013 - Imperative 6 Ensure an Open Fair Competitive and Secure Global Digital Economy IV Next Steps

Section twelve of Report on Securing and Growing the Digital Economy. This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer, please visit LibriVox dot org.

Report on Securing and Growing the Digital Economy by the Commission on Enhancing National Cybersecurity Imperative six ensure an open, fare competitive, and secure global digital economy the challenge and way ahead. The United States operates in a global economy with partners, suppliers, customers, and competitors around the world. Business is now conducted at Internet speeds in digital markets and does not stop at boundaries or borders. The digital economy also depends on an open, interoperable, secure, and reliable Internet that links every corner of the globe.

This globally connected economy relies on a patchwork of technology, requirements, regulations, policies, and laws that can be at odds with the free and instantaneous flow of information. Coordinated and effective international harmonization and cooperation are needed in order to realize the full economic promise of the nation and the world, and to allow for the efficient flow of information and ideas. The unprecedented economic and social opportunities created for individuals and organizations by this global network must be balanced against the needs of each country to protect itself from fraud, abuse, crime, and security threats.

Each nation also has the right to defend itself appropriately in cyberspace. Today, the use the international digital economy lacks the coherent systems necessary to effectively address cross border malicious cyber activity. The varied individual country technology requirements, assessment regimes, and cybersecurity policies fragment markets and force companies to devote resources to multiple compliance regimes rather than to innovation. The lack of global norms and standards forces industry to select markets where they can meet the national requirements, avoiding or abandoning others.

The lack of structure adds to disparities that can degrade national cybersecurity capabilities. The void in technical policy and legal conventions hampers information sharing and interoperability. Moreover, it creates an opening for criminals to launch attacks and conduct other malicious cyber activity. The obvious but hard to achieve desired state is an international system of systems that values responsible state behavior, discourages activity that is destabilising to the global networks, and promotes the growth of the digital economy domestically and abroad.

Mechanisms need to be developed to build the capacity of partner states to investigate and prosecute cyber crime within their borders and to increase the cyber security of their critical systems. Continued collaboration and cooperation, building on a significant effort over the past two years, is required to develop common standards and assessment activities, and to harmonize regional and global cybersecurity and privacy policies, laws, and norms. Recommendation six point one.

The Administration should encourage anax and actively coordinate with the international community in creating and harmonizing cybersecurity policies and practices and common international agreements on cybersecurity law and global norms of behavior. The transnational nature of the Internet makes international cooperation essential to an effective and secure global digital economy. Issues that need to be addressed internationally include the development of cybersecurity and technical standards, international conformance requirements, and coordinated incident response.

Increased multilateral legal cooperation, continued progress toward international consensus on applying international law to cyberspace, and the formalization of communications channels. Large global companies and smaller companies active in trade face as an increasing number of cybersecurity focused regulatory requirements from jurisdictions around the world. Confronted with competing, sometimes redundant, and even conflicting regulatory obligations, these companies confined themselves allocating disproportionate resources to reconciling requirements such as cybersecurity certifications and cybersecurity examination questionnaires, when their efforts would be more productively spent on actual cybersecurity measures.

Advancing a harmonized approach for developing cybersecurity and technology requirements would aid significantly in promoting the adoption of meaningful cybersecurity measures. This approach would also reduce and avoid the regulatory and compliance burden imposed by numerous competing regulatory requirements and ad hoc conflicting compliances. The business community would also benefit from the increased predictability, which is essential for further investment of resources in cybersecurity efforts.

Action Item six point one point one. Within the first one hundred eighty days of the next administration, the President should appoint an Ambassador for Cybersecurity to lead US engagement with the international community on cybersecurity strategies, standards, and practices. Short term to further communicate to the international community that cybersecurity is a top US national security priority. The Commission believes that the President should appoint a senior official as ambassador to coordinate and lead US engagement on cybersecurity.

This position would be on power with the newly created Assistant to the President for Cybersecurity and would elevate the issue within the Department of State. The newly created ambassador position should be empowered to speak and act on the Secretary of State's behalf and have a direct line to the Secretary. This individual should have responsibility for bringing together international counterparts to harmonize cyber security standards and practices, and to develop and promote peacetime norms of nation state behavior and a common understanding of the application of international law to cyber space.

The ambassador would also have the authority to negotiate and oversee the implementation of confidence building measures on a bilateral and multilateral basis. Action Item six point one point two. The Federal government should increase its engagement in the International Standards Arena to garner consensus from other nations and promote the use of sound, harmonized cybersecurity standards. Medium term decisions made in the International Standards Arena have important consequences for the cyber security of devices and systems, and the federal government should better coordinate and more actively participate in these efforts.

This engagement, which must be coordinated with industry in accordance with federal statute and policies, should focus on cyber security and privacy standards that increase security and privacy while fostering interoperability. These standards must win consensus from multiple nations and markets in accordance with an OMB Policy Directive OMBA one nineteen. The Director of NIST chairs the Interagency Committee on Standards Policy, which includes the Lead Privacy official at OMB, the Department of State, the Department of Commerce's International Trade Administration, the Department of Homeland Security, and the U.

S. Trade Representative. This forum should be used by the federal government to guide and improve coordination and expand U S International standards participation. The Commission recommends a dedicated initiative to better align cybersecurity standards activities.

This effort should include increasing the U. S. Government role in developing international cyber security standards, and it should begin with vigorous efforts to promote the use of the cybersecurity framework for international partners, including international regulators see Imperative I Recommendation one point four, Action Item six point one point three. The Department of State should continue its work with like minded nations to promote peacetime cybersecurity norms of behavior.

The Department of State should build on current efforts with allies and other countries that share similar cybersecurity concerns to develop a strategy for expanding the adoption of cybersecurity norms of behavior in cyberspace during peacetime. The State Department should identify venues of opportunity, including in bilateral and regional engagements, the United Nations Group of Governmental Experts, the G seven, the G twenty, the Organization of Security Cooperation in Europe OSCEE, and the Organization for Economic Cooperation and Development OECD, and other multilateral forums.

The Administration should make this strategy a cornerstone of its international engagements to ensure stability in cyberspace, open access to markets, the free exps change of ideas, and the stability of the digital economy. Action Item six point one point four. Congress should provide sufficient resources to the Department of Justice DJ to fully staff and modernize the Mutual Legal Assistance Treaty MLAT process, including hiring engineers and investing in technology that enables efficiency.

It should also amend US law to facilitate transborder access to electronic evidence for limited legitimate investigative purposes, and should provide resources for the development of a broader framework and standards to enable this transborder access. Medium term. US companies provide electronic communications services globally, including to many subjects of foreign law enforcement investigations. When the communication data for those persons are stored or accessible only in the United States, a conflict can arise between the requirements of US laws and of the foreign countries laws.

The MLAT process was designed to facilitate the lawful fulfillment of foreign law enforcement requests for information and evidence, but it was designed for another era with far fewer requests before electronic evidence was routinely stored in other countries, such as in cloud services. It lacks the speed, agility, and resources needed to stop today's criminals. Dissatisfaction with the MLAT process has fueled calls by many countries for data localization, which would harm the US technology industry and impede development of new global Internet services.

In addition to reforming the MLAT process and increasing DOJ five funding to support it, Congress should pass legislation proposed by the administration that provides a speedier alternative for qualifying governments to obtain extra territorial communications data related to preventing, detecting, investigating, or prosecuting serious crimes. The United States and the United Kingdom have negotiated a bilateral agreement that eliminates conflicts of laws so that each nation, under certain conditions, may have its requests for copies of data honored by companies in the other nation.

However, in order to implement the agreement, legislative changes are necessary, including establishing a broader framework and the standards to implement that framework that will be needed to bring numerous countries into similar agreements. In order to ensure that such agreements are reciprocal and to meet the needs of U S law enforcement investigation, Congress should also ensure that, in appropriate circumstances, US law authorizes law enforcement to obtain electronic data located abroad Action Item six point one point five.

NIST and the Department of State should proactively seek international partners to extend the cyber security frameworks approach to risk management to a broader international market. Short term, NIST, in coordination with other sector specific agencies, for example, the Departments of Energy, Transportation, and Treasury, should proactively expand US participation and leadership in the development of international cyber security standards for industry and other nations. The Department of States should identify partners to help extend this approach Globally, the United States has done developed important cybersecurity risk management approaches that could benefit organizations here and abroad.

Developing and selecting international standards is an increasingly important element of many nations economic strategy, and the United States has a corresponding opportunity to enhance the capabilities of those participating nations. In particular, NIST should promote the use of the cyber security framework by actively working with industry to seek its acceptance in international standards bodies Action Item six point one point six. The Department of State DHS and other agencies should continue to assist countries with cyber security capacity building in light of growing needs and recent developments.

Short term, the United States can more effectively respond to foreign cyber threats when our international partners have their own strong cybersecurity capabilities in planning, preparation, and response. US cybersecurity and privacy capacity building is essential in creating international partners with common interoperable technologies, policies, and supportive laws to ensure the security of the global digital economy. This assistance includes helping other nations to use internationally accepted standards and conformance programs in building their cybersecurity capabilities and to adhere to and enforce international laws.

Capacity building will improve cybersecurity threat and vulnerability information sharing, as well as supply chain security, attack identification and attribution, and cooperation in critical infrastructure protection. The federal government should review its existing capacity building efforts, identify any gaps that exist, and develop solutions to fill those gaps. It should then co ordinate with other nations to provide capacity building where most needed. These efforts will require increased resources from Congress.

Moreover, the expanded capacity building strategy should be supported by an implementation plan that coordinates funding and programs across the many agencies that invest in the capacity of other nations, including but not limited to, the Departments of State, Homeland, Security, Defense, and Justice. The strategy and implementation plan should be informed by, and, where applicable, organized according to the cyber Security Framework, so that all parties can focus on a standardized set of cyber security outcomes.

End of Section twelve.