On Arms Control, Little Reason for Optimism

Read more about On Arms Control, Little Reason for Optimism

Authors

Steven Pifer

News Type

Commentary

Date

Tue, 05/19/2020 - 12:00

Paragraphs

President Trump’s newly named envoy for arms control, Marshall Billingslea, gave a lengthy interview last week on the administration’s approach to nuclear arms negotiations. He stressed bringing in China, struck a pessimistic note about the sole treaty constraining Russian and U.S. nuclear forces, and offered no ideas for getting Moscow to discuss non-strategic nuclear arms.

Unfortunately, the interview reinforces the view that the Trump administration is unlikely to achieve a nuclear deal…or even develop a serious proposal.

Read full article at Defense One

Hero Image

Hussein Malla/AP

All News button

Subtitle

Officials in Moscow and Beijing will read Mr. Billingslea’s interview and see nothing to give them reason to negotiate.

US nukes in Poland are a truly bad idea

Read more about US nukes in Poland are a truly bad idea

Authors

Steven Pifer

News Type

Commentary

Date

Mon, 05/18/2020 - 12:00

Paragraphs

On May 15, the U.S. Ambassador in Warsaw, Georgette Mosbacher, suggested relocating U.S. nuclear weapons based in Germany to Poland. One hopes this was just a mistake by a political appointee unfamiliar with NATO nuclear weapons issues, not a reflection of official U.S. government thinking. Moving nuclear weapons to Poland would prove very problematic.

The U.S. Air Force maintains 20 B61 nuclear gravity bombs at Buchel Air Base in Germany (as well as B61 bombs on the territory of four other NATO members). Kept under U.S. custody, the bombs could, with proper authorization in a conflict, be made available for delivery by German Tornado fighter-bombers. This is part of NATO’s “nuclear sharing” arrangements.

The Tornados are aging, and the German Ministry of Defense is considering purchasing F-18 aircraft to continue the German Air Force’s nuclear delivery capability. That has reopened debate within Germany about the presence of U.S. nuclear arms there, with Social Democratic Party (SPD) parliamentary leader Rolf Mützenich calling for their removal.

On May 14, U.S. Ambassador to Germany Richard Grenell wrote an op-ed expressing concern about not “eroding the solidarity that undergirds NATO’s nuclear deterrent” and calling for the SPD to affirm Germany’s commitment to nuclear sharing. The next day, Ambassador Mosbacher entered the fray, with a tweet suggesting that U.S. nuclear weapons could be relocated to and housed in Poland.

If Germany wants to diminish nuclear capability and weaken NATO, perhaps Poland - which pays its fair share, understands the risks, and is on NATO's eastern flank - could house the capabilities here: https://t.co/VIzpHIgoUN

— Georgette Mosbacher (@USAmbPoland) May 15, 2020

This is a truly bad idea.

First, moving U.S. nuclear weapons to Poland would be expensive. Relocation would require constructing special infrastructure, such as WS3 underground storage vaults, and other equipment to ensure their security. The vaults normally are located within specially hardened aircraft shelters. While not a budget-buster, U.S. and NATO militaries have far more pressing needs to shore up the alliance’s deterrence and defense posture.

Second, deploying the B61 bombs in Poland would make them more vulnerable to Russian preemptive attack in a crisis or conflict. Russia has deployed Iskandr-M ballistic missiles in Kaliningrad. With a range of up to 500 kilometers, these missiles could strike targets in almost all of Poland within a matter of minutes and with very little warning.

Buchel, by contrast, would have longer warning time of an attack, and aircraft flying from there at least begin their flights out of range of Russian air defenses. The two major Polish air bases — which host Polish F-16s that are not, in any case, nuclear capable — are located within range of Russian S400 anti-aircraft missiles deployed in Kaliningrad and their radars.

Third, placing nuclear weapons in Poland would be hugely provocative to Russia. This is not an argument against provoking Russia in general — given its provocative behavior, including a military build-up, bellicose rhetoric, and use of military force against Ukraine. (Indeed, I called in 2014 for Washington to provide lethal military assistance to Ukraine and for U.S. and NATO forces to deploy to the Baltic states, steps that Moscow deemed “provocative.”)

But there is provocative and there is provocative. Putting U.S. nuclear arms so close to Russia would be the latter. Recall the 1962 Cuban Missile Crisis, when the Soviet Union placed nuclear weapons 90 miles from American shores. President John F. Kennedy imposed a naval blockade, which allowed time to work out a settlement with Moscow. In doing so, however, he set aside the recommendation of many of his advisers for air strikes and a full-scale invasion of Cuba.

Fourth, a U.S. proposal to relocate its nuclear weapons to Poland would prove very divisive within NATO. The members of the alliance stated in 1997 that “they have no intention, no plan, and no reason to deploy nuclear weapons on the territory of new [NATO] members.” They incorporated that into the “Founding Act” that established relations between NATO and Russia.

The security circumstances in Europe have changed dramatically and, unfortunately, for the worse over the past 23 years. Despite that, many NATO members still support the “three no’s” regarding nuclear weapons that the alliance adopted in 1997. A U.S. proposal to move the bombs to Poland would divide allies, cause some to question U.S. judgment, and prompt a broader nuclear debate within the alliance at a time when NATO should strive to show a firm and united stance toward Russia.

Relocating U.S. nuclear weapons to Poland would be expensive, militarily unwise because it would make the weapons more vulnerable to preemptive attack, unduly provocative, and divisive within NATO. This was a tweet best not sent. The one thing it does do, however, is give Mr. Mützenich a new talking point for removing the bombs from Germany; citing Ambassador Mosbacher, he can claim: “We can send them to Poland.”

Originally for Brookings

Hero Image

Stocktrek Images, Getty Images

All News button

Subtitle

Which Militants Receive Missiles? Explaining How Organizational Similarities Influence External Provision of Support

Tuesday, May 12, 2020 | 11:00 AM -Tuesday, May 12, 2020 | 11:45 AM

Livestream: Please click here to join the livestream webinar via Zoom or log-in with webinar ID 944 5730 9104.

About this Event: Why do some governments give foreign militants missiles that can destroy aircraft while giving others only bullets and AK-47s? Why do some governments deploy special operations forces to carry out joint attacks with some insurgent groups, while only giving others basic training on weapons handling? Despite the fact that governments often provide costly - and controversial - forms of support to foreign militant groups, we know little about why some groups receive advanced weapons technology and boots on the ground while others do not. In this presentation, I unpack trends in third-party provision of support through an in-depth examination of the CIA's provision of anti-tank missiles and the Pentagon's deployment of Special Operations Forces to support specific militant groups in the recent Syrian conflict. Drawing from an original dataset of the over 150 Syrian militant brigades that received some form of US support and over 60 interviews with Syrian militants and US and Jordanian government officials, I find that, when militant groups have similar organizational characteristics as the armed forces of their government partners, they are more likely to receive and accept costly forms of support.

About the Speaker: Melissa Carlson is a PhD candidate in the Department of Political Science at U.C. Berkeley, specializing in international relations, comparative politics, and methodology. She will join CISAC in 2019-2020 as a Middle East Initiative Pre-doctoral Fellow. Broadly, her research examines the dynamics of military partnerships between state governments and foreign militant groups. Melissa's dissertation develops an organizational theory of third-party provision of support: when foreign militant groups and state armed forces share similar organizational characteristics, they are more likely to form joint commands, carry out joint attacks, and provide each other with advanced weapons systems. Melissa's other research interests focus on factors that influence informal cooperation between states, and on how refugee perceptions of host communities, host governments, and aid organizations influence refugee decision-making. Prior to beginning her PhD at U.C. Berkeley, Melissa worked as Public Information consultant for the International Organization for Migration, Iraq Mission in Jordan and Iraqi Kurdistan. Melissa has a M.A. in Political Science from U.C. Berkeley, and a B.A. in International Relations and Politics, Philosophy, and Economics from Claremont McKenna College.

Virtual Seminar

Melissa Carlson

melcarl@stanford.edu

rsd19_072_0235a.jpg

Dr. Melissa Carlson is currently working with the Defense Security Cooperation Agency's Assessment, Monitoring, and Evaluation unit, where she promotes rigorous standards of measuring the effectiveness of the U.S.'s security cooperation and assistance programming. During her tenure at CISAC, she was a postdoctoral research and teaching fellow. She received her PhD in Political Science from the University of California, Berkeley, specializing in international relations, comparative politics, and methodology. Dr. Carlson's primary research examines the factors that influence the variation and intensity of partnerships between governments and foreign militant groups with a focus on the recent conflicts in Iraq and Syria. Her book-style dissertation project finds that, when foreign militant groups and state armed forces share similar organizational characteristics, they are more likely to deploy forces to conduct joint combat operations and provide each other with advanced weapons systems. In other research, Dr. Carlson examines the factors that influence informal and secret security cooperation between states and how misinformation and rumors influence refugees' relationships with host governments, service providers, and smugglers. Her research has been published in the American Political Science Review, the Review of International Organizations, and International Studies Quarterly, among other outlets. Outside of academia, Dr. Carlson has worked as a consultant for the International Organization for Migration's Iraq and Jordan Missions.

Affiliate

Melissa Carlson Predoctoral Fellow at CISAC

Seminars

A Research Agenda for Cyber Risk and Cyber Insurance

Read more about A Research Agenda for Cyber Risk and Cyber Insurance

Paragraphs

A Research Agenda for Cyber Risk and Cyber Insurance

By: Gregory Falco, Stanford University

Martin Eling, University of St. Gallen

Danielle Jablanski, Stanford University

Virginia Miller, Stanford University

Lawrence A. Gordon, University of Maryland

Shaun Shuxun Wang, Nanyang Technological University

Joan Schmit, University of Wisconsin-Madison

Russell Thomas, RMS and George Mason University

Mauro Elvedi, University of St. Gallen

Thomas Maillart, University of Geneva

Emy Donavan, Allianz

Simon Dejung, SCOR Reinsurance

Matthias Weber, SwissRE

Eric Durand, SwissRE

Franklin Nutter, Reinsurance Association of America

Uzi Scheffer, SOSA

Gil Arazi, FinTLV Ventures

Gilbert Ohana, FinTLV Ventures

Herb Lin, Stanford University

Abstract

Cyber risk as a research topic has attracted considerable academic, industry and government attention over the past 15 years. Unfortunately, research progress has been modest and has not been sufficient to answer the “call to action” in many prestigious committee and agency reports. To date, industry and academic research on cyber risk in all its complexity has been piecemeal and uncoordinated – which is typical of emergent, pre-paradigmatic fields. Further complicating matters is the multidisciplinary characteristics of cyber risk. In order to significantly advance the pace of research progress, a group of scholars, industry practitioners and policymakers from around the world present a research agenda for cyber risk and cyber insurance, which accounts for the variety of fields relevant to the problem space. We propose a cyber risk unified concept model that identifies where certain disciplines of study can add value. The concept model can also be used to identify collaboration opportunities across the major research questions. In this agenda, we unpack the major research questions into manageable projects and tactical questions that need to be addressed.

1.Introduction

In today’s digitally interconnected environment, every company is now a tech company. Every political entity is now a digitally-enabled one. Therefore, digital or “cyber” risk is business risk. While this may be a provocative statement to some, an irrefutable fact is that digital transformation is accompanied by new organizational exposure that needs to be managed accordingly. To date, efforts to evaluate the complexity of cyber risk have been piecemeal and uncoordinated – not unlike other emergent fields. This is wasting financial and intellectual capital, while also impeding new markets from flourishing (e.g. cyber insurance). The goal of this document is to propose a research agenda for cyber risk that aligns the interests of industry, academia, non-profits, and governments. To be successful, this agenda must resonate with all fields studying cyber risk including data science, behavioral science, economics, computer science, management science, political science, and law.

There are hundreds, if not thousands, of reports, white papers and academic articles that refer to cyber risk. Cyber risk is a multi-disciplinary issue, therefore ownership of cyber risk as a field of study has been decentralized across academic fields that seldom lack coordination. Our agenda’s focus is cyber risk management and cyber insurance for firms and similar organizations, individually and also in interdependent networks (e.g. supply and partner networks, critical infrastructure, etc.). This includes relevant government and non-profit organizations. We do not address cyber risk for individual people, nor do we address cyber risk for society at large, including international relations.

Because of the diverse audience for this research agenda, we conducted an extensive feedback exercise where we circulated this document with colleagues across the globe for each aforementioned field of study. The extensive collaborative process in formulating this agenda, in part reflected by the variety of coauthors, yielded a cyber risk intellectual space for each discipline. Representatives from each discipline provided detailed commentary on the proposed agenda and contributed what they believed to be the most relevant questions to their field. We asked that they categorize their questions in six categories derived from standard risk management process steps. Figure 1, which we call a Unified Concept Model for Cyber Risk, illustrates the categories relevant to each discipline based on their questions. We hope disciplines will be able to use Figure 1 and the subsequent agenda as a starting point for their cyber risk research, understand how their work fits into the broader cyber risk research landscape and determine which fields could collaborate on topics of shared interest. The authors acknowledge the imperfection of the process to designate topics by disciplines; however our intention is for this Unified Concept Model to evolve over time as more researchers join the conversation.

As part of our collaborative feedback process, we learned that each discipline believes that their field has the expertise to comprehensively address “cyber risk”. This is a function of the relatively narrow view each field has regarding the definition of the cyber risk problem set. For example, our statistician colleagues defined cyber risk as the study of modeling the likelihood of an attack, while political scientists defined it as the study of international security in the context of digital threats. We believe that each discipline’s views are valid, but that they must be contextualized in a bigger vision so that cyber risk can be systematically addressed as a research area unto its own right. The goal of this agenda is not to define cyber risk, but aims to illustrate the need for a broad definition and multi-disciplinary, collaborative approach to address cyber risk as a research field.

Cyber Risk Unified Concept Model; outer ring displays 6 umbrella questions; inner ring shows potential collaborations on each overarching question between the 8 listed disciplines

Figure 1 : Cyber Risk Unified Concept Model; outer ring displays 6 umbrella questions; inner ring shows potential collaborations on each overarching question between the 8 listed disciplines

The agenda elaborates on the six big questions identified by the co-authors in the Cyber Risk Unified Concept Model, proposes disciplines that could be well-equipped to study them, unpacks a variety of related, tactical research questions and provides sources as a starting point for each area of focus. These big questions are a variation of the standard five risk management process steps. The big questions include:

What constitutes cyber risk?
How should we measure cyber risks?
Are there cyber risks that can be avoided?
What are the opportunities to reduce cyber risk?
How can cyber risk be best transferred to other parties?
How can residual cyber risk be managed and monitored?

2.What constitutes cyber risk?

Primary Disciplines: Accounting, Computer Science, Law, Political Science

There is not one single type of cyber risk. Cyber risk could come in the form of unintentional data leakage, privacy loss, malicious attempts to damage digital systems, malicious attempts to steal or alter corporate confidential data for economic advantage or even as disinformation campaigns. The damage could be sporadic or a global damage that affects global digital assets (DDOS). There is an entire spectrum of cyber risk an organization can face ranging from unintentional data leaks to strategic, nation-state attacks. The scope of cyber risk has been difficult to characterize because there is widespread disagreement about what a cyber event actually entails. Some organizations consider a cyber event to be any unknown connection attempt to their network. Others consider successful unauthorized access to their network a cyber event. Still others define a cyber event as an instance when “loss” is experienced. Understandably, it is exceedingly difficult to benchmark security or risk across an industry or even within the same organization if everyone is using different definitions of an event. This issue is compounded by the varying definitions provided by standardization organizations such as NIST, ISO and MITRE.

For the purposes of establishing a cyber risk body of knowledge, it is vital to have clear and consistent terminology about cyber events and their impact potential. Disparate definitions of a cyber event will limit the ability for consistent reporting and data analysis about cyber risk. Further, it could complicate the ability for research studies to build on each other – one of the fundamental cornerstones of scientific progress.

Further complicating matters, the scale and scope of cyber risk is problematic depending on choice of boundary for data, computing systems, and stakeholders. Moving from narrow to broad, here are alternative scope statements for cyber risk:

A single organization’s cyber risk based on their owned assets.
A single organization’s cyber risk encompassing owned assets, third-party provider assets, public infrastructure (e.g. internet service providers) and its supply chain cyber risk.
A series of organizations’ collective cyber risk that accumulates based on their reliance on a common digital asset (e.g. cloud infrastructure).
A series of organizations’ collective cyber risk that accumulates based on their utility of ubiquitous software that shares a common vulnerability.
An insurer’s or institutional investor’s accumulated cyber risk based on outstanding policies and liabilities for interdependent industries or interdependent cyber incidents.
Reinsurers perspective of cyber risk aggregation and liabilities for interdependent industries or interdependent cyber incidents.
IoT/SCADA risk as multi-industry catalyzer for cyber risk and attacks.

Cyber risk is fundamentally different than other risks faced by businesses and covered by insurance (e.g. Property & Casualty, Errors & Omissions, etc.) in two ways.

First, the causal factors that drive cyber risk change and evolve rapidly – sometimes in less than a year, which is less than the insurance period for most cyber insurance policies. For a given firm, cyber risk can decrease within the insurance period because new security controls or resources have been successfully deployed, or vulnerabilities reduced, or the attack surface has been significantly reduced. But for that same firm cyber risk increase because attack surface increases, or security controls deteriorate, or new vulnerabilities appear, or because attacker tools and practices have evolved. Changing the IT landscape of an organization (new software used, new integration with suppliers, acquisition of additional companies /integration with such companies’ networks)) also increases the cyber risk during the insurance period.

Second, cyber activity does not usually follow clear patterns, which might help estimate the risk. For example, an advanced attacker who is specifically targeting individual organizations will never do the same thing twice. The barrier to modifying an attack is low and since skilled attackers do not want to risk being caught, they change approach. This often makes historical data of little use to assess a future risk.

Regarding cyber events, the time scope (duration) of cyber events and impact is problematic. Unlike perils like car accidents, earthquakes and others, a cyberattack even or episode can last for days, weeks, or months until it is recognized and stopped. Evaluation of the damages can also take long periods of time, since it is not always known what data was stolen and what uses are planned for the stolen information by the attackers. Cyberattacks can also proceed in stages, either by the same attackers or through other attackers with different resources or objectives, who acquire useful credentials or other data through “black hat” markets.

Regarding cyber loss (i.e. impact, damage), the losses could be sporadic and isolated or it could be global and widespread. It could include only tangible losses or both tangible and intangible damage. A cyber event could be any unknown attempt to a network or device. Or it might be defined to only include successful unauthorized network access. A more narrow definition of cyber event is when an economic loss is realized.

These problematic characteristics can significantly vary across different regions and business sectors, but all are essential considerations in studying cyber risk.

Potential Research Projects

Document and analyze the evolution of cyber events in relation to how they have impacted organizations over the years. Identify potential patterns and trends that can be used to project future cyber event threats.
Assess the determinants of cyber risk and identify any industry differences.
Assess what constitutes material cyber risk for corporate investors.
Evaluate how cyber events have and will continue to evolve.

Sources

Böhme, Rainer, Stefan Laube, and Markus Riek. "A Fundamental Approach to Cyber Risk Analysis." Variance Journal, www. variancejournal. org, online edition (2017).

Böhme, Rainer. Towards Insurable Network Architectures (Versicherbare Netzarchitekturen). it - Information Technology 52(5): 290-294 (2010)

Cukier, Kenneth Neil, Viktor Mayer-Schönberger, and Lewis Branscomb. "Ensuring (and insuring?) critical information infrastructure protection." Report of the 2005 Rueschlikon Conference on Information Policy (2005). Retrieved from: https://www.belfercenter.org/sites/default/files/files/publication/rwp_…

CRO Forum. “CRO Forum Concept Paper on a proposed categorisation methodology for cyber risk.” (2016).

Department of Homeland Security (US). Cyber Security Research and Development Broad Agency Annoucement (BAA) 11-02 (Solicitation). (2011). Retrieved from: https://www.fbo.gov/utils/view?id=560a331a2f0105f32ca8c1e4f068c5e6

Eling, Martin. "Cyber Risk and Cyber Risk Insurance: Status Quo and Future Research." Geneva Papers on Risk and Insurance 43.2 (2018): 175-179.

Eling, Martin, and Werner Schnell. "What do we know about cyber risk and cyber risk insurance?." The Journal of Risk Finance 17.5 (2016): 474-491.

Fisk, Gina, et al. "Privacy principles for sharing cyber security data." Security and Privacy Workshops (SPW), 2015 IEEE. IEEE, 2015.

Ramirez, Robert, and Nazli Choucri. "Improving Interdisciplinary Communication With Standardized Cyber Security Terminology: A Literature Review." IEEE Access 4 (2016): 2216-2243.

Ross J. Anderson: Liability and Computer Security: Nine Principles. ESORICS 1994: 231-245

U.S. Securities and Exchange Commission (SEC) “CF Disclosure Guidance: Topic No. 2” on Cybersecurity Risk and Cyber Incidents (see: https://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm)

Wang, S., Integrated Framework for Information Security Investment and Cyber Insurance (September 15, 2017). https://ssrn.com/abstract=291867 

3.How should we measure cyber risk and its associated direct and latent costs?

Primary Disciplines: Data Science, Economics, Management Science

Establishing consistent metrics that can communicate the extent of cyber risk internally and externally is important to understanding an organization’s cyber posture. One of the more important reasons to establish metrics is to understand the cost and benefits of investing in cybersecurity.

There will always be tradeoffs to security. Sometimes, it is convenience, other times it is a direct cost, and in some cases it is technological progress. The many types of tradeoffs can be abstracted into an equation with variables and represented as the level of cyber risk that an organization is comfortable with. Today this equation is formulated ad hoc for individual organizations based on point-in-time data. The calculus is then used to assess how much spending should be done to manage cyber risk. While these cyber risk equations such as presented in the Gordon-Loeb Model could be tactically useful (i.e., for supporting individual decisions), they do not capture macro cyber risk trends that could influence an organization’s long-term risk management strategy.

Also, current models fail to capture the considerable interdependencies across digitally enabled systems and their respective industries. The failure or compromise of a single digital system could cause cascading failures and exponential repercussions. This complicates the calculus of an organization’s cyber risk. It is unclear where the line should be drawn about where one organization’s cyber risk ends and another’s begins. These interdependent digital systems lead to one type of cyber accumulation risk.

Accumulation risks for cyber can involve the reliance across several industries on a subset of third-party providers. For example, there is a critical mass of digital capabilities across multiple organizations and industries that are reliant on a handful of cloud service providers. A cloud service provider can be seen as a single point of failure across multiple industries. Should one of these digital infrastructure services be compromised, millions of their users will be impacted globally.[1] One such example could be for critical infrastructure that operates on supervisory control and data acquisition (SCADA) systems. An attack on a SCADA system that controls the electric grid could have cascading impacts across sectors. As previously mentioned, risk damages can vary from tangible damages as extreme as human life, to intangible assets like reputation damages and financial losses, over a very long period of time.

The metric used to measure cyber risk by data science researchers is frequently considered to be the expected loss from a cyber breach. However, different metrics (e.g., probability of a loss of a given size, variance of potential loss) are sometimes used by researchers in other disciplines.

Methodologies are needed to improve the modeling of interdependent cyber events so that organizations can better prepare for cyber threats across a given industry or several interdependent industries. Further, these models can help evaluate accumulated risk potential. This research could be used by insurers improve estimates risk exposure in portfolios and to define risk tolerances.

Such research could be leveraged by insurers to calculate risk exposures and define risk tolerances.

Potential Research Projects

Define representative extreme– but nevertheless possible – and potentially interdependent and accumulating cyber scenarios, determine associated economic and insured industry losses, and estimate associated probability ranges. (Work in progress at Stanford – working title: Can a Cyberattack Cause a Financial Crises?).
Interview cyber insurance providers, , reinsurers and actuaries to understand accumulation scenarios they envision. Assess the adequacy of accumulation scenarios used by the insurance industry.
Investigate the various applications of economic and statistical models to cyber risk and evaluate their effectiveness. Propose new modeling approaches and existing techniques that appropriately cater to the unique challenges of modeling cyber risk.
Evaluate the extent of accumulation using a big data/AI platform. (Work in progress at FinTLV Ventures).

Sources

Agrafiotis,I., J.R.C. Nurse, M. Goldsmith, S. Creese, and D. Upton “A taxonomy of cyber-harms: Defining the impacts of cyber-attacks and understanding how they propagate”, Journal of Cybersecurity, 2018, 1–15

Anderson, Ross, and Tyler Moore. "The economics of information security." Science 314.5799 (2006): 610-613.

Bodin, L., L.A. Gordon and M.P. Loeb, “Information Security and Risk Management,” Communications of the ACM, Vol. 51, No. 4, 2008.

Böhme, Rainer, and Galina Schwartz. "Modeling Cyber-Insurance: Towards a Unifying Framework." WEIS. 2010.

Böhme, Rainer, and Gaurav Kataria. "Models and Measures for Correlation in Cyber-Insurance." WEIS. 2006.

Dejung, Simon. “Economic impact of cyber accumulation scenarios.” Swiss Insurance Association SVV Cyber Working Group. (2017).

Eling, Martin, and Jan Wirfs. "What are the actual costs of cyber risk events?." European Journal of Operational Research 272.3 (2019): 1109-1119.

Eling, Martin, and Kwangmin Jung. "Copula approaches for modeling cross-sectional dependence of data breach losses." Insurance: Mathematics and Economics 82 (2018): 167-180.

Eling, Martin, and Nicola Loperfido. "Data breaches: Goodness of fit, pricing, and risk measurement." Insurance: Mathematics and Economics 75 (2017): 126-136.

Falco G., Caldera C. and Shrobe H., "IIoT Cybersecurity Risk Modeling for SCADA Systems," in IEEE Internet of Things Journal. doi: 10.1109/JIOT.2018.2822842 URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8332467&isnumbe…

Gordon, L. A., & Loeb, M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security (TISSEC), 5(4), 438-457.

Hubbard, Douglas W., and Richard Seiersen. How to measure anything in cybersecurity risk. John Wiley & Sons, 2016.

Maillart, Thomas, et al. "Given Enough Eyeballs, All Bugs Are Shallow?." Revisiting Eric Raymond with bug bounty markets (2016).

Romanosky, S. Examining the costs and causes of cyber incidents, Journal of Cybersecurity, Volume 2, Issue 2, 1 Dec 2016, Pages 121–135

Ruan, Keyun. "Introducing cybernomics: A unifying economic framework for measuring cyber risk." Computers & Security 65 (2017): 77-89.

Thomas, R. C., Antkiewicz, M., Florer, P., Widup, S., & Woodyard, M. How bad is it? – A branching activity model to estimate the impact of information security breaches. Workshop on the Economics of Information Security (WEIS), Washington, DC. (2013).

Wang, S., Knowledge Set of Attack Surface and Cybersecurity Rating for Firms in a Supply Chain (November 3, 2017). https://ssrn.com/abstract=3064533

4.Can cyber risks be avoided?

Primary Disciplines: Computer Science and Management Science

One of the most under-developed areas of research is cyber risk avoidance, which usually involves managerial decisions at the level of enterprise architecture so that the enterprise is “less risky by design”. Of course, the interconnectivity of digital systems today is essential to the success in most industries, and therefore not all cyber risks can be avoided. But too often researchers, industry practitioners, and government policy makers take for granted the unchecked expansion of digital computing, communications, and interconnection.

One mechanism to avoid cyber risks is to minimize the use of computing systems and their connectivity. We do not necessarily encourage this, however, it is indeed a risk avoidance mechanism that some organizations employ. For example, anecdotally, we were informed that in several nuclear facilities, conscious decisions were made to revert to analog devices to avoid cyber risk. This is not a decision to be taken lightly considering the benefits digital devices afford (another, slightly “softer” practice, is to use internet-disconnected networks to reduce risk, like the use in military networks. Conversely, deciding to take such networks offline can generate additional cyber risks associated with off cycle or custom patches or other work necessary to maintain functionality/operability when a network is not readily connected to the internet. The unplugging argument does raise the issue of over-digitization of assets and the inherent cost/benefit of security to convenience and operational efficiency. This becomes an important discussion point for operations managers and those studying digital transformation.

Another option to avoid risk is by designing and using inherently secure systems. Today most devices, networks and systems make use of technology that was built without security as a priority. This issue is now even more pronounced with the prevalence of internet of things (IoT) devices that are designed with low-cost connectivity in mind (by vendors with little experience in the software sector). Some new approaches to designing and building software and hardware systems embody security-by-design principles. Such principles include practices such as deny-by-default where a system inherently disallows processes from running so that the surface area of attack is minimized. The intention of these securely designed digital assets is to optimize functionality while attempting to guarantee some level of security. Further technical advancements in this area—including those that can help to reduce the sometimes exorbitant cost of such assets—will only help to avoid cyber risks to the extent the securely designed systems are deployed. A persistent challenge to realize the benefits of new technology is device lifecycle, where it could be decades (as is the case for industrial systems) before devices are replaced and the security of the system is updated accordingly. Conversely, there is a trade-off: continuously replacing devices to more modern ones, with security implemented, also imposes the risk of new vulnerabilities detected and exploited, since new devices are using new protocols, new features and functionality, which exposes to new risks.

Matters of risk avoidance fall to system operators who can determine the operational value of having a digitized asset (and therefore judge if a digital system is necessary) and computer scientists that can design inherently secure systems.

Although in defined domains, one can argue that it is a best practice to minimize the use of connected systems, the global trend and development is forcing society the other way – being more connected, using more technologies and producing more data. Most businesses are critically (and increasingly so) dependent on technology and connected channels. Modern life and future trends will dramatically increase our dependence on connected technology (e.g. connected and autonomous cars).

Potential Research Projects

Interview organizations that have removed digital assets to avoid cyber risk and derive a list of considerations that could help organizations make similar decisions.
Research the requirements for and then design an inherently secure industrial controller that can be updated without causing system downtime.
Evaluate the security of the update process. In many cases, the complexity of the maintenance interface (in order to be secure) exceeds the complexity of the primary application. Establish a standardized update process that maintains security while preserving simplicity.

Sources

Anderson, R., Böhme, R., Clayton, R., and Moore, T. Security Economics and the Internal Market. ENISA, Heraklion, Greece, 2008.

Eling, Martin, and Werner Schnell. "What do we know about cyber risk and cyber risk insurance?." The Journal of Risk Finance 17.5 (2016): 474-491.

Böhme, Rainer. "Cyber-Insurance Revisited." WEIS. 2005.

Kuypers, Marshall, and Thomas Maillart. "Designing Organizations for Cyber Security Resilience." WEIS2018.

Shetty, Sachin, et al. "Reducing Informational Disadvantages to Improve Cyber Risk Management." The Geneva Papers on Risk and Insurance 43.2 (2018): 224-238.

5.Where are opportunities to reduce cyber risk?

Primary Disciplines: Behavioral Science, Computer Science, Law, Political Science

The Parkerian hexad outlines six elements of information security organizations should consider: confidentiality, possession or control, integrity, authenticity, availability and utility. The goal of fending off attacks theoretically entails preserving the hexad. Increasingly, organizations understand that they cannot protect themselves from and prevent all threats all the time. This raises the need to prioritize their systems, networks and data’s security and evaluate the opportunity to reduce cyber risk across the security hexad. Further, the relative importance of confidentiality, integrity and availability based on organizational context must be explored.

For example, if an organization faces the threat of a data breach versus data corruption – should one require more attention than the other? Some experts argue that for personally identifiable information (PII), confidentiality should no longer be a security priority because of the many large-scale data breaches that have occurred to date. It is inevitable that personal information will be stolen at some point in today’s cybersecurity climate. Therefore, more resources should be expended on authenticating the integrity of personal information through relational information rather than focusing on keeping the information hidden. Of course, these experts would argue that confidentiality should not be ignored, but simply prioritized accordingly. It is important to note, however, that such deprioritization can have regulatory consequences and potentially create economic loss due to fines/penalties (CCIA and GDPR fines for this). Organizations have finite resources available to manage cyber threats. Therefore, to properly manage cyber exposure, it is instrumental to study how organizations should prioritize assets and their associated cyber risks.

Beyond prioritizing and securing the most critical assets, concrete steps towards preventing specific cyber events can also be achieved through threat information sharing. Intra-industry security cooperation could be an effective cyber event prevention tool. The idea behind information sharing is simple. If organization A shares recent attacks with others (B and C) that may use similar digital assets, future attacks against B and C could be prevented. Today, Information Sharing Analysis Centers (ISACs) which have been established to facilitate cyber event information sharing across all critical infrastructure sectors have not been equally successful. ISACs are only as effective as the member organization’s participation. Some industries, like the financial sector, have member organizations that actively participate in information sharing. This in turn improves the security posture of the entire industry. Other sectors have seen less member organization participation. Studying why some sectors engage more with their ISACs than others could help improve cyber event prevention in sectors without effective information sharing.

There is a public good character of cybersecurity, which leads to some typical economical underinvestment problems. From an individual’s point of view it might be optimal to reduce investments in cybersecurity and public policy might help (or be needed) to get to some minimum standards for prevention. In light of the lack of policy direction in this space, it is important to evaluate market mechanisms that can have the same effect. Cyber insurance can be an example of this.

Some sectors already require insurance for daily operations. If cyber event prevention requirements were incorporated into mandated insurance policies, organizations would need to comply quickly for fear of losing their operating license. Importantly though, requiring purchase of a cyber insurance policy is not the point. Rather forcing a security conversation as part of the underwriting process for purchasing cyber insurance can potentially help institutionalize discussions and practices concerning cybersecurity.

Another market mechanism that some sectors require to indicate a minimum level of security is accreditations and certifications. Accreditations and certifications often require some compliance exercises to maintain status which assumes there is a third-party auditor of security practices that grants credentials. Such program are imperfect because they promote a “checkbox” compliance culture where many organizations stop worrying about their cyber risks if they complete the certification process. For this reason, several market mechanisms are needed to work in concert to reduce cyber risk at scale.

Potential Research Projects

Investigate the extent to which cyber security standards should be mandated. Determine if cyber security is considered a public good and understand parallels across industries to other public goods.
Study the potential unintended consequences of mandating cyber security standards. (Work in progress at University of Innsbruck).
Explore external incentives for cyber security. Conduct roundtables with industry and policymakers (separately) to understand why today’s incentives are insufficient.
Understand the extent of success ISACs have had today. Determine what makes some work and others less effective.
Conduct a roundtable of stakeholders such as ISAC organizers, trade associations, think tanks and industry cyber data stewards to determine a data collection standard for cyber risk information, and how such a standard could be implemented. The stakeholders for the exercise should be selected based on the purpose of the data collection standard. Produce a report associated with cyber data practices.
Interview CISOs to understand how and what cyber data is shared anonymously and determine what information is currently being held back for what reasons (e.g. privacy concerns, reputational preservation, competitive advantage, etc.). Evaluate opportunities to minimize these barriers.

Sources

Anderson, R., Böhme, R., Clayton, R., and Moore, T. Security Economics and the Internal Market. ENISA, Heraklion, Greece, 2008.

Böhme, R. Security Audits Revisited. In A. Keromytis, ed., Financial Cryptography and Data Security. Lecture Notes in Computer Science 7397, Springer, Berlin Heidelberg, 2012, pp. 129–147.

Bandyopadhyay, Tridib, Vijay S. Mookerjee, and Ram C. Rao. "Why IT managers don't go for cyber-insurance products." Communications of the ACM 52.11 (2009): 68-73.

Laube, S. and Böhme, R. Strategic Aspects of Cyber Risk Information Sharing. ACM Computing Surveys (CSUR), 50, 5 (November 2017), 77:1–77:36.

McQueen, Miles A., et al. "Time-to-compromise model for cyber risk reduction estimation." Quality of Protection. Springer, Boston, MA, 2006. 49-64.

Refsdal, Atle, Bjørnar Solhaug, and Ketil Stølen. "Cyber-risk management." Cyber-Risk Management. Springer, Cham, 2015. 33-47.

6.How can cyber risk be best transferred to other parties?

Primary Disciplines: Economics, Law, Management Science, Political Science

Another problematic aspect of cyber risk is accountability and responsibility. There is serious need for more research on how quantified cyber risk might improve accountability and responsibility, and also how it might have undesirable consequences. There are both social and financial definitions an implications of risk transfer. The financial definition of “risk transfer” is “a third-party takes responsibility for uncertain costs or losses, governed by contract, and usually in exchange for a premium or other compensation”. Most often the third-party is an insurance company. The societal definition of “risk transfer” is “another party (second, third, …) takes over accountability and responsibility for the uncertain costs, losses, consequences, or remediation efforts.” Organizations that have cyber risk transferred to them are subject to social sanctions such as blame, legal liability, etc. but also can claim social responsibility and authority such as leadership, sponsorship, and value network orchestration.

After each cyber event, fingers are pointed within an organization. More often than not, the CISO and/or the CIO take the blame for a cyber event. However, other times a system admin is blamed. In rare cases, where a major cybersecurity breach occurs, the CEO or the board of directors are held responsible for a breach. Ownership of cyber risk within an organization is generally unclear – even if there is a CISO or CIO that is supposed to manage information security. Because cyber risk is a key part of an organization’s overall business risk, cyber responsibility should be distributed across the organization. On a micro level, questions about the role of a CISO, where a CISO should sit in an organization and the extent of responsibility a CISO has is important to understanding an organization’s cyber risk.

On a macro scale, it is important to consider how organizations can transfer cyber responsibility and the associated risk externally to insurers, capital markets, contracts in indemnity and hold harmless agreements, or even the government. Today there are clear gaps in understanding how to accurately price the forward-looking cyber risk for a specific organization. There are even bigger gaps in understanding how cyber risks can accumulate across sectors and interdependent assets. This has inhibited the insurance industry from assuming more of this risk. As insurers and reinsurers become more confident in the extent of these risks, insurance can become a greater force in helping organizations transfer cyber risk. The same can be said for capital markets as cyber risk takers. However, there are some cyber events that the private sector may have limited interest in covering. One example is events deemed as “cyberwar”.

Beyond assessing defensive responsibility for cyber risk, it is vital to understand the attack dimension as well. Understanding who the adversary is, their motive, the sophistication and the scale of the attack could help to uncover if the attack was an act of war. Conversely, not all cyber risk incurred is the result of a malicious actor, but instead a result of unintentional behavior by people with certain access to network, data and systems. To distinguish the motive is important because at the point a cyber event is considered an act of cyberterrorism or cyberwar, it may become the government’s responsibility to interject and help manage cyber risk for private organizations, not dissimilar to what happened after 9/11. Some cyber risks and their associated causes will be easier to insure than others. For example, risks caused by unintentional behavior are typically not systematic and do not accumulate across companies in the same way that a concerted attack may accumulate. Therefore, unintentional behavior-caused cyber risks are likely to be more insurable.

To date many cyber insurance policies contain “acts of war” exclusions. However, there are many cyberwar definitions in use. We expect some of these definitions to change – and possibly consolidate – after a major cyberattack that insurance practitioners consider cyberwar.

Clarification around understanding both defensive cyber risk ownership, attribution and attack context are critical for selecting strategies to manage different cyber threats. A persistently moving target for what is cyberwar will not only hinder the private sector’s ability to properly manage their risk, but also limit insurers’ interest in covering cyber risk.

Potential Research Projects

Determine today’s opportunities to transfer risk and the limitations of transferring cyber risk. Identify ways to increase insurability of cyber. Here we can compare cyber risk with other types of risks that have been introduced to the insurance marketplace in the past, such as environmental degradation, employment practices liability, director’s and officer’s liability, and others.
Cyberwar and cyber terrorism do not have clear lines in the policy community. Provide a good definition of cyber war, incl. a delineation from cyber terrorism and cybercrime. Evaluate at which point governments must intervene.
Analyze the economic case for various public/private risk sharing structures for e.g. accumulating cyber scenarios that are (i) too great to be absorbed by the private re-/insurance market, and/or (ii) events with a terrorism- and war-like character

Sources

Biener, Christian, Martin Eling, and Jan Hendrik Wirfs. "Insurability of cyber risk: An empirical analysis." The Geneva Papers on Risk and Insurance 40.1 (2015): 131-158.

Bodin, L., L.A. Gordon, M.P. Loeb and A. Wang, 2018. Cybersecurity insurance and risk-sharing. Journal of Accounting and Public Policy 37(6): 527-544 (see: https://doi.org/10.1016/j.jaccpubpol.2018.10.004).

Eling, Martin, and Jingjing Zhu. "Which Insurers Write Cyber Insurance? Evidence from the US Property and Casualty Insurance Industry." Journal of Insurance Issues 41.1 (2018): 22-56.

Gordon, Lawrence A., Martin P. Loeb, and Tashfeen Sohail. "A framework for using insurance for cyber-risk management." Communications of the ACM 46.3 (2003): 81-85.

7.How can residual cyber risk be managed and monitored?

Primary Disciplines: Behavioral Science, Economics, Law, Management Science, Political Science

Regardless of prevention measures that organizations take, there is still some probability that an organization will experience a cyber event. Responding to residual cyber risk is as important as preventing the risk. There are multiple components of incident response including internal communication, external communication, threat containment, system repair and conducting attack post-mortems. Several organizations believe that upon being attacked, they can call the FBI or some government agency to request help. This is largely a fallacy. As evidenced in several high profile cyber events, incident response is managed by third-party consultants, not the government. Engaging these consultants becomes financially burdensome quickly. Therefore, the financials of residual risk management must be carefully studied.

One major residual risk issue organizations are struggling with is understanding how reputational damages manifest over time after a cyber event. While the stock price implications of a cyber event have been documented thoroughly, reputational damages long-term are less understood which can have indirect impacts on business performance.

Research is needed across the spectrum on residual cyber risks. Operators need better incident response playbooks, to include strategies and plans for communicating with various parties—shareholders, government officials, regulatory authorities, and the public. Executives need a clearer understanding of how much residual risk will cost and how to account for this in fiscal planning. Each of these areas can be unpacked yielding many interesting projects that can span across disciplines.

Potential Research Projects

Evaluate existing scenario trainings for cyber residual risk. Analyze the extent they cover financial risk management versus business continuity.

Sources

Choucri, Nazli, Stuart Madnick, and Priscilla Koepke. "Institutions for cyber security: International responses and data sharing initiatives." Cambridge, MA: Massachusetts Institute of Technology (2016).

Falco, G., Noriega, A., and Susskind, L.. “Cyber Negotiation: A Cyber Risk Management Approach to Defend Urban Critical Infrastructure from Cyberattacks”, The Journal of Cyber Policy. 2019. Doi: 10.1080/23738871.2019.1586969

Gordon, Lawrence A., Martin P. Loeb, and William Lucyshyn. "Sharing information on computer systems security: An economic analysis." Journal of Accounting and Public Policy 22.6 (2003): 461-485.

Romanosky, Sasha, et al. "Content analysis of cyber insurance policies: How do carriers write policies and price cyber risk?." (2017).

Spanos, Georgios, and Lefteris Angelis. "The impact of information security events to the stock market: A systematic literature review." Computers & Security 58 (2016): 216-229.

8.Conclusion

The main takeaway from this research agenda is the need for a multidisciplinary research approach to the six umbrella questions that make up the Cyber Risk Unified Concept Model and to begin work on the dozens of related empirical questions. As cyber risk as research problem continues to develop it requires shared understanding within and between aforementioned fields, coherence on which disciplines are best suited to tackle specific problem sets, and identification of collaborations with the potential to be most impactful.

Private industry and public organizations will benefit greatly from unbiased efforts to understand cyber risk. Disciplines involved with cyber risk research are tasked with working together while not overstating their own expertise. For example, data scientists need to evaluate the data while political scientists draw inferences from the past and present to lend insight on the cyberwar debate, and so on. Not only will effective multidisciplinary cooperation provide valuable understanding for cyber risk mitigation, but it will also begin to provide unique insights for dealing with cyber incidents. We believe that each discipline has a unique role in helping industry and academia make progress towards understanding cyber risk. Because of cyber risk’s interdisciplinary nature, it is essential for each field to evaluate how they fit into the broader research agenda.

[1] If all of these users had cyber insurance, the effects could be devastating on the underwriters and reinsurers of the policies considering the scale of the accumulated risk.

All Publications button

Publication Type

Working Papers

Publication Date

April 15, 2020

Journal Publisher

The 2019 Workshop on the Economics of Information Security (WEIS)

Authors

Herbert Lin

External URL

Full article

Aftershocks: The Coronavirus Pandemic and the New World Disorder

Read more about Aftershocks: The Coronavirus Pandemic and the New World Disorder

Authors

Colin H. Kahl

News Type

Commentary

Date

Fri, 04/10/2020 - 12:00

Paragraphs

The novel coronavirus (COVID-19) is a global public health disaster of almost biblical proportions. It is a once-in-a-century occurrence that threatens to destroy countless lives, ruin economies, and stress national and international institutions to their breaking point. And, even after the virus recedes, the geopolitical wreckage it leaves in its wake could be profound.

Many have understandably drawn comparisons to the influenza pandemic of 1918 and 1919. That pandemic, which began in the final months of World War I, may have infected 500 million people and killed 50 million people around the globe. As the grim toll of COVID-19 mounts, it remains to be seen if that comparison will prove apt in terms of the human cost.

But, if we want to understand the even darker direction in which the world may be headed, leaders and policymakers ought to pay more attention to the two decades after the influenza pandemic swept the globe. This period, often referred to as the interwar years, was characterized by rising nationalism and xenophobia, the grinding halt of globalization in favor of beggar-thy-neighbor policies, and the collapse of the world economy in the Great Depression. Revolution, civil war, and political instability rocked important nations. The world’s reigning liberal hegemon — Great Britain — struggled and other democracies buckled while rising authoritarian states sought to aggressively reshape the international order in accordance with their interests and values. Arms races, imperial competition, and territorial aggression ensued, culminating in World War II — the greatest calamity in modern times.

In the United States, the interwar years also saw the emergence of the “America First” movement. Hundreds of thousands rallied to the cause of the America First Committee, pressing U.S. leaders to seek the false security of isolationism as the world burned around them. President Franklin Delano Roosevelt pushed back, arguing that rising global interdependence meant no nation — not even one as powerful and geographically distant as the United States — could wall itself off from growing dangers overseas. His warning proved prescient. The war eventually came to America’s shores in the form of the attack on Pearl Harbor.

Even before COVID-19, shadows of the interwar years were beginning to re-emerge. The virus, however, has brought these dynamics into sharper relief. And the pandemic seems likely to greatly amplify them as economic and political upheaval follows, great-power rivalry deepens, institutions meant to encourage international cooperation fail, and American leadership falters. In this respect, as Richard Haas notes, the COVID-19 pandemic and the aftershocks it will produce seem poised to “accelerate history,” returning the world to a much more dangerous time.

However, history is not destiny. While COVID-19 worsens or sets in motion events that may increasingly resemble this harrowing past, we are not fated to repeat it. Humans have agency. Our leaders have real choices. The United States remains the world’s most powerful democracy. It has a proud legacy of transformational leaps in human progress, including advances that have eradicated infectious diseases. It is still capable of taking urgent steps to ensure the health, prosperity, and security of millions of Americans while also leading the world to navigate this crisis and build something better in its aftermath. America can fight for a better future. Doing so effectively, however, requires understanding the full scope of the challenges it is likely to face.

Read the rest at War on the Rocks

Hero Image

Radoslav Zilinsky - Getty Images

All News button

Subtitle

‘Just Say No’ Is Not a Strategy for Supply Chain Security

Read more about ‘Just Say No’ Is Not a Strategy for Supply Chain Security

Authors

Herbert Lin

News Type

Commentary

Date

Wed, 03/25/2020 - 12:00

Paragraphs

On Feb. 12, White House National Security Adviser Robert O’Brien announced that the U.S. government has “evidence that Huawei has the capability secretly to access sensitive and personal information in systems it maintains and sells around the world.” This represents the latest attempt by the Trump administration to support an argument that allied governments—and the businesses they oversee—should purge certain telecommunications networks of Huawei equipment. The position reflects the preferred approach in the United States, which is to issue outright bans against select companies (including Huawei) that meet an as-yet-unknown threshold of risk to national security.

Read the rest at Lawfare Blog

Hero Image

All News button

As US-Russian Arms Control Faces Expiration, Sides Face Tough Choices

Read more about As US-Russian Arms Control Faces Expiration, Sides Face Tough Choices

Authors

Steven Pifer

News Type

Commentary

Date

Mon, 03/23/2020 - 12:00

Paragraphs

The Trump administration’s proposal for trilateral arms control negotiations appears to be gaining little traction in Moscow and Beijing, and the era of traditional nuclear arms control may be coming to an end just as new challenges emerge. This is not to say that arms control should be an end in it itself. It provides a tool that, along with the right combination of deterrence and defense forces and proper doctrine, can enhance U.S. and allied security and promote stability.

Applying that tool will require overcoming a variety of challenges, not just regarding nuclear weapons but related issues, such as missile defense and conventional strike systems. Policymakers face some hard choices.

NUCLEAR ARMS

In August 2019, the United States withdrew from the 1987 Intermediate-range Nuclear Forces (INF) Treaty following Russia’s violation. (More broadly, Moscow’s selective compliance with arms control agreements poses a problem.) The 2010 New Strategic Arms Reduction Treaty (New START) remains as the sole agreement constraining U.S. and Russian nuclear weapons. New START expires in February 2021, but can be extended for up to five years.

For the United States, New START extension should be a no-brainer. Russia is in compliance with the treaty. Extension would continue limits on Russian strategic forces, as well as the flow of information on those forces provided by the treaty’s verification measures, until 2026. Extension would not require that the Pentagon change its strategic modernization plans, as those plans were designed to fit within New START’s limits.

Moscow has offered to extend New START, but the Trump administration has been reluctant. In 2017, U.S. officials said that, before considering the extension issue, they wanted to: 1) see if Russia met the New START limits, which took full effect in February 2018, and 2) complete the nuclear posture review, which was released the same month. Two years later, however, the administration still lacks a position on extension.

Instead, President Trump has set an unachievable objective — a trilateral negotiation with China and Russia covering all their nuclear arms. As I recently wrote in more detail, Chinese officials have repeatedly said no to such a negotiation, citing the large difference in nuclear weapons levels. The Trump administration thus far has offered nothing to entice Beijing to change its position.

Moreover, almost a year after the president set his goal, his administration has yet to offer a proposal — or even an outline — for what such a negotiation would seek to achieve. Neither Washington nor Moscow is ready to agree to have the same number of nuclear weapons as China, but it is unrealistic to think that Beijing would accept unequal limits.

Setting aside China, Russia is not ready to discuss all nuclear arms unless certain conditions are met (more on that below). The Obama administration sought a new negotiation after New START’s conclusion with the goal of including all U.S. and Russian nuclear weapons. That idea never gained traction in Moscow.

If New START expires in 2021, the United States and Russia likely would not launch major new build-ups, as both face real defense budget constraints. But their deployed strategic warhead levels could “creep up” above the number allowed by New START if the sides add warheads to intercontinental ballistic missiles (ICBMs) and/or submarine-launched ballistic missiles (SLBMs) that currently carry fewer warheads than their capacity. With the demise of New START’s verification regime, the sides would have little visibility into the other’s actions regarding adding warheads or total warhead numbers.

Some appear to believe that holding back on agreeing to the extension of New START and/or starting from scratch in a new negotiation might increase U.S. leverage to include all nuclear arms, including non-strategic nuclear weapons. That does not appear to be the case. It is more likely that the end of New START’s constraints on deployed strategic weapons would make bringing non-strategic or non-deployed nuclear weapons under control more difficult.

MISSILE DEFENSE

Russian conditions for discussing a broader agreement focus first on missile defense. Differences over missile defense pose a challenge for arms control.

Current U.S. missile defenses hardly constitute a threat to Russian ICBM and SLBM warhead numbers. Moscow, however, has long seemed to fear the potential of U.S. technology and prospective missile defenses. The United States and Russia came close in spring 2011 to an arrangement on a cooperative missile defense for Europe, but they failed to reach agreement, after which the Russian position on limiting missile defenses hardened. Moscow showed no interest in a 2013 U.S. proposal for an executive agreement on missile defense transparency, under which the sides would have exchanged information each year on their current missile defense numbers and prospective numbers looking out each year for 10 years.

Moscow appears to want legally-binding limits on missile defenses. However, the Trump administration’s 2019 missile defense posture review stressed that there should be no negotiated limits on missile defense. Missile defense has a strong constituency in the U.S. Senate, impeding the chance that a treaty limiting missile defenses would get the necessary two-thirds approval.

The missile defense issue will become more complex in coming years. As part of its ground-based mid-course defense, the U.S. military maintains 44 ground-based interceptors in Alaska and California capable of intercepting strategic ballistic missile warheads, with another 20 interceptors planned. In a separate program, the Pentagon is now developing a new variant of the SM-3 missile interceptor. Whereas current variants (the SM-3 IA and SM-3 IB) can engage intermediate-range ballistic missile warheads, the Pentagon intends to test the new SM-3 IIA variant against an ICBM warhead.

If the SM-3 IIA proves capable of intercepting strategic ballistic missile warheads, that will raise concern in Moscow (and Beijing) about the proliferation of those interceptors on U.S. warships, at Aegis Ashore sites in Romania and Poland, and elsewhere. Russia’s interest in limits on missile defenses would only intensify as would Moscow’s linkage of future nuclear arms reduction negotiations to a negotiation on missile defense.

LONG-RANGE PRECISION-GUIDED CONVENTIONAL STRIKE

Sea-launched cruise missiles (SLCMs) and air-launched cruise missiles (ALCMs) carrying conventional warheads have never been constrained by arms control agreements. As their precision has increased, Russian officials and experts have expressed concern that they could destroy targets that previously would have required a nuclear weapon and that the United States might consider a “conventional strategic” attack on Russia. It is unclear how realistic this concern is; would, for example, a conventionally-armed U.S. SLCM warhead be powerful enough to disable a hardened Russian ICBM silo?

Russian officials in 2011 began linking long-range precision-guided conventional strike systems to the issue of further nuclear arms cuts. The Pentagon has shown little enthusiasm for limits on these conventional systems, which are a key component of U.S. power projection capabilities. Russia may be starting to catch up, having demonstrated conventionally-armed ALCMs and SLCMs in Syria, but the U.S. military holds a significant numerical advantage.

As with missile defense, the situation with conventional strike may become even more complex. With the demise of the INF Treaty, the Pentagon is now developing or planning several conventionally-armed ground-launched missiles that would have been prohibited by the treaty. Two missiles — the Precision Strike Missile with a possible range of 700 kilometers and a ground-launched cruise missile with a range of 1,000 kilometers — almost certainly are being developed with European contingencies in mind. The Pentagon’s planned ballistic missile with a range of 3,000-4,000 kilometers is intended for the Asia-Pacific region, primarily as a counter to the large number of Chinese intermediate-range missiles (most of which are believed to be conventionally-armed).

Developing and deploying these U.S. missiles — along with Russia’s continued deployment of the 9M729 intermediate-range ground-launched cruise missile plus other missiles that Russia may develop and deploy as “counters” to new U.S. missiles — would further complicate the long-range precision-guide conventional strike picture. That, if in turn linked to nuclear arms control, would impede negotiation of a new agreement reducing and limiting nuclear weapons.

HYPERSONIC, CYBER, AND SPACE

Hypersonic weapons pose another complex factor for arms controllers. Both the United States and Russia (as well as China) are developing hypersonic weapons, including hypersonic glide vehicles to mount on ballistic missiles and hypersonic cruise missiles. Russia has deployed a small number of Avangard hypersonic glide vehicles atop ICBMs to enhance their ability to overcome U.S. missile defenses. Those fall under New START’s limits, but future hypersonic weapons, such as Russia’s Kinzhal air-launched ballistic missile, do not.

A negotiation to limit nuclear arms or long-range precision-guided conventional strike systems would have to take account of hypersonic weapons. That could be difficult, as the United States, Russia, and China appear to be focusing on different types of hypersonic systems.

Cyber and space domains can also have important effects on the nuclear arms relationship. Cyber raises concern about the possibility that a side’s nuclear command, control, and communication systems might be compromised in ways that would allow an intruder either to disrupt communications, including an authorized launch order, or to spoof the system with an unauthorized instruction. The cyber domain does not lend itself readily to traditional arms control-type arrangements.

As for space, Moscow has long advanced proposals to ban the weaponization or militarization of space. Washington has resisted those proposals, in part out of concern that they might affect the ability of the U.S. military to operate space-based assets for command and control, early warning, and intelligence, surveillance, and reconnaissance purposes. It is unclear whether more limited proposals, such as a ban on anti-satellite tests that generate orbital debris or a ban on deploying strike weapons in space, might be negotiable.

DIFFICULT TRADE-OFFS

Traditional nuclear arms control is in trouble. If the United States and Russia — and perhaps other countries in the future — wish to continue to use it as a tool to promote a more stable, secure, and transparent nuclear relationship, they will have to deal with challenges that did not arise or that they could agree to set aside during past negotiations.

Washington faces a fundamental choice: Is it prepared to countenance some constraints on missile defense and possibly long-range precision-guided conventional strike systems in order to get Russia to agree to further reduce and limit nuclear arms, including non-strategic nuclear weapons? Moscow faces something of the reverse choice: Will it hold to its insistence on limiting missile defenses and conventional strike systems even if that blocks a future nuclear arms agreement with the United States?

There remains the question of China, and Russia almost certainly would seek to include Britain and France. Would those third countries be willing to consider an approach other than a full negotiation with the United States and Russia, perhaps by offering a degree of transparency regarding their nuclear forces and committing unilaterally not to increase their nuclear weapons numbers so long as U.S. and Russian nuclear forces were reducing?

It would make sense for U.S. and Russian officials to conduct regular, intense bilateral strategic stability talks on the full range of issues — nuclear arms, missile defense, conventional strike systems, hypersonic weapons, third-country nuclear forces, cyber, and space — and their various interactions. Such discussions, if they go beyond mere recital of talking points, might allay some concerns the sides hold about the other while helping U.S. and Russian officials to decide whether specific negotiations might make sense.

None of these questions will be easy, and sorting them out will take time. That bolsters the already strong argument for extending New START. Doing so would give Washington and Moscow five more years to figure out what role, if any, arms control should play in managing their nuclear relationship with one another and, perhaps, with third countries.

Originally for Brookings

Hero Image

All News button

US-Ukraine Relations: Strengths and Weaknesses of US Policy Toward Ukraine with Recommendations for Future Initiatives

Tuesday, March 3, 2020 | 12:00 PM -Tuesday, March 3, 2020 | 1:30 PM

Seminar Recording: https://youtu.be/Se8UcB6HFNo

About this Event: Based on his recent experience in Kyiv, Ambassador Taylor will evaluate current US policy toward Ukraine and make recommendations for future initiatives. He will argue that now is the time to re-engage with Ukraine to strengthen US-Ukrainian relations and boost US security. He will address the two main threats to the Zelenskyy administration — the Kremlin and corrupt oligarchs.

About the Speaker:

Ambassador William B. Taylor served as the Chargé d'Affaires at the US embassy in Kyiv from June 2019 to January 2020. Previously, he served as the executive vice president at the U.S. Institute of Peace and the special coordinator for Middle East Transitions in the U.S. State Department during the Arab Spring. He served as the U.S. ambassador to Ukraine from 2006 to 2009.

He also served as the U.S. government’s representative to the Mideast Quartet, which facilitated the Israeli disengagement from Gaza and parts of the West Bank, led by Special Envoy James Wolfensohn in Jerusalem. Prior to this assignment, he served in Baghdad as Director, Iraq Reconstruction Management Office (2004-2005), in Kabul as coordinator of USG and international assistance to Afghanistan (2002-2003) and in Washington with the rank of ambassador as coordinator of USG assistance to the former Soviet Union and Eastern Europe (1992-2002).

Ambassador Taylor spent five years in Brussels as the Special Deputy Defense Advisor to the U.S. Ambassador to NATO, William Taft and earlier directed an in-house Defense Department think tank at Fort McNair in Washington, D.C. He served for five years on the staff of Senator Bill Bradley and earlier directed the Department of Energy’s Office of Emergency Preparedness.

In the Army, he fought in Vietnam as a rifle platoon leader and combat company commander in the 101st Airborne Division and flew reconnaissance missions along the West German border with Czechoslovakia in the 2nd Armored Cavalry Regiment.

William B. Taylor Former Chargé d'Affaires at the US embassy in Kyiv

Seminars

Iran and the Limits of Economic Statecraft: Sanctions, Energy, and the Effectiveness of Maximum Pressure

Wednesday, March 4, 2020 | 3:30 PM -Wednesday, March 4, 2020 | 5:00 PM

Seminar Recording: https://youtu.be/yIthWPC99bI

About this Event: Since the United States left the Iran nuclear deal in May 2018, the Trump administration has pursued a maximum economic pressure campaign toward Iran. The U.S. use of sanctions has gone far beyond what previous administrations have done to try to change Iran's policies, targeting large swathes of the Iranian economy, high-ranking Iranian government officials, and threatening other countries if they do not curtail their own private sector's activities with Iran. The economic consequences of these measures, particularly for Iran's domestic economy, Iran's ability to procure food and medicine from abroad, and for Iran's flagship energy industry, have been profoundly disruptive. The U.S. economic pressure strategy has also had direct impacts on the global shipping and energy industries. To better understand the impacts of the current U.S. strategy toward Iran, Elizabeth Rosenberg will discuss how the Trump administration has used unprecedented economic coercion, and how U.S. partners and adversaries have responded. She will focus on what role sanctions are likely to play going forward and whether they will be used now as a form of deescalation or escalation in U.S.-Iran tensions, which are particularly heightened following the U.S. killing of Qods Force commander Qasem Soleimani.

About the Speaker: Elizabeth Rosenberg is a Senior Fellow and Director of the Energy, Economics, and Security Program at the Center for a New American Security. In this capacity, she publishes and speaks on the national security and foreign policy implications of the use of sanctions and economic statecraft as well as energy market shifts. Current geographic areas of focus include Iran, Russia, China, North Korea, and Venezuela. She has testified before Congress on an array of banking and trade issues, and on energy geopolitics and markets topics. She is widely quoted by leading media outlets in the United States and abroad.

From May 2009 through September 2013, Ms. Rosenberg served as a Senior Advisor at the U.S. Department of the Treasury, to the Assistant Secretary for Terrorist Financing and Financial Crimes, and then to the Under Secretary for Terrorism and Financial Intelligence. In these senior roles, she helped to develop and implement financial and energy sanctions. Key initiatives she helped to oversee include the tightening of global sanctions on Iran, the launching of new, comprehensive sanctions against Libya and Syria and modification of Burma sanctions in step with normalization of diplomatic relations. She also helped to formulate anti-money laundering and counter-terrorist and counter-proliferation financing policy and oversee financial regulatory enforcement activities.

Prior to her service in the U.S. government Ms. Rosenberg was an energy policy correspondent at Argus Media in Washington D.C., analyzing U.S and Middle Eastern energy policy, regulation and trading. She spoke and published extensively on OPEC, strategic reserves, energy sanctions and national security policy, oil and natural gas investment and production, and renewable fuels.

Ms. Rosenberg received an MA in Near Eastern Studies from New York University and a BA in Politics and Religion from Oberlin College.

Outside CNAS, Elizabeth Rosenberg is providing exclusive advice on foreign policy and national security as an informal advisor to the Elizabeth Warren campaign.

Elizabeth Rosenberg Senior Fellow and Director of the Energy, Economics, and Security Program Center for a New American Security

Seminars

Do Morals Matter?

Tuesday, February 25, 2020 | 12:00 PM -Tuesday, February 25, 2020 | 1:30 PM

Seminar Recording: https://youtu.be/qanfBvhmTQM

About this Event: In Do Morals Matter?, Joseph S. Nye, Jr., one of the world's leading scholars of international relations, provides a concise yet penetrating analysis of the role of ethics in US foreign policy during the post-1945 era.

Working through each presidency from Truman to Trump, Nye scores their foreign policy on three ethical dimensions: their intentions, the means they used, and the consequences of their decisions. Alongside this, he evaluates their leadership qualities, elaborating on which approaches work and which ones do not.

Since we so often apply moral reasoning to foreign policy, Nye suggests how to do it better. Crucially, presidents must factor in both the political context and the availability of resources when deciding how to implement an ethical policy--especially in a future international system that presents not only great power competition from China and Russia, but transnational threats as borders become porous to everything from drugs to infectious diseases to terrorism to cyber criminals and climate change.

About the Speaker: Joseph S. Nye, Jr. is University Distinguished Service Professor Emeritus and former Dean of Harvard’s Kennedy School of Government. He received his bachelor's degree summa cum laude from Princeton University, won a Rhodes Scholarship to Oxford, and earned a Ph.D. in political science from Harvard. He has served as Assistant Secretary of Defense for International Security Affairs, Chair of the National Intelligence Council, and a Deputy Under Secretary of State, and won distinguished service awards from all three agencies. His books include The Future of Power, The Power Game: A Washington Novel, and (forthcoming) Do Morals Matter? He is a fellow of the American Academy of Arts and Sciences, the British Academy, and the American Academy of Diplomacy. In a recent survey of international relations scholars, he was ranked as the most influential scholar on American foreign policy, and in 2011, Foreign Policy named him one of the top 100 Global Thinkers. In 2014, Japan awarded him the Order of the Rising Sun.

Joseph S. Nye, Jr. University Distinguished Service Professor Emeritus Harvard’s Kennedy School

Seminars

Subscribe to North America

A Research Agenda for Cyber Risk and Cyber Insurance

Abstract

1.Introduction

2.What constitutes cyber risk? Primary Disciplines: Accounting, Computer Science, Law, Political Science

Related tactical questions include:

Potential Research Projects

Sources

3.How should we measure cyber risk and its associated direct and latent costs? Primary Disciplines: Data Science, Economics, Management Science

Related tactical questions include:

Potential Research Projects

Sources

4.Can cyber risks be avoided? Primary Disciplines: Computer Science and Management Science

Related tactical questions include:

Potential Research Projects

Sources

5.Where are opportunities to reduce cyber risk? Primary Disciplines: Behavioral Science, Computer Science, Law, Political Science

Related tactical questions include:

Potential Research Projects

Sources

6.How can cyber risk be best transferred to other parties? Primary Disciplines: Economics, Law, Management Science, Political Science

Related tactical questions include:

Potential Research Projects

Sources

7.How can residual cyber risk be managed and monitored? Primary Disciplines: Behavioral Science, Economics, Law, Management Science, Political Science

Related tactical questions include:

Potential Research Projects

Sources

8.Conclusion

NUCLEAR ARMS

MISSILE DEFENSE

LONG-RANGE PRECISION-GUIDED CONVENTIONAL STRIKE

HYPERSONIC, CYBER, AND SPACE

DIFFICULT TRADE-OFFS

2.What constitutes cyber risk?

Primary Disciplines: Accounting, Computer Science, Law, Political Science

3.How should we measure cyber risk and its associated direct and latent costs?

Primary Disciplines: Data Science, Economics, Management Science

4.Can cyber risks be avoided?

Primary Disciplines: Computer Science and Management Science

5.Where are opportunities to reduce cyber risk?

Primary Disciplines: Behavioral Science, Computer Science, Law, Political Science

6.How can cyber risk be best transferred to other parties?

Primary Disciplines: Economics, Law, Management Science, Political Science

7.How can residual cyber risk be managed and monitored?

Primary Disciplines: Behavioral Science, Economics, Law, Management Science, Political Science