America's Cyber Future Security and Prosperity in the Information
Total Page:16
File Type:pdf, Size:1020Kb
America’s Cyber Future JUNE 2011 Security and Prosperity in the Information Age VOLUME II Edited by Kristin M. Lord and Travis Sharp Contributors: Robert E. Kahn, Mike McConnell, Joseph S. Nye, Jr. and Peter Schwartz (co-chairs); Nova J. Daly, Nathaniel Fick, Martha Finnemore, Richard Fontaine, Daniel E. Geer Jr., David A. Gross, Jason Healey, James A. Lewis, Kristin M. Lord, M. Ethan Lucarelli, Thomas G. Mahnken, Gary McGraw, Roger H. Miksad, Gregory J. Rattray, Will Rogers, Christopher M. Schroeder and Travis Sharp Acknowledgments The authors would like to thank the more than 200 people who generously contributed their time and expertise to this proj- ect. We are especially indebted to our co-chairs Bob Kahn, Mike McConnell, Joe Nye and Peter Schwartz for their tremendous support and guidance over the past year. We also thank our contributing authors for producing such insightful essays. We are particularly grateful to the many people who reviewed drafts of the papers included in this volume, including Irv Lachow, James Mulvenon, Charles Dunlap, Eric Rosenbach, Jeff Lord, Tom Gjelten, Greg Rattray, David Asher, Jeff Pryce, Andrew Lewman, Daniel Calingeart, David Gross, Nova Daly and several anonymous reviewers. In addition, we wish to thank the dozens of dedicated professionals in the U.S. government, armed services and private sector who candidly shared their perspectives. We also thank Global Business Network for hosting a workshop in San Francisco in February 2011, as well as the many technologists and other experts who attended. Peter Schwartz, David Babington and Audrey Plonk deserve special recognition for making the workshop a success. We would like to recognize the valuable contributions made by our colleagues at CNAS, particularly Nate Fick, John Nagl, Tom Ricks, Richard Fontaine, Andrew Exum, Christine Parthemore, Brian Burton, Bill Uhlmeyer, Richard Weitz and Will Rogers. Nora Bensahel was a diligent and helpful editor. Liz Fontaine provided her usual high caliber of design expertise. Finally, we offer special thanks to our colleagues Abe Denmark, who played a key role in launching this project and partici- pated in many of our working group sessions, and Jessica Glover and Jackie Koo, who provided scrupulous research and fact checking for this report. Readers should note that the views expressed in each essay of Volumes I and II belong to the author(s) alone. They do not necessarily reflect the views of the editors, co-chairs or any of the other contributing authors, nor do they necessarily reflect the views of the authors’ employers or any other organization. A Note about Funding This report was made possible, in part, through the generous support of the Markle Foundation. The opinions expressed in the report are those of the authors and do not necessarily reflect the views of the Markle Foundation. Some organizations and companies that are mentioned in this report or have vested interests related to cyber security sup- port CNAS financially. CNAS retains sole editorial control over its projects and maintains a broad and diverse group of more than one hundred funders including foundations, government agencies, corporations and private individuals. A complete list of CNAS’ financial supporters can be found at http://www.cnas.org/support/our-supporters. Cover Image (ISTOCK) JUNE 2011 America’s Cyber Future Security and Prosperity in the Information Age VOLUME II Edited by Kristin M. Lord and Travis Sharp Contributors: Robert E. Kahn, Mike McConnell, Joseph S. Nye, Jr. and Peter Schwartz (co- chairs); Nova J. Daly, Nathaniel Fick, Martha Finnemore, Richard Fontaine, Daniel E. Geer Jr., David A. Gross, Jason Healey, James A. Lewis, Kristin M. Lord, M. Ethan Lucarelli, Thomas G. Mahnken, Gary McGraw, Roger H. Miksad, Gregory J. Rattray, Will Rogers, Christopher M. Schroeder and Travis Sharp America’s Cyber Future JUNE 2011 Security and Prosperity in the Information Age About the Contributors (in order of appearance) Kristin M. Lord is Vice President and Director of Studies at the Center for a New American Security. Travis Sharp is the Bacevich Fellow at the Center for a New American Security. Joseph S. Nye, Jr. is University Distinguished Service Professor at the Kennedy School of Government at Harvard University. Mike McConnell is Executive Vice President of Booz Allen Hamilton and former Director of National Intelligence and Director of the National Security Agency. Gary McGraw is Chief Technology Officer of Cigital, Inc., a software security consultancy, and author of eight books on software security. Nathaniel Fick is Chief Executive Officer of the Center for a New American Security. Thomas G. Mahnken is Jerome E. Levy Chair of Economic Geography and National Security at the U.S. Naval War College and a Visiting Scholar at the Johns Hopkins School of Advanced International Studies. Gregory J. Rattray is a Partner at Delta Risk LLC and Senior Vice President for Security at BITS, the technology policy division of The Financial Services Roundtable. Jason Healey is Director of the Cyber Statecraft Initiative at the Atlantic Council and Executive Director of the Cyber Conflict Studies Association. Martha Finnemore is Professor of Political Science and International Affairs at The George Washington University. David A. Gross is a Partner at Wiley Rein LLP and a former Ambassador and Coordinator for International Communications and Information Policy at the State Department. Nova J. Daly is a Public Policy Consultant at Wiley Rein LLP and former Deputy Assistant Secretary for Investment Security in the Office of International Affairs at the Treasury Department. M. Ethan Lucarelli is an Associate at Wiley Rein LLP. Roger H. Miksad is an Associate at Wiley Rein LLP. James A. Lewis is a Senior Fellow and Director of the Technology and Public Policy Program at the Center for Strategic and International Studies. Richard Fontaine is a Senior Fellow at the Center for a New American Security. Will Rogers is a Research Associate at the Center for a New American Security. Christopher M. Schroeder is an Internet entrepreneur, Chief Executive Officer of HealthCentral. com and a member of the Center for a New American Security’s board of advisors. Daniel E. Geer, Jr. is Chief Information Security Officer of In-Q-Tel, the independent investment firm that identifies innovative technologies in support of the missions of the U.S. intelligence community. Robert E. Kahn is President and Chief Executive Officer of the Corporation for National Research Initiatives and co-inventor of the TCP/IP protocol that is the foundation of the modern Internet. Peter Schwartz is Co-Founder and Chairman of Global Business Network and a member of the 2 | Center for a New American Security’s board of directors. Table of Contents VOLUME I America’s Cyber Future: Security and Prosperity in the Information Age By Kristin M. Lord and Travis Sharp I. Executive Summary 7 II. Introduction 11 III. U.S. National Interests in Cyberspace 12 IV. The Nature of Cyber Threats 20 V. Current U.S. Government Efforts to Promote Cyber Security 31 VI. Policy Recommendations 37 VII. Conclusion 51 VOLUME II Chapter I: Power and National Security in Cyberspace 5 By Joseph S. Nye, Jr. Chapter II: Cyber Insecurities: The 21st Century Threatscape 25 By Mike McConnell Chapter III: Separating Threat from the Hype: 41 What Washington Needs to Know about Cyber Security By Gary McGraw and Nathaniel Fick Chapter IV: Cyberwar and Cyber Warfare 55 By Thomas G. Mahnken Chapter V: Non-State Actors and Cyber Conflict 65 By Gregory J. Rattray and Jason Healey Chapter VI: Cultivating International Cyber Norms 87 By Martha Finnemore Chapter VII: Cyber Security Governance: Existing Structures, 103 International Approaches and the Private Sector By David A. Gross, Nova J. Daly, M. Ethan Lucarelli and Roger H. Miksad Chapter VIII: Why Privacy and Cyber Security Clash 123 By James A. Lewis Chapter IX: Internet Freedom and Its Discontents: 143 Navigating the Tensions with Cyber Security By Richard Fontaine and Will Rogers Chapter X: The Unprecedented Economic Risks of Network Insecurity 165 By Christopher M. Schroeder Chapter XI: How Government Can Access Innovative Technology 183 By Daniel E. Geer, Jr. Chapter XII: The Role of Architecture in Internet Defense 203 By Robert E. Kahn Chapter XIII: Scenarios for the Future of Cyber Security 217 By Peter Schwartz | 3 America’s Cyber Future JUNE 2011 Security and Prosperity in the Information Age quote. — Author CHAPTER I: Power and National securitY in CYberspace By Joseph S. Nye, Jr. America’s Cyber Future JUNE 2011 Security and Prosperity in the Information Age quote. — Author POWER AND National SECURITY The cyber domain is a new and a volatile man- IN CYberspace made environment.* The characteristics of cyberspace often reduce power differentials among actors, and thus provide a good example of the diffusion of power that typifies global politics in this century. The largest powers are unlikely to be able to dominate cyberspace as much as they have dominated other domains like sea or air. While powerful nations have greater resources, they also have greater vulnerabilities. So, at this stage in the development of the technology, offense dominates defense in cyberspace. That in turn leads to new and complex dimensions in national security policy. The community of national security analysts is only beginning to grapple with the implications of the new technologies and what they mean for attack, deterrence, defense, negotiation, coop- eration and non-state actors. In the words of the JASON advisory panel of defense scientists (an independent group of scientists that advises the By Joseph S. Nye, Jr. government on technological and scientific issues), “People built all the pieces,” but “the cyberuniverse is complex well beyond anyone’s understanding and exhibits behavior that no one predicted, and sometimes can’t even be explained well.” The com- plexity goes beyond that of natural systems because it also involves human strategic interactions.