Wed. May 27, 2015 Get Published  Get Alerts
HOME  |LOGIN
ABOUT | CONTACT US | SUPPORT US
Interview: Dr. James Andrew Lewis

Comments(0)
By Cynthia Iris, Senior Correspondent


International Affairs Forum: In a New York Times article on January 8th, you had said that there was no doubt within the U.S. government that Iran had been behind the wave massive attacks and online banks. Is there a digital fingerprint there?

Dr. James Andrew Lewis: It’s hard to say. The better answer might be that the U.S. has other means for figuring out what the Iranian government is up to. And that that probably contributed to, or buttressed, or expanded the digital fingerprint. So, in other words, we spy on the Iranians. The private sector guys who did the forensic investigation didn’t find enough to be conclusive. I think what happened is all the other things the U.S. does probably provided that conclusiveness. [Also], it’s not just the U.S. It could have been any number of countries who are looking closely at Iran.

IA-Forum: From your Profile Page on CSIS’s website, it seems you have an article on Stuxnet (a computer worm that attacked Iran’s nuclear centrifuges) coming out, entitled, “In Defense of Stuxnet”. Can you give us the top two ideas that you’re trying to convey in the article?

Dr. Lewis: Yes. (The article has been published in Israel). People don’t like covert action, but it’s been something that the U.S. has used against authoritarian regimes since World War II. And this is just a new tool in the long covert struggle with Iran.

IA-Forum: Russian President Putin ordered the Security Bureau, the FSB, to create a system to protect the government computers from cyber attacks. How effective can any government be, the U.S., Russia, etc., in this regard when many cyber attacks are undetected?

Dr. Lewis: That’s a good point. Putin’s intent was not to protect against cyber attack. It was to protect against political dissidence [it was focused on the media]. You don’t want to say I’d like to repress free speech. Even, that’s a bridge too far, even for the Russians. So you say “I’m going to protect against cyber attack by helping my media friends”. Ask yourself how you’d like the FBI to have complete access to your network? “To help you”. See what people say -- “gosh, I think it’s a swell idea”. So it wasn’t. There are things you can do. It’s not impossible to protect. But that was not the intent.

IA-Forum: So following along a piece of this, let’s talk about President Obama’s “Preemption Doctrine”. It’s hard to be successful with this approach because the target organization often doesn’t know its network has been compromised. What then?

Dr. Lewis: There’s a difference though between the target organization and the National Security Agency. Just as in the Cold War we had satellites and national technical means that could detect an imminent threat, there are similar sensors that can detect imminent threats in cyber space. They’re not perfect. And I don’t know what the success rate is. Is it one out of three? Is it two out of three? It’s somewhere in that range. So two out of three times we’ll know something’s coming and can block it. Does that mean it’s perfect? No.

IA-Forum: So let me follow that a little bit. I know we’ve got the technology, but are human assets, spies, back in demand because you said there were “two out of three” they could find. Where do human assets come into this cyber security equation?

Dr. Lewis: The way I look at it is cyber is just sort of like a new element to the larger equation of espionage. So you have spies, satellites. You have drones. And now you have hacking, right? So I think the part that often gets lost in translation is for major intelligence agencies, they’re using a portfolio of all these techniques.

IA-Forum: On Twitter, back in December, you wrote that cyber is an “inelegant” term. Why?

Dr. Lewis: So what are we talking about? We’re talking about network devices. And that’s not particularly elegant, either. We’re talking about network devices that have some computing capability. So, do you want to say “network computing devices”? So “cyber space”, it’s one of these portmanteau terms. We make it up. Like ‘globalization’. Because it covers a range of things. I mean, let’s just say one word rather than actually be descriptive. That’s where it becomes a substitute for thought.

IA-Forum: General Keith Alexander, the head of the DOD’s Cyber Command and head of the National Security Agency -- is he, by virtue of these jobs, America’s chief information officer (CIO), de facto?

Dr. Lewis: No. There’s someone the Office of Management and Budget (OMB) who has that role. [The head of the Office of E-Government and Information Technology in OMB]. He’s the CIO and they think about how (for the government and for the public) you get access to information, how you manage information systems, how you create the ability to easily find information and data.

IA-Forum: In Foreign Policy recently, you wrote, “The long-standing U.S. position that an open, free Internet is the best for innovation and growth is no longer persuasive. America needs a more compelling narrative to defend universal values. The battle for the Internet has begun, and we need better ideas if we are to win it.” Does the U.S. have a more compelling narrative now?

Dr. Lewis: No. That’s one of the things we have to do is develop that. I’m sort of working on it; other people are working on that. Here’s an easy illustration: ‘a free and open Internet is crucial for economic growth’. And that explains why China is growing at 10% and the European Union is in recession. And so the people we talk to it turns out are not dopes in other countries. They can figure this out, too. There’s been, for a whole set of historical reasons, a commercial argument to support free and open Internet. The commercial argument no longer makes sense.

Part of what’s puzzling to me is that there’s sort of a basic perspective here, which is that ‘democracy is good; justice is better’. And people don’t like that. A free and open Internet is a better guarantor of justice. But they say, “we can’t say that”.

IA-Forum: Why not?

Dr. Lewis: I don’t know. So we’re going to have to work on it.

IA-Forum: When you were on WBUR’s radio program, On Point, last week, you said that China is doing reconnaissance on civilian critical infrastructure, looking to effect --

Dr. Lewis: [General] Keith Alexander told me that.

IA-Forum: You said they’re potentially looking to affect U.S. military assets in the Pacific. And they go after our allies. You raised the idea of China and Japan moving towards an “unfortunate incident”. With the treaty that we have to defend Japan, do you see that scenario likely to become a cyber security problem in the near term?

Dr. Lewis: If it were to occur the answer would be ‘yes’. That we would need to think about how to support Japan in defending its information assets in defending its networks. Whether the Chinese would actually do anything -- people go through the same military calculus in thinking about cyber attacks that they do for any other weapon. What are the costs? How’s the international community going to react? Is it going to get me military advantage? It doesn’t mean they got the calculation right. But the Chinese are going to calculate. What would a cyber attack against Japan get me? And if they think it gets them something useful, they’ll do it. You could think about air defense, naval coordination. Those would be the targets.

IA-Forum: There’s a lot of chatter right now about North Korea about to do another nuclear test. If so, is there a Stuxnet worm with North Korea’s name on it out there?

Dr. Lewis: Probably not because the North Koreans -- this is why they’re not really yet a cyber threat. If you don’t have electricity, you’re very hard to hack. They’re one of the last countries on earth that isn't really computerized. And so they’re a hard target. You know, Iran, not as closed a society as North Korea. Strange, isn't it? And a little more modern in terms of its economy. And it turns out to being a backward economy with no electricity and no food is a plus in cyber defense.

IA-Forum: What about state sovereignty issues and who controls the internet? Russia and China have made proposals for control. This week [mid-February] the European Union is coming out with new regulations requiring private companies to report disruptions to government authorities. Who does control the internet; who should control the internet?

Dr. Lewis: The question I usually ask is, “why should the Internet be different from anything else?” I think the answer is, “it shouldn’t”. In the same way that in the U.S., the government has sovereign control of American territory, but it’s privately owned. There are rules about how government and the private individual interact on that ownership. I think that’s the direction we’re moving in. And each country will implement their control over the Internet, consistent with their national practices. People may not like that but the rest of the world has made up its mind, that’s where they want to go.

So who should control it? It should be the same kind of control you see for any other sort of activity. There’s a little bit for government. There’s a little bit for the private sector. But the idea that neither has a role is wrong. And the idea that somehow the state will be subordinate to private sector interests -- maybe in America, but not anywhere else.

IA-Forum: In the Christian Science Monitor, there was a piece a while back saying that a Pentagon official had called for the U.S. and Europe to cooperate on the NATO cyber shield, modeled after the nuclear missile shield that NATO was developing. Does that make sense? Would it work?

Dr. Lewis: It makes sense. There’s a lot of political obstacles. It would work in that the Europeans haven’t thought through how they act as a unified whole. So you have the member states want to maintain their control and the commission wants to do things across the EU. And NATO has an alliance defensive role. None of these actually fit together in ways that are seamless. So whenever there’s a seam, the seam is an opportunity for an opponent to exploit. So it would make sense. It’s just that the political difficulties turn out to be much greater than we thought. So think of it as the European debt crisis that’s carried over to the Internet.

IA-Forum: What would the advantage and the disadvantage be of having DOD’s Cyber Command come out from under STRATCOM’s control and be a full-standing command?

Dr. Lewis: Well, this is a new military activity so we’re going to go through a period of experimentation. And it’s like the travails of Space Command -- sometimes it’s independent, sometimes it’s a service. I bet we’re going to go through the same kind of moving around for this.

Right now, it is the only place where a four-star [general] reports to a four-star [general]. Now there’s a footnote here, which is that the head of U.N. Command in Korea is a four-star [general] who reports to the Pacific Command four-star [general]. But because it’s a U.N. command, it’s not the same thing. So we have an anomaly in how we’ve organized Cyber Command. It probably makes sense just for that reason, to split it out.

And one of the things that I think they’ve done is figure out the roles in different situations, for instance, what Cyber Command has the lead on. That’s helpful to know. From a neatness perspective, I think ‘separated’ for now. Whether it remains an independent command, I don’t know.

IA-Forum: Of the three mission areas in the new DOD Cyber Command proposal that’s just been released – which is the most critical to staff up first – 1) DOD’s own networks, 2) the military combatant commands, or 3) the “national mission” to cover critical “homeland” infrastructure? Personnel staffing, military and civilian, is supposed to go from about 900 now to 4900 in this ramp up.

Dr. Lewis: The first priority is defending DOD’s own networks. And that’s where they put most of their effort. Then there will be a split between the national mission and the support to combatant commands to regional commanders. Don’t know which will get priority there. My bet would be, absent some kind of regional crisis, it would be the national mission. But if we suddenly have a conflict in the Pacific, the regional combatant support will zoom up to be number two.

IA-Forum: When the U.S. government decides to move from a defensive cyber security to an offensive cyber security position, a preemptive position, what justifies the shift?

Dr. Lewis: The current approach isn't working. And the defensive approach, a reactive approach, always puts you at a disadvantage. We tried this at the end of the 19th century, where we thought we would have what they call ‘coastal defense battleships’. No offensive Navy for us. We would be peace-loving Americans and have coastal defense battleships, which were small, heavily armored, heavily-armed unseaworthy vessels.

A defensive approach is never going to be able to do it. And so when we’ve tried this in the past, you have to have a full-range military capability. And then you decide whether or not you’re using a defense or offense. You can’t just build half of it and then expect it to work.

IA-Forum: Do you think that there’s going to be a lot of pushback on this offensive effort? It may make sense practically speaking. But this sounds like it’s going to be a political problem, maybe an issue between civil and military partnership, do you think?

Dr. Lewis: No, the thing that surprises me in having seen them in action a couple of times, is that the Cabinet-level political types are very cautious about unleashing this. They want a lot of evidence. They want a lot of assurance there won’t be collateral damage. It’s not like the U.S. is going to go off wildly doing this. I see the emphasis on preemptive more as an effort to signal potential opponents that this is no longer a risk-free environment.

Up until now, you could do anything you wanted and you fixed absolutely no penalty. And signaling that that’s going to change is probably not enough. But it’s a good start. So I don’t think the threshold they set is high. And the caution they display in thinking about using this is high. So I’m not expecting to see anything soon.

The main thing was it was the signal to the Iranians. What they did to Aramco [the Saudi Arabian oil company] was fun. Don’t do it in the U.S. [Iran was suspected of launching a highly destructive cyber attack on Aramco’s corporate network in the summer of 2012].

IA-Forum: Thank you.



James Andrew Lewis is a senior fellow and director of the Technology and Public Policy Program at CSIS. Before joining CSIS, he worked at the Departments of State and Commerce as a Foreign Service officer and as a member of the Senior Executive Service. Lewis’s recent work has focused on cybersecurity, including the groundbreaking report “Cybersecurity for the 44th Presidency,” space, and innovation. His current research examines the political effect of the Internet, strategic competition among nations, and technological innovation.

Comments in Chronological order (0 total comments)

Report Abuse
Quick Links Twitter Face Book Get Alerts Contact Us Enter Ia-Forum Student Award Competition
International Affairs
Forum - (2014 Issue 1)

Available Now
ANNOUNCEMENTS
THE WORLD'S DISCUSSING...
06/02/2015: What Russia Really Wants More
06/01/2015: The Second Baptism of Rus'?: The Return of Religion and the (Soviet) Origins of Russian Patriotism More
05/27/2015: https://youtube.com/devicesupport More
05/27/2015: Event: Climate Change and Vulnerable Watersheds in the Andes - Lima, Peru More
05/27/2015: ONLINE ONLY - Brookings hosts Vice President Joe Biden for remarks on the Russia-Ukraine conflict More
05/27/2015: Instead of killing America’s shale revolution with increased production, the Saudis have jump-started Shale 2.0 More
05/27/2015: Designer Drugs: A New, Futile Front in the War on Illegal Drugs More
05/27/2015: Avoiding past mistakes More
05/27/2015: Southern Iraq is a safe place More
05/27/2015: The 10 lessons from global trade and investment planning in U.S. metro areas More
05/26/2015: Trial of Jason Rezaian raises red flags about proposed nuclear deal More
05/26/2015: Eurozone debt crisis: A Spanish wake-up call for Europe More
05/26/2015: NYT Shows No One Buys Government’s ‘Term of Art’ Argument in King v. Burwell More
05/26/2015: Former Governors Caucus brings common sense solutions to the Senate More
05/26/2015: Japan's Vision Toward China: Conflict and Cooperation in a New Asian Order? More
05/26/2015: Do the right thing More
05/26/2015: Will Greece Follow Ukraine's Gamble? More
05/26/2015: Blood and hope in Afghanistan: A June 2015 update More
05/26/2015: Blood and hope in Afghanistan: A June 2015 update More
05/26/2015: Undoing American leadership: The killer currency amendment to the trade bill More
05/26/2015: Can the data revolution transform how we finance development? More
05/26/2015: Venezuela: No Rule of Law, Bad Money More
05/26/2015: The big four banks: The evolution of the financial sector, Part I More
05/26/2015: Here to stay and growing: Combating ISIS propaganda networks More
05/26/2015: Jumpstarting community-led initiatives to counter violent extremism More
05/25/2015: The 4 Percent-Plus Solution More
05/25/2015: One year after Modi, U.S.-India and China-Pakistan ties deepen More
05/25/2015: Will Putin Gamble All On A Broader Ukraine Invasion? More
05/22/2015: Can Russian-Western Cooperation in the Arctic Survive the Current Conflict? More
05/22/2015: Climate change is a security threat to the Arctic and the time to act is now More
05/22/2015: Climate change is a security threat to the Arctic and the time to act is now More
05/22/2015: 'Should We Have Waged the Iraq War?' Is Not a Gotcha Question More
05/22/2015: Can FIFA become a role model for sustainable development? More
05/22/2015: Memo to Congress: Don't Do Something, Just Stand There More
05/22/2015: Sen. Paul's Great Surveillance 'Filibuster' and What to Expect Next More
05/22/2015: Chrystia Freeland on Ukraine's struggle for independence More
05/22/2015: The Glaring (Ir)Relevance of Ramadi More
05/22/2015: If You Don't Want Your Food Genetically Modified, Tell Nature to Stop It. More
05/22/2015: Currency Manipulation Can't be Fixed by Countervailing Duties More
05/22/2015: The fog of peace: An interview with Jean-Marie Guehénno More
05/22/2015: Iraq after the fall of Ramadi: How to avoid another unraveling of Iraq More
05/22/2015: Iraq after the fall of Ramadi: How to avoid another unraveling of Iraq More
05/22/2015: What Chinese investment could mean for Pakistan More
05/22/2015: NSA Surveillance: What Happens Next? More
05/22/2015: What you may not know about China and currency manipulation More
05/21/2015: The Regional Cold Wars in Europe, East Asia, and the Middle East: Crucial Periods and Turning Points More
05/21/2015: Tunisian President on Islam, Politics and Extremism More
05/21/2015: Security risks: The tenuous link between climate change and national security More
05/21/2015: Security risks: The tenuous link between climate change and national security More
05/21/2015: 10 maps that explain Ukraine’s struggle for independence More
More...
About | Contact Us | Support Us | Terms and Conditions

All Rights Reserved. Copyright 2002 - 2015