US moves a step closer to formalising cyber sanctions

The US Treasury Department has released details of the proposed regulation for imposing cyber-related sanctions on foreign actors. This is part of the US Administration’s wider moves to stop international players from perpetrating cyber attacks against the US. The new regulations have been described as a ‘carrot and stick’ approach, pressing individuals, companies, groups and nation states to abide by cyber norms, and using sanctions when they don’t. In April 2015, US President Barack Obama signed an executive order strengthening the administration’s ability to impose these types of sanctions. He also tasked the Treasury Department with taking the lead on developing, and following consultation, ultimately applying, penalties.

As the U.S. looks to get tougher on cyber criminals that threaten the nation's critical infrastructure, the Treasury Department released an abridged version of a proposed regulation for imposing cyber-related sanctions to foreign actors, whether individuals, groups or nation-states.

A major part of the administration's strategy to prevent international actors from perpetrating cyberattacks against the U.S. — citizens, companies and, in some instances, the government itself — is a carrot and stick approach, including a multinational community abiding by cyber norms coupled with sanctions on those who stray.

Federal Register: Cyber-Related Sanctions Regulations

In April, President Barack Obama signed an executive order strengthening the administration's ability to impose such sanctions and tasked Treasury with taking the lead developing and ultimately applying penalties. Before taking any action, the department would first consult with the attorney general and secretary of state, according to the executive order.

Prior to the order, the U.S. imposed sanctions on governments and certain multinational organizations. The new regulation enables the feds to go after specific individuals, freezing any assets within America's jurisdiction, restricting travel to the U.S. and prohibiting U.S. companies from doing business with those individuals.

The regulation posted on the Federal Register defines the terms and scope of the authority, such as who can be sanctioned and what those penalties look like.

"We are focusing on those actors that pose a significant threat to the national security, the foreign policy or the economic health or security of the United States as a whole," he said, listing some of the specific kinds of actions that could result in sanctions. "Damaging attacks on our critical infrastructure; disrupting computer networks through a widespread distributed denial of service attack; widespread or significant thefts of personal information, financial data, trade secrets or personal property; and the knowing use or receipt of those stolen goods."

While the rule has been finalized as of Dec. 31, the post on the Federal Register is an abbreviated version, with a more comprehensive version expected in the near future.

Aaron Boyd is an awarding-winning journalist currently serving as editor of Federal Times — a Washington, D.C. institution covering federal workforce and contracting for more than 50 years — and Fifth Domain — a news and information hub focused on cybersecurity and cyberwar from a civilian, military and international perspective.