Transcripts For CSPAN2 The Darkening Web 20170826

To say the least. We have terrific people here today for all these questions. Alexander klimburg as i mentioned has really written a book on this called the darkening web turkeys a senior fellow with the Council Cyber statecraft initiative. Is a Program Director at the hague center for strategic studies, an associate fellow at the Austrian Institute european policy. The welcome, alex. Delighted to have you. Ceo of north america, former deputy secretary of the department of Homeland Security and one of the most knowledgeable in the whole arena. And was write at the heart of many of the debates use government has. Again, welcome, Jane Holl Lute. Laura galante come most recent addition to the cyber is good initiative. Previously director of Global Intelligence at fire i which is one of the premier cybersecurity firms i would say in the whole world. Welcome very much. And then tal kopan, joining us today. He will do the moderation. Shes a political reporter for cnn focus on cybersecurity as well as other National Security topics. I think with a great group. We have fundamental questions that span a white set of issues. With that let me turn it over to alex. Hes going to give you a summary of some of these issues, some discussion from his book and just lay out some things that men the panel can get into with respective moderation. So alex, i invite you up. Thank you, frank. Its a great pleasure to be here you come very proud of my affiliation with Atlantic Council. My affiliation is hard but i think i spent more time Atlantic Council that i do there. I truly value display centigrade for its commitment to transatlantic values of think its very clear right now those values mean a lot with the military alliances were even governments. They also included very impressive commitment to gender balanced to grab a fantastic panel and to stop it easy to get such impressive assortment of folks in cyber. I think well be talking quite a bit about values and i will have a chance to get into the weeds during our actual discussion later on. I want to give you a rough outline of what i think some of the main and pertinent points in my book apart. Namely, the u. S. In particular but the west in general they often concentrate on seeing cybersecurity as a technical issue and a worse cyber airfare side will for issue like countries like russia and china concentrate on cybersecurity as a psychological issue and a worst Information Warfare problem. The consequence of this is where in the middle, on the journey we might see the global internet, may be one the most transformative inventions since the invention of the wheel from my point of view. What most people would consider to be a universal good advance our personal freedoms that we might see this universal good transform into something quite a lot darker come something that is used to suppress individual freedoms but also potentially to become one of a medium of control. This is a nightmare for some individuals but for others it is a dream. They are pursuing with vigor. The dreams and nightmares are useful analogy for security threats. I once conducted an experiment at harvard with some of our students to try to figure out what is more common, nightmares or common dreams. We came to the conclusion people tend to have different dreams of what something should be but they have, nightmares they are afraid of. This is one of the reasons why strategic arm talks on Nuclear Weapons had a good point of departure. There was one single nightmare we were all afraid of that one Mushroom Cloud that really bounced east and west together and basically make sure we had a proper honest discussion on the existential threats that we wanted to avoid it. We dont have that in cyberspace. We dont have a single nightmare that both sides equally. So the west, the most common fear is cyber war narrative, of effectively cyber warfare occurring due to inadvertent escalation. Thats accidental war or once conflict starts they could spiral out of control due to the unknowns we cant assess. Aside society that as i thrown back to the 1950 the 1950s or tt iron agedependent on a gloomy you actually are. But for others this isnt the worst possible outcome. This isnt what they fear the worst. The most. The most realistic physical threat is that their own existence. They see the internet is primary to being a means to encourage dissent, to undermine the rule, to allow for nations including the u. S. To interfere in domestic affairs. For them the most realistic threat is not cyber get on friday type of connecticut attack but effectively that there will be undermine through some type of uprising plants and connected to the internet and that will quite physically be a threat to them personally. They are much more concerned with matters that relate to governments and Law Enforcement than they are with, for instance, fixing application of International Law, the cyberspace. I call them cybersecurity faction, i have a simple goal. They want to fund and will change the way the internet is currently run which is by loosely linked actors in the Civil Society, the private sector and governments. Thats the order of priority because Civil Society has coded most of the internet. The private sector builds and maintains it and government can blow things up and they can spy on thanks. The groups want to move the control of as it is amongst as many Different Actors towards a model that is dominated by government. They want to move it away from the californian registered nonprofit but is there internationally minded which runs conference its a big part of the Domain Name Service which is something called the telephone book of internet. The reason why they want to do this because only ace information as a weapon. In one of the building through control of different parts of the unit to enact the Law Enforcement regime that would effectively enable think seven such as blocking translated copies of the New York Times or taking down websites or similar things of that nature. They see the internet primarily as a threat and a see the control of the internet as the only way to ensure their own regimes of billy. So the key to accomplish this is to articulate a rethink aware of governments see the role in cybersecurity, particularly in the west. So the russians have been encouraging this type of rethink since the late 1990s. Theyve been introducing a bill on the code of conduct in the u. N. General assembly and many other different ways they are pursuing this. They are hindered in this attempt primarily by the way the internet really works which means it is difficult to simply say we have no form a u. N. Agency the takings over. They are also helped by the fact every single time theres a cyber attack on every single time theres a report of supposed u. S. Malfeasance in cyberspace, the agenda is advanced again. The agenda is advanced in the direction didnt like to have it which is on one of the inner governmental solution and not a multistakeholder solution. Comparing cyber as a strategic disable or to a nuclear time. The state discussions between east and west on this issue roughly around the 1960s. Were still figuring things out but he cautions putting too much stock in the spirit of because the actors involved are just too dissimilar. In the case of Nuclear Weapons it was pretty clear who we need to have in the room. Today while governments in the room but who decides if its facebook, google, who also supposed been the room . Governments dont play that big role in cyberspace. And, therefore, decide you will should be in the room and the intergovernmental discussions part of the problem. The biggest problem is the discussion itself. By having governments as an arbitrator and security concerns, the authoritarian states are furthering the objective effectively pushing governments into controlling rule of the internet. Its a sticky problem. The more i try to push the issue away, the government stands up and says the more we defend the multistakeholder form of running the internet, the more the same time governments are taking up too much of a plate n the space, the more their diminishing the rule of the other actors, the furthering of those agendas want to see cyberspace control the governmental organizations. In fact, getting us to do something was, getting governments to do something in cyberspace is very often quite clear if the objective of many of these Cyber Attacks. Just to give you two examples that are pertinent. In 2015 a French Tv Network went off air catastrophically for two days, and the perpetrators are supposed to be isis who claim we are cyber jihadist and will strike you now everywhere. Two weeks later the french government leaked that they establish it was, in fact, Russian Military intelligence who had been behind the intrusion and destruction of effectively Critical Infrastructure. The question was why would they do such a thing . And from my point of view the question was quite obvious, they wanted to have cyber terrorism as an there to pick cyber terrorism hasnt ever could. We have terrorist use of internet. That is a big issue and its a complete issue but we dont have cyber terrorism yet. This would put cyber terrorism on the agenda and it did. For six months i spent a large portion of my time in europe running after new discussions at the french government had put up regarding cyber terrorism. Until 1. The discussion would away from cyber terrorism because in the west one of our agreements is we dont support the narrative of cyber terrorism because ultimately it means control of content. Thats what it means. Terrorist use of internet mean Something Else. Another example, you dont have to go back to 2015. Look at wannacry. Another example of what might be more interesting to basically blow something up and cause a fuss and a political narrative rather than steal data. This is why i keep coming back to how important it is to understand why a cyber attack might be, they might not be simply interested in trying to steal your data or preposition for war, they might be more interested in pushing a narrative. I narrative, the wannacry successor that we saw in the last couple of weeks has to have include established to be not rancid mcnab no interest in decrypting the system. You can even reach on like the its simply to destroy things. Given the fact their target even though it was ukrainian or not military essential in any way, what was the purpose . Those attacks like other tax i think at the pattern to them. Those patterns are simply pushing governments to do something in cyber by effectively grabbing the narrative of the narrative is also construed very much about security issues. Issue. Just to give another example, theresa may in the uk after the uk terror attacks announced she wants the uk to take the leading role in the regulation of control of data, and even didnt dismiss comparisons to the chinese way of running the internet. We are in a state, a country that formally referred to as mother of democracies was actually considering level of intrusion that previously only the chinese governments would have considered. Luckily, its not been included in the quaint speech maybe it will not be implemented. In any case that was narrative. Our moderator tal kopan wrote some years ago that are many analogies for cyber and those analogies tell a lot about you when you use them. If you talk about cyber war than you think government might be the answer. If you talk about Public Health issues, then you might think that some type of model might be the entity you talk about climate change, maybe you think another option is answered. I think all of these models are useful but i think theres one macro problem we should keep in mind above all else. What is the worst possible outcome were trying to avoid for ourselves when we engage in government regulation of behavior on internet . Anything we do including, and regulation, treaties, developing Cyber Capabilities, what is the worst possible outcome were trying to avoid . And that is something i think we havent talked enough about. For me it is quite simply we need to avoid falling into the trap, explicit trap of Information Warfare. That effectively notes weaponization of information. The weaponization of information means cnn, the washington post, the Atlantic Council all become pawns in a larger game that effectively sanction only by government. This is a very, very scary vision and is not likely to happen in the next five years or seven is, maybe ten years that its a possible nightmare. Its a much more likely nightmare and the nightmare of cyber armageddon that kept us on her toes or 50, 60, 70 years. The only way we can avoid this is really having a full commitment multistate kodama about the internet is run. A proper segmentation of how we discussions on cybersecurity issues which need to be highly siloed and separate so they dont contaminate each other as fundamentally endanger the Free Internet as it is today. Without the Free Internet there theres no free speech and without free speech we dont have any free society. That id like to move to our panel. Thank you. [applause] so thank you, alex, who now youre all familiar with. My name is tal kopan as introduced, im a reporter over at cnn. Our other panelists who didnt get a chance but a faced with the name but we have Laura Galante and then Jane Holl Lute who you heard about earlier. We will just dive right in. Fascinating stuff, lots to cover. I think what might be most useful to start with a particular case that perhaps were all to play with at this point, but the russian meddling in the 2016 election. Its interesting because its become discussed as some sort of cyber event partially because it involved hacking a personal emails with a sophisticated spear phishing cammy and then dumping those on internet, at a construction of a hacker figure that was used to disseminate these, and then there were separate scanning evidence of voter rolls, one actual breach that has been confirmed and possibly one other, although there were no Data Exfiltration or changing perhaps. So my question for the panel to get us started is, is it actually useful to think about what happened with the 2016 election as some sort of cyber event . Or do we risk limiting public understanding, conversation of what to do about it by viewing it only through that lens . Maybe ill jump right in. I dont think anyone use it only as a cyber event. I think people view it and i think there is a broad sense that yes in fact, this did happen and there is broad outrage but whether or not your outrage miss you to action is a completely separate story. What do you do about what you know . What do we do as a country with what we know . This brings us to the heart of alex is book and i think frank also framed the question really very well. The internet was envisioned by its founders and we all know them. They never imagined the evil to which the instrument might be put. But it has been put. The internet represents such a universal good for so many pickets empowering, uplifting, informing, connecting, the miniaturizing. Its really a universal good. The next question, who will keep it good . So maybe the russian hacking of the u. S. Electoral system and the intrusions into our electoral system, none of us thought it would happen. I think we all, it was in the realm of the unimaginable but i think it does for many focus the mind now who will keep the internet good. Laura, thoughts . I would add a bit to her points. I think the 2016 example and the russian interference and the 2016 election shows us is the clash that alex details so well and artful in your book, which is we had this Information Security layout of our countrys will use russia and china but particularly russia sort of the thought leader in this sea information as the main currency of what cyberspace is about. We had this other side, the Free Internet faction here to lead by the u. S. Where were thinking about cyber and more of a technical realm. What 2016 signified in a huge way is two ships passing in the night on how to think about the problem. So russian spent a good 16 years at the point is that more articulating how Information Security works in the russian mindset come protecting this information here, think about information as a weapon and also something that needs be used to protect people domestically. They have been advocating the sovereignty approach saying cyberspace as a place that can be sovereign. When youre willing to say that and youre putting that out in the u. N. Year after year and the u. S. Is doing its best to ignore that or at least disagree with sovereignty as a principal in cyberspace because it goes against so much of the principles that jane was her particularly on how the use cc internet. When you have is to give abuse of sovereignty and then the dnc is network gets hacked by the russians and a move that would bridge the sovereignty of euros in a way that russia sees sovereignty in cyberspace then you really upping the challenge for how the u. S. Government can start to address this. Its putting us by that the center of this debate of what we want our National Cyberspace policies to look like but more largely how should states exhibit power in this debate and how do you find the domain . Another much a book and started to unpack some of those questions and to think were finally, starting to do with us to get a mindset since you a real example over the last year. Alex, i thought it was very apropos your book starts with term, terminology become such an essential component of this. And to give you a chance response, as laura brought up in terms of when you think about how do you respond come you talk of Information Warfare and what we are witnessing how sometimes the response template directly into the hands of the person or cursing the defense, how do you start to think about if youre on the receiving end of one of these campaigns . So i think there is the general constant we need to come back to is that operation is not going tactically or operationally significant, it might not only be about achieving the tools and system for stealing data or prepositioning for war but it might also have a very clear little objective. This is something that is more in line with how the kgb and soviet union consented its military strategic thought experiment rather than at the westwood constructor jia thought experiment pixel it is ive been in west highly constrained issue, that is that is caught in a couple of boxes on the military level, fairly low down is not seen as a strategic paradigm. Russia and china has been seen as most strategic paradigm so its just a way a lot of these guys have been raised. They see it naturally. The warfare point, think its a board we come back to what can be done about it and how should review it, the european interested. The europeans, the estonians, the scandinavians and the german will say to the americans look, weve been putting up with this for the last five or seven years. This is nothing new. The level of it has ramped up massively but if you look at a country like sweden, sweden has been undergoing cyber Information Warfare campaign that puts the u. S. To shame. It has everything in it, threats to individuals, blackmail, smearing people, overt military threat. Everything was there. What happened . Effectively, if i get the numbers right, the Approval Rating for joining nato, sweden being neutral, went from 16 to 49 and now theyre reintroducing the draft. So we fail. Whatever the objective was it probably failed. Why was a successful in the u. S. . When it failed in france, germany, estonia, denmark and sweden. Actually a lot of of the countries one could add to the slaves and this is one thing i only dressed the tail end of my book simply because it happened right after i finished writing it, but is quite easily, if you look at two numbers that it puts in the back you can see with the level of trust in u. S. Institutions were. When only 20 of u. S. Public thought tha the mainstream medis doing a good job and only 6 think the company is doing a good job, then it cannot be a real spies use is a very soft target. The question should be why was a such a low level of trust in these critical institutions . You cant find anything like that in the western european nations, not even Eastern European nations. This was for me the clear point we have not sufficiently addressed, how can we even have an Approval Rating of 6 . China used to say for instance, Economic Growth dropped below 8. 5 then would be mass unrest. Now theyve lowered it to 8 , 7 because the world has it in for them. But fundamentally bit of thing they could get by with 20 or 30 or 40 Approval Rating. 6 . No democracy can survive that. How did we get to that 6 Approval Rating . I think i want to push back on this. I take a backseat to nobody i make you that the United States is exceptional. In this respect we are not particularly exceptional that the public is angry. Frankly, the public of you are around the world is angry whether it real, istanbul or in the streets of london, paris or in the United States. The occupy movement for many was sort of a manifestation of this, sort of undirected, unguided, im mad as hell and im not going to take it anymore. I think its fair to say the Publics Trust in institutions globally has collapsed. We dont trust businesses can we dont trust businesses. We dont trust the markets. Various institutions react with a range of emotions themselves. The media is indignant that we dont trust them. Why dont you trust us . Why should we care what you think . We really have come institutions had to go back to fundamental principles. Heres why you should care what an independent observer seeking out the facts is presenting to you. But im not arguing our media is perfect but what i am arguing is in the wake of snowden, i traveled a lot back and forth to your and one conversation in berlin was particularly affecting to me. My german counterparts had a very interesting colloquy among themselves. At first they were sort of like, we are so embarrassed. Right under our very noses, how could this have happened . Others were criticizing their leadership that they were shocked that there was espionage going on even among friends. But then they turned to me and said, why arent more americans outraged about Edward Stoughton . Plenty of americans outraged but what we know fundamentally in our system, when we moved to the extreme, our system will correct itself. Ive place a lot of faith in the pretty prudent public we have in the United States that we will correct or so. They said thats what youd understand about our political system. When they moved to the edge there is no safeguard. They fought over. I was stunned to hear that. I think we need to look at even this instance of russian hacking interviews election. There will be more of it. There will be others and it will happen another place. We need to understand this fundamental question of trust. How do we architect trust in public spaces . The fact publics everywhere are angry. Its not purpose driven anger. People kill each other with purpose driven anger. This is anxietybased anger. We are not sure we know how to architect trust. We are not sure we know how to architect trust in institutions, in public space. Thats at the heart of this question. Alex, how do we get to 6 may be the question is how do we get back to the 15, and congress has done that. You know, actually in the past Years Congress Approval Rating has started to pick back up over what john mccain loves to say paid staffers and meaty has ticked down to that level. One of the things you said in the introduction i thought was faceting is this notion that the objective of many of these Information Warfare campaigns is to consolidate power in government. You mention other governments have expressed this. In france on the eve of the election that a similar episode, some camping emails were hacked and a hacker figure emerge on the internet purporting to all this inside details. France actually in the government had the ability to say the 24 hours before the election meeting you can come with us. Many u. S. Institutions also operate in france follow these rules because if you operate their you follow the governmental rules. You see what we do, is her something more for the government to do to protect ourselves, where as using the arguing that the exact opposite must be true, so how do you unpack that inherent tension of wanting us to be able to have a National Response but almost during complete into the very hands of the objective . Perhaps laura, you know, you come from the private sector perspective where fire iv often have as good intelligence as the stuff that has the highest level of classification because we see it on the open market but how do you start to think about what the role of government, whats the role of society in this response . Its a huge question at think if theres an easy answer to it couldve written a book but at the heart is who do trust in a space that is abstract . One of the lines i really like was cyberspace is an abstraction just like finances. You have to have an interlocutor, whether its the president , the government, media, what have you to understand what is going on on some larger macro level in cyberspace. Im not convinced theres an easy answer to say the government holds the cards are all that as the private sector or what have you. The kind of obvious statement is wide the multistakeholder model as per through for as long as it has persevered given the ups and downs in changes in our attribution over the last 15 years, over all these different elements that a change in the time weve all been watching this space. So thinking from a more proactive sense what you think is what youre going to get to, what steps we need to take by what questions do we need to ask of the institutions that currently exist to govern the internet or more broadly translate whats happening to the internet, is who holds what roles and where do they carry forth that role . In the private sector frequently they are looking at whether they are investigating a fortune 500 network where the fbi will not be the first call, or maybe they were the first call also but maybe the private sector is been on it for the last year as a defense client or what have you. But where theres insight coming from industry, what is the right level of oversight or lack of oversight for how those findings should be shared and how far the findings go. When youre sitting there as the person in a government seat or private seat with first eyes or second eyes on network incident, on malware that step in use before, and Something Like that, what is your duty to talk about that to the rest of the world, knowing how huge the implications are around this . They came out and said we know these russian government hackers and it was Intelligence Committee that followed suit months later. And even in releasing at the time originally back in 2014, the report of this group, and our telly we lost a lot of sleep if this people initial lost a lot of sleep deciding whether we should reveal that we had a judgment that this was russian government a group and the tools behind and other acting, what have you and i contributed to that conclusion early in 2016 around the dnc hack. These are really weighty questions a lot of different people are dealing with and what are mechanisms that make some of the more predictable with or without government oversight . Its a huge question. The trust issue, we keep on coming back to which i think is faceting topic and it will bring you back to what jane said before hand, if we seek trust from a macro, a microlevel, a technical level and we take it up to the love of National Response, the are interesting things to be learned. Information security, what fireeye and all the other secret coverage to which is called Information Security works on the trust level. People change information with each other according to the own protocols pick sometimes that information should not be shared because of legal reasons are contractual obligations. Trust is most important thing among defenders of internet and guess what, its what often builds the unit. The internet cannot work without it. If there wasnt trust between the operator and other pieces, the whole thing would collapse. It is built on trust. Theres trust but verify the elements. Giveaways are doing that by having additional people involved but its based upon trust. Its not image of approaching the problem or if a very way of approaching the problem. Aas a slightly higher level talking about National Responses and trust on a National Level, one of the things i argue before this book is done with governments into something called whole of nation response, which is not like whole of government because it includes nonstate actors, is western democracy encourages the cooperation of the nonstate actors. I asked the french government what is a policy in this and they go what . We have a law. You can do it that way but its probably not going to cover all the bases you want to cover. Interesting note by the way the tv channel that was not air was designated as Critical Infrastructure, therefore it wasnt an act of war for so to knock a day. You missed that tv station so we will knock that one down. Now what are you going to do . Its walking up to the red light and putting a finger over and seeing what happens. Engendering trust i think from a Government Point of view is critical if you want to have a nonstate actors involved. That means private sector and Civil Society. We saw in the Obama Administration the last two years there was a big push to go out and encourage effectively both Silicon Valley well also other actors to be much more supported of the u. S. Government efforts in the space. That wasnt by accident. They government also went out of its way to encourage trust with its international partners. President obama gave his famous nsa speech where he announced limitations on the use of never been done before. It was very much first in World History and the reason was because they were fully aware of the fact trust was such an important factor. Where i think thinks maybe didnt yet develop was how we communicate Cyber Capabilities per se when we talk about trust. So for instance, if theres no public definition of what the Cyber Capabilities are. You can look and find documents but you wont find declassified definitions the different types of Cyber Operations and exactly what they can do. Its like saying heres a weapons system. We cant tell you if its a plane, a tank, a submarine, biological weapon but its there. We might use only might not use. It would be very helpful to have an open transparent discussion on what Cyber Capabilities are able to do, what is supposed to do and i would encourage public discussion maybe amongst states. That would be helpful to understand what our government capabilities in cyberspace and will also can also forget what basically are, neither is. We do have a common nightmare of lights going off. Even for authoritative machine still be interested in their physical security, we can make it clear this is what we can do to you and we appreciate into the stores. Lets figure out for a way that cannot happily spy accident and then we can make a huge step forward. To bring this to another case study because we could probably talk about this for even more than we are allotted today, and to send it back to jane, to talk about some of the Ransomware Attacks. One thing thats interesting but response was the department of homeland secret has been saying this is an example of how a model has worked. The attacks have not hit the is as hard they say because we have such a robust encouragement of our private sector to do the basics come to push up software. There are not as many bootleg versions of things in the u. S. And that type of thing. When we talk about those Ransomware Attacks, have any best practices emerged . We talk about Ransomware Attacks that were not actually ransomware, how does that affect the model for one of your favorite topics, cyber hygiene . I think thats right. A couple of things that i think are maybe historically interesting and audits about as our governments have struggled, every single one, everything government have struggled with its role in cyberspace. The key question, how to architect systems we can trust and compose we cant . How to ensure the integrity of information and identity and open internet . What should the role of governments be . And a recent government that is been tackling this problem has had a fight internally between the military intelligence and that community and the rest of that government. You can sort of see who is what. I had set for a long time we can it run cybersecurity as if its an Intelligence Program for this country. We will not be safe. I think governments, the key role of government is to tell us how should we distribute responsibility for cybersecurity in this country . What should my will be as a user come as an investor as a software developer, as a manufacture of hardware . On a big believer as you know in basic cyber hygiene. Why isnt government telling scorps why isnt government telling every enterprise that are for if i think you should be doing that will reduce your vulnerability by was over 80 . Pick a number. Hardware inventory, you know what is connected to network . Software come to know which running or trying to run . Permissions control, dino is one which one you run your network who yet given permission to . Some people have access information, they have no business having access to and then an Automated System in place to all alert you to the proper patches that you need to take expeditiously and are you patching . People used as the winners and Homeland Security what keeps you up at night. Whats the greatest threat that you see . Unpatched on the booze, absolutely. To me with a question. When we get them come have come governments been discharging their role . Alex is arguing strongly that they are overplayed their hand, that theres a movement the for government who control the internet. Just a question that i host of governments that believe governments ought to be at the heart of who sets the rules, what the rules should be, less access to them, access to get it under what conditions. There are others like the United States and never countries from western europe who believe that in this multistakeholder model. Why is this so important . In my lifetime the have been for strategic questions that the world has had to confront. When we confront been successfully we confront them multilaterally. The new multilateralism is multistakeholderism. Governments at the National Level may not have this right but asking the mayor you happen to see, it is the only game in town if you want to get things done. They work in multistakeholder with the private sector, forprofit, notforprofit, churches. They are the equal opportunity convener for solving community problems. But those for strategic questions have been in the wake of world war ii how do we save the world on this happening again . What do we have . We had the u. N. , nato, a number of multilateral institutions established that flourished. You could argue over that but there established and then got a very long way to answering that question. During the cold war and the potential for nuclear annihilation, again they return to multilateralism. In the postworld war i struggling with these issues, and today we have never said that answer. So alex maybe really onto something. The new multinationalism is multilateral multics they called herism. Do you feel like there is a win anywhere in these global Ransomware Attacks, any lesson that can prepare i remember a couple of years ago i was watching a panel, going on about about i could envision a world where we just consider it the cosseting business if we had to pay 20 and been going to to open our refrigerator. Or to get into our car. Ransomware would be so ubiquitous. I dont think he envisioned it as a weapon and what happens when shuts down hospitals you mention. What are some of the lessons . To the use do something right . Did we just get lucky . Just to come back to the multistakeholder. And also how regulation fits into it, because thats the question. Its important to note countries that support governments support governments, support the multistakeholder model include ones that are different views of how the internet generally speaking looks like. They include france, topdown internet which failed and sweden which is probably even more liberal than u. S. In terms of how they envision the intellectual property and the internet itself to be construed. Theres a lot of different views among those whose work multistakeholder model of them different views on a local regulations should work. Thats fine. The point about the stakeholder model is not it handles off anything to use president obamas expression cyberspace is the wild wild west. It doesnt have to be that way. There can be a share, there can be rules. The point is they are agreed within a framework that effectively account for the stakeholders. Its very tiring when you work in interNational Security and a part of International Negotiations for nearly eight years and just explain to diplomats and the generals that its nice to develop this Crisis Management function of the hotline telephone or Something Else but really these actors like Information Security responders, the security researchers, the white hat actors have that and theyre the ones who solve those problems. Not 90 of the time but 6 60 or 50 of the time and thats the cyber hygiene issue. If we have requirements that each nation thinks its important to fulfill then we would effectively drain the swamp little bit. We will effectively lower the level of which sears cyber adversaries can afflict sirs damage. Theres two truisms effectively in cyberspace. One of them is effectively 90 of all Cyber Attacks can be taken care of with good, resilient measures, good cyber protections. Thats definitely true because even state adversities will always use the cheapest tool at their disposal. Why should they use the magic tool . On the other hand, a committed attack will always get in and thats not probably going to change because math is a measure the easy cyber attack is a call you up and ask you to give me your information. Thats effectively what engine is about. Cyber is indeed true. There will be different ways and we wont be able to fix all of them. If we drain the swamp on all this to shocking, all this noise that is happening, then we can deal with more significant issues and that can be done with local regulation or its not a contradiction. Theres an internet, a general body worldwide that says all condit has to obey this particular criteria and one government has a problem with this content, you are obliged to take it down, no questions asked. Thats the type of model in which has likely been resistance apart but its important amongst Different Actors, the private sector also engenders trust with the government that they are able to manage themselves a little bit. The european union, they thought effectively google had not done that on some issue that facebook wasnt doing that and they find been a lot of money. So there is no however on both sides of these countries who believe in the multicycle to model there is awareness of the practice, of the multistakeholder model, this big mass of bodies, also very small bodies have to be engaged with and have to be given their due. Its a question of how we engender trust in that bolcom not necessary always what the model does because i will be up to them. Back to wannacry to make a topical, i think there are a couple of glimmers of light but Information Security community i know was a research and i forgot where he was, maybe california was the first to figure out, by accident, redirected the service, in the uk, redirected the internet and basically stopped wannacry in its tracks over lunch. He was very humble about taking credit for this what have you but its a good example what the community has been the first to the scene of some of these major situations that it happened. The other glimmer of hope to find in wannacry to me is i was in kosovo when wannacry was happening, and kne news countryn the world, right . Kosovo, everyone couldnt stop talking about wannacry as if this was the moment when they could use this to wake up decisionmakers about spend in cybersecurity. Even though some of these incidents might be in the Technical Community kind of looked down upon as that was so simple or it wasnt particularly sophisticated, they had an enormous wakeup call not only on cyber hygiene side but for companies and basic practices, the digital equivalent lock on your door that need to be taken by companies and governments writ large. They can have an enormous effect and just mind sharing mine change. I think thats what this has signified. Its funny you talk about the cyber wakeup call. I remember having panels when we talk about the target hack as the cyber wakeup call and its funny how quite that seems these days and yet the principles that were talking about havent really changed. I want to pull a different thread for a moment. One thing that struck me in your opening remarks and has with continued to talk, they seem so old and crochet a scene surrounded is the question of attribution. Laura, you sort of reference to this. How important when you talk about responding to what is Information Warfare, whether its ransomware, how important is it to establish who is behind and what their motivations are . And when were also talking about trust and how Many Americans still have doubts that are sometimes fed by people that of, its in their own interest to peoples doubts that russia was behind some of what we saw in 2016 . This is not only an interesting question but an important one, because the Information Security industry has really revolved around threats and identifying threats of the threats that opposed to you. One place we havent got it right, fact some of the college on Information Security industry will say we have failed. Its that they treat everything a person as what my colleague tony calls a special snowflake. Unique threat information thats about you. Younique threat information abot you. Really . We are all on the same web. We are all encountering 98 of the same dust. Thats what the message of hygiene is so powerful to me. We want to change the game can we need Widespread Adoption of hygiene. Whats the most important invention in his ship and kind . Soap. Soap, right . The mcculloch said wrong, the commercial soap. It was making it available at retail, retailing soap. Your point about we still have this fascination with the upper end, the high yen Cyber Threats the ninjas. Kevin and his group that with the first ones to call out the chinese a number of years ago. I think the trend government of which i was the part we were the last. If hygiene is effective why are we hearing more about it from governments who want to be authoritative on this . Because in part, and is preoccupied with the highend and for a very long time we treat all these problems as a metaphor the Intelligence Community and you are not cleared. This is treated as a nuisance and wanted it to go away. If we only knew what the government knew. If we only knew what nsa knew we can protect ourselves. Give that information to a what we learn from fireeye and others is is that is good to take a village pick is going to take all of us in the game and people identifying threats but, frankly, i dont i say brush her teeth, wash her hands come dont share food. I given the basic hygiene to successfully get through the day which is what most of us need. Laura, you sort of work for the lead in attributions. Countries of your thoughts . Attributions always going to be the natural question, who did it. Its just part of not just human nature but requirement in response to any of these threats. I think yes, weve been talking about threats. On the defensive standpoint we need to be talking about hygiene. Do you have a sprinkle is more important than what type of so yes, that matters in defense but when we talk about international cybersecurity, talking about these bigger questions how do state respond to whatever the incident might be, attributions always going to matter. I think we have come a long way from the days and thats a 20082009 when you still throw your hands up and just say attributions going to be the defining creature that the profit for anything to do about cyberspace. There was deathly a desire and we were motivated by a motivation, motivation was to go and figure how to explain this massive data sets were seeing an intellectual property theft that we are seeing and then put a face and agenda behind it to really explain this . Of the goal wasnt attribution in and of itself. The goal was to get her do something about it or provoke the discussion. Attribution as its own desired state isnt really the question. Its what are we doing attribution over to achieve . Alex will have some thoughts on this and then yall better have your questions ready as im coming to you next. The question of attribution has always been a very interesting one. Either people were furious about come youre not clearly answer on this. One of my favorite was put out by defense into comics copiers, was flagellin you said he believed in the james bond theory of technological that everything is evident in the james bond movie will happen in reality. And since some of theres a magic black box, in the james bond movie that already exist pick my foot was what we saw and education over the years is basically tailoring responses to our level of knowledge. We havent necessarily solve that but weve made great advances. Four years the point u. S. Government and of the government tried to make it was a response to significant cybertek doesnt have to be cyber. Make m we diplomatic, military, economic, Something Else. That often means you can time delayed, make a reversible, a lot of different sport thinks that, since tell you as possible. That also works at other levels here however when i think we sub pop is communicating even on the aside which is magic attribution capabilities shall we say, what the certain attribution really means. When people say we have a pretty good idea of where high confidence of attribution to a certain country or a certain nation, some people including decisionmakers in the u. S. Might think that means high probability means like a radar. I can tell you 99. 9 probability that missile that was just fired from north korea is come to the United States and it came from north korea. I dont think thats ever going to be possible in cyberspace depending on what kind of attribution you do. You might get 70 or 80 but if youre sitting on someones machine and yo use the guy typig something they could still be false flag operation. False live meaning its fake. Somebody else is doing it. They are pretending, they have hacked into the system of and pretending to launch it. Its all theoretically possible. Thats why its important we make the sanctions, the slow, the other waste response that dont involve cyber. Something like that happens, they want to believe that they didnt for a couple years. I saw that after the sony attack, Information Security groups, people who knew better were they knew better. After it is likely we got that wrong but they are questioning the political circumstances. That is the ultimate warfare. And between the citizenry and the government and the private sector, that is the whole point of most stakeholders, the bonds that connect them, weakening of that trust is what we shouldnt allow to happen. Makes me wonder if there is a play left on the table sometimes but i would love to turn it over, those watching online and tweet some questions online. I see familiar faces. The working theory is the attack was based on some code or exploit leaks from the nsa in april, given the nature of information that it can be copied or proliferate rapidly do governments have a responsibility to prevent the proliferation of statelevel tools . Sorry, if folks would introduce themselves. Hunter. Governments have a responsibility to protect unauthorized release of tools. I would second that and the fact that the Us Government was involved did not have control, would be International Law. You are responsible and have to have 2 have a military action, that would be a key point. Is that some things that needs to go in not just in terms of we have it but when you think as a government what can we construct . Is this worth constructing because of the remote possibility . Obviously it did not go the way it was expected. How to think about that at the front end. I wont think about any specific example but a hypothetical level of abstraction. This is not peculiar to cyber terrorism. There are other areas, lawyers go through this. Certain things when we do more damage than good. How do we control, what do we think will happen, how do we control the worst effects . The public has a right to expect the government is going through that kind of calculus. For old time sake. One point on that side. You think even though the equity problem is ongoing, people always trying to balance out competing interests of constructing a cyberweapon or designing something similar. Things partially go wrong, there was overall emphasis on offense rather than defense. There are many reasons for that, so much easier to do and the sense is it is really expensive, not only simply expensive to do on a political level, not just the financial level. Might have to introduce legislation to do this or that, much easier just to draw up offense capabilities in a blackhawk and say we have a deterrence model. The us case there are many legal reasons it is difficult to do, small countries like sweden, the netherlands and switzerland do that. Which is another reason we need to bring hygiene right to the front. It is a relatively straightforward, far less costly to patch on a regular basis and you know what software you allowed to run on your system and have to clean up afterwards. It gets cheaper as things get worse. Might have been difficult 70 years ago when we talked about what was relevant whether it is Insurance Markets or liability. All of these things are not politically possible, now they are increasingly possible with cost decreasing. Part of those costs simply should be by themselves to realize how much trouble they can get into, it would not even require that much in the way of government. Sam metzner was idf at georgetown university. I take your point that some countries are better at cyberdefense but we are larger and dont have the luxury of some of the conditions they do and we have a larger role in global governance. My concern is this. I like the idea of a multistakeholder internet which is really global commerce, a place in which we express this but i think that maybe too selfreferential. We have glued it to our electoral system. Somebody regards Critical Infrastructure at the battlefield, they will regard the internet as part of that battlefield. What we may be seeing is an evolving concept of operations, we may not have the luxury of referring to the internet as multistakeholder global go Global Commons that we so much admire. I would like to see sustained. We are looking at other countries that have a different concept of operations, just as germany had a very unpleasant concept of warfare, it redefines warfare in the Second World War and other countries had to adopt that concept, we may be forced to do so as well or at least take it into account. I would be curious what we might want to think about in a policy perspective when we cant define the internet the way we want to end other countries may define it as essentially a battlefield. Has the governance model already won . The fact that other countries see it differently is well taken and i agree with that and many things, the internet has been attached to things it wasnt intended to be attached to, the german covenant refused to consider cyberspace Critical Infrastructure because you shouldnt put anything critical on it. Tough luck. It has happened. What you might be saying is since that happened and we jumped into this unsecured environment should we make it more secure by redesigning it and i would say we dont have to redesign the entire thing. There are little sixes that can make it more secure and that is in part what is happening all the time. You heard the example of the 29yearold hacker who found the kill switch on the water cry outbreak and turned off. Many other examples. Daniel kaminsky found the biggest hole in domain names. These things happen every couple years and brings us a little further down the road but essentially brings us back to the argument that certain superCritical Infrastructure we should be thinking differently but this is on the defensive side. There is a reason certain Industrial Control Systems shouldnt be the way they are and shouldnt be allowed to be the way they are right now because it is too dangerous. That is one argument. It doesnt make the argument itself. It is the way they are connected. They have default passwords baked into the hardware that cant be changed. How much sense does that make. There are similar examples where people have been lackadaisical with their approach to security online. The wrong approach would say rip this thing up, it was built by kids, lets make a new one. That would be a very bad move but i also tried to explain to government officials when they voiced opposition to the stakeholder model that only government should be responsible for this because it is such an essential issue for everyone. Government have to be in charge. I go lets play this back. What happens, save as part of the human is responsible for that part of the internet. What happens to people who call attention to it, the web consortium. They have nonstate volunteers who sit down and write this stuff. Are you going to take orders from the icu or some other un agency . You will build another internet, the fact that it was already done, these guys will build the internet, they will build different parts of it and if we tried to design our own internet around these preferences they are going to build one that we dont like at all because it will be completely illegal and it is important to keep the people who built the internet on board because this is a nonstate domain and they are coming in to a domain that was built with different conservations, that wont solve the problem but only make it a lot worse because it will highlight in the range of security issues, you are protecting, tried to protect the powers but you are endangering free speech. What is basically right about your question is in this world you can be first, fast or powerful. We are not first and not fast but powerful. When you are powerful it doesnt matter when you arrive. Many people believe government have militarized cybersecurity unlike your phrase we. The infrastructure to the internet. There is no one who doesnt rely on cyberspace and it. We glued our economy to roads, rails and bridging and warfare when you are opposing your adversary takes account of that. The interesting question is will we move to more symbolic and less kinetic warfare because we can do such devastation to an adversary in cyberspace . We have seen preliminary examples that suggest the answer to your question is yes. On the side of the room if you can wait for the microphone. Im mike nelson, i work in public policy, and Internet Security firm. I have been working in multistakeholder processes, im excited to hear your full throated support and even more excited about your confidence in innovation but i have seen a lot of multistakeholder processes that go off the rails. At the Internet Engineering Task force, some of the efforts i was involved in for y2k we had deadlines, either selfimposed or y2k external. We also had everybody in the room who could veto any solution. The problem with the things you are talking about, making the internet more secure with controls on Cyber Attacks is we dont have deadlines and we dont have everybody in the room that could veto a solution. I have been to a lot of meetings of the un, the internet governance forum, you dont see the Intelligence Community there. You dont hear the cyberwarriors who are off in their own classified space. Do you see any global setting, intergovernmental or nongovernmental that could bring enough key players together given the sense of urgency so we might actually get a solution, broad agreement on some kind of approach to answering the questions, a solution to which problem . The insecurity of internet overall . We were talking a lot earlier about cyberattacks and when it is appropriate to bring down infrastructure. There was talk about cybernorms and doing something to pull governments back using these tools, encryption is another area where it is nice to have global agreement how encryption will be deployed. Probably five or six big hairy problems and no place we will get an answer. There are many questions. I describe the book as blind people which is a favorite metaphor to use for professionals, you see different parts, a wall or fan or host, you wont have the architecture, and things even on this panel, talk about Critical Infrastructure protection issues, and intergovernance issues. These are in government terms different agencies and a whole set of priorities and Different Things involved. One thing i argue is we need cross ventilation between many different silos. People should not be merged together because there are important jobs including armscontrol people and Law Enforcement people. Everybody has their own jobs to do but are not really aware of what is happening next door and that makes it difficult for response measures or understand the danger of those response measures so the example i gave as part of these norms processes are communication. So i was part of a working group, confidence building measures, it was great, we have online telephone. Lets add that to the hotline telephone the us and russia have. Another is Meridian Group and another one is the eu and another one is great so we have five different hotline telephones. Which one are you going to pick up first . People were just developing additional mitigation measures without knowing what is out there. People start effectively trampling all over each others shoes. The unpleasant fact is it is a complex issue. There are many parts of it like medicine, no one expects medicine or the financial system. We need to understand different components attacked in different ways. The way you were referring to international interstate issues, the weight is described, the outcome is clear that there is a different approach, interNational Security issues and the un first committee, go ahead, talk about International Law, application of applied cyber, constitute accountability, that is an important conversation, governments need to have it. Second, basket, Economic Issues and have that conversation about the internet which is so important, it is great, you can have it right there. Perfect if theres context around the convention but talk about Exchange Mechanisms and not the content. We only agree on how to communicate with each other when we have agreement the conference is illegal. The third basket means governance. About running the infrastructure itself and infrastructure that is not maintained in the private sector. Maintained by the community and the approach to this problem, dark configuration exercising controlling interest over all of these and a controlling interest in interNational Security to be responsible, so absolutely they have problems to be solved fair which is involved in the un discussions. That discussion should happen there and should not involve in my mind internet cost or infrastructure. Those should be held in the Government Department and this model keeps these things different from each other and makes it clear they cant be merged together and cant be compromised. You have seen the stakeholder in action, how things slow down and sometimes take over parts of it. I have seen Engineering Task force by government and companies at meetings where standards are set and they tried to make new standards a particular topic of interest, they go in and this is the stuff that runs into the future and we own it. What happens . They go someplace else. One of the guys from the community said people understand it f is not like an organization, doesnt even officially exist, not an official organization. It is a name of the hotel, nothing else, people, something comes over and buys the hotel, the system is very slow and cumbersome and ugly but better than the rest. One of the things mentioned in the encryption we are starting to see, commerce and technology is not country by country but global. To once again force you into the private sector, i am curious about your thoughts on this and the notion there is a marketplace that is invested by all of these things that may or may not be watched. Let me pick up on one last point, the question of how we attack this, we cant define this. I get this thrown to me all the time and it is as if we were talking about this domain, something where we have broad expertise on all these issues and there is huge power in categorizing the rabbit hole into how the un is dealing and approaching, cybersecurity is such an enormous field and conceptual areas had the power to say, this is where is a liberal arts majors of the world play in this land. Is this something we havent seen before . Is this something that should fall under our control framework. Are there existing mechanisms that have been formed in the last 60 years where people were thinking of the stuff that would serve us well. I always challenge people on the Political Science degree to say how do i do this . What is the right role . There is a huge translation problem in this space now and they need for bucketing, the technical side, strategic, political policy community can play together to figure out the existing law assigned to it. Jane had to step away to a commitment that if i may, we have a message from twitter from someone watching in cyberspace so thank you. This is picking up on the theme of the question earlier but in terms of the loss of cyberweapons which i interpret to mean losing control of a weapon that has been developed, to your point do we have an existing framework . How would that be handled under International Law . How would it be handled today . Ideally what would you like to see in terms of that issue . Im not in International Law. The concept of effective control in cyberweapons is an exciting issue i have been following for a couple years. It is undermined by the fact that we dont have liability laws. You cant sue anyone, how should you be able to sue the Us Government if they lose control of a cyberweapon. It doesnt work that way because International Law is different but fundamentally there is a political commitment. Be careful how you use that, interesting example is not only losing control of your software but also when your staff meaning cyberoperators or cyberwarriors do something on their own time, if they do a hack as opposed to a private contract. This has been the case probably china and russia, governments in both countries said that and this person happens to do that, they do that on their own time. International law is clear on that. If you have a special skill set and working for a Government Organization and do something knotty, the government is responsible. More difficult when it is about something intangible but there is a political liability. Many heads were being scratched. People are very embarrassed about what happened. I hope they are embarrassed enough to be more careful in the future but legally there is very little recourse i am familiar with. I am not touching that which it is a huge question. What form you would even try. It is too big between you and me. Jonathan nichols on twitter will have to carry that out for another day. Probably the last question right here. My name is archibald. A way to go, i had a message, the concept of cybersecurity, the solution to this problem. What would be your thought on this . That gets to the question of equal contribution but cyberforensics and what role that plays in here, kick us off on that as a veteran. I hate to say it depends on a great question but there are so many elements involved in attribution but more broadly figuring out how to prevent the type of attack or compromise you have seen, to prescribe a framework that would give that community governments, other players looking at how to handle 4 and 6 would be difficult. That said, a place where government can play a helpful role in reporting around forensics. Everyones version of cyberattack is completely different. You can take Computer Network attack from country 13, and go under attack and make cyberversion and pick what your choice is. The ap stylebook ways in. Any level of consistency so that when the British Government says x wisely happened in a hospital or the french government comes out after an incident in 15, some level to report that with fidelity, that is how nascent we are in our ability to talk about network incidents. How big an issue is classification . We talk about recurring theme of trust, describing what happened, one of the ways, there is doubt about the 2016 election, all that is ever released is top level stuff. You might get some specific ip addresses but there is proprietary information in the private sector, not releaseable because it reveals the tactics, are we ever going to get to a common sense of forensics when so much stuff is considered two different ways to approach that. Forensic privatesector environment looking at code reversing and piece of code looking at objects, getting the attribution. The capabilities, the less they will rely on that information and instead do what general Michael Hayden called the many haystack approach. You use that to get probability behind a certain event. A very different approach, who programmed it and what did they do, so that would be how would government present that information . Highly classified sources in international settings. There has been a proposal for a year or two supported by some on the internet, and open debate with attribution, something microsoft was keen on moving forward. There would be some organizations that basically said this government has been a bad boy on cyber. The big question is how do they deal with classified information . Nobody has answered that question but the way to answer it is the way it is currently dealt with in the us anyway, the nonproliferation treaty, they constantly get sources of classified intel that are high level and going through this process i dont fully understand whether it is credible or not but more important, trying to establish metrics and what we mean by certain events. That would be helpful. On the diplomatic side we need to define cyber operation, have a dictionary of terms as something put forward, just like National Security, it would be what you wanted to be like pornography, you know it when you see it. It is hard to define but we pushed on a riskmanagement level and asked those guys in that community in their types of segmentation and classification object and events, types of attack, that might move the dialogue forward and keep it in the technical dimension, not necessarily talking about weaponization. We are out of time, those who are joining in the room, opportunities to continue without the microphone. It is a wonderful panelist, thank you for tuning in. We have many of these and can look forward to stimulating conversations. [inaudible conversations] [inaudible conversations] james okeefe, how did you get started with project veritas . Guest i got started at