Therefore, the U.S. should pursue a discrete and cooperative dialogue with Israel as its committee takes shape. Congress has amended CFIUS’s mandate several times over the years to enhance its authority and address new risks. Washington should encourage similar adaptability in Israel. It will be especially important to better understand how exactly Jerusalem proposes to enhance protections against Chinese exploitation of Israel’s hi-tech sector. Whatever precise form this takes, U.S. intelligence sharing on entities with troubling connections to Beijing could prove enormously helpful, as could a sharing of FBI and other agencies’ best practices for educating the U.S. private sector on the dangers of adversarial foreign investment.
Treasury also should sanction the financiers of cyber operations, as sanctioning only the hackers themselves has been insufficient to deter their misbehavior. Reports indicate, for example, that another sanctioned Iranian cyber threat group, known as Cobalt Dickens, continues to operate unimpeded. Treasury’s existing anti-terrorism and non-proliferation sanctions are potent because they target not only the aggressors but also their financial networks. For U.S. sanctions to be an effective tool to combat and thwart cyber operations, this expansiveness must be replicated in the cyber realm.
but the industry is not yet capable of spurring society-wide cyber resilience. The U.S. government must help the private sector get the data it needs to improve risk modeling and prices. These better models will enable insurance providers to offer policies that provide real coverage from damages while simultaneously encouraging clients to protect themselves so that they are less likely to make a claim in the first place. In this way, the U.S. government can set loose the natural forces of capitalism to create a desirable cyber insurance product to offset cyber risk.