White House rolls out new national cyber strategy


The Trump administration released its long-awaited cyber strategy to the public on Sept. 20, promising a more aggressive willingness to deploy offensive operations against nation-states and criminal groups in the digital domain.

In a call with reporters, National Security Advisor John Bolton cited a number of high-profile cyberattacks over the past two years, such as 2017 WannaCry and NotPetya, as well as a 2018 attack that shut down much of the IT operations for the city of Atlanta, as examples of how the U.S. and other governments are under siege from both nation-states and criminal hacking groups.

Bolton confirmed press reports that President Donald Trump had officially rescinded PPD-20, an Obama-era presidential directive that laid out a complex interagency process governing offensive cyber operations, earlier this month. A new classified directive will replace it that lays out a “very different” process. While he declined to discuss specifics citing national security concerns, Bolton indicated that the Pentagon, U.S. Cyber Command and “other relevant departments” will be charged with taking the fight to malicious cyber actors in order to deter future attacks.

“We’re going to do a lot of things offensively, and our adversaries need to know that,” he said. “We’re not just on defense as we have been … for a period of time.”

The White House strategy dropped the same week that the Department of Defense rolled out its own cyber strategy, which envisions a robust role for the Pentagon and U.S. Cyber Command in protecting elections, defending U.S. critical infrastructure and coordinating and sharing cyber threat data with the private sector. Bolton said DOD’s strategy reflects its new role as defined by the president’s national strategy.

The new strategy, which Bolton said “starts today,” codifies many of the changes that have been telegraphed over the past year by the administration and media reports, particularly a loosening of the rules of engagement in cyber war.

The U.S. government has been struggling to put together a unified policy for cybersecurity over the past two years as the topic has become increasingly relevant to a large number of national security and foreign policy issues. The Department of Homeland Security and the Pentagon have emerged as two of the biggest players in the defensive and offensive cyber policy arenas, sometimes clashing in turf battles as each department attempts to satisfy Congress and policymakers who have asked for more aggressive action. Bolton said it took time to work out the various roles for different agencies in the process, but now “each agency knows its lane and is pursuing it vigorously.”

“I’ll just put it this way: for any nation that is taking cyber activity against the United States, they should expect … that we will respond offensively as well as defensively, and beyond that I’m just not going to go [any further] at this point,” Bolton said.

He also said the U.S. would seek to uphold international norms in cyberspace, protect American prosperity and innovation and invest in a better cybersecurity-talent pipeline.

Bolton also addressed questions about the controversial elimination of the White House cybersecurity coordinator position, saying he inherited a National Security Council structure that was filled with duplication and overlap and that he was determined to change it. The council already has two senior directors charged with implementing and coordinating cybersecurity policy, and Bolton said other major policy areas, such as intelligence, counterproliferation and defense, also have senior directors but no top-level coordinators.

In a statement, DHS Secretary Kirstjen Nielsen said the White House strategy -- as well as DHS’ own cyber strategy released in May -- will guide a series of efforts by the department to secure federal networks, protect critical infrastructure and combat cybercrime. She also said DHS would engage with the broader law enforcement community to explore updates and changes to current laws around electronic surveillance and computer crime.

About the Author

Derek B. Johnson is a senior staff writer at FCW, covering governmentwide IT policy, cybersecurity and a range of other federal technology issues.

Prior to joining FCW, Johnson was a freelance technology journalist. His work has appeared in The Washington Post, GoodCall News, Foreign Policy Journal, Washington Technology, Elevation DC, Connection Newspapers and The Maryland Gazette.

Johnson has a Bachelor's degree in journalism from Hofstra University and a Master's degree in public policy from George Mason University. He can be contacted at, or follow him on Twitter @derekdoestech.

Click here for previous articles by Johnson.


  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.