"The Kofi Annan Commission on Elections and Democracy in the Digital Age found the rise of social media has caused irrevocable harm to global electoral integrity and democratic institutions—and the effects may get even worse," Paris Martineau writes in Wired. CDDRL's Deputy Director Stephen J. Stedman served as the Secretary-General of the Commission. Read here.

The science of cyber risk looks at a broad spectrum of risks across a variety of digital platforms. Often though, the work done within the field is limited by a failure to explore the knowledge of other fields, such as behavioral science, economics, law, management science, and political science. In a new Science Magazine article, “Cyber Risk Research Impeded by Disciplinary Barriers,” cyber risk experts and researchers at Stanford University make a compelling case for the importance of a cross-disciplinary approach. Gregory Falco, security researcher at the Program on Geopolitics, Technology, and Governance, and lead author of the paper, talked recently with the Cyber Policy Center about the need for a holistic approach, both within the study of cyber risk, and at a company level when an attack occurs.

CPC: Your recent perspective paper in Science Magazine highlights the issue of terminology when it comes to how organizations and institutions define a cyber attack. Why is it so important to have consistent naming when we are talking about cyber risk?

Falco: With any scientific discipline or field, there is a language for engaging with other experts. If there’s no consistent language or at least dialect for communication around cyber risk, it’s difficult to engage with scholars from different disciplines. For example: The phrase “cyber event” is contested and the threshold for what an organization considers to be a cyber event varies substantially. Some organizations consider someone pinging their network as a cyber event, others only consider something a cyber event once an intrusion has been publicly disclosed. So there’s a disparity when comparing metrics of cyber events from organization to organization because of the different thresholds of what’s considered an event.

CPC: We’ve all been sent one of those emails letting us know our data may have been compromised and your paper points out it’s nearly impossible to put foolproof protections into place; attacks are inevitable. Given that, how should companies weigh the various ways they can protect themselves?

Falco: The first exercise each organization should go through when they decide to be serious about cyber risk is to prioritize their assets. What is business critical? What is safety critical? Then, like all other risks, a cost-benefit analysis must be done for each asset based on its priority. If the asset is safety-critical, then resources should be allocated to help protect that asset or at least ensure its resilience. Trade-offs are inevitable, no company has unlimited resources. But starting with an understanding of where the priorities are, is critical.

CPC: In companies, cyber security often falls entirely to the Chief Information Security Officer (CISO). Your paper argues that’s shortsighted. What is gained when a company takes a more holistic approach?

Falco: Distributing responsibility across the organization catalyzes a security culture. A security culture is one where there is a constant vigilance or at least broad awareness of cybersecurity concerns throughout the organization. Fostering a security culture is often suggested as a mechanism to help reduce cyber risk in organizations. The problem with not distributing responsibility is that when something happens, it’s too easy to resort to finger-pointing at the CISO, and that’s counterproductive. Efforts after an attack should be on responding and being resilient, not finding the scapegoat.

CPC: Cyber risk largely focuses on prevention, but your paper argues that it’s what happens after an attack in that needs greater attention. Why is that?

Falco: Every organization will be attacked. However organizations can differentiate themselves from a cyber risk standpoint by appropriately managing the situation after an attack. Some of the most significant damages to organizations can be reputational if communication after an attack is unclear or botched. Poor communication after an attack can result in major regulatory fines or valuation adjustments as seen in cases like Yahoo and that can have major business implications. Communications aren’t the only important element of post-attack response. A thorough post-mortem of the organization’s response to the attack can be an important learning experience and a way to plan for future attacks.

CPC: Protecting against cyber attacks and the losses that go with them can obviously be costly for companies. You make a case for collaboration among different fields, say among data scientists and economists. How can that be encouraged?

Falco: We argue that cross-disciplinary collaboration rarely happens organically. Therefore, we call on funding agencies like the NSF or DARPA to specify a preference for cross disciplinary research when funding cyber risk projects. Typically, this isn’t currently a feature of calls for proposals, but for cyber risk programs it should be. We encourage researchers to explore cyber risk questions at the margins of their discipline. Those questions may lend themselves to potential overlap with other disciplines and foster a starting point for cross-disciplinary collaboration.

For more on these topics, see a full list of recent publications from the Cyber Policy Center and the Program on Geopolitics, Technology, and Governance.

"Ideologically, today’s autocrats are a more motley and pragmatic crew. They generally claim to be market friendly, but mainly they are crony capitalists, who, like Putin in Russia, Orban in Hungary, and Erdogan in Turkey, are first concerned with enriching themselves, their families, and their parties and support networks. Increasingly, they raise a common flag of cultural conservatism, denouncing the moral license and weakness of the “the liberal West” while advancing a virulent antiliberal agenda based on nationalism and religion," writes Larry Diamond. Read here. 

The U.S. government's global hunger and food security initiative, Feed the Future, has prevented 2.2 million children from experiencing malnutrition in sub-Saharan Africa, according to new research led by Stanford Health Policy's PhD candidate Tess Ryckman.

The researchers compared children’s health in 33 low- and middle-income countries in sub-Saharan Africa. In 12 of those countries, Feed the Future provided services such as agricultural assistance and financial services for farmers, as well as direct nutrition support, such as nutrient supplementation. 

The study, published online Dec. 11 in The BMJ, found a 3.9 percentage point decrease in chronic malnutrition among children served by Feed the Future, leading to 2.2 million fewer children whose development has been harmed by malnourishment.

“What we see with stunting rates is striking,” Ryckman said. “I would argue that 2 million fewer children stunted over seven years is major progress and puts a substantial dent in total stunting levels. And that’s 2 million children who will now have the levels of physical and cognitive development to allow them to reach their full potential.”

Stunting, or having a low height for a particular age, is a key indicator of child malnutrition. Children who aren’t properly nourished in their first 1,000 days are more likely to get sick more often, to perform poorly in school, grow up to be economically disadvantaged and suffer from chronic diseases, according to the World Health Organization.

A Controlled Study

Feed the Future is thought to be the world’s largest agricultural and nutrition program, with around $6 billion in funding from USAID (plus more from other federal agencies) between 2010 and 2015. Despite its size, much remains unknown about the effectiveness of the program.

The researchers analyzed survey data on almost 900,000 children younger than 5 in sub-Saharan Africa from 2000 to 2017. They compared children from the Feed the Future countries with those in countries that are not participants in the program, both before and after the program’s implementation in 2011.

The researchers found the results were even more pronounced — a 4.6 percentage point decline in stunting — when they restricted their sample to populations most likely to have been reached by program. These included children who were younger when the program began, rural areas where Feed the Future operated more intensively, and in countries where the program had greater geographic coverage.

“Our findings are certainly encouraging because it has been difficult for other programs and interventions to demonstrate impact on stunting, and this program has received a lot of funding, so it’s good to see that it’s having an impact,” Ryckman said.

Multifaceted Approach to Nutrition

Experts are divided about the best way to help the world’s 149 million malnourished children: Is assistance that directly targets nutrition, such as breastfeeding promotion or nutrient supplementation, more effective? Or is it also beneficial to tackle the problem at its root by supporting agriculture and confronting household poverty?

The authors, including Stanford Health Policy’s Eran Bendavid, MD, associate professor of medicine, and Jay Bhattacharya, MD, PhD, professor of medicine, a senior fellow (by courtesy) at the Freeman Spogli Institute of International Studies and a senior fellow senior fellow at the Stanford Institute for Economic Policy Research, said their analysis supports the value of a multifaceted approach to combating malnutrition among children, namely leveraging agriculture and food security interventions.

“Independent evaluations of large health policy programs such as Feed the Future help build the evidence base needed to tackle persistent patterns of undernutrition,” said Bendavid, an epidemiologist. “The widespread prevalence of stunting and chronic undernutrition is among the most common and yet most stubborn cause of underdevelopment in the world, and learning what works in this space is sorely needed.”

The researchers, including Stanford medical students Margot Robinson and Courtney Pederson, speculated that possible drivers of the program’s effectiveness include three features of Feed the Future’s design: its country-tailored approach; its focus on underlying drivers of nutrition, such as empowering female farmers; and its large scale and adequate funding.

The authors hope their independent evaluation of the program might lead to more funding and support for it. At the very least, they said, it should demonstrate to people working on Feed the Future and the broader global nutrition program community that programs focused mostly on agriculture and food security — indirect contributors to malnutrition — can lead to success.

Value Unknown

Feed the Future has been scaled back in recent years — it once served 19 countries and now reaches only 12. The program’s budget also remains somewhat murky.

“While there isn’t much data on the program’s funding under the Trump administration, the program appears to have been scaled back, at least in terms of the countries where it operates,” Ryckman said. “It’s possible that some of these gains could be lost, absent longer-term intervention from Feed the Future.”

Image

The researchers also did not look at whether the program provided high value for the money spent.

“While we find that it has been effective, it hasn’t led to drastic declines in stunting and it is unclear whether it is good value for money,” she said.

Ryckman also noted that USAID’s own evaluation of its program is tenuous because it looked only at before-and-after stunting levels in Feed the Future countries without comparing the results to a control group or adjusting for other sources of bias, which is problematic because stunting is slowly declining in most countries.

“These types of evaluations are misleading,” Ryckman said. “The U.S. government really needs to prioritize having their programs independently evaluated using more robust methods. That was part of our motivation for doing this study.”

Support for the study was provided by the National Institutes of Health (grant P20-AG17253), the National Science Foundation and the Doris Duke Charitable Foundation.