Adam Hickey's guest appearances

Adam Hickey

ITSPmagazine

National Security Law Today

Stewart Baker

Alison Levine

Sam Houston

Robert Lee

Andrew Smith

Robin Smith

Kathleen Smith

Omar Khawaja

Adam Levin

David Cross

Stephanie Lucas

Jeffrey Smith

Joel Makower

Michael Woods

Caleb Barlow

OwlTail

Catherine Lotrionte

What do we think about this cybersecurity strategy? We wait for an attack to happen, then we respond to the threat by paying a criminal organization to get out of the trouble. Does it seem like a good one? Probably not, especially when it is illegal to do so. Let's discuss. Ransomware is a digital attack against an individual or organization that holds data and/or systems hostage until a payment is received. Like many other forms of cybercriminal activity, this is on the rise, affecting our society at large. If and when this happens, the options in front of the victim are generally:- Restore the system/data from a known good backup - Pay the ransom and go back to normal — (hopefully, assume the criminal honors the “agreement”)- Don't pay and experience the consequencesThe FBI discourages organizations from paying ransomware, and now the Department of Treasury has declared that paying ransoms is illegal and violates OFAC regulations. Seemingly this puts boards—and the conversation in and around evaluating risk—in a very precarious situation. The consideration around this and the balance of fiduciary responsibility depends on the organization: a manufacturing company vs. a hospital, for example, and what data is being held. However, it still squarely could disrupt the natural flow of risk considerations for Boards.How about cyber insurance? Can we just skip prevention because there is a cure? Probably not.Beyond the illegality of the payment, there's also the idea that the funds paid don't just land in the pocket of an individual criminal actor looking to buy a new sports car. It most probably supports international crime and nation-state activities such as funding human trafficking or nuclear weapon research and development.Also, why is this still a problem in 2021? Why can’t we win here?Listen in to this group of experts as we try to figure that out. Maybe we solved the problem. Maybe not. Guest(s)Dr. Catherine Lotrionte, CSIS Technology Policy ProgramAdam Hickey, US Department of JusticeStewart Baker, Steptoe &amp; Johnson LLPResourcesRSAC 365 Session: Understanding Response Risk Relative to Ransomware and DoT GuidelinesDept. Of Treasury Ransomware Advisory: https://home.treasury.gov/news/press-releases/sm1142FBI Position on Ransomware: https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/ransomwareRSAC 365 Virtual Summit: https://itspm.ag/virtual-summit-d0974This Episode’s Sponsors:BlackCloak: https://itspm.ag/itspbcwebTo see and hear more The Cyber Society content on ITSPmagazine, visit:https://www.itspmagazine.com/the-cyber-societyAre you interested in sponsoring an ITSPmagazine Channel?https://www.itspmagazine.com/podcast-series-sponsorships

What do we think about this cybersecurity strategy? We wait for an attack to happen, then we respond to the threat by paying a criminal organization to get out of the trouble. Does it seem like a good one? Probably not, especially when it is illegal to do so. Let's discuss. Ransomware is a digital attack against an individual or organization that holds data and/or systems hostage until a payment is received. Like many other forms of cybercriminal activity, this is on the rise, affecting our society at large. If and when this happens, the options in front of the victim are generally: - Restore the system/data from a known good backup  - Pay the ransom and go back to normal — (hopefully, assume the criminal honors the “agreement”) - Don't pay and experience the consequencesThe FBI discourages organizations from paying ransomware, and now the Department of Treasury has declared that paying ransoms is illegal and violates OFAC regulations. Seemingly this puts boards—and the conversation in and around evaluating risk—in a very precarious situation. The consideration around this and the balance of fiduciary responsibility depends on the organization: a manufacturing company vs. a hospital, for example, and what data is being held. However, it still squarely could disrupt the natural flow of risk considerations for Boards.How about cyber insurance? Can we just skip prevention because there is a cure? Probably not.Beyond the illegality of the payment, there's also the idea that the funds paid don't just land in the pocket of an individual criminal actor looking to buy a new sports car. It most probably supports international crime and nation-state activities such as funding human trafficking or nuclear weapon research and development.Also, why is this still a problem in 2021? Why can’t we win here?Listen in to this group of experts as we try to figure that out. Maybe we solved the problem. Maybe not. Guest(s) <a href="http://www.rsaconference.com/experts/catherine-lotrionte" rel="nofollow" target="_blank">Dr. Catherine Lotrionte</a>, CSIS Technology Policy Program<a href="http://www.rsaconference.com/experts/adam-hickey" rel="nofollow" target="_blank">Adam Hickey</a>, US Department of Justice<a href="http://www.rsaconference.com/experts/stewart-baker" rel="nofollow" target="_blank">Stewart Baker</a>, Steptoe &amp; Johnson LLPResources RSAC 365 Session: <a href="http://www.rsaconference.com/virtual-series/fds1-summit/agenda/understanding-response-risk-relative-to-ransomware-and-dot-guidelines" rel="nofollow" target="_blank">Understanding Response Risk Relative to Ransomware and DoT Guidelines</a>Dept. Of Treasury Ransomware Advisory: <a href="https://home.treasury.gov/news/press-releases/sm1142" rel="nofollow" target="_blank">https://home.treasury.gov/news/press-releases/sm1142</a>FBI Position on Ransomware: <a href="https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/ransomware" rel="nofollow" target="_blank">https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/ransomware</a>RSAC 365 Virtual Summit: <a href="https://itspm.ag/virtual-summit-d0974" rel="nofollow" target="_blank">https://itspm.ag/virtual-summit-d0974</a>This Episode’s Sponsors:BlackCloak: <a href="https://itspm.ag/itspbcweb" rel="nofollow" target="_blank">https://itspm.ag/itspbcweb</a>To see and hear more The Cyber Society content on ITSPmagazine, visit: <a href="https://www.itspmagazine.com/the-cyber-society" rel="nofollow" target="_blank">https://www.itspmagazine.com/the-cyber-society</a>Are you interested in sponsoring an ITSPmagazine Channel? <a href="https://www.itspmagazine.com/podcast-series-sponsorships" rel="nofollow" target="_blank">https://www.itspmagazine.com/podcast-series-sponsorships</a>

Understanding Response Risk Relative to Ransomware and DoT Guidelines | Don’t Pay, Can’t Pay, What Next | A Conversation With Dr. Catherine Lotrionte, Adam Hickey, And Stewart Baker

David Laufman

Thank you to Advisory Committee Chair Harvey Rishikof for appearing in this episode.The black letter law discussed in this podcast is:Foreign Spies: Stealing U.S. Economic Secrets in Cyberspace (2011 ONCIX report)http://www.thecre.com/fisma/wp-content/uploads/2011/11/Foreign_Economic_Collection_2011.pdfEconomic Espionage Act, 18 U.S.C. §1831-1832: https://www.law.cornell.edu/uscode/text/18/1831And https://www.law.cornell.edu/uscode/text/18/1831 E.O. 13694 (April 1, 2015), Blocking the Property of Certain Persons Engaging in Significant malicious Cyber-Enabled Activities: https://obamawhitehouse.archives.gov/the-press-office/2015/04/01/executive-order-blocking-property-certain-persons-engaging-significant-m U.S. Department of Commerce, Bureau of Industry and Security, Entity List: https://www.bis.doc.gov/index.php/policy-guidance/lists-of-parties-of-concern/entity-list Update to the IP Commission Report, February 2017: http://ipcommission.org/report/IP_Commission_Report_Update_2017.pdf Section 301 of the Trade Act of 1974: https://www.trade.gov/mas/ian/tradedisputes-enforcement/tg_ian_002100.aspFull Trade Act: https://legcounsel.house.gov/Comps/93-618.pdfU.S.-China Cyberspace norms developed in 2015: https://obamawhitehouse.archives.gov/the-press-office/2015/09/25/fact-sheet-president-xi-jinpings-state-visit-united-states United States v. Wang Don, Sun Kailiang, Wen Xinyu, Huang Zhenyu, Gu Chunhui, Indictment:https://www.justice.gov/iso/opa/resources/5122014519132358461949.pdf Chinese national Sentenced to Prison for Conspiracy to Steal Trade Secrets, October 5, 2016: https://www.justice.gov/opa/pr/chinese-national-sentenced-prison-conspiracy-steal-trade-secrets  U.S. and Chinese Defendants Charged with Economic Espionage and Theft of Trade Secrets in Connection with Conspiracy to Sell Trade Secrets to Chinese Companies, February 8, 2012: https://www.justice.gov/opa/pr/us-and-chinese-defendants-charged-economic-espionage-and-theft-trade-secrets-connectionChinese National Pleads Guilty to Economic Espionage and Theft of a Trade Secret from U.S. Company, May 19, 2017: https://www.justice.gov/usao-sdny/pr/chinese-national-pleads-guilty-economic-espionage-and-theft-trade-secret-us-companyKansas Agricultural Scientist Convicted in Theft of Engineered Rice, February 16, 2017: https://www.justice.gov/opa/pr/kansas-agricultural-scientist-convicted-theft-engineered-riceChinese National Who Conspired to Hack into U.S. Defense Contractors’ Systems Sentenced to 46 Months in Federal Prison, July 13, 2016: https://www.justice.gov/opa/pr/chinese-national-who-conspired-hack-us-defense-contractors-systems-sentenced-46-monthsZTE Corporation Agrees to Plead Guilty and Pay Over $430.4 Million for Violating U.S. Sanctions by Sending U.S.-Origin Items to Iran, Mary 7, 2017: https://www.justice.gov/opa/pr/zte-corporation-agrees-plead-guilty-and-pay-over-4304-million-violating-us-sanctions-sendingArticle: Cyber Crime Costs Projected To Reach $2 Trillion by 2019 https://www.forbes.com/sites/stevemorgan/2016/01/17/cyber-crime-costs-projected-to-reach-2-trillion-by-2019/#7b255b873a91The National Security Division of the U.S. Department of Justice can be found online: https://www.justice.gov/nsd

Thank you to Advisory Committee Chair Harvey Rishikof for appearing in this episode. The black letter law discussed in this podcast is: Foreign Spies: Stealing U.S. Economic Secrets in Cyberspace (2011 ONCIX report) <a href="http://www.thecre.com/fisma/wp-content/uploads/2011/11/Foreign_Economic_Collection_2011.pdf" rel="nofollow" target="_blank">http://www.thecre.com/fisma/wp-content/uploads/2011/11/Foreign_Economic_Collection_2011.pdf</a> Economic Espionage Act, 18 U.S.C. §1831-1832: <a href="https://www.law.cornell.edu/uscode/text/18/1831" rel="nofollow" target="_blank">https://www.law.cornell.edu/uscode/text/18/1831</a> And <a href="https://www.law.cornell.edu/uscode/text/18/1831" rel="nofollow" target="_blank">https://www.law.cornell.edu/uscode/text/18/1831</a> E.O. 13694 (April 1, 2015), Blocking the Property of Certain Persons Engaging in Significant malicious Cyber-Enabled Activities: <a href="https://obamawhitehouse.archives.gov/the-press-office/2015/04/01/executive-order-blocking-property-certain-persons-engaging-significant-m" rel="nofollow" target="_blank">https://obamawhitehouse.archives.gov/the-press-office/2015/04/01/executive-order-blocking-property-certain-persons-engaging-significant-m</a> U.S. Department of Commerce, Bureau of Industry and Security, Entity List: <a href="https://www.bis.doc.gov/index.php/policy-guidance/lists-of-parties-of-concern/entity-list" rel="nofollow" target="_blank">https://www.bis.doc.gov/index.php/policy-guidance/lists-of-parties-of-concern/entity-list</a> Update to the IP Commission Report, February 2017: <a href="http://ipcommission.org/report/IP_Commission_Report_Update_2017.pdf" rel="nofollow" target="_blank">http://ipcommission.org/report/IP_Commission_Report_Update_2017.pdf</a> Section 301 of the Trade Act of 1974: <a href="https://www.trade.gov/mas/ian/tradedisputes-enforcement/tg_ian_002100.asp" rel="nofollow" target="_blank">https://www.trade.gov/mas/ian/tradedisputes-enforcement/tg_ian_002100.asp</a> Full Trade Act: <a href="https://legcounsel.house.gov/Comps/93-618.pdf" rel="nofollow" target="_blank">https://legcounsel.house.gov/Comps/93-618.pdf</a> U.S.-China Cyberspace norms developed in 2015: <a href="https://obamawhitehouse.archives.gov/the-press-office/2015/09/25/fact-sheet-president-xi-jinpings-state-visit-united-states" rel="nofollow" target="_blank">https://obamawhitehouse.archives.gov/the-press-office/2015/09/25/fact-sheet-president-xi-jinpings-state-visit-united-states</a> United States v. Wang Don, Sun Kailiang, Wen Xinyu, Huang Zhenyu, Gu Chunhui, Indictment: <a href="https://www.justice.gov/iso/opa/resources/5122014519132358461949.pdf" rel="nofollow" target="_blank">https://www.justice.gov/iso/opa/resources/5122014519132358461949.pdf</a> Chinese national Sentenced to Prison for Conspiracy to Steal Trade Secrets, October 5, 2016: <a href="https://www.justice.gov/opa/pr/chinese-national-sentenced-prison-conspiracy-steal-trade-secrets" rel="nofollow" target="_blank">https://www.justice.gov/opa/pr/chinese-national-sentenced-prison-conspiracy-steal-trade-secrets</a> U.S. and Chinese Defendants Charged with Economic Espionage and Theft of Trade Secrets in Connection with Conspiracy to Sell Trade Secrets to Chinese Companies, February 8, 2012: <a href="https://www.justice.gov/opa/pr/us-and-chinese-defendants-charged-economic-espionage-and-theft-trade-secrets-connection" rel="nofollow" target="_blank">https://www.justice.gov/opa/pr/us-and-chinese-defendants-charged-economic-espionage-and-theft-trade-secrets-connection</a> Chinese National Pleads Guilty to Economic Espionage and Theft of a Trade Secret from U.S. Company, May 19, 2017: <a href="https://www.justice.gov/usao-sdny/pr/chinese-national-pleads-guilty-economic-espionage-and-theft-trade-secret-us-company" rel="nofollow" target="_blank">https://www.justice.gov/usao-sdny/pr/chinese-national-pleads-guilty-economic-espionage-and-theft-trade-secret-us-company</a> Kansas Agricultural Scientist Convicted in Theft of Engineered Rice, February 16, 2017: <a href="https://www.justice.gov/opa/pr/kansas-agricultural-scientist-convicted-theft-engineered-rice" rel="nofollow" target="_blank">https://www.justice.gov/opa/pr/kansas-agricultural-scientist-convicted-theft-engineered-rice</a> Chinese National Who Conspired to Hack into U.S. Defense Contractors’ Systems Sentenced to 46 Months in Federal Prison, July 13, 2016: <a href="https://www.justice.gov/opa/pr/chinese-national-who-conspired-hack-us-defense-contractors-systems-sentenced-46-months" rel="nofollow" target="_blank">https://www.justice.gov/opa/pr/chinese-national-who-conspired-hack-us-defense-contractors-systems-sentenced-46-months</a> ZTE Corporation Agrees to Plead Guilty and Pay Over $430.4 Million for Violating U.S. Sanctions by Sending U.S.-Origin Items to Iran, Mary 7, 2017: <a href="https://www.justice.gov/opa/pr/zte-corporation-agrees-plead-guilty-and-pay-over-4304-million-violating-us-sanctions-sending" rel="nofollow" target="_blank">https://www.justice.gov/opa/pr/zte-corporation-agrees-plead-guilty-and-pay-over-4304-million-violating-us-sanctions-sending</a> Article: Cyber Crime Costs Projected To Reach $2 Trillion by 2019 <a href="https://www.forbes.com/sites/stevemorgan/2016/01/17/cyber-crime-costs-projected-to-reach-2-trillion-by-2019/#7b255b873a91" rel="nofollow" target="_blank">https://www.forbes.com/sites/stevemorgan/2016/01/17/cyber-crime-costs-projected-to-reach-2-trillion-by-2019/#7b255b873a91</a> The National Security Division of the U.S. Department of Justice can be found online: <a href="https://www.justice.gov/nsd" rel="nofollow" target="_blank">https://www.justice.gov/nsd</a>

Thieves from Abroad: The threat of intellectual property theft with Adam Hickey and David Laufman