Cybersecurity Policy Report, Policy Blueprint for Trump Presidency Calls for Forceful Cyber Counter-Attacks, (Jul 16, 2024)

By Tom Leithauser

If Donald Trump becomes president again in 2025, his administration should more aggressively use the military to retaliate against nation-state cyber attacks than previous administrations, according to a policy blueprint prepared by a collection of conservative thought leaders and officials from the first Trump administration.

The Project 2025 Presidential Transition Project’s work, sponsored by the Heritage Foundation, is widely viewed as a policy road map for a Trump presidency, although Mr. Trump himself has claimed otherwise. The official Republican Party platform adopted yesterday at the party’s convention in Milwaukee mentions “cyber” only once, while the Project 2025 agenda delves more deeply into policy proposals.

During the first Trump administration, National Security Adviser John Bolton rescinded an Obama-era presidential policy directive that, in Mr. Bolton’s view, hindered the ability of the U.S. military and intelligence agencies to retaliate for nation-state cyber attacks on the U.S. (CPR, Sept. 20, 2018).

The Project 2025 policy blueprint recommends that a second Trump administration should opt for a more bellicose stance in cyberspace to deter cyber attacks.

“A whole-of-government approach and willingness to employ cyber, information, economic, and counterterrorist irregular warfare capabilities should be utilized to protect the homeland,” it says.

The administration should “[d]emonstrate a willingness to employ offensive cyber capabilities against adversaries who conduct cyberattacks against U.S. infrastructure, businesses, personnel, and governments,” it adds.

Regarding agency structure and missions, it calls for reevaluating the “dual-hat structure” that places a single official atop the National Security Agency and U.S. Cyber Command and suggests that the Cybersecurity and Infrastructure Security Agency’s mission should be constrained.

“CISA has rapidly expanded its scope into lanes where it does not belong, the most recent and most glaring example being censorship of so-called misinformation and disinformation,” it says.

It recommends that “the entirety of the CISA Cybersecurity Advisory Committee”—a 34-member board that advises CISA on cybersecurity policy issues—“should be dismissed on Day One.” It doesn’t explain why but suggests that the advisory committee has contributed to what it views as CISA’s mission creep.

It also recommends that CISA be removed from the Department of Homeland Security and placed under the Department of Transportation as part of an effort to “dismantle” DHS. “Breaking up the department along its mission lines would facilitate mission focus and provide opportunities to reduce overhead and achieve more limited government,” it says.

It acknowledges that structural changes to federal agencies would require the cooperation of Congress.

On data privacy issues, the Project 2025 blueprint recommends that the new administration challenge the European Union’s insistence that U.S. organizations adopt the strict privacy policies reflected in the EU’s General Data Protection Regulation to be eligible to receive and handle data about EU residents.

“For many years, the European Union (EU) has tried to force U.S. companies operating in Europe to follow its data privacy regulations,” it notes. It recalls that EU courts struck down two previous “privacy shield” agreements allowing data to flow from the EU to the U.S. on the grounds that they provided “insufficient protections for EU citizens against hypothetical U.S. government surveillance.”

“Those same European courts exempted the intelligence services of EU member states from the standards applied to the U.S., suggesting that trade protectionism may be the real motive behind data privacy regulations,” it says.

“An incoming conservative President should reset Europe’s expectations. Brussels has always arbitraged the difference between being a military ally against, for example, Russia and conducting a full-blown trade conflict with the United States,” it asserts.

“Restrictions on data exports have been part of the trade conflict, but now they could seriously harm our military and intelligence capabilities. Moreover, restrictions on U.S. intelligence collection hurt the Europeans themselves, especially as the United States shares unprecedented amounts of intelligence on Russia’s invasion of Ukraine with Europeans,” according to the Project 2025 policy blueprint.

“The United States has never seriously pushed back against the EU; now is the time,” it says. It recommends that a new administration should review an executive order issued by President Biden that imposed constraints on U.S. intelligence activities as part of an effort to arrange the latest iteration of a cross-border data pact with the EU (CPR, Oct. 7, 2022).

Any provisions of the EO “that unduly burden intelligence collection” should be rescinded, it says. “At the same time, in negotiations with the Europeans, the United States should make clear that the continued sharing of intelligence with EU member states depends on successful resolution of this issue within the first two years of a President’s term,” it says. “It is time for a real solution, not the 30 years of stopgaps imposed by Brussels.”

MainStory: TopStory FederalLegislation DataSecurity DataPrivacy