The Trump administration is looking for its 'cyber moonshot'

The hunt is on for a single national target that will be a game-changer in online security. But don't hold your breath, it's probably not coming soon.

Tech advisers to the Trump administration are looking for a cybersecurity “moonshot” — a single national target that will be a game-changer in online security. But a meeting of a blue-ribbon telecommunications panel this week suggested that defining such a goal is still some way off.

“This is the beginning of a conversation,” Scott Charney, vice chairman of the president’s National Security Telecommunications Advisory Committee told CyberScoop during a break in the proceedings at a public meeting Wednesday.

“This current approach [to cybersecurity] isn’t working,” added Charney, a former Justice Department cyber prosecutor and current Microsoft VP. “Maybe incremental improvements are not enough … The breaches keep on happening.”

One official said the “moonshot” paradigm had been suggested to the committee by the White House. A former official who once worked with the committee said that was how taskings typically emerged. Charney said only that “It’s something a lot of people have been talking about.”

On Thursday, Former CIA CTO Ira “Gus” Hunt delivered a presentation about the need for a cyber moonshot to an event hosted by The Atlantic. America faced a “compelling opportunity to apply the lessons” of that five year scramble to get a man on the lunar surface and bring him back, said Hunt, now the federal cybersecurity practice lead for Accenture. “It took a visionary challenge to put that all together,” he added. “Today, we need to ignite that same passion.”

Charles Romine, director of the Information Technology Lab at the National Institute of Standards and Technology introduced a panel of technologists to kick off the NSTAC discussion Wednesday.

The actual U.S. lunar program of the 1950s and 1960s had three characteristics as a national goal, Romine argued:

• It was seen as “impossible, or nearly impossible, to achieve.”

• It was “pretty easy to describe.”

• It was “also easy to know when you’ve succeeded.”

But even the invited experts noted it was difficult to see how those criteria could be be applied to information security.

“I don’t mean to imply that moonshots aren’t worth doing,” Ed Felten, the Princeton professor who was deputy CTO in the Obama administraion told the NSTAC. But”roofshots,” an alternative, more iterative methodology, might be a better approach to solving the cyber problem he suggested.

“Roofshots can help us find where the moonshots ought to be aimed,” he said.

In his roofshot manifesto last year, Google engineer Luiz André Barroso pushed back against the “moonshot” model of development and progress in the company, arguing that “the bulk of our successes have been the result of the methodical, relentless, and persistent pursuit” of iterative opportunities — “what I have come to call roofshots.”

From the point of view of the private sector, said Felten, “One of the good things about roofshots is your entire business doesn’t stand or fall [based] on whether you are the only people who can do it.”

In prospecting for oil, he said “You end up drilling a lot of holes,” but only one of them had to be a strike.

“There’s some discussion about whether moonshot is the right paradigm,” Charney acknowledged.

In Felten’s presentation, he laid out two very iterative goals: Better implementation of well-understood security best practices and more secure software development.

He said a cyber moonshot would have to be a “very ambitious, risky and fundamentally sound scientifically … Something that, if it works out, would have an enormous return.”

But it wouldn’t have to be large or expensive. Asymmetric Public Key Encryption — PKI — had made whole new categories of communications encryptable.

“When you get a new approach, that can be transformative,” Felten said.

But the “biggest” cybersecurity transformation over the past 20 years, “wasn’t technology, it wasn’t [corporate] culture, it wasn’t any of these things, it was a  peace treaty between the U.S. and China,” said NSTAC member Dave DeWalt, former CEO of numerous. He said the Obama-Xi deal had led to “massively diminished activity” by Chinese state-sponsored hackers.

However, the globally and universally connected nature of the internet makes the gains from such deals illusory, countered Rodney Joffe, senior technologist at Neustar.

“It just needs one country that won’t sign on and unless you block them [from the global internet] you’ve achieved nothing,” he said.

He added that the issue highlighted the failure of online accountability. “Every piece of the internet, every connection, every [device] on it, is owned by someone,” he said.

Those owners needed to start tackling the problems, not just piping them through to the next guy. “We need to push responsibility out to the edges more,” he said.

Trump blames Minnesota for cyberattacks on water sector, drawing pushback from cyber world

The president went against his intelligence agencies’ conclusions about Iran being the likely suspect in the campaign.

Where’s the Trump administration line on AI regulation?

Trump administration isn’t pushing companies to conduct cyber offense, national cyber director says

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems