In the space of about one minute, Secretary Kirstjen Nielsen of the Department of Homeland Security gave three tidy one-liners, each of which could describe how she sees the problem set of cybersecurity. First: \u201cyour risk is now my risk, my risk is now your risk.\u201d Next: \u201cwe have a weakest link problem and the consequences affect us all.\u201d Then: \u201ctoday we are all on the front lines of a digital battlefield.\u201d Together, the lines plotted a through-line to her keynote: it will take collective action to adapt to cybersecurity threats, the attack surface is vast, and government views it more as a conflict than as a technological challenge.<\/p>\n\n\n\n
While other news overshadowed headlines about cyber, the first year of the Trump administration saw massive attacks and breaches across the board. In her remarks, Nielsen focused on three of the newsier ones: the Equifax breach, which included information on roughly half of Americans<\/a>; WannaCry, the malware that notably hit hospitals in the United Kingdom<\/a> but as recently as last month caused a minor panic at Boeing<\/a>; and NotPetya, an attack that hit companies all over the world<\/a>. The way we refer to these attacks reveals the distance between them. WannaCry and NotPetya are known by the name of the attack tool, while Equifax we identify because it (and its massive database) was the target. What can keep information safe against both sophisticated attacks and sloppily defenses?<\/p>\n\n\n\n Government and politics, Nielsen argued, though she did not specifically invoke those terms. Nielsen compared individual cyber security to a family in Florida that only puts sandbags around their own house when the flood comes. Without working with neighbors to protect flooding in the neighborhood, the single sandbagged house will still be overwhelmed when the water rises, and the preparations will have been for nought.<\/p>\n\n\n\n Household metaphors were a persistent theme for the keynote. Remarking about the changed nature of attacks, Nielsen compared the attacks of a few years ago to a smash-and-grab home invasion that left broken glass everywhere, obviously and clumsy in execution. Today\u2019s attacks, she continued, are more like sophisticated break-ins, where nothing looks disturbed and the intruder may still even be in the house when the family gets home.<\/p>\n\n\n\n As for an answer to this problem, this inevitable flood and this covert intrusion, Nielsen\u2019s prepared remarks focused largely on norms. The United States is vulnerable to other attacks because aggressors feel they can get away with those attacks. To that end Nielsen suggested that the world, primarily governments but also tech companies, need to establish norms for cyberspace, rules and boundaries and hard lines. Backing up this would be an emphasis on deterrence, a promise of some retaliation in some form for some hostile acts.<\/p>\n\n\n\n \u201cTo those who would threaten our security and sovereignty, I have a simple word: don\u2019t,\u201d said Nielsen.<\/p>\n\n\n\n The how of that deterrence, and the nature of those norms, went unspecified in the remarks. In a question and answer session with CNBC\u2019s Deirdre Bosa, Nielsen had an opportunity to expand on the concepts further. The context, provided by Bosa, was the \u201cCybersecurity Tech Accord<\/a>,\u201d a proposed \u201cDigital Geneva Convention<\/a>\u201d drafted by over 30 tech companies, most notably including Facebook and Microsoft. (Big names absent from the accord at present include Google, Apple and Amazon.)<\/p>\n\n\n\n \u201cWe need norms. Part of our adversary\u2019s threshold being low is norms are not recognized,\u201d Nielsen said, while clarifying that she not speak to the specific of the rules as proposed. As to the absence of companies like Google, Apple, and Amazon, Nielsen noted that \u201cother companies have other ways of contributing to security infrastructure.\u201d<\/p>\n\n\n\n The Secretary pointed to a joint U.S.\/UK statement<\/a> issued by the Trump and May administrations as nudge in the direction of norm setting, though norms take more work that simply two countries working together.<\/p>\n\n\n\n Tackling the other thrust of norms and deterrence, Bosa asked Nielsen if the U.S. was prepared for offensive cyber. Nielsen hedged, saying that there are a lot of ways to interpret \u201chack back,\u201d then followed up by saying \u201ceverything is on the table.\u201d<\/p>\n\n\n\n \u201cIs that a yes on offensive?\u201d Bosa pressed.<\/p>\n\n\n\n \u201cThat is not a DHS function,\u201d Nielsen replied, and then went on to note that DHS has a team that coordinates cyber with other agencies. As presently organized, offensive cyber<\/a> falls under the prerogative of U.S. Cyber Command.<\/p>\n\n\n\n Finally, Nielsen was asked about the trade-off between privacy and security, especially in light of the European Union\u2019s General Data Protection Regulation (GDPR). Nielsen went on at length about the different cultural norms between Europe and the United States, and then noted that by protecting individual access to privacy, government agencies may lose some ability to see the big picture. And it was in this last moment that Nielsen broke from the metaphors about connected security, about a battle against nefarious actors where everyone is on the same side and benefits from the same actions, taken together.<\/p>\n\n\n\n \u201cDo we need a Digital Bill of Rights?\u201d Bosa asked.<\/p>\n\n\n\n \u201cDepends on what\u2019s in it,\u201d Nielsen said. \u201cWe need norms of digital responsibility.\u201d<\/p>\n\n\n\n