Clarke wants to know, where did we go wrong?
Connecting state and local government leaders
In the four years since the release of the National Strategy to Secure Cyberspace the U.S. lost its way, said former U.S. counterterrorism czar Richard A. Clarke.
LAS VEGAS ' At some point in the four years since the release of the National Strategy to Secure Cyberspace the United States lost its way, said former U.S. counterterrorism czar Richard A. Clarke.
'I'd like to know why it was that we lost momentum in solving the problem in more than a piecemeal manner,' Clarke, who delivered an opening keynote Wednesday at the Black Hat Briefings, said in an interview with Government Computer News. 'There is no leadership. There is no national plan implemented.'
The problem he refers to is the nation's growing reliance on an information infrastructure that cannot be defended. Industry, commerce, health care and our national defense increasingly rely on an Internet that remains brittle and open to attack and disruption.
'The day-to-day environment is replete with crime and espionage,' he said. 'We are accepting a high level of cost we needn't accept. But we've done nothing to solve the problem.'
Clarke has been a vocal and high-profile critic of the nation's cyberdefense efforts since his retirement from government in 2003. Now chairman at Good Harbor Consulting, he served under four presidents, from Reagan to George W. Bush. When he speaks of national leadership he should know what he is talking about. His last government position was chief counterterrorism adviser under Clinton and Bush and he helped to develop the National Strategy, released in February 2003.
'In this case we had high-level awareness that there was a problem,' Clarke said. The president signed off on the strategy and there was an understanding among government and industry leaders who collaborated on the strategy of the need for the two sectors to cooperate.
'They understood it was not mainly a government problem,' he said. There was a necessary role for government, but 'it was a private-sector problem, mainly.'
But little progress has been made and some ground has been lost. The government has failed as the role model it was supposed to be under the strategy, federal funding for security R&D is down and the situation probably will get worse before it gets better, he said. 'We need to ask ourselves, why?'
The problem is a lack of congressional as well as presidential leadership, coupled with a lack of executive initiative in the private sector.
'The government didn't want to regulate,' he said, and did not feel competent to regulate in technical areas. Corporate giants such as Microsoft, Cisco and Oracle have improved their own processes, but have had too little impact on the industry as a whole. Without government leadership, corporations won't move unless forced by some catastrophe. 'What motivates people at the corporate level is disaster.'
What progress could have been made had the nation stayed the course? Service providers could be filtering malware before it hits the local-area network and the end user, Clarke said. We could have better and more encryption, a secure Domain Name Service and a parallel network in place to provide priority service during emergencies, using IPv6 to prioritize traffic.
'I don't think that would have been hard,' he said. 'There are all sorts of things that could have been done. But it's no one's job.'
That is not to say there are no bright spots. 'There is some progress,' he said. A few companies are reducing the scope of vulnerabilities in their software, and IPv6 is slowly moving forward, especially in Asia. But Clarke is not optimistic about the government's ability to make use of the new version of the Internet Protocols, which is supposed to be enabled on agency backbones next June.
'I am very skeptical that the government is going to do the things it says it will do, because it hasn't over the last five years,' he said.
What can be done to improve things? The next administration might appoint someone to lead the effort, he said. 'Certainly not me, because I'm not going back in.'
In addition to his work as a consultant, Clarke also is establishing himself as a novelist, with two books under his belt.
Until that leadership comes, industry and consumers are on their own, and short of some catastrophe that will focus attention on the issues, will remain on their own. In the absence of the financial pain caused by a cyberdisaster, 'the only thing that's going to get anybody to do anything is regulation,' Clarke said. 'And that's too bad, but when you have a market failure you have to have regulation.'
NEXT STORY: Autonomy wins over state