The issue of cybersecurity is overwhelming – typical of a so-called “wicked problem,” that is one with multiple dimensions and many stakeholders with different values. Difficulties in attribution and accountability make the issue even harder. A roundtable on December 13, 2023, that the Stimson Center put together for the Society for Risk Analysis (SRA) Annual Meeting in Washington, DC, sought to take “some of the wicked out of the cyber problem.”
Debra Decker, a Senior Advisor at Stimson, led panelists in the discussion, first giving an overview of the characteristics of “wicked problems” and of Stimson’s project on cyber accountability, an area that few have been addressing in depth.
Panelist Dr. Fabio Massacci, Professor of Computer Science at the University of Trento, Italy, and at Vrije Universiteit, Amsterdam, is an expert in vulnerability management. He explained some of the challenges in holding system providers and managers to account. He also noted some of the recent progress being made in this area, especially in the European Union and to some extent in the United States, including with a move toward software development requirements in the form of attestations and some commensurate potential liability.
Panelist Dr. Unal Tatar, Professor in the Cybersecurity Department at the State University of New York at Albany, most recently served as the head of the National Computer Emergency Response Team of Turkey. He discussed accountability of the end-user for ensuring their and their entity’s good practices but also noted the importance of identifying and sharing more best practices, such as through the Global Forum on Cyber Expertise. He emphasized the need for capacity building and essential knowledge transfers worldwide. Complimenting NATO’s training projects and exercises and its help in building digital forensic centers, he noted NATO engagement extends beyond NATO members.
Dr. Christopher Ford is a former United States senior government official and currently a Visiting Fellow at the Hoover Institution and a Visiting Professor with Missouri State University’s Graduate Department of Defense and Strategic Studies. In a recorded interview, Dr. Ford shared his insights and experience in government from managing another “wicked problem” – the one of nuclear proliferation and security. He noted the different elements of the risks; how different approaches developed based on different values, interests, capabilities, and capacities; and how different collaborations and investments evolved. His point was that many different approaches were needed for addressing various issues and that like-minded States and NGOs could help lead effectively on various initiatives.
Rosa Celerio, George Washington Law School Associate Dean for International and Comparative Legal Studies and Burnett Family Distinguished Professorial Lecturer in International and Comparative Law and Policy, is an expert on human rights. She discussed the evolving threats to human rights, such as privacy, and how technology presented specific challenges. She also pointed out that existing agreements on norms and law could be and are gradually being adapted to face cyber challenges, such as to surveillance technologies.
In sum, to address wicked risks such as cyber, the panel consensus appeared to be to methodically assess and deconstruct the risks and then to address them in various ways as stakeholders can agree – with strong leadership being an important element in developing approaches to ensure effective outcomes. The discussion proved a valuable input to Stimson’s overall research supporting its Cyber Accountability Project.
