Cybersecurity Executive Order? – A Few Thoughts On Leaked 'Drafts.'

More than two weeks ago, the President postponed issuing an executive order on cybersecurity. Since then, we've had no word from the White House on when he intends to sign it. However, two purported drafts of the order have wound up on the Internet—the Washington Post published the first one,1 and Lawfare, the second. Here are a few quick impressions on those drafts, bearing in mind that the finalized version, if signed, will likely be different.

The drafts are relatively tame compared to some of the President's other executive orders. Both generally call for reviews of and reports on the nation's cyber defense capabilities. The first draft would have created four review panels to report to the President on issues ranging from U.S cyber capabilities and vulnerabilities to the identification of cyber adversaries. The second draft sounds similar themes, and maintains elements of those reviews, but places more emphasis on ensuring that federal agencies are prepared to confront cyber threats. This measured approach has led at least one expert to suggest (with respect to the first draft) that the Administration is merely "kick[ing] the can down the road." Both drafts, for instance, fail to mention just how the Administration plans to address the specific cyber threat that the nation is already well aware of— Russia.

Protecting the nation's critical infrastructure is a key theme in both drafts. The first draft calls for a report on "options to incentivize private sector adoption of effective cyber security measures." The goal is to "induce private sector owners and operators" of critical infrastructure "to maximize protective measures," invest in "cyber enterprise risk management tools and services," and "adopt best practices." The second draft refines its approach to the report, calling instead for certain federal agencies to "identify authorities and capabilities . . . to support the cybersecurity efforts of critical infrastructure owners and operators." It also includes a section on "core communications infrastructure," tasking the Secretary of Commerce with finding ways to encourage collaboration between...