Presidential Policy Directive 20

Last updated

Presidential Policy Directive 20 (PPD-20) provides a framework for U.S. cybersecurity by establishing principles and processes. Signed by President Barack Obama in October 2012, this directive supersedes National Security Presidential Directive NSPD-38. Integrating cyber tools with those of national security, [1] the directive complements NSPD-54/Homeland Security Presidential Directive HSPD-23.

Contents

Classified and unreleased by the National Security Agency (NSA), NSPD-54 was authorized by George W. Bush. [1] It gives the U.S. government power to conduct surveillance [2] through monitoring. [1]

Its existence was made public in June 2013 by former intelligence NSA infrastructure analyst Edward Snowden.

Background

Because of private industry, and issues surrounding international and domestic law, [3] public-private-partnership became the, "cornerstone of America's cybersecurity strategy". [4] Suggestions for the private sector were detailed in the declassified 2003, [5] National Strategy to Secure Cyberspace. Its companion document, National Security Presidential Directive (NSPD-38), was signed in secret by George W. Bush the following year. [5]

Although the contents of NSPD 38 are still undisclosed, [1] the U.S. military did not recognize cyberspace as a "theater of operations" until the U.S. National Defense Strategy of 2005. [3] The report declared that the, "ability to operate in and from the global commons-space, international waters and airspace, and cyberspace is important ... to project power anywhere in the world from secure bases of operation." [6] Three years later, George W. Bush formed the classified Comprehensive National Cybersecurity Initiative (CNCI).

Citing economic and national security, the Obama administration prioritized cybersecurity upon taking office. [7] After an in-depth review of the, "communications and information infrastructure," [8] the CNCI was partially declassified and expanded under President Obama. [9] It outlines "key elements of a broader, updated national U.S. cybersecurity strategy." [10] By 2011, the Pentagon announced its capability to run cyber attacks. [11]

General

After the U.S. Senate failed to pass the Cybersecurity Act of 2012 that August, [12] Presidential Policy Directive 20 (PPD-20) was signed in secret. The Electronic Privacy Information Center (EPIC) filed a Freedom of Information Request to see it, but the NSA would not comply. [13] Some details were reported in November 2012. [14] The Washington Post wrote that PPD-20, "is the most extensive White House effort to date to wrestle with what constitutes an 'offensive' and a 'defensive' action in the rapidly evolving world of cyberwar and cyberterrorism." [14] The following January, [15] the Obama administration released a ten-point factsheet. [16]

Controversy

On June 7, 2013, PPD-20 became public. [15] Released by Edward Snowden and posted by The Guardian, [15] it is part of the 2013 Mass Surveillance Disclosures. While the U.S. factsheet claims PPD-20 acts within the law and is, "consistent with the values that we promote domestically and internationally as we have previously articulated in the International Strategy for Cyberspace", [16] it doesn't reveal cyber operations in the directive. [15]

Snowden's disclosure called attention to passages noting cyberwarfare policy and its possible consequences. [15] [17] The directive calls both defensive and offensive measures as Defensive Cyber Effects Operations (DCEO) and Offensive Cyber Effects Operations (OCEO), respectively.

Notable points

Further reading

See also

References

  1. 1 2 3 4 EPIC. (n.d.). Presidential directives and cybersecurity. EPIC. Retrieved from http://epic.org/privacy/cybersecurity/presidential-directives/cybersecurity.html.
  2. ↑ Electronic Privacy Information Center. (n.d.). EPIC v. NSA - Cybersecurity Authority. EPIC. Retrieved from http://epic.org/privacy/nsa/epic_v_nsa.html.
  3. 1 2 Barnard-Wills, D. & Ashenden, D. (2012). Securing virtual space cyber war, cyber terror, and risk. Space and culture, 15(2), p. 110-123. doi:10.1177/1206331211430016.
  4. ↑ White House. (2003, February). The National Strategy to Secure Cyberspace (Rep.). Retrieved from http://www.us-cert.gov/reading_room/cyberspace_strategy.pdf.
  5. 1 2 Scahill, Jeremy (2013-04-23). Dirty Wars: The World Is a Battlefield. PublicAffairs. ISBN   978-1-56858-727-1.
  6. ↑ The National Defense Strategy of the United States of America (Rep.) (2005, March). Retrieved from http://www.globalsecurity.org/military/library/policy/dod/nds-usa_mar2005.htm.
  7. ↑ Krebs B. (2009, May 29). Obama: Cyber security is a national priority. Washington Post. Retrieved from http://voices.washingtonpost.com/securityfix/2009/05/obama_cybersecurity_is_a_natio.html.
  8. ↑ White House, Office of the Press Secretary. (2009, April 17). Statement by the Press Secretary on conclusion of the cyberspace review Archived 2009-05-21 at the Wayback Machine [Press release]. Retrieved from http://www.whitehouse.gov/the_press_office/Statement-by-the-Press-Secretary-on-Conclusion-of-the-Cyberspace-Review.
  9. ↑ Vijayan, J. (2010, March 2). Obama administration partially lifts secrecy on classified cybersecurity project Computerworld. Retrieved from http://www.whitehouse.gov/the_press_office/Statement-by-the-Press-Secretary-on-Conclusion-of-the-Cyberspace-Review.
  10. ↑ "Priorities". The White House. Archived from the original on January 20, 2021. Retrieved 2024-09-13.
  11. ↑ Nakashima, E. (2011, November 15). Pentagon: Cyber offense part of U.S. strategy. Washington Post. Retrieved from https://www.washingtonpost.com/national/national-security/pentagon-cyber-offense-part-of-us-strategy/2011/11/15/gIQArEAlPN_story.html.
  12. ↑ Rizzo, J. (2012, August 02). Cybersecurity bill fails in Senate. CNN. Retrieved from http://www.cnn.com/2012/08/02/politics/cybersecurity-act/index.html
  13. ↑ Electronic Privacy Information Center. (n.d.). EPIC v. DHS - Defense Contractor Monitoring: Classified NSA Cybersecurity Directive Sought by EPIC Establishes NSA Cyberattack Authority. EPIC. Retrieved from http://epic.org/foia/dhs/defense-monitoring.html
  14. 1 2 Nakashima, E. (2012, November 14). Obama signs secret directive to help thwart cyberattacks. Washington Post. Retrieved from https://www.washingtonpost.com/world/national-security/obama-signs-secret-cybersecurity-directive-allowing-more-aggressive-military-role/2012/11/14/7bf51512-2cde-11e2-9ac2-1c61452669c3_story.html.
  15. 1 2 3 4 5 Greenwald, G. & MacAskill, E. (2013, June 7). Obama orders US to draw up overseas target list for cyber-attacks The Guardian. Retrieved from https://www.theguardian.com/world/2013/jun/07/obama-china-targets-cyber-overseas
  16. 1 2 Federation of American Scientists. (2013, January). Presidential Policy Directives [PPDs] Barack Obama Administration. FAS. Retrieved from https://www.fas.org/irp/offdocs/ppd/index.html.
  17. ↑ Schneier, B. (2013, June 18). Has U.S. started an Internet war? CNN. Retrieved from http://www.cnn.com/2013/06/18/opinion/schneier-cyberwar-policy/index.html.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.