Obama has signed a secret directive to help thwart cyberattacks

Washington Post, By Ellen Nakashima

President Obama has signed a secret directive that effectively enables the military to act more aggressively to thwart cyberattacks on the nation’s web of government and private computer networks.

Presidential Policy Directive 20 establishes a broad and strict set of standards to guide the operations of federal agencies in confronting threats in cyberspace, according to several U.S. officials who have seen the classified document and are not authorized to speak on the record. The president signed it in mid-October.

The new directive is the most extensive White House effort to date to wrestle with what constitutes an “offensive” and a “defensive” action in the rapidly evolving world of cyberwar and cyberterrorism, where an attack can be launched in milliseconds by unknown assailants utilizing a circuitous route. For the first time, the directive explicitly makes a distinction between network defense and cyber operations to guide officials charged with making often rapid decisions when confronted with threats.

The policy also lays out a process to vet any operations outside government and defense networks and ensure that U.S. citizens’ and foreign allies’ data and privacy are protected and international laws of war are followed.

“What it does, really for the first time, is it explicitly talks about how we will use cyber operations,” a senior administration official said. “Network defense is what you’re doing inside your own networks. . . . Cyber operations is stuff outside that space, and recognizing that you could be doing that for what might be called defensive purposes.”

The new policy, which updates a 2004 presidential directive, is part of a wider push by the Obama administration to confront the growing cyberthreat, which officials warn may overtake terrorism as the most significant threat to the country.

“It should enable people to arrive at more effective decisions,” said a second senior administration official. “In that sense, it’s an enormous step forward.”

More at the link

This post was read 96 times.

About author View all posts


3 CommentsLeave a comment

  • I’ve been in the business for fifty years, mush of that time at the leading edge of computer systems design and implementation. I’ve seen terrible security and pretty good security but I’ve never seen perfect security. There are a couple of key points in that regard:

    First, minimize the consequences of security breaches. Don’t put all your critical information or functionality in one place. Localized power grids, for example, are much more resilient than one massive grid. Isolating critical manufacturing components and processes from one another may be less efficient but is less vulnerable to disruption. The networks that connect different systems should be private and completely isolated from the Internet.

    Second, establish proper in-house security. There is no real defense against the ‘disgruntled employee’. That means it behooves organizations – government, commercial, public and private – to eliminate the practices which ‘disgruntle’ employees. Fair workplace practices and genuine concern for the welfare of employees will reduce the risk from that side. In a political or military venue, stop making enemies unnecessarily.

    We have spent decades making enemies around the world and it’s getting worse. We are now facing significant blowback and that will also get worse. I think the new policies amount to locking the barn door after the horses have gotten out. Unfortunately, much of the money and expertise is likely to be used to monitor and control domestic cyberdom.

  • US cybersecurity report points accusing finger at China.

    An annual report to Congress says China is the biggest threat to US cybersecurity, spelling out in some detail who might be doing the cyberspying

    CSM, By Mark Clayton, November 15

    The sheer volume of Chinese cyberespionage directed against the United States, together with its increasing sophistication, “make China the most threatening actor in cyberspace,” concludes a new government report released Wednesday.

    While it is still unknown who in China, specifically, is doing the hacking, technical gains are helping trackers trace cyberespionage “campaigns” back to the country. Among the culprits, according to the annual report to Congress of the US-China Economic and Security Review Commission:

    Read the list at the link

  • Attorneys: Obama’s ‘secret’ cyber security law may allow ‘military deployment within the U.S.’

    Raw Story, By Stephen C. Webster, November 15

    The White House on Wednesday receieved a Freedom of Information Act (FOIA) request (PDF link) from two attorneys with the Electronic Privacy Information Center (EPIC), demanding that President Barack Obama release the text of what they called a “secret” new cyber security law that appears to enable “military deployment within the United States.”

    The FOIA was filed in response to an article that appeared in The Washington Post this week, claiming that Obama issued a secret directive shortly before the elections that empowers the military to “vet any operations outside government and defense networks” for cyber security purposes.

    However, because the exact text of the directive remains a secret, nobody can really say exactly what it does. That was somewhat disconcerting to American Civil Liberties Union legislative counsel Michelle Richardson, who told Raw Story on Wednesday that without the text, “it’s hard to see what they mean.”

    In their FOIA, EPIC attorneys Amie Stepanovich and Ginger McCall go even further, arguing that the directive is tantamount to the president issuing a “secret law” that may enable “military deployment within the United States” in order to vet network security at companies like AT&T, Facebook, Google and others. And indeed, the Post‘s article seems to substantiate that concern, explaining that the order will help “finalize new rules of engagement that would guide commanders when and how the military can go outside government networks to prevent a cyberattack that could cause significant destruction or casualties.”

    More at the link

Leave a Reply