America Needs a Whole-of-Society Approach to Cybersecurity. ‘Grand Challenges’ Can Help.

In the fifty years since our nation responded to an audacious call to put a man on the moon, we’ve come to idealize not just the achievement itself but how it was achieved—against impossible odds and through force of will and collective action. The term “moonshot” continues to represent the elevation of bold aspirations as a strategy to tackle the toughest, most complex challenges. 

Skeptics may grumble about a “cybersecurity moonshot” metaphor—and, of course, there is no obvious finish line in the mission to protect and secure our IT systems and networks—but this obscures the crucial need for a healthy infusion of optimism and bold, unconventional thinking to tackle the central challenge of our era. Like the National Security Telecommunications Advisory Committee, who proposed the “moonshot" in a November 2018 report, we believe our nation should commit itself to the goal, before this decade is out, of achieving a safe and secure Internet.

In compiling their report, the committee sought the advice of experts outside the cybersecurity community—leaders who empowered diverse groups of stakeholders to tackle big problems in domains such as space, public health and biomedicine. This led to their proposal for a Grand Challenge concept, long used by corporations, nonprofits and even the Pentagon to strategically elevate difficult problems and invite innovation by diverse communities to achieve bold outcomes, not incremental gains.

Within the U.S. Government, the General Services Administration’s Challenge.gov serves as the federal government’s hub of information on existing budgetary authorities and playbooks for launching national challenges that leverage open innovation tools like prizes, crowdsourcing and gamification.

Related: The White House National Cyber Strategy: Continuity with a Hint of Hyperbole

Related: The US Needs an Industrial Policy for Cybersecurity

Related: The US Needs a Cybersecurity Civilian Corps

We believe this well-established Grand Challenge model can be the cornerstone for the next evolution of cybersecurity public-private partnership—complementing well-established technical threat information sharing programs with more intellectually robust, innovative idea-sharing. Indeed, a multi-stakeholder effort on Grand Challenges for cybersecurity is already well underway—with two workshops held at the U.S. Naval and U.S. Air Force Academies earlier this year, tapping into the collective brainpower of nearly one hundred entities from across the cybersecurity ecosystem. 

The Challenge statements are intentionally provocative (Is that really achievable?), clear and broadly resonant (Could the average citizen understand why this is important?) and intrinsically motivating across society (Can this inspire a call to action from experts far beyond the traditional cybersecurity community?). 

A few draft Grand Challenge statements emerged from the group:

• “Empower every American with an 8th-grade level of digital literacy to make safe and secure decisions online by 2025”
• “Eliminate commodity cyber attacks to raise the cost of conducting a successful attack by 100x”
• “Make cybersecurity the premiere national example of how to effectively and responsibly leverage Artificial Intelligence and Machine Automation for the greater societal good”

There is no shortage of complex challenges to tackle in cybersecurity—spanning technology, human behavior, policy, education and more. Hundreds of thousands of people are working diligently and admirably to incrementally chip away at these many aspects. But it has become clear that we need a fundamentally new framework to help us collectively think bigger in pursuit of paradigm-shifting breakthroughs—ones that will make the Internet not just incrementally safer but fundamentally safe, by default.

Launching a series of Grand Challenges for Cybersecurity is one short-term action the U.S. government can take right now, using existing authorities, to empower a broad diversity of expertise towards the long term vision of a safe and secure Internet. 

Many entities—public, private and academic—have distinct roles to play in addressing our shared cybersecurity challenges. In the best historic examples, our government leaders in the White House, federal agencies and Congress have uniquely leveraged their ability to inspire and orient diverse stakeholders towards achieving shared national priorities. They must now do the same as strategic champions for cybersecurity, making clear that securing the Internet is a singular national priority and—like the moon landing—a challenge we must and can collectively overcome.

Related podcast: