Rebooting Congressional Cybersecurity Oversight

Cybersecurity is a broad challenge spanning many disciplines and industries. This paper argues that the current “patchwork” legal framework is ill suited to address cybersecurity questions either for legislative oversight or effective policymaking. The paper provides an overview of the nature and scope of the cybersecurity problem, with a focus on how the complexity of the field affects congressional oversight activities. Congress has been conducting a substantial amount of oversight in this area in recent years. Those efforts, however, have not yet resulted in legislative actions that have demonstrably improved national cybersecurity. This paper seeks to aid the effort to craft legal authorities that deal with an increasingly complex set of cyberthreats. This short exposition provides a path to rebooting Congress’ approach to cybersecurity oversight in a way that would allow these issues to be addressed more comprehensively.

Unpacking the Cybersecurity Challenge

Cybersecurity is a complex, integrated challenge spanning topics as diverse as (but not limited to) international affairs, national security and defense, criminal law, civil liability, data protection, privacy and personal responsibility. Cybersecurity also involves many different actors, ranging from governments to companies to organizations to individuals. And it involves virtually every type of computing and information technology in use today, representing a plethora of technologies far more diverse than the personal computers and servers of yesteryear. Thus, perhaps the greatest challenge of developing a comprehensive cybersecurity governance framework is the fact that it is a highly complex problem, pervasive and interrelated across many aspects of government, the private sector, and society.

From a federal government perspective, cybersecurity presents a set of interrelated challenges. Cybersecurity responses to malign cyber activities of hostile nation-states cannot be resolved the same way traditional kinetic defense threats would be handled. For example, cybersecurity cannot just be handed off to one agency, such as the Department of Defense (DoD) or the Department of Homeland Security (DHS). Although those departments play important roles, neither can—as a result of limits on legal authorities and their appropriate roles and responsibilities—address the problem comprehensively.

Most commonly, the term cybersecurity refers to some type of defensive technical security problem. Its meaning varies both descriptively and normatively across industrial sectors, types of actors, and disciplinary backgrounds.¹ In reality, however, cybersecurity problems generally describe only one piece of a complex puzzle. The lack of a framework for defining these issues diminishes the ability of policymakers to create policy that adequately addresses the full spectrum of cybersecurity problems. This spectrum is broad and is not limited to traditional defensive boundaries. It includes strategic and adversarial planning and operations, spanning parties from private sector targets to law enforcement to military operations. In a fully internetworked world of connected appliances, vehicles, Internet of Things devices, and mobile devices, holistic consideration of cybersecurity questions is necessary. This discussion takes an expansive view of the elements that impact “cybersecurity”—ranging from technical aspects of system security to principles of international law in the context of armed conflict. This wide view is unified by the theme of efforts to improve the health of the U.S. information and computing infrastructure as an empirical matter, agnostic of any particular normative policy prescription of consumer protection, economic policy, or related issues.²

The technological aspects of cybersecurity further complicate this problem in two ways. First, they create a degree of opacity for non-technologists in understanding key elements of the problem. Second, the highly technical nature of cybersecurity lends itself to the false belief that technical measures can provide complete solutions. Nothing could be further from the truth. Indeed, solutions focusing on technological “silver bullets” often are beneficial to adversaries because of the false sense of security they provide. Many of the most effective methods of “hacking” often rely on human vectors.³ Just as a technological perimeter is an infeasible system in an interconnected world, a cyber border defended by the Armed Forces is impractical.⁴

Current Framework of Cybersecurity Law

A body of disparate law governing cybersecurity has arisen over the past several decades. While this disparate patchwork includes significant amounts of state, foreign, and international law, Congress has been reluctant to address cybersecurity law comprehensively. The lack of a coordinated policy framework both encourages additional “patchwork” policymaking and further complicates interactions with those federal laws that do exist.⁵ The result is a complex, disorganized system that substantially advantages adversaries seeking to find “cracks” to exploit. Accordingly, to understand Congress’ oversight role, it is useful to group cybersecurity law into the domains to which various policy frameworks apply.⁶ Cybersecurity law can roughly be divided into two overarching categories: the law directed at government entities and the law directed at nongovernmental entities or activities.

Cybersecurity Law Directed at Government Entities

Cybersecurity law directed at government entities refers to laws that regulate the activities of the federal government as an actor. This includes activities related to the establishment and direction of government cybersecurity action protecting national defense,⁷ creation of federal cybersecurity agencies,⁸ providing for federal government information security practices,⁹ providing a framework for law enforcement to combat cybercrime,¹⁰ and associated areas of international law.¹¹ Cybersecurity law directed at nongovernment entities and activities, by contrast, includes laws that primarily regulate the activities of actors other than the government.¹²

Discussions of defensive cybersecurity often look to the DoD to protect U.S. national security. This view overestimates the legal authority of DoD and underestimates the technological aspects of defensive cybersecurity. Over a century of precedent suggests the Posse Comitatus Act substantially limits the ability of DoD to act outside the scope of its own infrastructure during peacetime.¹³ While DoD has taken steps to address this gap from a policy perspective—such as the development of the 2018 Cyber Strategy,¹⁴ which provides for DoD’s role in defending against certain malign cyberactivity—the scope of DoD’s ability to act domestically to prevent substantial harm from cyberattack is limited. Even were such limitations modified or removed, a virtual firewall at the U.S. border would be of limited (if any) effect. The state of global commerce and the architecture of the public Internet—which largely ignores political borders—makes border security on the public Internet impractical. A view that cybersecurity problems can be managed within DoD is insufficient, both legally and technologically.¹⁵

Another common area of discussion for defensive cybersecurity is criminal law enforcement. The enforcement of civilian cybercrime law primarily rests with the Department of Justice (DoJ), with support from DHS and the Department of Commerce (DoC). DoJ plays the lead investigative and prosecutorial role, whereas DHS works to coordinate efforts and provide technical and policy expertise both to other non-military governmental entities and to civilian organizations. Both departments and their constituent agencies coordinate, explicitly or implicitly, with the DoC’s National Institute of Standards and Technology, which maintains one of the largest repositories of expertise on computer science and computer security. The legal authorities for these activities range from the enabling statutes for the agencies themselves¹⁶ to the general federal computer crimes law¹⁷ to executive directives,¹⁸ and from traditional criminal investigation and enforcement to support for organizations experiencing or at risk of cyberattacks. Information sharing, increasingly the subject of legislative activity in the early 2010s, also falls within this category. There is neither statutorily required coordination nor organized congressional oversight of this wide range of activities.¹⁹

Cybersecurity Law Directed at Nongovernmental Entities

Cybersecurity legal and policy regimes directed at nongovernmental entities have been in place for decades, drawing from information security and privacy law frameworks and regulations. They focus primarily on the regulation of private actors’ interactions with one another and the extent to which those interactions may impact the overall cybersecurity ecosystem. Such regimes usually comprise two categories, sector-specific regulation and generally applicable regulation. In addition to this distinction, nongovernmental cybersecurity regimes sometimes distinguish between consumer protection laws (primarily aimed at protecting users and their data) and infrastructure protection laws (primarily aimed at protecting systems and infrastructure). The two approaches are, of course, not mutually exclusive. Sector-specific regulation at the federal level most notably includes regulation of the healthcare²⁰ and finance²¹ industries.²² The regulatory regimes for these two sectors are similar, both employing flexible styles of process-based standards regulation. Under this type of regulation, organizations are required to conduct cybersecurity risk assessments, develop plans reasonably responsive to those assessments, and follow and maintain those plans. While regulations vary across the industries, in general the foci of these regimes are both protecting infrastructure and protecting users and data.

General regulation at the federal level is substantially patchwork and overwhelmingly conducted through the unfair and deceptive trade practices authority of the Federal Trade Commission (FTC).²³ There is debate as to the proper role of the FTC, including whether the commission’s current statutory expertise (consumer protection and antitrust) should be extended specifically to include cybersecurity.²⁴ The FTC generally lacks practical rulemaking authority as pertains to cybersecurity and data protection, and it conducts its enforcement nearly exclusively through adjudicatory enforcement actions. The past two decades have seen a substantial expansion of FTC activity in this area through the adjudicatory process.²⁵ Congress has previously conducted oversight and reform activities in the face of expanding FTC activity,²⁶ but has not legislatively addressed FTC expansion into cybersecurity under its unfair and deceptive practices enforcement.²⁷ For over a decade, regulatory agencies such as the FTC and Department of Health and Human Services have imposed regulatory fines and other penalties on companies for failure to adhere to sufficient cybersecurity practices. Congress should explore whether those fines or other regulatory enforcement actions are actually providing significant incentive to change corporate behavior, as well as resourcing of and attention to cybersecurity requirements before an incident occurs. More recently, the Securities and Exchange Commission has also explored whether it can or should have a more substantial role in regulating private sector entities under its jurisdiction.²⁸

Regulation at the state level comprises a combination of variations on the federal regimes, as well as state data breach notification statutes. State-level data breach notification laws are generally similar across states in that they require entities to notify consumers whose information was disclosed during a data breach, when the data describing the consumer includes an identifier (usually the consumer’s name) associated with sensitive information (usually Social Security number, other government identification number, or financial account number). While general breach notification law does not exist at the federal level,²⁹ it has been considered by Congress from time to time.³⁰

In recent years, information sharing has become a topic of much policy and legislative attention. In 2015, Congress passed the Cybersecurity Information Sharing Act (2015 CISA),³¹ which, among other things, provided a liability shield to qualifying private actors, such as those who participated in the newly revised information-sharing program administered by DHS and DoJ.³² Information sharing was, at the time, viewed by private industry actors as an important step for improving cybersecurity practices and defensive measures. The 2015 CISA received substantial support from private industry, in large part because of the private sector’s desire to have a liability shield against exposure to tort and/or regulatory liability for information about their systems and activities contained in shared information.³³ Privacy and data protection advocates expressed substantial concerns regarding the legislation.³⁴

Information sharing–related legislative initiatives, have, in recent years, become the most visible and engaged area of legislative cybersecurity activity. In hindsight, however, the promises of information sharing have not been demonstrated to produce substantial changes in the defensive and deterrence landscape of cybersecurity for private organizations.³⁵ Systems continue to be compromised with problematic frequency, and adversaries and bad actors continue to discover and exploit vulnerabilities. In this regard, the attention given to information sharing over the past decade was likely disproportionate to the promise such legislation and activities held for making meaningful improvement in the nation’s cybersecurity footing.

It is difficult to prove that cybersecurity measures have (or have not) been successful at macro scale. This is in part because of the classic challenges involved in proving a negative. The measure of cybersecurity effectiveness is likely commensurate with the absence of malign cyberactivity, and there does not appear to be a reliable assessment of data that proves whether cyberattacks are on the rise or on the decline. There are substantial challenges of identifying dependent variables with which to measure cybersecurity incidence, and of distinguishing the impact of any one or few change(s) given the overall complexity of cybersecurity at scale.³⁶ These difficulties also note the importance of efforts to develop or improve metrics to evaluate the efficacy of cybersecurity measures. As R Street’s Paul Rosenzweig has noted, “There are no universally recognized, generally accepted metrics by which to measure and describe cybersecurity improvements …. As a result, decision-makers (whether they be corporate boards, government officials or individual users) are left to make choices about cybersecurity implementation based on qualitative measures rather than quantitative ones.”³⁷ On this issue, exploring mechanisms to measure the effectiveness of cybersecurity activities is a worthwhile endeavor.³⁸

Measuring cybersecurity, however, will be an incomplete endeavor if it is not supported by data. To date, a full set of data is not available because nongovernmental entities are not required to provide the federal government with information about significant data breaches, which is one metric indicating the success or failure of cybersecurity efforts. Accordingly, efforts to quantify cybersecurity effectiveness should take into account proposals to incentivize nongovernmental entities to provide information to the government or an independent entity that can collate reliable data about the extent of cybersecurity incidents and breaches.

For the reasons described above—most notably the continued public and market dissatisfaction with the state of cybersecurity—the information-sharing efforts of the past decade have not been as consequential as perhaps expected by the sustained effort to obtain legislation. This is, of course, not to say that information sharing is unhelpful, nor that it does not have a useful role in an overall strategy. Rather, it is better considered as part of an overall strategy that includes, as an important component, evaluative metrics and frameworks. As with the other areas of cybersecurity regulation discussed above, the absence of a coordinated strategy highlights the limits of individual solutions and the need for comprehensive oversight and reform by Congress.

Recent Cybersecurity Congressional Oversight & Proposal for Interim Steps

The Patchwork Mismatch

Currently, existing laws, executive structure, and congressional oversight mechanisms are a mismatch for the nature of the cybersecurity challenges presented by a complex, technologically integrated society. Existing mechanisms for congressional cybersecurity oversight are likewise disjointed and uncoordinated. Unlike in many other policy areas, there is no one clear committee or clear set of committees responsible for cybersecurity issues. These are divided among many committees in both the House of Representatives and the Senate, often along historical lines that may not match current expertise. The Judiciary committees often encounter cybersecurity issues in the context of surveillance, cybercrime enforcement, and privacy issues. The Armed Services committees are called upon to consider cybersecurity issues when evaluating legislation concerning offensive and defensive cyber capabilities, which are part of the government’s response to counter hostile cyber activities by foreign nation-states. The Intelligence committees engage on cybersecurity activities most recently from the perspective of protecting electoral system infrastructure from foreign influence and malign cyber activities related to foreign interference in democratic processes. And the Homeland Security committees are heavily involved in cybersecurity oversight due to the critical cybersecurity functions that DHS provides in securing the federal government’s civilian networks and in coordinating information sharing between government entities and the private sector. The lack of a coordinating function among these committees limits Congress’ ability to obtain a comprehensive picture of the cybersecurity problem, particularly when these committees advance legislation solely from their own jurisdictions.³⁹

To develop a successful cybersecurity approach, Congress must first be able to obtain a comprehensive picture of the problem. This is challenging, and not just because of the lack of committee coordination. The complex nature of the problem itself, previously illustrated, requires gathering information about the interaction of a large set of actors, economic sectors, and government departments. How would increased organized criminal investigative activities impact the incentives of potential nation-state actors? How would the responses by those foreign actors alter the availability of malicious tools and code to third parties targeting private organizations and individuals? How might proposals to legalize “hacking back” affect adversaries’ incentives to engage in false-flag operations? These are complicated questions spanning many different areas yet attempts to address any one area impact nearly all others. This is no easy challenge for Congress, made worse by the fact that it is happening in real time, and pressure to act is growing on executive agencies Congress must oversee.

Since January 2019, in the 116th Congress, there have been at least 13 hearings involving cybersecurity topics. These 13 hearings have been conducted by seven different congressional committees, including three committees in the House of Representatives and four committees in the Senate. From January 2017 to December 2018, in the 115th Congress, there were at least 56 hearings involving cybersecurity topics. These 56 hearings were conducted by 17 different congressional committees, including eight committees in the House of Representatives and seven committees in the Senate. (See Appendix A for a list of these hearings.) Meanwhile, specific members of Congress have launched the Cyberspace Solarium Commission, mandated by the 2019 National Defense Authorization Act and comprised of members from both chambers of Congress, as well as outside experts. The commission is charged with “evaluating divergent approaches to defending the United States in cyberspace and driving consensus toward a comprehensive strategy.”⁴⁰ The commission’s recommendations for developing this strategy are scheduled to be delivered in a 2020 report.

The lack of committee coordination is only one aspect of the problem, however. There are many different aspects to the cybersecurity problem, most of which are interrelated and equally vulnerable to adversaries who seek to compromise U.S. systems. In other words, attackers don’t care how they get in—only that they do. Their mechanisms do not neatly (or even weakly) follow committee jurisdiction. While the disjointed committee patchwork could be interpreted as an argument for intelligence oversight–style reform of congressional committee structure, this is as deceptively incomplete an answer as is the myth of information sharing or effective increased deterrence through criminal penalty. Because it is precisely the patchwork nature of the problem—which spans questions in national defense, law enforcement, agriculture, energy, transportation, finance, healthcare, manufacturing, consumer protection, and a host of other areas—that makes uncoordinated oversight and legislation challenging at best. At worst, it runs the risk of benefiting adversaries by promoting a false sense of security when problems are addressed in one area at the expense of ignoring another.

Interim Steps

While this paper does not make long-term recommendations, the patchwork mismatch discussed in this section does suggest two key interim steps that could be implemented this year and next.

First, as it pertains to cybersecurity oversight and legislation, in 2020, Congress should focus particular attention on the most urgent of priorities: the cybersecurity of the 2020 election, and whether there is an urgent legislative gap or authority that would significantly aid the executive branch in combating foreign nation-state cyberattacks against the United States or U.S. interests election infrastructure and democratic institutions.⁴¹ An example of this type of immediate legislative activity would be a provision as was added to the 2019 National Defense Authorization Act, which affirmatively authorized the DoD to take action in response to election interference by China, Russia, North Korea, or Iran.⁴² An additional consideration relevant to 2020 election integrity would be what transparency requirements can be legislated promptly to mandate that the government more effectively communicate cybersecurity threats and risks—including threats to electoral systems and democratic processes—to Congress, civil society and the public. The federal government waited too long—October 2016—to inform the public at large that a serious national security threat existed as it related to Russian efforts to interfere in the 2016 election. That mistake should not be repeated, and it likely requires legislation to ensure that it is not.⁴³

Second, the most prevalent oversight shortcoming is the lack of congressional coordination focused on cybersecurity.⁴⁴ Thus, we recommend the establishment of an interim joint select committee to begin work in the 117th Congress, which will commence in January 2021.⁴⁵ Ideally, this would take the form of a joint select committee with combined House and Senate membership, and equal numbers from each political party.⁴⁶ A select committee could be charged not only with initiating direct inquiries, but also with coordinating the activities of other committees that relate to cybersecurity issues. The committee, in addition to coordinating across both chambers, could be charged with producing specific reports or proposed legislation by a given deadline.⁴⁷ We propose that this committee be a true “select” committee—one with a short-term duration to tackle a specific problem, not a “select” committee that becomes a de facto permanent one (like the intelligence committees). Although not a joint committee, the model set by the House Select Committee on the Modernization of Congress appears to be one of bipartisanship and success in staying on task with visible progress toward its mandate.⁴⁸ Moreover, the select committee can pick up on the forthcoming recommendations provided by the report of the Cyberspace Solarium Commission to ensure that the baton is not dropped after their work concludes.⁴⁹ Finally, the limited duration of such a select committee could create some political accountability with the election of the 118th Congress. By charging it to create recommendations to be implemented for the 118th, and given the high-profile nature of cybersecurity issues, voter willingness to hold members accountable for failures to act is a plausible motivation for such a committee to produce recommendations in a finite time frame.

Conclusion

Although cybersecurity presents numerous challenges to crafting effective legislation that significantly improves the nation’s cybersecurity posture, the current environment demands more work in this legislative space. Having framed the cybersecurity legal framework roughly into the categories of law directed at government entities, which is underdeveloped; and law directed at non-government entities, which is fragmented, we propose renewed congressional attention to debate and legislation in the cybersecurity arena. In the short term, those efforts should include both immediate attention to 2020 election integrity and security, and, next year, the creation of a short-term, select committee to address cybersecurity legislative proposals in a comprehensive manner.

Note for acknowledgment: The authors thank Bobby Chesney, Carrie Gardner, Gus Hurwitz, Jeff Kosseff, Paul Mazzucco, Martijn Rasser, and Loren DeJonge Schulman for their helpful exchange of ideas on the issues discussed in this paper and feedback on earlier drafts of this paper. We are also grateful for research assistance from Marta San José Marin, and for the editing and publications expertise of Maura McCarthy and Melody Cook, as well as essential copyediting of Jennifer Rubio. This paper is part of a CNAS series on congressional intelligence oversight made possible by the generous support of The William and Flora Hewlett Foundation.