Improving Critical Infrastructure Cybersecurity

* The following article was originally published in Submarine Telecoms Forum (pg. 19–23).

On February 26, 2014, the United States Department of Justice (DOJ) petitioned the Foreign Intelligence Surveillance Court to allow the National Security Agency (NSA) to maintain its database of telephone records that would otherwise need to be purged pursuant to its existing data-collection authority authorized by the court. DOJ requested this additional authority ostensibly to ensure that the DOJ has access to records that may be relevant to lawsuits targeting the NSA’s sweeping collection of telephone metadata of both Americans and other countries’ citizens alike. One plaintiff challenging the NSA’s collection of telephone metadata, the American Civil Liberties Union (ACLU), stated that the DOJ’s request “is just a distraction. We don’t have any objection to the government deleting these records. While they’re at it, they should delete the whole database.”

These revelations and others by former NSA contractor Edward Snowden will likely add more fuel to fire for foreign governments to protect their citizens’ data from US government eavesdropping. Most commentators agree that these revelations have spurred Brazilian President Dilma Rousseff to press the European Union to accelerate the pace of the deployment of the planned $185 million undersea fiber optic telecommunications link that will be laid directly from the northeast of Brazil to Fortaleza, Portugal. It remains to be seen, however, whether the four anticipated submarine cable systems that were planned to be added between the United States and Brazil in the coming years will be put on hold until there is a thaw between the countries’ leadership.

Similarly, German Chancellor Angela Merkel and French President François Hollande have been engaged in discussion recently to explore methods to protect EU citizens’ data and keep email traffic away from US servers. Chancellor Merkel stated she “will talk with France about how we can maintain a high level of data protection. Above all, we will discuss which European providers we have who offer security to citizens so that you don’t have to cross the Atlantic with emails and other things, but also can build up communication networks within Europe.”

Some cybersecurity experts, however, question how secure foreign citizens’ data can be even if it is not processed through US based servers, given the disclosure last year that the NSA was tapping into Pacnet’s submarine cables located across the Asia-Pacific region. Tapping submarine cables, however, is certainly not a recent phenomenon. Beginning in the early 1970s, the US government began tapping Soviet naval undersea communications links deployed between Soviet naval bases. This project lasted until 1981 when NSA employee Ronald Pelton, now serving a life sentence, disclosed the existence of this eavesdropping operation to the Soviets for the sum of $35,000.

More recently, the Associated Press reported in 2005 that the USS Jimmy Carter, a Seawolf-class attack submarine, was repurposed for highly-classified missions, including the ability to carry crews of technicians to the bottom of the sea so that they could tap into undersea fiber optic lines. Additionally, the NSA paid its British equivalent, the Government Communications Head Quarters (GCHQ), $25 million to radically upgrade its listening station operated at Bude in the north of Cornwall, where many undersea cables surface out of the Atlantic.

Perhaps to quell some of the ongoing furor surrounding US surveillance, the Obama Administration announced in mid-February the launch of its voluntary Cybersecurity Framework, which is the result of a year-long effort led by the National Institute of Standards and Technology (NIST) and key industry participants to develop a voluntary how-to guide for organizations in the critical infrastructure community to enhance their cybersecurity. In a potential nod to the controversy surrounding the NSA data-collection controversy, the Cybersecurity Framework also offers guidance regarding privacy and civil liberties considerations that may result from cybersecurity activities. Although many organizations already have processes for addressing privacy concerns, the Cybersecurity Framework methodology is designed to complement such processes and provide guidance to facilitate privacy risk management consistent with an organization’s approach to cybersecurity risk management.

The Cybersecurity Framework is a key deliverable from President Obama’s Executive Order 13636, entitled “Improving Critical Infrastructure Cybersecurity” and which President Obama announced in his 2013 State of the Union speech and released on February 12, 2013. The Cybersecurity Framework is intended to steer companies toward best practices that deter hackers and other cyber spies from interfering with critical infrastructure, including global digital infrastructure, such as undersea communications cables that surface on US shores.

The goal of the Cybersecurity Framework is for industry and government to strengthen the security and resiliency of critical infrastructure based on public-private cooperation. Yet given that the United States Senate has twice failed to advance White House-backed legislation to give government more explicit authority to mandate certain minimum standards for cybersecurity of private sector critical infrastructure, the Cybersecurity Framework remains entirely voluntarily and lacks many key incentives sought by industry stakeholders. Many businesses have argued that perks — such as giving participating companies immunity from lawsuits in the event of a hacking incident, tax breaks, special technical assistance, or other incentives — are necessary to offset the costs of investing in new security technologies and procedures.

Further, despite being applicable to only US-based companies and government agencies that provide critical infrastructure, the Cybersecurity Framework references globally accepted standards, guidelines and practices, so that organizations domiciled inside and outside of the United States can use Cybersecurity Framework to efficiently operate globally and manage new and evolving risks. In refusing to develop US-centric standards, NIST stated that diverse or “specialized requirements can impede interoperability, result in duplication, harm cybersecurity, and hinder innovation.” For organizations with more advanced cybersecurity, the Cybersecurity Framework also offers a way to better communicate with their CEOs and with suppliers about management of cyber risks.

Each of the Cybersecurity Framework components is intended to reinforce the connection between business drivers and cybersecurity activities. The Cybersecurity Framework is divided into the following parts:

• The Cybersecurity Framework Core is a set of cybersecurity activities, outcomes and informative references that are common across critical infrastructure sectors, providing detailed guidance for a company to develop its cybersecurity risk profile. The cybersecurity activities are grouped by five functions — Identify, Protect, Detect, Respond, Recover — that provide a high-level view of an organization’s management of cyber risks.

• The Cybersecurity Framework Profiles are intended to help organizations align their cybersecurity activities with business requirements, risk tolerances, and resources. Companies can use the Profiles to understand their current cybersecurity state, support prioritization, and to measure progress towards a target state.

• The Cybersecurity Framework Tiers provide a mechanism for organizations to view their approach and processes for managing cyber risk. The Tiers range from Partial (Tier 1) to Adaptive (Tier 4) and describe an increasing degree of rigor in risk management practices, the extent to which cybersecurity risk management is informed by business needs, and its integration into an organization’s overall risk management practices.

NIST, however, is quick to acknowledge that the Cybersecurity Framework is not a one-size-fits-all approach to managing cybersecurity risk for critical infrastructure. As NIST stated, “organizations will continue to have unique risks — different threats, different vulnerabilities, different risk tolerances — and how they implement the practices in the Framework will vary.” Organizations are thus encouraged to determine their specific activities that are important to critical infrastructure delivery and to prioritize investments to maximize the impact of their continuing cybersecurity efforts.

Although the adoption of the Cybersecurity Framework is entirely voluntary, the Department of Homeland Security (DHS) has established the Critical Infrastructure Cyber Community (C3) Voluntary Program as a public-private partnership to increase awareness and use of the Cybersecurity Framework. The C3 Program is intended to connect companies, as well as federal, state, local, tribal, and territorial partners, to DHS and other federal government programs and resources that will assist their efforts in managing their cybersecurity risks. The goal of C3 is to provide a forum for participants to share lessons learned, get assistance, and learn about free tools and resources that can help them.

Ross A. Buntrock is practice group leader of Arent Fox’s Communications, Technology & Mobile practice and is nationally recognized for his work in communications, media, and technology law. He advises telecommunications carriers, technology companies, content providers, mobile payment companies, app developers, and associations on all aspects of communications and trade regulation.