American University Business Law Review Volume 2 | Issue 2 Article 1 2013 Fiddling on the Roof: Recent Developments in Cybersecurity Melanie J. Teplinsky Follow this and additional works at: http://digitalcommons.wcl.american.edu/aublr Part of the Law Commons Recommended Citation Teplinsky, Melanie J. "Fiddling on the Roof: Recent Developments in Cybersecurity." American University Business Law Review 2, no. 2 (2013): 225-322. This Article is brought to you for free and open access by the Washington College of Law Journals & Law Reviews at Digital Commons @ American University Washington College of Law. It has been accepted for inclusion in American University Business Law Review by an authorized administrator of Digital Commons @ American University Washington College of Law. For more information, please contact [email protected]. ARTICLES FIDDLING ON THE ROOF: RECENT DEVELOPMENTS IN CYBERSECURITY MELANIE J. TEPLINSKY* TABLE OF CONTENTS Introduction .......................................... ..... 227 I. The Promise and Peril of Cyberspace .............. ........ 227 II. Self-Regulation and the Challenge of Critical Infrastructure ......... 232 III. The Changing Face of Cybersecurity: Technology Trends ............ 233 A. Mobile Technology ......................... 233 B. Cloud Computing ........................... ...... 237 C. Social Networking ................................. 241 IV. The Changing Face of Cybersecurity: Cyberthreat Trends ............ 244 A. Cybercrime ................................. ..... 249 1. Costs of Cybercrime ....................................249 2. Professionalization and Commoditization of Cybercrime ....................................... 250 * Ms. Teplinsky is an adjunct professorial lecturer at American University Washington College of Law ("WCL"). She also serves on the Advisory Board of CrowdStrike, Inc. and writes and speaks frequently on cyberlaw issues. Prior to joining WCL, Ms. Teplinsky practiced law at Steptoe & Johnson LLP, where she counseled leading financial services, telecommunications, and other multinational clients on a wide array of issues including cybersecurity, data protection, and electronic surveillance. Ms. Teplinsky is a graduate of Harvard Law School and served as a law clerk to the Honorable Judge Rya W. Zobel, U.S. District Court, District of Massachusetts. The author wishes to thank Aijun Prasad and the editorial staff of the American University Business Law Review for their exceptional work and gratefully acknowledges Dmitri Alperovitch and Steven Chabinsky, who have contributed significantly to the author's thinking about the future of U.S. cybersecurity policy. The author also wishes to thank her family for their forbearance as she worked on this article, especially her loving and supportive husband, Steven, and their six-year-old red-headed daughter, who missed mommy so much during the drafting of this Article that she asked mommy to "pinky promise" not to write another. 225 226 AMERICAN UNIVERSITYBUSINESS LAW REVIEW Vol. 2:2 B. Cyberespionage ..................................... 252 1. Costs of Cyberespionage .................. ..... 256 2. Advanced Persistent Threats................ ..... 256 3. Cyberespionage Implications..........................258 4. Perpetrators of Cyberespionage ............. ..... 259 5. Cyberespionage and U.S.-China Relations ..... ..... 263 C. Cyberwar .......................................... 265 V. Recent Congressional and Executive Action...................276 A. Congressional Action (2011-2012)............................280 1. Administration Legislative Proposal ....................... 280 2. U.S. House of Representatives .........................280 a. Republican Cybersecurity Task Force ..... ..... 280 b. CISPA ........................... ..... 282 3. U.S. Senate. ........................... ..... 287 a. SECURE-IT Act................. ........ 287 b. Cybersecurity Act........................288 c. Revised Cybersecurity Act .......... ....... .......... 290 B. Rockefeller Letter..................... ......... 294 C. Executive Order .................................... 295 1. Information Sharing. .................... ...... 297 2. Cybersecurity Framework ................ ...... 300 D. Congressional Action (2013) ............................. 301 1. U.S. House of Representatives .........................301 a. CISPA ........................... ..... 301 b. SECURE-IT Act ......................... 303 2. U.S. Senate. ........................... ..... 303 E. Regulatory Litigation ....................... ..... 303 VI. Private Sector Challenges ...................... ...... 305 A. The Limits of Vulnerability Mitigation ........... ..... 305 B. Obstacles to Effective Vulnerability Mitigation ..... ..... 306 1. Lack of Cyberincident Data Necessary to Calculate ROI ...................................... 307 2. "It Can't Happen to Me" Mentality ................ 308 3. "No Corporation Is An Island": Cybersecurity as a Public Good .......................... ...... 310 C. Failure of Vulnerability Mitigation in the Face of Determined Adversaries ..................... ..... 311 VII. Private Sector Opportunities ..................... ..... 312 A. Pathways to Effective Vulnerability Mitigation ..... ..... 312 1. Cyberhygiene ............................... 313 2. Situational Awareness Through Threat Intelligence..........314 3. Insurance ........................................ 315 B. Beyond Vulnerability Mitigation......................318 2013 FIDDLING ON THE ROOF 227 INTRODUCTION [Y]ou might say every one of us is a fiddler on the roof trying to scratch out a pleasant,simple tune without breaking his neck. -Fiddleron the Roof I For today's CEOs and corporate boards of directors, trying to capture the benefits of new technology while tackling emerging cybersecurity challenges is a delicate balance akin to fiddling on the roof. This Article outlines recent developments in ".com" cybersecurity and their implications for corporate cybersecurity. Section I summarizes how information technologies have revolutionized the functioning of global economies, societies, and governments. Section II discusses the U.S. self- regulatory approach to ".com" cybersecurity and the long-standing challenge of securing critical infrastructure ("CI") networks. Sections III-V discuss technology trends, the cyberthreat landscape, and legislative developments affecting cybersecurity, respectively. Specifically, Section III outlines three technological trends that pose cybersecurity challenges: explosive growth in mobile technology; migration to cloud computing; and increasing pervasiveness of social networks. Section IV examines the increasingly complex global cyberthreat landscape, including the problems of cybercrime, cyberespionage, and cyberwarfare. Section V discusses recent congressional and executive action on cybersecurity, including the ongoing congressional debate over cybersecurity legislation. Finally, Sections VI and VII describe private sector cybersecurity challenges and opportunities, including the potential for the private sector to shift the long- standing ".com" cybersecurity debate in Washington toward a more holistic strategy that encompasses not only vulnerability mitigation, but also deterrence. I. THE PROMISE AND PERIL OF CYBERSPACE It has been said that "[c]yberspace touches practically everything and everyone." 2 With over two billion people relying on the Internet3 for a 1. FIDDLER ON THE ROOF (United Artists 1971). 2. WHITE HOUSE, CYBERSPACE POLICY REVIEW: ASSURING A TRUSTED AND RESILIENT INFORMATION AND COMMUNICATIONS INFRASTRUCTURE i (2009), http://www.whitehouse.gov/assets/documents/Cyberspace Policy Reviewfinal.pdf [hereinafter WHITE HOUSE, CYBERSPACE POLICY REVIEW]. 3. U.S. DEP'T OF DEF., DEPARTMENT OF DEFENSE STRATEGY FOR OPERATING IN CYBERSPACE 1 (2011), http://www.defense.gov/news/d20l107l4cyber.pdf ("From 2000 to 2010, global Internet usage increased from 360 million to over 2 billion people."). 228 AMERICAN UNIVERSITY BUSINESS LA WREVIEW Vol. 2:2 wide variety of economic,4 social, 5 and political interactions,6 cyberspace- the "globally-interconnected digital information and communications infrastructure"'-is nothing short of essential to modem life. Information technologies ("IT") have revolutionized the functioning of economies, societies, and governments around the globe. First, by any measure, IT has transformed the way we conduct business. IT has fundamentally changed the relationship between businesses and consumers, allowing not only for improved market differentiation and personalization of services, but also for the transformation of marketing through social media. 8 Internally, IT has driven business efficiency through the automation and/or reorganization of business processes, such as invoicing, recordkeeping, and supply chain management;9 big data analytics;10 and the 4. Global e-commerce sales are expected to reach $963 billion by 2013, according to Goldman Sachs projections. Don Davis, Global e-Commerce Sales Headfor the $1 Trillion Mark, INTERNET RETAILER (Jan. 4, 2011, 3:02 PM), http://www.intemetretailer.com/2011/01/04/global-e-commerce-sales-head-1 -trillion- mark. Cf SUCHARITA MULPURU ET AL., FORRESTER, THE ECOMMERCE JUGGERNAUT DOMINATES RETAIL 1 (2012) (noting that global e-commerce will represent a "trillion- dollar opportunity" by 2016). By 2016, Forrester predicts that "more than half of the dollars spent in U.S. retail will be influenced by the Web." SUCHARITA MULPURU ET AL., FORRESTER, US