We tend to think of international cyber attacks as a new phenomenon: threats only created by recent mass digitalization. But, in reality, they have been around since the Cold War. Back in 1982, the CIA accessed the control system for a Soviet gas pipeline and triggered a massive explosion. At the time, such events were known as ‘logic bombs’.
The difference today is that awareness of cyber attacks has grown, and so has their scale and frequency. For example, last year it was revealed that Russian hackers had infiltrated U.S. voter databases and software across 39 states during the presidential race; placing the entire electoral system in jeopardy. In 2016, Federal agencies reported no fewer than 30,899 information security breaches, 16 of which were considered “major incidents.”
Clearly, the cyber world has now become the next geopolitical battleground.
This brings us to one vital question: with Federal, business, and media interests dependent on robust digital security, how should the government be fighting the hackers?
Intra-Governmental Cooperation
Compared to modern hacking operations, the cyber exploits of the 1980s were small-time. In the current digital landscape, security organizations must contend with extensive attacks launched by national players such as the Russian Internet Research Agency or, potentially, the Korean Lazarus Group–which means disjointed cyber defenses are no longer enough.
The government has already recognized and made several changes to resolve this issue. In 2005, the office of Director of National Intelligence was established to consolidate information gathered by different agencies and bolster defenses after the events of September 11, 2001. In 2016, it increased cybersecurity spend by $5 billion and created the first Federal Privacy Council to improve communication between privacy officials and data usage guidelines. The Department of Homeland Security (DHS) has also continuously been working to safeguard government departments and share intelligence with states and global partners.
While these efforts enhance U.S. defensive abilities, greater internal unity is still needed. Inconsistent security processes continue to leave systems vulnerable: see the infamous 2015 Office of Personnel Management breach, caused by stalled authorization activity. A report on 552 local, state, and Federal organizations found erratic software updates, patching, and IP address protection leave multiple systems at risk.
To combat increasingly well-resourced hacker cells, departments must deploy a centralized approach to applying protective measures and distributing information. In other words, the government must build a cohesive security structure that has the muscle required to take on attackers.
Leveraging Enterprise Expertise
As data have become integral to everyday business functions–from delivering utilities such as electricity and gas, to running social media networks–the importance of protecting it has increased. Consequently, many companies in the private sector have built up a vast pool of knowledge about cyber safety: insight that could be a valuable asset for the government.
By strengthening relationships with influential enterprises, Federal departments can harness lessons they have learned about identifying, isolating, and removing threats to inform their security strategy, and avoid similar issues. Moreover, they can also replicate the techniques developed by private companies to reduce and highlight cyber crime.
For example, amid the spate of fake content in 2017, Facebook built a tool that allowed users to check whether they had unwittingly liked Russian propaganda. With perpetrators posing as American users, employing names such as ‘Being Patriotic’ and ‘Heart of Texas’, distinguishing between real or bogus posts was a tough task. Analyzing activity against known fraudulent accounts, Facebook was able to identify those linked to Russia’s Internet Research Agency and help audiences steer clear. The tool, which was shared with congress, has been heralded as a “serious response” to requests for increased transparency and provides a strong example of assets the government can gain from the private sector.
Bringing Order to State-Level Chaos
The complexity of U.S. security and privacy regulation is not news to workers in the Federal IT sector: most already know that the existing legislative framework is a convoluted web of state-specific rules. But the effect this has on national safety is unacknowledged. With every state following its own policies and benchmarks, security levels across America are hugely varied as is the government’s ability to protect against attacks.
For example, in Virginia, judges have ruled that the frequency of hacking and volume of data collected by internet service providers means individuals should not expect computer usage to stay private; i.e. immune to searches by security agencies. While states such as California take a different view. Ranked as the highest protector of privacy in America–with a rating of almost 86 percent–California recently introduced a bill that would require Internet of Things (IoT) device manufacturers to build security and data protection processes into all products.
With a single set of universal laws about how information should be collected and protected, the government can provide robust security and make better agreements with corporations concerning data sharing. Not to mention negating costly legal battles, such as the notorious Federal case against Apple.
Fortifying International Bonds
Cyber hacks are not just a U.S. issue; late last year the UK was also hit by a Russian hack that breached multiple email accounts. Once national discrepancies have been resolved, the U.S. would also do well to consider improving links outside its borders: after all, closer global ties can facilitate access to vital insight and improve combined power to defeat attackers.
Of course, international bonds have been forged before. The U.S. has previously made informal agreements with countries such as China, and participated in discussions at global events, including the Council of Europe Convention on cyber crime. Yet discord regarding the way intelligence is leveraged has also caused friction: in 2013 Brazil’s President Rousseff cancelled a visit due to apprehension about international monitoring activity and Germany’s
Chancellor Merkel made statements against electronic possible espionage.
By establishing clearly defined and formalized agreements for cyber security, including frameworks such as Privacy Shield–which protects data in transit between the U.S., EU, and Switzerland–the government can avoid international confusion, while creating a culture of mutual cyber support. In short, creating an alliance of the world versus cyber criminals.
International attacks may not be an innovation of the digital age, but it has spawned hackers who are better equipped and more powerful than ever. To keep them at bay, the government needs to pool resources both at home and overseas. By unifying internal processes and national rules, as well as enhancing business and global relations, the U.S. can ensure victory on the new cyber-focused geopolitical battlefront.
As President and CEO of security firm Cyber adAPT, Kirsten Bay leverages more than 25 years of experience of risk intelligence, information management, and policy expertise. Her career has seen her sit on a U.S. congressional committee; assist in developing policies for the White House; and, in the UK, share her insight with a parliamentary subcommittee on recreating trust in the global economy.