Biden’s cybersecurity strategy assigns blame to tech companies

WASHINGTON — The Biden administration plans to release a cybersecurity strategy on Thursday that calls on software makers and U.S. industry to take far greater responsibility for ensuring their systems can’t be hacked, while accelerating efforts from the FBI and Department of Defense to disrupt hackers and ransomware. groups around the world.

For years, the government has pressed companies to voluntarily report intrusions into their systems and regularly “patch” their programs to close newly discovered vulnerabilities, much like an iPhone does with automatic updates every few weeks. . But the new National Cybersecurity Strategy concludes that such voluntary efforts are insufficient in a world of constant attempts by sophisticated hackers, often backed by Russia, China, Iran or North Korea, to break into government networks. and private reviews.

Every administration since that of George W. Bush 20 years ago has released some sort of cybersecurity strategy, usually once per presidency. But President Biden’s differs from previous versions in several ways, primarily by asking for much larger mandates for private industry, which controls the vast majority of the country’s digital infrastructure, and by expanding the role of government to take offensive measures to anticipate cyberattacks, especially from abroad.

The Biden administration’s strategy envisions what it calls “fundamental shifts in the underlying dynamics of the digital ecosystem.” If enacted into new regulations and laws, it would require companies to adopt minimum cybersecurity measures for critical infrastructure – and, perhaps, impose liability on companies that fail to secure their code, just like companies. car manufacturers and their suppliers are held liable for faulty or faulty airbags. brakes.

“This just reinvents the American cybersocial contract,” said Kemba Walden, the acting national director of cyber, a White House post created by Congress two years ago to oversee both cyber strategy and cyber defense. . “We expect more from these owners and operators of our critical infrastructure,” added Walden, who took over last month after the resignation of the country’s first national cybersecurity director, Chris Inglis, a former deputy director of the National Security Agency.

The government also has an increased responsibility, she added, to bolster defenses and disrupt major hacking groups that have locked hospital records or frozen the operations of meat packers across the country.

“We have a duty to do this,” Ms. Walden said, “because the internet is now a global commons, essentially. So we expect more from our partners in the private sector, nonprofits, and government. industry, but we also expect more from ourselves.

Read alongside past cyber strategies issued by the three previous presidents, the new document reflects how cyber crime and defense have become increasingly central to national security policy.

The Bush administration has never publicly acknowledged America’s offensive cyber capabilities, even as it launched the most sophisticated cyberattack ever directed by one state against another: a covert effort to use code to sabotage nuclear fuel facilities. from Iran. The Obama administration was reluctant to name Russia and China as the powers behind major US government hacks.

The Trump administration has bolstered US offensive initiatives against pirates and state-backed actors overseas. He also sounded the alarm that Huawei, the Chinese telecommunications giant which he accuses of being an arm of the Chinese government, has set up high-speed 5G networks in the United States and among its allies, fearing that the company’s control over these networks will help in China. surveillance or allow Beijing to shut down systems in times of conflict.

But the Trump administration has been less active in requiring US companies to establish minimum protections on critical infrastructure, or in seeking to hold those companies liable for damages if the vulnerabilities they left unaddressed were exploited.

Imposing new forms of accountability would require major legislative changes, and some White House officials have acknowledged that with Republicans now in control of the House, Mr. Biden could face insurmountable opposition if he seeks to enact what amounts to to radical new business regulation.

Many elements of the new strategy are already in place. In some ways, it is catching up with actions taken by the Biden administration after struggling in its first year, which began with major hacks of systems used by both private industry and the military.

After a Russian ransomware group shut down the operations of Colonial Pipeline, which handles much of the gasoline and jet fuel along the East Coast, the Biden administration used little-known legal authorities held by the Transportation Security Administration to regulate the nation’s vast energy grid. pipelines. Pipeline owners and operators are now required to abide by far-reaching standards set largely by the federal government, and later this week the Environmental Protection Agency is expected to do the same for pipelines. ‘water.

There are no parallel federal authorities to require minimum cybersecurity standards in hospitals, which are largely regulated by the state. They have been another target of attacks, from Vermont to Florida.

“We should have done a lot of these things years ago after cyberattacks were first used to disrupt food for thousands of people in Ukraine,” Anne Neuberger, deputy national security adviser, said Wednesday. from Mr. Biden for Cyber ​​and Emerging Technologies. She was referring to a series of attacks on Ukraine’s power grid that began seven years ago.

Now, she said, “we’re literally tinkering with a sector-by-sector approach that covers critical infrastructure.”

Ms. Neuberger cited Ukraine as an example of proactively building cyber defenses and resilience: In the weeks following the Russian invasion, Ukraine changed its laws to allow ministries to move their databases and many government operations to the cloud, backing up computer servers and data centers. around kyiv and other towns which subsequently became targets for Russian artillery. Within weeks, many of these server farms were destroyed, but the government continued to operate, communicating with servers overseas using satellite systems like Starlink, also introduced after the outbreak of war.

The strategy also catches up with an offensive program that has become increasingly aggressive. Two years ago, the FBI began using search warrants to find and dismantle fragments of malicious code found on corporate networks. More recently, he hacked into the networks of a ransomware group, removed “decryption keys” that would unlock documents and systems belonging to the group’s victims, and foiled efforts to collect large ransoms.

The FBI can operate in national networks; it’s up to US Cyber ​​Command to take on Russian hacking groups like Killnet, a pro-Moscow group responsible for a series of denial of service attacks from the early days of the war for Ukraine . Cyber ​​Command also slowed the operations of Russian intelligence agencies around the 2018 and 2020 US elections.

But none of these solutions are permanent; some groups targeted by the United States reformulated, often under different names.

Mr. Biden’s only face-to-face meeting as president with Russian leader Vladimir V. Putin in 2021 in Geneva was largely prompted by fears that rising ransomware attacks could affect people’s lives. consumers, hospital patients and factory workers. Mr Biden warned the Russian leader that his government would be held responsible for attacks emanating from Russian territory.

There was a lull for several months and a major hacking group was raided by Russian authorities in Moscow. But this cooperation ended with the outbreak of war in Ukraine.

In a speech this week at Carnegie Mellon University, Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, described the administration’s efforts as “shifting responsibility to entities that fail to meet the duty of care that they owe their customers. .”

“Consumers and businesses expect products purchased from a reputable supplier to perform as they are supposed to and do not introduce undue risks,” Ms Easterly added, saying the administration should “ advancing legislation to prevent technology makers from disclaiming contract liability,” a common practice few notice in the fine print of software purchases.