Thad Allen on cybersecurity's growing complexity

The most byzantine problem facing government and the private sector today in the area of disaster preparedness and response is “the interface between cybersecurity and critical infrastructure,” Admiral Thad Allen, former commandant of the Coast Guard, said at a briefing Sept. 10 in Washington.

“The far more challenging issue right now is cybersecurity because the internet is everywhere and cyber touches everything,” said Allen, now an executive vice president at Booz Allen Hamilton. “Even if you don’t own a computer it touches you because it may be running the street lights and everything.”

Compounding the problem is the increasing complexity of the threat environment. “As we look to the future, we’re probably not going to be dealing with singular events anymore,” he said. “We’re going to be dealing with complex, hybrid events.”

The growing interaction between the natural environment and what Allen called “the human-built side of our environment,” which continues to expand, is “producing consequences that we didn’t see a couple of hundred years ago,” he said.

One type of hybrid event is where a natural disaster precipitates an extended man-made disaster, such as catastrophic damage to the critical infrastructure, he said.

But a more worrisome disaster scenario is man-made, one triggered by a cyber attack. “You can a have a man-made disaster precipitated by a cyber attack on a set of industrial control systems that produces an impact on the population, kinetic events and physical damage,” Allen said. “The level of complexity that we’re dealing with is that a combination of events can create negative synergy in ways we’ve never anticipated before.”

Adding to the problem of cybersecurity is the fact critical infrastructure, such as the electrical grid, resides mostly in the private sector, he said.

As a result, preparation for a cyber attack is hampered by the paucity of information-exchange mechanisms between the government and the private sector.

“How do you get warnings to the private sector when [the government has] intercepted them in a classified environment and can’t attribute the source for national security reasons?” Allen said. “If the private sector is being attacked, the real issue is how do you create the secret sauce that gets you to some metaphorical demilitarized zone [where information can be traded]? Right now, there aren’t enough legal safeguards for the private sector to feel comfortable in a complete- disclosure setting. They have issues related to liability and antitrust.”

At the same time, a variety of government agencies have different roles and responsibilities in responding to a cyber disaster, leading to governance issues. In a hypothetical example, the Federal Emergency Management Agency is trying to support local communities in recovery while the FBI is treating the disaster as a cyber crime, managing the area as a crime scene and preserving evidence, Allen said.

“In the absence of a single point of contact that is empowered politically to act on the behalf of the president, there is nothing that’s institutionalized to make that easy,” he said. “The more complicated these events get, the harder it is to deal with them.”

Ultimately, he said, it’s going to require legislation to sort out the governance hurdles and create lines of communication between government agencies and the private sector to exchange crucial data about cyber threats and events.

“That’s going to prompt a very complex discussion about what the inherent role of government is versus the private sector,” he said. “Where’s the dividing line and who should do what? In almost everything related to government’s involvement with either natural or manmade disasters really involves [the question of ] the inherent role of government.”

Some small-scale progress in creating a framework where government and the private sector can exchange information is being made by the National Cyber-Forensics and Training Alliance in Pittsburgh, a public-private partnership designed to identify, mitigate and neutralize cyber crime threats. The alliance began as a collaboration between the Software Engineering Institute at Carnegie Mellon University and local Federal Bureau of Investigation, Allen said.

“It’s an organization where you can co-locate industry representatives and federal government representatives,” Allen said. “They created an independent malware lab where they can analyze stuff and then go to the coffee pot and talk to each other.”

Since joining Booz Allen Hamilton in December 2011, Allen has been the leader of the company’s departments of Justice and Homeland Security business in the civil market. He has led the development of the notion of “resilience” in dealing with natural and man-made disasters—a holistic approach to understanding risk and risk mitigation across a unified coalition federal, state and local governments, businesses, community organizations and individuals.

“The argument for mitigation and looking at these things in advance is that we’re dealing with a level of complexity we haven’t seen before and we can envision all the combinations of events that could come about in a hybrid event,” he said.