Future of America's Cyber Safety Review Board hangs in balance amid calls for rethink

As the US mulls legislation that would see the Cyber Safety Review Board (CSRB) become a permanent fixture in the government's cyber defense armory, experts are calling for substantial changes in the way it's organized.

Discussions were held at a US Senate hearing on January 17 on how the CSRB could be improved. The board was established in 2021 via an Executive Order and is tasked with investigating some of the most pressing cybersecurity challenges facing the US, but has only produced two reports so far: One on Log4J [PDF] and another on the LAPSUS$ group [PDF].

All three senior industry figures in attendance agreed that a greater degree of independence was required to ensure the reports produced by the board were as richly detailed as possible, answering the questions that those in the private sector typically haven't in the past.

Tarah Wheeler, CEO at Red Queen Dynamics, said the current makeup of the CSRB needs a serious rethink and the way investigations are carried out at present is like asking Boeing's leadership to write the sole report on what happened with last week's 737 MAX 9 disaster.

Currently, the CSRB comprises 15 cybersecurity leaders from both the public and private sectors, but this is viewed as a potential blockade for open, transparent reporting on major incidents.

Rightly or wrongly, a private organization isn't expected to be completely and wholly transparent about a security incident, so to elect a representative of an organization subject to a CSRB investigation to the CSRB could result in findings omitted for legal and profitability reasons.

The board's upcoming third report, looking into the Microsoft Exchange snafu that saw 60,000 State Department emails flutter off to China, is one such example of where private sector members from or with ties to Microsoft have no place.

"Many individuals on the CSRB are beloved and respected, but they do have full-time jobs and they do not have the time, freedom, or authority to conduct independent, thorough investigations," Wheeler said.

"But why couldn't this be done in the private sector? Well, right now, many of the most significant cyber incident reports are legally vetted corporate publications, which can and have disappeared as profit and regulation required."

To avoid a duplication of efforts, the CSRB should be an independent body wielding the power to fully probe an incident and include every detail in an open report so the wider industry can benefit from the lessons, she argued.

The cybersecurity industry, at present, relies heavily on intelligence shared by private companies like Microsoft, Google, Mandiant, etc. The goal of the CSRB should be to offer reports filled with actionable information that's free to be published without fear of lawyers hushing certain sections or risking a dip in stock prices.

The sentiment was shared by Trey Herr, director of the Cyber Statecraft Initiative at the Atlantic Council, who also agreed that the proposed independence of the CSRB should be seen as a key strength and an argument in favor of introducing the board on a permanent basis.

"At some number of steps removed from an incident, both government and industry are naturally conflicted actors when it comes to investigating these failures," said Herr.

"Someone designed, built, certified, sold, and accepted the risk of that system before it failed. It is unlikely that any party along that supply chain will be the most eager to understand their role in such a failure."

In terms of the board's membership, Herr said the CSRB should have a handful of core members but also have the power to bring in and recuse members on an ad-hoc basis, depending on the perceived conflict of interest on any given investigation.

John Miller, senior veep of policy, trust, data, and technology and general counsel at the Information Technology Industry Council (ITI), said private sector board members should be independent and the election process should also be transparent. It's a sentiment that was met with unanimous agreement, but there is somewhat of an unease around the conflicts of interest that arise with the private sector's involvement.

"Some ITI members have noted the value and imperative of industry involvement in the board's activities, pointing out that the deep visibility of private sector cybersecurity firms into the global cyber threat landscape uniquely situates representatives from those firms to provide ecosystem-wide insights of enormous value to the board's deliberations," he said. 

"Other ITI members express concerns about whether private sector participation from only a handful of companies might create real or perceived conflicts of interest, such as the perception that competitive bias could influence the board's activities."

It's an interesting point to make given the long-running, and still ongoing, calls for stronger public-private collaboration in the infosec industry. Here we are today presented with a proposal for a dedicated function that is underpinned by the very thing the industry has been calling for, but the realization is now that certain guardrails must be in place for it to work.

Subpoena power?

In addition to its independence and primary function, discussions were held about whether the board should have the power to subpoena organizations to obtain key information that may otherwise stay within a company's walls.

It was an area that saw an element of disagreement among the experts offering their testimony before senators. Wheeler, on one hand, appeared vehemently in favor of affording the CSRB subpoena powers, but not in its current makeup, which she argued could be seen as anti-competitive.

"Use of that subpoena power by government officials could be seen as backdoor regulatory action," she said. "But if the CSRB were independent, it should absolutely have the power to compel information and testimony.

"I've been the one who's been being told shut up by a lawyer before in a moment where I, as a technologist and as an incident responder, was trying to just frantically solve a problem, keep people safe, stop data from leaking. And I think that the big challenge we have with a lack of subpoena power on the current board is that the real answers are often found about three layers deeper than the information that, as far as I am aware right now, is being provided to the board."

Herr agreed, with a slight addendum: The subpoena power should not be tied to a criminal investigation – something that may impede the board's access to information.

He said it should exist within a specific authority like the National Transportation Safety Board (NTSB) – a similar body that investigates major transport accidents and inspired the formation of the CSRB – and shouldn't be punitive in any way.

Miller opposed the idea, saying it was too early to think about affording the CSRB powers of this caliber until the Cybersecurity and Infrastructure Security Agency (CISA) has finalized the scope of the incidents and covered entities of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).

"I think it's premature to say that a board focused on investigating incidents needs subpoena power to get information until we know what those regulations say and what information is already going to be provided to CISA and the government," he said.

"We are concerned that subpoena authority puts CISA particularly, if that's where the CSRB continues to live, in a more adversarial position with the private sector. And then finally, if the CSRB is going to continue to have private sector members on its board, even if you insulate them from the decision-making process as to whether to issue a subpoena, it at the very least does create some apparent conflicts of interest when you have members of the private sector subpoenaing other members of the private sector who might be competitors."

Following the hearing, Senator Gary Peters (D-MI) said the committee was not endorsing any of the testimony given before it this week and is still in the research stages of deciding whether to codify the board. ®