FAS

Combating Malicious Cyber Acts, Penny by Penny

10.24.19 | 2 min read | Text by Steven Aftergood

Updated below

The Department of the Treasury blocked one transaction by a foreign person or entity who was engaged in malicious cyber activities earlier this year, using the national emergency powers that are available pursuant to a 2015 executive order.

But the value of the intercepted transaction was only $0.04, the Department said in a new report to Congress.

No other transactions were blocked by the Department of the Treasury’s Office of Foreign Assets Control (OFAC) during the reporting period from March 15 to September 8 of this year, according to the Department’s latest report. See Periodic Report on the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities, October 3.

Meanwhile, the cost of implementing the national emergency on malicious cyber activities was approximately $770,000 during the latest six-month period, the same report said.

Is this normal? Should Americans be concerned about the stark disparity between the amount of government expenditures and the reported proceeds? The Department of the Treasury did not respond to our inquiry on the subject yesterday. [see update below]

Background on OFAC’s Cyber-Related Sanctions Program can be found here.

Update: An official said that it would be a mistake to judge the efficacy or the efficiency of a particular sanctions program from a single periodic report, especially since these reports are not comprehensive assessments of the program.

Nor are blocked transactions the sole or primary measure of impact. Persons subject to sanctions may experience a range of other impacts, including: the disruption or loss of existing or planned contracts and other relationships with U.S. and foreign business partners; the blocking or rejection of transactions with persons outside of U.S. jurisdiction; the disruption of financial and other activities due to complementary actions taken by U.S. allies and partners; reputational damage due to the exposure of malign activities; the cost of altering and rebuilding cyber infrastructure exposed due to the imposition of sanctions; disavowal by associated governments; and loss of visas to travel to the United States and potentially to other countries.