Cyber Crime, Espionage and Terrorism

Cyber Espionage: The Silent Crime of Cyberspace

Virginia Greiman Boston University, Boston, USA [email protected] Abstract: In recent years, the disclosure of secrets through cyber infiltration of America’s largest intelligence organization, the National Security Agency (NSA), has raised the fears of veteran intelligence officials and close allies around the globe that no institution or government is secure from those who roam the discrete halls of cyberspace. Although espionage has existed since before the days of the Greek mythological Trojan horse, no one could have envisioned the sophisticated use of espionage in today’s networked world. Espionage has been used for political and military intelligence and economic and industrial pursuits with a lack of understanding of all of the impacts on our daily lives. In the context of foreign or international law, espionage is sometimes characterized as lawless, without controls or regulation, and it rarely distinguishes between economic and security based cyber espionage. Through empirical analysis this paper explores the treatment of espionage under various legal systems including those countries and regions considered the most advanced at cyber espionage, the United States, the United Kingdom, Russia and China. To provide greater insight into the different perspectives of cyber espionage from a legal standpoint, this paper distinguishes the law of national intelligence collection from the criminal laws of economic/industrial espionage on the domestic front. The purpose of this research is to analyze the development of cyber espionage as a preferred means of contemporary warfare, as well as a tool for economic and political intelligence. The paper concludes by responding to the challenges faced by nation-states in the development of an effective legal system governing espionage at the domestic and international level. Keywords: cyber espionage, cybercrime, foreign surveillance, national intelligence, economic espionage, cyber warfare

1. Introduction Although many countries all over the world are committing cyber espionage, the United States, Russia, and China represent the most sophisticated cyber spying capabilities (Senate, 2014). A 2011 Report by the Office of the National Counterintelligence Executive (ONCIX) suggested that the rise of cyberspace as a platform for innovation and storage of trade secrets was greatly enhancing the risks faced by American firms. The report also found that the United States remains the prime target for foreign economic collection and industrial espionage by virtue of its global technological leadership and innovation (ONCIX, 2011). Cyber espionage has also become an accepted and even preferred means of warfare. That is not to say that cyber espionage will replace traditional means of warfare, but it is already affecting the nature of nation-state conflict. Dunn Cavelty (2012) suggests that this shift began with the Cold War, when the United States and Russia focused their efforts on covert information gathering over outright warfare. Because all-out war between major world powers has become less acceptable in the modern world, more cautious strategies have continued into the 21st century. In the last few decades especially, as technology has become more advanced, cyber espionage tools have become indispensable to modern military operations (DoD, 2015). The Defense Department continues to support the Justice Department and other agencies in exploring new tools and capabilities to help deter such activity in cyberspace (DoD, 2015, p. 12). For example, the United States used verifiable and attributable data to engage China about the risks posed by its economic espionage. The attribution of this data allowed the United States to express concerns regarding the impact of Chinese intellectual property theft on U.S. economic competitiveness, and the potential risks posed to strategic stability by Chinese activity. To deter China from conducting future cyber espionage, the Justice Department indicted five members of the People’s Liberation Army for stealing U.S. intellectual property to directly benefit Chinese companies. The Chinese hackers were indicted on 31 counts, 23 of which were under the Computer Fraud and Abuse Act. While Justice Officials say the indictment was a breakthrough, others characterize the punishment as only symbolic as the likelihood of prosecution is slim (DOJ, 2014). The 2014 Office of Personnel Management (“OPM”) data breach has been described as the greatest theft of sensitive personnel data in history. However, neither the scope nor scale of the breach, nor its significance, has been fully investigated and shared with victims and the public. The 22 million victims—and their families—of this espionage attack share concerns with the deficiency of this counterintelligence campaign that have not been answered or addressed (Nakashima, 2015).

245

Virginia Greiman

Based on empirical research this paper explores the unique characteristics of cyber espionage under the laws of four major powers and the existing legal concepts and doctrines for national intelligence and cybersecurity and organizes a conceptual legal structure that frames the convergence and divergence in espionage laws and legal practice, and the areas for harmonization and agreement among nations.

2. Espionage under international law Espionage, commonly known as spying, is the practice of secretly gathering information about a foreign government or a competing industry, with the purpose of placing one's own government or corporation at some strategic or financial advantage. In the United States, federal law prohibits espionage when it jeopardizes the national defense or benefits a foreign nation (18 U.S.C.A. § 793). Criminal espionage involves betraying U.S. government secrets to other nations. Importantly, espionage does not reach the level of use of force under the U.N. Charter. According to the International Group of Experts that authored the Tallinn Manual 2.0 on the international law applicable to cyberspace, cyber espionage is distinct from the underlying acts that enable the espionage (NATO, 2017). The definition of a cyber-attack varies widely. For example, the United States definition of a cyber-attack does not include espionage as the U.S. has a separate Espionage Act (Espionage Act of 1917), while Germany makes no distinction between cyber-attack and probe or espionage (Germany CSS, 2011, pp. 14-15). However, espionage’s permissibility under international law remains largely unsettled; no global regulation exists for this important state activity (Pun, 2017). The contradiction of espionage is evident as states deem their own espionage activities legitimate and essential for national security, while aggressively pursuing criminal actions against foreign espionage activity. "The law of espionage is, therefore, unique in that it consists of a norm (territorial integrity), the violation of which may be punished by offended states, however, states have persistently violated the norm” … (Scott, 1999). Although it is unclear under international law whether states in general have a lawful right to spy on other states, the disallowance of certain activities within espionage is clearer (Pun, 2017). The treatment of those involved in spying activities as well as the use of torture to extract information has been held unlawful by Courts in many nations (Forcese, 2011). In 2013, fifteen countries, including the United States and China, agreed that international law, in particular, the United Nations Charter applies in cyberspace and explicitly highlighted the need to elaborate confidence-building measures and norms, rules, or principles of responsible behavior of States (UN Report, 2013).

3. The United States Espionage Act, Foreign Intelligence Surveillance Act, and Economic Espionage Act

More than one hundred years ago, President Woodrow Wilson signed the Espionage Act. Enacted soon after the United States entered World War I in 1917, the Espionage Act prohibited individuals from expressing or publishing opinions that would interfere with the U.S. military’s efforts to defeat Germany and its allies. Specifically, the Espionage Act made it a crime willfully to interfere with U.S. war efforts by conveying false information about the war, obstructing U.S. recruitment or enlistment efforts, or inciting insubordination, disloyalty, or mutiny. Ironically, this tension between national security and free speech rights still exists today. To be convicted under the 1917 Act, the law requires proof of intent for the information to be used to injure the United States or to advantage any foreign nation or reason to believe that the information will be used for either of these purposes. Section 794(b) applies “in time of war” and prohibits the communication of this information to the enemy or attempts to elicit any information relating to the public defense. The offenses contained in sections 794(a) and (b) are punishable by death or imprisonment for any term of years or for life. Courts have held that the statute requires the government to prove four elements under §793 : (1) the defendant lawfully or unlawfully had possession of, access to, or control over, or was entrusted with (2) information relating to the national defense that (3) the defendant reasonably believed could be used to the injury of the United States or the advantage of a foreign nation and (4) that the defendant willfully communicated, delivered, or transmitted such information to a person not entitled to receive it (§793). The U.S. Department of Defense tracks the 1917 Espionage Act and defines "espionage" in its Joint Publication 2-01.2 as "[t]he act of obtaining, delivering, transmitting, communicating, or receiving information about the national defense with an intent, or reason to believe that the information may be used to the injury of the United States or to the advantage of any foreign

246

Virginia Greiman

nation (JP 2-01.2). Espionage is a violation of 18 United States Code 792-798 and Article 106, Uniform Code of Military Justice. The Espionage Act is far from a paradigm of clarity. Scholars have described it as “incomprehensible if read according to the conventions of legal textualism, while paying fair attention to legislative history” (Edgar and Schmidt, 1986). A major problem that arises from the lack of clarity is to whom exactly the Espionage Act applies. The plain meaning of the Espionage Act appears to apply to everyone including government employees, leakers, whistleblowers, and members of the press alike. For example, Section 793(e) prohibits the willful communication of confidential information by someone who is not authorized to possess it. To address with more clarity the role of National Intelligence and Foreign data collection, the United States passed the Foreign Intelligence Surveillance Act in 1978 (FISA) with major Amendments in 2007 and 2008 to ease restrictions on surveillance of terrorists suspects where one party (or both parties) to the communication are located overseas (FISA, 1978). Despite the ample evidence that FISA has led federal investigators to significant victories in the apprehension of terrorists and the conviction of conspirators passing U.S. secrets on to foreign nations, it has been criticized for not maintaining the proper balance between national security and the protection of individual privacy (Breglio, 2003; Correia, 2014). Following the end of the Cold War, in the West there was a noticeable shift of concern about espionage from that which is political and military in nature to economic espionage, especially when carried out by cyber means (U.S. Strategy, 2011). In 1996, Congress passed the Economic Espionage Act (EEA), to help reduce the theft by foreign entities of proprietary information and trade secrets of U.S. businesses. Economic espionage occurs when a foreign government seeks information to advance its own technological or financial interest against another government, foreign company or an individual. The weaknesses of the Economic Espionage Act has been a subject of scholarly research. With some finding that the Act has been difficult to prove with minimal sentences under para. 1831, while others argue that the government has taken a hands off approach in helping private industry, and a lack of support from other nations assisting in international investigations (Reid, 2016). Notably, since the inception of the EEA in 1996 there have been fewer than 10 convictions to date under the law. Walter Liew, was the first person to be convicted of economic espionage by a U.S. jury in March 2014 and was sentenced to 15 years in prison.

4. China’s National Intelligence and Trade Secrets Law China passed its new National Intelligence Law on June 27, 2017 by the 28th meeting of the Standing Committee of the 20th National People's Congress. Article 1 of the Law states its broad purpose under the Constitution … “to strengthen and safeguard national intelligence work and to preserve state security and interests” (China, 2017b). The Law further specifies its purpose by providing that "National Intelligence work adheres to the overall national security perspective, provides intelligence as a reference in major national decision-making, provides intelligence support for the prevention and mitigation of threats endangering national security, and preserves the national political power, sovereignty, unity, and territorial integrity, the welfare of the people, sustainable social and economic development and other major national interests” (Art. 2). Consistent with China’s governance of national security, the Law stipulates that "The Central Military Commission uniformly leads and organizes military intelligence efforts” (Art. 3). To address respect for the law and human rights, the Law states “that the National intelligence efforts shall be conducted in accordance with law, shall respect and protect human rights, and shall preserve the lawful rights and interests of individuals and organizations” (Art. 8). The United States Intelligence Community in their 2017 Threat Assessment Report ranked China as the number one threat against U.S. interests in cyberspace noting that Beijing will continue actively targeting the US Government, its allies, and US companies for cyber espionage (Coates, 2017). As noted in the Report, The Chinese government continues to conduct pervasive industrial espionage against U.S. companies, universities, and the government and direct efforts to circumvent U.S. export controls to gain access to cutting-edge technologies and intellectual property in strategic sectors (U.S.-China, 2017). According to the Intellectual Property Commission Report by the National Bureau of Asian Research (NBAR) the scale of international theft of American intellectual property (IP) is in the hundreds of billions of dollars per year, on the order of the size of U.S. Exports to Asia (NBAR, 2013, p. 1).

247

Virginia Greiman

China’s espionage laws like the United States encompass both trade secret protections and national security. China first enacted trade secret “protections” in 1993 with the passage of Article 10 of the Unfair Competition Law, which prohibits businesses from the following: a) obtaining the trade secret of the rightful party by theft, inducement, duress or other illegal means; b) disclosing, using or allowing others to use the trade secrets of the rightful party obtained by illegal means; or c) disclosing, using or allowing others to use trade secrets in breach of an agreement or the confidentiality requirement imposed by the rightful party (China, 1993).

5. The United Kingdom’s Espionage and Trade Secrets Law From the earliest days of the British intelligence community, which was established in the early twentieth century, there was a close connection between intelligence-gathering and empire (Walton, 2013). Intelligence played an essential role in the administration of the empire, which by the 1920s had grown to encompass one - quarter of the world’s territory and population. The formation of the two services that would later become known as MI5 and SIS commonly called MI6 represented a fundamental break with all British intelligence- gathering efforts up to that point. For the first time, the government had professional, dedicated peacetime intelligence services at its disposal (Walton, 2013, p. 5). Historically, the United Kingdom embraced a stronger culture of secrecy than the United States (Donahue, 2005). The Official Secrets Act of 1989 is the key statute that prohibits the unauthorized disclosure of government information. The law criminalizes “secondary disclosures,” that is, the publication by journalists or members of the public of protected information received from government employees in contravention of the law (OSA, 1989). The Official Secrets Act 1889 (52 & 53 Vict. c. 52) was an Act of the Parliament of the United Kingdom. It created offences of disclosure of information (section 1) and breach of official trust (section 2). It was replaced in the UK by the Official Secrets Act 1911. The Official Secrets Act 1989 (c. 6) replaced section 2 of the Official Secrets Act 1911, thereby removing the public interest defense created by that section. The Official Secrets Bill was enacted to give increased powers against offences of disclosing confidential matters by officials, and to prevent the disclosure of such documents and information by spies, and/or to prevent breaches of official trust, in order to punish such offences of obtaining information and communicating it, against the interests of the British State. Unlike the U.S., Russia and China, the United Kingdom (UK), has not criminalized the misappropriation of trade secrets, and has limited its remedies to civil actions including injunctive relief, search and seizure orders and damages (UK, 2017). Based on an extensive consultation paper on the protection of official data, the UK Law Commission recently recommended that the UK criminalize the theft of trade secrets, however, the recommendations have not been acted upon (UK, 2017). The UK also proposed changes to the Serious Crime Bill in order to deter hackers by increasing the penalty under the Computer Misuse Act to a life sentence.

6. Russia’s Espionage and Trade Secrets Law Russia's External Intelligence Service (SVR) is the current incarnation of one of the world's oldest and most extensive espionage agencies, known for decades as the KGB (BBC, 2010). While China uses various methods to steal foreign trade secrets for both political and economic interests, Russia has recently focused its efforts on cyber espionage to promote its national economic interests, while also employing intelligence officers under diplomatic cover. The Criminal Code of the Russian Federation, Law No. FZ-190 as amended in 2012 , sets out what is termed “High Treason,” which is defined as “espionage, disclosure of state secrets, or any other assistance rendered to a foreign State, a foreign organization, or their representatives in hostile activities to the detriment of the external security of the Russian Federation committed by a citizen of Russia (RF, 1996, 2012). Under Article 275, of Law No. FZ-190 high treason shall be punishable by 12 to 20 years imprisonment with or without a fine in an amount of up to 500 thousand roubles or in the amount of the wage or salary, or other income of the convicted person for a period of up to three years. According to the Russian Federal Security Service (FSS), which proposed the bill, the amendments are aimed at emphasizing that state treason is a broad concept and that espionage and disclosure of state secrets are forms of it (RF, 2012). The FSS also stated, in its explanatory memo to the amendment law, that previous practice in enforcing the law in cases related to state treason and espionage identified the necessity of prosecuting acts of

248

Virginia Greiman

cooperation with representatives of international organizations engaged in hostile activities as state treason and of extending the liability of persons to whom state secrets are entrusted (Russia Code, Art. 51). The new Law has caused concern among human rights activists, who argue that its parameters of state treason are too broad and that there are no firm criteria to define when cooperation with an international organization assumes a criminal character, thereby leaving that assessment to the discretion of investigative and judicial authorities (Ozerova, 2012). Trade Secrets in Russia are protected under the Federal Law on Commercial Secrecy, Law No. 98-FZ effective 29 July, 2004 as amended in 2006 and 2007. Such secrets are protected from insiders to whom secrets have been entrusted, outsiders who obtain the secrets by improper means, and government agencies that might obtain and release the secrets (U.S. Library of Congress, 2012). Violating the trade secret law can entail disciplinary, civil, administrative, or criminal liability as provided by the legislation.

7. Challenges to harmonization of the international perspectives on cyber espionage As shown by each country’s approach to espionage, domestic laws are not sufficient to negotiate the challenges arising from trans-border issues such as those relating to national security and human rights, the public’s right of access to information, the individual’s right to privacy, the corporation’s right to remain competitive, the right to criminal process, and extraterritorial jurisdiction. International cooperation and international laws are also needed—both to allocate authority among political entities, and to define and protect core substantive values in the physical and virtual worlds (Bederman and Keitner, 2016). Powerful actors such as the United States, Russia, the United Kingdom and the United States have not gone far enough in addressing global inequality and the digital divide. International laws can address these injustices in ways that domestic laws cannot because of each nation’s own self-interest in national security and economic advancement. The United Nations Charter requires that any use of force, cyber or otherwise, must meet the requirements of military necessity, distinction between civilians and military targets, proportionality, and avoidance of unnecessary suffering (UN Charter, 1945). To the extent that cyber espionage amounts to an act of war, the international community must recognize and monitor these behaviors to maintain a peaceful existence. Scholars contend that a treaty which bans the use of cyber-attacks or limits their use is not realistic because there is currently no way to ensure compliance. More effective may be the establishment of norms as proposed by NATO, the OECD and other transnational organizations to prevent the possibility of a cyber war conducted through the use of cyber espionage. Developing state practice and norms relates to current international law, and rather than prohibiting espionage outright, it might serve as a more realistic approach. As noted by one expert, “[i]f states want these voluntary, non-binding norms of responsible state behavior in cyberspace to be truly meaningful words that can achieve their desired goals, then their actions and practice must demonstrate those tenets. States must demonstrate that they are willing to take the necessary steps to protect the security and prevent the misuse of the Internet in their respective countries” (Hathaway, 2017). This requires a calling out of wrongful acts conducted by other states, something that victimized states have been reluctant to do (Hathaway, 2017, p. 5). We cannot afford to be silent anymore. Vice Admiral Arthur K. Cebrowski, former Director, Office of Force Transformation at the Pentagon introduced the concept of institutionalizing transformation by innovating faster than our opponents and advocating more open access to information. If we are to be effective in the digital age, new approaches must be considered for national security that may require “less in trying to restrict information and more in knowing what is occurring” (Blaker, 2006). More cooperation among states at the international level is also clearly needed concerning economic espionage. Legal scholars have also noted the need for accountability at the international level when one country is wrongfully attacked by another (Kuntz, 2013). For example, the United States’ Cyber Economic Espionage Accountability Act expresses the sense of Congress that cyber economic espionage should be a priority issue in all economic and diplomatic discussions with the People's Republic of China, with the Russian Federation and other countries determined to encourage, tolerate, or conduct such cyber economic espionage (U.S., 2014). A review of the espionage laws shows the need for the United States to take a lead in developing better international collaboration and clearer laws. On the national security side, this requires stronger sanctions and

249

Virginia Greiman

cooperation from the international community, and stronger penalties for economic espionage. Since the enactment of the EEA in 1996 the statute has been amended to increase the fines that can be imposed from $500,000 to $5 million in the case of an individual and from $10 million to not more than the greater of $10 million or three times the value of the stolen trade secret (Economic Penalty Act, 2013). Though these fines are severe they clearly do not go far enough in changing the behaviors of the perpetrators. The United States Espionage Act needs revision to remove confusion and create a more consistent application of the law. In order to effectively prosecute legitimate cases of espionage, courts and prosecutors must clearly understand what constitutes espionage. Technology and the classification system for espionage should comport with modern reality. International cooperation on the conduct of espionage may take decades, but in the interim, application of the statute to leakers, whistleblowers and others requires amendment of this antiquated law to better protect our nations’ interests and our competitive advantage in the world.

8. Conclusion Although States may take different positions on the application, interpretation and development of international law, they have reached a consensus on the applicability of international law to cyberspace. Though the prospects of a comprehensive binding treaty on cyber espionage remains a challenge, the existence of a multiplicity of diverse non-binding norm initiatives, as well as several recent bilateral agreements reached between the main cyber powers, demonstrate that cyber norms development is possible. Future research must explore possible solutions for enhancing not only the laws of espionage, but the policies that inform these laws to meet modern realities. This requires multilateral cooperation and an international agreement on the rules and norms that govern cyber espionage both at the national security and economic level to better meet the needs of our evolving digital society.

References Bederman, D. and Keitner, C. (2016) International Law Frameworks, (4th ed) Foundation Press, New York. Blaker, J. (2006) “Arthur K. Cebrowski: A Retrospective,” Naval War College Review, spring 2006, Vol. 59, No. 2. Breglio, N. K. (2003) “Leaving FISA Behind: The Need To Return To Warrantless Foreign Intelligence Surveillance,” 113 Yale

L.J. 179. British Broadcasting Company (BBC) (29 June 2010) News Profile: Russia's SVR intelligence agency. China’s National Intelligence Law of the PRC (Promulgated on June 27, 2017 by 28th meeting of the Standing Committee of

the 20th National People's Congress) effective June 28, 2017. China’s Unfair Competition Law of the PRC (September 2, 1993) promulgated by People's Republic of China Presidential

Order No. 10. Coates, D. R. (11 May 2017) Statement for the Record: Worldwide Threat Assessment of the US Intelligence Community,

Director of National Intelligence Testimony, Senate Select Committee on Intelligence. Correia, E. R. C. (2014) “Pulling Back The Veil Of Secrecy: Standing To Challenge The Government's Electronic Surveillance

Activities,” 24 Temp. Pol. & Civ. Rts. L. Rev. 185. Donohue, L.K. (2005) “Terrorist Speech and the Future of Free Expression,” 27 Cardozo L. Rev. 233, 325-26. Dunn Cavelty. (2012) “The Militarization of Cyberspace: Why Less May Be Better”, IEEE Explore, 2012 4th International

Conference on Cyber Conflict (CYCON), Tallinn, Estonia, p 113. Economic Espionage Act (EEA) (October 11, 1996) 18 U.S.C. Sections 1831 and 1832. Edgar, H. and Schmidt, B.C. (1986) “Curtiss-Wright Comes Home: Executive Power and National Security Secrecy,” 21

Harvard Civil Rights-Civil Liberties Law Review, 349, 393. Forcese, C. (2011) “Spies Without Borders: International Law and Intelligence Collection” 5 J. Nat’l Security Law and Policy

179, 186-93. Foreign and Economic Espionage Penalty Enhancement Act (FEEPEA) of 2012, Pub. L. No. 112-269, 126 Stat. 2442. (2013). Germany. (2011) “Cyber Security Strategy for Germany.” Federal Ministry of the Interior, February. Hathaway, M. (2017) “Getting Beyond Norms,” CIGI Papers No. 127, Centre for International Governance Innovation,

Ontario, Canada. Joint Publication (JP-201). (05 January 2012) Joint and National Intelligence Support to Military Operation, Chairman of the

Joint Chiefs of Staff, U.S. Department of Defense, Washington, D.C. Kuntz, R. L. (2013) “How Not To Catch A Thief: Why The Economic Espionage Act Fails To Protect American Trade Secrets,”

28 Berkeley Tech. L.J. 901. Nakashima, E. (2015) “Hacks of OPM databases compromised 22.1 million people, federal authorities say.” The Washington

Post, Washington, D.C., July 9. National Bureau of Asian Research (2013) “Intellectual Property Commission Report of the Commission on the Theft of

American Intellectual Property,” The National Bureau of Asian Research (NBR), Seattle Washington.

250

Virginia Greiman

NATO Cooperative Cyber Defence Centre of Excellence (CCD COE) (2017) “The Tallinn Manual 2.0 on the International Law

Applicable to Cyber Operations,” (Michael Schmitt and Liis Vihul (eds.)) Cambridge University Press, Cambridge, England.

Ozerova, M. (2012) “He Did Not Betray Himself: Putin Signed the Law on State Treason” [in Russian], Moskovskii Komsomolets, 15 November.

Pun, D. (2013) “Rethinking Espionage in the Modern Era” 18 Chicago Journal of International Law 353. Reid, M. (2016) “A Comparative Approach to Economic Espionage: Is Any Nation Effectively Dealing With This Global

Threat?” 70 U. Miami L. Rev. 757. Russian Federation (RF) (2012) Explanatory Memo to the Draft Federal Law on Amending the Criminal Code of the Russian

Federation and Article 151 of the Criminal Procedure Code of the Russian Federation [in Russian], State Duma of the Russian Federation.

Russian Federation (RF) Criminal Code No. 63-FZ of June 13, 1996 (as amended up to Federal Law No. 120-FZ of June 7, 2017).

Russia Law Nr. 190-FZ [in Russian], Rossiiskaia Gazeta, No. 5935 (Nov. 14, 2012) (official publication). Russian Federation Article 151 of the Criminal Procedure Code [in Russian], State Duma of the Russian Federation (June 29,

2015) Amendments to Article 183 of the Russian Criminal Code. Scott, D. (1999) “Territorially Intrusive Intelligence Collection and International Law,” 46 A.F. L. REV. 217, 218. Senate Select Committee on Intelligence (January 29, 2014) Open Hearing on Current and Projected National Security

Threats to the U.S., 113th Cong. The Charter of the United Nations signed on 26 June 1945. The Foreign Intelligence Surveillance Act of 1978 (FISA) Pub.L. 95–511, 92 Stat. 1783, 50 U.S.C. ch. 36. The United Kingdom, Official Secrets Act 1989, c. 6 and Official Secrets Act 1911, c. 28. The United Kingdom Law Commission (2017) “Protection Of Official Data,” Consultation Paper No 230, Crown Copyright,

London, England. United Nations (2013) United Nations General Assembly Group of Governmental Experts on Developments in the field of

information and telecommunications in the context of international security, United Nations General Assembly, Sixty- eighth session, 24 June.

United States Department of Defense (US DoD) (2015) “Department of Defense Strategy for Operating in Cyberspace.” Pentagon, Washington, D.C.

United States Cyber Economic Espionage Accountability Act Summary: H.R.2281 — 113th Congress (2013-2014). United States Department of Justice (2014) “U.S. Charges Five Chinese Military Hackers for Cyber Espionage Against U.S.

Corporation and a Labor Organization for Commercial Advantages,” U.S. Department of Justice, Office of Public Affairs, Washington, D.C.

United States Library of Congress (2012) Russia: Espionage and State Treason Concepts Revised, Law Library of Congress, Washington, D.C., November 28.

United States Office of the National Counterintelligence Executive (ONCIX) (2011) “Foreign Spies Stealing US Economic Secrets in Cyberspace: Report to Congress on Foreign Economic Collection and Industrial Espionage 2009-2011,” October 2011. Director of the National Counterintelligence and Security Center under the Office of the Director of National Intelligence (ODNI), Washington, D.C.

U.S.-China Economic And Security Review Commission (2017) “Report to Congress. Executive Summary and Recommendations.” One Hundred Fifteenth Congress, First Session, November 2017.

Walton, C. (2013) Empire of Secrets: British Intelligence, The Cold War and the Twilight of Empire, The Overlook Press, New York, NY.

251

xiii

Virginia Greiman is Professor of Global Cyber Law and Governance and Megaprojects and Planning at Boston University and she teaches at Harvard University Law School. She served as a diplomatic official to the U.S. Department of State in Eastern and Central Europe, Asia and Africa and has held several high level appointments with the U.S. Department of Justice. Jeffrey Guion is a Captain in the U.S. Air Force and a graduate student at the Air Force Institute of Technology. He has a Computer Science B.S. from Northeastern University and previously managed the Wing Cybersecurity Office at Edwards AFB. His is currently working on mission relevant cyber terrain mapping for his thesis. Rudy Agus Gemilang Gultom, is a senior researcher at the Indonesian Defense University (IDU), Indonesia. He finished his M.Sc. in Computer Science from the University of Sheffield, United Kingdom (funded by the British Chevening Scholarship). He finished his Doctoral Degree in Electrical Engineering from University of Indonesia, Indonesia (funded by the Indonesian Government). Ginger Guzman is currently an international research fellow at The Institute of World Politics and is a PhD candidate in the School of Governance, Law, and Society at Tallinn University. Her research and interests are on cyberpower, security studies, and, international relations. More specifically her work examines the role of ideational cyberpower for states. Sharif Hassan has over 15 years of experience in Cyber security, specifically adversarial Cyber testing, and is the manager of the Lockheed Martin corporate Red Team. Sharif is currently pursuing his PhD in Computer Science at the University of Central Florida. Dr. Moniphia O. Hewling is a Cyber Security Consultant who currently heads the Jamaica Cyber Incident Response Team, a division in the Ministry of Science Energy and Technology. Often described as a cyber-warrior, Dr. Hewling’s main aim at this juncture is to drive the creation of a robust cyber security framework for Jamaica. Vahid Heydari received the M.S. degree in Cybersecurity and the Ph.D. degree in Electrical and Computer Engineering from the University of Alabama in Huntsville. He is currently an Assistant Professor of Computer Science at Rowan University, Glassboro, NJ, USA. His research interests include moving target defenses, mobile ad-hoc, sensor, and vehicular networks security. Dr Corey Hirsch is Chief Information Security Officer of Teledyne Technologies. He also serves as visiting fellow at both Warwick Business School, Coventry, and Henley Business School at University of Reading, U.K. Dr. Hirsch teaches information security at Stevens Institute of Technology. His practice and teaching centers around enterprise systems, leading the ICT function, information security, operations, and competitor intelligence. His 24-year career with Tektronix, Inc. included overseas assignments totaling nine years, and culminated as vice president, Europe. Both LeCroy and Tektronix participate in the test and measurement industry. Dr. Hirsch has research interests in information security and enterprise risk management. He earned his doctorate in business administration from Brunel University, London.

Michael Bennett Hotchkiss has research interests in the study of Information Warfare, Propaganda, Disinformation, and the History of Espionage. Michael possesses a Master of Organization Development degree (M.O.D.) from Bowling Green State University (USA), and a Bachelor of Arts in Industrial Psychology (minor Criminal Justice, Phi Beta Kappa honors) from University of Connecticut (USA). Gazmend Huskaj is a PhD candidate in Cyber Operations at the Swedish Defence University. He received his MSc in Information Security from Stockholm University in 2015 as a distinguished graduate. Previously, he was Director Intelligence in the Swedish Armed Forces focusing on cyber-related issues. He is also a ISACA Certified Information Security Manager (CISM). Steve Hutchinson is a cyber security researcher with ICF contracted to the US Army Research Laboratory. He has research interests in the cognitive aspects of cyber security decision-making and human-machine interface techniques to augment analyst capabilities. He has a MS in Instruction Science, graduate studies in Computer Science, and BS in Electrical Engineering. Ehinome Ikhalia holds a PhD in Information Systems and Computing, Ehinome possesses exceptional insight in the application of cyber security. He keeps his finger on the pulse of cyber security and has presented at international

Reproduced with permission of copyright owner. Further reproduction prohibited without permission.