Transcripts For CSPAN Sony Cyberattack Implications 20150118

. We fall into the mess. Unelected bureaucrats shouldnt write laws. Who are they working for . All the bureaucracy of Government Works for the president. We have abdicated our role as congress. The regulations are 20,000 pages. So much of it is being done without our knowledge. There is a debate over defunding the immigration executive order. I am for that and about 1000 other things on every bill. People say you were trying to tie the hands of the president. Thats our job. I dont care if its a republican president. The power of the purse, that is instructions. As a consequence, they do many things that we didnt intend to. I think that regulations that are written and very expensive optic comeback. Jim was a lead sponsor of an act when he was in the senate. It says that any regulation written by a branch of government that is expensive have to come back and be voted on it to become law by the congress. That would reassert our authority and the balance of powers. Your father was one of the big founders of the libertarian party. Are you for regulations and a constitutional way rather than just more red tape . I will give you an example of that. We passed the law, the clean water act its as no one can discharge pollutants into a stream. I would vote for that. If you have a company and you are dumping benzene in the ohio river, you should be in prison for doing that. I am for that regulation. That is a federal government regulation. That was passed in the 1970s. Over time, they have defined dirt as a pollutant and your backyard is a stream. We spend 100 million policing private property. We do so much to harass private property owners. We forgotten the things we should be doing. There is a role for government in communal property. Weve gone way too far to individuals. Ken lucas but clean dirt on his own land to raise the elevation in mississippi. He has been in prison for 10 years. He was 70 when he went to jail. That is a crime. Whoever put him in jail is the one who really ought to be in jail. One more question. Do you agree . I have mixed feelings. You are talking about the authority that is given for the trade agreements. The trade Promotion Authority there is an argument to be made on the separation of powers that i given this authority to the president that you have taken power that should be congresses. These are really treaties and they should be done is treaties and they are not. Im a big believer in free trade. I think free trade is a good thing. There have been libertarians who voted against some of the trade deals because they felt like they gave up sovereign entity to international bodies. Like a lot of things i outweigh the good and the bad. I think the good of trade has caused me to vote for things that i think are not perfect. The perfect way is we would lessen our trade barriers and do that through the congress. I think what we have been offered to vote on is not that. Trade has helped people. It helps the poorest among us. The average person who shops in a walmart saves 800 year because of free trade. Lets thank senator rand paul. [applause] next, a look at the impact of the sony Cyber Attacks. At 7 00, your calls and questions on washington journal. We are featuring all day programming on book tv and American History tv. Monday morning cornell west on a six revolutionary africanamerican leaders and their impacts on their own generation. Sandy fair editor on her life in journalism. Vanity fair editor on her life in journalism. On American History tv, what he did jones abernathy on her experience in the civil rights movement. Historians talk about the history of Race Relations in a ferguson, missouri. Find our complete Television Schedule at www. Cspan. Org. The us know what you think about the programs you are watching. You can email us at cspan. Org. You can join the conversation. Like us on facebook. Follow us on twitter. The deadline for the student cam video competition is tuesday. Get your entries completed. Produce a documentary on the three branches. For your chance to win a 5,000, go to student cam. Org. Speakers included mike rogers. This is an hour and 25 minutes. Thank you for coming this afternoon to our event on the sony cyber attack and its strategic implications. Almost four years ago, i had the pleasure to work with general hayden and some others to put on cyber shockwave, which i dont know if any of you remember. You can get a dvd or buy it on youtube. The idea was to simulate a cyber attack at the National Security Council Cabinet level and see how the United States would react, and see if we had the policies in place to actually be able to, if not prevent, than to react in a reasonable way to a cyber attack. One particular exchange that stuck in my mind when we did the simulation, the person playing the attorney general at the time said mr. President , we dont have the authority to do what youre looking to do, which at the time was to turn off peoples cell phones that had been infected with malware. And stewart baker, who is always selling his book, which is a great book if you havent read it, who was playing the white house cyber czar, founded the desk and said if the attorney general doesnt have the authority he should actually go and find the authority. I am not sure we have found the authority. But something has changed in the conversation we have been having this last week. New proposals suggest that perhaps we have turned a corner and are finally going to see some policy and legal changes when it comes to Cyber Security. Its interesting. I know that in trying to move the needle, we put a show on about a cyber attack but it took a cyber attack on a show to get things to start changing. To figure out what the impatiens are and to look at some of the controversy around the way the u. S. Government specifically has reacted, whether it is a question of attribution, a question of severity, we have an excellent panel today. To lead that discussion if you follow Cyber Security, you have surely read her articles, as i have. She knows more about cyber issues than probably 95 of the policymakers in washington. Maybe 96 . Thank you very much, and thanks to the Bipartisan Policy Center for putting on a very timely panel. The panelists dont need much introduction and you all have their bios, so i will keep it brief. He was the chairman of the house intelligence committee. He is now a radio talkshow host doing commentary on important issues of the day on something to think about with mike rogers on westwood one. A retired air force general, former cia director, and as a director, director of national intelligence, history major and now principal at the chertoff group, he is now writing a book about his career. Then we have dr. Paul stockton the former assistant secretary of Homeland Defense at the pentagon. He helped lead the departments response to Superstorm Sandy and the deepwater horizon crisis. He guided the Critical Infrastructure Protection Program and is a managing director at an llc. I want to open by saying that we at the Washington Post have a Cyber Security summit every year. For a couple of years, we created our own war games which we came up with fictitious oil and Gas Companies and banking firms that were attacked by fictitious middle eastern and Asian Countries sending viruses to cause Oil Disruption and create chaos in the economy. But never did across our minds to have north korea target a hollywood movie studio for a film about a cia plot to assassinate kim jongun. Did the koreans want brad pitt to play kim . What were they angry about . I thought it was funny. Thank you. Seriously, we have had countless intrusions into the u. S. Critical infrastructure and companies dealing with intellectual property saying this is the biggest transfer of wealth in history. We have seen penetrations into the white house and pentagon but it took a hack into sony for the government to come up with a firm response, unprecedented really. And to actually name north korea. Obama named north korea, and vowed to punish the country. So, we are going to go over the attack and the implications. Briefly, what happened at sony. You are all familiar with this. Just before things giving, sony discovered viruses in the system. Then the guardians of peace, as they were called, began posting embarrassing emails online, showing executives making racially insensitive remarks. That started to get a lot of attention and become a problem for sony. About mid december, the hackers ratcheted up and put a threatening message online threatening violence against theaters that showed the film and alluded to 9 11. At that point, theaters get nervous. They talk about not wanting to show the film. Sony decides they have to cancel the planned release for christmas day, and that leads to a huge controversy. The very next day, president obama convenes a meeting in the situation room with his National Security council. They decide, based on unanimous recommendations, that they are going to publicly name north korea, give attribution, say north korea was behind it and we are going to take a proportional response. So, that is the scenario. I want to turn to you, chairman rogers. How do you view the attack and do you think the president made the right call in naming north korea . You forgot to add that i decided to take four days off and i spent three of it on a beach dealing with this issue, so no one is angrier about it than me and my wife. This marks a significant change. We have seen Cyber Attacks before, clearly. We have seen denial of service attacks before. We have never seen a nationstate use its capability albeit somewhat limited in a way that actually destroy data. So, they went in to a company, and not only did they play the fun and games part, cause embarrassing pr problems, all of which was significant. They destroy data. They destroyed intellectual property that made it very difficult for sony to operate. There was a time when it was very concerning as to whether they would be able to function as a business. It was more than a little disruptive. It was on the verge of economic calamity for a company like sony. That was a very different game. We have seen other countries do it. We have seen iran do it to saudi arabia. But for a nation to decide it was going to have an impact in america by attacking an individual company, we have never quite seen that before. This is a whole new day in cyberspace for a host of reasons. Now the United States is going to have to show that it will not tolerate it because everyone is watching. Iran is watching. Russia is watching. China is watching. Every International Criminal organization is watching. These are the steps we are going to have to work through as a country. Naming them, i thought was an important thing. There are other things we need to do to move ahead and it needs to be smart. If we are talking about this six months from now, we will have made a serious mistake. Sony is not a Critical Infrastructure company. It is a hollywood studio. It doesnt fall into the Critical Infrastructure categories of oil, gas, banking. General hayden, take us into the situation room. How would you have assessed the attack and what would your advice have been . First of all, this was an arc that was predictable and i dont think any of us were surprised. This was going to happen. It happened then to these actors. Its all a continuum and a very protectable continuum. This is a nationstate attacking an american business. Loss of profit is a big deal and a relatively new deal. Thats one. The second point is yes, north korea did do this. I am quite comfortable with the government assessment and i am glad that the president said that. I would probably have tried to strike the word per portion all. I dont think we should give them comfort that the response would be proportional. I think it should be a response of our choosing. The president did say at a time and place of our choosing, but i think a word proportional gave them too much comfort. North korea is a nationstate doing destructive things, not for profit, but to coerce. These are all new flavors. And then finally, i am going to take responsibility for this because i have 39 years in government, our government is kind of feckless and our response. We are going to get around to our usual effort here, which is to beat up the victim. We will get to that directly and sony will have to answer a whole bunch of questions. So, you were surprised that the government came out and gave attribution . I was pleased. I would have struck proportional. This has implications beyond cyber stuff. This is a pathological little gangster state that wants to hold at risk Different Things of value to different people in the world and we have allowed them to take their game into a different domain. If i could just for a moment again, not particularly cyber related north Korean Foreign policy has been kind of like the instructions on your shampoo bottle, provoke, accept concessions, repeat. Provoke, accept concessions, repeat. But it has not been along a stable line. It has been along this line. They have taught us to tolerate ever more provocative actions. I really wouldve fought to get the word proportional out of the talking points. I agree with what you said about this being a game changer. The game changer in another way as well, and that is, we know now that a nation with. 001 of the u. S. Gdp has weapons they can use to launch an effective attack against the United States. Thats very different from seizing control of the power grid or the natural gas system. Nevertheless, we have had a wakeup call here. The trend is one way and that is toward nations acquiring increasingly sophisticated Cyber Weapons, increasingly destructive, and a growing number of nations being able to acquire these weapons. I am going to disagree with my old friend general hayden for just a moment here. I think it is terrific that the president has emphasized the importance of proportionality. We are in an era now where cyber conflict is burgeoning and we lack the rules of the road derived from armed conflict. We have to begin to think about this in a new era. I think proportionality is a standard the United States ought to be espousing. I think we need to be standing up the laws of conflict in the cyber realm that are going to be good for the United States and good for security in the long haul. I believe proportionality is an important principle, and that the legitimate military objective doesnt cause disproportionate suffering in the civilian population. We can imagine how an attack on a power plant might affect the nearby military facility, but if that attack creates mass civilian casualties, as it could, if it is an attack on a hospital, those are not legitimate plans of attack in a cyber conflict. People often get up in debates about what is an act of war. What this attacker had showed in a sense is that even ask that fall below an act of war can have significant impact, National Security issues, and cause a u. S. Government response. Do you think this is a teachable moment in that regard and that maybe, to your point of creating norms, are we working toward articulating clearer norms about what is acceptable behavior in the realm of cyberspace . I think we know what is unacceptable. The problem is, we wrestled with this for years. What is the appropriate response . I mean its hard. I think youre both right and i am not even in congress anymore, so thats hard for me to say. I think the general is trying to say that you dont want to advertise what we do believe we have the right to do in a case when a nationstate attacks a u. S. Company. Thats what i thought i heard you say, and i think thats exactly right. I think the debate has to happen on what exactly are appropriate responses. We had this argument ad infinitum behind closed doors. How much authority do you did of our capable ready cyber forces who are ready to go . They were ready to go on a sony case. They were absolutely ready to go, just waiting for the right instruction. And we never got to what the right instruction was, which i think is why we find ourselves where we are. You have to establish your defenses first. If we dont have some way for the government to at least assist the private sector in protecting their networks, it makes very little sense to try to create offensive trouble anywhere. They are not going to go after Government Works. They are going to go after private companies. That is a small case of what we see with sony. You start multiplying that with companies that are in the supply chain of Critical Infrastructure and you dont even have to go after Critical Infrastructure. You can go after the supply chain. Now you have a whole other discussion. You can understand how layered this problem is and why we are not ready. I argue to dig in, put on the helmet, strap it on, and then we can have a conversation about how to move forward. Do you think if the theaters and sony had not canceled the release of the film, would you still have advocated public naming of the state responsible, north korea, and then taking some sort of response in response to the destructive action alone . I would have. You saw the congressman kind of dance around iranians did massive denials of attacks on banks. You cannot find someone currently in government to say the iranians did that, but they did. I think that gets wrapped around a whole lot of macro, political right. Now that i have said it, we can move on. I was heartened that we said what we said about north korea. Of course, the principles of proportionality, distinction and necessity apply at the tacti