Reports & Papers

Cyber security is a relatively new international problem. A decade ago, it received little attention as an international issue, but since 2013 the Director of National Intelligence has named cyber security risks as the biggest threat facing the USA. Although the exact numbers can be debated, various non-profit organisations have listed hundreds of state-sponsored attacks by a score of countries in the past decade. Many observers have called for laws and norms to manage the growing cyber threat. In this paper the author outlines the key normative restraints on cyber conflict. The author draws on the development of international norms in recent history to offer insights into the formation of normative restraints in the cyber realm.

The government is facing a severe shortage of skilled workers, especially in information technology and cyber security jobs. The conventional wisdom in branches of policy and public administration is that the shortage is driven by low salaries that are not competitive for attracting top talent. Using longitudinal data on high skilled workers between 1993 and 2013, this paper shows that, if anything, government employees earn more than their private sector counterparts. Although government workers tend to earn less in the raw data, these differences are driven by the correlation between unobserved ability and selection into private sector jobs. These results are robust to additional data from the Census Bureau between 2005 and 2016. Instead, this paper shows that a more plausible culprit behind the worker shortage in government is a lack of development opportunities and poor management.

When we think about critical infrastructure, the first assets that come to mind include the electric grid, water networks and transportation systems. Further unpacking the definition of critical infrastructure, we consider industries such as agriculture, defense or the financial sector. However, we rarely think about where the underlying systems that enable technology functionality across these sectors physically reside, who developed the technology, and who can access and manage that technology.

This essay seeks to explain why the United States is struggling to deal with the “soft” cyberoperations that have been so prevalent in recent years: cyberespionage and cybertheft, often followed by strategic publication; information operations and propaganda; and relatively low-level cyber disruptions such as denial-of-service and ransomware attacks.

There are no silver bullets for federal cybersecurity. The system will retain its inherent complexity, necessitating close coordination and partnership. Federal cybersecurity will be an enduring mission, always evolving and changing to stay ahead of the threat. In other words, there is no “finish line”—only continual improvement, adaptation, and cooperation to secure the federal government and those it serves.