White House touts new cyber strategy

NOTE: This article first appeared on FCW.com.

The Trump administration released its long-awaited cyber strategy to the public on Sept. 20, promising a more aggressive willingness to deploy offensive operations against nation-states and criminal groups in the digital domain.

In a call with reporters, National Security Advisor John Bolton cited a number of high-profile cyberattacks over the past two years, such as 2017 WannaCry and NotPetya, as well as a 2018 attack that shut down much of the IT operations for the city of Atlanta, as examples of how the U.S. and other governments are under siege from both nation-states and criminal hacking groups.

Bolton confirmed press reports that President Donald Trump had officially rescinded PPD-20, an Obama-era presidential directive that laid out a complex interagency process governing offensive cyber operations, earlier this month. A new classified directive will replace it that lays out a “very different” process. While he declined to discuss specifics citing national security concerns, Bolton indicated that the Pentagon, U.S. Cyber Command and “other relevant departments” will be charged with taking the fight to malicious cyber actors in order to deter future attacks.

“We’re going to do a lot of things offensively, and our adversaries need to know that,” he said. “We’re not just on defense as we have been … for a period of time.”

The White House strategy dropped the same week that the Department of Defense rolled out its own cyber strategy, which envisions a robust role for the Pentagon and U.S. Cyber Command in protecting elections, defending U.S. critical infrastructure and coordinating and sharing cyber threat data with the private sector. Bolton said DOD’s strategy reflects its new role as defined by the president’s national strategy.

The new strategy, which Bolton said “starts today,” codifies many of the changes that have been telegraphed over the past year by the administration and media reports, particularly a loosening of the rules of engagement in cyber war.

The U.S. government has been struggling to put together a unified policy for cybersecurity over the past two years as the topic has become increasingly relevant to a large number of national security and foreign policy issues. The Department of Homeland Security and the Pentagon have emerged as two of the biggest players in the defensive and offensive cyber policy arenas, sometimes clashing in turf battles as each department attempts to satisfy Congress and policymakers who have asked for more aggressive action. Bolton said it took time to work out the various roles for different agencies in the process, but now “each agency knows its lane and is pursuing it vigorously.”

“I’ll just put it this way: for any nation that is taking cyber activity against the United States, they should expect … that we will respond offensively as well as defensively, and beyond that I’m just not going to go [any further] at this point,” Bolton said.

He also said the U.S. would seek to uphold international norms in cyberspace, protect American prosperity and innovation and invest in a better cybersecurity-talent pipeline.

Bolton also addressed questions about the controversial elimination of the White House cybersecurity coordinator position, saying he inherited a National Security Council structure that was filled with duplication and overlap and that he was determined to change it. The council already has two senior directors charged with implementing and coordinating cybersecurity policy, and Bolton said other major policy areas, such as intelligence, counterproliferation and defense, also have senior directors but no top-level coordinators.

In a statement, DHS Secretary Kirstjen Nielsen said the White House strategy -- as well as DHS’ own cyber strategy released in May -- will guide a series of efforts by the department to secure federal networks, protect critical infrastructure and combat cybercrime. She also said DHS would engage with the broader law enforcement community to explore updates and changes to current laws around electronic surveillance and computer crime.

About the Author

Derek B. Johnson is a senior staff writer at FCW, covering governmentwide IT policy, cybersecurity and a range of other federal technology issues.

Prior to joining FCW, Johnson was a freelance technology journalist. His work has appeared in The Washington Post, GoodCall News, Foreign Policy Journal, Washington Technology, Elevation DC, Connection Newspapers and The Maryland Gazette.

Johnson has a Bachelor's degree in journalism from Hofstra University and a Master's degree in public policy from George Mason University. He can be contacted at djohnson@fcw.com, or follow him on Twitter @derekdoestech.

Click here for previous articles by Johnson.

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

What is your e-mail address?

My e-mail address is:

Do you have a password?

Forgot your password? Click here


  • POWER TRAINING: How to engage your customers

    Don't miss our Aug. 2 Washington Technology Power Training session on Mastering Stakeholder Engagement, where you'll learned the critical skills you need to more fully connect with your customers and win more business. Read More


    In our latest Project 38 Podcast, editor Nick Wakeman interviews Tom Romeo, the leader of Maximus Federal about how it has zoomed up the 2019 Top 100. Read More

contracts DB

Washington Technology Daily

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.