We’re in a global cyberwar in which our corporate secrets are our chief prize. Are we up for the fight?  To get a clearer answer, The Wall Street Journal’s John Bussey spoke with Gen. Michael Hayden, principal of Chertoff Group and former director of the Central Intelligence Agency and National Security Agency. Here are edited excerpts of the discussion.  MR. BUSSEY: We got some news last month. There’s some legislation meant to increase cooperation between the government and business. Tell us about the bill and whether or not it helps CIOs protect corporate secrets.  GEN. HAYDEN: We’re talking about CISA, the Cybersecurity Information Sharing Act. Good news, a step in the right direction. But it’s too long in coming, it’s too small a step. And it reveals that within any realistic planning horizon, you are largely responsible for your own defense in the cyber domain.  The government, our government will be permanently late for your cybersecurity. Look, your armed forces view cyber as a domain. Land, sea, air, space, cyber. It’s a new domain. You and I have decided that this domain is so wonderful, empowering, we’re going to take things we used to keep down here in a safe, in a drawer, in a wallet, and put it up here where it’s largely undefended. This is the largest ungoverned space in recorded human history. There is no rule of law up here.  As taxpayers, you and I are going to want our government to defend us up here the way we have become accustomed to relying on the government for defending us down here. But there’s the general sclerosis of government, and the technology is going to move much faster than any government can move. Then we have not yet decided what it is we want or what it is we will allow the government to keep us safe. You’re going to have to be responsible for your safety [in the cyber domain] in a way in which you have not been required to be responsible for your safety [in the physical domain] since the closing of the American frontier in 1890.  MR. BUSSEY: It does seem that before the war on cybersecurity can be fought as a nation, we have to resolve the civil war internally over privacy.  GEN. HAYDEN: Yeah. And that’s a multigenerational thing. We haven’t arrived at a national consensus. In the American system, when the government doesn’t show up, we generally pick up the burden ourselves. So, the good news is there’s a lot of private-sector activity designed to keep us safe.  Let me explain this another way. When I think about a national-security problem, generally my instincts are the government is the prime mover. If you’re into Civil War history, Gen. Grant or Gen. Lee says, “You, sir, your corps is the main body. And you, gentlemen, you will conform your movements to the movements of the main body.” In government, I assumed that in cyberdefense, the main body was the government, and you shall conform your movements with the movements of the main body. In the cyber domain, you are the main body. What our government has to teach itself is that the government needs, in all but a few exceptional cases, to conform its movements to the movements of the main body, you.  MR. BUSSEY: One of the things that the private sector is doing is to look again at encryption.  GEN. HAYDEN: The issue here is end-to-end unbreakable encryption, should American firms be allowed to create such a thing. You’ve got Jim Comey, the director of the FBI, saying, “I am really going to suffer if I can’t read Tony Soprano’s email or if I’ve got to ask Tony for the PIN number before I get to read Tony’s emails.” I get it. There is an unarguable downside to unbreakable encryption. On the other side is the question: On balance, is America more or less secure with unbreakable end-to-end encryption, regardless of whether Jim can read Tony’s emails?  I think Jim Comey’s wrong. Jim’s logic is based on the belief that he remains the main body and you should accommodate your movements to the movements of him, which is the main body. And I’m telling you, with regard to the cyber domain, he’s not. You are.  MR. BUSSEY: Tell us how the landscape of threat is evolving or changing.  GEN. HAYDEN: The stealing-your-data stuff is there, and it’s getting worse. Beyond that, [people are trying] not just to steal data, but to create effects. So you’ve got Stuxnet, which is the destruction of a thousand centrifuges at Natanz in Iran. I view it as an unalloyed good, but it was done using a weapon comprised of ones and zeros to create physical destruction.  Leon Panetta spent a lot of time in his last year or two in government talking about cyber Pearl Harbor, digital 9/11, catastrophic attack. I don’t think that’s what we have to worry about. I’m not frightened about the Chinese turning out all the lights east of the Mississippi. I’m not worried about that superpower, catastrophic attack.  I’m worried about the isolated, nothing to lose, “Ah, what the hell? Let’s go see what happens,” nation state who goes after a North American enterprise to create physical destruction to show that they can. The Sony attack is the poster child for that.
Former head of the CIA and NSA Gen. Michael Hayden says government moves to protect cyberspace are too little, too late