The Trump administration recently released its National Cyber Strategy. The document covers four pillars of activity, such as the development of a cyber group, the protection of government networks and critical infrastructure and the fight against malicious cyberattacks from foreign actors.

Privacy professionals may look at the report and wonder where the privacy is in the White House’s report. Despite no overt references within the cyber strategy, however, many former federal government privacy professionals believe there is no way for the U.S. government to enact its plans without a mindful nod toward privacy.

“Whether it is emphasized or not in the language of the White House’s 25 pages or not, I think you can’t truly deal with cyber threats without properly considering how you are going to navigate privacy concerns,” said Goodwin Partner and former Chief of the Criminal Division for the U.S. Attorney’s Office for the Eastern District of New York James D. Gatta. “That’s just the nature of things.”

Davis Wright Tremaine Partner and former Director for Privacy and Civil Liberties at the White House Helen Foster shares a similar view. Even if privacy hasn't been explicitly mentioned in the National Cyber Strategy, Foster believes it does not mean the federal government has avoided the topic altogether.

“There is not a lot of talk about privacy in the document, which is not unusual for this kind of document, except for the fact that the topic is so interwoven with privacy and we know that we have issues in this area,” said Foster, who also served as CPO for the U.S. Department of Housing and Urban Development. “Particularly for the private sector, who can face huge liability for letting go of the wrong information. So you need to have folks in the private sector sharing information with the government, except they can get sued for that.” 

Foster noted that cybersecurity threat information sharing often involves consumer communications for which private industry has a legal obligation to maintain confidentiality. She said the private sector may end up violating statute should they disclose consumer communications and data without due process, which may also trigger freedom of speech considerations should citizens believe the government monitors communications. Foster believes without protection from liability, the private sector is better off withholding the information from the government.

Could data sharing be improved using techniques such as anonymization? Given the large amount of information at play, Foster does not think it is an option.

"In my experience the government players agree that private partners need to be free from liability for sharing cyber threat data," Foster said in an emailed statement. "The problem is getting that kind of legislation done, because privacy advocates and civil society groups argue that it will allow for too much government intrusion into private information," which is an issue Foster said groups such as the American Civil Liberties Union and the Center for Democracy and Technology have been working on for years.

Foster is also troubled by the White House’s recent elimination of the special assistant to the president and cybersecurity coordinator position, and the currently unoccupied position of director of the Office of Privacy and Civil Liberties (Peter Winn is serving now as acting Chief Privacy and Civil Liberties Officer).

Foster noted efforts to bolster the poor data sharing between the federal government and the private sector have been going on since the Bush administration. In order for those data sharing agreements to get back on the right track, Foster said the government needs to work with the private sector and privacy advocacy community, but the vacancies and terminations of the aforementioned positions leaves no one to consider these issues.

“That tells you where your priorities are right there. If you are going to have a priority on cybersecurity, you are going to need somebody in the role of the Director of Privacy and Civil Liberties,” said Foster. “You are going to need a cybersecurity expert and a political operator who can lead this and you are going to need the absolute, unwavering support of the president. If you can see an indication of that, you are a better person than I am.” 

As the National Cyber Strategy was released, rumblings of a federal U.S. privacy law have continued to make news. Laws such as the California Consumer Privacy Act of 2018 have reignited the conversation around an umbrella privacy law.

Should a federal privacy law come to fruition, it will inevitably work in conjunction with a national government cyber strategy.

“What we need is for Congress to be openly discussing this stuff and hammering out the right privacy laws for the country,” said Gatta, who has worked with the U.S. Department of Justice prior to joining Goodwin. “I think we will necessarily have to interact with whatever the government’s cybersecurity strategy is, and whether [privacy] is emphasized in the policy or not, it will certainly make itself part of the conversation.”

One major privacy consideration Foster looks to keep an eye on is transparency. Foster said the new cyber strategy is the first to focus on the use of cyber countermeasures. As foreign actors continue to conduct cyberattacks against the U.S., questions will arise as to how U.S. citizens’ data will be used to combat those incidents.

What tradeoffs of Americans' privacy might be necessary to maintain national security? As with her prior issues with the strategy, Foster noted there are no indications within the White House document, nor is there much of anyone within the administration present to assuage any concerns.  

“That is very worrying that we are talking about a new type of weaponization that potentially involves all of our information and our corporate data, but we can’t find what out what that impact is,” Foster said.

Will privacy get more of an overt consideration in future national cyber strategies? While it did not crack the Trump administration’s report, Gatta believes it is inevitable for privacy and cybersecurity to collide.

“In enacting a robust cyber enforcement strategy, you are necessarily going to be bumping up against the balancing between individual liberties and the right of the government to protect people,” said Gatta. “I would imagine that future White House cyber strategies are going to reflect privacy concerns and privacy protections.”

Photo credit: HarshLight via photopin cc