On April 1, 2015, President Obama issued a groundbreaking Executive Order (E.O.) enabling the United States to sanction persons that have (1) participated in malicious cyber-enabled activities constituting a “significant threat to the national security, foreign policy, or economic health or financial stability of the United States,” or (2) misappropriated trade secrets for commercial or financial gain outside the United States. No sanctions have yet been imposed and it is unclear how the U.S. government will deploy this new regime. Nonetheless, applying economic sanctions to the U.S. cybersecurity response is a potentially powerful tool that can fill gaps in law enforcement and deterrence. It also is a tool that could be leveraged by companies that have fallen victim to damaging cyber-attacks or competitors using stolen trade secrets. Further, companies outside the United States will need to consider compliance measures to manage exposure to sanctions under these new rules.

Overview of the Executive Order -

Executive Order 13694 targets significant, malicious “cyber-enabled” activities that have the purpose or effect of causing specific harms to security, infrastructure and business interests. It intends to enable the U.S. government to address malicious cyber actors outside of the United States who have traditionally hidden beyond the reach of other enforcement tools.