C riminals and other malicious actors increasingly rely on the Internet and rapidly evolving technology to further their operations. In this domain, criminals can compromise financial assets, hacktivists can flood websites with traffic—effectively shutting them down, and spies can steal intellectual property and government secrets. When such cyber incidents occur, a number of questions arise, including how the federal government will react and which agencies will respond. U.S. Cyber Incident Response

Federal law enforcement has the principal role in investigating and attributing cyber incidents to specific perpetrators, and this responsibility has been established within the broader framework of federal cyber incident response. Responding to cyber incidents involves (1) threat response, (2) asset response, and (3) intelligence support. DOJ, through the Federal Bureau of Investigation (FBI) and National Cyber Investigative Joint Task Force (NCIJTF), is the designated lead on threat response . The FBI's Cyber Division focuses on "high-level intrusions by state-sponsored hackers and global cyber syndicates, and the most prolific botnets." As established, the NCIJTF's mission is to "serve as a multi-agency national focal point for coordinating, integrating, and sharing pertinent information related to cyber threat investigations." Cyber-Related Task Forces and Partnerships

The FBI leads a variety of law enforcement task forces and partnerships focused on cyber threat response. Private Sector Information Sharing and Collaboration

In addition to its partnerships with law enforcement, the FBI has established several initiatives to interface with the private sector regarding cyber incidents. They collect and share information, build partnerships, and enhance awareness. The FBI stood up the Internet Crime Complaint Center (IC3) in 2000. Cyber Workforce

In addressing the cyber threat, the FBI faces challenges in both recruiting and retaining an appropriate cyber workforce. On the retention side, DOJ's Inspector General recommended that the FBI, among other things, "evaluate the effectiveness of the step-by-step training course for FBI agents on how to investigate national security intrusion cases; reconsider the rotation policy for cyber agents and ensure that agents skilled and experienced in cyber intrusions are available to FBI field offices; and consider developing regional hubs with agents that are experts in investigating national security intrusions." Technology and Investigations

FBI investigators seek to use every tool in their cyber investigative toolkit to combat a range of threats and attribute activities to specific threat actors. FBI Cyber Threat Prioritization

Relating to the FBI's work in combating and responding to cyber threats, one question policymakers may have is how the bureau prioritizes cyber threats. The OIG's report made two recommendations:
The FBI should use an "algorithmic, data-driven, and objective methodology" to identify and prioritize cyber threats. The bureau currently tracks agent time by case classification (such as public corruption or counterterrorism), not specific threats. Congress may elect to exercise its oversight to examine whether (and if so, how) the FBI has made any adjustments to its cyber threat prioritization regimen.
Criminals and other malicious actors increasingly rely on the Internet and rapidly evolving technology to further their operations. In cyberspace, criminals can compromise financial assets, hacktivists can flood websites with traffic—effectively shutting them down, and spies can steal intellectual property and government secrets. When such cyber incidents occur, a number of questions arise, including how the federal government will react and which agencies will respond.
The Obama Administration, through Presidential Policy Directive/PPD-41, outlined how the government responds to significant cyber incidents. Responding to cyber incidents involves (1) threat response, (2) asset response, and (3) intelligence support. The Department of Justice (DOJ), through the Federal Bureau of Investigation (FBI, or the bureau) and National Cyber Investigative Joint Task Force (NCIJTF), is the designated lead on threat response, which involves investigating and attributing specific cyber activities to particular individuals or entities as well as facilitating intelligence and information sharing.
In investigating cyber incidents, the FBI's Cyber Division focuses on "high-level intrusions by state-sponsored hackers and global cyber syndicates, and the most prolific botnets." In addition to conducting its own cyber investigations, the FBI
leads the NCIJTF, a multiagency hub for coordinating, integrating, and sharing information on cyber threat investigations; heads up other task forces and law enforcement partnerships focused on cyber threat response, including cyber task forces with subject matter experts at each field office, cyber action teams that can rapidly deploy in response to specific incidents, and cyber assistant legal attachés positioned in certain foreign countries to work with U.S. counterparts; has established several initiatives to interface with the private sector regarding cyber incidents; these resources (such as the Internet Crime Complaint Center, IfraGard program, and National Cyber-Forensics and Training Alliance) collect and share information, build partnerships, and enhance cyber threat awareness; has been working to recruit and retain an appropriate cyber workforce and has developed a multilayered cyber training program for its agents; and has been discussing with the technology community and policymakers how evolving technology, such as encrypted communications and devices, affects investigations, particularly in cyber-related cases, and how law enforcement can develop tools to investigate these cases most effectively.
Relating to the FBI's work in combating and responding to cyber threats, one question policymakers may have is how the bureau prioritizes cyber threats. DOJ's Inspector General, while noting strides in this arena, has recommended that (1) the FBI should use a more data-driven, objective methodology to identify and prioritize cyber threats, and (2) the FBI should develop a means to track agent time spent on specific cyber threats. Policymakers may elect to conduct oversight of the FBI's efforts in these areas, examine whether any changes to cyber threat prioritization affect where cyber threats rank within the broader universe of threats confronting the nation, and debate whether or how to direct the FBI's use of funds allocated to combating cyber threats.