National Security Law Commons^™

Mitigating Common Vulnerabilities And Exposures In Cobol-Based Critical Systems Using The Strangler-Fig Pattern, Lauren E. Caruso, Vincent J. Compeau, Assefaw H. Gebremedhin

Military Cyber Affairs

COBOL-based legacy systems continue to underpin critical infrastructure in banking and government sectors despite their age and associated cybersecurity risks. Originally developed through a Department of Defense–sponsored initiative to standardize business computing, COBOL remains widely used in mission-critical environments. However, these systems face increasing vulnerabilities due to outdated security architectures, workforce shortages, and rising maintenance costs. This paper examines cybersecurity and operational challenges associated with COBOL systems and evaluates the Strangler Fig pattern as a modernization strategy that enables incremental replacement while maintaining continuity. The findings highlight implications for financial institutions and public-sector organizations dependent on legacy infrastructure.

Private Coverage, Public Risk: The Role Of Cyber Insurance In National Security Governance, Deborah L. Johnson

Faculty Publications

This Article explores the growing yet underexamined role of the commercial cyber insurance market in shaping the United States' approach to cybersecurity readiness. It argues that, as cyber threats against U.S. critical infrastructure and essential services increase, commercial cyber insurance has quietly come to function as a de facto governance tool in national cybersecurity. In hospitals, water and energy systems, and other public-facing sectors, policy language, underwriting questionnaires, and post-breach claims practices help define what counts as "reasonable" security, influence how organizations plan for and respond to incidents, and affect the pace and scope of recovery after an attack. Yet …

Hacking With Uncle Sam: Imagining A Public-Private Partnership For Active Cyber Defense, Jonathan Coleman

Catholic University Journal of Law and Technology

Federal law makes no distinction between "good" and "bad" hackers—the Computer Fraud and Abuse Act criminalizes hacking by a private citizen in any form. While an anti-hacking statute is necessary to deter and punish cybercrime, the current law prohibits private entities from "hacking back" or, more precisely, from engaging in active defensive measures in response to a cyberattack. If these measures were legalized, they could allow private entities to assist law enforcement and reduce the financial and reputational costs of a cyber incident. Absent a change in the law, private entities are dependent on law enforcement to provide active cyber …

The Sec Proposed Cybersecurity Infrastructure Rules And New Disclosure Requirements, Neal F. Newman, Lawrence J. Trautman, Brian Elzweig

Faculty Scholarship

In addition to regulation of securities market issuers, the Securities & Exchange Commission (SEC) is also responsible for regulation of those entities that provide the networks, either electronic or physical, that enable the functioning of our securities markets. On February 9, 2022, the Commission published a Release for Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies containing proposals that, if adopted, would establish a new cybersecurity incident reporting and disclosure regime and require registered investment advisers (“advisers”) and investment companies (“funds”) to implement policies and procedures designed to address cyber risks. The comment period for …

From The Editor In Chief, Antulio J. Echevarria Ii

The US Army War College Quarterly: Parameters

Welcome to the Autumn 2025 issue of Parameters. We open with two In Focus commentaries. The first, “A Case for Military Proportionality: Disabling Nuclear Plants” by Henry Sokolski, offers practical ways in which military planners can disable civilian targets, such as nuclear infrastructure, without undermining operational goals, alliance cohesion, or long-term political objectives. Our second commentary, “The Consequences of Declining Patriotism in the United States” by Neil N. Snyder, presents findings from a national survey showing a decline in patriotism, especially among Generation Z nonveterans. His article highlights a growing civil-military values gap with implications for recruitment and national …

Parameters Autumn 2025, Usawc Press

The US Army War College Quarterly: Parameters

No abstract provided.

Using Blockchain Technology To Help Secure America's Defense Critical Infrastructure, Vimal Buck, Aerin Krebs, Brynn Hillard, Jakob Gerha, Joseph Lutma, Srikar Maduposu, Ted Allen

Military Cyber Affairs

Critical water infrastructure in the United States faces increasing cybersecurity threats from state-sponsored actors, with potentially devastating consequences for national security, economic stability, and public health. (Cybersecurity and Infrastructure Security Agency, 2025). This infrastructure supports defense critical assets and is actively being targeted by various state-sponsored hacking groups, which poses a major concern for civilians and military alike. K. Herath (personal communication, February 24, 2025) reported being aware of two attacks on Ohio water systems during his tenure as Cybersecurity Strategic Advisor to Ohio Governor Mike DeWine.

Water is essential to everyday life and defense and presents as a high-value …

Playing To Win: The Use Of Export Controls To Address Non-Military Strategic Competition, Joshua Angelo

Duke Law & Technology Review

Technology and national security have been intimately related throughout American history. Over the past eighty-five years, the United States has increasingly made use of export controls to prevent adversarial countries from using the fruits of its technological advancement to strengthen their militaries and harm American interests. Today, strategic competition with the People’s Republic of China involves a myriad of technologies which present risks outside of, as well as within, the military context. Chinese exports of technologies, including artificial intelligence, quantum computing, and 5G communications, can promote the country’s authoritarian model abroad, enable economic coercion, and help to enrich the regime. …

Law School News: Elisabeth D'Amelio Chosen As Class Of 2024 Graduate Student Commencement Speaker 5-14-24, Jordan J. Phelan

Life of the Law School (1993- )

No abstract provided.

Securing The Void: Assessing The Dynamic Threat Landscape Of Space, Brianna Bace, Dr. Unal Tatar

Military Cyber Affairs

Outer space is a strategic and multifaceted domain that is a crossroads for political, military, and economic interests. From a defense perspective, the U.S. military and intelligence community rely heavily on satellite networks to meet national security objectives and execute military operations and intelligence gathering. This paper examines the evolving threat landscape of the space sector, encompassing natural and man-made perils, emphasizing the rise of cyber threats and the complexity introduced by dual-use technology and commercialization. It also explores the implications for security and resilience, advocating for collaborative efforts among international organizations, governments, and industry to safeguard the space sector.

Cyber Plungers: Colonial Pipeline And The Case For An Omnibus Cybersecurity Legislation, Asaf Lubin

Articles by Maurer Faculty

The May 2021 ransomware attack on Colonial Pipeline was a wake-up call for a federal administration slow to realize the dangers that cybersecurity threats pose to our critical national infrastructure. The attack forced hundreds of thousands of Americans along the east coast to stand in endless lines for gas, spiking both prices and public fears. These stressors on our economy and supply chains triggered emergency proclamations in four states, including Georgia. That a single cyberattack could lead to a national emergency of this magnitude was seen by many as proof of even more crippling threats to come. Executive Director of …

Security-Enhanced Serial Communications, John White, Alexander Beall, Joseph Maurio, Dane Fichter, Dr. Matthew Davis, Dr. Zachary Birnbaum

Military Cyber Affairs

Industrial Control Systems (ICS) are widely used by critical infrastructure and are ubiquitous in numerous industries including telecommunications, petrochemical, and manufacturing. ICS are at a high risk of cyber attack given their internet accessibility, inherent lack of security, deployment timelines, and criticality. A unique challenge in ICS security is the prevalence of serial communication buses and other non-TCP/IP communications protocols. The communication protocols used within serial buses often lack authentication and integrity protections, leaving them vulnerable to spoofing and replay attacks. The bandwidth constraints and prevalence of legacy hardware in these systems prevent the use of modern message authentication and …

What Senior U.S. Leaders Say We Should Know About Cyber, Dr. Joseph H. Schafer

Military Cyber Affairs

On April 6, 2023, the Atlantic Council’s Cyber Statecraft Initiative hosted a panel discussion on the new National Cybersecurity Strategy. The panel featured four senior officials from the Office of the National Cyber Director (ONCD), the Department of State (DoS), the Department of Justice (DoJ), and the Department of Homeland Security (DHS). The author attended and asked each official to identify the most important elements that policymakers and strategists must understand about cyber. This article highlights historical and recent struggles to express cyber policy, the responses from these officials, and the author’s ongoing research to improve national security cyber policy.

Was The Colonial Cyberattack The First Act Of Cyberwar Against The U.S.? Finding The Threshold Of War For Ransomware Attacks, Liam P. Bradley

St. John's Law Review

(Excerpt)

On May 7, 2021, “DarkSide,” a foreign hacker group, conducted a ransomware attack against the Colonial Pipeline (“Colonial”). That morning, Colonial discovered a “ransom note demanding cryptocurrency.” The attack forced the shutdown of the Colonial Pipeline, stopping the daily delivery of 2.5 million barrels (MMBbls) of “gasoline, jet fuel and diesel” to the East Coast. The shutdown created fuel shortages, impacted financial markets, and panicked the public. The resulting fuel shortages and economic impacts “triggered a comprehensive federal response” on May 11, 2021. On May 12, CEO Joseph Blount paid a ransom of nearly $5 million in bitcoin to …

Letter Form The Editor, Wayne Rash, Iii

American University National Security Law Brief

In our last issue of The National Security Law Brief, Vol. 13, No. 1, we highlighted the dynamism that makes National Security Law such an exciting field. In this issue, No. 2, we continue with the dynamism theme. National security law is a field in constant change that often leaves us questioning how these changes will shape the law.

Securing Patent Law, Charles Duan

Scholarly Articles in Law Reviews & Journals

A vigorous conversation about intellectual property rights and national security has largely focused on the defense role of those rights, as tools for responding to acts of foreign infringement. But intellectual property, and patents in particular, also play an arguably more important offense role. Foreign competitor nations can obtain and assert U.S. patents against U.S. firms and creators. Use of patents as an offense strategy can be strategically coordinated to stymie domestic innovation and technological progress. This Essay considers current and possible future practices of patent exploitation in this offense setting, with a particular focus on China given the nature …

Newsletter, Fall 2022

Newsletter

No abstract provided.

Defensive Industrial Policy: Cybersecurity Interventions To Reduce Intellectual Property Theft, Dr. Chad Dacus, Dr. Carl (Cj) Horn

Military Cyber Affairs

Through cyber-enabled industrial espionage, China has appropriated what Keith Alexander, the former Director of the National Security Agency, dubbed “the largest transfer of wealth in history.” Although China disavows intellectual property (IP) theft by its citizens and has set self-sustained research and development as an important goal, it is unrealistic to believe IP theft will slow down meaningfully without changing China’s decision calculus. China and the United States have twice agreed, in principle, to respect one another’s IP rights. However, these agreements have lacked any real enforcement mechanism, so the United States must do more to ensure its IP is …

Newsletter, Winter 2022

Newsletter

No abstract provided.

Book Review: This Is How They Tell Me The World Ends: The Cyberweapons Arms Race (2020) By Nicole Perlroth, Amy C. Gaudion

Dickinson Law Review (2017-Present)

No abstract provided.

It's Time To Reform The U.S. Vulnerabilities Equities Process, Amy Gaudion

Faculty Scholarly Works

No abstract provided.

Eu Privacy Law And U.S. Surveillance: Solving The Problem Of Transatlantic Data Transfers, Peter Margulies

Law Faculty Scholarship

No abstract provided.

Recognizing The Role Of Inspectors General In The U.S. Government's Cybersecurity Restructuring Task, Amy Gaudion

Faculty Scholarly Works

Months prior to the 2015 public disclosure of a data breach at the U.S. government’s Office of Personnel and Management (OPM), the Office of the Inspector General for OPM issued a report that identified significant deficiencies and material weaknesses in a number of the agency’s information systems and IT security programs. In response to the 2020 SolarWinds supply chain hack, attributed to Russia, calls are underway for inspectors general to conduct audits and inspections and to review prior inspector general assessments of information systems and vulnerabilities at federal agencies. The use of inspectors general to assess information system vulnerabilities and …

Of Monopolies And Monocultures: The Intersection Of Patents And National Security, Charles Duan

Scholarly Articles in Law Reviews & Journals

It was certainly an odd thing for the Department of Justice attorney arguing for the United States to appear before the Ninth Circuit to tell the appellate judges that a federal agency was wrong. This was what happened in a Federal Trade Commission enforcement action against Qualcomm Inc., a semiconductor technology company. As a substantial holder of patents on mobile communications technologies and also a leading manufacturer of chips used in that same industry, the FTC charged Qualcomm with anticompetitive conduct; the district court agreed and enjoined Qualcomm from certain patent licensing practices. It was that award of injunctive relief …

National Cybersecurity Innovation, Tabrez Y. Ebrahim

Faculty Scholarship

National cybersecurity plays a crucial role in protecting our critical infrastructure, such as telecommunication networks, the electricity grid, and even financial transactions. Most discussions about promoting national cybersecurity focus on governance structures, international relations, and political science. In contrast, this Article proposes a different agenda and one that promotes the use of innovation mechanisms for technological advancement. By promoting inducements for technological developments, such innovation mechanisms encourage the advancement of national cybersecurity solutions. In exploring possible solutions, this Article asks whether the government or markets can provide national cybersecurity innovation. This inquiry is a fragment of a much larger literature …

Hacking For Intelligence Collection In The Fight Against Terrorism: Israeli, Comparative, And International Perspectives, Asaf Lubin

Articles by Maurer Faculty

תקציר בעברית: הניסיון של המחוקק הישראלי להביא להסדרה מפורשת של סמכויות השב״כ במרחב הקיברנטי משקף מגמה רחבה יותר הניכרת בעולם לעיגון בחקיקה ראשית של הוראות בדבר פעולות פצחנות מצד גופי ביון ומודיעין ורשויות אכיפת חוק למטרות איסוף מודיעין לשם סיכול עבירות חמורות, ובייחוד עבירות טרור אם בעבר היו פעולות מסוג אלה כפופות לנהלים פנימיים ומסווגים, הרי שהדרישה לשקיפות בעידן שלאחר גילויי אדוארד סנודן מחד והשימוש הנרחב בתקיפות מחשב לביצוע פעולות חיפוש וחקירה לסיכול טרור מאידך, מציפים כעת את הדרישה להסמכה מפורשת. במאמר זה אבקש למפות הן את השדה הטכנולוגי והן את השדה המשפטי בכל האמור בתקיפות מחשבים למטרות ריגול ומעקב. …

The Survival Of Critical Infrastructure: How Do We Stop Ransomware Attacks On Hospitals?, Helena Roland

Catholic University Journal of Law and Technology

Our nation’s infrastructure is under an emerging new threat: ransomware attacks. These attacks can cause anything from individual laptops, to entire cities to shut down for a period of time until the victim pays a ransom to the attacker. Unfortunately, these attacks are on the rise and the attackers have a new target: hospitals. Ransomware attacks on hospitals can temporarily shut down operating room technology and limit physician access to patient files, ultimately threatening the safety of hospital patients and the surrounding community. This paper examines how the threat of ransomware attacks on hospitals is on the rise and what …

Defining Critical Infrastructure For A Global Application, Colleen M. Newbill

Indiana Journal of Global Legal Studies

A Google search for the phrase "critical infrastructure" turns up 189 million results in little more than a half second: ''global critical infrastructure" has 151 million results; and "definition of critical infrastructure" yields 71.5 million results. The list of what industries and sectors fall under the critical infrastructure designation expands as time progresses and technology develops. As the threat of cyberattacks increases and this frontier of terrorism continues to emerge, attacks on critical infrastructure are high on the list of concerns and the need for protective measures imperative. The focus on protecting critical infrastructure does not stop at the borders …

Cybersecurity And The Rights Of The Internet User In France, Jennifer Cross

Georgia Journal of International & Comparative Law

No abstract provided.

Promoting International Cybersecurity Cooperation: Lessons From The Proliferation Security Initiative, Duncan B. Hollis, Matthew C. Waxman

Faculty Scholarship

Global efforts by states to cooperate through international rules in combating cyber threats have generated mixed results, at best. In this paper, we examine the architecture of the Proliferation Security Initiative (PSI) as a possible model for future cybersecurity cooperation among interested states. We identify several features of PSI’s architecture (rather than its substantive focus on non-proliferation) for further analysis, including PSI’s low entry costs, tiered structure, and flexibility, as well as its leveraging of both territorial jurisdiction and state consent. We conclude that, despite several hurdles visible in the scope of its membership and its legal framework, PSI still …