Now is Not the Time to Limit Cyber Liability and State Enforcement

It is a scary time for those of us concerned about data security and threats posed by the rapid rollout of AI systems. Cybersecurity experts dubbed last month “Black October” and have been warning us about the “vulnpocalypse.” So why are some Senators proposing a law that would limit liability for (and state enforcement authority against) major technology firms? It is a dangerous proposal that could make a bad problem a whole lot worse.

Threats to the privacy and security of our communications networks are not new. But the last six months have seen an alarming rise in the pace and scale of new cyber vulnerability discoveries. These discoveries are being driven by new AI systems that are especially good at detecting these weaknesses — veritable needles in the giant digital haystacks of our legacy systems. Most recently, researchers discovered that PHP (one of the most commonly used programming languages across the internet) had a critical vulnerability that could compromise the websites and apps we all use every day.

A malicious actor using this vulnerability to launch an attack could try to steal personal or payment information, to inject malicious software that would infect a users’ computer or mobile device, or could block access to entire sites or services. And this new threat comes as we are seeing a continuous onslaught of digital fraud, with older Americans suffering the brunt of online scams.

At a time where cyber vulnerabilities are on the rise and scams are threatening the financial wellbeing of people across the country, it is concerning to see leaders in the Senate introduce a new bill that seems to bring a spoon to a knife fight—and might be worse than passing no law at all if it is used to undermine existing state enforcement mechanisms.

Senators Cruz and Warner recently introduced the Telecommunications Cybersecurity Resilience Act with the intent of addressing “vulnerabilities in the U.S. and global telecommunications sector highlighted by the Salt Typhoon hacks and other sophisticated cyber threats.” But would the law actually accomplish that goal? Unfortunately, the answer seems to be no, but to understand why, I will first describe what the law would do:

• First, the bill would create a Telecommunications Cybersecurity Working Group housed within the National Telecommunications and Information Administration (NTIA).
  • Who would serve on this working group? Federal agency representatives, telecommunications carriers, equipment and infrastructure suppliers, software providers of cloud services and cybersecurity tools (more on this in later), state and local emergency network operators, and independent cybersecurity experts.
  • Why would this telecommunications working group be housed in NTIA rather than at the Federal Communications Commission? Great question.
• Second, the working group would be tasked with developing a set of “Industry Best Practices” governing telecommunications cybersecurity and to “create a network of independent third-party assessors eligible to certify implementation and maintenance of best practices.”
  • When would the working group create these best practices? The bill provides an 18-month period for the initial development of cybersecurity standards.
  • What would the best practices cover? They must focus on “identifying, responding to, mitigating, preventing, and remediating cybersecurity incidents and vulnerabilities” and be “risk-based” but also “avoid duplication of existing cybersecurity risk management processes.” They can include things like “application of security updates,” the “timely decommissioning” of devices that can’t be updated, the adoption of “configuration management practices” for hardware and software, and the implementation of multi-factor authentication.
  • Who decides what best practices to adopt? The Working Group would be co-led by the Assistant Secretary of Commerce for Communications and Information and one of the members selected by majority vote. We know from experience that telecommunications and big tech companies are well equipped to fund and staff members of this type of Working Group. Any independent cybersecurity experts and members of academia that are appointed, on the other hand, will essentially be volunteering their time and working on a limited or nonexistent budget. This asymmetry of power has historically led to Working Groups that either issue weak standards with little impact on industry practices or to disrupt the process toward a dead-end or gridlock situation.
  • How would the best practices be used? That takes us to the next part.
• Third, the Working Group would develop criteria for “independent third-party cybersecurity assessors.”
  • Who sets the criteria? The Working Group gets to set their own criteria for third-party assessors, subject to approval by the Assistant Secretary.
  • Who selects the assessors? The Assistant Secretary at Commerce publishes a list of assessors based on the Working Group’s criteria, with the caveat that no assessor can be “owned or controlled by a telecommunications carrier.”
  • Are telecommunications carriers (or others) required to be evaluated by these third-party cybersecurity assessors? No. It is entirely voluntary.Then what is the enforcement mechanism for these Working Group best practices? There is no penalty for failing to meet the Best Practices, but there is an incentive for a provider to submit to the assessment and become “certified” by the Department of Commerce: the provider will be “entitled to an affirmative defense” that its certification means it has acted with “due care or reasonableness” in mitigating cybersecurity vulnerabilities unless it is found to have “acted with gross negligence, willful misconduct, or have not materially implemented or maintained” the best practices.
  • What about providers (and suppliers / other software companies) that don’t get certified? They won’t be able to take advantage of the new affirmative defense (e.g. safe harbor) if they are sued for inadequate cybersecurity practices.

Clearly this bill recognizes that the telecommunications industry needs to step up its game to improve cybersecurity standards. But creating a voluntary Working Group with no regulatory or enforcement authority, which only generates a set of voluntary best practices, does not meet the moment we are facing. And when cyber liability (and the pressure it puts on providers and their insurers) is one of the few forces pushing companies to adequately invest in data security and prevention, the idea of creating broad affirmative defenses and potentially limiting the scope of state enforcement without new federal enforcement authorities should be a non-starter.