Tillerson cuts high-profile cyberdiplomacy office in State Dept. reorg

Move demotes US cyber diplomats as part of department overhaul.

On the heels of the resignation of State Department Cyber Coordinator Chris Painter—the top diplomat for negotiations on setting norms for nations' behavior in "cyberspace"—a State Department spokesperson confirmed that Secretary of State Rex Tillerson is moving toward shutting down the department's Office for the Coordination of Cyber Issues.

The office, set up by former Secretary of State Hillary Clinton during the Obama administration, has taken the lead in negotiations with other nations on cybersecurity policy issues. It also works out how existing international law applies to hacking, cyber-espionage, and other state-directed activities on the Internet. The Cyber Coordinator, who leads the office, has reported directly to the secretary of state. As the head of the office, Chris Painter—a career Department of Justice employee who was detailed to the State Department for the post six years ago—took part in multiple multinational negotiations resulting in agreements to halt economic electronic espionage against other countries' companies. Among these was an agreement reached by the Group of 20 leading world economic powers (G20) in November of 2015.

In a post to the Cipher Brief, Jason Healey— a senior research scholar at Columbia University’s School for International and Public Affairs, and a visiting scholar at the Hoover Institution at Stanford University—said that Painter's departure in itself was a blow to the US' leading role in setting the world cybersecurity diplomatic agenda. "Those that will suffer most [from Painter's departure] are likely to be American citizens, and indeed netizens in whatever country they live, who depend on an open, free, and secure Internet" Healy wrote. "Painter has been a tireless advocate for these goals—American goals—around the world, and the best days of American cyberdiplomacy may be behind us."

Secretary Tillerson plans to push responsibility for cybersecurity issues deeper into the department's bureaucracy as part of the Bureau of Economic and Business Affairs. The move is part of a much larger reorganization of the State Department by Tillerson—undertaken largely to accommodate a slashing of the department's budget. Healy told Ars that it's too early to judge what the impact of the move will be. "Because of mistrust of the administration and lack of credible information," he said, "the [cybersecurity] community is perhaps getting over-anxious. I'm very curious to see what the plan is. This could work out if the team is strengthened, led by an ambassador/assistant secretary, and combined with the Internet governance and telecom team."

But Robert Knake, senior fellow for cybersecurity at the Council on Foreign Relations, told Bloomberg that the decision by Tillerson sent the wrong signal to the world, "taking an issue that's preeminent and putting it inside a backwater within the State Department." Knake explained, "Position to power matters both within the US government and within the international community.”

The announcement comes on the heels of stalled negotiations at the United Nations' Group of Governmental Experts, the UN body addressing international cyber law. The group closed its 2017 meeting in June without reaching consensus on a set of recommendations. Michele Markoff, the State Department's deputy cyber coordinator, in a statement at the conclusion of the round of negotiations, bemoaned the failure of the UN GGE to address what nations are permitted to do in response to malicious activity by other states.

"The final draft of the report insufficiently addresses these issues," Markoff said. "I believe it would be a troubling and potentially destabilizing signal for this GGE to release a report that does not take a clear position on the applicability of these bodies of international law to States' use of [information and communication technologies (ICTs)], much less fulfill the mandate given to this Group by the UN General Assembly to study how international legal rules and principles apply to the use of ICTs."

Markoff and other State Department officials had hinted that the US might be forced to negotiate agreements governing cooperation on cybersecurity issues bilaterally with individual nations, such as the cybersecurity working group that President Trump and Russian President Vladimir Putin discussed at the recent G20 talks. Russia's RIA News Agency reported today that Russia's special envoy on cyber security, Andrey Krutskikh, had said the US and Russian governments are already in joint talks on that matter.

If a cyber-vacuum is created at the State Department, that may leave responsibility for defining the norms for cyber-behavior in the hands of the Defense Department, intelligence community, and the Department of Homeland Security. The DHS already has a lead role in the joint US-China cyber coordination effort.