error

  • Could not retrieve the oEmbed resource.
Cybersecurity
-

Abstract: Senior policy makers often talk as though cyber conflict poses the same kind of existential threat as does nuclear conflict.  Sober analysis reveals the silliness of this claim, but nonetheless, an understanding of nuclear conflict can help to structure thinking about cyber conflict.  Specifically, I will present some preliminary work on the proposition that nuclear and cyber conflict are similar in that the same questions arise in each, but that the answers to these questions are for the most part entirely different.  I hope that feedback from this seminar will help me to refine this work if I’m on the right track (or abandon it if I’m not).

About the Speaker: Dr. Herb Lin is senior research scholar for cyber policy and security at the Center for International Security and Cooperation and Research Fellow at the Hoover Institution, both at Stanford University.  His research interests relate broadly to policy-related dimensions of cybersecurity and cyberspace, and he is particularly interested in and knowledgeable about the use of offensive operations in cyberspace, especially as instruments of national policy.  In addition to his positions at Stanford University, he is Chief Scientist, Emeritus for the Computer Science and Telecommunications Board, National Research Council (NRC) of the National Academies, where he served from 1990 through 2014 as study director of major projects on public policy and information technology, and Adjunct Senior Research Scholar and Senior Fellow in Cybersecurity (not in residence) at the Saltzman Institute for War and Peace Studies in the School for International and Public Affairs at Columbia University.  Prior to his NRC service, he was a professional staff member and staff scientist for the House Armed Services Committee (1986-1990), where his portfolio included defense policy and arms control issues. He received his doctorate in physics from MIT.

Encina Hall (2nd floor)

CISAC
Stanford University
Encina Hall, C236
Stanford, CA 94305-6165

650-497-8600
0
Senior Research Scholar at the Center for International Security and Cooperation
Hank J. Holland Fellow in Cyber Policy and Security, Hoover Institution
HerbertLin.jpg

Dr. Herb Lin is senior research scholar at the Center for International Security and Cooperation and Research Fellow at the Hoover Institution, both at Stanford University.  His research interests relate broadly to the impact of emerging technologies on national security, especially in the digital domain (cyber, artificial intelligence, information warfare and operations), and has written extensively on the role of offensive operations in cyberspace as instruments of national policy.  In addition to his positions at Stanford University, he is Chief Scientist, Emeritus for the Computer Science and Telecommunications Board, National Research Council (NRC) of the National Academies, where he served from 1990 through 2014 as study director of major projects on public policy and information technology.  From 2016 to 2025, he was a member of the Science and Security Board of the Bulletin of Atomic Scientists. In 2016, he served on President Obama’s Commission on Enhancing National Cybersecurity and in  2021 on the Aspen Commission on Information Disorder.  Prior to his NRC service, he was a professional staff member and staff scientist for the House Armed Services Committee (1986-1990), where his portfolio included defense policy and arms control issues. He received his doctorate in physics from MIT.

Avocationally, he is a longtime folk and swing dancer and a lousy magician. Apart from his work on cyberspace and cybersecurity, he is published in cognitive science, science education, biophysics, and arms control and defense policy. He also consults on K-12 math and science education.

Date Label
Herb Lin Senior Research Scholar Speaker CISAC
Seminars
-

Abstract: In January 2010, inspectors with the International Atomic Energy Agency noticed that centrifuges at an Iranian uranium enrichment plant were failing at an unprecedented rate. The cause was a complete mystery—apparently as much to the technicians replacing the centrifuges as to the inspectors observing them.

Then, five months later, a seemingly unrelated event occurred: A computer security firm in Belarus was called in to troubleshoot some computers in Iran that were crashing and rebooting repeatedly and found some malicious code on them. At first, the firm’s analysts believed the code was simply a routine piece of malware. But as they and other experts around the world investigated, they discovered a mysterious virus of unparalleled complexity.

They had, they soon learned, stumbled upon the world’s first digital weapon. For Stuxnet, as it came to be known, was unlike any other virus or worm built before: Rather than simply hijacking targeted computers or stealing information from them, it escaped the digital realm to wreak actual, *physical *destruction on a nuclear facility.

Author Kim Zetter, a senior writer for WIRED magazine, recently published a book on Stuxnet. In this presentation, she'll tell the story about Stuxnet's planning, execution and discovery and why the attack was so unique and sophisticated. She'll also discuss the repercussions of the assault and how critical infrastructure in the U.S. is susceptible to the same kind

About the Speaker: Kim Zetter is an award-winning investigative journalist and author who covers cybersecurity, cybercrime, cyber warfare, privacy and civil liberties. She has been covering computer security and the hacking underground since 1999, most currently as a staff reporter for Wired, where she has been reporting since 2003. She was a finalist for an Investigative Reporters and Editors award in 2005 for a series of investigative pieces she wrote about the security problems with electronic voting machines and the controversial companies that make them. In 2006 she broke a story for Salon about a secret NSA room at an AT&T facility in Missouri that was believed to be  siphoning internet data from the telecom’s network operations center. In  2007 she wrote a groundbreaking three-part story for Wired on the cybercriminal underground, which exposed the world of online carding  markets and the players behind them. In 2010, she and a Wired colleague broke the story about the arrest of Bradley Manning, the former Army intelligence analyst accused of leaking millions of classified U.S. government documents to WikiLeaks. In 2011, she wrote an extensive feature about Stuxnet, a sophisticated digital weapon that was launched by the U.S. and Israel to sabotage Iran’s uranium enrichment program.  She recently completed a book on the topic.

Kim Zetter's book on Stuxnet, Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon, can be purchased by following this link

Encina Hall (2nd floor)

Kim Zetter Senior Writer Speaker Wired Magazine
Seminars
-

Abstract: The increasing frequency of cyber attacks and technological change have amplified the potential adverse effects of successful, large-scale cyber attacks. While detecting the source of cyber threats is difficult, technological capabilities are making it easier. Along with my co-author, Kevin Risser, I argue that the ability to identify cybersecurity threats provides a mechanism for deterrence since prospective hackers take into account the expected costs of punishment—that is, penalties upon being caught by either their government or international authorities. In particular, we discuss the extent to which cyber threat attribution technologies and security infrastructures affect military strategies. First, we contextualize our argument through a lens of standard mutual assured destruction and deterrence theory. While there are parallels between the two, cybersecurity threats are fundamentally different because of their diffuse and mobile nature. Second, we build a game-theoretic model to illustrate our insight that attribution provides a deterrent. Our model provides a closed-form relationship between the prospective hacker’s beliefs of evading attribution and the expected benefits/costs of an attack. We close our paper with considerations of future research.

About the Speaker: Christos Makridis is a Ph.D. candidate at Stanford University’s Management Science & Engineering department researching macro and public economics. He is also the Editor of the UNESCO-sponsored Global Water Forum’s economics section, and a Non-Resident Fellow at the North American Research Partnership. Christos studies the quantitative effects of a wide range of public policy interventions, such as tax policy on productivity and environmental policy on pollution abatement, in stochastic dynamic general equilibrium models. Christos holds a B.S. in Economics and Minor in Mathematics from Arizona State University.

 


Cybersecurity and Military Strategy: The Effectiveness of Attribution as a Deterrence
Download pdf

Encina Hall (2nd floor)

Christos Makridis PhD Candidate Speaker Department of Management Science & Engineering, Stanford University
Seminars
Authors
News Type
News
Date
Paragraphs

 

American deterrence, though traditionally centered on the nuclear triad, is becoming ever more integrated and dependent on other technologies in space and the cyber world, Admiral Cecil D. Haney, commander of the U.S. Strategic Command, told a Stanford audience.

Haney, appointed to lead USSTRATCOM by President Barack Obama last year, made a daylong visit to Stanford on Tuesday, holding seminars and private meetings with faculty, scholars and students at the Hoover Institution and the Center for International Security and Cooperation. His seminar at CISAC focused on strategic deterrence in the 21st century.

Admiral Haney has made it USSTRATCOM’s goal, in accordance with the Nuclear Nonproliferation Treaty (NPT) and the 2010 START Treaty, to reduce America’s nuclear weapons stockpile. But he sees a world where maintaining a deterrent is still necessary.

“As we work to continue our nation’s goal of reducing the role of our nation’s nuclear weapons, we find other nations not only modernizing their strategic capabilities but also promoting them,” he said. Russia, Iran, and China attracted particular concern. Haney declined to estimate how much the U.S. can reduce its stockpile without hurting its deterrent posture.

While the nuclear triad is still the foundation of American deterrence, space and cyberspace technology are now fully integrated with nuclear platforms, making cyber and space security indispensable.

“Deterrence is more than just the triad,” said Haney. “We are highly dependent on space capabilities, more so than ever before. Space is fully integrated in our joint military operations as well as in our commercial and civil infrastructure. But space today is contested, congested, and competitive.” 

Haney said there are more than 20,000 softball-sized objects orbiting Earth.

 

Image
dsc 9384

 

“Only about 1,000 of those objects are satellites, the rest is debris, increasing threats to our operational satellites as they travel at speeds exceeding 17,000 mph,” he said. The Joint Space Operation Center receives an average of 30 collision alerts per day.

Damage to some of our satellites could have devastating impacts on our economy, communications and infrastructure. Rival nations also pose space security challenges.

According to the U.S. government, China recently tested an anti-satellite missile. This follows a 2007 test when China successfully destroyed one of its satellites, and consequently created a cloud of debris that still poses a threat to international satellites.

“Keeping assured access to the space domain is a full-time job,” Haney said.

Likewise cybersecurity. America’s increasing reliance on cyberspace for both military and civilian purposes has created security vulnerabilities that can be exploited by both state and non-state actors. Haney cited the recent attacks on J.P. Morgan and Sony, Russia and China’s attacks on regional rivals, and non-state terror groups.

“We have benefited enormously from advanced computer capabilities, but it has opened up threat access to our critical infrastructure,“ Haney said. “As we confront terrorist groups we all know that they are not only using cyber for recruiting and messaging – but also to seek weapons of mass destruction.”

In a Q&A session after his talk during the CISAC seminar, a variety of concerns were raised about the USSTRACOM mission, including triad modernization, the ongoing personnel issues that have been in the news, and missile defense.

FSI Senior Fellow Scott Sagan asked about the recent spate of personnel problems at U.S. nuclear silos. Haney said a full review of personnel and procedures, ordered by Defense Secretary Chuck Hagel, was completed and changes have been enacted.

“We are trying to positively reinforce our workforce and I am getting a lot of positive feedback from operators,” Haney said. “We are having monthly conversations that include operational officers. When I visit sites I don’t just meet with commanders, I have meals with smaller groups of lower-ranking personnel.”

Haney previously served as commander of the Pacific Fleet. A graduate of the U.S. Naval Academy, he has personal experience with America’s nuclear deterrent as he served in submarines armed with nuclear ballistic missiles, which, in addition to land-based intercontinental ballistic missiles (ICBMs) and strategic bombers, make up part of the United States’ nuclear triad.

USSTRATCOM is one of nine unified commands that have control of forces from all four branches of the U.S. military. The command’s well-known responsibility is command and control of America’s nuclear arsenal, a role it inherited from the Cold War-era Strategic Air Command. Since its establishment in 1992, USSTRATCOM has been assigned additional responsibilities, most notably cyberspace and outer space.

 

You can listen to the audio of his presentation here.

 

Joshua Alvarez was a CISAC Honors Student during the 2011-2012 academic year.

 

Hero Image
dsc 9057 Rod Searcey
All News button
1
Authors
News Type
News
Date
Paragraphs

Stanford University today launched the Stanford Cyber Initiative to apply broad campus expertise to the diverse challenges and opportunities that cybersecurity, cyberspace and networked information pose to humanity.                                                      

Information security has an expanding and deepening role in virtually every facet of our personal, social, governmental and economic lives. Yet the Internet is decentralized and vulnerable to malicious use. How does society protect its core values in the face of the promise and perils of digital information? And, how does society adapt to changing technologies?

These are the type of questions that Stanford researchers will study, thanks to the jumpstart given by a $15 million grant from the William and Flora Hewlett Foundation. Stanford's initiative will be highly interdisciplinary in building a new policy framework for cyber issues. It will draw on the campus' experience with multidisciplinary, university-wide initiatives to focus on the core themes of trustworthiness, governance and the emergence of unexpected impacts of technological change over time.

"Our increasing reliance on technology, combined with the unpredictable vulnerabilities of networked information, pose future challenges for all of society," said Stanford President John Hennessy. "We share the Hewlett Foundation’s goal to seek a robust understanding of how new technologies affect us all at the most fundamental human levels. Stanford has a long history of fostering interdisciplinary collaborations to find thoughtful and enlightened answers to these paramount questions." 

Building on Stanford strengths

The Stanford Cyber Initiative will build upon the university's already extensive inquiry and research into Internet security. In doing so, Stanford has drawn on connections with industry and government by establishing, for example, a "cyber boot camp" for U.S. congressional staff (a Freeman Spogli Institute for International Studies/Hoover Institution collaboration,) a conference on the "ethics of data in civil society" and an ongoing "security conundrum" speaker series on cyber issues.

The initiative will work with Stanford’s existing research hubs addressing cyber issues, including those in the Computer Security Lab in the Department of Computer Science, the Freeman Spogli Institute's Center for International Security and Cooperation, the Hoover Institution and the Law School's Center for Internet and Society. FSI's Center on Democracy, Development, and the Rule of Law will also play a key role in the initiative.

The initiative will launch immediately and develop faculty seminars and conferences, organize working groups of faculty and students to tackle policy-relevant problems in information security, and provide support for internal research awards, teaching and curriculum development. Collaborations with industry and government are a vital part of the initiative.

The Stanford Cyber Initiative includes roles for faculty and students across a wide swath of research disciplines – computer science, law, the social sciences, engineering, political science and education, among others. And it will also enlist Stanford alumni who are leaders in the policy and technology fields.

For those seeking to participate, information is available on the Stanford Cyber Initiative website

A central hub

"We are deeply grateful to the Hewlett Foundation for recognizing Stanford's ongoing work and future potential in this area. With the help of their generous grant, this initiative will grow into a central presence on campus that more broadly comprehends the possibilities and perils of networked information," said Stanford law Professor George Triantis, who will chair the steering committee for the initiative.

The committee currently includes professors Jeremy Bailenson (communications,) Stephen Barley (management science and engineering,) Ian Morris (classics and history,) John Mitchell (computer science and electrical engineering,) Dan Boneh (computer science and electrical engineering,) Amy Zegart (Hoover Institution and CISAC) and Barbara van Schewick (law).

Mariano-Florentino Cuéllar, the director of Stanford's Freeman Spogli Institute for International Studies and a Stanford law professor, is one of the founders of the initiative. 

"The Stanford initiative will create vast opportunities to advance knowledge about the future of cyberspace and cybersecurity," Cuéllar said. "Faculty and students will expand existing research efforts and conversations with the goal of building a safer, better world that balances humanity's concerns with the promise of new technologies."

Cuéllar noted that crucial areas of examination include how to resolve trust and security problems endemic to networked information technologies, how to govern the Internet in a world where people often disagree about what they value, and how to anticipate unexpected developments in information technologies that could affect national security, intellectual property, civil liberties and society.

Ann Arvin, Stanford's vice provost and dean of research, said, "Our scholars and students will examine pressing questions about how can we ensure security and protect privacy while continuing to foster an open, innovative and entrepreneurial culture and society. We want to better understand the short- and long-term consequences and implications of the pervasiveness of digital technology in our lives."

In exploring this conundrum, the initiative will encourage collaborative focus across disciplines on the challenges of trustworthiness – for example, can individuals trust that information technologies will deliver on their promise and also avoid the hazards of deliberately hostile or antisocial actions? 

A central goal is to create a policy framework that can generate lasting solutions not only to existing problems but also to problems that may emerge in the future.  

'Profound implications'

The new program is supported through the Hewlett Foundation's Cyber Initiative, which has now committed $65 million over the next five years to the study of cybersecurity, the largest amount given to date by a private donor to this topic.

"Choices we are making today about Internet governance and security have profound implications for the future," said Hewlett Foundation President Larry Kramer, a former dean of the Stanford Law School. "To make those choices well, it is imperative that they be made with some sense of what lies ahead and, still more important, of where we want to go."

The other universities receiving Hewlett grants of $15 million each – the Massachusetts Institute of Technology and the University of California, Berkeley – will take a complementary approach in setting up the new centers based on their particular strengths and expertise.

 

Hero Image
cyber news
All News button
1
Authors
News Type
News
Date
Paragraphs

 

Journalist Barton Gellman had left his job at The Washington Post and was working on a book about surveillance and privacy in America when he was contacted last year by someone using the code-name VERAX, or “truth teller” in Latin.

So began one of the most dramatic chapters in the history of modern American journalism – and government surveillance. In the spring of 2013, Gellman began having remote, encrypted exchanges with someone who clearly had inside knowledge of the NSA's global and domestic surveillance programs. 

“He was trying to figure out whether he could trust me and ... I was trying to figure out if he was for real,” Gellman told a packed Stanford audience Monday night.

Last December, he traveled to Moscow to put a face to the code-name and determine whether the information he was providing was accurate.

“All extraordinary claims require extraordinary evidence – and he was providing that.," Gellman said of former NSA contractor Edward Snowden. "I was convinced fairly early on that I was dealing with something fairly serious.”

So Gellman went back to The Washington Post, where he had been on teams that won two Pulitzer Prizes for their coverage of the 9/11 terrorist attacks and the power and influence of Vice President Dick Cheney during the Bush administration.

“I went there because I trusted them and because I wanted their resources and their advice,” he told the audience of some 600 people at the CEMEX Auditorium on Monday. The Washington Post would go on to win the 2014 Pulitzer Prize for Public Service, shared with The Guardian US, for their reporting on the Snowden materials and the NSA.

Gellman today is a senior fellow at The Century Foundation and a visiting professional specialist and author-in-residence at Princeton’s Woodrow Wilson School of Public and International Affairs. He is the author of Angler: The Cheney Vice Presidency and is currently working on a book about the Snowden affair.

Snowden’s explosive disclosures about the National Security Agency’s intelligence-collection operations have ignited an intense debate about the appropriate balance between security and liberty in America.

In a special series this academic year at Stanford University, nationally prominent experts are exploring the critical issues raised by the NSA’s activities, including their impact on our security, privacy and civil liberties.

Amy Zegart, co-director of CISAC and a senior fellow at the Hoover Institution, launched the “Security Conundrum” series in October with its first speaker, Gen. Michael Hayden, the former director of the NSA and CIA who defended the government surveillance programs. The metadata collection “is something we would have never done on Sept. 9 or Sept. 10,” Hayden told Zegart during their conversation on Oct.  8. “But it seemed reasonable after Sept. 11. No one is doing this out of prurient interests. No – it was a logical response to the needs of the moment.”

Zegart, in introducing Gellman, said: “Tonight, we move from inside the NSA to inside the newsroom, which played a key role in revealing the NSA’s secret activities over the past year.”

All Photos by Rod Searcey

Image
gellman phil

 

In the second lecture in the “Security Conundrum” series, Gellman was in conversation with Philip Taubman, former correspondent and Washington and Moscow bureau chief for The New York Times and a consulting professor with Stanford’s Center for International Security and Cooperation (CISAC). Taubman teaches the class Need to Know: The Tension Between a Free Press and National Security Decision Making.

Gellman recounted his dealings with Snowden and described how he and his editors weighed the Snowden materials. Few questions are more difficult for American journalists than determining how far a free press can venture in disclosing national security secrets without imperiling the nation’s security.

“I asked him very bluntly, `Why are you doing this?’” Gellman said of Snowden.

“He gave me very persuasive and consistent answers about his motives. Whatever you think of what he did or whether or not I should have published these stories, I would claim to you that all the evidence supports his claim that he had come across a dangerous accumulation of state power that we, the people, needed to know about.”

One of the first Snowden revelations, Gellman said, was the top-secret PRISM surveillance program, in which the NSA is allowed to tap into the servers of nine large U.S. Internet companies, including Google, Microsoft, Yahoo, Facebook and Skype. Snowden believed the extent of mass data collection about American citizens was far greater than what the public knew.

The Post reported that PRISM allows the U.S. intelligence community to gain access from the Silicon Valley firms to a wide range of digital information, including audio, video chats, photographs, emails and stored data that enable analysts to track foreign targets. The program does not require individual warrants, but instead operates under the broader authorization of the federal Foreign Intelligence Surveillance Act court.

 

Image
dsc 8126

 

The FISA Court had also been ordering a subsidiary of Verizon Communications to turn over to the NSA logs tracking all of its customers’ telephone calls.

Gellman said Snowden asked for a guarantee the Post would publish the full text of a PowerPoint presentation that he had obtained describing the PRISM program. Gellman told him that his editors would not make any guarantees about what they would publish and in the end the paper only reproduced several slides so as not to harm national security.

Taubman asked Gellman what gives any journalist the right to publish classified documents and not hand those papers back to the NSA.

“I’m not accountable to anyone for my decisions about what is in the interest or not in the interest of the national security of the United States,” Gellman said. “What happens is the government tries to keep information a secret and I try to find it out – and then when that spillage happens, well, then we talk.”

In the case of PRISM, he sent emails to two “quite senior people” in the government and told them this was the type of email he only sends once every several years, when he is onto a big story they would want to know about. But he didn’t want to do anything over email, so when the senior officials called, Gellman gave them the title of the document about which he was going to write.

Image

That started the negotiations with the government and The Washington Post. In the end, the paper only published several of the government’s PowerPoint slides that explained the PRISM program because they were concerned about harming national security.

“We had no interest in doing that; we only had an interest in writing about the public policy question on a program that had secretly expanded in ways that almost no one knew about,” Gellman said. “To the extent that it involves drawing new boundaries allowing the government to spy on its citizens and the citizens never get to know that – that is quite relevant to know when you’re trying to decide whether you like what your government is doing.”

In a statement responding to the PRISM revelations by the Post, Director of National Intelligence James Clapper said information collection under the program “is among the most important and valuable foreign intelligence information we collect, and is used to protect our nation from a wide variety of threats.”

Clapper called the Snowden leaks about the legal program “reprehensible and risks important protections for the security of Americans.”

Gellman said Snowden has turned down million-dollar book and movie deals and lives in  “ascetic” asylum in Russia. Snowden told NBC News earlier this year that he was on his way from Hong Kong to Latin America, via Moscow, when his passport was confiscated and that Russia then granted him a one-year asylum.

“He is fascinating to me because he’s an unusual figure,” Gellman told Taubman, who had asked him what Snowden was like. He said the 31-year-old former systems administrator for the CIA did something most Americans would not: He gave up his personal freedom and changed the course of his life to make public the government surveillance programs that he believes are a danger to the American people.

“He described himself to me once as an indoor cat,” Gellman said. “He lives in a virtual world; there’s not a whole lot of difference for Snowden whether he’s living in Moscow or Hawaii – he’s is what I would call a net native. He has an ascetic personality; he doesn’t have or want very much stuff.”

Gellman added: “He is sort of Zen-like in his confidence that he has done the right thing.”

***

The Security Conundrum series is co-sponsored by CISAC, Hoover, and the Freeman Spogli Institute for International Studies, Stanford Continuing Studies, Stanford in Government and the Stanford Law School.

Other nationally prominent speakers will include Reggie Walton, the former presiding judge of the Foreign Intelligence Surveillance Court, and U.S. Sen. Dianne Feinstein, chairman of the Senate Select Committee on Intelligence.

Hero Image
gellman hand Rod Searcey
All News button
1
Authors
News Type
News
Date
Paragraphs

 

National Security Agency Director Admiral Michael Rogers told a Stanford University audience during a rare visit to Silicon Valley that his greatest concern today is that the nation is not yet prepared to defend against a major cyber terrorist attack.

He said the growing rift among the signals intelligence agency, tech companies and civil liberties organizations over the shifting boundaries of privacy rights and secret surveillance is weakening the nation’s resolve.

“We have yet to be able to come to a broad policy and legal consensus about how we deal with some of the legal issues in cyber now,” said Rogers, who took over the leadership of the embattled intelligence agency in April.

The admiral, wearing military dress, spoke to some 300 Stanford students, faculty and tech executives in an event sponsored by the Center for International Security and Cooperation (CISAC) and the Hoover Institution.

Watch the Rogers talk in this video:

 

His wide-ranging talk on Monday – in which he appealed to Stanford students to consider a career at the intelligence agency – came on the eve of a hearing by a federal appeals court investigating whether the NSA’s surveillance program violates the U.S. Constitution’s ban on unreasonable searches. The Justice Department argues that collecting phone data is of overriding importance to national security.

The NSA, whose mission is to prevent foreign adversaries from getting their hands on classified national security data, has come under fire since NSA contractor Edward Snowden disclosed last year the extent of the government’s electronic surveillance programs. The former CIA system administrator leaked documents to journalists that revealed global surveillance programs with the cooperation of some telecommunications companies and European governments.

One of those journalists was Barton Gellman of the Washington Post, who received dozens of top-secret documents from Snowden when he traveled to Moscow to meet him. Gellman, who shared the 2014 Pulitzer Prize for Public Service for his reporting on the Snowden materials and the NSA, will address a Stanford audience on Nov. 17th as part of the university’s “Security Conundrum” lecture series.

Rogers indicated that until a consensus is reached on government surveillance, the United Sates is vulnerable to attack.

“Is it going to take a crisis to wake us up and say, `Man, how did we get here?’” he asked. “I don’t want to be at the end of another 9/11 commission asking how we got here.”

Rogers said the government is backing a bill known as the Cybersecurity Information Sharing Act, which would allow tech firms and the U.S. government to share cyber threats captured through Internet data. The bill was introduced to the Senate in July but has not yet been voted on by the full Senate. Opponents of the bill say it would only give the NSA enhanced spying powers.

 

Image
Photo by Rod Searcey

 

Rogers called the proposed legislation critical. “Without it, cyber becomes a huge cost for us as a nation.”

Rogers said he knows Americans’ trust in their government is dismal.

“We have a fairly limited faith in Washington and there is incredible frustration over the mechanisms of our government, whether it be the legal framework, the courts, the Congress,” he said. “It’s hard to achieve a political consensus when we’re losing faith in many of the mechanisms.”

And still, he called on Stanford students – namely the engineering and computer science majors who were in the audience – to come work for him. While acknowledging that the NSA could not match the salaries of Google, Yahoo and Facebook, he said they could do something worthwhile for their nation.

“If we’re going to make this about money – we don’t stand a chance,” Rogers said.

But, he added, “We’ll give you an opportunity to dedicate yourself to something that is bigger than you: service to the nation.”

Rogers said young recruits would be given great responsibility at an early stage in their careers. And, they’d get to play real-world spy games. “We’re going to give you the opportunity to do stuff you can’t legally do anywhere else,” he said.

Not all students in the audience were ready to sign up.

Photo by Rod Searcey

Thu-an Pham, a sophomore who has yet to declare her major, said after listening to the talk that she’s concerned that NSA surveillance is curbing innovation.

"I'm worried about the impact of surveillance on the culture of innovation,” she said. “Glenn Greenwald gave a recent TED Talk on the importance of privacy. He showed that people alter their behavior to conform to norms and expectations if they suspect they are under surveillance, which stifles individuality and free-thinking.”

Pham also said she’s concerned about the possibility of American officials “outsourcing illegal tasks to other governments.”

The National Journal reported last week that the NSA has given broad access to British intelligence to Americans’ telephone calls and Internet traffic, leading civil liberties activists to accuse the agency of trying to circumvent the Fourth Amendment.

Amy Zegart, CISAC’s co-director and a senior fellow at the Hoover Institution, moderated the one-hour talk and Q&A in Encina Hall.  

Zegart, an intelligence expert, noted tech firms are tightening encryption standards to prevent government spying on their customers.

Google and Yahoo are working on tools to encrypt their email systems and Apple and Google just announced its mobile operating systems would eventually be encrypted by default. Government officials have warned that the tech firms could be aiding criminals and terrorists with these tougher encryption standards; FBI Director James Comey suggested Silicon Valley build encryption with a backdoor for the U.S. government to spy on potential terrorists.

“Industry is very concerned about evidence of the NSA undermining encryption standards. If the NSA were to find a way through encryption standards, how do you weigh the right thing to do?” Zegart asked.

“Let there be no doubt that a fundamentally strong Internet is in the best interest of the nation,” Rogers replied. “When you find vulnerabilities, we are going to share them; the default mechanism is that we’re going to share the vulnerabilities.”

 

Image
Photo by Rod Searcey

 

CISAC Affiliate Jennifer Granick, director of civil liberties at the Stanford Law School's Center for Internet and Society, asked Rogers to answer to disclosures by Snowden that the NSA secretly broke into communications on Yahoo and Google servers overseas.

“We do not use any foreign partners as a vehicle to overcome and bypass U.S. law,” Rogers replied. “When we partner with our Five Eyes teammates, we remind them that we have specific requirements that we must meet.”

The Five Eyes refers to an intelligence alliance of the United States, Canada, Great Britain, Australia and New Zealand to share signals intelligence.

Rogers conceded the Department of Defense no longer drives technical innovation, so the government will have to increasingly rely on the brainpower of Silicon Valley. He pledged to visit every six months and build partnerships with tech firms.

But he emphasized that national security could not be left to the technologists.

“It is unrealistic to expect the private sector to withstand the actions of nation-states,” Rogers said. “I think it is also unrealistic to expect the government to deal with this all by itself. We have got to create those partnerships that enable us to actually share information and insight in a real-time basis.”

Former CISAC Honors Student Joshua Alvarez contributed to this story.

 

Hero Image
rogers square NSA/CSS
All News button
1

Despite the enormous amount of attention that has been directed to software security in recent years, relatively little attention has been given to hardware security.  More than ever, the devices that are critical to everyday life and to the broader infrastructure are dependent on increasingly sophisticated integrated circuits ("chips").  As the complexity of chips and the supply chains involved in procuring them continue to grow, so does the risk that malicious circuity could be hidden within a chip during the design and manufacturing process. The circuitry could be triggered to launch an attack months or years later, with very significant consequences if carried out on a large scale.

This presentation will explain the increasingly global nature of the semiconductor industry and identify technology and policy steps that can be taken to minimize the likelihood of successful, large-scale, hardware-based cyberattack.

This event is by invitation only. All RSVPs should be sent to Russell Wald. There is a reception at 6:30PM, and the conversation begins promptly at 7:15.

The Capitol Visitor Center, HVC-215

First Street SE, Washington, DC

0
Affiliate
1-RSD13_085_0093a.jpg

John Villasenor is on the faculty at UCLA, where he is a professor of electrical engineering, public policy, law, and management as well as the director of the Institute for Technology, Law and Policy. He is also a nonresident senior fellow at the Brookings Institution and a member of the Council on Foreign Relations.

Villasenor’s work considers the broader impacts of key technology trends, including the growth of artificial intelligence, advances in digital communications, and the increasing complexity of today’s networks and systems. He writes frequently on these topics and on their implications with respect to cybersecurity, privacy, law, and business.

He has published in the AtlanticBillboard, the Chronicle of Higher EducationFast CompanyForbes, the Los Angeles Times, the New York TimesScientific AmericanSlate, the Washington Post, and in many academic journals. He has also provided congressional testimony on multiple occasions on topics including drones, privacy, and intellectual property law.

Before joining the faculty at UCLA, Villasenor was with the NASA Jet Propulsion Laboratory, where he developed methods of imaging the earth from space. He holds a BS from the University of Virginia and an MS and PhD from Stanford University.

John Villasenor
Panel Discussions
Authors
News Type
News
Date
Paragraphs

The heated debate over the line between liberty and national security took center stage as Gen. Michael Hayden, former director of the National Security Agency and CIA, defended government surveillance programs at Stanford’s launch this week of “The Security Conundrum” speaker series.

If such surveillance methods were further restricted, “that smaller box, in my professional judgment, would make the job of the NSA harder and would probably make you less safe,” Hayden told a packed audience at the event co-sponsored in part by the university’s Freeman Spogli Institute for International Studies (FSI) and the Center for International Security and Cooperation (CISAC).

Hayden admitted to being “prickly” as he discussed privacy concerns over NSA’s collection and storage of phone and email metadata covering billions of calls and messages by American citizens. The surveillance programs, which were exposed last year by leaks from NSA contractor Edward Snowden, were only used after the Sept. 11 terrorist attacks, given “the totality of the circumstances,” Hayden explained.

Hayden was director of the NSA from 1999 to 2005. He then led the CIA from 2006 to 2009.

 

The metadata collection “is something we would have never done on Sept. 9 or Sept. 10. But it seemed reasonable after Sept. 11,” he said. “No one is doing this out of prurient interests. No, it was a logical response to the needs of the moment.”

Amy Zegart, CISAC’s co-director and a senior fellow at the Hoover Institution, led the conversation with the four-star general. She pointed out that a majority of Americans distrusts the NSA and believes the agency is lying.

Hayden stressed that the phone records were similar to billing statements – detailing who made the calls and when. “There is no content. It is not electronic surveillance. Not at all.”

 

zegart hayden CISAC Co-Director Amy Zegart leaders a talk with former NSA and CIA Director Michael Hayden at the inaugural "Security Conundrum" speakers series on Oct. 8, 2014.

 

Though he understands why the operation is “theoretically frightening,” in reality, it’s designed to aid in the capture of terrorists within the United States, Hayden said.

“To listen to the content of the calls would violate the laws of the United States. It would violate the laws of physics,” he said. He challenged if anyone could offer “concrete evidence” of harm stemming from the phone data collection.

In defining the right to privacy, Hayden cited his philosophy behind the balancing act between security and liberty.

“Privacy is the line we continually negotiate for ourselves as unique creatures of God and as social animals,” he said. “There are some things that the community has the right to know – and there are other things that they clearly do not have the right to know.”

The debate is over where that line is drawn, between “what is mine” and “what is owed the collective,” he said.

Hayden noted that the phone and email metadata collection programs are only a small part of the larger issues the nation faces as it deals with increasingly adept enemies and the surveillance abilities of other nations.

 

“I’m just simply saying – who knows more about you? One of the least of your worries is the government,” he said, half-jokingly. He noted that Google knows more about Americans than does the U.S. government, and the Silicon Valley company uses that data for commercial purposes.

Addressing how tech companies are becoming more reluctant to cooperate with government requests for email communication data, Hayden said he didn’t have an answer about how to address the relationship.

There is a call for transparency of what the government is doing, but Hayden said “translucency” might be the better option, so as to not reveal all that the U.S. does for foreign intelligence.

“This is an enterprise that’s based on absolute secrecy,” he said of the NSA.

Image
“We have to give American people enough information to be at least tolerant, if not supportive, of what the American government is doing.”

But to achieve that, “it’s not transparency,” he said. “We actually have to be translucent … where you have the glass … and you get the broad patterns of movemen

The danger of not being able to target emails, Hayden said, would be that emails become a safe haven for enemies. “If we don’t’ do it, if you’re not going to let us do this stuff … over the long term, it puts your liberty at risk because bad stuff will happen.”

“The Security Conundrum” speaker series looks behind and beyond the headlines, examining the history and implementation of the NSA operations, the legal questions generated by them, the media’s role in revealing them, and the responsibility of Congress to oversee them.

Each guest speaker, in conversation with Stanford scholars, will probe the problems from different vantage points to explain the political, legal and technological contours of the NSA actions, as well as outline ways to preserve the nation’s security without sacrificing our freedoms.

On Nov. 17, journalist Barton Gellman will be the featured speaker. He is known for his Pulitzer Prize-winning reports on the 9/11 attacks and has led the Washington Post's coverage of the NSA. On April 10, Reggie Walton, the former presiding judge of the Foreign Intelligence Surveillance Court, will take the stage as the speaker on April 10.

Along with FSI and CISAC, the series is also co-sponsored by the Hoover Institution, Stanford Continuing Studies, Stanford in Government, and the Stanford Law School.

Image
hayden packed

Hero Image
14341 security news
All News button
1
Subscribe to Cybersecurity