Bill would tie foreign aid to cyber crime

A major new cybersecurity bill set to move through Congress this month would enable the secretary of state to condition foreign aid on countries’ action to counter cybercrime and cyberespionage.

On Feb. 15, senators introduced the Cybersecurity Act of 2012, a massive piece of legislation that represents the culmination of years of work in Congress to put together a new regime for public-private cooperation on combating the growing threats on the Internet. The main thrust of the bill is to identify those parts of the private sector that constitute "critical infrastructure" and to charge the Department of Homeland Security with working with the private sector to institute and enforce higher cybersecurity measures for those companies.

But one section of the bill directly links cybercrime in foreign countries to U.S. foreign assistance to those governments.

"The Secretary of State is authorized to accord priority in foreign assistance to programs designed to combat cybercrime in a region or program of significance in order to better combat cybercrime by, among other things, improving the effectiveness and capacity of the legal and judicial systems and the capabilities of law enforcement agencies with respect to cybercrime," the bill reads.

It continues: "It is the sense of Congress that the Secretary of State should include programs designed to combat cybercrime in relevant bilateral or multilateral assistance programs administered or supported by the United States Government."

In a briefing with reporters Wednesday, Senate staffers who worked on the bill said that in addition to trying to build foreign countries’ capacity to fight cybercrime, the goal is also to empower the State Department to use foreign aid as leverage to get countries to get active on fighting cybercrime and stop cyberespionage.

"There is a concern that some countries are not taking the issue seriously enough and we ought to do more to try to push them do so," said a Senate Democratic aide. "If there are cases where we are giving foreign assistance to countries that are turning around and being complicit in cyber crimes launched against the United States, maybe we need to take that into consideration as we are working on our foreign assistance package."

The provision was written by Sen. Kirstin Gillibrand (D-NY) and was based on a bill she had written with former Sen. Orin Hatch (R-UT).

"There isn’t a mandate for State. It’s not telling them they have to tie foreign assistance to countries’ actions on cybercrime, but it’s giving them a tool both to help build capacity in countries who want to do the right thing and pressure countries who do not want to do the right thing," the aide said.

The bill also calls on the secretary of state to work with international partners to ensure lawful behavior in cyberspace, develop a strategy for promoting norms in cyber behavior, and quotes Clinton as saying, "Those who disrupt the free flow of information in our society, or any other, pose a threat to our economy, our government, and our civil society. Countries or individuals that engage in cyber attacks should face consequences and international condemnation. In an Internet-connected world, an attack on one nation’s networks can be an attack on all. And by reinforcing that message, we can create norms of behavior among states and encourage respect for the global networked commons."

Another Senate democratic aide predicted that once the bill reaches the Senate floor, probably later this month, senators will try to add language that increases protections against products coming into the United States from foreign companies that have ties to authoritarian regimes or their armies.

It’s what’s known as "the Huawei problem," named after the Chinese computer technology company that just happens to be run by former high-ranking members of the Chinese People’s Liberation Army.

"What we call ‘the Huawei problem’ is a really difficult one to get your hands around because it is the quintessential 21st-century problem where you have a global telecommunications conglomerate that is a commercial entity but has close connections to a very important nation state which has very sophisticated and aggressive cyber espionage capabilities and intent," another Senate Democratic aide said.

Right now the bill seeks to prevent purchases of any products that are believed to be compromised and there are provisions to protect the government acquisitions supply chain, but multiple senators are expected to try to strengthen the bill’s approach to such companies through amendments, the aide said.

"That’s a needle you have to thread because it implicates global trade policy and WTO requirements, but we’ve got to make sure that ‘the Huawei problem’ is not overlooked."