Homeland Security Deputy Secretary Jane Holl Lute at the Black Hat Conference: “Commonalities between Cyberspace and Homeland Security”

Cybersecurity is a challenge that we face together. It’s important to talk about that challenge, what can be done about it, and, importantly, who should do the work. In 1990, as a young Army signals officer, I learned that the joint staff had prepared a document called Joint Vision 2010, or “JV 2010.” It was an expansive view of where the US military wanted to be in 20 years. I had a problem—there was no NV 2010, no national vision. We had a military that knew where it wanted to be in 20 years, and we had a country that had not even asked itself that question. We needed to catch up.

So, where is the U.S. today, and what does this country need to be at this moment in history?

America needs a safe and secure homeland. We need a dynamic economic engine that generates new wealth. We need strong friends and neighbors. We need predictable relations with others. That’s about the rule of law. What is the role of cyber, cyberspace, and cybersecurity in helping to secure U.S. interests? And to secure them against what? The threat seems pretty comprehensive. You can steal our data, our identities, our past life, our opportunities. But you can’t deter that threat, you can’t have a strategy of deterrence or of prevention, if you never talk about the threat, how we can understand it, indeed, how we can understand cyberspace at all.

Cyberspace and homeland security have a lot in common. A lot of brand recognition. But not everyone knows what those two terms mean. Cyberspace: is it a war zone? Is it a marketplace, a neighborhood, a school, a highway, a do loop of our past activities, a playground, a sandbox, a war zone.

How do cyberspace and war zones compare? Wars happen somewhere. They involve somebody. Geography is key. Seizing and holding terrain. Wars happen somewhere, but cyberspace is sort of this space-time thing. Nobody really gets it.

Wars end lives. Cyberspace merely destroys them. War zones are characterized by lawlessness—no order, contested order, alternative order that people are fighting about. Cyberspace seems to be a place without even norms of behavior. That’s a difference.

There are a lot of mythologies about war. We say that poverty contributes to violent conflict. Wealth does too. Rich people will kill each other too. We say that ethnicity contributes to violent conflict. But calling a conflict ethnic doesn’t tell you anything about why it’s violent, about why people are killing each other over their ethnicities. We need to know more about why that is so. Fundamentally, the greatest mythology about war is that it is inevitable. But war is not the weather. We shouldn’t act like it is.

So how many analogies for war are there for cyberspace? How should we talk about cyberspace, and what can be done about the challenges that we encounter every day? We can’t access the Internet, we can’t transit, we can’t shop, we can’t browse, we can’t communicate in a secure way. That seems pretty fundamental. What should we do about that?

At Homeland Security we have the challenges of building on the first seven years of the Department, trying to understand what we mean when we talk about a secure homeland. Through a series of meetings, processes, and yes, conversations, we laid out a vision of Homeland Security. We are trying to create a safe, secure, and resilient space where the American way of life can thrive. That’s the mission. So these questions are fundamental: What does it mean to be safe? What does it mean to be secure? We want the American way of life to thrive – how are we going to do this?

At the Department we’ve laid out five essential missions for ourselves. One is to prevent another terrorist attack. The second mission is to secure our borders, and here you can begin to see the duality of the homeland security challenge. We don’t only want to keep out people and goods that might be dangerous, we want to facilitate trade and travel. The strength of this country rests on our ability to interact with the rest of the world, and to do so in safety and security. The third mission is to enforce our immigration laws. The fourth mission is the cyber mission, ensuring the safety and security of cyberspace. Now some people were surprised that we determined that a safe, secure, and resilient cyberspace is essential to a safe, secure, and resilient homeland. And the fifth mission is to create a resilient society, where the American people are able to face all threats and hazards that come our way.

Within each we have identified goals that will tell us if we are effective at discharging these key missions. Resilience takes empowered individuals, capable communities, and a responsive Federal system. It’s not impossible to achieve. We do this based on the simple principles of security, resilience, and exchange with the rest of the world. It’s not about building borders that are impenetrable; it’s about interchange with the rest of the world. But doing all these things for homeland security will require us to think differently about ourselves and about our tools.

Cyber is called out as a separate mission of homeland security. But in order to create a safe and secure cyber environment, we have to define cyber’s strategic space. And here, there are two very important shaping trends that are conditioning our understanding and access to the strategic space within which cyber operates.

The first trend is the trend of technology. Anthropologists tell us that technology is putting tools within our grasp. But the current trend is that technology is exceeding our grasp. It is way out in front of society’s ability to understand, adapt, and adjust. At the very least we certainly feel as a society that we are lagging behind the frontiers of technology that you deal with every day. And what lags even further behind than our social sensibilities is our laws. The law is always a lagging indicator. It is the arrested judgment that society comes to when it confronts its problems. That’s what the law reflects. It anticipates the familiar. But so much is happening in technology that is unfamiliar to so many of us. How long can we stand that?

The second trend is a normative convergence that is emerging, not only within our society but around the world. I have spent most of my life in the international field – war, conflict, conflict resolution, war termination, rebuilding a society after war has destroyed it. The normative convergence that is emerging centers around three things: expectations of transparency, expectations of inclusivity, and expectations of reciprocity. What are we going to do about those emerging norms? How can we adapt the uses of technology that seems to be exceeding our grasp, when technology was defined to begin with as tools within our grasp? How do we craft a strategy that permits the fullest exploitation of technology while ensuring our safety?

So, how have we historically ensured our safety? By location. Location was the dominant security strategy. No longer. The State system was formed in 1648 so sovereigns could protect their citizens from marauding outsiders. In how many places around the world today do citizens need protection by outsiders from marauding sovereigns? Location is no longer the key to safety.

In cyberspace, location is irrelevant. In cyberspace, power has no beginning and no obvious end. It’s hard to feel secure in what we know. It’s hard to feel secure in where you are. It’s hard to feel secure in who you are. So what is the purpose of cybersecurity? To create a safe, secure, resilient place where we can thrive. Secure our information and secure our identities. And promote the kind of awareness, innovation, and shared understanding that make us all better off.

And to achieve this, we have to depart from the romantic notion of cyberspace as the Wild Wild West. Or the scary notion of cyberspace as a combat zone. Yes, there is a new reality for security, for conflicts, for relationships. In fact, there is a contest right now for the corner on the market in the three areas that used to define the role of government: control of lethality, control of capital, and control of rulemaking. That power is going somewhere. It is going into private hands. And these changes have been fueled by the expansion of the domain of cyberspace.

So what is the core question? What will we do when this happens in cyberspace? How will we govern? What will the rules be? – for there will be rules. Can we still hope to rely on trust in each other? Trust in our actions? In our intentions? In our effects? Cyberspace is being built on an insecure platform to begin with from a governance and a legal perspective. The goal here is not control, it’s confidence. We want to expedite the good, while preventing, excluding, the bad. It’s not the like Wild Wild West, it’s not a jungle out there. It’s not even a global commons. It’s more like light than like air or water. There are no perfect metaphors, there are no historical analogies. We may live in ahistorical times.

We need to build the ecosystem for the healthy enjoyment, the healthy use by all of us. Do we need a culture of preparedness in this environment, do we need a culture of resilience? Do we need a culture of prevention?

In 1994, I had the extraordinary privilege of associating with Dr. David Hamburg, then of the Carnegie Corporation, and Cyrus Vance, former Secretary of State, and a group of individuals who were determined that we could do more to prevent the outbreak of mass violence. To stop the spread, the renewal of mass violence once peace has been achieved. And we resolved to think about how we create a preferred environment rather than just avoid bad alternatives. So if you want to prevent people from killing each other, you need create livable societies, societies that have representative governments, market economic activities, and civil society based on the rule of law. If you want to stop the spread of violent activity you have to create fire breaks. And if you want to prevent the renewal of violence once peace has been achieved, you need to create space – physical and political space so that peaceful efforts can succeed. The culture of prevention is one that builds on an affirmative vision of the future – creating a better place.

We at the Department of Homeland Security want to stimulate responsible debate about cyberspace. We want to participate in that debate. We want a debate on the rules of the road, about governance, how do we get it right. What is governance holding? What needs doing?

At the Department of Homeland Security we have been very busy in cybersecurity. We identified cybersecurity as essential to creating a safe, secure, resilient place for the American way of life to thrive. We instituted a National Cyber Challenge because we believe awareness and education are essential. And all the good ideas out there have not even been thought of yet. We’re developing a National Cyber Incident Response Plan that we’ll test in the fall. We are deploying Einstein 2 throughout the dot-gov space. We are standing up NCCIC. We are advancing a trusted identity strategy in cyberspace. We can find a way to secure ourselves. This country can be safe. We can protect our privacy and our rights. We can let open markets flourish. We certainly at the Department don’t believe we have all the answers. What will guide us? Will our expertise guide us? Will our experience guide us? Do we know the difference – that expertise is knowing the conditions under which your experience is relevant. Do we have the courage to challenge the assumptions and explode myths?

Billions of dollars have been spent to secure cyberspace, yet none of the most fundamental problems have been solved. You can’t access, you can’t surf, you can’t transit, you can’t shop, you can’t talk securely. Fundamental problems.

The Administration is seeking to build a strategy to help ensure the cybersecurity of this nation. It’s enormously exciting to get a challenge on this scale. It doesn’t happen all the time in your life. It’s exciting to be working with people who are at the cutting edge of their field and who recognize that we all have a role to play. This is where you all come in.

Help us not to be destined to tackle these largest of questions with the narrowest of approaches. Just as our Constitution diffuses power in order to concentrate this Nation’s strength, it will take the efforts of all of us to ensure the security of each of us.

National security is about all of us. Homeland security is about each of us. National security is strategic, centralized, top-driven. Homeland security is operational, decentralized, bottom-driven—driven from the grassroots, driven from the experience of individual human beings. Problems in national security scale at the wholesale end, they involve us all. Homeland security challenges and problems scale on the retail end, each of us is affected. These two of course connect. But we need strategies to deal with problems in the homeland, and we need help.

I’m told your community has very good taste when it comes to ideas. I’ve tried to offer a few. I’m told that you’re driven. Among you, can you tell differences among the drivers and the driven? In my world, it’s important to make that distinction. Pollsters tell us that today the country is about evenly divided about a lot of things. So many things, 48 percent this, 52 percent that. This is a climate that permits many ideas, but it’s also a climate that compels few. So we might as well have the satisfaction of thinking the hard thoughts and doing what is right.

My parents, and perhaps yours, come from the greatest generation. I believe you are the ablest generation: educated, healthy, smart, and well-off. Pan-global, and connected, and deeply concerned about your fellow man. We live in an age where we know before victims do that they will be victims. What will we do about what we know?

Well, 100 years ago what did people do about what they know? In 1910, Churchill was 36 years old, Franklin Roosevelt was 28, Gandhi was 41, Mao Tse-Tung was 17, and J. Robert Oppenheimer was 6. What do you do about what you know? How much time do you have to make a difference?

Ours is a very special democracy, born of a very deep belief in the core principles of shared humanity and the obligation to value human worth. Ours is a demo that has been enriched by the cultures of all the world, fueled by the ideas of the courageous, built by the energy of youth. This is our “present at the creation” moment.

If you talk to people who do research on the brain they will tell you it is their Renaissance. Let’s make it ours. What is the vision that you see? I know what I see, but as I think Ernest Hemingway said, “If you know you want to say next, it’s time to stop.”