From tinkering with an old Amiga computer in college to prosecuting one of the first computer hacking cases in the country, Chris Painter’s life has always revolved around computers and technology.
Painter has even adorned his office walls with posters from science fiction movies that involve hackers on the run, espionage and computers taking over the world. He said the posters “highlight for visiting diplomats and industry leaders the popular misperceptions of computers.”
In real life, he plays the leading role in implementing the United States’ International Strategy for Cyberspace, a task that most people would find formidable but one that Painter finds exciting.
__________________________________________________
This article originally appeared in the latest edition of CGI Initiative for Collaborative Government‘s Leadership journal. For more news and insights on innovations at work in government, please sign up for the AOL Gov newsletter. For the quickest updates, follow us on Twitter @AOLgov.
________________________________________________
“This is not a subject for governments alone, but will require close collaboration with the private sector.”
As the first coordinator for cyber issues at the State Department, Painter is on the global stage partnering with other countries to create a more secure, reliable and open Internet. His focus encompasses the security of mobile devices, which are being used more and more around the world and are just as susceptible to attack as more traditional computers, Painter said.
“It’s an international problem that will require international collaboration among governments and other stakeholders,” he said.
It’s an international problem that will require international collaboration among governments and other stakeholders.” – Chris Painter
Painter’s current role is a natural progression in a professional journey that started 20 years ago as a federal prosecutor tackling some of the earliest cybersecurity cases.
Back then, cybersecurity “really didn’t get any kind of higher policy attention,” Painter said. “Cyber crime did to some extent. Law enforcement, in many ways, was a bit ahead of the curve because they were facing actual intrusions, but even they hadn’t organized around it.”
Times have changed. Now, cybersecurity is a priority for people at the highest levels of government, particularly as new mobile technology makes it easier to connect with the world. Painter’s boss, Secretary of State Hillary Rodham Clinton, has said it is a foreign policy imperative to ensure a free and open Internet and the international community needs to have a serious conversation about the principles that will guide us in maintaining an Internet that benefits the world.
Painter is uniquely qualified to facilitate that conversation because his career has mirrored the rise in prominence of the Internet and the now global implications of cybersecurity. From his work prosecuting famous computer hacker Kevin Mitnick and other cyber criminals to his role at the White House as senior director for cybersecurity policy, Painter has been one of the United States’ lead actors in a real-life cybersecurity thriller.
Before he left the White House to join the State Department, he helped develop the International Strategy for Cyberspace. Although it started as the “creative cacophony” of 18 agencies in a room, all voicing their perspectives on cyberspace issues, over the course of a year and half, it coalesced into a unified framework for all cyber issues, including cybersecurity, Painter said. “Everyone had great ideas, but they weren’t meshed up. Putting this under one strategic framework was important and a huge accomplishment and something no other country had done.”
The experience broadened his view of the issues. “One of the things I recognized as we were writing this international strategy is you can’t look at cybersecurity in these narrow silos,” Painter said.
“Cybersecurity is critically important, but if you don’t look at it in the broader context, it will always be seen as a niche issue and a technical issue. It will always be seen as a cost, and people won’t understand the benefit.”
Eye on Mobile Security
Many countries have already reacted favorably to the International Strategy for Cyberspace, a 25-page document that “outlines not only a vision for the future of cyberspace but an agenda for realizing it,” as President Barack Obama said.
Although it is a U.S. strategy, it’s meant for the world. Painter said the United States wants to expand the dialogue beyond its traditional allies to those in the developing world, where many people, especially those in poor and rural areas, missed the personal computer stage and went straight to mobile phones. From 2005 to 2010, cell phone use tripled in the developing world to nearly 4 billion mobile subscriptions, according to the International Telecommunication Union. And many of those people are using the phones to access the Internet.
So naturally the International Strategy for Cyberspace will accommodate the growing use of mobile technology. “It took us a long time even in this country to care about these issues, and there is still a lot of work to be done,” Painter said. “Developing countries can learn from what we did right and also from our mistakes.”
It has only been in the past few years that the United States “has realized at a senior level that security is important to enable all the positive economic and social benefits that new technologies afford,” Painter said. “As other governments, particularly in the developing world, are facing some of these issues for the first time, they have an opportunity to approach this problem from a holistic standpoint and make sure that innovation and social growth are empowered by more secure systems.”
With that in mind, in July the State Department partnered with the Justice and Homeland Security departments and the government of Kenya to host a seminar in Kenya for five east African countries on issues related to cyber crime, cybersecurity and Internet freedom.
As part of that effort, Painter has traveled to Kenya twice in the past few months and has seen firsthand how mobile use is evolving in that part of Africa. For instance, Kenya has an innovative payment system that allows people to pay bills and make purchases by transferring money electronically via their cell phones. It’s akin to swiping a credit card, but it’s revolutionary for people who might never have had a bank account before.
“It’s not just large countries that get innovative and profit from this,” Painter said. “This is the wave of the future.”
Given the growth and penetration of mobile devices and mobile broadband, security is as important as it is in the desktop PC world, Painter said. “Those platforms are just as susceptible to compromise and attack. This is not a subject for governments alone but will require close collaboration with the private sector so, to the maximum extent possible, security can be baked in instead of added later.”
On the Case
Painter has always had an interest in computers and is a self-professed early adopter of technology. As an undergraduate at Cornell University, he studied literature, political science and biology. He bal¬anced reading James Joyce, programming Fortran, and studying differential equations and chemistry.
After he earned a law degree from Stanford University, he went to work at the Ninth U.S. Circuit Court in Seattle as a law clerk for Judge Betty Fletcher, who he said has been at the forefront of many cyber issues. He later worked at law firm Arnold and Porter in Washington, D.C., where he handled technology, cable television and satellite issues.
In 1991, he moved to Los Angeles to work as a federal prosecutor. As an assistant U.S. attorney, “you get fascinating cases like people robbing banks with their name tags on – not the smartest criminals,” he said with a laugh. “But at the same, there were some high-tech cases going on, which I gravitated to. Frankly, there weren’t a whole lot of people who understood or cared or wanted to get involved in that.”
“We could find opportunities to work together with other nations to realize a positive vision of cyberspace.”
In one of the first hacking cases to gain wide¬spread media attention, Painter helped track down and prosecute Kevin Mitnick, who had hacked into the networks of major technology companies and Pacific Bell’s voice mail computers, among other crimes. Mitnick eluded capture for two-and-a-half years until he was finally arrested in North Carolina in 1995 and eventually confessed to wire fraud and computer fraud as part of a plea deal.
Painter said what he learned from the Mitnick case is that “there is no shortage of individuals and groups who would seek to exploit vulnerabilities in our broadband and mobile systems. That requires unprecedented coordination and international cooperation to address those threats.”
He also helped prosecute the first Internet stock manipulation case in which an individual created a fake Bloomberg page with false tips that a company was about to be sold, causing the stock to rise by 30 percent. In 2000, when distributed denial-of-service attacks took down Yahoo, eBay, Buy.com and other sites, the case, which Painter also worked on, captured public attention because people were becoming more dependent on computers.
“You still had this dichotomy of people thinking, ‘This is kind of cool,'” Painter said. “They didn’t really see how it harms them, so it’s not like it is today.”
The attacks were traced to a teenager in Canada, which meant working with authorities on the other side of the border to apprehend the culprit.
The international aspects of the case sent Painter down a new path professionally. From Los Angeles, he was working closely with the chief of the Computer Crime and Intellectual Property Section and others at the Justice Department, Painter said. “Then I decided to come back to the ‘mother ship’ at Justice and help run that section for a number of years and get more involved in the international activities there.”
As part of those activities, since 2002, Painter has chaired the G8 High-Tech Crime Subgroup, where he has worked with dozens of foreign governments.
After a stint as deputy assistant director of the FBI’s Cyber Division, Painter served in the White House as senior director for cybersecurity policy on the National Security Staff. During his two years at the White House, he was also acting cybersecurity coordinator before Howard Schmidt was named to the post and was a senior member of the team that conducted the Cyberspace Policy Review that Obama commissioned shortly after he took office.
At a Cyber Crossroads
In February 2011, Clinton hired Painter to create and lead the new Office of the Coordinator for Cyber Issues at the State Department, where a key part of his job is changing the perception of cybersecurity and other cyber issues from purely technological to mainstream policy issues.
“The key to convincing senior leaders to invest in cybersecurity is weaving it into the broader context of a business or the government,” Painter said. “This isn’t something that should be discussed in the dark techno-corners, it’s something that should be discussed across the board. My office is deliberately supposed to look at the whole suite of cyberspace issues so we can realize a positive vision of cyberspace – for which cybersecurity is one supporting part.”
Painter added that we are at a crossroads where we must choose how to deal with the darker side of cyberspace. “The question is: Are we going to have an Internet that is open, secure and reliable that will enable growth or will we have something different?” Painter said.
“The things you are trying to enable are social growth, Internet freedom, open communication, and economic innovation and growth,” he added. But for those efforts to succeed, people must feel secure when communicating or conducting business in cyberspace. In other words, they must feel safe from crime and intrusions into their privacy.
“We have to balance usability with security of systems,” he said. “If you have security that is so overwhelming you can’t use the systems, they’re worthless to you. If usability is king and you never think about security, then in the long run, that usability is going to be undermined.”
He emphasizes that technology can have a transformative effect and a natural evolution that countries shouldn’t stymie. “It could lead not only to democratization and social growth, but also to economic growth and innovation.” Nevertheless, “we have to be cautious as we go forward. There are some states that find that openness threatening.” Working with those countries will require patient, persistent diplomacy, he said.
Widening the Aperture
To achieve the international strategy’s vision, collaboration among government, industry and non-governmental organizations is vital, Painter said.
“Governments have to develop a culture of working with industry,” he said. “It’s second nature in the U.S., but it’s not the case in the rest of the world. You really need that. It’s not just one group of actors that will control this.”
The U.S. has worked collaboratively in multiple areas to enhance cooperation on international law enforcement and to combat cyber crime. One example is in the Organisation for Economic Co-operation and Development’s principles for Internet policy-making, which “reflected the input of governments, the private sector and civil society, and as a result was a far more inclusive and stronger document,” Painter said.
It is also important to bring the technical and policy communities together – two groups that are not necessarily used to dealing with each other.
Painter said that when DHS drafted its National Cyber Incident Response Plan in 2009 to establish a comprehensive approach to natural and man-made disasters, it was built from the beginning with private-sector involvement. “It was a much more in¬clusive process,” Painter said. “That changed the dynamic where people felt like they had a stake in it.”
Fortunately, the increased focus on cybersecurity has prompted agencies to get together more often, Painter said. “The fact that there are frequent discussions at a high level with various interagency aspects to them means that people are more comfortable with each other,” he said. “Communication between agencies and coordination between agencies is far better than they have ever been.”
At the State Department, Painter’s office formed a cyber coordination group whose members come from all over the department and have experience working with countries all over the world. That shared expertise is invaluable in broadening awareness of the sweep of issues that cybersecurity affects. When the International Strategy for Cyberspace was released in May, Painter sent a cable to State Department posts worldwide asking that posts talk to their host governments and identify the officials who were tracking cyber issues in those countries so that cyber points of contact could be designated.
“Through this engagement, we could find opportunities to work together with other nations to realize a positive vision of cyberspace – an open, interoperable, secure, and reliable information and communications global infrastructure,” he said.
“We’re trying to work with other governments to see what we can do together,” Painter said “We need to be smarter about the way we organize. Many stakeholder groups are doing good work but not coordinating it. By working together, we can amplify each other’s message.”
That’s especially important in these times of economic uncertainty. Everyone is facing limited resources, which means we need to prioritize, find creative solutions, partner with other government agencies and share information better, Painter said. In short, financial constraints are forcing agencies and countries to collaborate more. “That’s ultimately the right solution anyway, so it’s good people are being driven that way,” Painter said.
His experience working with people from all over the State Department, the government and the world has been “a widening of the aperture in my career,” Painter said. “I feel very lucky to be here at the State Department and to have that expanding view, and there is some benefit to having done this as long as I have because I can look back and say, ‘Here is how things have changed.'”
“Not that we’re close to being finished,” he added. “We still have work to do.”
Now it’s up to Painter and his team to help achieve the long-term goal of what the Internet and cyberspace will look like, and playing a leading role in the challenge suits him just fine. “I am far happier to be in a position where I can engage in this now than to be on the outside looking in,” he said.