President Joe Biden on Thursday will sign an executive order that is his final stab at shoring up America’s cyber defenses after a damaging string of cyberattacks on federal networks that US officials have blamed on Chinese and Russian operatives.
The directive is the product of a monthslong review by US officials of key hacking operations that took place during the Biden administration, from Russia’s alleged disruption of a satellite provider before the Kremlin’s full-scale invasion of Ukraine, to China’s alleged infiltration of US telecom networks to spy on top Republicans and Democrats.
The goal is to “put the new administration and the country on a path to continued success” and “to make it costlier and harder for China, Russia, Iran and ransomware criminals to hack,” Anne Neuberger, a senior White House official, told reporters on Wednesday.
The order will task agencies with using stronger encryption to protect federal employees’ calls and text from interception, according to a draft reviewed by CNN. That’s a nod to the Chinese telecom hack, which preyed on targets who used insecure messaging. The directive also gives the Department of Homeland Security’s cyber agency more power to gather key data from other agencies’ networks to investigate sophisticated hacking operations and makes it easier for the Treasury Department to sanction cybercriminals or spies who disrupt critical US infrastructure.
The executive order also calls for new programs to try to reduce the billions of dollars’ worth of identity fraud that has affected Americans and to use artificial intelligence to protect the American energy sector from hacks.
The order reflects Biden administration officials’ long-running frustration with lax security practices at software firms that sell to the US government. A US government-backed review of Microsoft’s security practices, for example, found a “cascade” of “avoidable errors” that allowed another group of Chinese hackers to breach the tech giant’s network and later the email accounts of senior US officials in 2023. (Microsoft has announced reforms to its security policies.)
In his first months in office, Biden issued another cybersecurity order that required contractors meet a minimum set of security standards to do business with the government. But Thursday’s directive is finally requiring those contractors to provide the government and the public with data showing their software meets secure development requirements. Federal agencies will post the receipts online for the public to see, per the order.
“We were not validating that products we were using actually conveyed to us that they were meeting that secure standard,” Neuberger said.
Cybersecurity has been a traditionally bipartisan issue. It is not yet clear to what extent the new Trump team that takes office next week will keep or scrap the executive order. Trump’s incoming national security adviser, Mike Waltz, has called for more offensive cyber operations, but the next administration has not laid out strategies for cyber defense.
