Thread by @doctorow

In security, attackers have an easier job than defenders: an attacker has to find a single mistake that a defender has made; a defender has to make no mistakes.

But the best defense is NOT a good offense. Neglecting defense means abandoning the people you're defending.

1/

So guess how the US apportions its "cyber" budget.

It's all "deterrence" (i.e. offensive capability) and virtually no actual defense. As @Jason_Healey writes in @lawfareblog, this leaves Americans as "prey," not "predators."

lawfareblog.com/cyber-budget-s…

2/

Healey is writing about the Cyberspace Solarium Commission's report "on a strategic approach to defending the United States in cyberspace against cyber attacks of significant consequences."

solarium.gov

3/

The report shows that the vast majority of information security spending in the US is though the military, not through defensive organizations like the DHS, a trend that began with Clinton and has been continued by every president since, with massive acceleration under Trump.

4/

Ironically, Trump has criticized previous admins for neglecting defense and pledged to increase it as a priority, but all he did was redefine "defense" to mean "punishing those who use cyber tools for malicious purposes" and attaining "peace through strength."

5/

Which is why the DoD's cyber budget is 25% higher than the total infosec budget of ALL defensive agencies, with US Cybercommand HQ getting 33% more to cover program ADMINISTRATION than the ENTIRE State Dept cyber budget, INCLUDING operations.

6/

The DoD's cyber ops budget is 250% of the budget for then entire Cybersecurity and Infrastructure Security Agency, and 1000% of the budget for the National Cybersecurity and Communications Integration Center.

7/

And that's just the part of the budget we know about; most of the DoD's budget is a secret. It's part of the trend Rosa Brooks spoke of: "everything became war and the military became everything."

8/

Healey: "There are tremendous risks when a fearsome offense is paired with a weak defense," because "a more fearsome cyber offense makes it more likely they will get in a sucker punch on the U.S. before Cyber Command can bring its big guns to bear."

9/

He's focused on the geopolitics, but we must attend to human costs. When computer criminals steal trade secrets or kompromat, steal identities or clean out your bank account, they get away clean because your government has prioritized attacking rivals over defending YOU.

10/

To take just one example: the NSA found a vulnerability in Windows that they codenamed "Eternalblue." Rather than report that bug to Microsoft so it could be fixed and everyone relying on Windows could be safer, the NSA kept the bug a secret so it could attack its enemies.

11/

Then Eternalblue leaked. It got picked up by dumdums and spliced into some not-very-effective ransomware, supercharging in and giving birth to the Wannacry epidemic. Wannacry went on to shut down numerous businesses and hospitals around the world, including in the US.

12/

But it did worse than that: Wannacry was used to shut down entire US CITIES. For MONTHS. Including, for example, Baltimore, a city that serves as a commuter town for Beltway Bandits, perhaps including some who decided not to fix Eternalblue.

nytimes.com/2019/05/25/us/…

13/

It would be one thing if the only people who suffered as a result of this ghastly blunder was DoD personnel and their overpaid contractors - but the collateral damage here is staggering.

14/

An offensive posture means you can make your enemy's rubble bounce after they slaughter your people. Only a general hoping for consulting work with a defense contractor could view this as a good tradeoff for the casualties experienced by the people they've sworn to protect.

eof/