6th European Conference - Academic Conferences

Merritt Baer
security end-result, as is presumed by security-investment-level calculations. See, e.g., Schavland,
Chan and Raines (2009:629): “Our model places a dollar valuation on the insurance we are willing to
purchase for information security." Yet the assumption of a linear connection between investment and
security is generally inaccurate. Karen Evans, Administrator for Electric Government and Information
Technology, Office of Management and Budget (2007), emphasized in a statement to a congressional
subcommittee that when it comes to e-security, neither high spending nor high regulatory compliance
translate directly to actual higher security.
Because of the private sector‟s lack of incentives to collaborate, coupled with private companies‟
incentives not to divulge information about breaches (See, e.g., Gal-Or and Ghose 2004), there is an
opaqueness about cybersecurity vulnerabilities which can produce misinformation. For instance, there
has been a longstanding assumption that cyberattackers are exploiting unpatched computers after the
patch has been released-- Internet security expert Eric Rescorla (2004) has even argued against
disclosure and frequent patching for this reason. However, the latest Verizon data breach report does
not support this: "In the past we have discussed a decreasing number of attacks that exploit software
or system vulnerabilities versus those that exploit configuration weaknesses or functionality…[This
year] there wasn‟t a single confirmed intrusion that exploited a patchable vulnerability” (2010: 29). In
other words, as Verizon‟s 2009 Report stated, "vulnerabilities are certainly a problem contributing to
data breaches but patching faster is not the solution” (2009:18).
There is another concrete instance of misinformation in the “60 Minutes” video (2009) that claimed
that the Brazilian powergrid was taken down by hackers. While the video met wide acceptance and
generated apocalyptic fears, Bob Giesler, Vice President for Cyber Programs at SAIC, soon avowed
the video to be “part of the dialogue that is absolutely wrong. The Brazilian powergrid dropped
because of poor and faulty maintenance.” Giesler was corroborated when Wired Magazine (2009)
reported that there was an investigation, and the blackout was “actually the result of a utility
company‟s negligent maintenance of high voltage insulators on two transmission lines.”
Misinformation about our cyber nemeses obscures analysis of policy needs and threat prioritization.
Game theory cannot apply efficiently when we miscalculate or fail to identify those against whom we
are playing.
4. Moving from a linear to a biological model
High reliance on private sector for cyber development means the DoD must use a customer-driven
intelligence model, identifying needs and contracting for them. Yet competition for contracts does not
occur in a perfectly competitive environment, and reliance upon it incorrectly presumes that the
government has perfect information about their own needs and the risks of disclosing them. Umehara
and Ohta (2009: 323) model transparency as a zero-sum game, and “assume that when a
government agency makes a decision it knows the total amount of the potential damage." We may
need to reevaluate the customer-driven intelligence model to find ways to harness more of the
brainpower that exists not only in the private sector but also within the nonprofit, academic, and
government domains—such as the working group that came together to face the Conficker virus
challenge (See Moscaritolo 2009).
Similarly, there are “weapons” confronting the DoD in the cyber arena that do not come from
traditional or foreign enemies, such as the Wikileaks disclosures. As Giesler (2009) phrased it, “The
challenge to the government is: how do you harness that decentralized, netcentric organism? How do
you enable the ecosystem's antibodies to react to these things as opposed to regulating and breaking
it down? How do you nurture that reaction?” This decentralized power emerged in the response to
Pakistan blocking Youtube-- as Jonathan Zittrain (2009) reminds, this was a crisis to which NANOG,
“an informal network of nerds, some of whom work for various ISPs,” promptly responded.
Cyberwar strategy requires us to think outside of a linear security-investment frame of mind toward
weapons development. The most accurate model of cyber threat appears to one that is biological—
specifically, one that is epidemiological— in its response to invasion. In the case of the Estonian
cyberattacks, Giesler (2009) offers as example, “it was the banking sector, it was the tellco sector that
responded,” and “I started to think „Maybe that's the right model. This stuff is so decentralized, the
problem is so pervasive and so fast…how you organize around a problem will dictate how you solve it
and it requires a lot more dialogue.” The Department of Defense has recognized this interweaving of
capabilities and data, and released the more oblique statement, “We are in the Age of
Interdependence, out of the Information Age” (DoD 2009 Vision Conference).
26