Bringing Out the Big Stick
President Obama yesterday signed an executive order that will put serious economic pressure on organized cyber criminals operating from overseas and on foreign companies that benefit from the cyber theft of American trade secrets and other intellectual property. I have previously criticized this administration for bringing too little, too late to this fight, but this order has real teeth. The President has moved beyond palliatives.
The order permits the government to freeze the assets of anyone who engages in, or who is complicit in, cyber attacks from abroad that harm or attempt to harm organizations “in a critical infrastructure sector.” That sector, defined in regulation, now includes a wide swath of the economy, including banks, energy, and pharmaceuticals, all of which are being relentlessly attacked over our networks. Anyone who uses cyber means to steal trade secrets, money, or intellectual property “for commercial or competitive advantage or private financial gain” is also subject to the order.
These provisions alone would not accomplish much because cyber thieves are hard to catch and are usually protected by uncooperative governments, chiefly in Russia and China. So the order goes farther. In the case of stolen intellectual property, it permits the government to freeze the assets of any company that benefits from the stolen property, “knowing it to be stolen.” That knowledge is easily supplied, either to company that manufactured the widgets or the U.S. company that imported them. The goods would then be subject to seizure.
The order also covers the property of people and companies acting directly or indirectly on behalf of parties whose property is blocked by the order. If you’re an estate agents in Mayfair, for example, you must now think very carefully before handling the property of Russian Mafiosi who has been or could be tied to cyber crime. If you do, you can now be excluded from entry into the United States, and if your agency has an office in Beverly Hills or Manhattan, the whole operation can be seized, kit and caboodle. Banks, which already have a headache trying to “know their customers,” will require even more aspirin.
This order was made under statutes that give the President emergency powers. Invoking them was a big step. It was based on the President’s finding that “increasing prevalence and severity of malicious cyber-enabled activities originating from, or directed by persons located, in whole or in substantial part, outside the United States constitute an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States.” True enough. Well done, Mr. President. It’s now up to the Treasury Secretary to put this order into effect through regulations. Let’s get going, Mr. Secretary.