Cybersecurity

White House rolls out new national cyber strategy

cybersecurity

The Trump administration released its long-awaited cyber strategy to the public on Sept. 20, promising a more aggressive willingness to deploy offensive operations against nation-states and criminal groups in the digital domain.

In a call with reporters, National Security Advisor John Bolton cited a number of high-profile cyberattacks over the past two years, such as 2017 WannaCry and NotPetya, as well as a 2018 attack that shut down much of the IT operations for the city of Atlanta, as examples of how the U.S. and other governments are under siege from both nation-states and criminal hacking groups.

Bolton confirmed press reports that President Donald Trump had officially rescinded PPD-20, an Obama-era presidential directive that laid out a complex interagency process governing offensive cyber operations, earlier this month. A new classified directive will replace it that lays out a “very different” process. While he declined to discuss specifics citing national security concerns, Bolton indicated that the Pentagon, U.S. Cyber Command and “other relevant departments” will be charged with taking the fight to malicious cyber actors in order to deter future attacks.

“We’re going to do a lot of things offensively, and our adversaries need to know that,” he said. “We’re not just on defense as we have been … for a period of time.”

The White House strategy dropped the same week that the Department of Defense rolled out its own cyber strategy, which envisions a robust role for the Pentagon and U.S. Cyber Command in protecting elections, defending U.S. critical infrastructure and coordinating and sharing cyber threat data with the private sector. Bolton said DOD’s strategy reflects its new role as defined by the president’s national strategy.

The new strategy, which Bolton said “starts today,” codifies many of the changes that have been telegraphed over the past year by the administration and media reports, particularly a loosening of the rules of engagement in cyber war.

The U.S. government has been struggling to put together a unified policy for cybersecurity over the past two years as the topic has become increasingly relevant to a large number of national security and foreign policy issues. The Department of Homeland Security and the Pentagon have emerged as two of the biggest players in the defensive and offensive cyber policy arenas, sometimes clashing in turf battles as each department attempts to satisfy Congress and policymakers who have asked for more aggressive action. Bolton said it took time to work out the various roles for different agencies in the process, but now “each agency knows its lane and is pursuing it vigorously.”

“I’ll just put it this way: for any nation that is taking cyber activity against the United States, they should expect … that we will respond offensively as well as defensively, and beyond that I’m just not going to go [any further] at this point,” Bolton said.

He also said the U.S. would seek to uphold international norms in cyberspace, protect American prosperity and innovation and invest in a better cybersecurity-talent pipeline.

Bolton also addressed questions about the controversial elimination of the White House cybersecurity coordinator position, saying he inherited a National Security Council structure that was filled with duplication and overlap and that he was determined to change it. The council already has two senior directors charged with implementing and coordinating cybersecurity policy, and Bolton said other major policy areas, such as intelligence, counterproliferation and defense, also have senior directors but no top-level coordinators.

In a statement, DHS Secretary Kirstjen Nielsen said the White House strategy -- as well as DHS’ own cyber strategy released in May -- will guide a series of efforts by the department to secure federal networks, protect critical infrastructure and combat cybercrime. She also said DHS would engage with the broader law enforcement community to explore updates and changes to current laws around electronic surveillance and computer crime.

About the Author

Derek B. Johnson is a senior staff writer at FCW, covering governmentwide IT policy, cybersecurity and a range of other federal technology issues.

Prior to joining FCW, Johnson was a freelance technology journalist. His work has appeared in The Washington Post, GoodCall News, Foreign Policy Journal, Washington Technology, Elevation DC, Connection Newspapers and The Maryland Gazette.

Johnson has a Bachelor's degree in journalism from Hofstra University and a Master's degree in public policy from George Mason University. He can be contacted at djohnson@fcw.com, or follow him on Twitter @derekdoestech.

Click here for previous articles by Johnson.


Featured

  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.