Stanford cybersecurity expert Herb Lin said America may be at a “tipping point” regarding the rewards and risks of the Internet, unless new cybersecurity policies are adopted by the incoming Trump Administration. He speaks Dec. 7 at Stanford on the issue.

The costs of using the Internet and computational devices due to inadequate security may soon outweigh the benefits unless dramatic cybersecurity measures are taken, a Stanford scholar said.

Herbert Lin, a senior research scholar for cyber policy and security at Stanford’s Center for International Security and Cooperation (CISAC), serves on the President’s Commission on Enhancing National Cybersecurity, which on Dec. 2 issued strong recommendations to upgrade the nation’s cybersecurity systems.

Lin will speak Dec. 7 at Stanford about the report – his talk will be featured live on video. The 100-page report aims to inform the incoming Trump Administration about how to approach escalating cybersecurity dangers. The effort follows significant hacking of U.S. government systems in and accusations by the White House that Russia interfered in the U.S. presidential election.

The commission suggested both short- and long-term measures, such as fixing problems from the weakly protected ‘internet-of-things’; creating an assistant to the president for cybersecurity; and re-organizing responsibility for the cybersecurity of federal agencies, among others.

The report also urged getting rid of traditional passwords, which could help reduce identity theft. It also advised that the new administration train 100,000 new cybersecurity workers by 2020.

A research fellow at the Hoover Institution, Lin was recently interviewed by CISAC about the report:

What is the reason to move the burden of cybersecurity away from the user to higher levels of companies, government?

Taking the necessary and appropriate measures for cybersecurity is, for practical purposes, too complex for average end-users. A successful effort to push cybersecurity measures farther from the user will result in better security because security decisions will be made by those who are security experts rather than users that are unfamiliar with security.

Why is the White House the best entity to lead cybersecurity efforts?

Enhancing national cybersecurity requires a whole-of-government effort, indeed a whole-of-society effort.  The task is making a meaningful dent in a problem that is so large. Only with high-level leadership does that effort have any chance of success.

Will the distrust of the U.S. government by the technology community in general hinder this approach to cybersecurity? How can the tech world's trust in the government on cybersecurity issues be improved?

Distrust harms both sides – the U.S. government and the technology community.  The U.S. government loses the ability to enlist the cooperation of the private sector, which has many capabilities that it does not have, capabilities that would be useful in fulfilling its responsibilities to the American people. The tech sector invites harsh legislation and suspicion that work against its interests. At the same time, the distrust is not entirely unfounded, as both sides have indulged in apocalyptic rhetoric that has raised the temperature of the debate without much productive result.  But what I’m saying here represents a personal perspective, and isn’t part of the commission’s report.

What happens if these recommendations are not enacted or adopted? What happens to the typical American computer user? In the long run, if we do little or nothing, how will this affect the Internet – as an economic driver or engine for the economy, place where people connect?

President Obama created the commission because he believed that cybersecurity was a high national priority, a sentiment with which both presidential candidates agreed. If the nation does too little to improve its cybersecurity posture, the gap between the security we have and the security we need will only grow because the cybersecurity threat we face is growing. And if that is the case, the costs of using the Internet and computational devices due to inadequate security will outweigh the benefits – indeed, there is evidence that we are near such a tipping point today. Even now, a large fraction of Americans are unwilling to use the Internet for certain purposes due to security concerns – and I can tell you that I personally refrain from conducting certain transactions online for just such reasons.

Any other issues?

One of the most surprising aspects of the report was the process that produced it.  The chair of the commission is known to be a Democrat. The vice-chair is known to be a Republican.  Other than that, you would be hard-pressed to identify the political affiliations of anyone else on the commission on the basis of what they said. So it was thoroughly a nonpartisan effort that produced the report.

Herb Lin will speak at 4:30 p.m. Wednesday, Dec. 7 in the NEC Auditorium, Gates Computer Science Building Room B3. More information and live video information is available at http://ee380.stanford.edu. The title of the talk is “Charting a Cybersecurity Path for the Next Administration: Report of the President's Commission on Enhancing National Cybersecurity.” In February, President Obama announced a Cybersecurity National Action Plan to take a series of short-term and long-term actions to improve our nation’s cybersecurity posture.  A central feature of that plan is the non-partisan Commission on Enhancing National Cybersecurity.

Follow CISAC on Twitter at @StanfordCISAC and on Facebook at www.facebook.com/StanfordCISAC.

MEDIA CONTACTS

Herbert Lin, Center for International Security and Cooperation: (650) 497-8600, herbert.s.lin@stanford.edu

Clifton B. Parker, Center for International Security and Cooperation: (650) 725-6488, cbparker@stanford.edu

How is the current cooperative international order positioned to face the political forces of rising nationalism in the world?
A Conversation Series by United Nations University with CDDRL Deputy Director Stephen Stedman, watch here.

Toomas Hendrik Ilves, the former president of Estonia, will join Stanford University as a visiting fellow in January.

Ilves, whose title will be the Bernard and Susan Liautaud Visiting Fellow, is set to work at the Center for International Security and Cooperation in the Freeman Spogli Institute for International Studies. He served as the fourth president of Estonia from 2006 to 2016. During his career, he has been a diplomat and journalist, and was the leader of Estonia’s Social Democratic Party in the 1990s.

Ilves’ tentative start date at CISAC is Jan. 9, and his appointment will run through June 30. Afterwards, the Hoover Institution will extend his appointment for another full year. During his time on campus, Ilves said he plans to delve deeply into the intersections between information technology and security policy, areas that have long fascinated him during his career.

“Stanford has long been a place I enjoy visiting as one of the few if only universities to have top minds from both realms,” Ilves wrote in an email interview, noting how many Stanford scholars are studying these types of issues. He has some big projects in mind.

“After spending the past quarter of a century on digitizing Estonia, a country also faced with daunting security challenges, I plan to write a book on the foundations of a functioning digital society,” he said.

Ilves added, “Much of what we have seen in the past decade – massive hacks, data theft, privacy violations – come from fundamental weaknesses in the haphazard way our digital world has developed, where security is primarily an afterthought and a patch.”

He said that a secure and functional digital society has to be based on both legally and technically sound foundations. “I have argued and written for years that it’s the analog, legal basis of our digital world that determines if we are technologically secure.”

Parallel to this topic, Ilves said his most recent speeches and articles have examined the “challenges of an increasingly fissiparous and nationalist Europe.”

Michael McFaul, the director of FSI, said that Ilves’ interest in FSI and CISAC is a reflection of their scholarly reputations around the world.

"As president of Estonia, Toomas Ilves emerged as a world leader on issues related to cyber security, e-governance, and liberal ideas more generally. His intellectual and policy agenda fits perfectly with what we do at FSI,” McFaul said.

He noted, “We are very lucky to have him as the first Bernard and Susan Liautaud Visiting Fellow.”

Ilves also served in the Estonian government as the minister of foreign affairs from 1996 to 1998 and again from 1999 to 2002. In that position, he was in charge of European Union enlargement and NATO issues. Later, he was a member of the European Parliament from 2004 to 2006.

Ilves believes the challenge for all small European countries, Estonia included, is to maintain a functioning European Union as well as a strong NATO, the primary treaty basis of trans-Atlantic relations. Many significant political and security issues exist on the Continent, he noted.

“With elections across Europe increasingly demonstrating a turn toward nationalism and populism, the EU and NATO currently face their greatest challenge since their founding. As a small country that has consistently supported the EU and NATO as a matter of national security, for Estonia, this is a question of national survival,” said Ilves.

Follow CISAC on Twitter at @StanfordCISAC and on Facebook at www.facebook.com/StanfordCISAC.

MEDIA CONTACT

Clifton B. Parker, Center for International Security and Cooperation: (650) 725-6488, cbparker@stanford.edu