Trump sparks speculation after repealing cyber attack restraints

US president Donald Trump has repealed legislation requiring approval from several federal government agencies before cyber attacks can be launched, without indicating what future policy may be.

This move, first reported by The Wall Street Journal, removes restraints on how and when the US can launch cyber attacks.

This means it will be easier for the US to go on the offensive in cyber space, prompting speculation that US cyber attacks on other countries are becoming increasingly likely.

The move, which has been described as an “offensive step forward” by one official briefed on the decision, has also prompted speculation that by speeding up the US’s ability to respond to attacks, Trump is attempting to deter any cyber attacks on the US by its adversaries, particularly foreign interference in US election processes ahead of mid-term elections in November.

Former Obama-era White House cyber security coordinator Michael Daniel has criticised the move, saying it could do more harm than good. “You could end up having an operation wreck a carefully crafted multi-year espionage operation to gain access to a foreign computer system,” he told The Wall Street Journal.

Cyber security representatives have called on the Trump administration to move quickly to fill in the details of what new rules might be introduced to replace those repealed earlier this week, underlining the need for clear international rules on cyber attacks and clear consequences for breaking them.

Sam Curry, chief security officer at security firm Cybereason, said there is a need for more information from the Trump administration.

“We need to know what the Trump administration guidelines are, why the rules are being changed now and what scenarios are envisioned where either accidents are to be avoided, clandestine operations are needed or new tools are needed for expected conflict.

“Hopefully it won’t take another Snowden-like leakage or a massive conflict where new offensive cyber powers are exercised to give us more insight into the new rules of engagement and foreign policy stance,” he said.

In response to apparent Russian interference in the 2016 US presidential elections, many in the cyber security community have called on the international community to come together and determine not only what constitutes acceptable behaviour online at the nation state level, but what checks and balances can be meaningfully put in place to those states that refuse to adhere to these agreed upon practices.

“We’ve had thousands of years to get the role of kinetic violence right in international affairs. We know the rules and what constitutes a violation; we have treaties and protocols. We don’t yet have them for cyber conflict,” said Curry.

“While the reversal of the Obama directive signals many likely things like increased autonomy, less red tape or even increasing the options for conflict resolution and policy, we still need more from the administration. 

“The military, diplomats and those across the table from the United States need to know what the new normal is now that the old has been thrown out,” he said, calling for detailed guidance and clarity.

UK journalist and author Misha Glenny, who has studied patterns of cyber crime for the past 12 years, believes there is a real onus on governments to come up with some rules of the road in cyber space.

He believes this is necessary so that the world does not end up facing a black swan incident affecting the critical national infrastructure of some countries in the next decade.

“This could be the unintended release of malicious code into the wild, because nation states have shown they are not fully in control of their cyber weaponry,” Glenny told Computer Weekly in March 2018.

“WannaCry demonstrated how easy it is to affect national infrastructure when you are not even trying,” he said.

Initiatives towards an international cyber cooperation framework, such as the Tallin Manual and the Budapest Convention, have failed to meet their objectives because they do not have the support of Russia, which at present is prepared to work only through the United Nations.