The latest attempt by the State Department to set behavior norms

The State Department has released guidelines for developing an array of consequences that Washington can impose on adversaries to ward off cyberattacks.

Following lawmakers’ calls for the Trump administration to lay out a clear cyber deterrence strategy, the State Department has proposed developing a broader set of consequences that the government can impose on adversaries to ward off cyberattacks.

The unclassified version of the State Department’s deterrence recommendations, published Thursday, calls for the U.S. to work with allies to inflict “swift, costly, and transparent consequences” on foreign governments that use “significant” malicious cyber activity to harm U.S. interests.

To do that, the U.S. government needs to clearly and publicly outline the malicious activity it seeks to deter, according to the State Department report, which was required by a 2017 White House executive order. The document doesn’t go into detail on deterrence tools, but U.S. officials have said that sanctions, indictments, publicly attributing attacks, and covert offensive operations are all on the table.

Dating back to the Obama administration, lawmakers have urged the executive branch to delineate a deterrence strategy after high-profile breaches of the Office of Personnel Management in 2015 and the Democratic National Committee in 2016. Chinese hackers allegedly carried out the former operation while Russian hackers were responsible for the latter.

The Trump administration also should develop different strategies for deterring each of its adversaries, the report suggests. In other words, what might work in deterring North Korean hackers may not for Russian ones as such activity depends on geopolitical context. Pyongyang’s hackers, for example, have continued to carry out attacks against companies on multiple continents despite ongoing diplomatic negotiations with the United States.

State Department officials also released an “international engagement strategy” Thursday advocating a “new cooperative framework” for deterring adversaries, without elaborating on what that looks like. The strategy, also required by the 2017 executive order, aims to reduce the risk of cyber-driven conflict by reviving international discussions of cyber norms.

The State Department pushed for a norms agreement through the United Nations Group of Governmental Experts, but those talks collapsed last June over disagreements between the United States, Russia, and others over the right to defend themselves in cyberspace.

The State Department has been without a cybersecurity coordinator since the departure of Christopher Painter 10 months ago, with Deputy Assistant Secretary Robert Strayer serving as the top cyber diplomat.

Painter, now a non-resident fellow at the Australian Strategic Policy Institute, released his own deterrence report this week, which echoed the department’s call for tailored deterrence strategies.

“Actual or threatened responsive actions are effective only if the target of those actions is something that matters to the state in question, and that target will differ according to the particular state involved,” Painter wrote.

Rubio restricts visas for sextortionists, cyber scammers

The move stems from a Trump executive order as the administration continues to pursue cyber-enabled fraud and other crimes.

Open-source security is posing challenges governments can’t easily solve

Trump postpones executive order focused on AI security 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure