks.harvard.edu/policy-memo-databases and Brodsky LN. How to Write a Policy Memo. Available from: https://perma.cc/6UUX-K37B.

4 The White House. National Cybersecurity Strategy, 2023. Available from: https://perma.cc/3PHN-QBTJ.

5 Bush V. Science, the Endless Frontier. Princeton University Press, 2020.

6 Mazzucato M. The Entrepreneurial State: Debunking Public vs. Private Sector Myths. Anthem Press, 2013.

7 Oqubay A. Climbing without Ladders: Industrial Policy and Development. Made in Africa. Oxford University Press, 2015.

8 Aggarwal VK and Reddie AW. Comparative industrial policy and cybersecurity: a framework for analysis. Journal of Cyber Policy 2018; 3:291–305, Aggarwal VK and Reddie AW. Cyber Industrial Policy in an Era of Strategic Competition. 2019. Available from: cltc.berkeley.edu/wp-content/uploads/2019/05/Cyber_Industrial_Policy.pdf.

9 See Harris RG and Carman JM. Public regulation of marketing activity: part II: regulatory responses to market failures. Journal of Macromarketing 1984; 4:41–52.

10 Aggarwal VK and Reddie AW. Comparative industrial policy and cybersecurity: a framework for analysis. Journal of Cyber Policy 2018; 3:291–305.

11 Standage T. The Victorian Internet: The Remarkable Story of the Telegraph and the Nineteenth Century’s On-line Pioneers. New York: Walker and Co., 1998.

12 The EC3 has documented the rise of live, on-demand child sexual abuse made possible through Tor and cryptocurrencies. The Internet expands the availability of such abuse, makes permanent the abuse in the form of digital copies of the act, lowers the barriers to abuse, and lowers the likelihood of being caught. Europol. IOCTA 2016 Internet Organised Crime Threat Assessment. Europol, 2016.

13 Prevelakis V and Spinellis D. The athens affair. IEEE Spectrum 2007; 44:26–33.

14 Abelson H, Anderson R, Bellovin SM, Benaloh J, Blaze M, Diffie W, Gilmore J, Green M, Landau S, Neumann PG, et al. Keys under doormats: mandating insecurity by requiring government access to all data and communications. Journal of Cybersecurity 2015; 1:69–79.

15 Landau S. Listening in: Cybersecurity in an Insecure Age. Yale University Press, 2017.

16 Kilburn K, and Macleod MD. Lucian. Cambridge, MA: Harvard University Press, 1913.

17 Postman N. Crazy Talk, Stupid Talk: How We Defeat Ourselves by the Way We Talk and What to Do About It. New York: Delacorte Press, 1976.

18 Sageman M. The next generation of terror. Foreign policy, 2008;165:37.

19 Pew Research Center. Pew Research Center: American Trends Panel Wave 30, Question 58 [31114995.00112]. Abt Associates. Cornell University, Ithaca, NY: Roper Center for Public Opinion Research, 2017.

20 CBS News. CBS News Poll, Question 10 [31116378.00009]. Social Science Research Solutions (SSRS). Cornell University, Ithaca, NY: Roper Center for Public Opinion Research, 2017.

12.
Cybersecurity Futures

Chapter image: Young Man with Bow and Large Quiver and his Companion with a Shield, formerly titled Telemachus and Mentor, Giovanni Battista Tiepolo, 1730–1750.

Source: Rembrandt Association/Rijksmuseum Amsterdam/Public domain/
http://hdl.handle.net/10934/RM0001.COLLECT.5574.

Chapter Learning Goals

Learn about scenario analysis.

Apply scenario analysis to possible cybersecurity futures.

The only sure thing in life is change. How might technology, society, and the law evolve, and what could those changes mean for cybersecurity? This short, final chapter presents possible cybersecurity futures in the form of scenarios.

Why should one think about futures in a structured way? Scenarios have a purpose: to help you think about what you should be doing today to get ready for tomorrow. You will probably have a decades-long career in cybersecurity, so you surely will need to learn new skills. Scenarios might help you identify what general knowledge and skills will be important in the future.

There is also the opportunity to think about your role in shaping cybersecurity. Could you envision yourself setting a positive agenda? Think about the world you would like to have in your future and for your children—what security environment would you like to see realized?

12.1 Scenarios Methods

There are many methods for developing scenarios and engaging with them. Here are questions you can ask to drive thought and discussion, while all will not apply to each situation:

Reframing Is our understanding of this scenario dominated by a particular lens, such as consumer law, criminal law, or national security? Can the scenario be fundamentally reevaluated if we question our assumptions and look at the problem through an entirely different lens?

Uncertainty Where is there uncertainty in the scenario? What if those uncertainties were resolved?

Geopolitical change What geopolitical changes could trigger a profound rethink of any given issue? Think broadly. Geopolitical changes could include wars, climate change, or fundamental changes to economies.

Technology change What advances in technology could trigger a rethink (Table 12.1)?

Human values How might technology changes affect how we think of ourselves?

Governance How might these changes endanger or enhance traditional stores of trust—ownership of property, the ability to make promises through contract, the purpose imparted and financial reward from work, and rule of law?

Equity Are there subgroups that win big or lose big from the changes brought about by the scenario?

History Can we look to historical examples—for instance, in the development of computing or other technologies—to anticipate how we might fundamentally rethink positions?

Scenario analysis can feel overwhelming. Sometimes, the way to approach it is to consider the status quo as a possible scenario. One can then consider some of the profound ways our world has changed in the past decade to motivate the belief that scenarios could be realistic.

Table 12.1 Significant and difficult-to-foresee shifts relevant to security.

Cultural concerns, concepts | Technology enablers | Policy responses
Fear of automation and machine intelligence | ChatGPT and generative artificial intelligence (GAI) | Privacy laws regulating data inputs, use limitations on GAI, requirements to check outputs
Rise of leakers, distrust in the US intelligence community | Encryption, anonymous leak sites | Prosecution of leakers, document attribution techniques, supercharging of EU privacy rights laws
Foreign interference in US politics | Social media, bots | Large rethink of social media, filtering, new proposals for speech limits, intelligence community/Law Enforcement Agency (LEA) turn to influence instead of cybercrime
Foreign recruitment of domestic extremists | YouTube, encrypted chat apps | Surveillance, blocking of some YouTube users. Congress loosens limits on US public diplomacy
China’s turn to indigenous industry, science | Precision manufacturing, mastery of the China firewall | Large-scale industrial policy investments in the United States, export control, counter-espionage activities
#MeToo movement | Social media | Platforms adopt abuse policies; states criminalize nonconsensual image posting; people start losing jobs and elections because of harassment
Invasion of Ukraine; re-emergence of blocs | Cyberattacks on satellites and critical infrastructure | Quick passage of information-sharing mandate for US critical infrastructures

12.2 Even More Sophisticated Cyberattacks

A number of sophisticated, high-tech attacks have been discussed throughout the book and there are obviously many more. These attacks are essentially indistinguishable from magic for the average computer user, and while they don’t appear that way to people with sophisticated technical skills, most of the attacks are both unexpected (even under close scrutiny by experts) and inevitable. The emergence of high-tech attacks like Spectre and Meltdown, for example, is driven both by the almost unimaginable complexity of modern computing devices, combined with the equally unimaginable tenacity of attackers. Meltdown and Spectre are speculative execution attacks, which prey on the fact that modern CPUs may make guesses about the flow of computer code that is being executed. When the CPU guesses incorrectly, the mistake is automatically fixed, but there are minute effects that can be observed by an attacker and may leak sensitive information.

We’ve also discussed targeted attacks, where an adversary may target a specific individual or company. Not all of these attacks steal data—some stealthily introduce incriminating data into a system. Typical end-point defenses, such as antivirus, are notoriously bad at detecting targeted attacks, because malware used in the attack may never have been seen before, much less analyzed, and so, detection patterns have yet to be established.

Perhaps even more worrisome are “file-less” and memory-only malware, which can also be designed and aimed at specific individuals or corporations. Malware of this kind may leave no trace at all once a computer system has been powered down. That is, potentially all exculpatory evidence may be removed if traditional forensic analysis does not include memory analysis techniques.

Attacks such as these substantially complicate attribution of civil or criminal misbehavior, particularly given the scarcity of highly-trained investigators (and their associated costs). An innocent individual faced with a charge of misconduct over data stolen from, stored on, or transmitted by a computer faces a serious problem in that the persons making the charge may be entirely unaware of or unable to detect malicious tampering. Furthermore, mounting a successful the “malware did it” Trojan Horse defense against such charges will be met with skepticism and cost a great deal of money (as of this writing experienced experts who might be able to reveal the existence and nefarious behavior of targeted malware might cost $500 to well over $1,000 per hour).

Assuming they are taken seriously, how might hard-to-detect cyberattacks impact the proper functioning of our legal system?

What resources might need to be available to “level the scales” and help the accused defend themselves?

How do targeted attacks impact the amount of training that should be required for law enforcement tasked with conducting forensics investigations? Is any amount of training really enough?

12.3 Quantum Computing

Quantum computing provides an excellent example of a yet-to-arrive technology that might trigger a broad rethink of our security priorities. The field is a huge recipient of industrial policy support—with the United States and China pouring billions into basic research.

The notional threat of quantum computing is that a large device will undo RSA and Elliptic Curve (ECC) encryption, thus making it possible to read many communications and, more dangerously, spoof the identity of certificates used to sign software updates and websites. Such capabilities would mean a well-resourced and well-placed adversary could steal the certificate for a popular service, say gmail.com, and then read everyone’s email. It would also enable nation-states that sit atop archives of intercepted intelligence to decrypt yesteryear’s secret documents.

Author Hoofnagle writing with Simson Garfinkel in their 2022 book, LAW AND POLICY FOR THE QUANTUM AGE,¹ assess that it is probable that scientists are facing a quantum “winter.” Like the previous artificial intelligence (AI) winter, the quantum winter will follow a hype cycle where the technology simply does not live up to expectations, and critically fails to create a virtuous cycle. That is a situation where production-ready applications mint money for the private sector and create further demand for more quantum computing. Modern personal computing is the offshoot of such a cycle, which experimental and then mainframe computing created for the military and big businesses from the 1940s to the 1980s.

Further, Hoofnagle and Garfinkel argue that even if a large-scale quantum computer can be built, it is unlikely to be a substantial threat to encryption. This is because only some encryption is vulnerable to quantum attack; as each key still would take hours to factor, governments would have to carefully choose what to decrypt, and countermeasures are not only available; they are being adopted.² For instance, in May 2022, the Biden administration took substantial policy steps to ensure the entire federal government IT infrastructure has quantum resistance.

Suppose you must make a decision about spending government dollars in quantum computing research, and you possess conflicting assessments: some, like the above, predict a winter, while others see the creation of a large decryption machine. How much of a priority should one place on spending on quantum technologies?

Suppose you lead the government research portfolio of a low- or middle-income (LMIC) nation and assess that China and the United States will develop large-scale quantum computers. What are your options?

12.4 Automaticity and Autonomy: Artificial Intelligence and Machine Learning

Back in 2010, the Canadian government commissioned a study that was unique in scope. Because of Bell Canada’s network aperture, it was able to study 70% of the nation’s Internet traffic over a year. Initially classified, the report found that an astonishing amount of traffic was malicious. Specifically, 53 Gbps at any given time is malicious/illicit traffic, 94% of all e-mail is spam or malicious, and 5% of machines are infected by botnets at any given moment.³ The volume and speed of malicious activity already surpassed what any human could deal with over a decade ago.

No technology enjoys more hype than AI and many cybersecurity companies claim their services employ it. In reality, many companies nowadays “fake” AI by using people to perform analyses behind the scenes, or by defining AI so broadly that it includes any software that does basic pattern recognition significantly better and faster than a human. But under such definitions, even calculators are AI.

Machine learning (ML), a subfield of AI, will have important effects in cybersecurity. There are many different kinds of ML techniques, and the most basic could be thought of as statistical. ML algorithms are developed by computers analyzing huge amounts of information to find subtle and not-so-subtle correlations that support classification, for instance, into spam versus non-spam email folders.

Most AI/ML techniques require huge pools of data. This leads to a basic observation: relatively common attacks, such as phishing, may be easier for AL/ML systems to detect, because there are so many tagged messages that are malicious. Learning algorithms have a lot of examples to practice on. Conversely, black swan events—like terrorism—are unlikely to be detected through these techniques because of a dearth of model data and the application of mētis.

Cybersecurity is one field where ML is actually used—and is successful! Perhaps, the best example comes in analyzing software for viruses, where state-of-the-art techniques enable not just signature-matching (exact matches) but also perturbances added to confuse pattern recognition. Again, this is possible in part because, as the Bell Canada report indicates, attacks make a huge corpus of malware available for analysis.

AL/ML can be used for offense as well. We have to consider whether generative technologies will create new forms of frauds and tricks, or change the economics of existing, labor-intensive frauds. In the former category, the fear of a general AI is that it will be more intelligent than people and could play a long con with humans to trick them into releasing the AI or otherwise achieving some goal. In that situation, we might not understand the means nor the ends of the trick.

In the latter category, short of general AI, existing generative AI technologies could be a massive force multiplier for fraudsters. These technologies can generate realistic text, images, and even voices. Even in the near term, generative AI technologies may be used to automate labor-intensive frauds, such as identity theft and phishing. Identity theft is easy to commit, but requires commitment. One must maintain many identities, many forms of contact information (for instance, P.O. boxes to receive credit cards), and find ways of converting credit into other forms of value. Phishing, too, is labor intensive.

But consider a program that scans targets’ social networks for close connections and automatically sends them malicious emails that appear to come from their friends and co-workers. A well-trained generative AI could personalize these messages to appeal to certain kinds of people, or even reference recent events to convince the recipient to do something. More broadly, generative AIs might become sources of voluminous disinformation and bile.

ML systems reveal yet another tension in security: criminal definitions of computer hacking require the suspect to use a computer to interfere with another computer. But in a world with ubiquitous computing that senses phenomena and makes decisions, one can hack systems without a computer. Consider the anecdote of the 14-year-old boy in Poland who caused trains to derail by shining light into the railway’s signalizing system.⁴ Or consider how by merely wearing special glasses, researchers at Carnegie Mellon were able to fool computer vision systems into thinking the researchers were celebrities.⁵

ML systems are also subject to other forms of poisoning that do not (and couldn’t possibly) trigger any criminal prohibition. For instance, since ML systems are trained on web texts, an adversary could use generative AI to create tens of thousands of websites with bad data on them, intending that this data will be scraped by ML systems and later corrupt outputs. Recent research also suggests that the outputs of current generation AI systems may be significantly degraded if systems are trained on datasets containing their own prior outputs (e.g., an “art”-generator such as DALL-E may produce substantially degraded outputs if trained on its own art).⁶ All these attacks require is posting large amounts of AI-generated content that might be consumed in future training efforts. There is also research into methods that artists can use to deliberately “poison” their own creative work. One such system is called Nightshade, presented as “a last defense for content creators against web scrapers that ignore opt-out/do-not-crawl directives.”⁷

The future of computer hacking may be systems hacking—interferences that do not require a computer at all. Ultraviolet light might be used to signal computer vision systems to “see” things that are not there. Ultrasonic noise might be used to have computers hear commands users cannot perceive.

Turning to cybersecurity, do cyberattacks and defense present the most likely scenarios where automaticity and autonomy might be adopted?

What are the differences between automaticity and autonomy?

Are there components of the “OODA loop” (see Chapter 4) that are safer to hand over to automaticity or autonomy? Are there dividing lines between primarily “defensive” and “offensive” systems?

Are there good prospects to promote defensive use of AI/ML?

What if the adoption of AI/ML defense fundamentally changes the offense/defense balance, making it harder to attack, and easier for defenders to identify attackers?

Who wins, and who loses?

12.5 The Data Trade and Security

Berkeley political scientist Steven Weber poses the following question about data trade:

…do data flow imbalances make a difference in national economic trajectories? If a country exports more data than it imports (or the opposite), should anyone care?⁸

To make this question concrete, Weber develops the following scenario:

…Imagine that a large number of Parisians use Uber on a regular basis to find their way around the city. Each passenger pays Uber a fee for her ride, and some of that money goes to the Uber driver in Paris. Uber itself takes a cut, but it’s not the money that really matters here. Focus instead on the data flow that Uber receives from all its Parisian customers (including both sides of the two-sided market; that is, Uber drivers and passengers are both customers in this model). Each Uber ride in Paris produces raw data about traffic patterns, and about where people are going at what times of day, which Uber collects. This mass of raw data, over time and across geographies, is an input to and feeds the further development of Uber’s algorithms. These in turn are more than just a support for a better Uber business model (though that effect in and of itself matters because it enhances and accelerates Uber’s competitive advantage vis-à-vis traditional taxi companies). Other, more ambitious data products will reveal highly valuable insights about transportation, commerce, commercial and social life in the city, and potentially much more (what is possible stretches the imagination).

And here’s an obvious public policy consequence: if the mayor of Paris in 2025 decides that she wants to launch a major reconfiguration of public transit in the city to take account of changing travel patterns, who will have the data she’ll need to develop a good policy? The answer is Uber, and the price for data products that could immediately help determine the optimal Parisian public-transit investments would be (justifiably) high.

One way an adversary could collect information on Americans is by placing devices all around the nation. Another is to get Americans to use apps (think TikTok) that provide sensing information back to the provider. Yet, another is simply to buy information. In 2021, the Director of National Intelligence released a fact sheet warning Americans that Chinese companies had purchased two genomics companies, stating, “The PRC views bulk personal data, including healthcare and genomic data, as a strategic commodity to be collected and used for its economic and national security priorities.”⁹

The knowledge power of the private sector is a major theme throughout this book. The private sector has attribution powers greater than most law enforcement agencies, and indeed LEAs, intelligence agencies, and militaries are sometimes reliant on the private sector for their basic work.

What dangers do these examples elucidate? Should they trigger a rethink of the public-private cybersecurity approach?

How should these issues be managed? How does the management of them differ when an economic regulation lens is taken instead of a security lens?

12.6 The Sovereign Internet

We learned in the first part of this book that the Internet was developed and governed by a diverse group of US government, private sector, and NGO institutions. These institutions may disagree on some matters of policy, but in the largest sense, they agree about the importance of free expression and freedom to do business. These institutions’ governance thus tended to ignore the content traded on these services. The result was an explosion in diverse websites, representing every human interest imaginable.

No license or preapproval is required to create a website or application. Liberal governments also tend not to require websites to identify their users nor keep records on them. A palpable consequence from these policies comes from the popularity of adult pornography online. Prior to the Internet, adult pornography was regulated and sometimes subjected to prosecution for obscenity. Nowadays, even children can access material once treated as obscene on their mobile phones.

As Danny Steed observes, “cyberspace has so far enjoyed a honeymoon period of apolitical governance thanks to the victory of the liberal order in the Cold War.”¹⁰ This honeymoon is coming to an end in both bedrock liberal democracies and in nations with less commitments to human rights. In the liberal West, nations have stayed out of regulating information with the exception of copyright violations and Child Sexual Abuse Material (CSAM). Now, with rising concern about foreign disinformation and manipulation, policymakers are intensely focused on what is being said on social media. In the United States, policymakers have attempted to ban China-based social media app TikTok for fear it is a vector for manipulation. US policymakers have also realized that even mainstream social media services present significant child predation and human trafficking risks. These forces put pressure on Internet companies to police content.

Nations are of course not totally free or completely without freedom. Nations exist on a continuum of freedom, with some having institutions and norms that promote individual freedom to various degrees. Of course, others are simply authoritarian. In less free nations, governments push for Internet sovereignty. Steed observes, “due to the significant and persistent insecurities that the Internet has brought to today’s world, politics is now fully committed to reasserting its sovereign authority on this space.”

We first encountered the Internet sovereignty nations, such as China and Russia, in Chapter 1. These nations make a facially reasonable argument: Respect for other nations requires that we acknowledge their sovereignty.¹¹ To do otherwise smacks of imperialism or colonialism. To follow this logic, liberal western technical choices structure values and norms, and these colonize any nation that integrates Internet technology. Nations like Russia argue the Internet will be more free and less “fragmented” if only the international community recognized the nation’s interest in content security (rather than computer security).

There are at least five design/policy forces that are moving liberal and illiberal nations alike toward a sovereign Internet:

Some nations are building automated censorship into the DNS—for instance, some European nations have blocked access to Bittorrent sites for all their users; in China, extensive blocking is implemented for “political security.” Russia has tested “separating” their Internet by disconnecting from the public network and running its own, in-country DNS.

At the edges, privacy laws can become forces for sovereignty; strong prohibitions on the transfer of data, for instance, can in effect be data localization. That is, a prohibition in moving citizens’ data outside the nation.

Data retention mandates require service providers to archive user data so it can be easily accessed by law enforcement if a crime occurs.

Real identity measures require service providers to take some steps to link users to their true identity.

Rule by law countries, such as China, enact sweepingly broad consumer protection laws that seem to prohibit ordinary business. This means all businesses are technically violating the law, no matter what they do. Thus, the Party can bring strategic enforcement actions against any business for political reasons.

Imagine a future where Internet sovereignty takes hold. What would such a future look like?

Our discussion highlights the roles of China and Russia, but how might transitional democracies react to sovereignty?

Systems are dynamic, so one could imagine a future where sovereign laws enacted in China and Russia trigger a reaction in the West. How might western nations react? Are there portions of the sovereignty strategy that make sense for the United States to adopt?

12.7 Outer Space Cyber

In August 2019, the President of the United States tweeted this photograph (Figure 12.1).

Observers were flummoxed by this photo. The resolution and clarity of the image suggested it was taken by a UAV or high-altitude plane—but if the United States was not involved in this accident, did we just happen to be flying surveillance vehicles over Iran’s airspace?

Figure 12.1 President Trump wrote, “The United States of America was not involved in the catastrophic accident during final launch preparations for the Safir SLV Launch at Semnan Launch Site One in Iran. I wish Iran best wishes and good luck in determining what happened at Site One.”

Source: Unknown/Wikimedia Commons/Publicdomain/https://en.m.wikipedia.org/wiki/File:2019-08-29_Safir_launch_failure.jpg.

Experts in satellites analyzed the metadata associated with the image and concluded it was taken with a “Key Hole” satellite.¹² The Key Hole series, made by Lockheed Martin, cost over a billion dollars each and remain one of the most secret arrows in the American intelligence quiver. The specific satellite identified was launched in 2011, and so, presumably newer generation descendants, managed by the Department of Defense’s National Reconnaissance Office (NRO), have even higher resolution.

The image indeed speaks a thousand words about why the US established the Space Command as a unified combatant command, placing it on par with sister services like the Army and Navy: US satellites provide key intelligence that can help the nation anticipate and manage conflict. If a war were to be waged between superpowers, first strikes might be launched against satellites. Accordingly, the Space Force, originally formed and housed by the Air Force out of Vandenberg Air Force Base, now has the leadership of a four-star general and a seat at the Joint Chiefs of Staff. Space Command now has authority over all military actions in space, defined as 100 km or more above sea level.

Threats to satellites can come not only from computer attacks but also from clever kinetic ones. An intriguing 2019 editorial in the Wall Street Journal related this anecdote: An object that appeared to be space debris “made 11 close approaches to one of the rocket’s discarded stages. Such an elaborate space dance would be possible only if the object had thrusters and enough fuel to maneuver very precisely.” The author continued, claiming China has “a satellite with a grappling arm capable of lifting other satellites out of orbit. China has now conducted multiple successful tests of this ‘kidnapper satellite,’ some of them at geostationary orbit, where America’s most sensitive space assets reside, including satellites for communications, surveillance and early warning of a nuclear launch.”¹³ In addition to physical attack from nearby satellites, terrestrial-based attacks include lasers and other techniques. But don’t take our word for it! You can read about these methods in an academic paper written by two Chinese scientists and a member of the People’s Liberation Army (PLA).¹⁴

Turning back to cybersecurity, a nation that lacks launch capability or cannot practically use terrestrially-based lasers to attack satellites is likely to turn to computer attacks on satellites. And this should concern us because many satellites in orbit are decades old.

What would it mean for communications if nations struck or otherwise disabled satellites in a conflict?

What options are there to defend satellites using cybersecurity techniques?

12.8 Classification Declassed

Imagine a future where classification policy starts to be widely seen as an expensive failure.

Policymakers might have good reason to conclude this. Many of the biggest failures of secrecy have come from insiders—from John Anthony Walker (1968–1985), Robert Hansen (1979–1981, 1985–1991, 1992–2001), Jonathan Pollard (1984–1985), Ana Montes (1985–2001), Chelsea Elizabeth Manning (2009–2010), to Edward Snowden (2009–2013). Millions of Americans hold security clearances that require a fantastic management bureaucracy to investigate and monitor clearance holders. Yet, the leaks keep on springing.

The management problem extends well beyond leakers—senators, cabinet members, and presidents find it difficult to manage classified documents.

In the lead-up to the Ukraine war, President Biden advisor Jake Sullivan adopted a policy allowing intelligence on Russian activities to be released. The Intelligence Community (IC) correctly predicted that Russia was preparing to and ultimately did invade Ukraine. The policy shift gave the IC an observable victory—intelligence failures are easier to see than successes. But it also showed the utility of intelligence-sharing with the public. The result: a broad change in classification, where much less is classified, and what is classified becomes declassified more quickly. Threat information is becoming more available to cybersecurity companies and other defenders.

What if the Sullivan approach became the model for the United States?

12.9 Attribution Perfected or Not

In the “metaverse,” attribution is perfect. This is because the metaverse is a combination of encryption and blockchain technologies that make the Internet both decentralized and governable by local panjandrums. Metaverse spaces are rivalrous and brands such as Disney can sell users official clothes for their avatar that are verifiably authentic and unique to that user. Theft is impossible. The metaverse is an intellectual property owners’ dream.

The opposite scenario is envisioned by Barlowism (see Chapter 5): a fundamental change in Internet infrastructure and protocols causes users to be completely free of censorship, intellectual property, and other information restraints. John Perry Barlow’s Internet is a placeless abstraction layer where governments are ineffectual in identifying people or regulating any kind of information transfer.

Which of the scenarios is more likely, and what would the world be like in either scenario?

Might we find ourselves somewhere between the metaverse and the Barlowverse? Can security shape a future with the best of both visions?

12.10 Conclusion

The scenarios in this chapter do not try to predict the future; instead, their purpose is to provoke thought. You could develop your own scenarios as technology and politics make our lives interesting in new ways.

This concludes our time together studying cybersecurity. We encourage you to reflect on this book’s themes: the idea that cybersecurity is a technical endeavor, but cannot be understood without immersion in the field’s economics, psychology, political theory, and history of military and intelligence activity.

Remember you, dear reader, can have an exciting and rewarding career in cybersecurity. You can learn the technical skills, and the reward is worth it. Cybersecurity jobs not only pay well, they also do good. The liberal form of cybersecurity described in this book advances human freedoms. We cannot have freedom of speech, freedom of association, privacy rights, an innovative economy, and a flourishing private sector without the right kind of security. We need millions more experts to work on this task.

Professional stimulation is yet another reason to consider a career in cybersecurity. It is a field where you can use mētis. Attacks and attackers evolve constantly and so will the cybersecurity professionals at the edge of the field. If you are a lifetime learner, cybersecurity provides a promising path to a challenging career.

Finally, we wrote this book in the hope that it would inspire you. We would be delighted to hear your story—send us an email.

Notes

1 Available free here: https://cup.org/3kX4JlI.

2 Hoofnagle CJ and Garfinkel SL. Quantum Cryptanalysis: Hype and Reality. Lawfare: Hard National Security Choices, 2022 Feb. Available from: https://www.lawfareblog.com/quantum-cryptanalysis-hype-and-reality.

3 Canada B. Combating Robot Networks and Their Controllers, 2010. Available from: https://perma.cc/NU8U-V7U3.

4 Zetter K. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon. 1st ed. New York: Crown Publishers, 2014.

5 Sharif M, Bhagavatula S, Bauer L, and Reiter MK. Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition. CCS ’16. Vienna, Austria: Association for Computing Machinery, 2016.

6 Alemohammad S, Casco-Rodriguez J, Luzi L, Humayun AI, Babaei H, LeJeune D, Siahkoohi A, and Baraniuk RG. Self-consuming generative models go mad. arXiv preprint arXiv:2307.01850, 2023.

7 Shan S, Ding W, Passananti J, Zheng H, and Zhao BY. Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models, 2023. arXiv: 2310.13828[cs.CR].

8 Weber S. Bloc by Bloc: How to Build a Global Enterprise for the New Regional Order. Harvard University Press, 2019.

9 National Counterintelligence and Security Center. China’s Collection of Genomic and Other Healthcare Data from America, 2021 Mar. Available from: https://perma.cc/R35P-C7CL.

10 Steed D. The Politics and Technology of Cyberspace. Modern Security Studies. Abingdon, Oxon; Routledge, Taylor and Francis Group, 2019.

11 In 2023, the Russian Federation introduced a United Nations convention “based on equitable cooperation” and called for “the sovereign right of each State to ensure security of national information space and to establish norms and mechanisms in order to manage its information and cultural space in accordance with national legislation.”

12 Langbroek M. Image from Trump tweet identified as imagery by USA 224, a classified KH-11 ENHANCED CRYSTAL satellite — sattrackcam.blogspot.com. https://sattrackcam.blogspot.com/2019/09/image-from-trump-tweet-identified-as.html, 2019.

13 Sciutto J. A Vulnerable U.S. Really Does Need a Space Force; China and Russia are developing new weapons that can attack crucial American satellites, and the U.S. has been slow to respond to the danger. The Wall Street Journal, 2019.

14 Liu Z, Lin C, and Chen G. Space attack technology overview. Journal of Physics: Conference Series 2020; 1544:012178.

V
Further Reading and Index

Further Reading

Index

Further Reading

Abelson H, Anderson R, Bellovin SM, Benaloh J, Blaze M, Diffie W, Gilmore J, Green M, Landau S, Neumann PG, et al. Keys under doormats: mandating insecurity by requiring government access to all data and communications. Journal of Cybersecurity 2015; 1:69–79.

Acton JM. Cyber Weapons and Precision-Guided Munitions. Understanding cyber conflict: Fourteen analogies, 2017: 45–60.

Aggarwal VK and Reddie AW. Comparative industrial policy and cybersecurity: a framework for analysis. Journal of Cyber Policy 2018; 3:291–305.

Aggarwal VK and Reddie AW. Regulators join tech rivalry with national-security blocks on cross-border investment. Global Asia 2019; 14:40–7.

Aggarwal VK and Reddie AW. Cyber Industrial Policy in an Era of Strategic Competition, 2019. Available from: cltc.berkeley.edu/wp-content/uploads/2019/05/Cyber_Industrial_Policy.pdf.

Ahmed S. Credit cities and the limits of the social credit system. AI, China, Russia, and the global order: technological, political, global, and creative. JSTOR, 2018: 48.

Alemohammad S, Casco-Rodriguez J, Luzi L, Humayun AI, Babaei H, LeJeune D, Siahkoohi A, and Baraniuk RG. Self-consuming generative models go mad. arXiv preprint arXiv:2307.01850 2023.

Almog D. Cumulative deterrence and the war on terrorism. The US Army War College Quarterly: Parameters 2004; 34:1.

Ames MG. The Charisma Machine: The Life, Death, and Legacy of One Laptop per Child. Cambridge, MA: The MIT Press, 2019.

Anderson R. Why Information Security Is Hard – An Economic Perspective. Computer Security Applications Conference, 2001. Available from: https://www.acsac.org/2001/papers/110.pdf.

Antón AI and Hemmings J. Recognizing Vendor Risks to National Security in the CFIUS Process. LawFare, 2019.

APEC Policy Support Unit. Economic Impact of Submarine Cable Disruptions, 2012 12 Dec.

Arquilla J and Ronfeldt D. Cyberwar is coming! Comparative Strategy 1993; 12:141–65.

Bardach E and Patashnik EM. A Practical Guide for Policy Analysis: The Eightfold Path to More Effective Problem Solving. CQ Press, 2019.

Barlow JP. A Declaration of the Independence of Cyberspace. Electronic Book, 1996. Available from: homes.eff.org/~barlow/Declaration-Final.html.

Bartles CK. Getting gerasimov right. Military Review 2016; 96:30–8.

Bay S, Biteniece N, Bertolin G, Christie EH, Dek A, Fredheim RE, Gallacher JD, Kononova K, and Marchenko T. The Current Digital Arena and Its Risks to Serving Military Personnel. Riga: NATO Stratcom, 2019.

Ben-Atar DS. Trade Secrets: Intellectual Piracy and the Origins of American Industrial Power. Yale University Press, 2008.

Berman EP. Thinking Like an Economist: How Efficiency Replaced Equality in US Public Policy. Princeton University Press, 2022.

Biden J. Executive Order 14028-Improving the Nation’s Cybersecurity. Daily Compilation of Presidential Documents, 2021 5 May.

Blair DC, Chertoff M, Cilluffo FJ, and O’Connor N. Into the Gray Zone: The Private Sector and Active Defense against Cyber Threats. Technical report. Center for Cyber and Homeland Security, 2016. Available from: https://perma.cc/5RWZ-D39P.

Blank LR. Media Warfare, Propaganda, and the Law of War. Soft war: the ethics of unarmed conflict. Cambridge University Press, 2017:88–103.

Blank S. Cyber war and information war a la russe. Understanding Cyber Conflict: Fourteen Analogies. Washington, DC: Georgetown University Press, 2017: 1–18.

Blum A. Tubes : A Journey to the Center of the Internet. 1st ed. New York: Ecco, 2012. Available from: http://books.google.com/books?isbn=9780061994937.

Bojanc R and Jerman-Blažič B. An economic modelling approach to information security risk management. International Journal of Information Management 2008; 28:413–22.

Bond D. Inside GCHQ: the art of spying in the digital age. Financial Times, 2019 5 May 23.

Borghard ED and Schneider J. Israel responded to a Hamas cyberattack with an airstrike. That’s not such a big deal. Washington Post, 2019 5 May. Available from: https://perma.cc/5N6Z-LPHQ.

Brantly AF. The Decision to Attack: Military and Intelligence Cyber Decision-Making. University of Georgia Press, 2016.

Brodsky LN. How to Write a Policy Memo. Available from: https://perma.cc/6UUX-K37B.

Brown G. Spying and fighting in cyberspace: What is which. Journal of National Security Law and Policy 2015; 8:621.

Buchanan B. Mitigating the Cybersecurity Dilemma. The Cybersecurity Dilemma. Oxford University Press, 2017. Available from: https://www.oxfordscholarship.com/10.1093/acprof:oso/9780190665012.001.0001/acprof-9780190665012-chapter-9.

Buchanan B. The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics. Harvard University Press, 2020.

Burton M. Government Spying for Commercial Gain. Unclassified Extracts from Classified Studies - CIA 2007; 37(2).

Bush V. Science, The Endless Frontier. Princeton University Press, 2020.

Buzan B, Wæver O, and Wilde Jd. Security: A New Framework for Analysis. eng. Boulder, CO: Lynne Rienner Publishers, 1997.

Calabresi G and Smith S. On Tort Law’s Dualisms. Harv. L. Rev. F. 2022; 135.

Caltagirone S, Pendergast A, and Betz C. The diamond model of intrusion analysis. Standard, 2013.

Canada B. Combating Robot Networks and Their Controllers, 2010. Available from: https://perma.cc/NU8U-V7U3.

Center for Advanced Defense Studies (C4ADS). Lux and Loaded: Exposing North Korea’s Strategic Procurement Networks. Washington, DC, 2009.

Cheng D. Cyber Dragon: Inside China’s Information Warfare and Cyber Operations: Inside China’s Information Warfare and Cyber Operations. ABC-CLIO, 2016.

Chesney R and Smeets M, editors. Deter, Disrupt, or Deceive: Assessing Cyber Conflict as an Intelligence Contest. Georgetown University Press, 2023.

Cicero MT. (MT. De Officiis). Harvard University Press, 1913.

Clark DD. Designing an Internet. MIT, 2018.

Cole D. We Kill People Based on Metadata. The New York Review of Books, 2014; 10.

Conference Report on The National Defense Authorization Act for Fiscal Year 2013, Statute, 2012.

Connell M and Vogler S. Russia’s approach to cyber warfare (1rev). Technical report. Center for Naval Analyses Arlington United States, 2017.

Council NR. Strengthening Forensic Science in the United States: A Path Forward. Washington, DC: The National Academies Press, 2009:348. Available from: https://www.nap.edu/catalog/12589/strengthening-forensic-science-in-the-united-states-a-path-forward.

Cranor LF. A Framework for Reasoning about the Human in the Loop. Proceedings of the 1st Conference on Usability, Psychology, and Security. UPSEC’08. San Francisco, California: USENIX Association, 2008.

Cue E. French Riled by US Claims Of Industrial Espionage. CS Monitor, 1993.

Cunningham B, Grant J, and Hoofnagle CJ. Fighting Insider Abuse After Van Buren. LawFare, 2021.

Dai X. Toward a Reputation State: The Social Credit System of China. Unpublished Work, 2018.

Danzig R. Technology Roulette: Managing Loss of Control as Many Militaries Pursue Technological Superiority, 2018.

Davies W. Nervous States: Democracy and the Decline of Reason. New York: W.W. Norton Company, 2019.

Defense Intelligence Agency. Challenges to security in space, 2019. Available from: https://purl.fdlp.gov/GPO/gpo116298.

Defense Science Board Task Force on Computer Security. Security Controls for Computer Systems. Government Document, 1970.

Deibert RJ. Black code: Censorship, surveillance, and the militarisation of cyberspace. Millennium 2003; 32:501–30.

Deibert RJ and Rohozinski R. Risking security: Policies and paradoxes of cyberspace security. International Political Sociology 2010; 4:15–32.

Denning DE and Strawser BJ. Active cyber defense: Applying air defense to the cyber domain. Understanding Cyber Conflict: 14 Analogies. Edited by Perkovich G and Levite AE. Georgetown University Press, 2017.

Devanny J, Martin C, and Stevens T. On the strategic consequences of digital espionage. Journal of Cyber Policy 2021; 6:429–50.

Director of National Intelligence. What We Mean When We Say: An Explanation of Estimative Language, 2007.

Director of National Intelligence. Worldwide Threat Assessment of the US Intelligence Community. Government Document, 2019.

Eddy M and Perlroth N. Cyber attack suspected in German woman’s death. The New York Times, 2020; 18.

Edelman B. Adverse selection in online “trust” certifications. Proceedings of the 11th International Conference on Electronic Commerce, 2009:205–12.

Egloff F. Cybersecurity and the age of privateering. Understanding Cyber Conflict. Fourteen Analogies. Edited by Perkovich G and Levite AE. Georgetown University Press, 2017:231–47.

Eisenstadt M. Iran’s Lengthening Cyber Shadow. Washington Institute for Near East Policy, 2016.

El-Ghobashy T, Abi-Habib M, and Faucon B. France’s Special Forces Hunt French Militants Fighting for Islamic State; French citizens have been killed by Iraqi artillery and ground troops using location coordinates and other intelligence supplied by French forces during the battle to drive the extremist group from Mosul, Iraq. Wall Street Journal (Online), 2017.

Elmer-Dewitt P. First Nation in Cyberspace. Time Magazine, 1993 12 Dec.

Europol. IOCTA 2016 Internet Organised Crime Threat Assessment. Europol, 2016.

Europol. Dark web child abuse: Administrator of DarkScandals arrested in the Netherlands, 2020 3 Mar. Available from: https://perma.cc/RHJ5-FVW6.

Eykholt K, Evtimov I, Fernandes E, Li B, Rahmati A, Xiao C, Prakash A, Kohno T, and Song D. Robust Physical-World Attacks on Deep Learning Visual Classification. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018 6 Jun.

FTC v. Wyndham Worldwide Corp. 799 F.3d 236 (C.A.3), 2015.

Farrell H and Glaser CL. How effects, saliencies, and norms should influence U.S. cyberwar doctrine. Bytes, Bombs, and Spies: The Strategic Dimensions of Offensive Cyber Operations. Edited by Lin H and Zegart A. Brookings Institution Press, 2018.

Farrell H and Newman AL. Weaponized Interdependence: How Global Economic Networks Shape State Coercion. International Security, 2019; 44.

Federal Bureau of Investigation. FBI and Local Law Enforcement Seek Public’s Assistance Concerning Severed Fiber Optic Cables in the East Bay and South Bay. https://perma.cc/RN7D-MTQR, 2015 6 Jun.

Federal Bureau of Investigation. Clearances, 2017.

Fink E. Uber’s dirty tricks quantified: Rival counts 5,560 canceled rides. CNN Money, 2014.

Fischerkeller MP and Harknett RJ. Deterrence is not a credible strategy for cyberspace. Orbis 2017; 61:381–93.

Fischerkeller MP and Harknett RJ. Persistent Engagement, Agreed Competition, Cyberspace Interaction Dynamics, and Escalation, Standard, 2018.

Foreign Relations Authorization Act, Fiscal Years 1986 and 1987. Statute, 1985.

FTC v. D-Link Sys., Inc. N.D. Cal., No. 17-cv-00039, 2017.

Galeotti M. The ‘Gerasimov Doctrine’ and Russia non-linear war, 2014. Available from: https://inmoscowsshadows.wordpress.com/2014/07/06/the-gerasimov-doctrine-and-russian-non-linear-war/.

Garfinkel SL. Anti-forensics: Techniques, detection and countermeasures. 2nd International Conference on i-Warfare and Security. Volume 20087, 2007:77–84.

Garfinkel SL. Digital forensics research: The next 10 years. Digital Investigation 7(Suppl), 64–73. Digital Investigation, 2010; 7.

Garfinkel SL and Theofanos M. Non-Breach Privacy Events. Technology Science, 2018.

Gerasimov V. The Value of Science in Prediction. Military-Industrial Kurier, 2013; 27.

Gleick J. The Information : A History, A Theory, A Flood. 1st ed. New York: Pantheon Books, 2011. Available from: http://books.google.com/books?isbn=9780375423727.

Goldsmith J. U.S. Attribution of China’s Cyber-Theft Aids Xi’s Centralization and Anti-Corruption Efforts. LawFare, 2016.

Goldsmith J and Wu T. Who Controls the Internet?: Illusions of a Borderless World. Oxford University Press, 2006.

Gordon LA and Loeb MP. The economics of information security investment. ACM Transactions on Information and System Security 2002; 5:438–57.

Gordon S and Rosenbach E. America’s Cyber Reckoning. Foreign Affairs, 2022 1 Jan.

Gorman S, Dreazen Y, and Cole A. Insurgents Hack U.S. Drones. Wall Street Journal 2009 12 Dec.

Greenberg A. Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin’s Most Dangerous Hackers. 1st ed. New York: Doubleday, 2019.

Greenhill K. Kleptocratic Interdependence: Trafficking, Corruption, and the Marriage of Politics and Illicit Profits. Corruption, Global Security, and World Order. Washington, DC : Brookings Institution Press, 2009 :96–6.

Grossman T, Kaminska M, Shires J, and Smeets M. The Cyber Dimensions of the Russia-Ukraine War. https://perma.cc/VE2Q-ZNFT, 2023.

Gupta C. The Market’s law of privacy: Case studies in privacy and security adoption. IEEE Security & Privacy 2017; 15:78–83.

Handel MI. Leaders and Intelligence. Leaders and Intelligence. Routledge, 2012:3–39.

Harmon AM, Kilburn K, and Macleod MD. Lucian. Cambridge, MA: Harvard University Press, 1913.

Harris RG and Carman JM. Public regulation of marketing activity: Part II: Regulatory responses to market failures. Journal of Macromarketing 1984; 4:41–52.

Healey J. A Fierce Domain; Conflict in Cyberspace 1986 to 2012. Cyber Conflict Studies Association, 2013.

Healey J. The cartwright conjecture: The deterrent value and escalatory risk of fearsome cyber capabilities. Bytes, Bombs, and Spies: The Strategic Dimensions of Offensive Cyber Operations. Edited by Lin H and Zegart A. Brookings Institution Press, 2018.

Herley C. So Long, and No Thanks for the Externalities: the Rational Rejection of Security Advice by Users. NSPW Oxford 2009. Available from: http://www.ists.dartmouth.edu/docs/ecampus/2010/herley_ecampus2010.pdf.

Herman M. Intelligence Power in Peace and War. Cambridge University Press, 1996.

Herr T and Ormes E. Understanding Information Assurance. Cyber Insecurity. Edited by Harrison RM and Herr T. Roman and Littlefield, 2016.

Heuer RJ. Psychology of intelligence analysis. Center for the Study of Intelligence, 1999. Available from: https://perma.cc/N534-CYVP.

Hildebrandt M. Balance or trade-off? Online security technologies and fundamental rights. Philosophy and Technology 2013; 26:357–79.

Hill K. The Secretive Company That Might End Privacy as We Know It, 2020 1 Jan.

Hill K and Krolik A. How photos of your kids are powering surveillance technology. The New York Times, 2019.

Hoffman D. The Dead Hand: The Untold Story of the Cold War Arms Race and its Dangerous Legacy. Anchor, 2009.

Hoofnagle CJ. The Origin of Fair Information Practices: Archive of the Meetings of the Secretary’s Advisory Committee on Automated Personal Data Systems (SACAPDS). Unpublished Work, 2014.

Hoofnagle CJ. Federal Trade Commission Privacy Law and Policy. Cambridge University Press, 2016.

Hoofnagle CJ and Garfinkel SL. Quantum Cryptanalysis: Hype and Reality. Lawfare: Hard National Security Choices, 2022 2 Feb. Available from: https://www.lawfareblog.com/quantum-cryptanalysis-hype-and-reality.

Hoofnagle CJ and Whittington J. Free: accounting for the costs of the internet’s most popular price. UCLA L. Rev. 2013; 61:606.

Hoofnagle CJ, Altaweel I, Cabrera J, Choi HS, Ho K, and Good N. Online pharmacies and technology crime. The Routledge Handbook of Technology, Crime and Justice. Routledge, 2017:146–60.

Huawei Cyber Security Evaluation Centre (HCSEC) Oversight Board. A report to the National Security Adviser of the United Kingdom. Government Document, 2019.

Ignatius D. Russia’s radical new strategy for information warfare, 2017 1 Jan.

In the Matter of Zoom Video Communications, Inc. A corporation, d/b/a Zoom, No. 192 3167 (Final complaint), 2021.

In the Matter of Zoom Video Communications, Inc. A corporation, d/b/a Zoom, No. 192 3167 (Decision and Order), 2021.

Jamieson KH. Cyberwar: How Russian Hackers and Trolls Helped Elect a President—What We Don’t, Can’t, and Do Know. Oxford University Press, 2018.

Jampen D, Gür G, Sutter T, and Tellenbach B. Don’t click: towards an effective anti-phishing training. A comparative literature review. Human-centric Computing and Information Sciences 2020; 10:1–41.

Janofsky A. When Paying a Ransom is the Best Way Out. Wall Street Journal, 2019 6 Jun.

Jervis R. Cooperation Under the Security Dilemma. World Politics 1978; 30:167–214. Available from: www.jstor.org/stable/2009958.

Jervis R. Why Intelligence Fails: Lessons from the Iranian Revolution and the Iraq War. Cornell University Press, 2010.

Kahn H. On Escalation: Metaphors and Scenarios. Hudson Institute. Series on National Security and International Order, no. 1. New York: Praeger, 1965.

Kahn D. The annotated the American Black Chamber. Cryptologia 1985; 9:1–37.

Kahn D. The Codebreakers: The Comprehensive History of Secret Communication from Ancient Times to the Internet. Simon and Schuster, 1996.

Kan PR. Dark International Relations: When Crime is the “Dime”. War Room, 2019 7 Jul.

Kaplan F. Dark Territory: The Secret History of Cyber War. Simon and Schuster, 2016.

Kello L. Cyber legalism: Why it fails and what to do about it. Journal of Cybersecurity 2021; 7:1–15.

Kesari A. Predicting cybersecurity incidents with machine learning and mandatory disclosure regulation. Journal of Law, Technology & Policy 2022; 2022:57–118.

Kesari A, Hoofnagle C, and McCoy D. Deterring cybercrime: Focus on intermediaries. Berkeley Tech. LJ 2017; 32:1093.

Klimburg A. The Darkening Web: The War for Cyberspace. Penguin, 2018.

Knake RA and Clarke RA. The Fifth Domain: Defending Our Country, Our Companies, and Ourselves in the Age of Cyberthreats. Penguin Press, 2019.

Koller JS. The Future of Ubiquitous, Realtime Intelligence: A GEOINT Singularity. Center for Space Policy and Strategy, 2019.

Korzak E. Export controls: The Wassenaar experience and its lessons for international regulation of cyber tools. Routledge Handbook of International Cybersecurity. Routledge, 2020:297–311.

Korzak E. Russia’s Cyber Policy Efforts in the United Nations. Tallinn Paper No. 11, 2021.

Kramer DB and Fu K. Cybersecurity concerns and medical devices: Lessons from a pacemaker advisory. Jama 2017; 318:2077–8.

Krebs B. Spam Nation: The Inside Story of Organized Cybercrime-From Global Epidemic to Your Front Door. Sourcebooks, Inc., 2014.

Kreps S and Schneider J. Escalation firebreaks in the cyber, conventional, and nuclear domains: moving beyond effects-based logics. Journal of Cybersecurity 2019; 5:tyz007.

LabMD, Inc. v. F.T.C., 776 F.3d 1275, 1278 (C.A.11), 2015.

LaBranche NN. The economic loss doctrine & data breach litigation: Applying the “venerable chestnut of tort law” in the age of the Internet. BCL Rev. 2021; 62:1665.

Landau S. Listening in: Cybersecurity in an Insecure Age. Yale University Press, 2017.

Langbroek M. Image from Trump tweet identified as imagery by USA 224, a classified KH-11 ENHANCED CRYSTAL satellite — sattrackcam.blogspot.com. https://sattrackcam.blogspot.com/2019/09/image-from-trump-tweet-identified-as.html, 2019.

Lapsley P. Exploding the Phone: The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell. Grove Press, 2013.

Lapsley P. The definitive story of Steve Wozniak, Steve Jobs, and phone phreaking. The Atlantic, 2013.

Lawson L. Truth in Publishing: Federal Regulation of the Press’s Business Practices, 1880–1920. Southern Illinois University Press, 1993.

League of Nations, International Convention Concerning the Use of Broadcasting in the Cause of Peace, Statute, 1936.

Leiner BM, Cerf VG, Clark DD, Kahn RE, Kleinrock L, Lynch DC, Postel J, Roberts LG, and Wolff S. A brief history of the Internet. ACM SIGCOMM Computer Communication Review 2009; 39:22–31.

Levine DS and Seaman CB. The DTSA at one: An Empirical Study of the First Year of Litigation under the Defend Trade Secrets Act. Wake Forest Law Review 2018; 53:105.

Levy S. Hackers: Heroes of the Computer Revolution. Volume 14. New York: Anchor Press/Doubleday Garden City, 1984.

Liang Q and Xiangsui W. Unrestricted Warfare. PLA Literature and Arts Publishing House, 1999.

Libicki MC. What is Information Warfare? National Defense University, 1995.

Libicki MC. Conquest in Cyberspace: National Security and Information Warfare. Cambridge University Press, 2007.

Libicki MC. Cyberdeterrence and Cyberwar. RAND, 2009.

Lin H. Attribution of Malicious Cyber Incidents: From Soup to Nuts, 2016 9 Sep.

Lindsay JR. The impact of China on cybersecurity: Fiction and friction. International Security 2014; 39:7–47.

Lindsay JR. Restrained by design: the political economy of cybersecurity. Digital Policy, Regulation and Governance 2017; 19:493–514.

Liu Z, Lin C, and Chen G. Space attack technology overview. Journal of Physics: Conference Series 2020; 1544:012178.

Lloyds of London. Business blackout, 2015.

Machiavelli N. The Prince (WK Marriott Trans.), 1908.

Mandiant. APT1: Exposing One of China’s Cyber Espionage Units, 2013.

Manjikian MM. From global village to virtual battlespace: The colonizing of the internet and the extension of realpolitik. International Studies Quarterly 2010; 54:381–401.

Marks P. Google usability chief: Ideas have to be discoverable. New Scientist, 2011 11 Nov.

Martínez AG. Chaos Monkeys: Obscene Fortune and Random Failure in Silicon Valley. HarperCollins, 2016.

Mattis J. Summary of the 2018 national defense strategy of the United States of America. Technical report. Department of Defense Washington United States, 2018.

Matyszczyk C. Zuckerberg claims more Facebook sharing leads to world peace, 2016 2 Feb.

Mazzucato M. The Entrepreneurial State: Debunking Public vs. Private Sector Myths. Anthem Press, 2013.

McCoy D, Pitsillidis A, Jordan G, Weaver N, Kreibich C, Krebs B, Voelker GM, Savage S, and Levchenko K. Pharmaleaks: Understanding the business of online pharmaceutical affiliate programs. Proceedings of the 21st USENIX Conference on Security Symposium, 2012.

Meertens RM and Lion R. Measuring an individual’s tendency to take risks: the risk propensity scale 1. Journal of Applied Social Psychology 2008; 38:1506–20.

Metzler J. Security Implications of 5G Networks. UC Berkeley Center for Long-term Cybersecurity, 2020.

Miller SE. Cyber threats, nuclear analogies? Divergent trajectories in adapting to new dual-use technologies. Understanding Cyber Conflict: Fourteen Analogies. Edited by Perkovich G and Levite AE, 2017:161–79.

Mitnick K. Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker. Hachette UK, 2011.

Mitnick KD and Simon WL. The Art of Deception: Controlling the Human Element of Security. Indianapolis, Indiana: Wiley Publishing, Inc., 2002.

Mitroff II. Technology Run Amok: Crisis Management in the Digital Age. Palgrave MacMillan, 2019.

Muddy Waters Capital. MW is Short St. Jude Medical, 2016.

Mueller M, Grindal K, Kuerbis B, and Badiei F. Cyber attribution. The Cyber Defense Review 2019; 4:107–22.

Mulligan DK and Schneider FB. Doctrine for Cybersecurity. DÆDALUS, 2011; 140. Available from: http://www.cs.cornell.edu/fbs/publications/publicCYbersecDaed.pdf.

Nakashima E. Dismantling of Saudi-CIA Web site illustrates need for clearer cyberwar policies, 2010 3 Mar. Available from: https://perma.cc/L4PY-XVHN.

Nakashima E and Goldman A. CIA pulled offices from Beijing after breach of Federal personnel records. Washington Post, 2015.

National Academies of Sciences. At the Nexus of Cybersecurity and Public Policy. United States of America: National Academies of Sciences, 2014.

National Center for Education Statistics (NCES). Program for the International Assessment of Adult Competencies (PIAAC), 2017.

National Conference of State Legislatures. Computer Crime Statutes, 2022. Available from: https://perma.cc/X3HW-L6QR.

National Consumer Council. Models of Self-Regulation, 2000 11 Nov. Available from: https://perma.cc/VMX9-84L9.

National Consumer Law Center. Consumer Protection in the States: A 50 State Evaluation of Unfair and Deceptive Practices Law, 2018. Available from: https://perma.cc/H99L-R8AC.

National Counterintelligence and Security Center. China’s Collection of Genomic and Other Healthcare Data from America, 2021 3 Mar. Available from: https://perma.cc/R35P-C7CL.

National Defense Authorization Act for Fiscal Year 2013. Statute, 2012.

National Security Agency. Limiting Location Data Exposure, 2020 8 Aug.

New York AG of Fake Comments: How U.S. Companies and Partisans Hack Democracy to Undermine Your Voice, 2021 5 May. Available from: https://perma.cc/L8AC-E577.

Nissenbaum H. Where computer security meets national security. Ethics and Information Technology 2005; 7:61–73.

Nye JS. The Future of Power. New York: PublicAffairs, 2011.

Nye JS. Cyber Power, 2010.

Obama B. Executive Order 13587–Structural Reforms To Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information. Daily Compilation of Presidential Documents, 2011.

Obama B. Executive Order 13691-Promoting Private Sector Cybersecurity Information Sharing. Daily Compilation of Presidential Documents, 2015 2 Feb.

Office of the California Attorney General. California Data Breach Report, 2016. Available from: https://perma.cc/52Y7-3VNF.

Office of the Director of National Intelligence. Assessing Russian Activities and Intentions in Recent US Elections, Government Document, 2017.

Olson JM. Fair Play: The Moral Dilemmas of Spying. Potomac Books, Inc., 2006.

Olson P. We Are Anonymous. Random House, 2013.

Oqubay A. Climbing without Ladders: Industrial Policy and Development. Made in Africa. Oxford University Press, 2015.

Ostrom E. A general framework for analyzing sustainability of social-ecological systems. Science 2009; 325:419–22. Available from: http://www.jstor.org/stable/20536694.

Ostrom E, Burger J, Field CB, Norgaard RB, and Policansky D. Revisiting the commons: Local lessons, global challenges. Science 1999; 284:278–82. Available from: http://www.jstor.org/stable/2898207.

Perla E and Oldani M. A Guide to Kernel Exploitation: Attacking the Core. Elsevier, 2010.

Perlroth N. This Is How They Tell Me the World Ends: The Cyberweapons Arms Race. eng. London: Bloomsbury Publishing Plc, 2021.

Perrin L. Partitions in the S-Box of Streebog and Kuznyechik. Cryptology ePrint Archive, Paper 2019/092, 2019. Available from: https://eprint.iacr.org/2019/092.

Peterson S and Faramarzi P. Exclusive: Iran hijacked US drone, says Iranian engineer. Christian Science Monitor 2011 12 Dec 15. Available from: www.csmonitor.com/World/Middle-East/2011/1215/Exclusive-Iran-hijacked-US-drone-says-Iranian-engineer.

Pfanner E. Italian appeals court acquits 3 Google executives in privacy case. The New York Times, 2012.

Plutarch. Lives. Agis and Cleomenes, Tiberius and Caius Gracchus, Philopoemen and Flamninius, Vol. 10. Loeb Classical Library. Heinemann, 1921.

Postman N. Crazy Talk, Stupid Talk: How We Defeat Ourselves by the Way We Talk and What to do About It. New York: Delacorte Press, 1976.

Poulsen K. Kingping: How One Hacker Took Over the Billion-Dollar Cybercrime Underground. Crown, 2011.

Prevelakis V and Spinellis D. The Athens affair. IEEE Spectrum 2007; 44:26–33.

Prier J. Commanding the trend: Social media as information warfare. Strategic Studies Quarterly 2017; 11:50–85. Available from: http://www.jstor.org/stable/26271634.

Protocol Additional to the Geneva Conventions of 12 August 1949, and Relating to the Protection of Victims of Non-International Armed Conflicts (Protocol II), 1125 UNTS 609. Entered into force Dec. 7, 1977, 1978.

Rabkin J and Yoo J. Striking Power: How Cyber, Robots, and Space Weapons Change the Rules for War. Encounter Books, 2017.

Rajagopalan RP. Electronic and Cyber Warfare in Outer Space. Government Document, 2019.

Rao JM and Reiley DH. The economics of spam. Journal of Economic Perspectives 2012; 26:87–110.

Reagan R. Assignment of national security and emergency preparedness telecommunications functions: Executive Order 12472, April 3, 1984 [establishing the National Communications System]. eng. Weekly Compilation of Presidential Documents 1984; 20:467–73.

Reardon J. The curious case of coulus coelib, 2022 4 Apr. Available from: https://perma.cc/7G2F-SLM2.

Remijas v. Neiman Marcus Group, LLC. 794 F.3d 688, United States Court of Appeals, Seventh Circuit, 2015.

Rid T. Cyber war will not take place. Journal of Strategic Studies 2012; 35:5–32.

Rid T. Active Measures: The Secret History of Disinformation and Political Warfare. New York: Farrar, Straus and Giroux, 2020.

Rid T and Buchanan B. Attributing cyber attacks. Journal of Strategic Studies 2015; 38:4–37.

Rittel HWJ and Webber MM. Dilemmas in a general theory of planning. Policy Sciences 1973; 4:155–69.

Robertson J and Riley M. The big hack: How China used a tiny chip to infiltrate U.S. Companies. Bloomberg News, 2018 10 Oct.

Romanosky S and Herr T. Understanding cyber crime. Cyber Insecurity. Edited by Harrison RM and Herr T. Roman and Littlefield, 2016.

Romanosky S, Ablon L, Kuehn A, and Jones T. Content analysis of cyber insurance policies: How do carriers price cyber risk? Journal of Cybersecurity 2019; 5:tyz002.

Rosenbach E, Peritz AJ, and LeBeau H. Confrontation or Collaboration?: Congress and the Intelligence Community. Harvard Kennedy School, Belfer Center for Science and International Affairs, 2009.

Rosenzweig P. The organization of the United States Government and private sector for achieving cyber deterrence. Deterring Cyber Attacks: Informing Strategies and Developing Options for it US Policy. National Research Council, 2010.

Rosenzweig P. Cyber warfare: how conflicts in cyberspace are challenging America and changing the world. ABC-CLIO, 2013.

Rosenzweig P. Turns Out It Is Not 85 Percent. LawFare, 2023.

Rovner J. The elements of an intelligence contest. Deter, Disrupt, or Deceive: Assessing Cyber Conflict as an Intelligence Contest. Edited by Chesney R and Smeets M. Georgetown University Press, 2023.

Rumsfeld DH. DoD News Briefing - Secretary Rumsfeld and Gen. Myers, 2002 2 Feb.

Safire W. The Farewell Dossier. New York Times, 2004 2 Feb.

Sageman M. The next generation of terror. Foreign policy, 2008:37.

Sanger DE. The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age. Crown, 2018.

Sanger DE and Fackler M. NSA Breached North Korean Networks Before Sony Attack, Officials Say. New York Times, 2015 1 Jan.

Savage C, Miller C, and Perlroth N. NSA said to tap Google and Yahoo abroad. The New York Times, 2013 10 Oct:10–30.

Schell RR. Computer security: the Achilles’ heel of the electronic Air Force? Air University Review 1979; 30:16–33.

Schelling TC. The Strategy of Conflict. Harvard University Press, 1980.

Schelling TC. Arms and Influence. Yale University Press, 1995.

Schmidle Jr R, Sulmeyer M, and Buchanan B. Nonlethal weapons and cyber capabilities. Understanding Cyber Conflict: 14 Analogies, 2017:31–44.

Schmitt MN. Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. 2nd ed. Cambridge University Press, 2017.

Schneider JG. Deterrence in and through Cyberspace. Cross-Domain Deterrence, 2019:95–120.

Schneier B. Beyond Fear: Thinking Sensibly About Security in an Uncertain World. eng. New York: Copernicus Books, 2003.

Schneier B. Inside the twisted mind of the security professional. Wired Magazine, 2008 3 Mar.

Schneier B. The psychology of security. International Conference on Cryptology in Africa. Springer, 2008:50–79.

Schneier B. Data and Goliath : The Hidden Battles to Collect Your Data and Control Your World. 1st ed. New York: W.W. Norton & Company, 2015.

Schneier B. Secrets and Lies: Digital Security in a Networked World, 15th Anniversary Edition. Wiley, 2015.

Sciutto J. A Vulnerable U.S. Really Does Need a Space Force; China and Russia are developing new weapons that can attack crucial American satellites, and the U.S. has been slow to respond to the danger. The Wall Street Journal, 2019.

Scott J. C. Seeing Like a State: How Certain Schemes to Improve the Human Condition Have Failed. Yale, 1999.

Severin A. Keeping up with China: CFIUS and the need to secure material nonpublic technical knowledge of AI/ML. Duke L. & Tech. Rev. 2021; 19:59.

Shan S, Ding W, Passananti J, Zheng H, and Zhao BY. Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models, 2023. arXiv: 2310.13828 [cs.CR].

Shane S. The enduring influence of Anwar Al-Awlaki in the age of the Islamic State. CTC Sentinel 2016; 9:15–9.

Shannon CE. A mathematical theory of communication. The Bell System Technical Journal 1948; 27:379–423.

Shapiro C and Varian HR. Information Rules: A Strategic Guide to the Network Economy. Harvard Business Press, 1998.

Sharif M, Bhagavatula S, Bauer L, and Reiter MK. Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition. CCS ’16. Vienna, Austria: Association for Computing Machinery, 2016.

Sherman J. Data Brokers and Sensitive Data on US Individuals. Duke University Sanford Cyber Policy Program, 2021; 9.

Shostack A. Threat Modeling: Designing for Security. John Wiley & Sons, 2014.

Shostack A and Stewart A. The New School of Information Security. Pearson Education, 2008.

Simitian J. UCB security breach notification symposium: March 6, 2009 how a bill becomes a Law, Really. Berkeley Technology Law Journal 2009; 24:1009–17.

Smith RE. Ben Franklin’s web site: Privacy and curiosity from Plymouth Rock to the Internet. Privacy Journal, 2000.

Smith B and Browne CA. Tools and Weapons: The Promise and the Peril of the Digital Age. Penguin, 2021.

Sola Pool I de. Technologies of Freedom. Cambridge, MA: Harvard University Press, 1983.

Spiekermann S. Ethical IT Innovation : A Value-Based System Design Approach. Boca Raton, FL: CRC Press, 2016.

Sreeharsha V. WhatsApp is briefly shut down in Brazil for a third time. New York Times, 2016 7 Jul 19.

Standage T. The Victorian Internet : The Remarkable Story of the Telegraph and the Nineteenth Century’s On-Line Pioneers. New York: Walker and Co., 1998.

Steed D. The Politics and Technology of Cyberspace. Modern Security Studies. Abingdon, Oxon: Routledge, Taylor and Francis Group, 2019.

Stoll C. The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage. Doubleday, 1989.

Stone B. U.S. informant helped run theft ring. Seattle Times, 2008 8 Aug.

The White House. National Cybersecurity Strategy, 2023. Available from: https://perma.cc/3PHN-QBTJ.

Thucydides. The Landmark Thucydides: A Comprehensive Guide to the Peloponnesian War. Edited by Strassler RB. Simon and Schuster, 1998.

Tucker P. China’s Disinformation Warriors May Be Coming for Your Company. A recent attack on a rare-earths processor shows a new facet of information warfare: weaponized NIMBYism. Defense One, 2022 6 Jun. Available from: https://perma.cc/T6FB-S3Z4.

Turner F. From Counterculture to Cyberculture: Stewart Brand, the Whole Earth Network, and the Rise of Digital Utopianism. University of Chicago Press, 2010.

U.S. Electronic Espionage: A Memoir. Ramparts, Vol. 11 no. 2, August 1972. Berkeley, CA, Ramparts Magazine, 1972.

United States Information and Educational Exchange Act of 1948. Statute, 1948.

US Department of State. Soviet Influence Activities: A Report on Active Measures and Propaganda, 1986–87. Government Document, 1987.

Valeriano B and Maness RC. Cyber War Versus Cyber Realities: Cyber Conflict in the International System. USA: Oxford University Press, 2015.

Verbruggen M and Boulanin V. Mapping the development of autonomy in weapon systems, 2017.

Von Clausewitz C. On War. Princeton University Press, 2008.

Wæver O. Securitization and Desecuritization. Centre for Peace and Conflict Research Copenhagen, 1993.

Wall AE. Demystifying the title 10-title 50 debate: Distinguishing military operations, intelligence activities & covert action. Harv. Nat’l Sec. J. 2011; 3:85.

Ware W. Security Controls for Computer Systems. Rand Corporation for the Office of the Director of Defense Research and Engineering, 1970.

Wassenaar Arrangement. Statement issued by the plenary chair on 2019 Outcomes of the Wassenaar Arrangement on export controls for conventional arms and dual-use goods and technologies. Vienna, 5 December 2019, 2019.

Weber S. Coercion in cybersecurity: What public health models reveal. Journal of Cybersecurity 2017; 3:173–83.

Weber S. Bloc by Bloc: How to Build a Global Enterprise for the New Regional Order. Harvard University Press, 2019.

White House. Vulnerabilities equities policy and process for the United States government. White House Report, 2017.

Whitten A and Tygar JD. Why Johnny can’t encrypt: A usability evaluation of PGP 5.0. In Proceedings of the 8th USENIX Security Symposium, 1999.

Wilner AS. US cyber deterrence: Practice guiding theory. Journal of Strategic Studies 2020; 43:245–80.

Winner L. Do artifacts have politics? Daedalus 2018; 109:1:121–36.

Wolff J. Cyberinsurance Policy: Rethinking Risk in an Age of Ransomware, Computer Fraud, Data Breaches, and Cyberattacks. MIT Press, 2022.

Wong E. Russia secretly gave $300 million to political parties and officials worldwide, U.S. says. New York Times, 2022 9 Sep.

Yadron D. Iranian Hackers Infiltrated New York Dam in 2013: Cyberspies had access to control system of small structure near Rye in 2013, sparking concerns that reached to the White House. Wall Street Journal, 2015 12 Dec.

Yardley HO. The American Black Chamber. Bobbs-Merrill, 1931.

Zetter K. Countdown to Zero Day : Stuxnet and the Launch of the World’s First Digital Weapon. 1st ed. New York: Crown Publishers, 2014.

Zimmerman EJ. The foreign risk review modernization act: How CFIUS became a tech office. Berkeley Technology Law Journal, 2020; 34:1267–1304.

Zuboff S. Big other: surveillance capitalism and the prospects of an information civilization. Journal of Information Technology 2015; 30:75–89.

Index

SYMBOLS

5G and cybersecurity 403

A

Abbott Labs pacemakers 270

Able Archer 83, 217

access controls 379

access devices 295

active defense 421

active measures 44, 235

Advanced Persistent Threats (APTs) 407

Aerojet Rocketdyne 355

agent provocateurs 50

Aggarwal, Vinod 453

agreed competition 213

air-gapped systems 177

al-Awlaki, Anwar 49, 177, 458

al-Qaeda 458

American Registry for Internet Numbers (ARIN) 102

America Online 6

Anderson, Ross 112

anonymizing overlay network 100

Anonymous (hacking group) 208, 210

anti-forensics 97

anti-ICBM defenses 217

anti-satellite (ASAT) weapons 173

antitrust 361

Apple Computer 101, 453

iMessage 81

application-layer attacks 75

APT1, 371

Aquinas, St. Thomas 156

Arab Spring revolutions 234

armed attack 334

Arquilla, John 153

artificial intelligence 467, 468. see also machine learning

Assange, Julian 208

asset specificity 359

asymmetric advantage 56, 211

Athens Affair 455

attack/defense balance 116

attack surface 345

ATT&CK409

attribution26

false flags 92

human 91

machine 91

party 92

technical 91

Aurelius, Marcus 256

Aurora Generator Test 334, 336

authentication feature 294

authoritarians’ access to personal data 328

Automated Indicator Sharing (AIS) 342

AIS Portal 364

automated securities trading 437

autonomous servers 73

B

Baker, Stewart 64

ballot secrecy 204

Bardach, Eugene 444

Barlowism 237, 241, 397, 452

Barlow, John Perry 238, 476

Bartles, Charles 235

basic subscriber information 323

behavioral economics 127

below threshold attacks 158, 162, 171, 205, 213

BGP attacks 73

Bin Laden, Osama 210

Bitcoin 293

Bittorrent 411

body-wide networks 7

Border Gateway Protocol (BGP) 73

bot attribution 55

Botfrei 232

Buchanan, Ben 91, 218, 401

Budapest Convention 327

bulletproof services 317

Bureau of Industry and Security 406

business judgment rule 436

C

Calabresi, Guido 256

Canadian pharmacies 286

Carnegie Endowment for International Peace 209

cash out 283

Cassandra 153, 223

castle walls approach 338

Center for Internet Security Critical Security Controls 267–268

Central Intelligence Agency (CIA) 121, 176

certificate authority 67, 122

Charlie Hebdo 322

Chemical Facility Anti-Terrorism Standards (CFATS) 351

child sexual abuse material (CSAM) 34, 94, 282

China 370, 402

IP attacks 370

Cicero 233

Cisco 122

Clapper, James 181

Clarifying Lawful Overseas Use of Data (CLOUD) Act 327

Clark, David 16, 60, 86, 118, 443

Clarke, Ian 100

Clarke, Richard 118, 153

cloud computing 143

Cloudflare 74, 122

club goods 230

Cole, David 64

Colonial Pipeline attack 336, 338, 343

Commerce Control List (CCL) 406

commercial espionage 372

Committee on Foreign Investment in the United States (CFIUS) 121, 404

common pool resource (CPR) 226

Communications Decency Act §230 386

CompTIA 93

Computer Crime and Intellectual Property Section (CCIPS) 121, 287

computer extortion 14

Computer Fraud and Abuse Act (CFAA) 297

computer network attack (CNA) 39, 183

computer network exploitation (CNE) 39, 151, 183

confidentiality-integrity-availability (CIA) triad 12

content/non-content divide 320

contextual threat information 361

contractors as belligerents 164

Convention on Cybercrime 460

copy controls 379

copyright law 379

Corn, Gary 222

cost-benefit analysis 22, 255

counter-commander 46

counter-force 39, 46, 144, 160

counter forensics 97

counter-value 39, 49, 143, 160

counter-will 46

credential stuffing 412

critical infrastructure 225

CIP Reliability Standards 350

cross-domain deterrence 86

Crypto AG 336

cryptocurrency 292

tumbling services 293

cryptology 32

Advanced Encryption Standard (AES) 30

Caesar cipher 28

cryptanalysis 32

cryptographic hashes 33

cryptosystem 28

Data Encryption Standard (DES) 29

digital signatures 34

elliptic curve cryptography 32

Enigma 28

hash collision 34

hashing 33

one-time pad 37

private key cryptography 30

public key cryptography 31

RSA 30

scytales 28

substitution cipher 28

symmetric cryptography 30

Cuckoo’s Egg 177

Cyber Command 121

cyber hotline 218

Cyber Incident Reporting for Critical Infrastructure Act of 2022, 343

Cyber Kill Chain 409

cyberpower 37

Cyber Safety Review Board 339

cybersecurity

collective interests 21

context 4

definitions 5

Cybersecurity and Infrastructure Security Agency (CISA) 335, 342

Cybersecurity Capability Maturity Model (C2M2) 350

Cybersecurity Information Sharing Act of 2015 (CISA) 325, 358, 361

cybersecurity insurance 437

Cybersecurity Maturity Model Certification (CMMC) 355

cyberspace 5

as physical place 8

placeless paradox 10

cyberstalking 311

cyber terrorism 331

cyber threat indicators (CTI) 364

D

Danzig, Richard 172

dark fiber 73

dark web 292

DARPA452

datagrams 62

data localization 69, 329, 405

Daubert standard 90

deep packet inspection 63

defend forward and persistent engagement 171

Defend Trade Secrets Act (DTSA) 373

Defense Advanced Research Projects Agency (DARPA) 60

Defense Federal Acquisition Regulation Supplement (DFARS) 355

defense in depth 212, 338

Defense Industrial Base (DIB) 164, 355

Deibert, Ronald 245

denial-of-service attack 282

Department of Defense 5

contractors 355

design basis threat 351

de Sola Pool, Ithiel 238

deterrence

asset specificity 201

attacker advantage 212

attribution problem 203

automaticity 205

benefits denial 199

compellence 198, 207

cost imposition 199, 203

credibility 200

cross-domain deterrence 204

denial of benefits 203

dishonest signaling 202

entanglement 207

general deterrence 199

honest signaling 202

loud organizations 202

loud shouts 202

persistent engagement 199, 213, 215

punishment 199

quiet threat 203

specific deterrence 199

strategic irrationality 205

symmetric counter 203

threats 199

DIANA one-time pad 35

diesel generator cyberattack 334

digital abuse 311, 385

digital forensics 34

Digital Geneva Convention 209

Digital Millennium Copyright Act (DMCA) 379

takedown 387

digital natives 134

disharmony 51

disinformation 235

history 41

disruption, denial, degradation, destruction, deception (D5) 165

distinction, proportionality, and necessity 160

Domain Name System (DNS) 65

root 65

D order 323, 328

drones 174

dual criminality 327

Dyadic Cyber Incident and Dispute Dataset (DCID) 152–153

E

economic sanctions 290

e-crimes unit 287

Eightfold Path for Policy Analysis 444

Electronic Espionage Act (EEA) 375, 378

Electronic Frontier Foundation (EFF) 239

electronic warfare (EW) 72, 155

Encrochat 292

encryption 28

backdoors 454

consumer availability 81

countermeasures 82

by default 453

democratization in access 81

exceptional access 454

going dark problem 454

outer space 82

endpoint security model 16

entrepreneurial state 452

Equifax Breach 178

escalation ladder 219

EternalBlue 178

European Convention of Human Rights (ECHR) 23

European Cybercrime Centre (EC3) 284, 287

European General Data Protection Regulation (GDPR) 417

evolution of security 20

exceptional access 454

excludable goods 230

ex parte requests 319

Export Administration Regulations (EAR) 121, 406

export control 406

F

Facebook social contagion 415

False Claims Act 355

Farook, Syed Rizwan 454

Farrell, Henry 145, 209

Federal Bureau of Investigation (FBI) 120, 287, 320

Federal Communications Commission (FCC) 81, 415

Federal Energy Regulatory Commission (FERC) 350

Federal Trade Commission (FTC) 121

Fertik, Michael 388

Financial Services Modernization Act of 1999 425

fingerprint forensics 90

fintech 283

first to market 113

Fischerkeller, Michael P.199, 213

Five Eyes (FVEY) 185

Foreign Intelligence Surveillance Act (FISA) 188, 329

Section 702, 189, 329

selectors 189

foreign ownership risks 14

forensic science 90

Fourth Amendment 316

fourth-party capture 98

freedom infringement impact assessments 22

Freenet 100

G

Garfinkel, Simson 415

generative AI (GAI) 468

geofence warrant 313

GEOINT Singularity 170

Gerasimov Doctrine 234

Gerasimov, Valery 234

GIAC93

Global Navigation Satellite System (GLONASS) 174

Global Positioning System (GPS) 173

Goldsmith, Jack 372

Google 369, 458

Google dorking 399

Google Street View 415

government action requirement 316

Gramm Leach Bliley Act (GLBA) 425

grand jury subpoena 319

gray zone 162

Greenhill, Kelly 288

Griffith, Virgil 285

Grindr 14, 405

Guardians of Peace 400

H

hacker 283

hacking back 421

harassment and abuse 385

Harknett, Richard J. 199, 213

Harris, Kamala 267

Hasdrubal 156

haveibeenpwned 411

Hayden, Michael 64

Healey, Jason 106, 202

Health Information Technology for Economic and Clinical Health Act (HITECH) 415

Health Insurance Portability and Accountability Act (HIPAA) 415

Herley, Cormac 138

Heuer, Richards J. 137, 182

high modernism 237, 243

Hildebrandt, Mireille 22, 459

Huawei 14

Hunt, Troy 411

hybrid war 234

I

IAPP 93

identity theft 294

Immigration and Customs Enforcement (ICE) 287

impersonation 296

incident response (IR)

breach defined 414

efficacy 420

GDPR approach 417

giving notice 415

incidents versus breaches 413

materiality 414

regulator disclosures 415

specialization 419

trigger information 413

indicators of compromise (IOCs) 343, 361

indictment strategies 288

industrial control systems 345

industrial policy 452–453

information-domain concerns 14, 40

information glut 41, 163

information integrity 163

information scarcity 41

information security 10

Information Sharing and Analysis Centers (ISACs) 122, 338

Information Sharing and Analysis Organizations (ISAOs) 339

InfraGard 320

inherently political technologies 237–238

In-Q-Tel 453

insecurity through acquisition 79

insider trading 431

Instagram 335

insurance 437

Intelligence Advanced Research Projects Agency (IARPA) 172

Intelligence Community (IC) 15, 121, 178

intelligence estimative language 188

International Emergency Economic Powers Act 285

international humanitarian law 156–157

International Relations Theory 198

International Telecommunication Union (ITU) 122

International Traffic in Arms Regulations (ITAR) 121, 407

Internet

balkanization 211

dark web 292

deep web 290

Internet Protocol (IP) 7, 60, 345

redesigns 86

sovereignty10–11, 211, 402

surface web 293

as tubes 68

Internet Assigned Numbers Authority (IANA) 65

IoT security 178

I2P 100

IP theft, countermeasures 372

Iran 73, 174, 206, 208, 473

Islamic State of Iraq and the Levant (ISIL or ISIS) 49

ISIS travelers 49

Israel 5

Ivanov, Alexey 102

J

Jervis, Robert 116

Jobs, Steve 23

Johnson, Loch 221

Jong-Un, Kim 201, 400

Juniper 122

Just War Theory 143, 156

idealism, realism, nihilism 156

Summa Theologica 156

virtue ethics 156

K

Kahn, David 79

Kahn, Herman 221

Kan, Paul 287

Kello, Lucas 162, 222

Kerr, Orin 287

Key Hole satellite 474

kleptocratic interdependence 288

Knake, Robert A. 118

Knight Capital 437

Kreps, Sarah 220

kulturkampf 46, 50, 235

L

Lakoff, George 42

law of armed conflict (LOAC) 156–157

least cost avoider 256

legacy systems 148

Lethal Autonomous Weapons

automaticity 166

autonomy 166

effectors 166

human in the loop (HITL) 166

human on the loop (HOTL) 167

Phalanx CIWS 167

letters rogatory 327

Libicki, Martin 153, 208, 221

Lindsay, Jon 162

Lin, Herbert 91

link analysis 64

link-layer attacks 70

Livy 155

Lockheed Martin 474

Lucian of Samosata 40, 457

Lulzsec 97, 104

M

Machiavelli, Niccolò 233

machine learning 405, 467–468

Macron, Emmanuel 203

Maidan movement 235

mail covers 78

malware 95

growing sophistication 95

Mandiant 371

Maness, Ryan 153

Manjikian, Mary 241

Maroochy Water Services 336

materiality 431

Matheny, Jason Gaverick 190

Matwyshyn, Andrea 7

Mazzucato, Mariana 452

media access control addresses (MAC) 70

medical device security 270

Melian Dialogue 157

Meltdown 465

Merkel, Angela 185

metadata64–65, 78, 321

Metaverse 476

Microsoft Corp. 209

Microsoft Ireland case 327

minimum viable product (MVP) 113

Minuteman III 146

Morris, Robert Tappan 23

Morris Worm 23

Muddy Waters 270

Mulligan, Deirdre K. 230, 232

multi-factor authentication 133

multi-stage intrusion 91

Mutual Legal Assistance Treaty (MLAT) 327

My Friend Cayla 270

N

National Center for Missing & Exploited Children (NECMEC) 287

National Cybersecurity and Communications Integration Center (NCCIC) 344

National Cyber Security Center (NCSC) 435

National Institute of Standards and Technology (NIST) 122, 346

800-53, 346

800-171, 355

Cybersecurity Framework 335, 339, 346

Cybersecurity Framework efficacy 357

National Protection and Programs Directorate (NPPD) 342

National Reconnaissance Office (NRO) 474

National Science Foundation (NSF) 86

National Security Agency (NSA) 89, 121, 176

network economics

adverse selection 112

externalities 112

fixed costs 112

information asymmetry 112

marginal costs 112

moral hazard 112

tragedy of the commons 112

winner takes all 113

network-level filtering 360

network neutrality 73, 296, 360

Neustar 122

Newman, Abraham L. 209

New School of Information Security 411

New York State Department of Financial Services (NYSDFS) 426

Nicaragua judgment 159

Nissenbaum, Helen 20, 449

Nitro Zeus 336

noisy exit 417

non-consensual image posting 285

normative account 9

North American Electric Reliability Corporation (NERC) 350

North Korea 208, 285, 400

NotPetya 178

Nye, Joseph 38

O

Obama, Barack 372

Odysseus 41

Office of Compliance Inspections and Examination (OCIE) 431

Office of Foreign Assets Control (OFAC) 121, 290, 406

Office of Personnel Management (OPM) breach 206

Old Crows 155

Olympic Games 202

one-shot quality 359

one-time pad 174

Onion Router (Tor) 38

OODA loop 146

open-source intelligence (OSINT) 399

open source software 449

operational security (OpSec) 101

Operation Aurora 369

Operation Orchard 150

OPM Breach 177, 178

optical telegraphy 78

OSI Internet layers model 68

Ostrom, Elinor 125, 226

outer space industry 82

P

Packet Clearing House 62

packets 62

paste sites 411

path-based attacks 73

Payment Card Industry Data Security Standard (PCI-DSS) 122, 352

Pearl, Daniel 322

Peck, Winslow 181

permissive action links 146

phishing 128, 407

physical layer attacks 68

Pizzagate 236

plans of action and milestones (POAM) 355

Podesta, John 128

Poe’s law 136

policy analysis, methods 444

politics of security 21

Polybius 156

Ponemon, Larry 409

positioning, navigation, and timing (PNT) 173

postal mail security 79

Postel, John 66

Postman, Neil 458

Poulsen, Kevin 102

precautionary retention 317

Predator UAV 174

pre-positioned devices 80, 98

prescriptive account 9

presentation layer attacks 75

preservation order 317

Presidential Decision Directive–63 337

Presidential Policy Directive 21 339

pretexting 407

Pretty Good Privacy (PGP) 134

privacy breaches 415

privacy enhancing technologies 99

probable cause 323

procedural computer crime law 282

product liability for security 448

product recall 270

Program for the International Assessment of Adult Competencies (PIAAC) 458

PSYOP 49

pushbutton forensics 95

Putin, Vladimir 201, 204, 234

Q

quality of service (QoS) 73

quantum technologies

computing 466

cryptanalysis 467

encryption 174

quantum key distribution (QKD) 174

quashal 319

R

Rabkin, Jeremy 163

Rand, Ayn 322

RAND Corporation 143

ransomware 328

rational choice theory (RCT) 127, 130

Reagan, Ronald 297

Reddie, Andrew W. 453

referent object 223

Regulation E 419

Regulation Z 419

reliance 116

resilience 26, 338

retention 317

“revenge pornography” 285

reverse proxy 74

Rid, Thomas 91, 148, 235

risk 394

credit card transactions 417

management 395

risk tolerance 395

rivalrous goods 230

Ronfeldt, David 153

Rosenzweig, Paul 122, 160, 250, 342

rubber hose security 328

Russia 5, 44, 208, 287, 403

Russia Today (RT) 50

Rustad, Michael 447

S

Safire, William 403

San Bernardino attack (2015) 454

satellites 82

anti-satellite (ASAT) weapons 82

domiciles 82

satellite cybersecurity 173, 345

satellite ISR 184

scenario analysis methods 464

Schelling, Thomas 200, 205, 221, 288, 409

Schell, Roger R. 142

Schneider, Fred B. 230, 232

Schneider, Jacquelyn 220

Schneier, Bruce 26, 394

science of security 411

Secure Border Gateway Protocol (SBGP) 125

Secure Domain Name Service (DNSSEC) 125

Security and Exchange Commission (SEC) 368, 416, 430

security and freedom xxv

security as risk shifting 22, 24

security breaches 411–412

IPR breaches 368

material 368

security by obscurity 28

security certifications 93

security dilemma 181

security for whom? 21

security incidents 412

security standards 335

security statexxv, 20

Security Studies 198, 215

anarchy 215

escalation 218

securitization 198, 222

security dilemma 216

security theater 26

security training 133

Seleznev, Roman Valerevich 105, 327

self-defense 421

Semnan Launch Site 474

session-layer attacks 75

Shadow Brokers 178

shadow IT problem 133

Shannon, Claude E. 241

Shapiro, Carl 112

shareholder derivative lawsuits 436

Shostack, Adam 17

shutter control 174

Signal app 81

Skripal, Sergei 44

Smith, Brad 322

Smith, Robert Ellis 78

social engineering 76, 127

software liability 446

Solar Sunrise 206

SolarWinds 336

Sony Pictures 400, 431

sovereignty 69

space law 82

spam 291

Specially Designated Nationals and Blocked Persons List (SDN) 121, 209, 290, 406

Spectre 465

speculative execution 465

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege (STRIDE) 17

SRI International 452

stalking 311

Starlink 82, 174

Stasi 48

Stimson, Henry 180

Stoll, Clifford 101, 177

Stored Communications Act (SCA) 318

stored value cards 283, 293

Strategic Air Command (SAC) 146

strategic ambiguity 123

strategic irrationality 204

Strategic Studies 198

strategic surprise 179

Structured Threat Information Expression (STIX) 364

structuring 293

Stuxnet 177, 202

submarine cables 81

subpoena 318

substantive computer crime law 282

subtractability 226

Sullivan, Joseph 416

superwarrant 324

supply chain 169, 355, 403–404

surveillance capitalism 120

SWIFT 209

T

Tallinn Manual 157

Team Telecom 80–81

technical computer security 21

technology convergence 80

technology determinism 238, 244

technology neutrality 238

technology sovereignty 405

TeleGeography 81

Telegram 73

telegraph 79

telephone networks 79

telephone security 79

terrorism 331

The Onion Router (Tor) 98

third party doctrine 316

threat indicators 361

threat modeling 15

Thucydides 157

Tiberius Gracchus 41

TikTok 335

Title 10 and 50 conflicts 176, 193

Tor Onion Routing 99, 291

hidden services 99, 292

onion address 99

onion sites 292

The Silk Road 292

tort liability for security 448

tradecraft 178

trade secrets 374

traffic analysis 63, 78

Traffic Light Protocol (TLP) 320

tragedy of the commons 124

transnational criminal organization (TCO) 103, 210

transport layer attacks 73

Trans-Siberian Pipeline Explosion 335–336

Trojan defense 95

Trump, Donald 171

trust 116

Trusted Automated Exchange of Intelligence Information (TAXII) 364

truth sandwich 42

Turing, Alan 65

Tygar, Doug 134

U

U-2 and SR-71 overflights 184

Uber 416

undersea-cable attacks 80

United Nation Charter 157

United Nations Group of Governmental Experts (UNGGE) 209

United States Naval Research Laboratory 292

Unmanned Aerial Vehicles (UAVs) 174

unpeace 162

untrusted network 16

usable security 134

US Cyber Command (USCYBERCOM) 171

use of force 334

user-layer attacks 76

US Information Agency (USIA) 48

US Information and Educational Exchange Act 48

US Munitions List (USML) 407

US Naval Research Laboratory 292, 456–457

US Secret Service (USSS) 287

Cyber Fraud Task Forces (CFTF) 320

utopianism 237

V

Valeriano, Brandon 153

Vandenberg Space Force Base 345

Varian, Hal 112

Vault7 Leak 178

Verisign 122

Virtual Private Networks (VPN) 97

Voice of America 48

voluntary request 318

Vulnerabilities Equities Process (VEP) 189

W

Waldron, Jeremy 22

walled gardens 6, 230

Ware, Willis 143

WarGames (film) 297

warrant 318, 323

Wassenaar Arrangement 406

Wæver, Ole 225

Weber, Steve 233

WebMoney 283

Weltanschauungskrieg 48

Westphalian sovereignty 11, 170

WhatsApp 81

Whitten, Alma 134

Whittington, Jan 228

WHOIS 102

WhoWas 102

wicked problem 4

Williamson, Oliver E. 125

Winner, Langdon 237

wiper 400

worldview warfare 48

World Wide Web 6, 62

Wozniak, Steve 23

X

Xi Jinping 372, 402

Y

Yardley, Herbert 79

Yoo, John 163

Z

zero-day attack 343

zero-trust 340

Zuboff, Shoshana 51, 120, 228

Zuckerberg, Mark 457

WILEY END USER LICENSE AGREEMENT

Go to www.wiley.com/go/eula to access Wiley’s ebook EULA.