error

  • Could not retrieve the oEmbed resource.
Cybersecurity
Authors
News Type
News
Date
Paragraphs

 

Stanford senior Sarah Kunis said she and other CISAC honors students were introducing themselves to some senior White House advisors when President Barack Obama walked in the room.

“I couldn’t stop my jaw from dropping,” said Kunis. It was honor enough to have an hourlong  sit-down with National Security Advisor Susan Rice, Senior Advisor to the President Valerie Jarrett, and Homeland Security Advisor Lisa Monaco.

The CISAC Honors Students spend their senior year working on theses that focus on critical international security issues. They were eager to get the chance to talk to the three powerful Washington advisors.

The students had just been in the audience to hear Obama address a large Stanford and Silicon Valley gathering at the White House Summit on Cybersecurity and Consumer Protection on Feb. 13. They were then taken to a conference room in the same auditorium where Obama spoke.

“I was surprised to see Susan Rice’s nameplate, so I thought she was who the invitation referred to, but there was an empty chair with no nameplate, between her and Jarrett,” recalled Patrick Cirenza, another CISAC honors student and a research assistant for retired U.S. Gen. Jim Mattis, a visiting fellow at the Hoover Institution.

Then Obama walked in the room. The students were stunned – and nervous.

“I remember how sweaty my palms were,” said Cirenza. “I already had a visceral reaction seeing him at the podium so you can only imagine being in the same room with him. His presence fills the room.”

Taylor Grossman, another CISAC honors student whose thesis looks at the incentives and payoffs of warning the public about terrorist threats, said the conversation started off with Obama asking them whether they might consider careers that would protect the digital domain.

 

“But then we branched out and talked about a lot of different things,” she said. “The situation in Syria, public warning systems, education, the civil-military divide. It was really a whole range of issues.”

Before being joined by Jarrett and Rice, the students spoke with Cheri Caddy, director for cybersecurity outreach and integration in the National Security Council, for about an hour.

 

“We asked her pretty frank questions about cybersecurity, North Korea … defensive and offensive capabilities, and getting students interested in the field,” said Grossman. “She was quite candid and provided her own opinions.”

Grossman is a research assistant for CISAC Co-Director Amy Zegart, who is also a senior fellow at Hoover and garnered a shout-out from the president during his keynote address, thanking her for helping to convene the summit.

Jarrett talked to the students about sexual assault on campus. It was the second time the honors students had met the Stanford alumna; they first met her during their two-week Honors College in Washington, D.C. before the start of their senior year.

Obama initially directed the conversation, focusing on cybersecurity. He then opened it up for questions on any topic.

CISAC Honors Students take a selfie before President Obama addresses the White House Summit on Cybersecurity and Consumer Protection, Feb. 13, 2015.
Cirenza told the president his honors thesis evaluates the analogy between earlier nuclear deterrence and the development of cyber deterrence today.

“I told him I thought we are in the 1950s nuclear stage now with regards to cyber-deterrence,” he said. The president disagreed.

“He said, ‘That’s interesting, but I don’t think it’s the case, since there are gradations with cyber wars whereas nuclear warfare is more black and white.’”

Grossman asked the president about the role of the National Terrorism Advisory System, which replaced the color-coded Homeland Security system, and whether he envisioned a scenario in which the government would have to use it.

“He and Lisa Monaco focused on specific warning systems, which was interesting to me,” she said.

The topic turned to Syria when the president noticed that Kunis had brought along a copy of U.N. Ambassador Samantha Power’s book, “A Problem From Hell: America and the Age of Genocide.”

“I asked why we are not intervening in Syria and why we are not fulfilling our Right to Protect (R2P) obligation,” said Kunis. “President Obama said that the situation there was heartbreaking and that everyone looked at the problem to figure out what we should do to stop the suffering, while evaluating our interests. We cannot intervene without having a plan for the future – and we can’t overthrow governments.”

Cirenza said Obama noted that there are routine calls to intervene in Syria, but few to intervene in other nations, such as the Democratic Republic of Congo, where more than 5.4 million people have died from conflict-related causes since a civil war erupted in the central African nation in 1998.

President Obama also shared his view that he doesn't believe the United States would have been locked into the Iraq and Afghanistan wars as long as it has if there were a mandatory national draft in place. He asked students what they thought of instituting such a draft.

Almost none thought it a good idea.

Overall, the students said, it was the most incredible day of their Stanford careers“It’s going to be hard to look forward to much else,” said Cirenza, who now has adjustments to make to his honors thesis. “Pretty much downhill from here. Thanks, Obama.” 

 

 
 

 

Joshua Alvarez is a 2012 Stanford graduate and was a CISAC honors student.

Hero Image
students obama
President Obama meets with Stanford students, including three from the Honors Program at FSI's Center for International Security and Cooperation, at the White House Summit on Cybersecurity and Consumer Protection at Stanford University on Feb. 13, 2015.
Linda Cicero
All News button
1
Authors
News Type
News
Date
Paragraphs

 

11:33 A.M. PST

THE PRESIDENT:  Hello, Stanford!  (Applause.)  Thank you so much.  Thank you.  Thank you, everybody.  Have a seat.  Have a seat.

AUDIENCE MEMBER:  Yes, we can!

THE PRESIDENT:  Yes, we can!  (Applause.)

First of all, let me thank President Hennessy for not just the introduction but for your outstanding leadership at one of the great universities of the world.  (Applause.)  I’ve got to admit, like, I kind of want to go here.  (Laughter and applause.)  I was trying to figure out why it is that a really nice place like this is wasted on young people -- (laughter) -- who don’t fully appreciate what you got.  It’s really nice.  And everybody here is so friendly and smart, and it’s beautiful.  And what’s there not to like?

I want to thank you and everyone at Stanford for hosting this summit, especially Amy Zegart, George Triantis, and someone who served as a great advisor to me at the White House and as an outstanding ambassador to Russia before coming back to The Farm -- Mike McFaul.  (Applause.)

It is great to be here at Leland Stanford Junior University.  And I’m pleased to be joined by members of my team who bleed Cardinal red.  We’re infiltrated with Stanford people.  We’ve got Senior Advisor Valerie Jarrett, National Security Advisor Susan Rice, Secretary of Commerce Penny Pritzker.  (Applause.)  And, let’s face it, I like Stanford grads.  I noticed Steve Chu was around here, who helped lead our Energy Department for a while.  (Applause.)  And he’s now hanging out.  I’m also pleased to be joined by other members of my Cabinet -- our Secretary of Homeland Security Jeh Johnson is here, and our Small Business Administrator, Maria Contreras-Sweet.  And I want to acknowledge my tireless Homeland Security Advisor who helped, and continues to shape, our cybersecurity efforts -- Lisa Monaco.  (Applause.)  Thank you, Lisa.  

So I’d always heard about this campus, and everybody is riding bikes, and people hopping into fountains -- (laughter) -- and the current holder of The Axe.  (Applause.)  This is the place that made “nerd” cool.  (Laughter.)  I was thinking about wearing some black-rimmed glasses, some tape in the middle, but I guess that’s not what you do anymore.  Ambassador McFaul told me if I came to Stanford, you’d “talk nerdy to me.”  (Laughter.)       

But I’m not just here to enjoy myself.  As we gather here today, America is seeing incredible progress that we can all be proud of.  We just had the best year of job growth since the 1990s.  (Applause.)  Over the past 59 months, our businesses have created nearly 12 million new jobs, which is the longest streak of private sector job growth on record.  And in a hopeful sign for middle-class families, wages are beginning to rise again.

And, meanwhile, we’re doing more to prepare our young people for a competitive world.  Our high school graduation rate has hit an all-time high.  More Americans are finishing college than ever before.  Here at Stanford and across the country, we’ve got the best universities, we’ve got the best scientists, the best researchers in the world.  We’ve got the most dynamic economy in the world.  And no place represents that better than this region.  So make no mistake, more than any other nation on Earth, the United States is positioned to lead in the 21st century. 

And so much of our economic competitiveness is tied to what brings me here today, and that is America’s leadership in the digital economy.  It’s our ability -- almost unique across the planet -- our ability to innovate and to learn, and to discover, and to create, and build, and do business online, and stretch the boundaries of what’s possible.  That’s what drives us.  And so when we had to decide where to have this summit, the decision was easy, because so much of our Information Age began right here, at Stanford.  

It was here where two students, Bill Hewlett and Dave Packard, met and then, in a garage not far from here, started a company that eventually built one of the first personal computers, weighing in at 40 pounds.  (Laughter.)  It was from here, in 1968, where a researcher, Douglas Englebart, astonished an audience with two computers, connected “online,” and hypertext you could click on with something called a “mouse.” 

A year later, a computer here received the first message from another computer 350 miles away -- the beginnings of what would become the Internet.  And, by the way, it’s no secret that many of these innovations built on government-funded research is one of the reasons that if we want to maintain our economic leadership in the world, America has to keep investing in basic research in science and technology.  It's absolutely critical.  (Applause.)

So here at Stanford, pioneers developed the protocols and architecture of the Internet, DSL, the first webpage in America, innovations for cloud computing.  Student projects here became Yahoo and Google.  Those were pretty good student projects.  (Laughter.)  Your graduates have gone on to help create and build thousands of companies that have shaped our digital society -- from Cisco to Sun Microsystems, YouTube to Instagram, StubHub, Bonobos.  According to one study, if all the companies traced back to Stanford graduates formed their own nation, you’d be one the largest economies in the world and have a pretty good football team as well.  (Laughter and applause.)

And today, with your cutting-edge research programs and your new cyber initiatives, you’re helping us navigate some of the most complicated cyber challenges that we face as a nation.  And that’s why we’re here.  I want to thank all of you who have joined us today -- members of Congress, representatives from the private sector, government, academia, privacy and consumer groups, and especially the students who are here.  Just as we’re all connected like never before, we have to work together like never before, both to seize opportunities but also meet the challenges of this Information Age. 

And it’s one of the great paradoxes of our time that the very technologies that empower us to do great good can also be used to undermine us and inflict great harm.  The same information technologies that help make our military the most advanced in the world are targeted by hackers from China and Russia who go after our defense contractors and systems that are built for our troops.  The same social media we use in government to advocate for democracy and human rights around the world can also be used by terrorists to spread hateful ideologies.  So these cyber threats are a challenge to our national security. 

Much of our critical infrastructure -- our financial systems, our power grid, health systems -- run on networks connected to the Internet, which is hugely empowering but also dangerous, and creates new points of vulnerability that we didn’t have before.  Foreign governments and criminals are probing these systems every single day.  We only have to think of real-life examples -- an air traffic control system going down and disrupting flights, or blackouts that plunge cities into darkness -- to imagine what a set of systematic cyber attacks might do.  So this is also a matter of public safety.

As a nation, we do more business online than ever before -- trillions of dollars a year.  And high-tech industries, like those across the Valley, support millions of American jobs.  All this gives us an enormous competitive advantage in the global economy.  And for that very reason, American companies are being targeted, their trade secrets stolen, intellectual property ripped off.  The North Korean cyber attack on Sony Pictures destroyed data and disabled thousands of computers, and exposed the personal information of Sony employees.  And these attacks are hurting American companies and costing American jobs.  So this is also a threat to America’s economic security.

As consumers, we do more online than ever before.  We manage our bank accounts.  We shop.  We pay our bills.  We handle our medical records.  And as a country, one of our greatest resources are the young people who are here today --digitally fearless and unencumbered by convention, and uninterested in old debates.  And they’re remaking the world every day.  But it also means that this problem of how we secure this digital world is only going to increase. 

I want more Americans succeeding in our digital world.  I want young people like you to unleash the next waves of innovation, and launch the next startups, and give Americans the tools to create new jobs and new businesses, and to expand connectivity in places that we currently can't imagine, to help open up new world and new experiences and empower individuals in ways that would seem unimaginable 10, 15, 20 years ago. 

And that’s why we’re working to connect 99 percent of America’s students to high-speed Internet -- because when it comes to educating our children, we can’t afford any digital divides.  It’s why we’re helping more communities get across to the next generation of broadband faster, with cheaper Internet, so that students and entrepreneurs and small businesses across America, not just in pockets of America, have the same opportunities to learn and compete as you do here in the Valley.  It’s why I’ve come out so strongly and publicly for net neutrality, for an open and free Internet -- (applause) -- because we have to preserve one of the greatest engines for creativity and innovation in human history.

So our connectivity brings extraordinary benefits to our daily lives, but it also brings risks.  And when companies get hacked, Americans’ personal information, including their financial information, gets stolen.  Identity theft can ruin your credit rating and turn your life upside down.  In recent breaches, more than 100 million Americans had their personal data compromised, including, in some cases, credit card information.  We want our children to go online and explore the world, but we also want them to be safe and not have their privacy violated.  So this is a direct threat to the economic security of American families, not just the economy overall, and to the wellbeing of our children, which means we’ve got to put in place mechanisms to protect them.

So shortly after I took office, before I had gray hair -- (laughter) -- I said that these cyber threats were one of the most serious economic national security challenges that we face as a nation, and I made confronting them a priority.  And given the complexity of these threats, I believe we have to be guided by some basic principles.  So let me share those with you today.

First, this has to be a shared mission.  So much of our computer networks and critical infrastructure are in the private sector, which means government cannot do this alone.  But the fact is that the private sector can’t do it alone either, because it’s government that often has the latest information on new threats.  There’s only one way to defend America from these cyber threats, and that is through government and industry working together, sharing appropriate information as true partners. 

 Second, we have to focus on our unique strengths.  Government has many capabilities, but it’s not appropriate or even possible for government to secure the computer networks of private businesses.  Many of the companies who are here today are cutting-edge, but the private sector doesn’t always have the capabilities needed during a cyber attack, the situational awareness, or the ability to warn other companies in real time, or the capacity to coordinate a response across companies and sectors.  So we’re going to have to be smart and efficient and focus on what each sector does best, and then do it together.

Third, we’re going to have to constantly evolve.  The first computer viruses hit personal computers in the early 1980s, and essentially, we’ve been in a cyber arms race ever since.  We design new defenses, and then hackers and criminals design new ways to penetrate them.  Whether it’s phishing or botnets, spyware or malware, and now ransomware, these attacks are getting more and more sophisticated every day.  So we’ve got to be just as fast and flexible and nimble in constantly evolving our defenses. 

And fourth, and most importantly, in all our work we have to make sure we are protecting the privacy and civil liberty of the American people.  And we grapple with these issues in government.  We’ve pursued important reforms to make sure we are respecting peoples’ privacy as well as ensuring our national security.  And the private sector wrestles with this as well.  When consumers share their personal information with companies, they deserve to know that it’s going to be protected.  When government and industry share information about cyber threats, we’ve got to do so in a way that safeguards your personal information.  When people go online, we shouldn’t have to forfeit the basic privacy we’re entitled to as Americans.

In recent years, we’ve worked to put these principles into practice.  And as part of our comprehensive strategy, we’ve boosted our defenses in government, we’re sharing more information with the private sector to help those companies defend themselves, we’re working with industry to use what we call a Cybersecurity Framework to prevent, respond to, and recover from attacks when they happen.

And, by the way, I recently went to the National Cybersecurity Communications Integration Center, which is part of the Department of Homeland Security, where representatives from government and the private sector monitor cyber threats 24/7.  And so defending against cyber threats, just like terrorism or other threats, is one more reason that we are calling on Congress, not to engage in politics -- this is not a Republican or Democratic issue -- but work to make sure that our security is safeguarded and that we fully fund the Department of Homeland Security, because it has great responsibilities in this area.

So we’re making progress, and I’ve recently announced new actions to keep up this momentum.  We’ve called for a single national standard so Americans know within 30 days if your information has been stolen.  This month, we’ll be proposing legislation that we call a Consumer Privacy Bill of Rights to give Americans some baseline protections, like the right to decide what personal data companies collect from you, and the right to know how companies are using that information.  We’ve proposed the Student Digital Privacy Act, which is modeled on the landmark law here in California -- because today’s amazing educational technologies should be used to teach our students and not collect data for marketing to students.

And we’ve also taken new steps to strengthen our cybersecurity -- proposing new legislation to promote greater information sharing between government and the private sector, including liability protections for companies that share information about cyber threats.  Today, I’m once again calling on Congress to come together and get this done.

And this week, we announced the creation of our new Cyber Threat Intelligence Integration Center.  Just like we do with terrorist threats, we’re going to have a single entity that’s analyzing and integrating and quickly sharing intelligence about cyber threats across government so we can act on all those threats even faster.

And today, we’re taking an additional step -- which is why there’s a desk here.  You were wondering, I'm sure.  (Laughter.)  I’m signing a new executive order to promote even more information sharing about cyber threats, both within the private sector and between government and the private sector.  And it will encourage more companies and industries to set up organizations -- hubs -- so you can share information with each other.  It will call for a common set of standards, including protections for privacy and civil liberties, so that government can share threat information with these hubs more easily.  And it can help make it easier for companies to get the classified cybersecurity threat information that they need to protect their companies.

I want to acknowledge, by the way, that the companies who are represented here are stepping up as well.  The Cyber Threat Alliance, which includes companies like Palo Alto Networks and Symantec, are going to work with us to share more information under this new executive order.  You’ve got companies from Apple to Intel, from Bank of America to PG&E, who are going to use the Cybersecurity Framework to strengthen their own defenses.  As part of our BuySecure Initiative, Visa and MasterCard and American Express and others are going to make their transactions more secure.  Nationstar is joining companies that are giving their companies [customers] another weapon to battle identity theft, and that's free access to their credit scores. 

And more companies are moving to new, stronger technologies to authenticate user identities, like biometrics -- because it’s just too easy for hackers to figure out usernames and passwords, like “password.”  (Laughter.)  Or “12345 -- (laughter) -- 7.”  (Laughter.)  Those are some of my previous passwords.  (Laughter.)  I've changed them since then.  (Applause.)  

So this summit is an example of what we need more of -- all of us working together to do what none of us can achieve alone.  And it is difficult.  Some of the challenges I’ve described today have defied solutions for years.  And I want to say very clearly that, as somebody who is a former constitutional law teacher, and somebody who deeply values his privacy and his family’s privacy -- although I chose the wrong job for that -- (laughter) -- but will be a private citizen again, and cares deeply about this -- I have to tell you that grappling with how government protects the American people from adverse events while, at the same time, making sure that government itself is not abusing its capabilities is hard. 

The cyber world is sort of the wild, wild West.  And to some degree, we're asked to be the sheriff.  When something like Sony happens, people want to know what can government do about this.  If information is being shared by terrorists in the cyber world and an attack happens, people want to know are there ways of stopping that from happening.  By necessity, that means government has its own significant capabilities in the cyber world.  But then people, rightly, ask, well, what safeguards do we have against government intruding on our own privacy?  And it's hard, and it constantly evolves because the technology so often outstrips whatever rules and structures and standards have been put in place, which means that government has to be constantly self-critical and we have to be able to have an open debate about it.  

But we’re all here today because we know that we're going to have to break through some of these barriers that are holding us back if we are going to continue to thrive in this remarkable new world.  We all know what we need to do.  We have to build stronger defenses and disrupt more attacks.  We have to make cyberspace safer.  We have to improve cooperation across the board.  And, by the way, this is not just here in America, but internationally -- which also, by the way, makes things complicated because a lot of countries don't necessarily share our investment -- or our commitment to openness, and we have to try to navigate that.

But this should not be an ideological issue.  And that’s one thing I want to emphasize:  This is not a Democratic issue, or a Republican issue.  This is not a liberal or conservative issue.  Everybody is online, and everybody is vulnerable.  The business leaders here want their privacy and their children protected, just like the consumer and privacy advocates here want America to keep leading the world in technology and be safe from attacks.  So I’m hopeful that through this forum and the work that we do subsequently, that we're able to generate ideas and best practices, and that the work of this summit can help guide our planning and execution for years to come.

After all, we are just getting started.  Think about it.  Tim Berners-Lee, from his lab in Switzerland, invented the World Wide Web in 1989, which was only 26 years ago.  The great epochs in human history -- the Bronze Age, Iron Age, Agricultural Revolution, Industrial Revolution -- they spanned centuries.  We’re only 26 years into this Internet Age.  We’ve only scratched the surface.  And as I guess they say at Google, “The future is awesome.”  (Laughter.)  We haven’t even begun to imagine the discoveries and innovations that are going to be unleashed in the decades to come.  But we know how we’ll get there.

Reflecting on his work in the 1960s on ARPANET, the precursor of the Internet, the late Paul Baran said this:  “The process of technological developments is like building a cathedral.  Over the course of several hundred years, new people come along and each lays down a block on top of the old foundations, each saying, ‘I built the cathedral.’  And then comes along an historian who asks, ‘Well, who built the cathedral?’”  And Baran said, “If you’re not careful, you can con yourself into believing that you did the most important part.  But the reality is that each contribution has to follow on to previous work.  Everything is tied to everything else.”

Everything is tied to everything else.  The innovations that first appeared on this campus all those decades ago -- that first mouse, that first message -- helped lay a foundation.  And in the decades since, on campuses like this, in companies like those that are represented here, new people have come along, each laying down a block, one on top of the other.  And when future historians ask who built this Information Age, it won’t be any one of us who did the most important part alone.  The answer will be, “We all did, as Americans.”

And I’m absolutely confident that if we keep at this, if we keep working together in a spirit of collaboration, like all those innovators before us, our work will endure, like a great cathedral, for centuries to come.  And that cathedral will not just be about technology, it will be about the values that we’ve embedded in the architecture of this system.  It will be about privacy, and it will be about community.  And it will be about connection.  What a magnificent cathedral that all of you have helped to build.  We want to be a part of that, and we look forward to working with you in the future.

Thank you for your partnership.  With that, I’m going to sign this executive order.  Thank you.  (Applause.)

                                      END                12:03 P.M. PST

All News button
1
Authors
News Type
News
Date
Paragraphs

Corporate leaders and government agencies must work more closely together to safeguard computer networks from cyber attacks, President Barack Obama said Friday during a speech at Stanford University.

“This has to be a shared mission,” Obama said. “Government cannot do this alone. But the private sector cannot do it alone, either.”

Following his 30-minute address, Obama signed an executive order creating a framework for how companies can better share cyber data with the government. Obama said the order creates “hubs” that will allow businesses to share security information with one another and will also give corporations access to classified threat information that could potentially help protect them.

And he stressed the need to balance privacy protection with a need for increased security against hackers who threaten the country’s economy and public safety.

“Grappling with how the government protects the American people from adverse events while making sure the government itself is not abusing its capabilities is hard,” Obama said. “The cyber world is the wild wild west. To some degree, we’re asked to be the sheriff.”

And he acknowledged that it’s more than reasonable to ask “what safeguards do we have against the government intruding on our own privacies?”

“When we go online, we shouldn’t have to forfeit the basic rights to privacy we have as Americans,” Obama said.

The president’s remarks were delivered during a White House Summit on Cybersecurity and Consumer Protection hosted at Stanford. The daylong event included panels moderated by Homeland Security Secretary Jeh Johnson and Commerce Secretary Penny Pritzker and attended by other government officials, Stanford scholars and the chief executives of major technology and health care companies, public utilities and financial institutions. He also surprised a group of Stanford students, including three honors students at FSI's Center for International Security and Cooperation, with an in-depth talk about global issues.

“Stanford’s proximity and sustained relationships with Silicon Valley are important assets in building a more secure cyber infrastructure,” Stanford President John Hennessy said in his welcoming remarks Friday morning. “But we need – and we have today – industry from across the country representing the many sectors that are connected to cyber systems.”

Friday’s summit came three months after Stanford launched a major Cyber Initiative. The initiative – funded with a $15 million grant from the William and Flora Hewlett Foundation – brings together faculty and researchers from across campus to address the challenges posed by cyber technologies. It also intends to connect their academic work with policymakers and industry leaders.

 

 

"This is the beginning of a new challenge for the government and a new field of study for us,” Michael McFaul, director and senior fellow at the university’s Freeman Spogli Institute for International Studies, said after the president’s remarks. McFaul, who is also a senior fellow at the Hoover Institution, served as Obama’s ambassador to Russia.

“For a president to come and talk about these issues is a huge boost to this as a subject of real inquiry. It's rare that the White House do a summit not at the White House. It shows the importance of this institution, the initiative and the collaboration that need to take place between universities, government and the private sector."

Obama ticked off a number of milestones that are the stuff of Stanford and Silicon Valley lore – the partnership between William Hewlett and David Packard, the creation of the computer mouse, the birth of Google, Yahoo, and dozens of other tech companies that have redefined how life is lived around the world.

“When we had to decide where to have this summit, the decision was easy,” Obama said, adding that Stanford is helping to “lead the way” technology is developed and used.

Those points resonated with students who were able to attend the speech after receiving tickets through a lottery.

"So much that is done in Silicon Valley got its start here," said Jason Chen, a sophomore interested in computer science and foreign languages. "Even though I don't know what exactly I'm going to do, what part I may contribute, (Obama) made us all connected to each other, part of the same community."

Obama also cited the university’s role in keeping a policy-relevant perspective when it comes to addressing issues of personal privacy and security against cyber threats.  He also acknowledged the Stanford graduates and faculty members who have served in his administration – including Pritzker and McFaul; Valerie Jarrett, Obama’s senior adviser; Susan Rice, the U.S. ambassador to the United Nations; and Steven Chu, who served as Obama’s energy secretary.

 

More multimedia content about the summit here.

students obama President Obama meets with Stanford students, including three from the Honors Program at FSI's Center for International Security and Cooperation, at the White House Summit on Cybersecurity and Consumer Protection at Stanford University on Feb. 13, 2015.

 

The summit and Obama’s executive order come on the heels of high-profile computer network attacks that helped make the case for Obama to put cybersecurity at the top of his agenda. Hackers have breached the computer systems of  federal agencies, Sony Pictures, Home Depot, Target, and Anthem – the nation’s second-largest health insurer.

The Obama administration also announced this week the creation of the Cyber Threat Intelligence Integration Center, which will share and help monitor cybersecurity intelligence gathered by government agencies.

Amy Zegart, co-director of the Center for International Security and Cooperation and a senior fellow at Hoover, said Stanford is an obvious place for Obama to discuss the responsibilities of tech companies when it comes to the safety of computer networks.

“The most important message that came across today is that this effort crosses all the traditional boundaries in academia, in industry, in government,” said Zegart, who has been a key player in the university’s Cyber Initiative and met with Obama just before the president delivered his remarks. “Cybersecurity is the ultimate team sport and the summit brought all the elements of the team together."

And Kathy Garcia, a sophomore majoring in management science and engineering, said the president spoke about cybersecurity and consumer protection in a way that everyone could understand.

"He made a good point that to be successful both the public and the private sectors have to work together," Garcia said

Before Obama’s remarks, Apple CEO Tim Cook talked about the privacy concerns that are inherent to data sharing. But he said the private sector and government agencies could work together to protect the safety and privacy of customers and citizens.

“Safeguarding the world of digitized personal information is an enormous task,” he said. “And no single company or organization can accomplish it on its own. That is why we’re committed to engaging productively with the White House and Congress and putting the results of these conversations into action.”

Other business leaders attending the summit agreed.

"I think the president is really trying to come to grips with a really big problem that's ever expanding,” said RSA executive chairman Art Coviello. “He's doing it by executive order, but as was said so many times today, we need congressional action as well. We also need to ensure that we create the trust that we need between government and private sector to ensure that we can have this public-private partnership. As a starting point, I think (the summit) was terrific, but let's see a lot of action coming out of it."

As weighty as the substance of his talk was, Obama opened his talk with some lighthearted comments about the bicycle-riding, fountain-splashing, Cardinal-obsessed Stanford students who have “made nerd cool.”

“Ambassador McFaul told me if I came to Stanford, you'd talk nerdy to me,” Obama said.

Then, getting to business, the president said: “I’m not just here to enjoy myself.”

A half-hour later, he signed his executive order and walked off the stage in Memorial Auditorium with a wave to the audience.

 

Brooke Donald, Beth Duff-Brown, Amy Adams, Kathleen Sullivan, Ker Than, Bjorn Carey and Tom Abate contributed to this report.

Hero Image
obamaonstage
President Barack Obama onstage at the White House Summit on Cybersecurity and Consumer Protection on Feb. 13.
Linda Cicero / University Communications
All News button
1
Authors
News Type
News
Date
Paragraphs

 

Herb Lin has a long agenda crafted from big ideas.

As CISAC’s inaugural senior research scholar for cyber policy and security, Lin intends to make Stanford the premier hub for academic research and public policy in an effort to protect the world’s computer networks against cyber attacks.

“When I was recruited, Stanford told me to think big. So I’m thinking big,” says Lin, who comes to Stanford from the National Research Council of the National Academies in Washington, D.C., where he was chief scientist at the Computer Science and Telecommunications Board.

“Part of my job is also to find a way to build cyber connections to other parts of the campus – law, medicine, the business school, engineering – so there are a variety of interesting possibilities that I’d like to tackle.”

Even before taking up his new role at Stanford last month, Lin worked with CISAC co-director Amy Zegart to convene a three-day boot camp that brought together Silicon Valley heavyweights and congressional staffers working on critical cyber legislation.

Lin wants to launch a policy journal devoted to research about cybersecurity. He hopes to construct the university’s first undergraduate courses about the foreign policy and economic implications of cybersecurity, as well as the risk analysis of cyberspace. He will represent Stanford's efforts in public commentaries, such as the one he wrote for The Wall Street Journal about how companies can ward off hackers.

And Lin was instrumental in facilitating the Feb. 12-13 White House Summit on Cybersecurity and Consumer Protection at Stanford University. President Barack Obama addressed the summit, the first time a sitting U.S. president conducted business on the Stanford campus in 40 years.

“Obviously the president has a great bully pulpit here, and is highlighting the importance of cybersecurity on the national policy agenda,” said Lin. “We are particularly delighted that he’s come to Stanford – which is recognition of our role in advancing the cybersecurity interests of the nation.”

Lin, who took up his new role at CISAC in January and is also a research fellow at the Hoover Institution, plans to reach across campus to help the university establish a cohesive strategy for the intersection of cyber policy and international security.

 

 

“Cyber touches many facets of life,” said Lin, who has a Ph.D. in physics from MIT. “Some of us are interested in the implications of cyber for international security and foreign relations. Others focus on how protect the nation’s critical infrastructure. Still others are trying to develop tools that can be used to make better decisions about consumer protections. I’d like to bring all of that under one coherent theme.”

Lin also helped organize the Department of Commerce’s National Institute of Standards and Technology workshop at Stanford on Feb. 12. The roundtable, which was in coordination with the White House summit, brought together chief technology and security executives to discuss the challenges of implementing consumer protection technologies in real-world conditions.

Lin moderated a panel at that workshop about academic research that has applications for consumer protections against cyber threats. Michael Daniel, special assistant to the president and cybersecurity coordinator at the White House, gave the keynote at the workshop.

Cybersecurity has become a priority for the Obama administration. The White House in October launched the BuySecure initiative, which includes reforms such as securing payment systems and preventing identity theft. Obama also spoke about cybersecurity in his State of the Union address on Jan. 20.

“No foreign nation, no hacker, should be able to shut down our networks, steal our trade secrets or invade the privacy of American families, especially our kids,’ Obama said.

Track II Diplomacy

Just as CISAC scholars have for decades been involved in Track II diplomacy in foreign policy, nuclear arms control, and counterinsurgency, Lin would like to see Stanford build on that by facilitating dialogue with other nations about ways to protect and defend their digital networks against cyber attacks and breaches.

“CISAC, as you know, has a long tradition of having nuclear dialogue with China and Russia, even during the coldest periods of the Cold War,” said Lin. “I’d like there to be a Track II diplomacy effort for cyber based here at Stanford, which many Chinese regard as the world’s No. 1 university.  That’s a very attractive platform from which a cyber dialog can be started and sustained.”

CISAC Senior Research Scholar for Cyber Policy and Security, and a research fellow at the Hoover Institution, says to understand cybersecurity you must first understand the basic components of locks and keys.

Finally, Lin intends to work with academics and scientists at Columbia University and the American Academy of Arts and Sciences to establish a boot camp for scholars of international relations and political science who want to work on cyber issues.

Last August, Lin worked with Zegart – who is also a senior fellow and associate director for academic affairs at Hoover – to bring in two dozen senior congressional staffers for a rigorous boot camp that paired them with military, academic and technology experts working at the highest levels of cybersecurity.

The three-day camp drew such names at Google Chairman Eric Schmidt and Facebook’s Chief Information Officer Joe Sullivan. Many of the congressional staffers said it was the first time they’d had the chance to closely interact with the very tech executives for whom they are working on protections and legislation.

Stanford announced in November it had launched the Stanford Cyber Initiative with the support of a Hewlett Foundation grant of $15 million. The initiative will take an interdisciplinary approach to address the challenges raised by cyber technologies.

Michael McFaul, director of CISAC’s parent organization, the Freeman Spogli Institute for International Studies, said Stanford is poised to lead in the cyber arena.

“We have a tradition and an ability to do things in an interdisciplinary way,” said McFaul, a professor of political science and a senior fellow at Hoover.

“I think we’re uniquely qualified and uniquely placed to tackle all those here at Stanford, especially because we sit at the heart of Silicon Valley,” said McFaul, who was the U.S. ambassador to Russia for President Obama before returning to Stanford last year. “I expect to see Stanford become the leading institution in the world for addressing cybersecurity issues.”

Readers can learn more about Stanford University’s push into cybersecurity here.

Hero Image
herb locks
CISAC Senior Research Scholar for Cyber Policy and Security, and a research fellow at the Hoover Institution, says to understand cybersecurity you must first understand the basic components of locks and keys.
Rod Searcey
All News button
1
News Type
News
Date
Paragraphs

Stanford will welcome President Barack Obama to the campus Friday, Feb. 13, where he will address the White House Summit on Cybersecurity and Consumer Protection.  The president will join top-level government officials, corporate CEOs and Stanford faculty members who will gather to discuss pressing issues at the all-day summit organized by the White House.

President Obama is expected to deliver the keynote remarks at the event, which will be held in Memorial Auditorium and in the Cemex Auditorium at the Stanford Graduate School of Business. The invitation-only event will not be open to the public, but Stanford students can register for a lottery to obtain tickets.  Stanford faculty, students and staff members currently researching cyber-related issues have been invited to take part in panels and conversations.

The summit will be Webcast live in its entirety here for those unable to attend in person, and more details will be posted at WhiteHouse.gov/CyberSummit.

 

 

The event will mark the first time that a sitting U.S. President has made public remarks at Stanford since 1975, when then President Gerald Ford dedicated the Crown Quadrangle at the Stanford Law School. President Herbert Hoover addressed students at Stanford in 1932, and President Theodore Roosevelt spoke at Stanford in 1903.  President Bill Clinton was a visitor to campus during his presidency, but in his private capacity as a Stanford parent to daughter Chelsea Clinton.

The campus community can expect further information about parking and transportation changes as a result of the president's visit as event details are finalized.

President Obama announced the full-day White House cyber summit during a Jan. 13 speech and said "It's going to bring everybody together – industry, tech companies, law enforcement, consumer and privacy advocates, law professors who are specialists in the field, as well as students – to make sure that we work through these issues in a public, transparent fashion."

From increasing cybersecurity information sharing to improving adoption of more secure payment technologies, topics listed by the White House that the summit will address:

  • Public-Private Collaboration on Cybersecurity;

  • Improving Cybersecurity Practices at Consumer-Oriented Businesses and Organizations;

  • Promoting More Secure Payment Technologies;

  • Cybersecurity Information Sharing;

  • International Law Enforcement Cooperation on Cybersecurity;

  • Improving Authentication: Moving Beyond the Password.

The White House summit is also the next step in the President's BuySecure Initiative, which was launched in November 2014, and will help advance national efforts the government has led over the last two years with executive orders on consumer financial protection and critical cybersecurity infrastructure.

Stanford announced a major Cyber Initiative in November that will apply broad campus expertise to the diverse challenges cyber-technologies pose for virtually every facet of our personal, governmental and economic lives. Funded with a $15 million grant from the William and Flora Hewlett Foundation, the Stanford Cyber Initiative draws upon Stanford's experience with multi-disciplinary, university-wide initiatives to focus research on the core themes of trustworthiness, governance and the unexpected impacts of technological change.

While the agenda for the White House summit has not yet been finalized, among the Stanford faculty members and researchers invited to participate are Amy Zegart, co-director of the Center for International Security and Cooperation (CISAC) and a senior fellow at the Hoover Institution; Stanford Law Professor George Triantis, who chairs the Cyber Initiative; John Mitchell, vice provost for teaching and learning and professor of computer science; and Herb Lin, senior research scholar for cyber policy and security at CISAC and a Hoover research fellow. Stanford President John Hennessy is slated to open the summit and will have the honor of introducing President Obama.

Stanford is preparing for a significant media attendance for the event, and coverage is expected by major television networks and more than 200 journalists from around the world. 

Students interested in registering for the student ticket lottery can consult the Stanford Ticket Office website for further information Monday.  Registration will close Tuesday at 11:59 p.m.

We will be updating this social media story about the summit:

 

 
Hero Image
obama security The White House
All News button
1
Authors
News Type
News
Date
Paragraphs

 

The United States has thrust itself and the world into the era of cyber warfare, Kim Zetter, an award-winning cybersecurity journalist for WIRED magazine, told a Stanford audience. Zetter discussed her book “Countdown to Zero Day,” which details the discovery and unraveling of Stuxnet, the world’s first cyber weapon. 

Stuxnet was the name given to a highly complex digital malware that targeted, and physically damaged, Iran’s clandestine nuclear program from 2007 until its cover was blown in 2010 by computer security researchers. The malware targeted the computer systems controlling physical infrastructure such as centrifuges and gas valves.

Reports following its discovery attributed the creation and deployment of Stuxnet to the United States and Israel. The New York Times quoted anonymous U.S. officials claiming responsibility for Stuxnet. 

Zetter began reporting on the cyber weapon in 2010.

“When the first news came out, I didn’t think much of it,” Zetter told a CISAC seminar on Monday. The title of her book refers to a “zero-day attack," which exploits a previously unknown vulnerability in a computer application or operating system.

“Watching the Symantec researchers unravel Stuxnet, I knew what fascinated me was the process and brilliance of the researchers. The detective story is what pulled me in.” 

Zetter’s book follows computer security researchers from around the world as they discover and disassemble Stuxnet over the course of months, much longer than any time spent on typical malware. The realization that Stuxnet was the world’s first cyber weapon sent shock waves throughout the tech community, yet did not create as much of a stir in mainstream society. 

“It’s funny because a lot of people still don’t know Stuxnet or haven’t even heard of it,” Zetter said. “The recent vandalization of Sony seems to have finally gotten people’s attention. It was not a case of true cyber warefare, but I'm glad that my book came out right before it happened because its perception as a nation-state attack has led to interest in all nation-state attacks, including Stuxnet. The Snowden leaks also put cyber warfare on the map.” 

 

“Countdown to Zero” also places Stuxnet in political context. The first version of Stuxnet was built and unleashed by the Bush administration in 2007, according to Zetter. Iran accelerated its enrichment process in 2008, leading to fears it would have enough uranium to build a bomb by 2010. President Barack Obama inherited the program; he not only continued it,but accelerated it. Another, more aggressive version of Stuxnet was unleashed in June 2009 and again in 2010. Obama gave the order to unleash Stuxnet while publicly demanding Iran to open itself up to negotiations. 

The effectiveness of the world’s first cyber weapon remains a subject of debate. The most optimistic assessment of Stuxnet is that it delayed and slowed Iran’s uranium development enough to dissuade Israel from unilaterally striking the country, and it afforded time for intelligence and diplomatic efforts. Stuxnet contributed to dissension and frustration among the upper ranks of Iran’s government (the head of Iran’s nuclear program was replaced) and bought time for harsh economic sanctions to impact the Iranian public.

“Stuxnet actually had very little effect on Iran’s nuclear program,” said Zetter. “It was premature, it could have had a much bigger effect had the attackers waited.” Iran still made a net gain in their uranium stockpile while being attacked and they are updating their centrifuges, which would make Stuxnet obsolete.

The more unsettling parts of Zetter’s book catalog security vulnerabilities in America’s public infrastructure, which could easily be victim to a Stuxnet-style attack, and consider the implications of the era Stuxnet heralded. For example, in 2001 hackers attacked California ISO, a nonprofit corporation that manages the transmission system for moving electricity throughout most of California. More recently, Zetter writes, in 2011 a security research team “penetrated the remote-access system for a Southern California water plant and was able to take control of equipment the facility used for adding chemicals to drinking water.”

The Obama administration has publicly announced that shoring up infrastructure security is a top priority. Zetter finds this ironic, because unleashing Stuxnet has opened the U.S. up to attacks using the same malware.

“When you launch a cyber weapon, you don’t just send the weapon to your enemies, you send the intellectual property that created it and the ability to launch the weapon back against you,” writes Zetter. “Marcus Ranum, one of the early innovators of the computer firewall, called Stuxnet ‘a stone thrown by people who live in a glass house.’”

More broadly, Stuxnet heralded an era of cyber warfare that could prove to be more destructive than the nuclear era. For Zetter there is also irony to the use of cyber weapons to combat nuclear weapons. She quotes Kennette Benedict, the executive director of the “Bulletin of the Atomic Scientists,” pointing out, “that the first acknowledged military use of cyber warfare is ostensibly to prevent the spread of nuclear weapons. A new age of mass destruction will begin in an effort to close a chapter from the first age of mass destruction.” 

Zetter has similar fears.

“The U.S. lost the moral high ground from where it could tell other countries to not use digital weapons to resolve disputes,” Zetter said. “No one has been killed by a cyber attack, but I think it’s only a matter of time.”

Joshua Alvarez was a 2012 CISAC Honors Student. 

Hero Image
cntdwn20day
All News button
1
-

Abstract: NSA stands for National Security Agency, but the agency is at odds with itself in its security mission. Undermining global encryption standards, intercepting Internet companies' data center transmissions, using auto-update to spread malware, and demanding law enforcement back doors in products and services are all business as usual. What legal basis does NSA and FBI have for these demands, and do they make the country more or less safe?

About the Speaker: Jennifer Granick started as the Stanford Law School Center for Internet and Society's (CIS) Director of Civil Liberties in June of 2012. She became an affiliate at the Center for International  Security and Cooperation in July 2012. 

Jennifer returned to Stanford after stints as General Counsel of entertainment company Worldstar Hip Hop and as counsel with the internet boutique firm of Zwillgen PLLC. Before that, she was the Civil Liberties Director at the Electronic Frontier Foundation. Jennifer practices, speaks and writes about computer crime and security, electronic surveillance, consumer privacy, data protection, copyright, trademark and the Digital Millennium Copyright Act.

From 2001 to 2007, Jennifer was Executive Director of CIS and taught Cyberlaw, Computer Crime Law, Internet intermediary liability, and Internet law and policy. Before teaching at Stanford, Jennifer spent almost a decade practicing criminal defense law in California. She was selected by Information Security magazine in 2003 as one of 20 "Women of Vision" in the computer security field. She earned her law degree from University of California, Hastings College of the Law and her undergraduate degree from the New College of the University of South Florida.

Encina Hall (2nd floor)

Jennifer Granick Director of Civil Liberties at Stanford Center for Internet and Society Speaker Stanford University
Seminars
-

Abstract: With the development of cyber capabilities by an increasing number of states, policymakers as well as scholars have been calling for the negotiation of a new international treaty to regulate cyber warfare. This paper provides an account and analysis of relevant debates in the United Nations with a focus on the position of four states – Russia, China, the US and the UK. Discussions have been concentrated in the First Committee of the General Assembly which has been seized with the issue since 1998 when the Russian Federation submitted a proposal for an international convention to govern the use of information and communication technologies for military purposes. While these efforts towards a wholesale international treaty have not materialized, Russia and China continue to advocate a change in the legal status through the promulgation of additional norms. In contrast, the US and the UK have been firm supporters of applying current legal regimes, including the UN Charter and the Geneva Conventions, to the use of cyber capabilities by states. In advancing these positions, two powerful narratives have emerged each emphasizing different aspects of the cybersecurity debate.

 

About the Speaker: Elaine Korzak is a postdoctoral cybersecurity fellow at CISAC. She earned her Ph.D from the Department of War Studies at King´s College London in 2014. Her thesis examined the applicability and adequacy of international legal frameworks to the emerging phenomenon of cyber attacks. Her analysis focused on two legal areas in particular: international law on the use of force and international humanitarian law. Elaine holds both an MA in International Peace and Security from King´s College London and an LL.M in Public International Law from the LSE. Her professional experience includes various governmental and non-governmental institutions, including NATO´s Cyber Defence Section as well as the European Commission´s Directorate-General on Information Society and Media.

 


Encina Hall (2nd floor)

Elaine Korzak Cybersecurity Fellow Speaker CISAC
Seminars
Authors
News Type
News
Date
Paragraphs

 

The White House announced it will host a Summit on Cybersecurity and Consumer Protection at Stanford on Feb. 13, convening major stakeholders to help shape public and private sector efforts to protect consumers and companies from growing network threats.

The all-day event will include senior leaders from the White House and across federal government; CEOs from a wide range of industries including financial services, technology, retail and communications companies; law enforcement officials; and consumer advocates. Stanford faculty members and students currently researching cybersecurity issues will be involved throughout the summit.

"We are honored to host this White House summit at Stanford University and are excited to play a pivotal role in convening experts from government, industry and academia," said Amy Zegart, co-director of the Center for International Security and Cooperation at Stanford. "Stanford is very engaged in studying cyber-related issues, and we look forward to enhancing this work by sharing our expertise on the cybersecurity issues that are so critical for the United States, its consumers and its businesses."

Topics at the summit will include "increasing public-private partnerships and cybersecurity information sharing, creating and promoting improved cybersecurity practices and technologies, and improving adoption and use of more secure payment technologies," the White House said in a statement.

Stanford announced a major Cyber Initiative in November that will apply broad campus expertise to the diverse challenges cyber-technologies pose for virtually every facet of our personal, governmental and economic lives. Funded with a $15 million grant from the William and Flora Hewlett Foundation, the Stanford Cyber Initiative draws upon Stanford's experience with multi-disciplinary, university-wide initiatives to focus research on the core themes of trustworthiness, governance and the unexpected impacts of technological change.

"Stanford has tremendous depth in the information security field, which is playing a deepening role in every facet of our lives," said Stanford Law Professor George Triantis, who chairs the Cyber Initiative. "Stanford is conducting extensive research into Internet security across a wide swath of disciplines – computer science, law, engineering, medicine, political science, economics and education. Collaborations with industry and government are vital, and we applaud the White House for drawing us all together here at Stanford."

Cybersecurity is expected to be raised as a key priority by President Obama in his State of the Union address next week. The White House Summit is also the next step in the President's BuySecure Initiative, which was launched in November 2014, and will help advance national efforts the government has led over the last two years with executive orders on consumer financial protection and critical cybersecurity infrastructure.

Details are still being finalized for the summit at Stanford, which will feature keynote speeches, panel discussions, and small group workshops, allowing participants to build on efforts in the public and private sectors to further improve cybersecurity practices.

Stanford units expected to be involved in the summit include the Freeman Spogli Institute for International Studies, the Stanford Cyber Initiative, the Center for International Security and Cooperation, the Hoover Institution and the schools of Engineering, Law, Business, Medicine and Education, among others.

Hero Image
obama cyber
President Barack Obama talks next to Secretary of Homeland Security Jeh Johnson at the National Cybersecurity and Communications Integration Center in Arlington, Virginia, Jan. 13, 2015.
Reuters
All News button
1
News Type
Q&As
Date
Paragraphs

Sony Pictures Entertainment was set to release a satirical comedy, “The Interview,” in late 2014, but a cyberattack hit the organization that leaked corporate information, leading the company to initially pull the film and opening up a string of theories over who was behind the attack and how to respond.

Speculation began to mount as a clearer picture of the unprecedented hacking, both comprehensive and large in size, began to emerge. The breach is thought to be retribution for Sony’s production of the film, which carries a plot to assassinate North Korean leader Kim Jong-un.

Then, a threat was directed at movie theaters and moviegoers planning to screen and see “The Interview.” The message warned those against involvement ahead of the film’s Dec. 25 opening, indicating a “bitter fate” and alluding to the 9/11 attacks in the United States.

An unknown group, The Guardians of Peace “GOP,” claimed responsibility for the cyberattack. Media and those familiar with North Korea began to point blame on the country, which had already publicly condemned the film last June and has a history of cybercrime. Responding to accusations, top North Korean leadership rejected any involvement in the attack.

Image
rsd14 078 0248a

The White House responded as Sony canceled the film’s New York premiere and said it would discontinue distribution. Following his year-end press conference, President Barack Obama condemned the hacking, citing the Federal Bureau of Investigation’s conclusion that North Korea was behind the attack. The President said the United States would respond “proportionally,” and on Jan. 2, signed an Executive Order that put into action a series of sanctions imposed by the Department of the Treasury.

David Straub, a Korea expert at Stanford University, answered questions about the Sony hacking and its policy implications for the United States and North-South Korean relations. Straub is the associate director of the Korea Program at the Walter H. Shorenstein Asia-Pacific Research Center. He formerly served as the State Department’s Korean affairs director.

What do we know about the Sony hacking? Who’s responsible?

Based on many types of evidence, including confidential information, U.S. government officials appear to be quite confident that North Korea did in fact conduct this operation. There’s still some disagreement in the media and among tech experts over who is responsible. They’ve cited a number of reasons but the main one is that the FBI’s official statement attributing the attack to North Korea provided evidence that they believe is far from conclusive. I myself am not a technical expert, but based upon my following North Korea for many years – the attack strikes me as being very likely to have been a North Korean operation. The FBI statement noted that the Sony attack is similar to an attack that the North Koreans conducted against South Korean banks and media outlets in March 2013. In that attack, many South Korean banks had their hard drives completely wiped clean. It was a hugely destructive attack and very similar to what happened to Sony.

Does North Korea’s response to the Sony hack coincide with past behavior?

In addition to the 2013 South Korean bank cyberattack, the North Koreans apparently sank a South Korean naval vessel in 2010, killing 46 sailors. In both instances, the North Koreans denied that they did it, expressed outrage over being accused, demanded that the South Koreans produce proof, said that they could prove that they didn’t do it, and then requested that the South Koreans conduct a joint investigation. These same demands are being made in response to the U.S. blaming Pyongyang for the Sony cyberattack. It couldn’t be more similar. More generally, the North Korean regime is very calculating. They know they can’t win an outright military confrontation with South Korea, much less the United States, so what they do is try to find a weak link and go after it in a way in which they have plausible deniability – a situation where it’s very difficult for the attacked party to prove who did it.

Describe North Korea’s hacking capabilities.

North Korea is a very secretive country, so it’s hard to be completely certain of their cyber capabilities. However, according to many accounts, the North Korean government has established professional hacking schools and units over the years, resulting in hundreds if not thousands of trained hackers. North Korea has engaged in a number of attacks in the past, the most prominent one was the attack on South Korean banks in March 2013. But also, a few years ago, North Korea conducted less sophisticated attacks on major U.S. government websites.

Why would they conduct an attack?

The North Koreans appear to have both the capability and the motivation to attack Sony. The nation’s entire political system rests on a cult of personality – now a cult of family, actually – that began with the founder of the regime, Kim Il-sung, and extends to his grandson today, leader Kim Jong-un, who has been in power since Dec. 2011. It’s the only thing holding the political system together at this point. The cult of personality is so strong that any direct criticism of the top leader is something that North Koreans will compete among each other to reject. From this standpoint, it seems very likely that they would feel they had to prevent the showing of a movie that features an assassination of Kim Jong-un. And, the hackers had plenty of time to prepare for and implement the attack because everyone knew well ahead of when the movie would be released.

The United States placed new financial sanctions on North Korea. What impact will the sanctions have?

President Obama made it clear that the U.S. government would respond at a time, in a place, and in a manner of its own choosing. Not all measures taken would be made public. So far, the first publically announced measure was the President’s Executive Order on Jan. 2 imposing additional sanctions on a number of North Korean agencies and officials. This in itself is unlikely to have major consequences because most of those entities were already sanctioned. But, the Executive Order states that the sanctions are being implemented not only because of the cyberattack against Sony, but more generally because of North Korea’s actions and policies, including its serious human rights abuses. So in a sense, the North Koreans got the United States to expand its reasons for sanctioning them.

 

President Obama addresses the Sony hacking, saying the United States will "respond proportionally," at his year-end press briefing on Dec. 19.

President Obama addresses the Sony hacking at his year-end press briefing on Dec. 19. Photo credit: WhiteHouse.gov

 

What other steps will the United States likely take?

President Obama left open the possibility that North Korea might be returned to the U.S. State Sponsors of Terrorism list, from which the nation was removed in 2008. I think it was a mistake to remove North Korea from that list in the first place. It was done to promote progress on the nuclear talks, which eventually failed, and ignored a number of terroristic actions that North Korea has committed in recent years. Another possibility, which is being pushed by Republicans in Congress, is to increase financial sanctions that mirror the type that were successfully implemented in Iran.

How will the U.S. response influence cybersecurity policy going forward?

The attack on Sony is a huge wakeup call to American businesses, and even to the U.S. government. It’s the first attack of this size on a company located in the United States. It got tremendous profile in the media and the President has been personally engaged in responding. Nearly everyone has heard about it, so U.S. companies are now going to be focused much more on cybersecurity because it has exposed some potential vulnerabilities – a “if North Korea can do it, presumably others can too” mentality. Moreover, if an attack can be executed on a film company, it could also be done to other businesses and even to elements of U.S. critical infrastructure.

How do you view North Korean leader Kim Jong-un’s possible offer to meet with South Korean leadership this year?

Kim Jong-un said that he was open to the possibility of a summit with South Korea in his annual New Year’s address, although he made no specific proposal. He made clear that the summit would be conditional on actions to be taken in advance by South Korea. Among these, Kim demanded ending U.S.-South Korean military exercises and halting the flow of propaganda-filled balloons sent over the border into the North by non-governmental activist groups in the South. Moreover, North Korea has a history of expanding its conditions later, without any warning. So, I think one has to be skeptical. The signal is unfortunately less likely to be a sincere effort toward real, sustained dialogue, and more likely to be a North Korean propaganda effort devised to confuse, divert and divide international public opinion. That said, South Korea has acted entirely appropriately in welcoming the signal and reiterating its own offer of high-level talks. Let’s hope for the best.

David Straub also participated in an interview with Public Radio International on Jan. 1 about the prospect for North-South talks, the audio can be accessed on the PRI website.

Hero Image
reuters theinterview
"The Interview," a Sony Pictures film starring actors Seth Rogen and James Franco about a fictional plot to assasinate North Korean leader Kim Jong-un, releases in theaters.
Reuters/Kevork Djansezian
All News button
1
Subscribe to Cybersecurity