Where Are We Now? Examining the Trump Administration’s Efforts to Combat Cybercrime

1. The Federal Government has taken a whole-of-nation and international approach to combat the rising cybercrime wave.

For the past two years, the US government has taken a whole-of-nation and international approach to fighting the cybercrime wave, which has increased due to the COVID-19 pandemic. The Internet Crime Complaint Center (IC3) has seen an uptick of 400% complaints a day, totaling nearly 4,000, since the pandemic began.¹ Google similarly reported seeing 18 million daily malicious emails and malware related to COVID-19 in just one week in April 2020.² As a result, the US Secret Service testified that $30 billion could be lost to cybercriminals who are taking advantage of COVID-19 stimulus programs.³ However, the perpetrators behind these crimes go largely unpunished with only three in 1,000 cases seeing an arrest, according to Third Way analysis.

Based on publicly available information, five US government entities—the Department of Homeland Security (DHS), Department of Justice (DOJ), Department of State, Federal Bureau of Investigation (FBI), and US Secret Service (USSS)—conducted at least 20 policy actions to reduce cybercrime since 2018 (excluding sanctions and indictments).⁴ Sanctions and indictments were not included in order to focus on the efforts that facilitate those activities to occur. These actions include establishing international norms and standards, conducting international capacity building efforts, and hosting gatherings to improve relationships with various partners, among other activities.⁵  The FBI, for example, held a “Ransomware Summit” in September 2019 with cyber insurance companies, private sector companies, and others to gain a better understanding of their needs. And in light of the COVID-19 pandemic, Attorney General Barr issued a memo to all US Attorneys to “prioritize the detection, investigation, and prosecution of all criminal conduct related to the pandemic.”⁶  More information and a full list of these policy actions can be found in the Appendix.

Most of these actions were presumably driven by the White House’s “National Cyber Strategy,” which was released in 2018 and outlined five priority actions to reduce cybercrime.⁷ The Strategy charges the National Security Council (NSC) to coordinate with departments, agencies, and the Office of Management and Budget on “an appropriate resource plan” for implementing the strategy but does not detail  specific budget numbers to fund these actions. It also directs federal departments and agencies to use the strategy for “execut[ing] their missions.”⁸ However, an implementation plan, which usually accompanies federal strategies and critical to understanding which government entities are responsible for implementing specific actions by set dates, has not been released.⁹

This diagram illustrates the five priority actions that the National Cyber Strategy identified to achieve their cybercrime enforcement goal and the actors involved to implement those actions.

2. The Administration is focused on improving domestic and international law enforcement’s ability to arrest and charge criminals, strengthening international cooperation, and enhancing domestic partners’ capacities to handle cybercrime incidents.

Cybercrime is a borderless threat that often involves the cooperation of law enforcement and diplomats in several different countries to bring perpetrators to justice. The five federal entities that engaged in cybercrime-enforcement actions recognized this and focused on reducing threats from transnational criminal organizations (TCOs), improving apprehension of criminals abroad, and strengthening partner nations’ law enforcement capacity and cooperation.¹⁰ These objectives are intrinsically linked together and cannot succeed without the success of the other. Because malicious cyber actors are often not located in the United States, the US government cannot apprehend criminals without international partners who have the means to identify and arrest a suspect. Likewise, the threat from cybercrime cannot be reduced unless the United States and cooperative governments have the capability and capacity to impose consequences on the perpetrators. Consequently, the government’s ability to fulfill these objectives require interagency and international collaboration, which were the primary audiences who benefited from these actions. As a result, the State Department has entered into bilateral agreements with partner nations, issued condemnations and warnings to nation-states where cybercrime emanates, and engaged in international bodies to advance policies to deter cybercriminals.

In addition to international engagement, DOJ, FBI, DHS, and USSS worked with state, local, and private partners to improve cybercrime incident reporting and response. Public-private partnership is particularly imperative because cybercriminals use private-sector networks and infrastructure to commit crime, which is then often used against private companies. In fact, one success during the COVID-19 pandemic has been federal law enforcement agencies strengthening and expanding relationships with companies to remove (or takedown) hundreds of malicious websites (or domains).¹¹ Similarly, federal agencies have created new task forces with Connecticut, Delaware, Virginia, and West Virginia to investigate and prosecute cybercrime related to the pandemic.¹² However, whether these partnerships will become institutionalized post-pandemic or dissolved remains to be seen. Unfortunately, sustaining long term public-private partnerships may be hampered due to the Justice Department aggressively pushing for weaker encryption standards and other odious actions taken by the Trump Administration that private companies disagree with.¹³

3. Budgets for federal agencies with cyber enforcement missions have not increased, and at times diminished, commensurate with the threat and their priorities.

Despite these promising actions, the Trump Administration has not increased funding commensurate with the growing rate of cybercrime for the key entities with cybercrime enforcement missions. This then raises questions on the long-term sustainability of these efforts. In some cases, the Administration has attempted to cut or defund programs focused on cybercrime, but Congress has pushed back on some of these reductions during the annual appropriations process.

For example, although the National Cyber Strategy identified international capacity building as a primary objective, the White House proposed in its budget to reduce the State Department’s International Narcotics and Law Enforcement Bureau’s global capacity building programming for cybercrime and intellectual property rights from $10 million to $5 million, the past three years.¹⁴ Congress rejected these cuts and has thus far appropriated the full $10 million. Nonetheless, this $10 million pales in comparison to the $86 million in capacity building funding for countering terrorism and violent extremism included in the Fiscal Year (FY) 2020 budget.¹⁵

The Administration also defunded training opportunities for state and local law enforcement—a primary goal for DHS—in its FY 2020 and FY 2021 Congressional Budget Justification.¹⁶ The Administration recommended cutting the National Computer Funding Institute (NCFI), which offers training courses to state and local law enforcement, prosecutors, and judges, from $30 million to $4 million for FY 2021.¹⁷ This reduction is alarming because the NCFI is estimated to need $35 million to operate at full capacity.¹⁸ Similarly, the FBI’s National Domestic Communications Assistance Center (NDCAC), which offers various technical and training assistance to state and locals on digital evidence, had a proposed decrease of 11% in FY 2020. Over the past eight years, the NDCAC budget has decreased 25% while the FBI’s total budget has increased roughly 16% in that same time.¹⁹

Without proper resources to keep up with the increasing cybercrime threat, the entities tasked with implementing the Administration’s cyber strategy will be stretched thin and hindered in making these efforts as effective and sustainable as possible.

4. Metrics are lacking to assess the effectiveness of these actions in reducing cybercrime.

Quantitative metrics are unavailable to assess whether any of these actions are reducing cybercrime. The National Cyber Strategy does not detail, for example, any framework for monitoring and evaluating the impact of its proposed actions or call for any implementing entities to develop such frameworks. These metrics are essential for evaluating how many law enforcement personnel need to be trained to improve response efforts, the impact of indictments and apprehensions on deterring criminals, and the percentage increase in international capacity-building efforts needed to combat cybercrime.²⁰ While these national strategies tend to be broad and non-prescriptive, they are often accompanied with strategic implementation plans that detail these types of metrics and how they should be achieved.²¹ No such implementation plan has been released for this strategy. Further, whether someone is regularly assessing and coordinating the Administration’s policy actions is unclear. The recent US Cyberspace Solarium Commission’s report highlighted this challenge and noted the need for a National Cyber Director in the White House to coordinate cybersecurity strategy throughout the executive branch.²²

Federal agencies and departments’ strategies also lack metrics to assess their progress. The State Department’s strategy does not include quantitative or qualitative metrics to assess how well it is building international cooperation and capacity, which is one of their key goals.²³ As a result, bipartisan congressional leaders have called for further clarity on what metrics are being used.²⁴ DOJ, on the other hand, views success as 90% of cybercrime cases going “favorably,” and DHS wants “.5” law enforcement personnel trained.²⁵ However, not all indictments are public, making it difficult for the public to know if they are achieving their goal. The DHS metric, too, was obscure in what “.5” meant and lacks context in how many law enforcement personnel are needed to reduce the cybercrime enforcement gap. Further, US law enforcement faces tremendous gaps in capturing the totality of cybercrime incidents and reporting the enforcement actions taken against the perpetrators. Numerous national commissions have called on the US government to address this core challenge.²⁶

As a result of these gaps, adequately measuring the United States’ progress in reducing cybercrime and bringing cybercriminals to justice remains a challenge.

5. Questions for Congress and Conclusion

While the Administration has taken several policy actions to combat cybercrime, questions remain about their long-term institutionalization, sustainability, and effectiveness.  Members of Congress should consider these concerns and raise the following questions when conducting hearings, drafting legislation, and considering appropriations for the relevant US government entities:

1. When will the White House release an implementation plan for its national cyber strategy?
2. How much is the federal government spending on cybercrime enforcement overall and do the key agencies and departments believe they have enough resources and personnel to meet the strategic objectives set in the White House strategy?
3. What changes must be instituted to establish better metrics to measure the rate of cybercrime and evaluate the impact of efforts aimed at reducing it and holding accountable the perpetrators? In the absence of success metrics, what impact does the Administration believe its efforts have had in reducing cybercrime?
4. Who is coordinating the various cybercrime enforcement policy actions across the federal government to ensure we are being as effective and efficient as possible?
5. What will happen with the various cybercrime initiatives established or expanded during the COVID-19 crisis after the pandemic subsides? How do we ensure that the lessons learned during this crisis to educate the public about and impose consequences on the perpetrators of cybercrime are carried forward for future crises?

The Administration has undertaken a number of policy actions to advance its commitments in its 2018 National Cyber Strategy related to cybercrime. Yet, areas exist that require increased congressional scrutiny to better understand how implementation is moving forward and the overall impact of these efforts. By raising these questions, Congress can begin to shed light on the issues that may need further attention when appropriating funds and drafting legislation, and ultimately helping to ensure cybercriminals do not operate without retribution.