A Worry About the New Executive Order on Sanctions for Malicious Cyber Activity

As Paul Rosenzweig noted earlier today in Lawfare, the President just signed out an Executive Order that can result in the imposition of financial sanctions on a variety of bad actors that ply their trade through cyber means or against important cyber assets and/or restrictions or bans on travel to the United States on such individuals. Paul also makes the key point that “If access to US markets is of value, the Administration is signalling, strongly, that continued access may be conditioned on good cyber behavior.” I concur with that statement. But it’s only half the equation. The other half is how the bad actor (or the government of jurisdiction over the bad actor) will respond to US sanctions levied against them. Remember, we don’t get the last move in this game unless the other side simply rolls over and plays dead when we do whatever it is that we do. Consider China, for example. U.S. companies have all kinds of active business interests in China right now. Although many of them today chafe under Chinese restrictions or conditions for their doing business in China (e.g., having to surrender certain intellectual property rights to China), the operative question if the United States imposes sanctions on Chinese companies (likely state-owned enterprises) is whether a Chinese counter-response—justified or not—will make life even more miserable for U.S. companies now doing business in China. I think they will—which leads to the point that imposing economic sanctions of this sort on Chinese companies is not likely to be cost-free to U.S. companies. What will be the response of the U.S. companies harmed in a Chinese counter-response? In particular, are they likely to complain to the U.S. government about what is happening to them? And if they do, what will the U.S. government do then? I don’t have any answers here, and I am not saying that imposing sanctions on offending companies or individuals is bad policy. But I worry that no responsible authority has thought through the end game, or even the opening game beyond our first move. I sure would like to be reassured about that.