Deconstructing the U.S. Policy of Indicting Malicious State Cyber Actors

Abstract

In 2014, the United States Department of Justice unsealed its first indictment against foreign military hackers. Since then, the Justice Department has continued the practice, indicting military and intelligence personnel from China, Russia, Iran, and North Korea, as well as hackers-for-hire working at the behest of State handlers. Debates over the propriety and efficacy of the indictments have discussed the benefits and downsides of the policy writ-large, but have not analyzed the indictments in-depth to deconstruct the policy and identify first principles. This paper analyzes all of the indictments publicly released thus far and characterizes them along several axes, including the status of the hackers, the goal of the operation, the identity of the target, and the crimes charged, with additional discussion about the techniques involved in the various operations. After examining the trends identified in the analysis, this paper proposes a more nuanced framework for deciding whether or not to indict malicious State or State-sponsored cyber actors and recommends policies that will help the U.S. combat malicious State activity in cyberspace.