The Scope of the Problem

In his column at Bloomberg Hal Brands outlines his plan for responding to the massive security breach of U. S. government departments and private companies by Russian hackers:

First, don’t fall asleep on Russia, even as the Chinese threat attracts the majority of America’s geopolitical attention. Putin’s Russia may be a declining, economically moribund power. But his high tolerance for risk, combined with Moscow’s talent for identifying and exploiting Western vulnerabilities, means that Washington downplays the Russian challenge at its peril.

Second, effective cyberstrategy must blend unilateral and multilateral measures. It seems likely that many other countries were victimized by the SolarWinds hack. The U.S. must therefore work more closely with other advanced democracies to strengthen shared warning networks, coordinate damage assessments, and impose sharp costs on malign actors. As Microsoft president Brad Smith argues, “In a world where authoritarian countries are launching cyberattacks against the world’s democracies, it is more important than ever for democratic governments to work together.”

Third, those responses cannot be solely defensive. SolarWinds highlights the basic offense-defense asymmetry in cyberspace: A clever attack will require remediation efforts costing orders of magnitude more than the attack itself. Moreover, the relatively open nature of the democratic internet, and the fact that responsibility for cybersecurity is diffused among so many public and private actors, creates vectors of vulnerability that will always tempt authoritarian regimes.

all of which convince me that he doesn’t understand the scope of the problem.

The federal government and U. S. governments in general have major structural problems which render them peculiarly incapable of maintaining cybersecurity. Among these structural issues are:

• Security talent tends to be homegrown, i.e. provided by individuals, frequently self-taught, already working in their departments.
• Worse still, they may be outsourced. The incident involving Edward Snowden revealed the risks of doing that.
• Governments are unable to discipline public employees. They can move them but terminating civil service employees is incredibly cumbersome.
• Procurement rules make it practically impossible to respond in an agile manner.
• Governments don’t just tend to use software monocultures but they frequently use extremely outdated software monocultures.

Those leave just two strategies for making governments more secure. The first would be to detach their networks from the Internet entirely and not allow any devices which can be connected to the Internet to connect to their networks. That’s actually done in certain very highly secure facilities in the government. As should be needless to say, that would be extremely impractical to do across all levels of government, basically setting them back 30 years. That’s at least ten years more than they’re already behind the times.

The alternative would be to reorganize personnel, staffing, budgeting, procurement, and the very structure of the government from top to bottom. Governments should be much more distributed and resilient than they are. Need I belabor the point? Those things aren’t going to be done, either.

In the absence of one of those two strategies none of the measures Mr. Brands suggests will be particularly effective.

One more point. SolarWinds is publicly traded (it took an enormous hit following the revelations—practically a near-death experience). It should be sued under the provisions of Sarbanes-Oxley. It is pretty obviously in violation. That might be true of Microsoft as well.