New objectives for CFIUS: foreign ownership, critical infrastructure, and communications interception.

• Author: Lewis, James A.
• Position: Committee on Foreign Investment in the United States

1. NEW CHALLENGES II. THE CFIUS PROCESS III. RISKS OF FOREIGN OWNERSHIP IV. NEW GOALS FOR REGULATION Global economic integration creates new kinds of risks for national security. Foreign ownership of U.S. telecommunications service providers is one such risk. While foreign acquisitions of U.S. companies are almost always harmless, there has always been concern among federal officials that foreign ownership could multiply opportunities for espionage, make defenders' tasks more complex, and reduce law enforcement communications interception capabilities. A new concern is that foreign acquisitions are a new avenue for a potential opponent to disrupt critical infrastructure and the services. The issue for national security is how to preserve communications interception capabilities and defend against potential service disruptions or intelligence activities in a period where integrated, global telecommunications enterprises and foreign ownership of, or participation in, national networks is increasingly routine.

1. NEW CHALLENGES

   Communications interception is an integral part of law enforcement and intelligence activities. Nations have engaged in the interception of electronic communications for more than a century. Most countries have agencies, policies, and legal structures that control and take advantage of interception techniques. These control mechanisms also secure the country's own communications networks and information from the interception efforts of others. (1)

   Communications interception techniques can be divided into two broad categories: bulk interception and targeted interception. Bulk interception is the collection of all signals or emanations regardless of who sends them. The mass of signals are then processed and filtered to discover meaningful information. This technique is primarily used by intelligence agencies and is derived from military signals intelligence efforts that began shortly before World War I when militaries began to monitor the radio spectrum for transmissions of interest. (2) The zenith for bulk collection efforts was in the 1980s and since then the effectiveness of these techniques has been degraded by advances in information technology. (3)

   The second category, targeted interception, involves collecting against an individual user or device. This includes the techniques that fall under the rubric of wiretapping, but also new techniques developed for targeted collection on the Internet (these techniques often resemble spyware). Targeted collection frequently requires intrusive measures (as opposed to the more passive bulk collection techniques) which involve direct physical access to the communications medium or to the physical space of the target to collect data. It is difficult and costly to do this covertly. Targeted collections, and their requirement for access, are more intrusive and can pose a greater risk to civil liberties.

   The Committee on Foreign Investment in the United States ("CFIUS") is part of a broader effort in the United States to maintain interception capabilities. The United States seeks to preserve its interception capabilities while limiting foreign interception opportunities. Since the end of the Cold War, implementation of this policy has required repeated responses to changes in technology that would have otherwise degraded U.S. capabilities. The technological improvements that made communications technologies better and cheaper can also make interception more difficult. These improvements included the use of fiber optics, packet switching, strong commercial encryption, and the spread of Voice over Internet Protocol ("VoIP"). (4) Many of the regulatory battles between the federal government and the telecommunications and information technology industry in the 1990s, such as the Communications Assistance to Law Enforcement Act ("CALEA"), encryption, Carnivore, Patriot Act modifications to the Foreign Intelligence Surveillance Act ("FISA")--involved federal efforts to constrain or respond to technological change.

   Technological challenges to interception are now complemented by challenges that arise from changes in the international economic environment: the globalization of supply chains and ownership, especially foreign ownership of U.S. telecommunications networks. This new challenge will shape future policy and regulatory interventions of communications interception.

   This development has grown out of a broader set of economic and political changes. These changes have made the task of interception more difficult. Regulations that emphasize private ownership and competition in telecommunications have reduced the number of national monopoly service providers that, since they were very often owned completely or in part by the government or were themselves a government agency, had a tradition of close cooperation with national authorities. Regulatory changes and improved technologies have lowered the cost of communications and helped contribute to growth in the volume of traffic, which also complicates intelligence activities. (5) The profusion of services, technologies, and service providers also complicates interception efforts. The economic benefit of these changes clearly outweighs the cost to law enforcement and intelligence, but few governments appear to be willing to accept the accompanying erosion of capabilities.

   A more gradual set of challenges to interception emerged from the regulatory and policy changes that encouraged global economic integration and the internationalization of ownership. American foreign policy for more than a century has encouraged an open, international economy and the removal of restrictions to trade and foreign investment. Technological change reinforces globalization. Expanded trade, new technologies, and the resultant international economic integration changed how companies must do business if they want to remain financially and technologically viable. These changes, however, have created a new series of concerns in the national security community.

   The crux of these concerns is that the United States faces new kinds of threats to its defense that fall outside of traditional military and intelligence activities. This belief grows out of changes in the international security and economic environment that followed the end of the Cold War. A series of commissions grappled with the problem of how to adjust U.S. security policies in the new environment in the 1990s. These commissions concluded that national security would face new kinds of threats from opponents, who would use unconventional and asymmetrical modes of attack with unconventional weapons, and exploit vulnerabilities within the American infrastructure. (6) Weapons of mass destruction formed the principle source of asymmetrical threats to the homeland, but information and communications systems were also seen as especially vulnerable. (7) This highlights the emphasis in homeland security on new threats to security and a new sense of vulnerability that pervades policymaking. (8)

   There is no coherent strategy in the United States for dealing with these issues, in part because they are new and in part because they cut across the responsibilities of existing agencies. Much of the activity in national security during the last ten years, beginning with Presidential Decision Directive 63 on Critical Infrastructure Protection, (9) the creation of the Department of Homeland Security, and the publication of both the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets (10) and the National Strategy to Secure Cyberspace, (11) focused on developing a policy framework for a new security environment where a territorial concept of security is no longer adequate to describe the nature or source of potential threats. (12)

   In the earlier territorial concept of security, borders were clearly demarcated, industries were national, and key services were state-owned or provided by national firms. This made the management of security tasks (such as communications interception) easier for national authorities. However, the economic underpinnings of this territorial approach have been eroded. Agreements on international trade and finance, buttressed by technological developments, made it easier for nationals of one country to own and invest in companies and provide services in another country. (13) International agreements to remove regulatory obstacles for foreign ownership, combined with national economic policies that privatize and deregulate key services are increasing the integration of national economies.

   Opening the door for American companies to sell or own property outside the United States has been a hallmark of American foreign policy. The United States routinely seeks bilateral and multilateral investment trade agreements to promote free trade. The recent focus of trade liberalization was to remove barriers to direct foreign investment and ownership by foreign nationals of key services, such as telecommunications. (14) The 1998 World Trade Organization Basic Agreement on Telecommunications Services expanded the ability of foreign owners (with certain caveats detailed in the agreement) (15) to enter telecommunications markets and furthered the trends in technology, causing partnering agreements and ownership in telecommunications to be increasingly linked across borders. (16) Negotiations in the World Trade Organization ("WTO") furthered liberalizations in the trade of telecommunications services. (17)

   The results of consolidation in the telecommunications industry, and the effect of WTO agreements that break down the barriers to firms in one country providing services in another, have increased the blending of ownership. However, while American firms were investing overseas, foreign firms were investing in the United States. Foreign investment is vital to the national economy and the United States could not deny to others the...