Thanks for coming in, everybody. This is Ambassador Doug Lute, the most recent U.S. Ambassador
to NATO. He would have loved to attend, but I think slipped a disc in his back and couldn't
get on the plane, so he's talking to us from his home in Washington. So without further
ado, I will put the microphone down to him.
Okay. How does it sound now? Yeah, we're good. Okay, we should probably stop right
here and consider this a success. Look, thanks, first of all, for gathering today. I have
to apologize. I'm in Arlington, Virginia. I could not make the trip to DEFCON this year,
although I was very much looking forward to it. So this has to pass for a moment.
This is my opportunity to share some time with you. Jake mentioned that I most recently
served as U.S. Ambassador to NATO in Brussels for the last three and a half years, but actually
I've spent my entire adult life in the national security arena. I served in Europe as an Army
officer during the Cold War, in the Balkans in the mid-1990s, in the Middle East and
South Asia since 9-11.
I've served in the Pentagon, in the White House, and most recently at NATO headquarters.
In short, I've studied national security issues my entire life, beginning at West Point, through
my Army career, my time at the White House, and with a degree at Harvard. So you might
ask, why am I piped into DEFCON? What am I doing talking to you, this audience of cybersecurity
experts?
I have really just won.
Here is my simple main point. Last year's attacks on the American voting process are
as serious a threat to our democracy as any I have seen in over 40 years. The attacks
last year may prove to be more serious than any physical attack at the core of our nation.
Physical attacks, obviously, increase the level of security. In fact, security attacks
occur loss of life, damage to materiel, and those losses are tragic.
But ultimately, America is a rich, strong country.
We can recover from those attacks.
We're resilient.
However, if we were to lose confidence in the security of our voting process,
the voting process, this most fundamental link between the American citizen
and his and her government, if we lost confidence in that,
the damage could be much more severe.
In short, in my view, as a national security guy,
this is a serious national security issue.
Now, my remarks this afternoon are not about what happened last year.
I think you've heard other speakers talk about that.
You've read about this.
And I frankly think that the forensics on last year's Russian attacks
will come fully to light by way of the several investigations that are currently underway.
And I think, frankly, we should have confidence that the investigations in the Senate
and with the special counsel will bring out the facts.
But some things are already clear while these investigations are underway.
First of all, Russia tried to infiltrate.
They tried to influence the election outcome in favor of one candidate.
And second, at a very minimum, Putin tried to discredit the process.
He tried to discredit the election outcome by casting doubt on its legitimacy, on its credibility.
So why is this so serious?
Why should we act now?
I've got essentially five points.
And let me run through these five.
And then I hope you understand.
I hope we have a bit of time for questions.
So first of all, this is a serious national security issue
because Putin has demonstrated successfully that he can use cyber tools against the U.S. election process.
This is not academic theory.
This is not hypothetical.
It is real.
He influenced our election process.
He cast doubt on our democracy.
And he has gridlocked Washington, D.C. at a very low cost to Russia.
Now, in military terms, if you go to the military dictionary,
there's actually a very clear definition of what constitutes a threat.
And what that definition says is that a threat has two components.
There must be a capability and there must be intent.
So a threat is capability plus intent.
And Russia's attack last year meets very clearly that dictionary definition.
So this is a proven credible threat.
And that's the first reason that we have to take this seriously.
Second, this is a national security issue because Russia is not going away.
Putin himself can be in office until 2029.
2029.
Even when he is replaced someday, any Russian successor leader would likely use similar tactics to inflame Russian nationalism,
that is, to cause Russians to rally around the flag and to weaken international opponents,
especially if they could do it at such low cost.
Why would Russia do this?
What are Putin's objectives?
What's he actually up to?
I want to get into this in a bit of detail here.
So let me spend a couple minutes on this question.
What is Putin up to?
Very simply, the Russian experts I know and have worked with believe that he has one overriding objective,
and that is simply to stay in power atop the Russian state.
But he knows that in the long run, he has a very weak hand.
Russia is a state in steady decline.
Decline economically.
It's a single resource economy, oil and gas.
It produces nothing else that anybody else wants to buy.
It's in decline by way of all health indicators, by way of demographics, by way of all political social indicators.
Russia is a state in decline.
So in order to stay in control of such a state,
Putin centralizes power very narrowly around himself,
and he plays to a few key supporters,
the Russian military, the intelligence services,
and a reasonably small set of Russian oligarchs, the very rich.
Meanwhile, he suppresses all internal opposition.
He inflames Russian nationalism, Russian pride,
the Russian sense of greatness,
the Russian sense of being victimized over the last 25 years after the fall of the Soviet Union.
If you are Putin and you want to stay in power,
you eliminate internal opposition,
and if you don't have a real external enemy,
you create one.
And that is exactly what he has done.
This is all to stay in power.
Now, beyond staying in power himself, he has other objectives.
Not as primary as staying in power,
but closely related.
He also wants to create a geographic buffer zone
around Russia.
This buffer zone being a friendly,
or at least weak and compliant countries
along Russia's periphery.
This is why he invaded Georgia
in the caucuses in 2008,
and why he still occupies Georgian territory.
This is why he seized the Crimean Peninsula
from Ukraine in 2014, just three years ago.
This is why he continues to this day
to destabilize eastern Ukraine
by sponsoring proxy militias,
providing military support, and so forth.
All of this activity on his border, on his periphery,
is to destabilize these neighbors
so that they will not lean towards the West.
They will not lean towards the European Union
or towards NATO.
Because if Georgia or Ukraine
were successful as democracies
integrated into the EU and NATO,
that example would be disastrous for Putin.
It would be an example to the Russian people
that they don't have to live in a state of decline.
That there is greater opportunity
if their next-door neighbors demonstrate this opportunity,
Russia would be at risk.
Putin would be at risk.
Russians would essentially ask,
why not us?
And Putin will not tolerate that question.
And then finally, Putin has even broader objectives.
He would like to take advantage
of any opportunity to crack the solidarity,
the cohesion of the West.
That is, the cohesion of the Atlantic Alliance, NATO,
the cohesion of the European Union,
and ultimately the cohesion of the United States
as a member of NATO
and as a partner of the European Union.
He wants the sanctions imposed by the European Union
and the US to end.
These sanctions are an insult to him
and they're further weakening his already weak economy.
He will try to divide the West,
create cracks, fissures, erode cohesion.
That's why he conducts large military exercises
on the borders of NATO
while he sort of rattles his military saber,
even with nuclear threats.
That's why he supported Marie Le Pen
and her party in the French elections
just a couple months ago.
And that's fundamentally why
he tried to interfere with US elections last year.
He is very pleased.
He is very pleased today
that the White House is ensnarled
in this controversy,
ensnarled by this issue,
that Washington is all gridlocked
by the controversy that he promoted.
If he can weaken the West at low cost,
he sees himself as strengthening Russia
and he will do so
every single time.
So when I say that Russia is not going away,
I mean that Russian leaders will continue
to centralize power
and do what they can to stay in power.
They will continue to weaken their next door neighbors
and they will take every opportunity
to crack the cohesion of the West.
So the Russian threat is real
and it's here to stay
even beyond the person of Vladimir Putin.
Now, the third reason
that election security here in the States
should be a national security issue
is because other states are watching.
If Russia can attack the US election,
then others are saying,
so can we.
Think here of Iran,
North Korea,
even non-state actors
like the so-called Islamic State
and perhaps others.
So others are watching.
The fourth reason out of five
that this is a national security issue
is because our next election,
the 2018 off-cycle elections
and the 2020 presidential elections
are actually just around the corner.
And these will be lucrative targets
to any cyber opponent.
Time is actually quite short
to repair our vulnerabilities.
We have to have a sense of urgency now.
And that's one of the messages
that we're trying to communicate
with our partners there at DEFCON this week,
this sense of urgency.
And finally, fifth and finally,
this is a national security issue
because other democracies
beyond the United States
are also vulnerable.
Putin tried to vote,
quote unquote.
He tried to vote in the US elections
last fall.
He voted in favor of one party
in the French elections
just a couple months ago.
He will likely try to vote
in the German elections
in several months from now.
Earlier, past years,
he has voted in Georgia,
Ukraine, and Montenegro.
So this is a threat to the United States.
This is a United States
national security issue.
But beyond us alone,
it's a national security issue
because friends and allies
are also under threat.
So for these five reasons,
the security of the US election process
is a top national security issue.
And that's what brings me
to DEFCON this afternoon.
Now look, I'm not the expert
on securing, on how to secure
our voting process.
But there are well-established experts
in that room with you today
and elsewhere around DEFCON.
In the community,
there are well-established experts
on what needs to be done.
In particular, I would point
to two nonprofit efforts
of verified voting
and the Center for Internet Security
as providing standards
and well-thought-out,
well-reasoned remedial steps
that need to be taken
to ensure we never have
a repeat of last fall.
The good news here,
despite all that sort of bleak outlook,
the good news here
is that we actually know
what needs to be done
to secure our 50 states
and the over 6,000 voting jurisdictions
around the country.
One of the challenges, of course,
is that we do have
so many points of entry,
so many potential vulnerabilities.
It is now time, in my view,
to elevate this issue
to the level of a national campaign,
a national campaign
that is bipartisan
or, frankly, nonpartisan.
I've served under presidential administrations
of both parties.
George Bush hired me
into his White House in 2007.
Barack Obama invited me to stay in 2009.
I'm about as bipartisan
and nonpartisan as he is.
This campaign needs to have
that same feature.
This is not about
which party was attacked
or which party could be vulnerable
or which benefit.
This is about
our American election process
and the very foundation
of our democracy.
It is the fundamental link.
Just think about this.
It is the fundamental link
between everyone
who lines up on voting day
and the people
and casts his ballot,
his or her ballot,
and his role in the democracy
and the elected government officials that follow.
That fundamental link is under assault.
So, look,
for over 40 years,
as a military officer,
as a government official,
I didn't even line up to vote.
I voted by absentee ballot
from wherever I was stationed
around the world.
I filled out the ballot.
I sealed it.
I signed it.
And I assumed that when I mailed it
that voting security
was somebody else's job.
Someone else was going to take care of this.
I frankly didn't worry about it.
I felt that my ballot,
when I posted it in the mail,
was secure.
After last year's experience,
I don't feel that way anymore.
I'm convinced
that I personally, as a citizen,
have to get involved in this.
And I am involved in this.
And I hope you will come
to a similar conclusion
and that you will join this effort,
either as technical experts
committed to finding good remedies
and appropriate safeguards
or simply as concerned citizens.
Let's get involved.
Let's get this fixed.
Look, I'm happy now
to take your questions
and I hope that we can actually engineer that
with this sort of video connection.
So, thanks.
I can hear you, Julia.
Sorry, Jacqueline.
Great.
That'll work.
I understand that
NATO has defined cyber
as the fourth domain
along with the air, land, and sea.
And I understand also
that an act of war
against one member of NATO
is an act of war against all.
Does General Luke believe
that the act of war,
the definition of an act of war
in the cyber domain
has been well defined?
I have a question about
how NATO defines cyber.
It's an attack on one ally
and it's an attack on all of them.
It's cybernality
and it's a new domain
and it's a new airplane.
How has NATO thought about
or defined this?
Yeah, this is a very fundamental question
that was at the centerpiece
of my work at NATO
beginning in 2013.
Let me take you back a little bit
and give you a little context.
So NATO came into being in 1949
and the key clause in the treaty
that brought those original
12 allies together is Article 5.
It's the fifth paragraph, right?
And basically it says
an attack on one is an attack on all.
And the treaty defines an attack,
which gets to this question,
as an armed attack.
And of course in 1949,
four years after the end of World War II,
everybody knew what
armed attack looked like, right?
And that definition of armed attack
persisted all the way up to 2014.
And at a summit
with Barack Obama in the chair
and in the United Kingdom,
the then 28 allies
updated the Washington Treaty
by way of a policy decision.
And what they decided and codified
was that NATO will treat cyber attacks
as capable of triggering
Article 5.
So being equated to an armed attack.
So in a way they updated
the 1949 language.
Now that usually follows by the question,
well, what kind of cyber attack?
So did the cyber attack
on the United States last year,
for example,
or the cyber attack on Estonia in 2007,
Georgia in 2008,
or Ukraine repeatedly
over the last couple of years,
do those constitute,
do those trigger Article 5
and therefore a NATO response?
NATO left the answer to that question ambiguous
and not well defined.
And the idea here was that NATO,
while it wanted to be on the record
of signaling that cyber could trigger
the treaty and a response,
it wanted to be ambiguous about exactly
where that line was to be drawn.
And it also wanted to be ambiguous
in terms of the nature of NATO's response.
So NATO has not taken the decision
that cyber attacks
will be responded to by cyber responses.
So there's a little benefit here of ambiguity
in the sense of signaling to potential opponents
that first of all,
you can't get away with a cyber attack
if it generates the kind of impact
that an armed attack might have.
And that second,
as an opponent,
you should not feel certain about
how NATO exactly
responds.
Right.
Right.
Well,
I mean,
I take it by the question
that you,
like me,
think that this will be a challenge
and that there will be
partisan politics
that some try to play
on this issue.
I mean,
you have only to look at the other
contentious issues
in terms of updating our democracy.
You know,
the outline of voting districts,
partisan.
Candidate selection,
partisan.
Campaign financing,
partisan.
And term limits,
very partisan,
right?
So there are other issues underway.
There are other initiatives underway,
all of which have drawn partisan fire
in terms of the pros and cons,
the winners and the losers on those issues.
The reason I think
there's a shot here
for this issue,
the election of our voting system,
is to be nonpartisan
or bipartisan
is because of the National Security Act.
It's really only by way
of the sorts of assaults
that we saw last year
that an outside power,
a foreign power,
can threaten
our democracy from inside.
All those other issues,
districts,
candidates,
financing,
term limits,
those are all internal issues.
Russia doesn't get to vote
on those issues.
And our system will deal
with those issues.
And they will draw
partisan pros and cons.
This one, though,
our voting system security,
I think has the potential
to rise above that partisanship.
And that's why,
in my remarks,
I emphasize over and over
and over again
that this is a national security issue.
National security,
typically,
over the long history
of our democracy,
has been
a bipartisan issue.
So that's my hope.
But I take your,
it's a very partisan atmosphere.
It's propaganda,
media,
social engineering,
and so on and so forth.
What's your observation on that?
Separate from voting machines
security,
community security,
what do you think
of the underlying
information operations
and things
from Russia
are going to be
invested
in class
and in
national security?
And what do you think
of the information
operations
and things
that are going
Right.
Now,
this is another tool
in Putin's kit bag,
right,
in his toolbox.
And,
again,
he can do this
remotely,
sometimes
with fingerprints
and sometimes
not for attribution.
He can do it
at scale.
It's relatively
inexpensive.
And
he can use,
especially,
modern social media
platforms
to amplify
these messages.
I mean,
if you think back
to the time
that,
you know,
sort of the media
post-war,
post-World War II period,
1950s and 60s,
Russia,
at that time,
Russian leaders
at that time
tried to influence
Western election campaigns.
But they had to do it
with,
you know,
communist parties
in those countries
and posters
and pamphlets
and flyers
and so forth,
right?
Well,
consider the difference
today,
where bots
and social media
and fake news
and disinformation,
misinformation
gets flooded
onto our
airways.
So,
this is a
big challenge
as well.
And
I don't list
this
as the same
national security
level challenge
as voting security.
But there's
no question
that there's
a Russian attempt
to influence
the politics
outside Russia
by way of this
mass
misinformation
campaigning.
Yeah.
So,
for me,
and this
is
I think
as much
a personal
judgment
as anything
else,
I still have
confidence
in the American
public's
ability
to discriminate,
distinguish
between
real news
and fake news
and to be
a pretty
sophisticated
consumer
of
news.
I think
that arena
right now
is flooded
with
misinformation
and
and
disinformation.
And I think
social media
platforms
amplify that.
So,
it's a challenge.
And I think
it's more difficult
today
to get the facts
because there are
so many
contrary
facts
or competing
facts,
quote unquote,
if you will,
in opposition.
But
fundamentally,
I believe
that
Americans
can
distinguish.
I hope
I'm right
on that.
I think
from the
voting
security
challenge
is because
if the
voting
process,
if the
security
of the
voting
process
is believed
to be
sacrificed,
jeopardized,
compromised,
then
what I'm
concerned
about
is that
Americans
could draw
the conclusion
that
It's
not worth
bothering.
It's
not worth
paying
attention
to
election
campaigns.
And
if that
link
between
the
voter
and
his or
her elected
officials
is broken,
I'm not
sure how
you repair
it.
So
to me,
there is a
line that's
crossed.
If the
credibility
of our
election
process
is
compromised.
So for me,
it's a
different
character.
And I think
more severe.
Don't states,
in fact,
try to
influence
the
election?
Is it what
did the
technology?
I would refer
to some reports
I've seen
on our own
intelligence
operatives
in Iran
and some of
their presidential
elections
this century.
And what
they did
any different
from what
anyone else
did?
So the
The question is about internal respect.
No, no, I'm saying that I'm saying that countries,
countries of the United States
and Iranian elections in this century
attempting to having on the ground
trying to incite all of the influence,
you know, students and other things in that environment.
And how is that having traditional intelligence assets
working on the ground to be different
than coming from the side,
other than it's much faster, much cheaper,
gonna change a much better.
Right, this is a question about do you,
how do you weigh this?
Is Russia just evolving in their methodology
but traditionally, especially in the last century,
you may have seen other states try to influence
how come elections, you know, that are not there.
For instance, has the US manipulated elections in Iran?
Right, so look, like most things in life,
the track record here is not clean cut.
And I'm not suggesting by way
of my rather pointed and maybe even passionate remarks
about what happened to us,
I'm not suggesting that our track record is clean
as you go back into history.
What I am suggesting is that this assault last year
is the first serious assault
at the heart of our election process.
And because we have another election in 18 months,
and one after that in 2020,
we don't have much time to do the forensics on this
and to review the history before we actually take
the practical steps required to repair the vulnerabilities.
So look, I'm a reader of history as well.
There are things in our history that all Americans
should take a moment to think about.
And look, this country's not perfect.
We've made mistakes in the past.
But this would be a mistake of huge historic proportions
if we imagine this threat away.
And we run the gamble, we run the risk
that the next national election is so corrupted
that we break the confidence of the American people,
and the whole progress process of democracy.
That's what's at risk here.
And I don't think the US process has been at such a risk ever
in the over 200 years of American voting,
the voting record.
And if you're asking me for a personal view,
I'm no longer in the government.
If you're asking me for a personal view,
I think it's wrong for any outside power
to try to manipulate the American people.
I think it's wrong for any outside power
to try to manipulate the American people.
to try to manipulate or delegitimize
another's internal electoral process.
.
Well, to the extent that we can attribute
the specific individuals or organizations
within the Russian government
that are responsible for last year's activities against us,
then those should be included.
And some of those are included in the current sanctions.
regime. But if this situation becomes more clear and we can further attribute, then obviously those
organizations or individuals should be added. Meanwhile, what else can we do? Well, first of
all, we should do exactly what we've been talking about for the last hour here. We should become a
much harder target. Right now, in classic military terms, we're a soft target. The American election
system is a soft target. Why? Because we're still operating voting machines connected to the
internet. We're still, in some jurisdictions, conducting elections without the ability to
audit them by way of a paper audit trail. We still have voter registry databases hanging on the
internet, and everybody there obviously knows how vulnerable those databases are. So what happens
when we just talk about this for the next 18 months or 36 months, and then it happens again?
And so
. . .
I think much of what we've talked about, and I think what the voting, as I recall, the voting village, I think it's called.
Sorry, I'm not in the voting village.
What that's all about is simply to take this thing seriously, this threat seriously.
So we obviously should do that.
And then the other thing we should do is, as much as possible, share our experience from last year with like-minded democracies and have an open conversation, not only among ourselves,
and sharing information among the 50 states, among the secretaries of state, typically the senior voting officials in every one of our 50 states, but also down to the individual jurisdictions.
So we have to do that sharing internally.
But we should share information.
Externally, internationally as well.
So, for example, a good example of this is that the U.S. intelligence community, when it reached its conclusion last fall, after the Russian activities, came to NATO headquarters and briefed all 27 other allies on our experience in classified setting, down to the who, the what, the when, and the where of the Russian activity.
That's a good example.
The kind of sharing that we should have among our, especially our European allies, especially among our other democratic partners around the world.
Because, as I mentioned in my remarks, we have a responsibility to fix us.
We have an at-home responsibility.
But we also, as a leading democracy, have a responsibility beyond that to be the standard bearers for other democracies, many of which are not as wealthy, not as well-off, and not as historically.
grounded as ours.
So there's a big responsibility here, to get this right for us, but to get it right as the standard bearers for democracies around the world.
Thank you.
Thank you.
Thank you.
Thank you.
Thank you.
Thank you.
I don't know.
The question is, are there any other measures being taken?
Like federal, is there any federal action?
Is there any federal action?
There are.
I don't know if there's any other action.
I don't know if there's any other action.
Right.
So, again, I'm not the technical expert here,
and I'm sure there may be others in the room,
perhaps representatives of the Department of Homeland Security,
who ultimately has federal responsibility to assist the states and local authorities.
And this assistance can come in a number of forms.
I mean, first of all, it can come by way of funding assistance.
And for a relatively modest amount of federal funding,
we could do away with these vulnerable electronic machines.
Modest funding.
For modest funding from the federal government,
we could mandate or make possible a paper audit trail for every election,
which assures us that the outcome is credible and responsible.
We should, and DHS, Homeland Security,
has taken a decision that among other critical infrastructure systems around the country,
so nuclear power plants, electrical power grids,
our financial infrastructure,
there's a whole set of critical infrastructure,
that our voting systems are among those.
That's a good step.
And what that means is that federal funding is available
to help state and local jurisdiction voting officials.
A big thing that could be done here,
and here I think the Center for Internet Security is a very credible voice,
is to share information on tactics, techniques, procedures, and threats.
That even the smallest voting district in all 50 of the states are subject to.
So there's a combination of setting standards, sharing information, providing funding,
all of which fall directly into the basket of DHS.
So I think there are probably some DHS officials there who would agree.
Now, my understanding of the experience last fall, or last year, during our election cycle,
is that DHS, the federal government, in some instances offered assistance,
only to be turned down by state and local authority.
So I think this is a two-way street.
This is, on the one hand, the potential of the federal government to help,
but it's also, this is what's so important about organizations like DEFCON,
that it's so important that the local authorities,
who are not paying as close attention,
and may not be as connected and aware of the vulnerabilities of the Internet
and voting systems riding along the Internet,
that those players, below the federal level,
become more aware and be open and welcoming to federal support.
So this has got to be a two-way street.
And by the way, that goes back to the fundamental point,
that this campaign needs to be national,
and it needs to be bipartisan.
We need to do this as Americans, for America.
And that's probably the point on which to end.