Cyber security, Strategic anticipation and other stories

The Geneva Centre for Security Policy podcast is your gateway to top conversations on international peace and security. It will bring you timely, relevant analysis from across the globe with over 1,000 multi-disciplinary experts speaking at 120 events and 80 courses every year. Click subscribe, download on your favourite podcast player, get notified each time we release our weekly episode.

Podcast Episode 11

Host: Hello, my name is Claire Heffron and welcome to the Geneva Centre for Security Policy podcast on the latest issues, advancing peace, security and international cooperation. We hear the terms “Cyber 9-11” and “Digital Pearl Harbor” but what do policy makers actually do the day after a crisis? The Cyber 9/12 Strategy Challenge is an annual cyber policy competition for students to compete in developing national security policy recommendations, tackling a fictional cyber incident. We had the chance to speak to Chelsey Slack, Deputy Head of the Cyber Defence Unit at NATO. And as the global security environment is changing at a fast pace, actors need to move from spending too much time reacting to more proactively identifying the emerging security issues that may affect them. We spoke to Dr Wendy Schulz, who is the Director at Infinite Futures on issues surrounding international security policy also Dr Bastian Geigrich Director of Defence and Military Analysis at the International Institute for Strategic Studies. 

Host: The Cyber 9/12 Strategy Challenge is a competition to give students an understanding of policy challenges associated with potential cyber conflict. We had the chance to interview Ms Chelsey Slack, Deputy Head of the Cyber Defence Unit at NATO. 

Ms Chelsey Slack: NATO has been on a journey when it comes to developing its approach to cyber defence that includes everything from the capabilities to the policy questions, and the three main pillars you can think of in terms of NATO's mandate in cyber defence: the first has to do with protecting the the assets that we have so protecting the networks, and this is quite a broad footprint, if you like, more than 60 sites, so protecting the information that we have, protecting the networks that we own. That's the first responsibility of NATO when it comes to cyber defence. Second, increasingly, we need to be able to operate in this space, we have operations and missions, cyber space is now recognized as a domain of operations. So in order to continue to do work in this increasingly digital era, we need to be able to ensure that we're able to operate in this space as well. So that's the second aspect. And then the third pillar of work that we do is as a platform of 29 different countries. We help our allies to raise their own national resilience, of course, it remains a national responsibility to decide how to organise cyber defence nationally, what types of strategies you put in place, how you work with partners. But given that we're an Alliance, we try to use it as a platform where Allies can raise their overall level of cyber resilience. So in short, the three main goals protecting what we have, being able to operate in this space and helping our Allies to become as resilient as possible. We initially began recognising the cyber threat in setting up our capabilities, for example, the NATO incident computer incident response capability way back in 2002. But we took very much a technical approach to the issue.

Host: What is your approach when it comes to the future of cyber?

Ms Chelsey Slack: As we've seen various geopolitical developments be it in Estonia, 2007, Georgia 2008, Ukraine 2014, we've seen an evolution in the way that NATO thinks about cyber defence, it's now very much become a political issue that's on the agenda of the North Atlantic Council. And with that, has come important decisions politically, such as, for example, in 2014, the decision to recognise cyber defence as part of NATO's core task of collective defense at the same time to recognise that international law applies in cyber space. There are rules that govern this space, which is very important. We've also been working, as I said, to become more operational in this area by recognising cyberspace as a domain of operations. But we need to be just as effective in cyberspace as we are in the air, on land and at sea, also working to help Allies build their resilience through initiatives such as the Cyber Defence Pledge. So it's been very dynamic. Over the past decade or more, our approach has evolved in a very measured and responsible way in response to some of the incidents that we've seen in the geopolitical events. Now in terms of where it's going, I would say NATO's continuing we recognise that we've made a lot of progress in this area, but there's much more to be done, which is why we're constantly looking at ways to boost our capabilities to ensure that the Alliance can deliver on its core task, for example, of collective defence. We're looking at ways to help Allies enhance the resilience by sharing that best practice what's going on nationally, in the field of education and training, for example, or exercises, how can we help Allies to raise their overall level of cyber defence and third, I would say, continue to look at building partnerships which are essential. We like to say at NATO that cyber is a team sport. And so we've been doing a lot of work to try to develop our relationships with other countries, with other international organisations such as the European Union and with industry and academia. And I think especially, as we're seeing a lot of talk now in terms of where technology is headed, we're doing a lot of work and thinking about innovation about emerging technologies, and how, for the last 70 years, NATO has been preventing conflict and helping to preserve peace, how we remain fit for purpose for the next 70 years, when it comes to the development of technology and keeping up with the pace of innovation. For me, the Strategy Challenge is key. And I know that NATO is very pleased to be a sponsor of this event. And what's so important is that it captures what we deal with in terms of cyber defence on a daily basis. And that is that you have to take incidents, you have to take a situation you have to analyse it. And then you have to make policy recommendations and present that to your decision makers. So what the Strategy Challenge does is it brings that to life if you like, and it involves students and it involves graduates. And in that sense, it helps to train that next generation, which is so important, and not just sitting in a classroom and learning about how to write a policy brief. But really put in front of a group of judges, they're given a scenario and you need to present it. And that's a very practical application of what we do on a daily basis. So that's why I think it makes it unique in that sense. And it also brings together the stakeholders that we work with on a daily basis. So be it from academia, or from industry or from governments or from international organisations like the one I represent. So for me, the Strategy Challenge really has the whole package in that sense, which is why we're really excited to support that initiative. And moving forward that's exactly what we need. We need people who have different backgrounds who can spot issues who can analyse them and package that tailor that in a way then that informs decisions, which is what this field is all about. So I think the Strategy Challenge in particular equips the next generation to deal with those things, let alone the next generation but also for the judges we get quite a lot out of it, because I can tell you I learned quite a bit from them too, and their responses. “That was a great idea and that was a really well done” so once again, it's not just a one way street. In that sense, it's very dynamic. And I think the GCSP and the Atlantic Council, do a great job in making sure that there's that two way street.

Course Advertisement: Crisis Management: Navigating the Storm, Singapore 2021

How will you know when you are in a crisis, and what you're going to do to ride the storm? Many organisations will face a crisis in today's complex and volatile environment. Leaders need to understand the characteristics of a crisis and what they can do to protect themselves and their organisations to survive. I am David Horobin, I am the GCSP’s Course Director for Crisis Management: Navigating the Storm at the Geneva Centre for Security Policy, we are acutely aware of the challenges facing leaders when confronted with a crisis that may severely impact an organisation. Together, we examine the anatomy of crises events, discuss contemporary methodologies and tools to improve resilience and enhance preparedness. Using carefully designed simulations, we help you develop the skills and trust needed to face any crisis. We can help you develop your awareness of leadership style, to assess and then mitigate the threat and risks for any crisis. We have proven tools and techniques designed by experts in their field that you can apply to your crisis preparedness and reduce the fear you may have when faced with a catastrophic event. Come and test your crisis skills and assess what you need to change it in your organisation, understand how other experts do things and get inspired to better protect your future.

Host: We must take a forward looking approach to issues surrounding international security policy amongst its wide group of stakeholders to support more effective strategic planning, and better decision making today. We spoke to Dr Wendy Schulz, Director at Infinite Futures. She shared with us her thoughts on strategic foresight. What is the main focus on futures?

Dr Wendy Schulz: Well, I would say that the underlying key futures principle is to think differently about the future, to think in terms of multiple possible futures. And to think also about what you really want for the future, what you'd prefer as a future and that whatever actual future we end up in is going to be a dialogue between the possibilities and our preferences. So the image of the future, the stories we tell about the future, and that balance or tension between what's possible, the what if, and what we want, the what do I value is really key and features.

Host: Why should we study future methods?

Dr Wendy Schulz: It’s interesting as a discipline because of course, unlike other disciplines, we can't actually go study the future. I can't transport myself into the future and be a good observant researcher. So many of our other scholarly colleagues laugh at us and say we can't be disciplined because we can't actually observe and collect facts or in short, there are no future facts. So what we can do, first of all, is ask people what their images of the future are and look at images the future that are out there in culture and compare those we can create exploratory, as I said, images of the future so the trick about futures methods is that they have to be rigorous in terms of collecting data on the changes that have happened in the past and that are happening in the present that we can observe.

Host: What is your experience with the GCSP?

Dr Wendy Schulz: What is fantastic about the courses here is that they bring in students from a wide variety of professional disciplines who are all managing different responsibilities, engaging at different levels of leadership of strategic thinking. They are from countries all across the world. So you have both professional diversity and actual cultural diversity. And they're all here eager to acquire new tools and to practice with them and to learn from each other. So you have a lot of intellectual and creative strengths in the room. And at the same time, because people are working together on both in both discussions and in applied examples of some of the tools that GCSP teaches. They're also forming bonds and so they're creating a professional network that they can carry forward, moving out of any particular course that they're taking here and it's intellectually enriching, it's very creative and it's a lot of fun.

Host: Organisations must be prepared for a variety of possible threats in today's world and ready to take advantage of opportunities, both of which may appear in different forms than in the past, and which will call for more varied responses. We discuss strategic foresight and analysis with D. Bastian Geigrich, the Director of Defence and Military Analysis at the International Institute for Strategic Studies.

Dr Bastian Geigrich: I think in the policy environment where foresight really comes in is to help people think about plausible future developments before they occur. So it is meant to create the mental space and the knowledge to prepare for future contingencies. And in that way, prepare yourself for the future. It’s not meant to be a prediction. It's not about knowing what will happen, it is about preparing for different contingencies and for different futures that are out there.

Host: What role can it play in strengthening policy?

Dr Bastian Geigrich: I think it can help inform decisions, it is not a tool to, on its own perhaps, justify certain spending decisions and so on so forth. But it helps people get orientation in an age of uncertainty. It is meant to manage uncertainty. It helps in a policy environment to clarify goals, to define strategies to reach these goals and from that derive decision relevant insights that then can be taken forward to inform strategy processes to inform approaches to different markets, if you're in the private sector or in the more policy oriented setting, it might help you clarify your level of ambition in a particular policy sector. So that's really where it helps. And think about foresight not as an event, but as a process as something that you seek to do. Again, and again, as you move through time. It's not a one off thing as only useful actually, if you keep doing it. If you want that to be successful, I would argue, you would really need to invest in a specific module in your project that works on implications. So what you're trying to do is, through foresight, project your yourself forward, whatever the time horizon is that you interested in 10 years, 15 years, something like that, but then you cast your eye back to what are the decisions that now need to be taken in order to prepare for a variety of future so you design implications that matter now, that's how you get attention. You also probably should invest some time in defining indicators that enable decision makers to see whether developments are moving in the direction that you thought about or are they taking a turn in a different direction. That's important to know. And that shows how foresight helps if it is done as a process. And if you do these things, you also ensure that a project doesn't just end with a report or a workshop, but it generates a dynamic that actually helps the organisation well beyond those initial steps. 

Host: Well that’s all for today’s podcast with the GCSP. Thanks for listening and thank you Chesley Slack for joining us along with Dr Bastian Geigrich and Dr Wendy Schulz. Join us again next week to hear all the latest insights on the latest in international peace and security. Bye for now!