National Security Presidential Memorandum 13

John Bolton has confirmed what others have been quietly saying for some months now.  The policies of the Trump Administration are changing the approach used by the Obama Administration, formalized in Presidential Policy Directive 20, compromised by Edward Snowden.  At least we won't have a Top Secret policy floating around on the Internet this time.  That will be a nice change.

Second, Bolton's comments make it clear that the emphasis is not on offensive use of cyber weapons, but the deterrence of foreign use of those same kind of weapons.  I have been advocating that for years. The Obama White House thought deterrence could come from defensive reactions, including non-cyber, to deter offensive cyber attacks.  That clearly was not a good strategy.  By the time the reply took place, the perpetrator had forgotten why they were being attacked.  Speeding up that process is a good thing.

But any new strategy should also be clear that the Defense Department is not the place to put this deterrence strategy.  It belongs in the Intelligence Community.  Defense has made power grab after power grab, even trying to get into defense of public networks by redefining what they are responsible for.   Now that the cyber position is gone in the White House, Defense was the logical place to put it, but it is because that position never did what it was supposed to be able to do, bring together the various components of cyber defense of the national infrastructure.  Defense cannot do that, and we tried it before.  Defense tries to bulldoze its way into everything, including commercial networks where it has no contracts for service or domain.  Homeland Security was the only alternative but wasn't up to the job.  Defense continued to maintain it was the best place for the mission, and it looks like they finally won.