White House rolls out new national cyber strategy

The Trump administration released its long-awaited cyber strategy to the public on Sept. 20, promising a more aggressive willingness to deploy offensive operations against nation-states and criminal groups in the digital domain.

In a call with reporters, National Security Advisor John Bolton cited a number of high-profile cyberattacks over the past two years, such as 2017 WannaCry and NotPetya, as well as a 2018 attack that shut down much of the IT operations for the city of Atlanta, as examples of how the U.S. and other governments are under siege from both nation-states and criminal hacking groups.

Bolton confirmed press reports that President Donald Trump had officially rescinded PPD-20, an Obama-era presidential directive that laid out a complex interagency process governing offensive cyber operations, earlier this month. A new classified directive will replace it that lays out a “very different” process. While he declined to discuss specifics citing national security concerns, Bolton indicated that the Pentagon, U.S. Cyber Command and “other relevant departments” will be charged with taking the fight to malicious cyber actors in order to deter future attacks.

“We’re going to do a lot of things offensively, and our adversaries need to know that,” he said. “We’re not just on defense as we have been … for a period of time.”

The White House strategy dropped the same week that the Department of Defense rolled out its own cyber strategy, which envisions a robust role for the Pentagon and U.S. Cyber Command in protecting elections, defending U.S. critical infrastructure and coordinating and sharing cyber threat data with the private sector. Bolton said DOD’s strategy reflects its new role as defined by the president’s national strategy.

The new strategy, which Bolton said “starts today,” codifies many of the changes that have been telegraphed over the past year by the administration and media reports, particularly a loosening of the rules of engagement in cyber war.

The U.S. government has been struggling to put together a unified policy for cybersecurity over the past two years as the topic has become increasingly relevant to a large number of national security and foreign policy issues. The Department of Homeland Security and the Pentagon have emerged as two of the biggest players in the defensive and offensive cyber policy arenas, sometimes clashing in turf battles as each department attempts to satisfy Congress and policymakers who have asked for more aggressive action. Bolton said it took time to work out the various roles for different agencies in the process, but now “each agency knows its lane and is pursuing it vigorously.”

“I’ll just put it this way: for any nation that is taking cyber activity against the United States, they should expect … that we will respond offensively as well as defensively, and beyond that I’m just not going to go [any further] at this point,” Bolton said.

He also said the U.S. would seek to uphold international norms in cyberspace, protect American prosperity and innovation and invest in a better cybersecurity-talent pipeline.

Bolton also addressed questions about the controversial elimination of the White House cybersecurity coordinator position, saying he inherited a National Security Council structure that was filled with duplication and overlap and that he was determined to change it. The council already has two senior directors charged with implementing and coordinating cybersecurity policy, and Bolton said other major policy areas, such as intelligence, counterproliferation and defense, also have senior directors but no top-level coordinators.

In a statement, DHS Secretary Kirstjen Nielsen said the White House strategy -- as well as DHS’ own cyber strategy released in May -- will guide a series of efforts by the department to secure federal networks, protect critical infrastructure and combat cybercrime. She also said DHS would engage with the broader law enforcement community to explore updates and changes to current laws around electronic surveillance and computer crime.