Cybersecurity in Context

Chris Jay Hoofnagle is Professor of Law in Residence at the University of California, Berkeley, where he has taught since 2006. He has published extensively on cybersecurity law and related subjects, and is a practicing attorney with venture law firm Gunderson Dettmer, as well as an advisor to multiple defense and intelligence technology companies. Golden G. Richard III is Professor of Computer Science and Director of the Cyber Center at Louisiana State University. He is a Fellow of the American Academy of Forensic Sciences with over thirty years of experience in teaching cybersecurity and related topics in computer science. His primary areas of expertise are in memory forensics, digital forensics, malware analysis, reverse engineering, and systems programming.

• About the Authors xiiiPreface xvAcknowledgments xixAbout the Companion Website xxiIntroduction xxiiiI What is Cybersecurity?1 What Is Cybersecurity? 31.1 What Is the Cyber in Cybersecurity? 51.1.1 Cyberspace’s Places and the Problem of Internet Sovereignty 81.2 What Is the Security in Cybersecurity? The “CIA” Triad 121.2.1 The Internet’s Threat Model 151.2.2 Computer Security Versus “Cybersecurity” 191.2.3 Security, Innovation, “Hacking” 231.2.4 Security from a Private Sector Perspective 241.2.5 Building on the CIA Triad 261.2.6 Cybersecurity Definitions 271.3 Encryption Is Critical in Cybersecurity 281.3.1 Modern Cryptosystems 291.3.2 Hashing 331.4 Cyberpower: How Insecurity Empowers and Undermines Nations 371.5 Is Disinformation a Cybersecurity Concern? 401.5.1 From Information Scarcity to Glut 411.5.2 The Power of Influence Campaigns on the Internet 431.5.3 Libicki’s Disinformation Framework 461.5.4 The US Approach: Free Speech First 481.5.5 Election Interference 501.5.6 Is There Really Reason to Be Concerned? 531.6 International Views 551.7 Conclusion: A Broad Approach 572 Technology Basics and Attribution 592.1 Technology Basics 602.1.1 Fundamentals 602.1.2 Reliance Is a Fundamental Element of Computing and the Internet 662.1.3 Internet Layers 682.1.4 Cybersecurity Depends on Generations of Legacy Technologies 772.1.5 “Controlling” the Internet 842.1.6 Why Not Start Over? 852.2 Attribution 862.2.1 Types of Attribution 912.2.2 Attribution Process 922.2.3 Don’t Be Surprised: Common Dynamics in Attribution 1032.2.4 The Future of Attribution 1062.3 Conclusion: An End to Anonymity? 108II Cybersecurity’s Contours3 Economics and the Human Factor 1113.1 Economics of Cybersecurity 1123.1.1 Asymmetry and the Attack/Defense Balance 1163.1.2 Incentive “Tussles” 1183.2 The People Shaping Internet Technology and Policy 1203.2.1 Tragedies of the Un- managed Commons 1243.3 The Human Factor— The Psychology of Security 1273.3.1 Attackers as Behavioral Economists 1273.3.2 Institutions as Rational Choice Economists 1303.3.3 User Sophistication 1343.3.4 The Role of Emotion and the Body 1363.3.5 Security as Afterthought 1383.3.6 RCT: The User View 1383.4 Conclusion 1404 The Military and Intelligence Communities 1414.1 Why Cybersecurity Is Center Stage 1444.2 Are Cyberattacks War? 1484.2.1 Cyber War Will Not Take Place 1484.2.2 Cyber War Is Coming 1534.2.3 The Law of War 1554.2.4 Cyber Realpolitik 1624.3 Computers and the Future of Conflict 1654.3.1 The Changing Nature of Conflict 1664.4 Cybersecurity and the Intelligence Community 1764.4.1 The Intelligence Community 1784.4.2 The Power of the Platform 1874.4.3 The Vulnerabilities Equities Process 1894.4.4 Cyber Soldiers and/or Cyber Spies? 1934.5 Conclusion 1955 Cybersecurity Theory 1975.1 Deterrence Theory 1985.1.1 Deterrence Theory Contours 1995.1.2 Deterring with Entanglement and Norms 2075.1.3 Cyber “Power” 2095.1.4 The Deterrence Theory Critique 2135.2 Security Studies: Anarchy, Security Dilemma, and Escalation 2155.2.1 Anarchy 2155.2.2 The Security Dilemma 2165.2.3 Escalation and the Security Dilemma 2185.2.4 Securitization: Nissenbaum Revisited 2225.2.5 The Problem of Referent Object 2235.2.6 Nissenbaum’s Alternative Vision: Cyberattacks Are Just Crimes 2245.2.7 A Response to Nissenbaum: Strategic Risks Do Exist 2255.3 Economic Theory: The Tragedy of the Cybersecurity Commons 2265.3.1 The Free Problem 2275.4 The Public Health Approach 2305.5 Gerasimov and “Hybrid War:” Information Domain Revisited 2335.5.1 The US Reaction 2355.6 Barlowism as Theory 2375.6.1 Technology Utopianism: The Internet as Democratizing 2375.6.2 Utopia as No Place, But as Organic 2425.6.3 High Modernism and Authoritarian High Modernism 2435.7 Conclusion 246III Cybersecurity Law and Policy6 Consumer Protection Law 2496.1 Federal Trade Commission Cybersecurity 2506.1.1 FTC’s Legal Authority 2526.1.2 Unfairness 2546.1.3 Deception 2576.1.4 The Zoom Case— Complaint 2586.1.5 The Zoom Case— Settlement 2626.2 FTC Adjacent Cybersecurity 2676.2.1 The Attorneys General 2676.2.2 Self- regulation 2686.2.3 Product Recalls 2706.3 The Limits of the Consumer Protection Approach 2716.3.1 Two Litigation Moats: Standing and Economic Loss 2726.3.2 The Devil in the Beltway 2756.4 Conclusion 2797 Criminal Law 2817.1 Computer Crime Basics 2827.2 Computer Crime Incentive Contours 2837.3 The Political/Economic Cyber Enforcement Strategy 2877.4 Cybercrime’s Technical Dependencies 2917.5 The Major Substantive Computer Crime Laws 2937.5.1 Identity Theft 2947.5.2 The Computer Fraud and Abuse Act (CFAA) 2977.5.3 Other Computer Crime Relevant Statutes 3097.5.4 Digital Abuse 3117.6 High- Level Investigative Procedure 3127.6.1 Investigative Dynamics 3127.6.2 Investigative Process 3177.6.3 Obtaining the Data 3177.6.4 Stored Communications, Metadata, Identity, and “Other” 3187.7 Live Monitoring 3247.7.1 International Requests and the CLOUD Act 3267.7.2 National Security Access Options 3297.8 Conclusion 3328 Critical Infrastructure 3338.1 What Is “Critical Infrastructure” 3368.2 Political Challenges in Securing Critical Infrastructure 3418.3 Cyber Incident Reporting for Critical Infrastructure Act of 2022 3438.4 Technical Dynamics 3458.4.1 What Does CI Designation Mean 3458.5 NIST Cybersecurity Framework 3468.5.1 NIST Broken Down 3468.5.2 Electricity and Cybersecurity 3488.6 Alternative Approaches to the NIST Cybersecurity Framework 3518.6.1 Assessments and Audits— They’re Different 3528.6.2 Requirements- based Standards 3528.6.3 Process- Based and Controls- Based Standards 3548.6.4 Privacy != Security 3568.6.5 Standards Critiques 3578.7 The Other CISA— Cybersecurity Information Sharing Act of 2015 3588.7.1 Information- sharing Theory 3588.7.2 Information- Sharing Practice 3608.7.3 Provisions of CISA (the Act) 3628.8 Conclusion 3659 Intellectual Property Rights 3679.1 IPR Problems: Context 3689.1.1 IP Threats 3699.1.2 Apt1 3719 2 Protection of Trade Secrets 3739.2.1 Reasonable Measures for Protecting Trade Secrets 3749.2.2 Rights Under the DTSA 3759.2.3 The Electronic Espionage Act (EEA) 3789.3 Copyright and Cybersecurity 3799.3.1 The DMCA and Critical Lessons for Software Testing 3859.4 Online Abuse and IP Remedies 3859.4.1 Public Law Remedies for Abuse 3879.4.2 Private Law Remedies for Abuse 3929 5 Conclusion 39210 The Private Sector 39310.1 There Will Be Blood: Risk and Business Operations 39410.2 The Politics of Sovereignty 39710.2.1 Homo Economicus Meets North Korea 40010.2.2 Technological Sovereignty 40210.2.3 Committee on Foreign Investment in the United States 40410.2.4 Data Localization 40510.2.5 Export Control 40610.3 The APT Problem 40710.4 The Security Breach Problem 41110.4.1 Trigger Information 41310.4.2 What Is an Incident? What Is a Breach? 41410.4.3 Notification Regimes 41510.4.4 Does Security Breach Notification Work? 42010.5 Hacking Back: CISA (The Statute) Revisited 42110.6 The Special Case of Financial Services 42510.6.1 Gramm Leach Bliley Act (GLBA) 42510.7 Publicly Traded Companies and Cybersecurity 43010.7.1 Material Risks and Incidents 43110.7.2 SEC Enforcement 43210.7.3 The Board of Directors 43410.8 Cybersecurity Insurance 43710.8.1 Insurer Challenges 43810.8.2 Buying Insurance 43910.9 Conclusion 440IV Cybersecurity and the Future11 Cybersecurity Tussles 44311.1 A Public Policy Analysis Method 44411.2 Software Liability: Should Developers Be Legally Liable for Security Mistakes? 44611.3 Technical Computer Security Versus Cybersecurity Revisited 44911.3.1 The Criminal Law Alternative 45011.3.2 The Consumer Law Approach 45111.3.3 The Industrial Policy Approach 45111.4 Encryption and Exceptional Access 45311.5 Disinformation Revisited 45711.5.1 Racist Speech and Cybersecurity 46011.5.2 What Expectations About Disinformation Are Reasonable? 46111.6 Conclusion 46112 Cybersecurity Futures 46312.1 Scenarios Methods 46412.2 Even More Sophisticated Cyberattacks 46512.3 Quantum Computing 46612.4 Automaticity and Autonomy: Artificial Intelligence and Machine Learning 46712.5 The Data Trade and Security 47012.6 The Sovereign Internet 47112.7 Outer Space Cyber 47312.8 Classification Declassed 47512.9 Attribution Perfected or Not 47612.10 Conclusion 476V Further Reading and IndexFurther Reading 481Index 495