Cyber Commission Remains Bullish Trump Team Will Take Some Recommendations

As the first inklings of President Donald Trump’s cyber policy emerge, experts remain hopeful team Trump’s policy will draw from the Obama administration’s heavy lifting.

In particular, there’s significant optimism that dozens of recommendations from a major cyber review Barack Obama ordered in the wake of the Office of Personnel Management data breach may be taken up in a 90-day cyber review Trump has promised but not yet formally launched.

That hope has a number of things going for it. Most importantly, Congress and the American public are in full-blown crisis mode over cybersecurity, especially Russian-government backed cyber meddling during the 2016 election.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

However, there’s one great caution against expecting the Trump administration to take lessons from the Obama team: Donald Trump.

The two administrations clashed mightily over those Russian-backed election hacks, which intelligence agencies say were partly aimed at aiding Trump’s election. During the transition, Trump declared the government has “no [cyber] defense” and is “run by people that don’t know what they’re doing” when it comes to cybersecurity.

That conflict could make it difficult for Trump officials to openly endorse the commission’s findings.

Experts remain hopeful, however, that the Trump team will use the report from the Commission on Enhancing National Cybersecurity as a guidepost—even if they don’t give the commission much credit.

“The Trump administration can reframe it in its own words and adopt it as its own initiatives,” said Alan Chvotkin, executive vice president of the Professional Services Council and a former longtime Hill staffer. “They’ll apply the Trump administration philosophy, strategy and approach, but that doesn’t undercut the work the commission has already done.”

New America Senior Fellow Peter Singer was more blunt: “It would be great if they plagiarized these [recommendations],” he said.

It’s not uncommon for administrations to draw on their predecessors’ work without acknowledging its origin, which some cyber watchers hope will happen here.

This particular report could be particularly compelling because its recommendations—including increasing cooperation between government and the private sector, and focusing on incentivizing companies to improve cybersecurity rather than regulating them—are largely nonpartisan and align with Republicans’ free market preferences, Singer said.  

The cyber commission co-chairs spent two hours briefing a cross section of the Trump transition team on their report before the inauguration, Executive Director Kiersten Todt told Nextgov.

The group that received the briefing included transition representatives for the Defense, Homeland Security, State and Commerce departments as well as the National Security Council and the General Services Administration and a cross-agency technology team, Todt said.

The team also included Joshua Steinman, an executive with the cybersecurity firm Thin Air who has worked with the Pentagon’s Silicon Valley outpost and who is expected to lead Trump’s White House cyber efforts, she said.

“They were thoughtful and constructive and asked great questions,” Todt said. “They have an interest in taking a look at the [report’s] recommendations and which make sense to pursue.”

The report includes a slate of 60-, 100- and 180-day goals for the Trump team related to securing the internet of things, improving public-private cooperation on cybersecurity and beefing up the cyber workforce.

Though appointed by Obama, commission members mostly hailed from industry and academia and several were recommended by Republican leaders in Congress. Todt has stressed several times since the election the commission’s recommendations were designed to fit either the Clinton or Trump administrations and that the commission even eschewed describing particular roles or titles with the presumption either administration might rejigger them.

“Cybersecurity is not a partisan issue,” Todt said. “The commission itself was very substantive and nonpartisan. Some key members have relationships with key leaders in the incoming administration and they can talk to them about some ideas.”

It remains unclear, however, what role the cyber commission report, which was widely expected to be a blueprint for cybersecurity if Hillary Clinton had won, will play in Trump’s 90-day cybersecurity review.

That uncertainty is magnified by questions about the review itself.

Trump suggested soon after his election the review would be led by DOD and later that the intelligence community would play a leading role. Either of those might undercut DHS' role as lead government liaison to the private sector in cybersecurity.  

Trump announced soon before taking office that former New York Mayor Rudy Giuliani would advise him in a private capacity on cybersecurity and help convene a rotating collection of private-sector officials to discuss the topic. It’s not clear what role that group will play in the larger cyber review.

Depending on the review’s focus, the cyber commission report could be more or less relevant, said Herbert Lin, a commission member and senior research scholar for cyber policy at Stanford University’s Hoover Institution.

“Our review focused on the digital economy … so if the administration wants to address the role of offensive operations in cyberspace, our report isn’t going to be particularly influential,” Lin said.

“If Clinton had won, the reception would have been a more favorable one, but that’s not to say that this is an unfavorable one,” Lin added. “It’s just that we don’t know yet. The jury’s out.”

Even if the recommendations are not implemented as part of the 90-day review, that won’t be game over, Singer said.

“Sometimes, these reports get utterly buried, but the ideas are out there in the firmament and, for the most part, they’re nonpartisan,” he said. “So you can imagine many of them popping up in future reform proposals.”

There’s also the possibility of a cyber crisis—the sort the Obama administration faced numerous times—pushing the Trump administration to implement something fast and looking to the report’s recommendations for guidance.

“If there’s a major event,” Singer said, “that changes the politics of what’s possible.”