Feedback to Exploring Cyber International Relations: MIT-Harvard Minerva Team

DRAFT

ECIR Research Team Response to ONR Review Committee Report on:

“Feedback to Exploring Cyber International Relations:

MIT-Harvard Minerva Team”

Introduction

Thank you to the reviewers for the helpful and insightful feedback. Below we have addressed specific issue areas as requested. This Report is in three parts.

Part 1 presents our overall action planbased on the feedback as a whole. This includes a series of initiatives to improve overall management, research coordination, reporting, and institutional collaboration.

Part 2 puts forth the Track-specific replies to the questions that have been raised.

Part 3 responds to programmatic issues.

PART I: Action Plan in Response to the Review Committee Concerns

We have initiated a process through which we can respond more effectively to Review Committee concerns. The six items below span our current response strategy. We view this as an ongoing process, not as a one time activity.

1. New ECIR Mechanisms

We would first like to highlight specific new mechanisms that we believe address expressed concerns. These include:

• Strengthen the ECIRinterdisciplinary strategy to focus on year 2 research, includinga monthly team meeting (based around individual seminar presentations) to improve collection and dissemination of interdisciplinary work.

• Launch of a new “Student CoordinationCouncil” to promote student involvement, student-focused project collaboration mechanisms (such as a student seminar series), reporting of student participation, and overall education objectives.

• Establish new communication and outreach strategy, including (a) a new ECIR website, which includes working papers and seminar calendar, and (b) new group wiki to better promote communication and documentation (particularly around consensus of “definitions” and working concepts.)

• Refinemonthly reporting procedures to better internally capture and externally communicate research activities.

Overall, we have refocused on improved mechanisms to communicateprogress and output as itoccurs and reorganize to more effectively to promote research objectives.

2. Interdisciplinary Interactions

In Year Two, we look to increase interdisciplinary and inter-track collaboration by building on the groundwork of year one (including the Harvard seminar, specific research lines such as the Clark/Choucri collaboration, and the System Dynamics research) via several additional mechanisms, such as will increase the role of students as “bridges,” as suggested, a new monthly team meeting, and increasing the priority of documenting these interdisciplinary interactions as they occur.

Many investigators have been influenced by findings, data, and discussion by other collaborators, and we have redone our internal monthly reporting mechanism to better document and report this information. We recognize that the Year One Report did not fully reflect the interdisciplinary research that did occur.

We also want to briefly note the difference between interdisciplinary research within tracks, which we believe was a notable success for four of the five tracks of Year One, and research linkages across tracks, which we hope to improve in Year Two and beyond.

As a brief case of Year One interdisciplinary research, we would like to highlight the collaboration between Nazli Choucri (Political Science) and David Clark (Computer Science),a collaboration that lead toa way of integrating cyber and real international relations.This resulted in a “consensus” overall system architecture to characterize cyberspace to help integrate the “real” and cyber international relations consistent with the goals of ECIR, and provide an integration approach for the research generated by other members of team within and across tracks. We expect this architecture to help us relate “real” and cyber international relations.Summarized in the Year One Report, this System View of the architecture consists of three main dimensions:

(1) Layer-view of the Internetand the actors that operate at each of the major layers and/or shape and influence the functionalities;

(2) Major actors and entities, national and international, who use the Internet, pursue their own mission and objectives, and constitute fundamental players in the overall venue of “cyberspace;

(3) Generic national and international actions and activities generally characterized in the “real” domainbut gradually integrating cyber venues. See Clark (CSAIL) papers for the initial specifications of (a) and (b); the extension to (c) is in collaboration with Choucri (Pol Sci), and student is doing his thesis on this topic (Sloan).

This approach was consolidated through a weekly interdisciplinary collaboration, had student involvement (leading to a thesis), and helped in curriculum development, all which would not have occurred without the Minerva structure. We look to year two to extend and build on similar efforts, with potential collaboration to be supported by a monthly group meeting. This meeting will be arranged around a research seminar to help promote research awareness among team members and promote the development of interdisciplinary awareness.

We would also like to briefly revist the theoretical principles that help to guide the interdisciplinary research. Our dual interdisciplinary strategy is as follows:

Given that we have already generated a body of knowledge, an important outcome of Year One (even with disconnects), our plan is to begin two mechanisms or strategies for connecting the various pieces.

• System View of“Real”-Cyber International Relations System: In order to make the linkages, we needed to develop some information individually within the tracks. This work focuses on the interactions between and among different actors interacting in cyber space and we consider it as an important framework for “locating” the track specific contributions. Multi-methods will be drawn upon to be articulated through Year Two
• Dynamic of “Real” and Cyber System: This linkage principle is anchored in temporal interactions, and captures the interplay among difference dimensions around an issue. The method to be used is system dynamics.

In sum, we believe the new operational mechanisms will help support our overall interdisciplinary research goals:

• A new monthly team meeting (based around seminars) to improve collection and dissemination of interdisciplinary work.
• Improved use of students (described in more length in section 3.)
• Revised use of reporting and documentation (described in more length in section 6.)
• Utilizing the groundwork developed within tracks in Year One
• Refocusing on the overarching theoretical interdisciplinary strategy to connect various pieces, given experience of Year One

3. Student Training and Curriculum Development

We are pleased that the student effort was a highlight of the review, and we hope to build on the success in student training and participation with additional coordinating mechanisms. To date, student participation in ECIR research resulted in work toward five theses, one joint paper with faculty where the student is the lead, and continued work planned for the summer.

To improve coordination, we have already developed an email listserv for students, and now have initiated a new student-led meeting and seminar. The group will be lead by an advanced student, and we believe will promote student involvement, awareness of overall research, and interdisciplinary among investigators. A student group meeting is currently scheduled for May 13 to follow the group-wide Cyber IR Seminar. We are also working on the overall vision for this group, but options include student seminars and working papers.

We believe there is already closecommunication between individual investigators and students, but this will also be better captured using the group wiki, described in more detail below.

We have also re-configured our monthly reporting to focus on documenting student participation, products, and contributions. Full documentation of student participation will be updated on the basis of the first student seminar,and we will use the year 1 report as a baseline to continue to track and update out progress in year two.Additionally, we will send two full student thesis concurrently with this report.

Concerning curriculum, the ECIR activities have lead to the development of a new course approved to be offered in the next academic year. We expect to have a draft syllabus by the end of the summer. Year One activities were vital in the development of the curriculum, and at this point, we have defined the course core and the suggested weekly topics.

4. Team Management

We take very seriously the concerns about groupinteractions, potential dysfunctionalities, and team cohesion. Given that the MIT administration is fully engaged in contributing to improving our “Team-Performance,” we expect that this to promote appropriate effective discourse in the future. We believe that the monthly group meeting will support team cohesion. This group meeting will also keep the ECIR team informed of related activities by the researchers that are not part of this Minerva initiative.

5. Documentation and Reporting

We will support our documentation and reporting via two separate venues. These are the new group website (externally directed) and the group wiki (internally directed). We focus here on the role of the wiki as a place in which documentation and exchanges of concepts can occur.

We believe we have begun to develop working definitions of key concepts through the activities of Year One. For example, the concept of “HotSpot” in international relations has a different meaning than it does in computer sciences. We will expand our efforts to codify this work on common meanings from diverse perspectives in Year Two using the wiki platform.

We also note that at this time we are at various stages of documentation for the research activities. For example, all of the data and the data points for the variables in the ECIR Dashboard are checked, rechecked, and fully documented. This is an excellent model for other data sets of a metric nature that we expect to use for other data sets.

Another example pertains to the literature documentation in international relations. That consists of identifying the select materials written by scholars of international relations using different theoretical perspectives (or “lenses”) and assumptions about cyber variables in world politics. Since that literature is nascent at best, it is especially important to baseline it at the onset.

6. Technical Feedback – Use of Data

Request: “The government would like the research team to provide an explanation of the limitations of using media data, event data, interviews, etc. that reflect descriptions of cyber events in understanding cyber. It is clear these limitations may be unavoidable given the paucity of actual cyber attack, cooperation, etc data but they should be captured.”

Questions concerning the limitations of data that reflect descriptions of cyber events are an ongoing research issue for the group, and this topic has come up many times informally in the seminars. The use of media data is itself a challenging issue.

(1)The concept of “events data” refers to a well developed methodology in political science that generates intensity-metrics (generally from conflict to cooperation) from incidents reported in public venues. Our reference to events data pertains specifically to the generation of metrics from reported interactions.

(2) We have not yet completed our explorations of the differences between reporting on physical interactions versus cyber-based interactions. We need to better understand the nature of the limitations.

(3) We acknowledge these complexities and propose to confront them by approaching cyber challenges from a variety of approaches (data, theory, simulation.)

PART II: ECIR Team Responses to Track focused Questions

Below are responses to the specific requests identified by track.

Track A

Request: Please provide a response to the following:

1. What is the relationship between “Cyber Politics” and “Cyber International Relations”?

Cyber Politics is defined as interactions designed to influence the authoritative allocation of values in society (real as well as virtual) in terms of who gets what when how (following Lasswell’s and Easton’s definitions of politics). Cyber International Relations refers to (a) interactions across state borders (b) within and across a wide range of domains (c) undertaken by a wide range of actors (d) in the pursuit of their goals and objectives.

1. How is the theoretical work (top right quadrant) being integrated/influencing the MIT portion of the theory work.

It is being integrated into the system architecture (see Clark and Choucri) as the anchor for the action dimension (and developed by a graduate student Guarav Agarwal for his thesis). That dimension captures power relations ranging from “soft power” (the top right hand quadrant) such as persuasion and negotiation to “hard power” such as the use of physical means of influence or the deployment of military force.

1. Please describe how you are defining “non-state” actors. Are you considering different types of “non-state” actors separately in analysis and theory development?

We define these to include all actors other than sovereign states or aggregate entities consisting of sovereign states. Non-state actors, important features of international relations and international politics, include for profit as well as not for profit entities..

1. References to the “government” do not make clear if the team is taking a US-centric approach to theory development. Please address.

Government(s) is a generic concept. It is the core institution of governance for the sovereign state. We do adopt a US centric approach to theory development. At the same time, the dominance of the US cannot be ignored. The US case is the most important of all the sovereign states given where the Internet was created. Most if not all major players at the layers levels have also US roots.

1. Questions on section 2.5.3, page 20 the internet is leading to “peace or conflict” . Why/ how would the internet be different from any other media in this regard? What is degree to which these discussions parallel those from other innovations in communication?

At least six features of the Internet are distinctive in the context of international relations, namely with respect to the impacts on, and the role of, time, space, permeation, ubiquity, participation and attribution. These variables are defined in the draft working paper on Introduction to Cyber International Relations.

Request: Please explain what will be done to address these “serious” challenges. The report was written in August and it is unclear what progress has been made in tackling these issues.

Thereview committee correctly summarized some of the concerns about data availability and data consistency that we uncovered below. The analysis and the reporting has been an ongoing process. We believe that this analysis (and the much more detailed discussions and examples in the three reports and papers completed) are an important early result of the project. The fact that we are able to draw some specific conclusions about the nature of the data is itself extremely useful for the project as a whole. But there was much more accomplished by the research team (see below.)

Somehow the review committee missed this on page 23 of the Annual Report Year One:

“But this does not mean that there is no useful data. We are able to do trending within and between countries & relative comparisons. Also, we are able to use other sources to analyze the self-reported capabilities of each CERT (e.g., we can compare the number of Botnets identified by each CERT with national-level information from vendors such as Symantec.) Our success with such analyses is described in some of our research results described below.” Much more is discussed in the 34 page report entitled: “Institutional Foundations for Cyber Security Current Responses and New Challenges” and the other reports.

In addition, in various places, such as Slide #82 of our presentation, we describe some additional steps, proposed to be taken in Year Two

•Ongoing Work

–More data sources and data categories are being identified and incorporated in the Dashboard

–Semantic reconciliation techniques (e.g., MIT context mediation research and semantic web research) will be explored to alleviate data inconsistency and interpretability and to provide a consistent view for the exploration

–Economic and/or social incentives for improving the reporting and sharing of nation-level data are to be investigated

•Suggestion that we help to develop “business model” for the CERTS

–Show that some data provides useful insights -> Imagine what more data can do!

–Like old days: “What do you mean you do not have a web site?!”

Track B

Request: Please provide the interview protocol. See the programmatic note below regarding human subject approval.

Consistent with MIT rules and regulations, any activity that involves interaction with “human subjects” in any field or arena must be cleared by the Institute Committee on Human Subjects. We are fully aware of this requirement and have already had considerable experience with this committee on other research projects.

The interview strategy is under development but we will provide updates as we progress.

Request: The government team has requested that the attributes of the case studies be described/defined and a justification be provided for the selection of the case studies. How does this set of case studies provide insight into overarching hypothesis of the program? Please describe/characterize the methods that are being used to assure that the data collection being done for the case studies is systematic. How will the data be made available to others?