Cybersecurity experts say the west has failed to learn lessons from Ukraine

One stumbling block is the US government’s categorization of certain details as classified. Robert Lee, who runs cybersecurity company Dragos, said he has been involved in cases that were not immediately disclosed because the information was classified.

“There’s some truth,” he added, in the “idea that asset owners and operators are just keeping it quiet.”

Another problem is the reluctance of listed companies to disclose potentially damaging information for fear of the impact on their share price, which has prompted the US to work on legislation to deal with the issue. The Chamber of Commerce is disputing new rules from the Stock Exchange Commission that will require publicly traded firms to disclose material breaches within four days.

Several agencies meanwhile have overlapping authority, “creating chaos” rather than being disciplined, said Lee.

“You’ve got the FBI and DHS and CISA tripping over each other yelling at each other,” said Lee. “And the inter-agency [fights] behind the scenes [are] about 10,000 times worse than whatever gets made public.”

At a bar at the conference, an official from the US defense department pulled up a chair to a group of cybersecurity professionals and asked why the US has not been hit with complex, simultaneous attacks.

The official replied to his own question: “Deterrence as defense. They know we are in their systems too and, if they hit us here, we turn the lights off in Moscow.”

Easterly, the CISA director, acknowledged that progress on transparency was still underway but the fear of tit-for-tat attacks had held some chaos at bay.

“There is some fear of escalation,” she said. “Are there still people who are going to their lawyers first and foremost? Yes. But we’re starting to break through on the understanding of a threat to one is a threat to all.”

© 2023 The Financial Times Ltd. All rights reserved. Not to be redistributed, copied, or modified in any way.