Full hearing: US Senate on Cyber War Readiness

Highlights from the US Senate panel on cybersecurity 23 February 2010.

Mary Ann Davidson, CSO (Oracle). Required reading! Ms. Davidson masters the subject in bright prose. This is an excellent indictment of the rush deploy smart grid technologies before we’ve had time to harden them from the types of attacks that routinely take computers off line. Thought experiment: what level of unplanned downtime would you be comfortable with for your house’s electrical power? water? energy? Would you try to save 10% on your electric bill if for a system that you couldn’t be sure would work more than 99.9% of the time?

Even better, Ms. Davidson points out a crucial flaw in education. Computer science is applied mathematics, and few departments teach young programmers how to write secure software. If university departments don’t teach secure programming, we will need professional certifications to substitute, as with medical residencies, CFA exams for financial analysts, and professional societies for engineers and architects.

Vice Admiral Mike McConnell (Booz Allen Hamilton). Sound byte: “If there were a cyber war today, the United States would lose.” Some excellent recommendations for training a new class of software engineers, security professionals, and managers. Don’t be distracted by the salacious and unwarranted assertion at the outset. The rest of the testimony is good, and nobody is better informed than the Admiral.

Dr. James A. Lewis (CSIS). A couple of interesting metaphors. He compares cyberspace to a condominium and to a shopping mall, meaning that the space is all privately owned, and that neighbors have a compelling interest in one another’s behavior. Therefore all should be willing to submit to greater regulation. I’m inclined to agree with Borg’s statement (below) that government regulations are unlikely to keep pace with the rate of innovation. Rather  than ask the government to certify that buildings are safe, wouldn’t we be better off with private certification of a standard of risk, as we currently do with automobiles, houses, and financial management? Computers and especially software are endlessly complicated, and don’t lend themselves well to the same type of governance as broadcast media and airplane safety.

Lewis also makes a crucial overstatement when he says that there are no rules on the Internet or that the Internet is a wild west. Actually many national and state authorities have control over Internet commerce, fraud, and even transborder crimes. At a more fundamental level, Lewis’ lawless vision of the Internet is fundamentally at odds with Internet governance over every layer of the Internet, from the development of hardware standards and Internet protocol, to the assignment of names and numbers, to the software that runs servers and home desktops. Re-read Lessig, and see if you can imagine the Internet truly without rules.

Scott Borg (US-CCU). Focuses on 3 central problems: (1) the conflict is already here; (2) cyber conflict threatens future American prosperity; (3) fixing markets is the key to improving cyber security. I agree with Borg, but then I’m biased.

Rear Admiral James Arden Barnett, Jr., Ret. (FCC). An interesting point of view. I don’t have any problem with DHS assisting the country with situational awareness, but the philosophy of defense is extremely centralized. The greatest specific policy errors of homeland security in the last ten years have been efforts to provide one-size-fits-all information and requirements from a central national office: the national threat level scale, vastly increased expenditures on passenger screening at airports, and advice on creating a safe room for chemical gas attacks inside your home. There are too many computers, and too many businesses to expect that federal marshals can secure their IT infrastructure for them. Effective homeland defense will require businesses and individuals to have cheap, effective, and secure choices to accomplish the things they already know how to do: run their businesses and their households.

Thank you Brian Hasbrouck

You should go check out Brian’s blog, Political Risk Explored. He is currently reading some great books!

• Bremmer and Keat The Fat Tail
• Bremmer The J Curve
• Kindleberger and Aliber Manias, Panics and Crashes
• Bernstein Against the Gods
• Bouchet, Clarke and Groslambert Country Risk Assessment

Nobody else says things this nice about me except on my birthday. Thank you! Seriously, thank you for attending Fletcher’s conference Managing Political Risk 2009.

I also wanted to thank Munish, Benjamin, and Andy for being so nice to me.  I’m happy I came up even though I’m approaching my 23rd hour of straight consciousness and feel sick.  I’ll probably wrap up some of the things I learned on Sunday/Monday after I’ve recovered from the conference and/or weekend!

…

A nice gentleman by the name of Benjamin Mazzotta showed me his desktop picture of the world sized to population.  Awesome. The map (and him).

Political risk advising: core business

More from Fletcher / CEME / Exxon Mobil conference Managing Political Risk 2009.

Question from the audience: what ultimately separates political risk advising firms from general management consulting firms with global reach? Six replies, paraphrased here.

1. Clients ask for cogent, insightful analysis of context for global context.
2. Key regulatory and due diligence requirements.
3. Firms provide certification of due diligence.
4. Strategic advice for how to level the playing field.
5. Attention to the difficult, expensive local information; not what the newspapers say, but what is going on behind closed doors. Early warning and strategic advice regarding corruption and invisible local relationships.
6. Business practices and norms in a new environment.
7. Many firms mentioned the specific leverage that FCPA has over American firms, and any publicly traded in USA.

Big think: political risk

Manging Political Risk 2009

Like any good academic conference the first order of business is to see if we can improve on Wikipedia or Merriam Webster and define terms.

Political Risk

Political risk is a type of risk faced by investors, corporations, and governments. It is a risk that can be understood and managed with proper aforethought and investment…..

Broadly, political risk refers to the complications businesses and governments may face as a result of what are commonly referred to as political decisions—or “any political change that alters the expected outcome and value of a given economic action by changing the probability of achieving business objectives.”[1] . Political risk faced by firms can be defined as “the risk of a strategic, financial, or personnel loss for a firm because of such nonmarket factors as macroeconomic and social policies (fiscal, monetary, trade, investment, industrial, income, labour, and developmental), or events related to political instability (terrorism, riots, coups, civil war, and insurrection).”[2] Portfolio investors may face similar financial losses. Moreover, governments may face complications in their ability to execute diplomatic, military or other initiatives as a result of political risk.

A low level of political risk in a given country does not necessarily correspond to a high degree of political freedom. Indeed, some of the more stable states are also the most authoritarian. Long-term assessments of political risk must account for the danger that a politically oppressive environment is only stable as long as top-down control is maintained and citizens prevented from a free exchange of ideas and goods with the outside world.[3]

Definition 1: Actions of governments that affect the returns to investors.

• In particular expropriation, breach and abrogation of contracts.
• Tax law, trade restrictions.
• But generally not labor, environmental laws.
• Convertibility restrictions yes, but devaluations no.

Definition 2: Failures of governments to act that affect the returns to investors.

• Failure to enforce laws, provide a conducive business environment in line with firm’s expectation at the outset of the contract.

Definition 3: Political events that insurance and other risk management strategies can manage.

Inductive reasoning is a great way to arrive at a definition for what political risk is. There’s slightly more here than the pornography standard (know it when I see it), but it is a reactive, rather than a proactive basis for definition. If the concept has any legs, I’d like to see that we can forecast what risk managers can and ought to do, rather than just an exhaustive catalog of what they have done.

Definition 4: Include grassroots political actors, public opinion in consumer markets with above.

David Hobbs in particular suggests that oil companies need to recognize that both host and home polities must consent to and participate in the oil company’s operations, not merely the specific government counterparty that inks the deal.

More on this in a few minutes.

UPDATE– Ganson:

There are no political risks, only mistaken expectations.

UPDATE–Howell:

Political risk is the probability that an investor will lose money due to factors in a society government or its international environment. risk will vary according to the theory applied to projection and measurement. Risk also varies at different investor levels, i.e., for all foreign investors, for a particular industry, for a particular firm, or for a specific project.

Seems to me that nobody so far has a good answer to Ganson. Losses are often calculated against future cash flows and not only existing assets; and these expectations are contextual, professional documents.

Numbers and Units in Political Risk Analysis

A major global vendor of political risk analytics gave a talk at the Fletcher School today. They rate political risks according to a 5-point scale, with copious documentation of how countries’ political life is compressed down into this one metric. As a colleague noted, nobody uses the political risk metric for anything, because it’s such a vague number. I disagree. At the end of the day, people would much prefer to use a simple, bad heuristic to complex information that doesn’t permit quantitative comparison. Many people will categorize countries on the basis of a 5-point scale largely because of the analyst’s good reputation.

Reputable academics use simple indices in quantitative studies all the time explicitly because someone has already standardized the observations. Social science variables are cost-prohibitive to measure otherwise. This phenomenon is especially true for studies that compare countries’ performance on democracy, corruption, and many other socially defined, abstract categories. The big danger is that, due to competitive business dynamics, the leading provider will define political risk analysis, and that the whole industry will coordinate its expectations and analytic frames around that algorithm.