A new Washington initiative seeks to shape policy debates over how the government and private sector collaborate on cyber operations, a conversation that will inevitably raise complex questions about the legal authorities governing industry’s role, participants say.
Venable’s Center for Cybersecurity Policy and Law launched the Cyber Operations Policy Coalition this week, seeking to be a “trusted forum for collaboration among industry, government, legal experts, academia, and civil society to help develop policy frameworks for collective cyber defense,” according to its mission statement.
At a launch event Wednesday, current and former officials concurred that stakeholders will need to confront unresolved questions about legal authorities, liability and the rules of the road for companies before deeper public‑private cyber operations can truly scale.
Legal expertise will be “key to the success” of integrating industry and government more closely, Katie Sutton, assistant secretary of defense for cyber policy and the principal cyber advisor to the defense secretary, said in a discussion held at the event.
“We talk about authorities — everything is under what authorities do I have, what authorities does Cyber Command have, under what authorities is this operation happening? [There are] a lot of well-defined authorities from a government perspective. Industry actually has quite a few authorities that they can bring to bear too, because they run this domain,” Sutton added.
“We can’t be in a model … asking permission every time a certain step is going to be taken. That’s going to require a lot of the unsexy work we heard about the legal and policy foundations, the understanding of liability and everything that surrounds that,” said Tonya Ugoretz, who heads PwC’s Cyber & Risk Innovation Institute and previously served in senior roles at the FBI and the Office of the Director of National Intelligence.
Unlike traditional military domains, cyber conflict often runs through privately owned networks, forcing the government to rely on companies that may be both targets of foreign activity and essential partners in responding to it.
The U.S. has sought to integrate cyber activity into military operations, lending the debate urgency as the White House more openly discusses offensive cyber operations and as private companies are drawn deeper into the market for cyber tools. The advent of advanced cyber-focused frontier AI models has also contributed to the discussions.
As part of its emerging counter-advanced persistent threat planning with major providers, the Joint Cyber Defense Collaborative — a Cybersecurity and Infrastructure Security Agency-led body for coordinating public and private sector cyberdefense — is beginning to explicitly map out both defensive playbooks and potential offensive-leaning moves that might be on the table in a geopolitical crisis, according to Matt Springer, the JCDC deputy assistant director.
That would also raise fresh questions about legal risk and authorities for companies that own and operate infrastructure. “We have some potential cyber offensive options that could be taken theoretically by partners in those scenarios,” he said at the launch event. “This will get into some of the policy questions I know we wanted to touch on. That’s a dicey area.”
The discussions highlight how cybersecurity is becoming a more central arena for national security law, as officials and industry leaders examine whether existing legal frameworks are sufficient for operations that frequently require closer coordination between the government and private firms.
In the last year, top national officials have sought to highlight the role of cyber operations in their recent military achievements. A new cyber service branch is also being weighed in the must-pass annual defense bill.
