Hamilton on Foreign Policy #108: Cybersecurity for the Long Haul

Not so long ago, Americans thought of threats to our nation in terms of armies marching across borders, nuclear weapons in the hands of our enemies, missiles aimed at our homeland and 9/11 style terrorist attacks.

These are all serious dangers and we have to be ready to respond to them. But many experts today believe that cyberattacks are now the most urgent threat to our national security.

The cyber-world is new to many of us older folks. Understanding it requires learning new vocabulary, with talk about the internet, information security, logging into bank accounts or email inboxes, cyberinfrastructure and cyber targets, 5G networks, spear-phishing, spyware, and many other terms. We marvel at the ease with which our grandchildren have taken to the cyber world.

As the cyber world has exploded in scope and importance, cyber threats to the well-being of our people are multiplying each year in frequency and severity. The threats come from multiple directions. Some perpetrators are criminals, hackers, and malicious pranksters. Some are organizations. Others are hostile countries, including Russia, China, Iran, and North Korea. Each day our adversaries become more sophisticated, making it hard to keep our defenses up.

Our dependence on the internet is a necessity and a challenge. We rely on it for communication, banking, shopping, information storage, and a multitude of other daily tasks. It is convenient, adds immeasurable value to our economy and hugely increases the information available to us.

But the very connectedness it creates among us makes us more vulnerable to attacks.

Penetrating our networks is not hard but tracking and attributing the attacks is hard. Bad actors, who can use a multitude of techniques to achieve their many goals, often avoid identification and capture. They use the internet and social media to spread political chaos, mischief and disrupt elections and services.
Some are trying to steal money or force companies to pay them to stop denial-of-service attacks. Cyberattacks may cost the U.S. economy more than $100 billion a year, according to estimates.
Terrorists use the internet to promote propaganda and recruit members. And there is always the real threat of massive cyberattacks that could disrupt our economic system or cripple our electrical or communication grids.

For a long time, we have known about these threats, and we have tried for years to figure out how to respond. Congress has passed laws, and presidents have wrestled with the issue and issued about 20 executive orders on cybersecurity. We have developed penalties – most recently, new sanctions imposed in December on Russian intelligence operatives for their role in attempting to interfere in U.S. elections in 2016.

Our government has created a large bureaucracy of offices, bureaus and agencies to address the cyber-issues. Congress has held hearings, questioned officials and demanded action from the Defense Department, the National Security Agency and other governmental organizations. Much good work has been done. But we learn every day about new attacks and additional ways our accounts and data are vulnerable. We have done a lot right, but we have much more to do.

We have to develop stronger ways to deter these cyberattacks and step up our pace for developing both offensive and defensive cyber tools.

We need to share information better and integrate our responses in the public and private sectors. We have to offer companies liability protection and address the enormous privacy issues that arise with creating and storing massive amounts of data. We need to train a workforce with science and technology skills to create and deploy better cyber tools.

We need a lead agency in the U.S. government with the primary mission of cybersecurity. But we can’t rely on a government alone. All of us – including policymakers, the military establishment, law enforcement, and leaders in the private sector – must try to understand who the adversaries are, where they are, how they work, what their capabilities and intentions are and what we can do about it all.

The experts are right that this is the No. 1 threat to our economy, our privacy and our national security. And as the Director of National Intelligence Dan Coats said, nearly all of our information networks and systems will be at risk for years to come. We will not be able to declare victory soon and move on. We are in for the long haul.

By Lee H. Hamilton