On June 13, 2017, the Senate Foreign Relations Subcommittee on East Asia, the Pacific, and International Cybersecurity Policy held a hearing entitled “State-Sponsored Cyberspace Threats: Recent Incidents and U.S. Policy Response.” The hearing focused on cyber threats from state actors and the attendant risks posed to national and economic security interests in the U.S. The session was chaired by Senator Cory Gardner (R-CO), who championed the creation of a select committee on cybersecurity that would bring together various members with key responsibilities for cyber. The hearing featured as witnesses Dr. Samantha Ravich of the Foundation for Defense of Democracies and the Honorable Eric Rosenbach of Harvard University.
Senator Gardner opened the hearing by stating that “cyber attackers do not sleep,” and the U.S. “must choose to either use all instruments of national power, including diplomacy, economic sanctions, and offensive capabilities to deter the malicious cyber actors or cede the field to our adversaries and face catastrophic consequences.” The Ranking Member of the Subcommittee, Senator Edward Markey (D-MA), echoed Senator Gardner’s concerns about malicious cyber actors, noting that “today’s era is known as the IoT, the Internet of Things. But IoT can also stand for Internet of Threats.”
Dr. Ravich’s testimony focused on cyber threats to the economic sector. She described the threat posed by “the hostile state actor who recognizes that while it may not be able to compete directly with America’s strength of arms, it holds a significant asymmetric advantage in attacking our economic wherewithal.” Dr. Ravich categorizes such strategic activity as “Cyber-Enabled Economic Warfare” and noted that China and North Korea are active players. To help defend against this strategy, Dr. Ravich called for more formal partnerships with democracies that have advanced cyber technologies, such as the U.K. and Israel.
In his testimony, Mr. Rosenbach used a digital “glass house” analogy to make two points about potential American cyber vulnerabilities. First, Mr. Rosenbach reiterated Dr. Ravich’s concern about the asymmetric nature of malicious cyber campaigns, stating that a “small nation with an offensive cyber capability can have an outsized effect on a larger power” – such as, for instance, North Korea – “a nation where most citizens do not even have an Internet connection” – against the U.S. Second, Mr. Rosenbach said open societies are more vulnerable than authoritarian ones that “control the media, censor domestic online activity, and shield their nations, to some degree, from outside information and cyber operations through the use of national-level firewalls, like the Great Firewall of China.”
Mr. Rosenbach described a few ways to address cyber vulnerabilities, such as sanctioning countries that deploy cyber weapons and “taking a leading role in building international capacity to disrupt the proliferation of black-market destructive malware.” Mr. Rosenbach also pushed for legislation mandating compliance with the National Institute of Standards and Technology’s Cybersecurity Framework, noting that making the framework mandatory for energy sector infrastructure was particularly important.
Senator Gardner expressed concern about leadership in the federal government in terms of cybersecurity policy. To help address that, Senator Gardner said he supports the creation of a select committee on cybersecurity that would place the ranking member and chair of “each committee that has jurisdiction over cybersecurity … on one committee so that they can have a whole of government view, because this is a complex issue.”
Senator Gardner closed the hearing by stating that the U.S. must build out an understanding of how the country’s global security alliances operate in connection with cyber threat issues and determine how to “move forward with [a] common interest around the globe to develop the kinds of norms that we need to” in the cyber arena.
