In the wake of North Korea’s recent cyber attack against Sony, Breitbart News spoke with Paul Rosenzweig, who served as Deputy Assistant Secretary for Policy at the Department of Homeland Security, about the cyber threats we face as a nation today. Mr. Rosenzweig now serves as Principal of Red Branch Consulting, and is the author of Cyber Warfare: How Conflicts in Cyberspace are Challenging America and Changing the World.
Breitbart News: In your role as Deputy Assistant Secretary for Policy at the Department of Homeland Security, did you feel we were prepared to counter the cyber threats posed by our adversaries?
Paul Rosenzweig: No, we were not. We were unaware of what the threats were. We were not able to sufficiently address them.
Breitbart News: Was that a result of bad government policy, a lack of legislation in place to deal with the threats, a reactive Washington, D.C. culture, or something else?
Paul Rosenzweig: All of the above. It was something new–a threat that we hadn’t seen before. There were also significant legislative and policy impediments.
Breitbart News: What State would you consider as the #1 cyber threat to the United States?
Paul Rosenzweig: Russia. They have a very able cyber team. They far surpass anything the North Koreans can do–probably even the Chinese as well. The Russians are in a very unstable position right now. I wouldn’t want to be on the receiving end of something if they decided to become more aggressive in the cyber domain.
Breitbart News: How good are our attribution capabilities? How long does it take us to figure out who did it, and how sure can we be that a specific state or actor has hit us?
Paul Rosenzweig: Our attribution skills have improved substantially over the past ten years, as opposed to our cyber defense skills, which are lagging behind. We have a pretty high degree of confidence in attribution. But the reality is–we can never be 100% certain. Similar to our legal system, it depends on what degree of proof is chosen. Sometimes we can provide proof beyond a reasonable doubt. Other times we don’t have enough to be that certain. If we are expected to find 100% certainty regarding attribution, we will never act.
Breitbart News: Do states such as Russia, Iran, China, and North Korea display trademark signs when they hack us? What are they known for? What differentiates them when they conduct cyber attacks?
Paul Rosenzweig: There’s two things that differentiate them: their motives and their purpose. It’s one of the reasons we’re pretty sure that North Korea conducted the Sony attack, because who else really gives much of a hoot and a holler about North Korea?
Furthermore, people use noticeable techniques and tradecraft. If you want to make a sports analogy, its similar to certain pitchers throwing certain fastballs, or politicians using similar lines in their speeches. We see forensically things that are common.
But we also need to keep in mind that our adversaries know this too. They may take advantage of that to try and hide, and pretend to be somebody they’re not.
Breitbart News: What’s your opinion on the Cyber Intelligence Sharing and Protection Act (CISPA) legislation working its way through Congress? Is it possible to create cyber policy that enhances our national security without infringing upon our liberties?
Paul Rosenzweig: Regardless of the legislation, I don’t think the government is smart enough, nimble enough, or quick enough to create effective policy. The techniques used in the Sony Attack are brand new, so there’s nothing you could have written even last week that would have helped.
Breitbart News: What’s it going to take for the government to catch up and get up to speed in its defense of the Cyber domain?
Paul Rosenzweig: Government can’t catch up. It’s going to take the private sector, Silicon Valley activity, people like Sony getting hurt, to fight back against these cyber attacks. But they’re not going to turn to the government in the end, they’re going to turn to private sector actors. What the government needs to do is make sure that it enables private sector actors to do what they need to do to protect themselves.
The government’s role is in standard-setting, making sure that they get out of the way. The government is too big and burly to be effective in protecting the private sector from cyber attacks.
Breitbart News: What can the United States do to better deter the continuing cyber war against us?
Paul Rosenzweig: At this moment, we have no strategy at all in dealing with cyber attacks. Deterrence strategy can be effective, not just through our cyber capabilities, but through other means.