The first sanctions program directed at cyber-attackers, whether an individual or group, has been signed by President Obama. With this, any attacks deemed to be of a significant threat to interests of the United States fall under the executive order.
According to the order just signed, a significant threat is constituted as anything that would threaten the economy or security of the United States, and threats coming from individuals or groups. This encompasses very specific things to include:
• Vital infrastructure
• Disruption or hijack of computer networks
• Stealing trade secrets belonging to companies or stealing personal information of citizens for the purpose of profit
As stressed by Obama in a formal statement, the main focus is on cyber threats coming from overseas. Often, law enforcement and diplomatic tools are the most effective response but by targeting sanctions, people associated with cyber-attacks can be handled in a more direct and intense manner.
Diplomatic relations are not in order with all countries, which are where the worst cyber-attackers are located. As stated by Michael Daniel, cyber-security coordinator for President Obama, the new executive order is designed as framework used to fill in gaps.
Daniel expressed that many cyber-attacks come from countries there diplomatic tools cannot reach or where commonly the government prefers to turn a blind eye to attacks of this kind on America. Because of that, the administration needed to different type of tool capable of going after cyber-attackers, especially from countries that receive little to no government support but also those where criminals are not extradited.
Daniel went on to say that the goal with the new executive order is to focus on people who are enabling cyber-attack groups in any way, to include providing financial support. When questioned if the new executive order would apply to the attackers on Sony, no comment was provided by Daniel or the Department of Treasury.
However, Daniel did say that whether the Sony case would meet the terms of the new order is difficult to speculate since the tool is not designed to help a particular company in the US but instead, the entire country itself.