Biden’s cybersecurity executive order aims to strengthen US protections: NPR

In the final week of his term, President Biden signed an ambitious executive order on cybersecurity incorporating lessons learned over the past four years.

From his first days in the White House, Biden has faced disruptive digital attacks, from Russian spying on U.S. government agencies through third-party software to ransomware attacks hitting hospitals and Chinese hackers infiltrating infrastructure reviews.

Over time, the Biden administration has found new ways to combat spies and cybercriminals. They took ill-gotten gains by targeting cryptocurrency wallets. They released detailed indictments targeting individual hackers around the world. They shut down botnets and removed malicious code from infected devices, to name a few examples.

But hackers continue to steal vast amounts of data and dollars, and the threat is far from over.

The power of the purse

With that in mind, the new executive order issued Thursday follows a previous one issued during Biden’s first year in office. It aims to make federal agencies and contractors more secure and give the federal government more power to punish hackers who target critical infrastructure.

“The goal is to make hacking more expensive and difficult for China, Russia, Iran and ransomware criminals, and also to signal that America is serious about protecting our businesses and our citizens,” said Anne Neuberger, Biden’s outgoing national vice president. Security advisor for cybersecurity and emerging technologies, on a call with journalists.

Defensively, the U.S. government uses the power of the purse. Software companies that sell to the government will have to prove they use secure development practices to win and keep lucrative federal contracts. Compliance verification standards will be developed by the National Institute of Standards and Technology, or NIST. The decree will also impose cybersecurity standards for the procurement of new space systems.

Emphasis is also placed on combating identity theft. The U.S. government is pushing the industry to develop secure, privacy-protecting digital identity solutions. The focus is on secure provider storage of private cryptographic keys for identity management.

Internally, the U.S. government will require agencies to adopt quantum-resistant algorithms to protect against theft and decryption by adversaries. And the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, or CISA, will be given more responsibility for investigating known vulnerabilities in federal systems. They will benefit from “more centralized visibility,” Neuberger said.

The Biden White House is also launching a partnership with the private sector to develop tools to use artificial intelligence to better secure the energy sector, including scanning for vulnerabilities and automatically suggesting potential fixes.

“This is an area that is particularly targeted by countries and criminals,” Neuberger said.

Finally, the executive order will make it easier for the federal government to impose sanctions on ransomware groups that target critical infrastructure such as schools and hospitals.

Neuberger told reporters that Biden’s team had not discussed details of the cybersecurity executive order with President-elect Donald Trump’s transition team in advance because he has not yet named his top officials in matters of cybersecurity. She said they were open to those discussions once Trump’s team was in place.

Trump’s new officials can reverse or replace Biden’s executive actions at will. But the hope, Neuberger said, is that the executive order’s goals are largely bipartisan.

Industry and policy experts welcome the executive order and encourage President-elect Trump to maintain and expand the Biden team’s cybersecurity efforts.

“Cybersecurity and defending our nation’s critical infrastructure from threats has always been a nonpartisan issue,” said Ilona Cohen, chief legal and policy officer at cybersecurity firm HackerOne.

“We are particularly encouraged by the order’s recognition of the potential of artificial intelligence to improve cybersecurity and its focus on addressing vulnerabilities involving AI systems and software,” Cohen said. “We encourage the Trump Administration to advance the order’s provisions, particularly those aimed at staying ahead of China in security through AI.”