Paul N. Edwards of CISAC has been appointed as a lead author for the Sixth Assessment Report of the Intergovernmental Panel on Climate Change (IPCC). The IPCC is the scientific organization supporting the United Nations Framework Convention on Climate Change (UNFCCC).  Organized by the United Nations and the World Meteorological Organization, the IPCC’s reports provide the scientific underpinnings for the international climate negotiations that led to the 1997 Kyoto Protocol and the 2015 Paris Agreement on climate change.

The IPCC reviews the state of the science of climate change every 5-7 years. Its Sixth Assessment Report—to which Edwards will contribute--will be completed in 2021. Edwards will serve as lead author for four years to develop, review, and complete the assessment.

Through his appointment, Edwards becomes the first social scientist to serve as a lead author in Working Group 1, which assesses the physical science of climate change. The other two working groups deal with impacts, adaptation, and vulnerability (Working Group 2) and mitigation of climate change (Working Group 3).  Edwards will travel to Guangzhou, China, next week for the first meeting of lead author—a trip for which he has purchased carbon offsets.

Paul N. Edwards is William J. Perry Fellow in International Security and Senior Research Scholar at CISAC, as well as Professor of Information and History at the University of Michigan. At Stanford, his teaching includes courses in the Ford Dorsey Program in International Policy Studies and the Program in Science, Technology & Society. His research focuses on the history, politics, and culture of knowledge and information infrastructures. He focuses especially on environmental security, including climate change, Anthropocene risks, and nuclear winter.

Edwards’s book A Vast Machine: Computer Models, Climate Data, and the Politics of Global Warming (MIT Press, 2010), a history of the meteorological information infrastructure, received the Computer Museum History Prize from the Society for the History of Technology, the Louis J. Battan Award from the American Meteorological Society, and other prizes. The Economist magazine named A Vast Machine a Book of the Year in 2010. Edwards’s book The Closed World: Computers and the Politics of Discourse in Cold War America (MIT Press, 1996) — a study of the mutual shaping of computers, military strategy, and the cognitive sciences from 1945-1990 — won honorable mention for the Rachel Carson Prize of the Society for Social Studies of Science. Edwards is also co-editor of Changing the Atmosphere: Expert Knowledge and Environmental Governance (MIT Press, 2001) and Changing Life: Genomes, Ecologies, Bodies, Commodities (University of Minnesota Press, 1997), as well as numerous articles.

Introducing Cyberspectives, a new podcast analyzing the cyber issues of today with host John Villasenor.

In the inaugural episode, guest Andrew Grotto provides analysis on a broad range of cyber issues, including questions regarding areas of cyber most in need of national level attention, aspects of cyber that are underappreciated, emerging opportunities in the commercial cybersecurity sector, and how the academic community can best contribute to the cyber policy dialog.

About the guest:

Andrew Grotto is a William J. Perry International Security Fellow at the Center for International Security and Cooperation and a Research Fellow at the Hoover Institution, both at Stanford University. Before coming to Stanford, Grotto was the Senior Director for Cybersecurity Policy at the White House in both the Obama and Trump Administrations. Prior to that, he was Senior Advisor for Technology Policy to Commerce Secretary Penny Pritzker.

KEY EXCERPTS FROM THE ANDY GROTTO INTERVIEW

(the text below has been condensed and edited for clarity)  


John Villasenor:  
Is there anything less obvious that you'd say about aspects of cyber that you think are particularly deserving of national level attention—other than the obvious such as protecting critical infrastructure?

Andy Grotto:  
To me, one issue that really jumps out at me based on my experience, is I think there's a lot of open questions around the appropriate allocation of responsibility between the government and the private sector for defending against cybersecurity threats, and so I'll use an analogy from the physical world: we would never expect in a million years the operator of a power plant to defend a plant against a North Korean ballistic missile. That mission is squarely the government's job.

And, the cyber analog to that, though, is a little tricky because if North Korea conducted a highly sophisticated cyberattack against a plant, we might say, “Okay, yeah, maybe it's unreasonable for the plant to be able to defend against that kind of sophisticated attack.” But, what if it was just a criminal group, a domestic criminal operator who happened to come up with a sophisticated attack? Does it matter that the identity of the perpetrator was a nation state vs. some ambitious vandal?

And then, on the opposite end of the spectrum, if North Korea were to send in a lone agent to break into the power plant and sabotage it, and the sabotage caused catastrophic power outages and damages to the economy and loss of life, obviously, that's still a national security matter for the government to devote resources to both preventing and remedying, but we would also have a lot of questions about whether or not the power plant operator did its job. We would want to know, "Okay, so did you have perimeter security? Did you lock the front door? Why was your security vulnerable to such a single point of failure?"

So there's a blended responsibility. And, I don't think that that line is clear in the cyber context because a nation state adversary could use a relatively low-end, even unsophisticated attack to conduct an attack with national security implications, partly owing to the fact that it was a nation state that did it. In that case, it's a national security issue.

John Villasenor:  
So you're saying that this sort of allocation, it's easy to come up with the extreme ends of the spectrum. But, most of the stuff that we actually encounter in terms of cyber challenges is going to be somewhere in the less clear middle ground, and you're saying that allocation of responsibility is hard, and I think that's a terrific point. The other thing I wanted to briefly reflect on is: You made a really important comment. You stated, correctly, of course, it's clear that there's a lot of energy spent responding to crises, cyber crisis of one form or the other. My question in response to that observation is, is that also a risk? It's a risk in any domain, but is it a particular risk in this domain that our energies understandably get directed towards solving crises, but in doing that, we then fail to sort of take a step back and look at the big picture and take some of the steps that could make some of these crises not happen in the first place?

Andy Grotto:  
Yeah, it is a challenge, and I think if I could pick a point of optimism here: it's that part of the reason why, I hope, why crises consumed so much bandwidth during my time in government is because oftentimes these crises presented matters of first impression for decision makers, especially the time when the broader cyber mission space was evolving within and across different agencies of the government. It meant that getting decisions made on cyber questions just took a lot more time, energy and resources than they might take in other domains.

So, my point of optimism is that as the government develops some muscle memory around how to deal with policy challenges in the cyber context, those decision costs will start to come down. They may still be high relative to other domains, but they hopefully won't be quite as high as I thought they were, at least, during my time.

John Villasenor:   
Are there any areas of cyber that you think are particularly underappreciated, in other words, that aren't getting the attention they deserve in light of their potential importance?

Andy Grotto:  
I mentioned the allocation of responsibility question for critical infrastructure. That's one. I'll offer two additional ones. The first is a lack of really reliable data around the cost of cyber incidents. There are various studies out there on what a data breach costs. What we're seeing more and more is scholars and statisticians pulling some pretty divergent conclusions from this data, which says something about the data.

So, I think that's an area where I would like to see a lot more scholarly attention and focus by industry and government, because I think if we can generate better data about the cost of cyber incidents, it will help enterprises across the country manage their risk more effectively, and then potentially even create a more vibrant insurance market.

And then the other area that [needs] more attention is sort of what I call third-country issues and offensive cyber operations. In a cyber context, that identity relationship between the physical location of the adversary and the target, as it were, the physical target, isn't in place, so, an adversary may be in country A operating malicious cyber infrastructure in country B, and so, an operation against that adversary in country A may actually have to take place in country B, which may or may not have anything to do with whatever conflict the US government or pick-your-government has with country A. So, that was a third country in the mix that creates, I think, some challenging policy and legal questions.

John Villasenor:           
And I would assume that's not only the exception. That's likely, more often than not, going to be the case, right? If you're an attacker, the last thing you want to do is, you know, make it obvious where the attack's coming from, so I would assume one of the first things you're going to do is to try to launch it from somewhere that at least tries to mask your identity, right?

Andy Grotto:                
Right, and one of the unfortunate twists here is that our adversaries are also very familiar with US surveillance law and constitutional protections here domestically, so what adversaries will do is they will purposefully compromise infrastructure in the United States and use that infrastructure as part of their attack infrastructure because they know that, in a way, in a practical matter, it's harder for the US government to operate domestically against a national security threat such as that than it is if that same infrastructure were in a third country, because we would need probably cause and satisfy legal requirements that just aren't the same if we're operating overseas.

John Villasenor:           
Let me ask another question, and this is the one where anybody who's a venture capitalist should be particularly interested in your answer here, or a startup company: Obviously, there's an enormous commercial sector devoted towards cyber solutions of all shapes and sizes. The question is, while that's a large sector, it's less clear that it's covering all the bases. Are there any obvious gaps in the types of solutions you see reflected in today's commercial offerings? If you were going to leave the academic/policy world and start a cybersecurity company, is there a particular sector of cybersecurity that you think is ripe for better solutions commercially?

Andy Grotto:  
I think any technology that can do what a human does in cybersecurity more efficiently and more effectively has huge potential because time and time again, the critical shortage in enterprise, whether it's the federal government or in private companies, is human capital, the need for people to do IT and solutions that can perform, can automate these tasks, I think, have huge potential in the future. I think IoT cybersecurity is, I think, a massive opportunity, how to both build efficient solutions into products, but also how to retrofit products that have bad security with more effective security. I think that's a huge market.

John Villasenor:   
For people in the academic community, on the cyber policy side, again, putting the obvious aside: is there anything that you see as a particularly ripe avenue for people in the academic policy world to contribute to help move the dialog forward on cyber issues?

Andy Grotto:  
Yeah, so on the sort of policy side specifically, I would say, one area is data on cost of incidents, on the behavior of enterprises in the face of uncertainty around cyber risk. I think there's a huge need and opportunity for doctoral students looking for dissertations to delve into some of these empirical questions about measurement and whatnot.

I would love to see more psychologists in the cybersecurity business. If you look at studies of how adversaries break into enterprises and organizations, they're almost, for the most part, exploiting human weaknesses. There's this spearfishing, right, that, things like that, and getting a better handle on how to make people, whether they're IT professionals or just users of IT, you know, either less vulnerable or effective at fending off attacks, I think there's a huge need and maybe some fascinating questions of psychology there.

And then, I think, a need for management scientists, organizational scientists, to start to unpack how businesses and governments and businesses both within sectors and across sectors can collaborate on common challenges and better characterizing, “What can we learn from history about the ability of like-minded or similarly-situated institutions to tackle complex management” because managing cybersecurity risks is ultimately a management challenge for enterprise, tackling a complicated management challenge like cybersecurity.

On May 14 and 15, 2018, many of the CISAC fellows were lucky enough to visit the United States Strategic Command (USSTRATCOM) at Offutt Air Force Base near Omaha, Nebraska. USSTRATCOM oversees strategic deterrence on multiple fronts, including nuclear weapons, missile defense, and, until recently, cyber-attacks. This trip was only the latest iteration of a longstanding relationship between CISAC and USSTRATCOM to foster research and debate on deterrence, assurance, and nuclear security

Our visit involved several highlights. General John Hyten, Commander of USSTRATCOM, took time out of his schedule to speak with us during breakfast on the first day. We were briefed on the global mission and history of USSTRATCOM, strategic planning, laws of armed conflict, nuclear modernization, and cybersecurity. The fellows were also able to visit the Global Operations Center and Battle Deck, where many of USSTRATCOM’s most important day-to-day functions take place. Several CISAC fellows (including me) had the opportunity to brief both military and civilian members of USSTRATCOM on a range of issues spanning from nuclear terrorism to the proliferation of offensive cyber capabilities to the domestic politics of American citizens’ growing perception (now at a historic high) of national decline.

I walked away from the experience with three strong impressions.

First, USSTRATCOM is populated with thoughtful individuals who have deeply sober attitudes about the devastating impact of using nuclear weapons. Each person we met was committed to ensuring the nation’s security but emphasized how seriously they took the notion of nuclear conflict and how they all sought never to prevent conflicts from reaching that point.

Second, I was struck by how everyone at USSTRATCOM was open to discussing new or provocative ideas. During our breakfast, General Hyten called upon one of the fellows working on Russian nuclear doctrine. It was clear that he was aware of the fellow’s work and disputed its conclusion. The two conversed about their differing views for several minutes before agreeing to disagree. Another one of our fellow’s briefings focused on the origins of the recent United Nations treaty on the prohibition of nuclear weapons. Her talk drew some skepticism, but also many questions and generated a very civil discussion. USSTRATCOM invited us to speak, took our arguments seriously, and sought to understand any viewpoint that they felt could be valuable.

Third, and lastly, there is enormous need and potential to continue building connections between the military (or government more broadly) and the academic community. Visiting USSTRATCOM highlighted how scholars who study security may not fully grasp the realities behind how to effect and maintain it. This might lead to academic work that tends to be unrealistic or too reductive. Conversely, both military and civilian members of USSTRATCOM may be so engrossed in addressing specific problems that they sometimes miss the forest for the trees or overlook fallacies in their strategic logic. This could result in policies that have unintended and, given USSTRATCOM’s purview, severe consequences. Collaboration between these two worlds is perhaps the best tool we have for solving both problems simultaneously. The potential ramifications are too important not to do so.

Eric Min is a Zukerman Postdoctoral Fellow in Social Sciences at the Center for International Security and Cooperation at Stanford University, where he also obtained his Ph.D. in Political Science. His research focuses on the application of text analysis, machine learning, and statistical methods to analyze the dynamics of conflict and diplomacy. Starting in the fall of 2018, he will be an Assistant Professor in Political Science at the University of California, Los Angeles. He can also be found on Twitter. 

Sagan is a senior fellow in the Center for International Security and Cooperation and the Freeman Spogli Institute for International Studies at Stanford.

Scott D. Sagan, the Caroline S.G. Munro Professor of Political Science, has been named a 2018 Andrew Carnegie Fellow. Sagan is also a senior fellow in the Center for International Security and Cooperation and the Freeman Spogli Institute for International Studies (FSI) at Stanford.

Sagan joins this year’s class of 31 Carnegie Fellows, each of whom receives up to $200,000 to pursue a significant research and writing project.

Image

Sagan’s Carnegie project will focus on assumptions about nuclear deterrence and strategic stability, which will include a multi­country study of ethics, nuclear weapons and public opinion. The project will also run experiments to discover how information about the potential damage of nuclear weapons might alter public support for using such weapons during war and peace.

Sagan has been examining citizens’ attitudes about the use of nuclear weapons. His recent article (co-authored with Dartmouth College Professor Benjamin Valentino), “Revisiting Hiroshima in Iran: What Americans Really Think about Using Nuclear Weapons and Noncombatant Immunity,” has revealed alarming findings about the American public’s willingness to support the use of nuclear weapons in a variety of strategic scenarios.  This work has generated novel conversations in both the scholarly and policy worlds about future nuclear risks.

“Professor Sagan’s innovative work has helped illuminate assumptions about how the world views nuclear war today.” said FSI Director Michael McFaul. “I am thrilled that the Carnegie Corporation has recognized the importance of Scott’s work for our current, dangerous era.”

The Carnegie Corporation was established in 1911 by Andrew Carnegie to promote the advancement and diffusion of knowledge and understanding. In keeping with this mandate, the corporation’s work focuses on the issues that Andrew Carnegie considered of paramount importance: international peace, education and knowledge, and a strong democracy.

“We were reassured by the immense talent and breadth of experience reflected in the proposals from this year’s nominees for the Andrew Carnegie Fellows Program,” said Vartan Gregorian, president of Carnegie Corporation of New York and president emeritus of Brown University. “Since its founding in 1911, the Corporation has provided strong support to individual scholars, as well as a wide variety of institutions, causes, and organizations. The response to the fellows program gives me great hope for the future of the study of the humanities and the social sciences as a way for this country to learn from the past, understand the present, and devise paths to progress and peace.”

As a senior policy advisor on the Middle East at the Pentagon and the White House, Colin Kahl has witnessed struggles in the region first-hand. From working to shape the U.S.-led campaign against the Islamic State and the long-term partnership with Iraq to limiting Iran’s nuclear activities to helping craft the U.S. response to the Arab Spring, Kahl knows better than most how important it is to understand this rapidly changing region.

Now that he has joined the Freeman Spogli Institute for International Studies (FSI) as its inaugural Steven C. Házy Senior Fellow, Kahl wants to improve understanding of how developments in the Middle East impact people in the region and security around the globe.

The launch of FSI’s Middle East Initiative provides a first step toward this objective. As the initiative’s first director, Kahl plans to create “connective tissue” for efforts already underway across Stanford.

“There are a number of disparate efforts around campus working on Middle East issues,” said Kahl. “There is a lot of terrific research and engagement going on. My hope is that the Middle East Initiative will serve as a focal point to expose the Stanford community to ongoing work and foster new conversations that are not happening now.”

Many of the Middle East activities already occurring on campus happen at FSI, making it a natural home for the initiative.

“Our scholars are already studying the dynamics of authoritarian regimes in the Middle East, prospects for reform and democracy in the Arab world, ways to counter terrorist activities and promoting economic development,” said FSI Director Michael McFaul. “Stanford students want to dive more deeply into the region’s political, social, economic and technological development. We want to give them that opportunity.”

In the 2018-2019 academic year, FSI’s Ford Dorsey Master's in International Policy plans to begin filling this need by adding a three-course sequence on the Middle East.

Kahl also plans to bring more Middle East scholars from outside Stanford to share their ideas and research.

“I look forward to helping Stanford students and scholars connect and collaborate in ways that enrich our understanding of this vital region,” said Kahl. “Stanford has much to contribute to some of the most pressing policy challenges we face.”

Stanford political scientists Condoleezza Rice and Amy Zegart offer insights about how businesses can most effectively confront “political risks” in an uncertain world where information for customers and clients is now at their fingertips.

While political risks have grown more complex, wisely managing them remains fairly straightforward, two Stanford scholars say.

Political scientists Condoleezza Rice and Amy Zegart explain how a company’s fairy tale can become a nightmare if it fails to take effective measures against “political risk,” the probability that an action or event will significantly affect business, positively or negatively.

For companies, political risk is defined as the probability that a political action will significantly affect their business – whether positively or negatively.

Whether those threats come from government, Twitter, terrorists or activists and hackers, the reality is that political risks can blindside even the best managers if preparatory measures are not taken, say Condoleezza Rice and Amy Zegart, two Stanford political scientists. They co-taught the Stanford MBA course, Managing Global Political Risk, to more than 200 students over the past six years, collecting case studies and research for their course.

Zegart, the Davies Family Senior Fellow at the Hoover Institution and co-director of Stanford’s Center for International Security and Cooperation, and Rice, the Thomas and Barbara Stephenson Senior Fellow at Hoover and a former U.S. secretary of state, feature their findings in the book, Political Risk: How Businesses and Organizations Can Anticipate Global Insecurity. Rice is also the Denning Professor in Global Business and the Economy at the Stanford Graduate School of Business.

Drawing on social science research, interviews with industry leaders and their own experiences, Rice and Zegart explain why political risk is so hard for all organizations to see. They provide detailed examples of best practices and cautionary tales in risk management from leading businesses as well as insights from aircraft carrier operations, NASA’s space shuttle program and professional sports teams.

Political Risk offers a new approach for anticipating, analyzing, mitigating and responding to possible threats that can be applied in any organization.

In an interview, Zegart said that such risk is no longer just about a foreign country’s tax system, regulatory environment or threat of expropriation.

“Instead, security challenges – wars, civil unrest, cyberthreats, terrorism and insurgencies – pose risks and opportunities for global organizations and businesses, which could have catastrophic or – if well handled – beneficial consequences,” Zegart said.

At the same time, globalization and social media have given local people everywhere an ability to spread messages and join in common causes around the world. As a result, politics in one location can have cascading effects elsewhere – whether it’s the spread of Tunisian protests in the Arab uprisings or a campaign to ban the sale of “conflict diamonds” from war-torn African countries.

From fairy tale to nightmare

Consider SeaWorld, the theme park company that in 2013 had just completed an initial public offering that exceeded expectations, raising more than $700 million in capital and valuing the company at $2.5 billion, according to Rice and Zegart.

Eighteen months later, SeaWorld’s fairy tale had become a nightmare. The stock price had plunged 60 percent and top management resigned. Why? A low-budget documentary film examined the treatment of the company’s famed killer whales. Soon, news headlines were excoriating the company, with pressure growing on public officials to regulate the handling of killer whales. Amid the backlash, SeaWorld’s stock fell from $38.92 a share to $15.77 in 2014 – and it has not recovered.

So, how can companies and organizations best manage political risk in our current environment of rapid information? Rice and Zegart suggest a new “framework.”

Understand risks: Companies need to evaluate what their appetite is for political risk. For example, while oil and gas companies undertake long-term investments in distant countries, they might be willing to tolerate more risk than more retail-oriented industries, such as hotel chains and theme parks, that face customers on a daily basis.

Also, they should ask: What is their company-wide understanding about the tolerance of risk? Rice and Zegart suggest companies encourage creative thinking to guard against “blind spots” or groupthink” when it comes to judging risk factors.

Analyze risks: Getting good information about political risks and conducting objective reviews and analyses of those challenges is important, Rice and Zegart wrote. That research can be used to make wiser business decisions grounded in reality. “Getting managers to use rigorous political risk analyses – of any variety – to defend investments can significantly improve decision-making.”

Reduce risk exposure: Organizations need to ask themselves how they can decrease their susceptibility to identified political risks. Also, do good systems and teams exist that can react and handle situations on a timely basis? Also, Rice and Zegart noted, managers can take steps to minimize potential damage long before a crisis unfolds if they plan properly and foresee the likely risks.

Respond to risks: Organizations can learn from incidents where something may have gone wrong. They can use such knowledge to respond more effectively to future crises. “Leaders must react and correct for the human tendency to ascribe close calls to a system’s resiliency when it’s just as likely the near miss occurred because of a system’s vulnerability,” according to Rice and Zegart.

They provide as an example of a wise approach a toy company that in 2006 created a strategic risk management system that helped align views on risk across the company. Leadership set up systematic processes for training all new managers about risk; engaging every important business leader, including the board members, in setting the risk appetite; identifying risks; and integrating risk assessment and reduction into business planning.

They also pointed to a hotel chain that now has a sophisticated security alert system. While the company acknowledges it doesn’t know when or where terrorists may strike next, it has increased preparedness and safety measures in every hotel. The company achieves this by notifying hotel managers about changing conditions that might pose a threat and informing employees what to do in potential cases of risk.

“In the end,” Rice and Zegart write, “the most effective organizations have three big things in common: They take political risk seriously, they approach it systematically and with humility, and they lead from the top.”