Benjamin Dynkin, Barry Dynkin
Security, North America
Congress wants to ensure that cybersecurity becomes a “baked-in” concept throughout the Department of Defense.
The drafting, negotiation, and passage of the National Defense Authorization Act (NDAA) is an annual event that sets the annual budget for the Department of Defense. During this time Congress is able to exert control over the priorities, guiding principles, and issues that will be addressed by the department in the coming year. The 2018 incarnation of the NDAA, which has just been signed into law by the president, includes, nested in Title XVI, Subtitle C, provisions, a requirement that the White House and the DOD meaningfully investigate, consider, and establish national standards and guidance in the cybersecurity and cyber-warfare space. They must explore the development of a national posture for these issues.
Title XVI, Subtitle C, which is referred to as “Cyberspace-Related Matters,” contains several provisions, suggestions and requirements which range from prohibiting Kaspersky Lab products on federal systems (Section 1634) to studying the application of blockchain technologies for the DOD (Section 1646), and even authorizing the department to help states assess and detect cyber vulnerabilities in state elections (1638). Additionally, Congress wants DOD to concentrate on increasing America’s leadership role in the development of international legal norms for cyber warfare. While these are all important aspects of the U.S. national cybersecurity posture, they are constituent elements of a much larger query: what is the U.S. cyber posture and position. Fortuitously, this section contains provisions that require the DOD to analyze, study and propose answers to these questions which play a unique role in preserving America’s national security into the twenty-first century. Congress has used its power of the purse to ensure heightened engagement with these essential issues. This article seeks to present and consider Congress’ priorities in this space as they were made manifest in the 2018 NDAA.
Section 1631 & 1632—Developing Legal Norms in Cyber Warfare