Transcripts For CSPAN Discussion Focuses On Russian Hacking 20170221

You can find all of this and more on our website. Next on cspan, a conversation on russian hacking. We will hear from a New York Times reporter, a National Intelligence officer and the author of a new book on Cyber Security. This is 90 minutes. The ball has dropped. Happy and welcome ladies and center. N to the belford it is a wonderful evening in cambridge, massachusetts. We have cspan with us today and a good twitter presence as well. For those of you not in the room, it is very sunny, very warm outside. Please visit cambridge anytime, especially our Cyber Security project. It is a wonderful panel we have today. First, our colleague ben buchanan, a post doctoral fellow here. David singer, a senior fellow and New York Times security correspondent. Fiona hill joins us from washington, currently at the brookings institution, had been the National Intelligence officer for russia but is also a harvard alumnus several times over. Welcome back. Thank you everyone for cramming in here to the absolute full house. Trust us everybody, it is absolutely packed. We will note that if you have your cell phone on, please turn it to silent or turn it off, a remarkable idea. If youd like to live tweet, go for it. It is on the record. Have at it. What we would ask is when it comes time for q a, we do have microphones on my left and youre right and my right and your left. When it is time for questions, please use them. That way our audience here and on tv will be able to participate and hear what we are talking about for the q a. With that, lets begin. Let me ask our guest, fiona, tell us a little bit about where we are at with russia today. Where have we been . We have a new administration that comes in with a slightly different approach and thought about russia then previous than previous administrations. Set the stage for us, if you would, where we are at with russia today. Thank you for being here. Fiona thank you. Thank you very much. It is great to be back at harvard and see so many familiar faces. Really nice to be here. Interestingly enough, we are not at much of a different place with russia than we usually are at the beginning of administrations. There are plenty of people in this room who will think back, sorry i dont want to be rude to anybody, back to reagangorbachev, when Ronald Reagan wanted to change the trajectory of the relationship with the soviet union, and did through summits with mikael gorbachev. Since havepresident s had to rethink the relationship. They have all tried to find new relationships, so that is not unusual. What is unusual is the backdrop to the president ial election here in the United States with an unprecedented level of efforts by russia to have some kind of influence over those elections. It has been hotly denied by moscow, but i think by this point, the reason we are having this panel, articles from david sanger and others, that is quite clear that those denials are meant to throw us off the scent of what is happening. Also, attempts to influence elections by russia or the soviet union or the russian empire back in the day, it wasnt necessarily elections but the choice of kings and queens, it is also not unusual. It is not unusual for an outside power to have a say in what happens with another power, an adversary or friend. It is just that the technology we are here to discuss has given everybody opportunities to have influence in different ways. Anyone in this room who is able to code can hack into somebody elses computer. Back in the day, it was more difficult to have political influence. You had to spread rumors, you have to maybe affect a palace you had to have physical spies in different places, or even plant people to sway the day. Now we are in a situation where with a few taps of computer keys, you can have a major impact, or at least have people talking about that impact. So i would argue that we are not in an entirely unusual and unprecedented position, but the scale of the efforts we have seen to have an impact in u. S. Politics is somewhat unprecedented. Excellent. Thank you for that great opening. If that is the intro for the russian side of the story, help us think through the cyber side of the story. Thats right. It is a pleasure to be here. A lot of things are new, and a lot of things arent new, and that is true on the cyber side of the ledger as well. Russian Cyber Operations go back a long time. One of the first state on state Cyber Operations, moonlight maze, late 1990s, and that was tied clearly to the russians. So this is not new, but for those of you who might be new to the Cyber Operations, a way to conceptualize them is we have a category of operations, espionage, and this is an old tactic in new clothes, gathering information through signals intelligence, and this is incredibly valuable to nations today. It is difficult to overestimate the degree to which modern nations, including the United States and russia, rely on signals intelligence and Cyber Intelligence to inform their decisionmaking processes, and also sometimes in 2016 to leak information and carry out influence operations. That is one half of the cyber ledger. The other half is holding targets at risk or developing attack capabilities. The russians have done a fair amount in this area as well. What is significant here for those who have not studied Cyber Operations before, if you build a missile, you build a missile and target later. If you want advanced Cyber Capabilities, you need to do reconnaissance and prep work in the adversarys network well before you want to launch the capability. We have seen the russians doing some of this prep work before. So this is a significant part of their operations, even if it is not a high profile influence operation or espionage operation. Make no mistake about it, russia has recognized the power of Cyber Operations to steal inverted information, but also to attack. Terrific, all right. Well, not terrific for victims of russian attacks, but terrific in terms of opening comments. Thank you for that. David, link the two if you would together with a wonderful story that you had written back in december, december 13, on a saturday, a very detailed account in the New York Times called the perfect weapon, how russian cyber power invaded the United States. David thanks. It is great to see so many friends here. Thank you for coming out. The title of this piece, and it is a long piece, about 7000 words long, was an effort to do a reconstruction of what had happened. The title of the perfect weapon came about because the more we discussed it, the more we came to the conclusion that it was perfect for the situation that russia finds itself in today. The russians, like the iranians, like the north koreans, in fact like almost everybody else, do not see any advantage in confronting the United States frontally or any advantage in doing anything that would actually provoke a major response or certainly a kinetic response. Cyber is perfectly well designed , as was pointed out, for the option of doing a low level attack that could be used for espionage, could be used in this case for influence operations that merge a very old soviet tactic from the 1940s with the very modern technology of cyber. Or it could be used in a much bigger case for fullscale attack, what the United States did in the Olympic Games against the iranian infrastructure. And so the trick for the russians here was to find something that was inexpensive, deniable, and that would count on our ability or our inability to both detect it quickly and to respond decisively. Now on that last point, counting on the u. S. For a slow response, and then for a confused one, i think they got a payback that was bigger than they ever possibly could have imagined. Just to take you briefly through the timeline for any who may have missed this, the United States was first alerted by an allied Intelligence Service about an attack on the dnc, an intrusion into the dnc, in the fall of 2015. Because the u. S. Never wants to reveal exactly where the intelligence came from, it routed this through the dhs, department of homeland security, and the fbi sends a midlevel agent out to go find a completely clueless i. T. Group that was defending the dncs computer systems. I would not say defending the dncs computer systems. They were hanging around the dncs computing systems. [laughter] david the special agent calls, leaves a message, asks for a callback. The person running this, you cant make this stuff up, doesnt believe he is from the fbi, but doesnt check or call back for a while. They spend months in the dance back and forth where they are presented with the evidence. The fbi said a group called the dukes appeared to be responsible for this. This is part of russian intelligence. But the response is so slow that the president of the United States did not actually hear about any of this until june 2016, nine months. In an era when we talk about how cyber means we have to be able to respond quickly, have a playbook ready, be able to look at your array of options, whether sanctions or a counter cyber attack or some other form of active defense, or Something Else, you cant do that if you are responding this slowly, and in the interim, what did the russians do . They went beyond the dnc into the email accounts of john podesta, who in march 2016, who was the chairman of Hillary Clintons campaign. We found evidence of 128 private email accounts within the Clinton Campaign they tried to get into. They actually only broke into two. Why did they only break into two . Because only two people in the entire group did not have two factor authentication on their email. If there is a lesson for all of you in the audience here, it is subtle but out there, leave immediately and put your two factor authentication on. They gathered all this stuff from john podesta, who had checked with his i. T. People and somebody still hit the button that allowed a spear Phishing Campaign to get his password, and it was months later after another attack was discovered, run basically by gru, the Russian Military intelligence, that people discovered what was going on, cleaned out the dnc hard drives. By that time, the russians had everything, and the first material was made public in the days before the opening of the democratic convention, and that was the set of releases of the internal dnc material that led to the resignation of Debbie Wasserman schultz as the chairman of the dnc, and then they did a another set of releases during the campaign of the podesta emails, most of which got released within hours of that now famous videotape of thencandidate trump saying some fairly crude things. The release of the emails came 24 hours later. These came over several different channels. First over two channels we believe the russians themselves set up, and when not enough people were clicking on those, somebody gave the material to wikileaks. So what was unusual here . First, we had not anticipated. We had a failure of imagination that the russians would take a series of techniques and used it against the United States. Secondly, we failed to anticipate that a group like the dnc or rnc would be easy targets. Thirdly, we had an fbi that responded so slowly that they never did what we did during the reporting of the piece, which was walk between the fbi building and the dnc headquarters. It was a 14 minute walk, including a stop to get coffee at starbucks. [laughter] david this would not have required a lot of effort on their part. Then fifth, president obama when he got the data did not want to be accused of getting involved in the election on Hillary Clintons behalf, so he reacted fairly slowly and carefully. We reported in late july that the Intelligence Community had concluded the russians were behind the attack. The Intelligence Communitys First Published attribution of this was not until october 7, and the u. S. Response was not until a few weeks before president obama left office, so if youre looking for a case study of how not to respond quickly to one of these things, you have got one. Michael that has got to be maddening, and one of the best things about moderating a panel with david sanger is he cant ask you to explain why the government was so slow in responding, so we will leave that for the q a. Let me come back to ben to take on an article this morning from the succeeding and victorious New York Times to contrast with another adjective being used. The article this morning in the paper says, czech suspects a foreign power in email hacking. What do we make of this . What do you think of that . Is this the russians . Fiona, is this the part of the playbook . Ben i will handle the czech thing. I will let fiona handle the playbook. There is no doubt in my mind this is not a new trick. There was one study that showed between 19452000, the United States and russia, then soviet union, combined to try influence to try to influence over 114 foreign elections, sometimes overtly, sometimes covertly, so this trick has been around for a while, but doing it in an electronic fashion is new, and there is no reason to think the United States in 2016 was the first time the russians tried it in electronic fashion. If you look at the 2014 election in ukraine, there is pretty good evidence the russians were involved in that. And given what appears to be a successful 2016 campaign by the russians in the u. S. Elections, theres no reason to think they will stop. I have heard from folks in europe that they are concerned that they feel like the russians got away with it in the United States, so nothing will deter them from doing it to us, germany, france, Czech Republic with elections coming up are quite concerned, and in my view, rightfully so. The question for those nations is, what are they going to do about it . Germany has pursued a policy of aggressively calling out russian hacking far more than any other nation, and it is not clear that that is itself deterring russia and certainly smaller states like the Czech Republic, who might not have advanced Cyber Security or a history of working in Cyber Operations have a lot to be concerned about, so if you are looking for new stories in 2017, this is one that is not going away, and this is one that will get a lot of attention. Michael i think just to set fiona up on this, an article on the brookings website, what makes putin tick and what the west should do. That is very much worth reading. It is an excerpt from her book. One of the opening lines is that we may have underestimated his willingness to fight for as long and as hard and as dirty as he needs to. Is this an extension of that . The kinds of activity, an extension of that argument . Fiona i think it is an extension. One of the reasons we put that is the conclusion of the 2015 book, precisely because the analysis prefigures this. It was mostly focused on russian activity in eastern europe, so the failure of imagination was to extend it to the United States and larger western European Countries. But just to pick up about the question you posed to ben. In december 2016, the head of german intelligence also announced, and this has been picked up in the New York Times and elsewhere, that the personal email accounts of the German Parliament has also been hacked, and presumably other accounts as well. There is evidence of shell Bank Accounts in switzerland for a more conventional type of influence operations, funding Political Parties in advance of german elections. So we can fully anticipate the kind of activity we are seeing in countries normally not on the front page of the New York Times, moldova, belarus, montenegro, the kinds of operations to influence and push the tide of elections there to be attempted in germany, the Czech Republic, the netherlands, french elections are coming up, although there seemed to be selfgenerated problems in the french elections. One could say that his information through the kinds of sources we are talking about as well. This is a pattern that has been continued for some long period of time. We are just now seeing it much more starkly in our own backyard. As david said, it was a failure of imagination on our part not to see this given back if you go back 30 years to the 1980s and further, this is a feature of the kind of cold war activities that we and the soviet union were undertaking. In terms of that playbook, putin is a former operative in the kgb. He continues to think like an operative. He himself is extremely proud of that skill set he acquired. He talks quite frequently of being a specialist in Human Resources. Also in the use of information. He never shies away from extolling the virtues of the techniques he learned to play dirty in the kgb and their application in politics. He saw in the u. S. Political race something incredibly contentious. We are familiar with the nature of the Political Campaign we just went through, and an incredible amount of opportunity to exploit on all fronts. Putin and the people around him are strategists. We always underestimate and have underestimated for the reasons my colleague mentioned and why i wanted to write this book about putin, that we always assumed he is an opportunist. You cant take advantage of opportunities unless you have an idea about what you are going to do with them. The people who came out of the kgb like putin were trained in contingency planning, but also have clear goals about what they wanted to do. In this instance, for a long time, putin has been in the interests of russia first. This was his slogan back in 2000. I am not just picking up on the meme of the moment. When putin came into the presidency in russia in 2000, his whole manifesto that he announced at the end of december of 1999 was to put russia back on its feet, first internally, domestically, then as a great power, and at numerous times and many speeches he has made through his presidencies and the beginning of his various presidencies, he wants to make sure there is geopolitical and geoeconomic demand for russia and russia is one of the big players. He has also made it clear he will use whatever means necessary for this. What david said about the asymmetry of power is important. Putin is also quite cautious in his application of force and violence. You see that in domestic politics as well. There are a lot of policy steps made domestically that are meant to have an influence on others, very selective targeting of individuals. We have now seen that in Foreign Policy as well. When putin and the russians target a country, they often target an individual. A classic case was our elections with hillary clinton, who they saw as a threat. You can also see this in turkey. After the shooting down of the aircraft by the turkish military, the russian aircraft that made a small incursion into turkeys airspace during the syrian conflict in 2015, putin targeted, all of the russian establishment targeted not the turkish people, not a turkish air force, but president erdogan directly. Airing out the dirty laundry, the kind of information circulating in the Turkish Press and has led to the arrests of turkish journalists. He said it was a stab in the back. He revealed that he and president erdogan had secret deals behind the scenes about the kurds in northern syria. Revealed all of this publicly. He went after president erdogan and the turkish government with a single minded purpose, putting sanctions on them, basically forcing the turks to eventually capitulate in terms of giving an apology for the shooting down of the plane and turning the screws on turkish front abilities with the kurdish situation in syria and after the coup this past summer. Those are the kinds of actions we see repeated. We have seen it in smaller countries repeatedly. We are seeing the russians feel emboldened on doing this at a much larger scale, and they see this as fair game and part of a totality of instruments. Cyber is just one of a whole number of strategies and mechanisms. Michael let me ask david to pick up on something you were talking about. In terms of the asymmetry, the point david made earlier about why Cyber Capabilities can be the perfect weapon. That is the deniability. As a journalist, you are in a powerful role in communicating these activities to the public. The government does not talk about these. The only opportunity for the populace and academia to learn about what happens is through a handful of journalists, and david has been reporting on it longer than almost anyone else. How do you think about evidence . How do you think about the standards that are needed to say that everybody is denying it, but here is what we will say as a succeeding victorious paper of record . David thanks for that and the reminder that im the oldest cyber reporter wandering around. [laughter] david first, the first thing to remember here is that this was not the first time by a long shot that we saw russian intelligence operations, even in the United States. Mentioned midnight maze you. But we forget that earlier in the Obama Administration, we had seen three espionage only attacks. One on the state department, one on the unclassified emails in the white house, and one on the joint chiefs of staff, that being the scariest one because the dotmil is supposed to be the safest zone in the u. S. Government. As if the u. S. Government has a particularly safe zone. It was not the russians who went in to the office of Personnel Management and got the 21 million files. That was the chinese, who beat them to it, but it was in these other cases. So in each of these other cases, there is of course the forensic evidence that you see, bruce and others here can talk about that better, but there are certain patterns. The russians in the case of this hack used some very familiar techniques and tools. They used familiar ip addresses that have been used elsewhere. Of course, you can fake and ip address and borrow someone elses tools. You get to a point where there were enough of them that it becomes significant. Then secondly, you have motive, and i think fiona alluded to this when she mentioned hillary clinton. Vladimir putin has made no secret of the fact that he believes that secretary clinton in her last year as secretary when she commented quite publicly on the 2011 russian parliamentary elections and declared that they had been rigged, in putins mind, she was interfering with the russian elections, and i think it was a fairly reasonable guess, but again, you are still guesswork here, that he was seeing this as something as payback for something she had done. But the truth of the matter is that the only way you get truly convincing evidence is if you have a tap of a verbal conversation in which the people who are doing this are discussing it, or you have implants inside a Foreign Network in which you can see the traffic. If the dnc email suddenly show up running through an implant that you have put in the russian systems, you have a pretty good guess how this all came about. This is the hardest part of this whole bit, because revealing implants, revealing sources, is the most difficult element of it, and so the u. S. Government turned out an Intelligence Report in december that laid out their case. It was utterly unhelpful on all the questions you just described, but we quickly found out there were two other versions of the report. One of them was intended only for a closed to session for members of congress, which is to say that it was cleaned up with the understanding that the leak would happen between 10 seconds and 10 minutes after the meeting ended, and then there was a compartmentalized version, which is what was shown to president obama and also shown to president elect trump at that time and his staff. It is pretty fascinating because from the afternoon he saw that, you never heard President Trump again say that he did not believe this was the russians. In fact, he said flat out i do believe it was the russians. He then changed the topic, but it clearly impressed him. When we went back to do our reporting, we found what you expect to find, which was that evidence of this material inside russian systems. Michael i will turn to ben for a decision on opportunism and contingency planning. We will try to give a preference to students if you have a question. If you are a student, come to the microphone and get a head start. We talked about the need to think about strategic planning, not opportunism or what the putin playbook is about. But for Cyber Operations, how much can you stick to a plan . Can you help us think a little bit about the need for what you would call agility because you dont entirely know every single step of the way if will be successful or not, versus the need to tradeoff things strategically. Help us make sense of that, and students, hit the microphones. Ben this is a great question. One that is not often asked and one that is particularly vexing. It goes back to what i said before about the need to develop access early if you want attack capability that is sophisticated. We also should note that Cyber Operations are a complex beast. These are multistaged, and oftentimes they take place in target networks where access can be lost any given day, not from a security update for security improvement, but just because somebody changes their software from something 2. 0 to something 3. 0. You could lose access to what it is you are trying to operate or the domain you are trying to operate. There are real challenges, and i think david points out the challenges on the defensive side of responding to the operations you do detect, particularly when that interface is with the bureaucracy. There are folks who will tell you on both offense and defense that the solution is to get humans out of the loop if possible, to fight in the cyber domain or engage in the cyber domain at machine speed rather than person speed or swivel chair speed. It is an admirable goal, and we have seen fits and starts in our intelligence that would make that thinkable in the long run. I think the realization that is inescapable these days is organizations have to streamline the response processes and have people making the strategy and doing the plans who are comfortable with technical facts of the cyber domain and who are comfortable with the fact that things go wrong and flexibility is required. It is fundamentally different than operating in previous areas of traditional conflict and nuclear conflict. Also Information Operations, which took place at slower, more inexact speeds. I think when the history of this period is written, it will be written as a period in which policymakers are struggling to figure out how to operate in this domain. The subtext of that is probably that the nation that does it well and fastest and finds its agility is going to have the most success. David just a quick addition to that at risk of uttering the obvious, taking people out of the system sounds good for fast response, but it also takes the superpower politics of it out of the system. You dont want to do that because the way you would respond to a hack from north korea, as the u. S. Did after the sony attack, could be quite different from what you want to do if you are responding to russia or china. Michael i think we are going to be able to do another session here at the Kennedy School with the head of darpa. Darpa ran a grand challenge last year about selfhealing systems in computers that can attack each other and heal each other without humans in the loop. That is going to be a topic we will explore here at the Kennedy School. Fiona one point before we go to the questions. There is going to be an element of all of us as individuals involved in this as well. It wont just be symptoms systems we will have to take care of. We are all going to have to be very careful about our own use of the internet. I have been personally hacked multiple times. It has been a very sobering experience. Michael by Human Resources . [laughter] yes, but the chinese and everybody imaginable is trying to get hold of our data, organized crime, and individuals who want to basically get hold of peoples identity information. I think it is going to be incumbent in this environment to each one of us to not just go back and put in the necessary for gmail, but thinking about our use of all social media. For students and those of you out there who have a whatsapp account, very recently, i discovered a colleague of mine had their facebook account hacked, which basically infiltrated their whatsapp account. All of us linked on whatsapp got a filter of porn from the hacking of a facebook account. So i would advise all of you to start changing those settings pretty quickly. The point is we have gotten used to these tools as part of individual convenience and part of our lives. People are tweeting, people are on their computers now, but we have made ourselves vulnerable to a range of individuals that want to attack us. I think it is going to be a sobering experience. I remember back in the day at the Kennedy School and here at harvard when everyone was dictating notes and writing everything down in notebooks, in some cases, we may actually had have to sanitize our ways of operating because of the sensitivity of information, going back to the days where we did not have to blog and tweet. Michael what a time. [laughter] michael lets get to the audience. Please identify yourself with your name. My name is josh golding. I am a senior at tufts university. I will target this at dr. Hill, but if anyone can answer, i would appreciate it. I am curious how you think internal competition within the Russian Security services will influence the frequency and scale of Cyber Operations. Fiona that is a great question. Obviously, there is something going on right now because we are getting information about arrests and things going on in moscow. Every Security Service has competition. David get some testament about the fbi. We have a pretty strict firewall between what our various agencies can do. For example, the fbi has to deal with a lot of domestic political issues. The cia and other intelligence agencies deal with foreign intelligence are not allowed, actually, to basically undertake any investigation that has domestic political components. I think the Russian Services knew that very well. They were able to take advantage of some of our firewalls. In this case, they have a lot of overlap. They work for different masters but also the same master. I think they are very keen on showing who is more agile, who is able to get the information first. It is not all about elections either, because there is a routine to find out information about leadership in other countries, to find out information that would give the russian government a distinct advantage. Obviously, there is housecleaning going on because there are all kinds of questions about whether individuals in the Services Provided information to the United States or provided information to other governments about what is going on, but i think this is going to be a very big issue that most of us on the outside will not know what is happening, but this is something that will be a feature in the next couple of years, and i would say we will see a lot more of these attacks as agencies are being compromised in russia. They will be trying to prove their worth again. I dont think this issue is going to go away, and it will be difficult for us to deal with the complexities of interagency competition in russia. Just one very quick point about russia. The russians also have an election coming up. Putin has to basically put himself up for relegitimization in 2018. This is actually important. Elections do matter in russia because it is a way of getting popularity again and putting faith back in the presidency. You can be sure that putin is to going to want to make sure there will be no outside efforts to influence their elections as he believes happened in 2011 and 2012. We can imagine more preemptive aggression coming from russia to make sure that nobody has any idea about intervening. Michael a 30second supplemental . David one point. It was the fsbs group that first got into the dnc, and it was 78 months later when the gru came in. There was considerable speculation within u. S. Intelligence that the two of them were not coordinated, and actually it is the gru that ended up getting caught and the one that made a lot of this material public. I think that hints at some of the competition fiona refers to. Michael if others want to hit the microphones, i would invite you to do it, but you over here, please introduce yourself. My name is grant. I am a student here at the Kennedy School. Thank you for this panel. This week, vice magazine put out an article called the data that turned the world upside down. It was about the use of psychometrics, which is an enhanced form of demographic information, basically feedback from the clicks you made on facebook. They can put people in categories and influence elections. Say if i clicked on a few things, they know i am an anxious father about a certain type of issue, and they can target individually based on that through dark advertising and other methods. My question is, we have seen this in campaigns. This was linked to the president ial campaign in the vice article. Has this been used by the state actors, and what are the implications of this . Michael you had me at psychometrics. Any thoughts . Ben, you want to jump in . I think this hints at a broader point. Before we into the question, we talked a lot about Cyber Operations. We have an event called russia and Cyber Operations. This intersects neatly with Information Operations and propaganda operations and what the kgb used to call active measures. False information, fake information. I think at some point, the story will be written about the tv network rt, the online website sputnik, and a verifiable army of twitter accounts and Facebook Accounts pushing information. In some way, this is hidden in plain sight and we can debate the effectiveness, but there is no doubt that is the piece of the puzzle i dont fully understand. This notion of microtargeting is important. I am not sure of the degree to which the russians have mastered microtargeting in the way president ial campaigns have, in part because i dont think they can buy the data from facebook in the way that the Obama Campaign in 2012 did. The broader principle is the more data that does get out there, either through legitimate or illegitimate means, we have seen the chinese run a series of operations. David mentioned opm. There are also hacks against Insurance Companies that gather data on american citizens. The more data that is out there, the more savvy Intelligence Services will use it as part of these influence operations that intersect with the Cyber Operations that are familiar to those of us who have been studying them for a while. David the question i get asked most often, usually by people who voted for hillary clinton, was, can you qualify and the end quantify in the end whether or not this operation swung the election . I always say no, we cant, because the russians did not go after the actual voting machines. They appear to have scanned a number of registration databases, but we have no evidence they manipulated the votes, so those 3 million illegal votes came from someplace else. [laughter] david but because we dont do that, we have no idea in the end how successful or not successful this was. You are trying to separate it out in an election where there are other factors. The statements made by james comey about Hillary Clintons emails. The fact that secretary clinton did not prove to be an anonymously effective enormously effective candidate. How all of these mix in our difficult to tell. That is part of what made the russians so successful because you think they did not start this operation in 2015 when this all began thinking that they would get donald trump elected. They thought, like most of the people in this room thought, that his candidacy would probably be over by september or october of 2015. And yet as time went on, it looked like their goals evolved, and they evolved because they were able to move from information gathering, which is where the fsb began, to making information public that might simply disrupt the election, make people lose confidence in our system. At the very end, if you believe the assessment of u. S. Intelligence, actually entering on behalf of donald trump. Fiona what the russians specialize in, and this goes back an extremely long way we are in the 100th anniversary of the russian revolution. The bolsheviks specialized in propaganda and these kinds of operations. They have been at this a very long time. When you look at what they have been doing for the last hundred years, these kinds of operations, they have been riding a tide that is already there, exploiting vulnerabilities in some cases, but really giving a nudge in the direction of larger trends. If you look back 100 years, lenin embraced all kinds of causes that were not intrinsic to the revolution he was trying to undertake, including the National Operations of ukrainians and a whole bunch of other nationalities of the former russian empire. He had stalin coopting them and moving their independence in the direction of the bolsheviks. He picked up on the ideas of other revolutionaries and amplified those until he parted company with them. All kinds of things. What i think we saw in the case of rt and sputnik, the russian outlets, they amplified trends that were already there, but emphasized the directions in which they wanted to see things going. They also, and i think this was written in a recent article that either you or one of your colleagues wrote, there is a counterintuitive element to all of this. The russians want to look good at what they are doing. They love that we are having this panel right now. Cspan is here, but maybe we are live on rt. It makes them look effective. We are all here giving them kudos. They really did a good job here in terms of their goals. They are probably working on our dinner at the same time. Basically, they have loomed very large in this in a way they could not have possibly expected. This is also good for business. Putin wanted to join the kgb and basically went through a whole series of laudatory documentaries and films about the kgb and undercover operations during world war ii. You can be assured there are an awful lot of people getting recruited now on the backdrop of taking down a titan of u. S. Politics. They are doing it much more effectively than the chinese or the north koreans. Basically, russia is back in business. For a former, probably still current, operative like putin, this is probably a source of incredible pride and a job well done. I do think there is some work that can be done by an enterprising graduate student at the Kennedy School to look at how the release of that information drove traffic online and changed narratives online. That, i think, actually is measurable and researchable. Right now, i think it is a fair point to say it is a little hard to point your finger on it, but there are ways to research this. David how fake news compares to a New York Times article. [laughter] david my ego prevents me from giving you many of the results, but i can tell you that the fake news stuff gets repeated fast, which is why facebook, google, and others are looking for mechanisms either technological or of an editorial nature that would say to people who click on a certain article or certain facebook post, hey, you should look at these two or three other accounts that suggest that what you just clicked on was complete fabrication. My colleague, with whom one of the two reporters i wrote the perfect weapon with, went out and found a guy living in annapolis, who basically wrote a lot of this fake news. He said that if he could have made more money writing fake news in support of hillary clinton, he would have done that, but the market was for trump. [laughter] michael horrifying. Next question, we will go for quick questions, and we will go for short answers, please, as we get down to final jeopardy. My name is jim. I was an official student many moons ago. Still a student of life. I want to follow up on the in the election and fake news, especially domestically with david sanger, though all of you are welcome to respond. You were always clear this is an old playbook on steroids and should be taken seriously, even if we should not panic. I think everyone sitting and standing in this room takes it seriously, but it is also fair to say that we are about 90 of the eastern intellectual elite sitting in this room, and there is a group of people who dont seem to take it as seriously as we do. The New York Times had an article weeks ago about Trump Supporters and their reaction to russian hacking. There were three positions. On one end, it did not happen. In the middle, it happened but did not influence the election. On the far end, it happened, and it was a good thing that got trump elected. Nowhere was there a sense that this was a problem. If perhaps 35 of the electorate who are Trump Supporters dont see russian hacking as a problem, what is the political will, the reality domestically about how we can move forward on this with the money, the staff, the policy that we all think it deserves . Michael great question. David . David first of all, this is a setup because jim was a graduate student trying to keep track of all of us when i was a student. He has seen the agitprop closeup here. It is a very good question, and i think it is one of the reasons that you saw so many committees in congress and many efforts by the Obama Administration to set up investigations that would live beyond the Obama Administration. I think you are going to see a lot of efforts by the Trump Administration to try to make sure that this either goes away or there are distractions from it and so forth. But fundamentally, the hacking investigation fell victim to the same divisions within the country that made it so effective. Fiona i think what we are going to have to do, and it is going to be incumbent on all of us, is basically change the discussion about this and narrative and actually depoliticize this stuff if at all possible. It is right that it fell victim to partisan politics, and i have to say with due respect to some former senior figures in the cia, they actually did not help in this matter in opeds and other articles they wrote where they declared themselves in favor of a particular candidate or made partisan comments , because the message overall should have been that this is an affront to our National Security. No matter what your position on hillary clinton, she was running for Public Office as a legitimate candidate in a legitimate election, no matter how contentious this election was. If it can happen to hillary clinton, it can happen to anybody. Anybody sitting in here who is a member of linkedin and has their personal information taken, we should all be concerned about this because many people in this audience will want to run for Public Office, just by the fact that you are sitting here and working at the Kennedy School. Anybody out there in private citizenship and all those who voted for trump, they can have their personal information taken. We know the chinese have been doing this. It is only a matter of time before this is used for political purposes. I think we have to have a national debate. Congress is the right place to be having that. They have oversight over the Intelligence Services. They can have this compartmentalized information. It is incumbent upon us to talk about this in a nonpartisan fashion and make it clear how serious this is. Which is why people like ben are doing this research. Also, it is worth asking a question. Had president obama, starting in july or august, come out every couple of days saying this is not about my support for hillary clinton, but we cant have a foreign power messing in the lection and this is what the we might question, would that have been a better approach . I can tell you that while most of the public on it, there are many former members of his administration who believe that he should have been a lot more vocal about it. I think it is also worth noting that senator mccain recently created a specialized subcommittee to focus on Cyber Security. That is a good step. I think what we should expect and ask for is our representatives in congress to spend a little more time specializing in Cyber Security oversight not just for the Armed Services committee, the intelligence committee, but for a much broader swath of society. I think that is where we need to be heading. My soninlaw offers Cyber Security Information Services to congress. Wonderful. Got him a good shout out there. We have a question here . Go for it. Im a graduate student at the davis center for rushen and your asian status. You spoke about providing evidence and how do we provide this evidence to the public, prove to the extent possible that these events are taking place . David, i got a lot more from your story than i got from the u. S. Intelligence report from early january which, for someone who follows russia was absolutely nothing new. We charge more for prescriptions that be they do. [laughter] i was wondering with your views with the limitations on releasing certain information, how can the fact that a lot of people in this country dont believe this is happening be combated . Has a somebody who background into the national fedge council, its incredibly difficult for the intelligence agent study write something thats more interesting in that assumery. That was the most sanitized summary they could put out there. As david was saying, there was also the anticipation that the redacted version would be leaked as well. But they put people in danger. We do not know precisely whats gong on going on. I dont have any special information at all about whats going on in these arrests in russia. These are life and death consequences for the people who provide the information. I would suggest a compromise and this is something for the role of congress. Intelligence communities is in a very difficult situation because their priority is securing the nation and advising the president. I think Lindsey Graham came out and said that hed been hacked. So members of congress have had these experiences and they can find ways of reaching out to their con stitch yenlts. Presumably the people who voted in them have a degree of trust in them. We have a problem on trust in the congress right now. I do think it was significant that President Trump actually said yes, he believes now its russians. After having been adamant on the other side, hopefully that will have an impact without him revealing any of the information to any of his supporters. I think he was also right to talk about the fact that china and other countries are involved in this i think weve always had a hesitancy. And the Brookings Institute where i work now has been hacked repeatedly. We have the whole issue now from where people take down your systems and you have to pay with bit coin to free your systems. We need to be much more open and transparents in talk about this i think its incumbent upon all of us sitting on this panel to find way of the doing this youre right, we wont get anywhere unless individuals start to take this seriously. I need everyone to work with me. Keep the answers brief, please. Ive had long didnt with a lot of friends in the intelligence agencies about whether they could have opened up more in the way of evidence. And i strongly believe they could have because so much here had already been brought out by private companies, which they could have come out and rat tied and ratified and said their analysis was the same as those private firms and i think they probably couch talked a bit about having evidence affirmed through implants they had in the russian systems. Its not exactly news to the russians that were inside their systems. Without getting so specific it ndangered the lives as fiona suggested. I think theyre suck stuck a little bit in the old ways to handle this. Just to amplify what david said about the private companies. Talking about intelligence and the communication in cybersecurity is different from alking about weapons in syria. Working with Cyber Security companies that want too own these issues. Based on privet things along, i was happy to say by july or august, this was russian activity because of certain indicators. Thats where the Intelligence Company needs to adjust. Both to big piggyback on the private sector and when should it fear what naysay . Ut that is a wrinkle i think that require as rethink on the Intelligence Community side. Ben has documented some of this in a recent that require as paper called rush i russia and cyber opportunities. Feel free to check that out please entrust yourself. Im a master students here at the Kennedy School. I have a question with regards to the various Upcoming European elections. You stress that we should expect continued russian interference and you spoke about the shortcomings in the south id be curious to hear your views on how far and how you see European Countries learn from whats happened with the u. S. And how vulnerable you see potentially those countries . You certainly see the germans having publicly talked about this as a problem. They have a vulnerability that i think is different than ours. We were made officer safer here by the fact that our election system is so disparate across the states and theres so much suspicion of having a centralized system one run by the federal government, you would have had a different system . Different states and sometimes different counties. Its a lot different in europe. They have a lot of problems that o beyond ours. Overall, some of the countries like germany and the united kingdom, they have for integrated intelligence communities and much smaller and tend to be communicating with each other much more quickly. Also, theyve been put on notice. If it can be done to the United States, you can be sure it can be done to other countries. So there will be reverse active measures taken by countries now. Of course, their political gures have been forewarned that their accounts have been hacked and those who have not been wered that thats the case should be told theres a high likelihood that thats the case. I think well be seeing a lot of the European Countries working quite closely together. Theres been a host of centers set up within europe on cyber picking up on so much of the issues that have been raised here now to swam information. Including that nato had quarters and other Key Countries within the e. U. Itself. 2014 hack e is the of ukrainian elections. Three days before the election, the systems are wiped and the ukraines were ready anded that backups. On election day itself, 40 minutes before the ukrainians were going through the results, they found out they were going to push out to the media false results which would show a fringe candidate winning. Theyd then have to retract and push out the fake results. The only thing that pushed out the fake results to a decimal point was russian tv, who somehow knew what was going to happen before it happened. Which suggested the influence between the operations. Thats the sort of stuff that would worry me in the european elections going forward. Excellent. All right. Yes, sir . My name is paul. Im a graduate student. My question has to do with opium attacks. Like you touched on in the talk. Like why there is seemingly forless interest in the discourse of our attack compared to the russian hacking. President trump said a while ago, why there are certain interests in Foreign Government hacking our country, whereas the chinese have been doing that for as long as we can remember, and if you look at the severity, the scale of the attack, opium attack, that was, anytime, like an act of war if you think about , whereas the hacking of rcdnc, as much as we want to think about sit probably not on the same scale. Ack in 2015 i was working at a newspaper and i remembered covering that and about how there seemed to be very little interest in that story. The story of the day wasnt about the attack. It was about Something Else so im just curious. Now, obviously got it. Excellent. Ben and then david. Act of war from o. P. M. , yes or no . No, knot nonact of war. U. S. Has been clear that if they can do it to the chinese, they would. My guess is they have. Great moment when general clapper, until recently the director of intelligence was up testifying on the o. P. M. Attack, which did get well covered. And yet all these members of congress quhorp saying about the chinese attack on o. M. And he kept correcting them and saying no, it was not an attack. It was the chineseled actually, he wouldnt even say china at the time. He would say the incursion on o. P. M. , the incursion, theest uponnage. The reason is if he est pannage. If he categorized it as an attack, he would have to say this is the kind of behavior we do not do. Not only is it what we do, but if you look at the snowden documents and look at what the United States has done in china, we have done parallel things. Not on the same scale. Did the scale of it, 21, 22 million records. Did the scale change the nature of it . Fiona i think one of the issues that were all going to have to address just in line with the discussion is now how we regulate cyber relations among sailts states. As everyone has said here, you can be sure the United States is doing a lot of this as well and other countries clearly are too. Russia, china, every country is involved in these kinds of activities if they have that capability so were in a whole new set of territory now. Extra territorial in a way that isnt covered by in of our preexisting treaties. Its one of those difficult things about how do we deal now with cyber relations . Do we engage in treaties, negotiations . What level . The attack on peoples emails like a Tactical Nuclear weapon. Something like a large denial of service or attack an infrom structure. Is this the right way of thinking about this . This is the debate that people are starting to push us toward now. Do we think in cyber in the same way that we used to talk about nuclear deternlts and arms control. I think deterrents and arms control. Asking about these kinds of yes is only the beginning for us. And this new administration is going to have to be one of those discussion. They did not reenvent what thinking has already happened. Theres a tendency to start thinking about cyber developments at new. You can go back and look at books. Weve sad haad these problems since the 1980s. Uclear is not a great analogy. We are looking to have joe nye here. If you had a suggestion for thinking about norms and governance in the work that youve spent so much time working on in this field for trying to bring stability in International Relations in cyber space, any reactions to what fiona was just saying . And then i will repeat it on the microphone. We are making some progress with developing enormous but have a long way to go. One of the reasons jim packer o. P. M. O. Call the intrusion an attack was they were busy working out an arrangement with china to prescribe or develop a norm against Cyber Espionage for purposes. They wanted to develop that distinction so they didnt disrupt that. You might say thats minor but it is an indication of how a norm can develop. To have a callout, as mike would say, i have an article thats appearing this week in the winter stu of International Security called dissuasion and deteenagers of cyber space and arguing deterrence of cyber situation and space and arcing why this is different from nuclear and why there are four Different Levels of deterrence and not just retaliation as there is with nuclear. But im not going to bore with you that. But the point is there is a beginning of development. A long, long way to go. The idea here is that for norms development, theres been some Good Progress but theres a long way to go. On our website, you can see some of joes earlier work on this one of the organizations also was one of the reasons director clapper killed not say the o. P. M. Compromise was an attack was because the United States were in negotiations with the choips and that can be an instructive lesson for us about how norms do develop. And joe has an upcoming article in the issue of International Security on dissuasion and deteenagers in cyber space. Check it deterrence in cyber space. Check it out. Well come over to this side. Please entrust yourself. Thank you. Im a firstyear student at the Fletcher School of law and diplomacy. My question goes to all of you. So what do you think is an appropriate or proportionate response to the russian hack in the u. S. Election . I had a conversation with my friend, its not only an intrusion on the election but the d. N. C. They protect the attack on the value of democracy. Democracy. What would be your at adequate response . Fiona, gives give us a 30,40 second proportional response to the attack. Fiona ill be very quick on this the this issue to the response, you have to trade very carefully. With joe robably be nyes article. We have to be very careful. When you mention the issue of values, we want to be trying to take down similar i said institutions in the other country. Now, the russian government already believes that we have been doing that. And in actually fact i would argue we have not engaged in that same type of retaliation we did during the cold war. We have seen in the wake of this in the Obama Administration, the last actions they took beforehanding over the baton to the Trump Administration, did, in, announce a whole new sets of sanctions against individuals and entities in russia but it wasnt just in response to the hacking. Was also in response to the harassment of u. S. Dip la diplomats that has been going on for an extraordinarily long time in raucha and for other kind of actions. It depend on what you want to achieve with those actions in response. Which is why i do think we have to have a very measured look at this and to look at all the different ways of approaching this and part of it may, in ct, be having a constructive dialogue with the russians on what they want to get out of all this what is the point of them continuing these attacks. David . David bob yates when, he was defense secretary used to say that the three worlds at least asked in washington are and then what . It was the and then what is that kept getting in the way of the Obama Administrations response. Your response was slow and then you made up for it by making it incredibly weak. There answer is lets think about what some of our other options are. Had we called out the russians and done sanctions right in october, it would have invited them to come in and mess around with an election infrastructure on election day that we had already figured out they knew how to getted in these these pieces of it. So they didnt want to get up the escalation ladder. There are all kind of things they could do in sanctions and counter strikes and so forth. Its the problem between feeling really good the next morning saying gosh, really got those guys and feeling really crummy the week later. Its the hangover effect that got to them. We do feel crummy. Ben . Ben lets pretend there are no con consequences and the u. S. Gets the final shot, what would they do . Ymmetric o find an as weakness on the other side. What are russias . Maybe the corruption that surrounds their leadership. Would the u. S. Want to dump information on put and be his cronies . Putin already thinks we do. Would the u. S. Want to mess with the russian internal system, which is a cyber system. There are methods available but it ups the ladder quickly of escalation. I think thats why we didnt see any of these actions but the options are there. The legal part about questionability i think has delegated. Proportion nallty is fairly, youre comfortable with the options. The question is why do you want to respond to a given act in a certain way in the context of the overall by lateral relationship. Where when we have a problem with the country, its not just a cyber country. So the response to a cyber introducing or headaching is going top to have to be done in the context of the overall question and what the country country was. Lightning round. Please introduce yourself. Good evening. My name is petry peter. I want to thank you for having this conversation conference. Im an eye spiring student at the university. An aspiring government legislation analyst, an aspiring husband. Get your question out there. Here we go. Im sorry, im very nervous. Youre doing great. Hit us. Most of us in this room know that the first step of an attack is reconnaissance, right . We agree . Is security stupid, to quote a famous rock star. We are being taught right now to basically give information without asking for any kind of details back. For example, who has access to the information. Whats the exact information thats being collected and how can we delete it . What should we do regarding privacy . This is what ensures our liberty, right . What should we do regarding privacy. Right . 15 seconds i think is probably enough time. Ben, help us out, looking back on some of the work that was encryption, r on give us a number on privacy. I think the privacy question links back to one directly posted before about what do we do. Is sb there is no world in which John Podestas account is going to be regulated by any government. All the talk about the balance of privacy, incredibly important. But the account that may have changed this election was a personal email account. If donald trump says i gout. Po testo says no thank you. Until that is cured, this problem is not going away. A free option on gmail. Next question, please entrust yourself and well do quick answers. Im reben beck rebecca. I have a balk on information technology. In my mind, i believe that kind of whats going on now ask with the creation of the cloud freezing rain structure, which is being controled by just a few entities at this point, theres a kind of power being created thats never existed before which i really think we need to be mindful of, especially in terms of the gatic democratic process. Its making it possible to crunch data faster than has ever been possible and in my mind, its interesting because most top corporations, including the u. S. Govert, are throwing their data in there, maybe not with a lot of thought. So ive been observing whats going on and feeling very alarmed as someone who has an i. T. Scombaug ive brothers in i. T. As well and were very concerned. Bring us your question or share your concerns. The question is with the cloud. The ability to crunch data. I mean, how do you feel about the new technologies that are being created and should there e more Data Governance around . Because behind all of this hacking is the cloud, really. The ability to send massive amounts of news fields to these huge data bases bases and thinking about the security of the information. The downside of a cloud is it centralizes stuff much more. The upside is, if the cloud provider is paying attention to security, it doesnt leave open as many of the holes as when each of us has a different amount of security on our own systems. So while john podesta would note trust the u. S. Government, he probably wishes he had trusted google more by using the services, you make the point, were provided for free. The combination of the Cloud Computing and big daggeta capability poses a new set of risks to us and you think about the o. P. M. Attack, getting the records of 2 million americans probably wouldnt have been all that useful to the chinese because somebody would have had to go through those records or an army of people who you have. With the big data capability, they can sort through them very quickly so that when somebody shows up at the airport in beijing and they fingerprint them on the way in and do an immediate comparison of whats in the o. P. M. Database, they can conclude, gee, this didnt show up. I wonder why this person is going in to be the second at shea in the ambassador when his fingerprints dont exist in our at thea base. When you steal 2 million records of federal government employees, everybody exaggerates their job titles. It turns out youre stealing, theres four million special assistants tots president. Wouldnt you know it. Any quick adigs about risk on reliance on the cloud . Fiona my personal view of everything that has taken place from wikileaks onward is nobody should have any expectation of privacy anymore. For anyone in any kind of public position that have a blog, a professor or a teacher, youre seen as fair game. Its basically the po testa obviously has no expectation of this being seen as a private email. I personally got rid of my private email because it had been hacked so many times. Id wish to talk to you in person than send you an email. Ben, do you still have private email . I do. I think its possible to secure. Authentication is the single most important thing you can do. Last question here. Thank you. Im anna. Just today professor walsh talked on an International Relations class about seven warning signs for war. One of them was like a rapid shift in military technology that makes it cheaper and more feasible. You see theve talkedhow likelo possibility, or do you see a possibility of a great power war with a shift of technology . Hall if you go back, vladimir putin, if you go back to his speech with it security conference in 2007, it was a declaration of war that we did not have the imagination to realize. It was done in a conventional sense, like the invasion of in 2008. N 2008 area in fact, i am glad no one mentioned it until i mentioned it now. Thinking from a military perspective, it is all just part of a very large toolkit going from nuclear all of the way through to political efforts. Fore is a very good piece those of you who want to look for it on the internet, explaining it just came out in the last month or so. Many commentators in russia have also talked about syria being one of the points of that war now, because it was see a shaking out of the regional order. It talks about ukraine as a proxy war with the United States. We have not declared it and have not talked about it in these terms. What we have seen is a full attack on our election, but it much largeron a scale. I think we have to get used to the fact that this is where we are. Host david . Sanger it is now making its way into u. S. Doctrine, as well, so when you look at what the cyber special Mission Forces are supposed to be doing, the 100 groups that have been distributed among the more traditional military units, it is to use cyber in the Opening Hours or at some point in a otherct together with events. If you are looking for a description of this, what has been written about a u. S. Program which was the u. S. Program against iran if we had gotten into conflict with iran, and it described it in days, and that describes the competition, and that so int that is all about, many ways, they are significant differences in it. The way the russians have thought about this for a while has got parallels, not exact, with the way that the u. S. Military is doing it. Ofon data, we have examples cyber attacks, no killing, some carried out by the russians, and there was the first publicly , by russia,t caused and that in 2016, we saw another. These are is that developing capabilities, but as much as we are talking about influence operations, they are incredibly important. We should not forget that this is tools of war now. The question was posed in a sense of theory and what leads. O conflict this is a subject near and dear to my heart, and it is a branch of the theory that says conflict is more likely if tw things are true. One, perception often has the and this is everyone ando the president himself, the second is that it is hard to tell offense from defense. David talking about implants, it is very difficult to extinguish an offense of cyber intrusion from a defensive one. My presumption and my conclusion is that this animates the risk of conflict, and this makes it more likely that nations are going to misperceive one another when they see this. Go, i want you to join me in thanking kate, who set all of this up. [applause] host she had the real hard job. We had the fun part. And thank you to the panel. [applause] host and thanks to you for tuning in, for being here in person on a very sunny, warm, cambridge evening. Please come back and see us. Thanks again. [captions Copyright National cable satellite corp. 2017] [captioning performed by the national captioning institute, which is responsible for its caption content and accuracy. Visit ncicap. Org] look at ourere is a primetime schedule on the cspan networks. Starting at 8 00 p. M. Eastern here on cspan, the first president ial speeches to congress from president Ronald Reagan, george h. W. Bush, though clinton, george w. Bush, and barack obama. It is pulled tv, with books and authors on National Security issues, and on cspan3, American History tv, with programs looking back to the internment of japanese americans during world war ii. Announcer cspans washington journal, live, every day, with issues that impact you. Coming up wednesday morning, michael steele, former republican chair, talks about the party and President Trump a a monthit more than into his presidency. Then, under president obama, the Trump Administration of us to be as National Security and Foreign Policy efforts, as well as white house plans to roll out new dance, and vetting gui a look at new immigration to increase Immigration Enforcement in the United States. Be sure to watch cspan a posthumous washington journal, live on wednesday morning. Be sure to watch cspans washington journal. Watch President Trump. This congressp is going to be the busiest congress we have had in decades. On cspan and cspan. Org, and listen free on the cspan radio app. Announcer now, todays briefing with secretary sean spicer, discussing the immigration policy, the relation with the press, and border security. This is almost one hour. All rise. Mr. Spicer