202

By Joseph Marks
March 29 at 7:25 AM
THE KEY


President Trump speaks to the media. (Saul Loeb/AFP/Getty Images)

President Trump wants to find a grand solution to the nation’s cybersecurity challenges, one that will allow the nation to stop playing constant defense.

The idea behind his “cybersecurity moonshot” initiative, launched in 2017, was that the country's digital vulnerabilities present as dire a threat as the Soviet Union’s advantage in space did when the Sputnik satellite launched in 1957.

But money talks: While the Trump administration is spending on today’s cybersecurity challenges, it’s not preparing for tomorrow’s.

The president’s budget request last week boosted overall cybersecurity spending by about 5 percent, including a whopping 10 percent hike for military cybersecurity. But most government offices that tackle emerging challenges in cybersecurity would see cuts to their research and development budgets under the plan.

CONTENT FROM AMERICAN PETROLEUM INSTITUTE
"Natural gas is vital to both the environmental and economic sustainable energy future"
   Read More
The biggest cut — an incredible $219 million — is to the Homeland Security Department’s science and technology wing, which does much of the long-range research aimed at making technology fundamentally more secure. That budget, if it’s approved by Congress, would cut the division to slightly less than two-thirds of its 2019 funding.

The committee charged with the moonshot project, meanwhile, recommended in a draft report in November that government, industry and academia surge investments in a broad set of cybersecurity research and development priorities, including research focused on next-generation encryption, artificial intelligence and biometrics.

“If you want to fund a moonshot, you have to fund foundational research and development,” Ari Schwartz, a former senior director for cybersecurity on the National Security Council, told me. Schwartz is now director of cybersecurity services at the law firm Venable.

ADVERTISING

The ultimate victim of the research cuts, which are spread across DHS, the Commerce and Energy departments, and the National Science Foundation, will be the cybersecurity of U.S. companies and citizens, experts told me.

“These are problems that don’t manifest themselves in two to three years, but 10 years down the road,” Bruce Potter, founder of the annual hacker conference ShmooCon, told me.

The problem, in a nutshell, is that the Internet was never designed with security in mind, and all the money government spends on network defense or fighting back against adversaries in cyberspace won’t change that fact. But, new investments in research and development might.

Historically, the pace of cybersecurity developments has lagged behind the pace of technological innovation, said Potter, who is chief information security officer at the cybersecurity firm Expel and was also senior technical adviser to an Obama-era commission focused on improving the nation’s cybersecurity.


Industry is prepped to make major technological advances during the next decade — including connecting myriad more devices to the Internet and conducting more tasks with artificial intelligence and machine learning — which will create many more targets for hackers and increase the amount of damage they can do, Potter said.

And we’ll be in a lot of trouble if security doesn’t catch up with those innovations.

“That’s burned us historically and it’s just going to continue to burn us,” Potter told me.

The Trump budget also proposes a $75 million research budget cut to the Commerce Department’s National Institute of Standards and Technology, which has set basic cybersecurity standards that are followed throughout the world. A new Energy Department cybersecurity office would also see a $13 million research budget cut. And the National Science Foundation would get a $605 million across-the-board research budget cut, though only a portion of that would hit cybersecurity research.


DHS’s cyber operations wing would have its research budget approximately doubled to $31 million under the proposal, but that hardly makes up for the loss elsewhere.

The cuts are part of a trend the past three years in which the Trump administration has recommended cybersecurity research cuts along with increases to cybersecurity operations. But those cuts are typically pared back by Congress.

All of that stands in stark contrast to the moonshot report, in which members of the President’s National Security Telecommunications Advisory Committee predicted “more severe and physically destructive cyberattacks” over the next decade and described the nation’s digital vulnerabilities as “an existential threat to the American people’s fundamental way of life.”

Fixing that problem “will require strong national leadership, political will, and a sustained whole-of-nation investment over an extended period,” the report warned.

In other words: You can’t be the moonshot guys if you don’t want to pay for NASA.