In January 2008, the Bush Administration initiated the Comprehensive National Cybersecurity Initiative (the CNCI) to make the United States more secure against cyber threats. The CNCI "establishes the policy, strategy, and guidelines to secure federal systems." On February 9, 2009, President Obama directed a 60-day interagency cybersecurity review to develop a strategic framework to ensure the CNCI is being appropriately integrated, resourced, and coordinated with Congress and the private sector. However, threats could originate from foreign military or intelligence operatives rather than from terrorist groups. Move towards managing a single federal enterprise network;
2. Connect current government cyber operations centers;
6. Expand cyber education;
9. Develop multi-pronged approaches to supply chain risk management; and
12. Legal Authorities for Executive Branch Responses to Cyber Threats

As discussed, the CSIS report on Securing Cyberspace for the 44 th Presidency recommends executive action to protect U.S. cyberspace. To be legally authorized, the CNCI and any other executive-branch action must have some basis in statutory or constitutional law. In addition, although the phrase "war powers" evokes international conflicts, it seems that the President's war powers authorize at least some domestic action. Cyber intrusions conducted by individual computer hackers, not supported by or aligned with a nation or terrorist organization, are perhaps best characterized as ordinary criminal activity whereas orchestrated intrusions by foreign security or intelligence entities might belong in a category of routine foreign-intelligence gathering. Therefore, at least until Congress takes further action in the cybersecurity area, it appears that the executive branch is not precluded from implementing the CNCI or other cybersecurity responses under Justice Jackson's Youngstown framework. Likewise, the Supreme Court has characterized the President as the "sole organ" of the country in conducting foreign affairs. Congress might choose to:
determine the most appropriate and effective organizational entity in which the nation's principal cybersecurity prevention, response, and recovery responsibilities should reside; require the senior U.S. government official in charge of all CNCI related activities be a Senate confirmable position to facilitate ongoing information exchange regarding Initiative plans and areas of progress and difficulty; enact legislative language recognizing and defining the classified and unclassified aspects of the CNCI and the need for greater transparency and inclusiveness; require the new Administration to develop and revise annually a classified and unclassified national cyber security strategy and intelligence community generated National Intelligence Estimate that provides Congress, the telecommunications industry, and the American public information related to the CNCI, the current and strategic cyber threats facing the nation, and programs being implemented to prepare for evolving technological risks; define the privacy and civil liberty considerations that should accompany all aspects of the CNCI; include legislative language in applicable authorizations bills to establish a programmatic foundation for CNCI related programs and suggest funding for current and future year's activities; or identify and codify relevant laws defining a national security related cyber offense against the United States, offensive versus defensive cyber activities, and the situations in which the Congress should be notified prior to the United States undertaking an offensive or counteroffensive cyber act. In response to calls for executive action, questions have arisen regarding the adequacy of legal authorities justifying executive responses to cyber threats.
Federal agencies report increasing cyber-intrusions into government computer networks, perpetrated by a range of known and unknown actors. In response, the President, legislators, experts, and others have characterized cybersecurity as a pressing national security issue.
Like other national security challenges in the post-9/11 era, the cyber threat is multi-faceted and lacks clearly delineated boundaries. Some cyber attackers operate through foreign nations' military or intelligence-gathering operations, whereas others have connections to terrorist groups or operate as individuals. Some cyber threats might be viewed as international or domestic criminal enterprises.
In January 2008, the Bush Administration established the Comprehensive National Cybersecurity Initiative (the CNCI) by a classified joint presidential directive. The CNCI establishes a multi-pronged approach the federal government is to take in identifying current and emerging cyber threats, shoring up current and future telecommunications and cyber vulnerabilities, and responding to or proactively addressing entities that wish to steal or manipulate protected data on secure federal systems. On February 9, 2009, President Obama initiated a 60-day interagency cybersecurity review to develop a strategic framework to ensure the CNCI is being appropriately integrated, resourced, and coordinated with Congress and the private sector.
In response to the CNCI and other proposals, questions have emerged regarding: (1) the adequacy of existing legal authorities—statutory or constitutional—for responding to cyber threats; and (2) the appropriate roles for the executive and legislative branches in addressing cybersecurity. The new and emerging nature of cyber threats complicates these questions. Although existing statutory provisions might authorize some modest actions, inherent constitutional powers currently provide the most plausible legal basis for many potential executive responses to national security related cyber incidences. Given that cyber threats originate from various sources, it is difficult to determine whether actions to prevent cyber attacks fit within the traditional scope of executive power to conduct war and foreign affairs. Nonetheless, under the Supreme Court jurisprudence, it appears that the President is not prevented from taking action in the cybersecurity arena, at least until Congress takes further action. Regardless, Congress has a continuing oversight and appropriations role. In addition, potential government responses could be limited by individuals' constitutional rights or international laws of war. This report discusses the legal issues and addresses policy considerations related to the CNCI.