A vacuum the size of cyberspace. That unfortunately describes the long awaited but non-existent list of “cyber worst actors” based on President Obama’s executive order to impose economic sanctions in response to “malicious” foreign-controlled cyber related activities. This list will identify the Department of the Treasury’s Office of Foreign Assets Control’s (OFAC) “Specially Designated Nationals and Blocked Persons List (SDN-Cyber)” — if OFAC ever issues a list. Distressingly, OFAC needed 8 months after the president issued the cyber-activities executive order (on April 1, 2015 and made effective on December 31, 2015) to publish anemic and meager regulations. Incredibly, the regulations fail to define the key terms “malicious activities” and “posing a significant threat to the national security, foreign policy, or economic health or financial stability of the United States.”
OFAC has abdicated its responsibility to publish clear, enforceable regulations on cyber criminality. That postpones indefinitely any effective U.S. government action to specify clearly when, who, and how cyber criminals — both state and non-state — will be punished financially by OFAC under the executive order.
This isn’t OFAC’s first time listing and sanctioning cyber rogues. In January 2015, in response to the hacking of Sony Pictures, Obama issued an executive order immediately listing the government of North Korea and individuals for economic sanctions. Obama’s executive order addressed previous cyber hacking, bringing to mind numerous known bad actors that could be listed based on previous cyber breaches.
Mega piracy king Kim Dotcom, currently attempting to halt extradition to the U.S. to stand criminal trial, could make any long — or short –sanctions list for piracy of intellectual property. Unfortunately, regardless of the fact the U.S. DOJ has indicted Dotcom for alleged theft of millions of dollars of intellectual property from the entertainment industry, the executive order could be used against him to block his U.S.-based assets only if the Treasury determines that Dotcom’s theft constituted a “significant threat” to the “economic health or financial stability of the United States.” Moreover, how do the executive order and OFAC regulations stop ongoing flagrant profiting from prior cyber theft and compensate the victims for their accrued and future financial losses?
What about listing China, whose People’s Liberation Army is responsible for hacking into American defense contractors and stealing trade secrets that are significant to national security and commercially valuable? For example, 60 Minutes reported recently on China’s theft of intellectual property, from the American Superconductor company. China stole the company’s software to control wind turbines, and used that stolen software for use in Chinese wind turbines, bypassing American Superconductor and nearly destroying their business. China is responsible for stealing American Superconductor’s software, and for using the misappropriated technology to operate wind turbines. In this theft, China sure looks like a “person” who “directed” the theft from outside the United States and “use[d]” it for commercial purposes as described in the executive order and thus should be on the OFAC list. If the OFAC SDN-CYBER category were a real-world list in existence and China on it, the federal government and Massachusetts presumably would not have been allowed to use federal taxpayers’ money to buy those turbines. American Superconductor would clearly vote China onto OFAC’s Cyber Worst Actors list.
Then there is the Snowden conundrum with the cyber sanctions. Do Edward Snowden’s gargantuan cyber theft of national security documents constitute a “significant threat to the national security” of the United States under Obama’s cyber executive order? What about other persons (who may be a U.S. or non-U.S. citizen) who may have “materially assisted” or “provided financial” support to Snowden in support of those thefts or support him in the future? These “persons” might include Julian Assange and the Government of Russia. This scenario highlights the difficulty of implementing the key criteria in the cyber E.O. and the failure of the current OFAC regulations.
Despite the frustration with OFAC’s phantom cyber list, the Securities Exchange Commission is the poster child for going after cyber hackers where it hurts and successfully — freezing assets. Last, week the SEC froze assets against nine new defendants, in addition to the 34 Ukrainian-associated cyber traders and hackers who infiltrated Wall Street newswires’ computers and stole and released to their associates non-public financial information that generated approximately $100 million in illegal trading profits for the hackers. The U.S. Government knew most of these hackers at the time the president issued his cyber executive order in April 2015. When OFAC gets around to issuing the Cyber Worst Actors list, the SEC has at least 40 names for OFAC to consider nominating.
The now-effective and seriously deficient OFAC regulations represent a significant part of the Obama administration’s efforts to deter and punish cyber criminals. One hopes diplomatic pressures did not influence OFAC to issue the current anemic regulations, lest vigorous cyber economic sanctions regulations offend significant U.S. trade partners. President Obama’s cyber sanctions executive order must be implemented promptly and firmly, to deter and punish cyber criminality and cyber theft, particularly in well-documented cases such as multiple cyber-predations by the Government of China and its PLA. Treasury/OFAC’s current lackluster implementation of Obama’s cyber executive order results in an unfortunate signal to foreign governments, among others, that the U.S. Government is acquiescing to state and non-state actors undermining U.S. interests.
Treasury evidently decided not to seek public opinion concerning these critical regulations. Although the regulations address the crucial subject of cyber crime, Treasury waived the requirement of the Administrative Procedure Act for advance opportunity for public comment before issuing regulations. In this case, silence is not golden. OFAC admits that these regulations are in “abbreviated form.” OFAC says it “intends to supplement [the cyber-sanction regulations] with a more comprehensive set of regulations, which may include additional interpretive and definitional guidance.”
In the spirit of good, “transparent” government, Treasury/OFAC should invite public comments for the official record, hold a public hearing, and provide a public response to those comments, including any comments urging Treasury to consider revising the current regulations. Any less robust effort to strengthen the current regulations only emboldens the “Cyber Worst Actors” to continue their cyber-based attacks against all aspects of the United States’ national security and economic interests.
Mattie Lolavar is President of M22 Strategies, Inc. a policy and communications firm focused on cybersecurity. She is the Founder of CyberSalon™ a monthly meeting bridging the public and private sectors on cyber issues.