I do. I brought a copy of the book for Graham 4:00, and I don't think he's here, but I'm going to keep and give it to someone else as well.
But yeah, the book just came out a few days ago in the US. You can get it on American Kindle.
And people who know how to do cyber stuff can figure out how to get it in this country through the American version, the Kindle.
It should be out soon enough, but I never understand the relationship between Oxford, U.
S and Oxford UK terms of ownership.
So I don't know how that works. But they're not the same entity is probably a lot of email.
And I mean, I think one thing to mentioned is that I have a lot of publications the fans like.
It doesn't really matter.
I did a lot of research early on in my career on conflict processes, a lot of data work, a lot of stuff I don't really want to necessarily revisit.
I did a whole book on Tibetan movies for some reason. I don't know how it happened.
I just did. It's a long story, but I think what's interesting is that I feel a lot better about my stage of my career
right now because I found something that I think is interesting and important,
and that for me is cybersecurity, because there's a lot of bluster, there's a lot of hype,
there's a lot of assurance that we know something about this domain, quote unquote, without any evidence.
And to me, that's a huge problem. That's not what we do in politics.
That's not what we do in research. We don't say things based on the imagination of what could happen.
We say things based on what we know has happened and will happen based on evidence.
And that's what really structured my work and structure.
What I've been doing now, which I do with Benjamin Jensen, the Rain Man is all ears are theirs.
I throw the co-authors under the bus. Really? And that, of course, is in the cover of the book.
But the purpose of this next book, the second book I've done on cybersecurity, is really to understand just how useful our cyber strategies.
No one has really dived into that question. No one's really asked the question of what good are they?
We assume there's a utility for cyber weaponry.
We assume there's a usefulness. We assume we can use them against ice.
We assume that Russia was able to leverage these technologies against America during the 2016 election.
And while we have the presence of these weapons during these pieces, we have no real analysis of their utility.
Did they really work the ice? His story is a hilarious to me.
One of my favourite articles I think was written by David Sanger.
We're talking about America targeting Axis, and one of the things they said is the first thing Americans did is take out the power crisis.
Then they supposedly it happens. And my question at that point is, how do you have someone without power?
How does that work? You know, how do you leverage high technology tools against low technology adversaries?
And this is a challenge that we have in America right now because we assume future warfare will
be high tech when the reality is our adversaries from the last 30 or 40 years have been very,
very low tech. So now we've moved towards using high technology weapons against unsuitable opponents.
And this is because of the politics of defence acquisitions. This sort of hype have a line in the book, New Toys and bring new joys.
I kind of get the idea that a lot of people in the military think cyber tools are like Christmas Day.
You just unwrap your new toys and you want to play with them,
but then you find out they don't really work against the target you're trying to use them against.
And, you know, one of the funny issues here is in America,
the DOD literally asks for loud cyber bombs because they felt that the cyber weapons we were using against adversaries,
adversaries didn't know they were being used, they're being targeted. And for them, that was a problem.
They wanted, in effect, the same tool that we could have.
And we argue throughout this book is that cyber is not necessarily a new tool.
It's a new method that this is really a tool of political warfare.
This is something George Kennan talked about in the forties.
It's something we've been doing since the beginning of time, and that is covert operations, espionage.
But this is where cybersecurity really falls. Yeah, we put it towards the domain of warfare and violence.
And I spoke in front of the Senate in the U.S. and they kept asking me, well, where is the red line?
And I didn't really understand that question because to me, the red line is death.
But until we have death, I don't know how we're really going to get there towards this idea of massive cyber war.
It's not really a thing as far as I'm concerned. I think the bucket that we place cyber security in is utterly, utterly wrong.
And we need to rethink the concept. So cyber enabled tools will not replace traditional elements of statecraft.
They won't be new tools or leverage. The other thing is that these methods could be cheap, easy and fast are no substitute for traditional strategy.
If something is cheap, easy and fast, it probably isn't very useful.
The problem is what it says in the definition of cheap. It'll go away quickly.
The facts will not link and that's a challenge.
People ask me about Estonia. Weren't the facts there?
Wasn't that a devastating attack in 2007? I mean, some people certainly argue that as they argue with me in person,
but then you get them in private and they make jokes about how they use that attack to get NATO's to spend more money on the country.
So the reality is much different. They are the ones who carried out the attack.
They were, of course, were hacked by Russia. They, of course, were targeted.
But their solution was to turn things off and let it basically blow the story.
And reality is much different than a story we tell ourselves because we want these new sensational stories.
We want to understand this sort of revolutionary war.
And I think what we really have to kind of grass is the idea of a limited utility in destructive
warfare and a more useful utility and a change towards lower values of covert warfare.
I think that's the future. Innovation and military democracy is rarely revolutionary.
Instead, it's evolutionary as a process replete with unintended consequences and cascading effects.
And the challenge is that we focus more on the covert actions or aspects of cybersecurity.
There are many, many unintended effects.
And the reality is I am often in rooms of American military people who I have to kind of raise my hand and say,
you just kind of mentioned a war crime.
You probably shouldn't talk about that, because the reality is if you use cyber tools, there is no distinction between the attacker and the civilian.
These things don't really there's no distinction, really. They bleed from one side to the other.
Even Stuxnet attack on an Iranian nuclear plant underground in the middle of nowhere,
disconnected from the Internet, still affects the civilian population and still what out.
So that's a challenge, is that there are unintended consequences and possibly cascading effects.
And we have no grasp on what the intention or what the reality will be in the future.
We need to avoid the megaphone approach to cyber security.
Most Irish security talks will focus on one event the focus on the 2016 election, a focus on the Sony hack, but focus on Estonia.
They'll focus on Stuxnet.
We have a World War One ification of cyber security where we focus on these grand events and we don't really look at the scope of the problem.
And that's a huge challenge to understand any challenge in war, any issue.
We should look at the large recent history, and we do have a large recent history of cyber events.
We have coded over 192 cyber attacks between rival states.
So those are states with a longstanding history of antagonism.
We will spread this out and do a lot more, will go to states that are not rivals,
will hold non-state actors, but in the end recognise cyber disputes between recognised adversaries.
We're probably not going to reach more than 500 over the last 20 or 30 years.
That is not a lot of events, but that is enough to grasp an empirical history and empirical and understand an empirical picture of this domain.
And when you do this, we have a different picture.
The efficacy of cyber strategies is very, very limited, and the stories that we tell about cyber security are limited utility.
If they only really apply to one face when in as many cases as possible to achieve some sort of adequate leverage over our readiness.
And that's a challenge for cyber security.
If we focus on one case, we focus on this megafauna and megafauna basically means like harmless people studying the big things,
but not like the insects or butterflies or things that are more important for understanding, say, climate change.
We focus on the megafauna of cyber security. We miss the more useful information and taking a larger picture of the scope of cyber actions.
We have not seen them achieve knock out effects. We haven't seen them have dramatic change on the opposition yet.
This is still clearly a security problem and there does. We made a path to clear direction in this domain.
But this path to chaos and destruction in this domain is very different in the way most people talk about it.
Major powers now attempt to apply for some cyber strategies to gain a position of advantage relative to their rivals.
And on the other hand, small states and asset actors are using cyber operations to punch above their weight, so to speak.
So everyone using cyber powers. The major states have used them against other adversaries to maintain their power.
Smaller states are using it to reach and harm larger states.
These operations seek to achieve effects and compel the adversary to change their behaviour.
That's the reality of what compelled to use coercion well well occurs in the
second power few have uncovered how to measure and understand the effects.
And of course, the potential, because that's really what is at the heart of cybersecurity.
It's this promise of effect. The challenges in the field of cyber security.
There's very little analysis of what effect means and how we can understand effects and how we can understand change.
Actually, a cyber strategy is a critical question. We want to understand the future of cyber conflict and escalation.
I don't know how you could do one without the other.
I don't know how you understand the utility of a weapon without understanding how effective a weapon is.
And this goes to you know, it's been a life changing event for me to move from Glasgow to Cardiff to now work for the U.S. Marines,
where I work for the U.S. Marines. We talk about battle damage assessment quite a bit.
We talk about how useful their weapons are and what effect they have.
But when we talk about cyber security in the U.S. military, we don't talk about battle damage effect assessment.
We don't talk about how useful these weapons work.
It's more of a rush to use these new tools to justify their utility without evaluating their effectiveness.
And that, to me, is a huge conundrum in a huge problem.
And, of course, there's a huge promise that impacts about the sovereignty and the U.S. national security strategy.
U.S. National Security Strategy says cyber attacks offer adversaries low cost
denial opportunities to seriously damage or disrupt critical infrastructure,
cripple American businesses, weaken our federal networks, and attack the tools and advice of Americans every day to communicate and conduct business.
Cyber Revolution. US and academia see lines of code as potent.
Cyber weapons that create strategic instability via magic says cyber warfare capabilities are leading to new remains revolution in military affairs,
wherein cyber capabilities will play an increasingly desirable role in military conflicts.
One of the things that's often said about my career is I've been attacking strong.
I guess maybe you can say that. But the reality is there are a lot of strong man in the field of cyber security.
There are a lot of people that say things without evidence and promise a lot of impact and promise a lot of change.
And to me, as an American, I want to understand, is that really true?
Do we have any evidence for any of this? And for me, a lot of this falls in the range of coercion and compliance, according to the use of threats,
punishment and restoration of force during a crisis or conflict to alter foreign policy behaviour,
cyber coercion that would be digitally exploiting the power to hurt and escalating the cost of taking certain actions.
So in the digital domain, using using these tools, basically founded on microprocessors to escalate cost.
But of course there's a difference between deterrence and compels a threat or intended to make
an adversary do something versus the threat intended to keep adversary from doing something.
Everyone in cyber security focuses on a cyber deterrence, which by definition would mean deter an adversary from doing something.
I don't know how you witness someone not doing something. So it's tough to evaluate that with empirical evidence.
But you can seek to evaluate what evidence a threat made to make an adversary change their behaviour will compel us.
So it's a big distinction. A lot of people missing shortly, but for us our focus is on balance.
And cyber operations are meant to shape how rivals will manage a crisis as an actor
could compel an adversary sort of physical attack or also signal the risk of escalation.
And that is a key aspect of cyber security. It's not all about massive war and it's not all about massive destruction.
In fact, I think a lot of people watch Battlestar Galactica too much, or even potentially my favourite cyber security movie, WarGames from 1982.
There hasn't been a good one since that really challenged me on that one.
But this focus on massive destruction.
Sure. The massive effect really belies what we think is going on here and that's using methods
short of physical attack to change behaviour and all attention to signal intentions,
to alter the balance of information and to also signal the risk of future escalation.
We're finding something strange about cyber security. Cyber actions actually limit escalation.
The entirety of the discourse of cyber security tells you this is going to be an escalatory domain.
We find very little evidence of that, and that's a huge challenge.
That's a huge problem. We keep talking about opening the Pandora's box of cyber security.
Yet even when major powers were attacked by lesser adversaries, they refused to attack back.
And my future work, which we're doing now,
is we're doing cross-cultural scenarios which are basically experiments to look at decision making of people who leverage cyber weapons.
And we're finding even military government.
And of course, every experiment has students.
All of them refuse to escalate because they don't think it's really worth escalating to war over a digital effect or digital attack.
And that's a challenge for the entire discourse, because the story in reality is much different than the story we craft in our mind.
And this is something that bothers me about the field. There are a lot of unfulfilled promises of cyber campaigns,
and neither as revolutionary nor as normal as they seem when evaluated with evidence that I offer my hypothesis.
Me and Ryan Anderson tell the 15 that adversaries of digital front are restrained.
They're constrained in their options. They're unlikely to engage in cyber conflict because of normative restrictions,
because the proliferation of cyber weapons and the risk inherent within tested options.
So no impact out of it. There are enormous cybersecurity. They have been created.
They're not very strong, but they are there. The other thing is cyber weapons are I don't know how you want to put it, use it or lose it, so to speak.
You use a cyber weapon, it gets out into the wild.
Anyone can use it and send it right back to you. That's an entirely different way of using a weapon than, say, a cruise missile.
It's tough for us to use zero day weapons because once you do, you can't use it again.
You've lost that in your arsenal and that's a challenge. And then finally, the military hates using untested weapons.
They despise it because everything the military does is about success.
It's about achieving success and not getting fired and making it to the next promotion y than what the military offered to use weapons.
And they have little probability of knowing how useful they are because they had not used an actual day to day combat situations.
So we offered those theories before. When we go one step further now and the next book in the Cyber Strategy book,
we're suggesting that cyber strategies produce limited course of effects and actually limit escalation.
So the reason we are arguing that cyber strategies are unlikely and are rarely used is because they're not very effective and that when they are used,
they're actually used as signals to limit escalation and actually contain the potential for warfare.
We find the utility of cyber warfare in the form political warfare optimised for 21st, 21st century lies, and it's formed as an ambiguous signal.
That's not a plausible deniable signal. You do it.
You send it out there, but you're not really attached to it.
You could deny that you ever did. It proved to have the best quote when you said, I don't think we hacked 16 election, but we have hackers.
And sometimes they wake up and they're very patriotic and they decide, hey, let's defend Russia, let's attack America.
He literally said that basically, you know, like we work for the that's the idea.
But there's no assurance that you actually did these things because it's tough
to pinpoint the chain of command and who is actually watching these operations.
But also, never underestimate the stupidity of the people watching these operations, which recently found that Gusev,
for the one passing information to WikiLeaks, his Twitter account was logged in to from the GRU in St Petersburg.
So they had like, you know, 180 lagoons and they found that one where you made that one mistake.
And there's always that one mistake. There's always that behaviour.
There's always that thing that a hacker does that gives up.
Who? They are, it's tough to really hide them because they are human beings.
No, I'm not talking about A.I. and cybersecurity. That's a whole other thing.
I don't really know how to handle that just yet, but as we have humans involved,
humans often make mistakes and we can figure out where a lot of these attacks come from.
But because we know where the attack comes from, it doesn't mean we won't know who ordered that attack.
We don't know. Our president is saying it. We don't know. President Trump is saying it.
We don't know how Putin is ordering these things. But we knew they were.
We do know who does. So that way, a sort of plausible deniability is a form of ambiguous signal.
And in political science and international relations,
we have largely failed to understand both ambiguous signals and covert actions and convert attempts
to demonstrate resolve to rely on seeking costs a rising the risk to shape rival behaviour.
That's really what cybersecurity is. It's cover attempts to raise costs to shape the behaviour of the Opposition.
They're not massive, massively destructive. They're more ways of just kind of signalling that this isn't what we like.
Let's do something different. Or in some ways they're harassment episodes.
So we divide cybersecurity events into three buckets.
This is just state to state right now. So we're leaving out crime.
But disruption is harassment. Probing signalling in.
They may have espionage to manipulate data and perceptions to alter the balance information to steal data.
And then you have the great operations which are covert efforts to deny and sabotage.
Those are the most destructive types of operations over the last, you know, since 2000.
This is the picture of cybersecurity, 182 incidents in our dataset.
I could talk about the dataset all day long, but not really to dive into that now.
But you get the picture that there are rising cyber conflict events.
But these are events are predominately dominated by harassment and espionage.
That's what these two are. The degrade often the serious destruction options are very, very minimal throughout history.
We don't see very many of them. And these are the megafauna events.
So the thing is, we talk a lot about these grand cyber events, but in proportion there are very, very rare.
And these are the significant attacks.
You know, I can't capture every deed off, every attempt to change someone's password, every sort of problem, every intrusion.
That's beyond our capabilities. We're talking about significant government efforts to harass, to use espionage or to degrade.
And that's the picture we get. Our major finding is that cyber warfare produces only limited concessions.
192 episodes of cyber wars between rival only 5.2% achieve compelled success, which seems bad.
That's pretty good for coercion. But that's just tells you how bad caution is as a tool.
Coercion rarely ever works. The history of coercion is a very tough story of telling.
We we will threaten this. You will do this. There very rarely happens.
Think of it like a child. You tell a child what to do. They're more likely to do the complete opposite or it is tough to achieve.
Cyber degradations are more likely to achieve concessions and other forms of cyber strategy.
So the more serious events obviously are more likely to change behaviour.
The problem with that finding is all the cyber gate majority or all of the cyber
events that produce concessions all involve the United States not being biased here.
That's just what we know. And the problem is, if your findings are dominated by one state, your findings are probably biased by that one state.
So it's either an outlier. America is super effective.
Everyone super weak. I don't you can tell whatever story you want to tell the social scientist.
To me, this is a challenge because all my events are driven by one state.
It doesn't make it for a generalisable finding. And even if you unpack this, the story isn't very good.
The United States and Russia are in a continuous cycle of China attacking China, stealing America,
countering with counter espionage, China stopping and then starting right back up again in the year later.
So there's just this continuous cycle that always happens.
Now, we should expect that to happen. That's just how international politics works.
The reality is, until we resolve the foundations of disputes between, say, Israel and Iran, US and Russia, i.
The U.S. and China were never going to solve these cyber disputes.
And these cyber disputes are going to continue. But are they going to be these massive, revolutionary, destructive events?
We don't really think so. Neither past cyber emissions nor state's leading cyber power are empirically associated with concessions.
Military and economic power appear to be better explanatory factors.
So we get logic, regression analysis of statistics.
We controlled for all other factors, including regime type, military capabilities, military power, economic power.
We have a measure of cyber capacity based on superconductors, based on engineering degrees, based on cybersecurity publications.
And the only thing that seemed to matter is kind of basically if you use cyber events on the past, in the past, you're more likely to use them again.
Not necessarily confounding finding that's what you would expect to find.
But the reality is nothing else really seems to matter that much besides economic power.
So is it cyber that's making these states more effective when they use these tools?
Likely not. And even when cyber exchanges between rivals escalate, they remain limited in scope outside ongoing military conflict.
So when we see escalation on a ten point scale, it often is from a two to a three, not from a two to a six, not even from a 2 to 4.
I think we have one case I should remember which one it is, where they jump to level on a severity.
This other deeper problem is we have very little grasp on what escalation is.
If I read one more application for American's escalation ladder for cyber security,
come either know we need new ideas and new thoughts about how escalation works because we are focussed so much on the era of nuclear power,
we haven't been able to leverage this era of nuclear power on the future of warfare as it is now,
which is, hey, AI, drones and cyber and special operations. The two things don't match.
I just declined to review a book on nuclear and cyber war because I just said I'm not going to be fair to it because it's just a dumb idea.
We cannot connect these two things. They're disconnected quite a bit.
Country specific results. We have case studies. Of course you do have cases.
Oh, and I did this in front of a moscow State University professor.
I'd say she was very upset. I used to represent Russia and I would be upset if you use a bald eagle.
It's like, you know, losing hair or something good for America. But Russia is a diminished power.
She's probably more upset with that. Has a political system,
a flatter economy and limitations on military spending in cyber strategy is a
disruption in this information as a cheaper way to seek out its political voice.
It can't do much more than that. There's a overblown view of impact the election of 2016 with neither cheap nor very effective.
But it was noticeable. And that's a challenge for cyber security because there's so much attention on these events.
You gain notice, but it doesn't mean it changed anything.
And I really hate to parent Trump's line about this, but I think first,
the monkey cage with the time went out and looked at all the polling organisations in America and we asked them,
Do you have any polls that show WikiLeaks having an impact on voters?
You've never seen one. We can't find one.
It's not to say there's not an impact there. Likely it is because the race was so close in an event so close,
any little thing can have an impact but asked for a major impact and change in how America thought about Hillary Clinton.
Now, it really just kind of reinforced views of people who already hated her.
That's really all it did. It didn't really change much.
We cannot find evidence for that. So it's not very effective.
But it doesn't mean it wasn't insidious. It doesn't mean it wasn't challenging.
It doesn't mean it's something we don't need to worry about. I'm not saying cyber is not an issue.
I'm saying the frame when we talk about cybersecurity is completely and utterly off.
We talk about it in a frame of warfare, and we really need to talk about it in a frame of espionage and covert operations.
And we need to think about it more for the domain of psychological interpretations and perspectives.
We need to look at it from the the view of blowback are behavioural psychology,
but instead we focus so much on this nuclear race strategic perspective.
Russia is using Ukraine as a testing ground, not what's not, it's just trying to win a war.
Ukraine is not doing very well. It's been stuck in the airport and the last.
For two and a half years. That side was not helping Russia win anything at all.
It only does it because it can't do much else.
China rising good powered and attempting to bridge the gap economically, militarily, to logically with a status quo competitor.
And the challenge was in the eighties and seventies, China went out and sought to steal its way to adaptation and innovation.
And they continue that with cyber security. The problem is you cannot steal your way of innovation, adaptation, and it doesn't work.
My favourite story of that is all the Japanese distilleries that bar Scottish whiskies.
I used to live out of Glasgow that they couldn't move it.
They couldn't take a distillery, move to Japan and reproduce the same thing.
There's something about techniques, knowledge, about developing the technology yourself.
I think China has realised that, but the early history of China cybersecurity was very much about stealing information.
The problem was, is that you would actually see China steal information two or three times and that would tell you there's a lack of coordination.
One group would steal something and another group was still the same thing a few months later.
They're not talking to each other. They're not digesting that information because there's just so much of it.
It's tough to really do much with all this volumes and volumes of information there.
China's new strategy, I believe,
is more focussed on protecting their interests in the South China Sea and preventing internal revolt and and and kind of
becoming the leader in what we call digital sovereignty and ensuring that each state can control their digital territory.
And that's really China's focus now. So they become less dangerous in our eyes if we have a proper perspective on what they've been doing.
But all states, the America does the same thing or Russia does the same thing.
We should have blamed one state for espionage over another. This is the second oldest profession in the world.
The question is, how effective is it? I don't think we have a good grasp in terms of espionage on does it really work?
Do you really get anything out of all this analysis, out of all this information?
You know, now it's become a lot of people who work for the CIA have just been reading newspapers at this point.
That's really what's what espionage has become in many ways, America.
That's just the logic of superiority over Russia and China.
And what America basically does is where we stand at this precision shred complex to cybersecurity and the precision strike complex.
There's this view in America of targeted operations.
Probably the worst story I've ever heard about Trump is when they showed him that they have these
new munitions that limit civilian casualties and how they waited for a terrorist to leave a house.
And that's when they used a Stinger missile.
And then Trump said, Well, why would we do that? We do that because that's what America does in the military.
That's their doctor. To limit collateral damage, to be precise.
We use America uses cyber capabilities sparingly because we don't want to give access to
our superior capabilities in cyberspace and because we need to have precise strikes.
I mentioned before there's a lot of collateral damage in cybersecurity.
We want to limit that. America, you know, we talk about having a cyber operative at every regiment.
The challenge for that would be, though, we would also need to have a legal analyst at every regiment.
You cannot disconnect cybersecurity in America from legal analysis.
There's so many rules about what you can do and what you can do to other people's computers.
It's such a real tense weapon, and to use it effectively, we would need to go no holds barred.
And that's something that maybe John Bolton might be willing to do.
But out of the last 20, 30 years, America has been very careful about the use of cyber capabilities for harm, for destruction.
It doesn't mean America doesn't use it for spying, for espionage and intrusion.
Of course they do. That's just what the CIA does.
They need to do something. Everyone has a job. Escalation in cyberspace.
Stance of escalation ladder know that's the Herman Collins escalation ladder, which has 42 steps or 44 steps.
There's nothing like that. It's just [INAUDIBLE] for tat.
Or you can view it as a cycle. Espionage does not lead to escalation.
It just leads to you get caught for escalation that you you bar a few people.
You make a lot of people persona non grata. The other favourite thing that happened was.
We kicked the Soviets out of the Seattle and actually they had because they were trying to recruit Microsoft people.
They called the cops on us because all the Americans went in with the same devices and tried to sweep the building.
So they were being upset about that. But for my enforcement,
for there is a danger that the UAE recently used covert cyber capabilities to suggest that Qatar had said things that they did not say.
So that's really, to me, the problem, the fear change in data, manipulating data.
Forget what they call now, but they have a new term for it when you can just like change someone's face, do the video analysis.
That's the real fear. But that's not cyberwar.
That's just espionage, covert operations, propaganda.
It's nothing really different.
And the other thing is there's a key importance of political attribution that we make a lot about the attribution problem.
But if these events happen in the context of a rivalry or let's say a company called
Sony gets hacked because they're making a movie about the North Korean dictator,
they were probably hacked by North Korea. It doesn't take a lot of analysis to figure that out, but a lot of people reject that idea.
The cybersecurity and the digital people believe they are above politics.
They believe that politics is a part of their process.
Robert Lee, a very prominent cyber cyber analyst who formerly the NSA and I see and I say was
in a big New York Times article the other day talking about how his company,
Dragos, doesn't do attribution because of political issue.
And that's right.
But the problem is, if you're going to talk about who the attacker is and what their motives are, you should probably know who the attacker is.
And limiting or dividing the buckets between digital technology and politics is not going to work on these.
Two things need to be combined together, and that's a whole education challenge.
That's a whole infrastructure challenge. That's a whole challenge for the whole of government approach to cybersecurity.
We also are seeing the newer attacks too between government on private industry.
And that's another issue because what's the proper response?
You know, America, NSA, NSA knew that Sony was going to be hacked.
They knew something was being hacked. We were watching Sony hacked.
Well, what are you supposed to do? You're supposed to be intervening.
Blow your sources. You're intervening. You're going too far in protecting a civilian organisation that might not want that protection.
They may not ask for that protection as a whole. Another source of challenges.
And it's not about this public private partnership people could be talking about.
There is no partnership. There is no exchange of information.
There is no collaboration that needs to happen more.
And that's going to be the real challenge. To me, cyber security is more about a human security issue.
How do you protect private individuals who are more likely to be harm than government?
And we have no answer to that. We don't know who you're going to call.
You know, we have this issue where Trump keeps saying, why didn't the DNC turn over their server?
They did. To cyber security firms who were made up of people who are former NSC people who left because they make more money in private industry.
That's just the way the world works now that now private industry is probably much more capable of doing a lot of these technological espionage.
And that's a whole big challenge. My friend wrote a great article called Blue Hairs.
It was a War on the Rocks. Jacki Snyder But what she's talking about is the people who do technology at a high rate,
who are very good at it, don't fit in government, they don't fit in government structures.
I heard many a general talk about why, while for a cyber operative they must know this system,
that system and that system, and they must know this code, and that doesn't work.
We all know how we train students. We know how we develop.
How some of the best talent we develop comes from non-traditional sources, and we find it in non-traditional ways.
Yet a lot of things we do on cyber security is about replicating traditional ways of learning and methodologies.
That doesn't really mean that we're going to lead to some sort of revolution.
So the challenge in practice, you do a lot of work on cyber conflict is a new means and of course, in political opponents demands.
We understand the realities in the limits of innovation.
We talk too much about the possibilities, but not enough about the limits.
I'm a pessimistic person. American and Latino from L.A.
I do things differently. I've always never trusted the government. I grew up in Rampart Division era.
You know, the whole idea of, you know, the cops planting things on American civilians.
I've always been sceptical in my life and I think it's important here.
The story we're being told doesn't match with evidence that there are limits to innovation.
There's a woeful need to understand the processes of decision making and psychological reactions.
So we need to understand more how units make decisions as a collective group, but also the psychological aspects of cyber security.
Because it is changing our brains, it's changing how we behave.
There's change in our dependencies. It's becoming an addiction of sorts.
We can't frame this as a war. This is more of a challenge and the elements of basic human behaviour.
We haven't done enough psychological work.
Michael GROSS and his team is doing good work, but I think others need to do more and we're doing more work on decision making and wargames.
But we urge caution. States seeking to leverage cyber actions to achieve decisive effects are likely to be disappointed.
Digital effects have been slow to emerge and tend to amplify rather than replace traditional elements of power.
It's just making the strong states strong. That's all it's really doing.
The story is not much different to the future.
One, we have a very clear problem with threat inflation.
If we inflate the threat too much and talk too much about the danger of a massive cyber war from Russia or China,
we're not going to prepare our defences for the future. We need to do the basic things first.
We need to understand how we're going to control access, how we're going to maintain privacy,
how we're not going to let Facebook keep everyone's data away. These are current challenges.
Yet the story we tell is much grander and much different.
And the reality of the fight on a day to day basis is not a domain of novelty or escalation or conflict spirals.
Cybersecurity is a domain of covert operations and an international.
Relations. We have very few people who have done good work on covert operations.
Bob Jervis, Austin Khazan, Caramello but there's very, very few of them.
I think that's where the future of international relations needs to go.
If we're going to understand a revolution in our relations, it's more of a revolution towards covert operations,
away from these more escalatory, dramatic conflict events.
There are a lot of underappreciated strategic risks in cyber security blowback, which means a weapon can be used right back at you.
There are one shot weapons that can be spread. They're untested.
They're risky. We put a lot of promise in cyber security when?
After we actually talk to a lot of cyber operators, they're very dubious.
They're on weapons because they know the limitations of their weapons.
The difference between the story the news media tells, a story cyber operators tell is drastically different, and that's a problem.
I think we need empirical research to back that up. Whatever you want to call empirical research, it doesn't really matter.
But case studies data were psychological experiments, scenarios.
But I want things grounded in the real world. There's too much done in cybersecurity, on flights of imagination, in the hypothetical.
All hypotheticals must be grounded in what is plausible, and you can't do research on things that are not exactly plausible.
A lot of the research people seem to do seems to be based on this grand idea of a cyber war,
you know, made up from Battlestar Galactica or, say, the Ghost Fleet book.
Ghost Fleet book. That's just not what's happening. We have to understand a process of modern political warfare.
When states like Russia have a view of status that isn't being met, in reality,
they have a very limited ability to change that perception of their status.
And cyber is one way of doing. Cyber is one way of trying to achieve notice, but it's not a way of achieving impact.
And the other thing, too, is we have seen covert operations.
We've seen reflexive measured by Russia during the Cold War.
You know, they they said America spread HIV, things like that.
We never threatened to bomb them for this, but we do now all the time because the 216 and 16 election.
And that's a problem. And then I think in the end, the two challenge, I think in the future is more of a personal thing.
It's a human security issue. It's about cyber repression.
We're talking earlier about the idea of cyber being a liberation technology.
That's actually the complete opposite of that for many countries. It's actually a way of repressing and controlling your population.
That's where cyber security is very effective. It's not effective in state to state and state to individual.
So the framework we use to evaluate cyber security is entirely wrong.
I shouldn't have written that book, but that's what people wanted me to do.
There's a whole other product that I think is more important and that's trying
to understand how states are using these actions to control their population.
And we need to document that. We need to seek to name and shame it.
We need to involve the U.N. and other civil society organisations.
But we're so focussed on this idea of massive cyber war, I think we really miss what is going on.
It's not a revolution of warfare between states. It's a revolution of warfare between state versus individual.
And that's where I think the future needs to go and where we need to investigate in the future.
So thank you. I'm open to questions.