Takeaway: Where does the responsibility for repelling cyber attacks rest in the internet age?

Politics. Washington is a place where you can admit to being bad at your job and Capitol Hill sends you money.

Last week, Christopher Wray, Director of the Federal Bureau of Investigation, told Vanderbilt University Chancellor Daniel Diermeier that the Chinese Communist Party had infiltrated parts of American infrastructure via software and hardware systems as well as using more traditional tools of spycraft.

The threat is the reality of modern life and a deteriorating geopolitical dynamic but in wars past – cold and hot – the government was responsible for protecting America from nefarious actors – real and fabricated – around the planet.

The failure to do so has typically involved a good tongue lashing from Congressional Oversight committees and sometimes a resignation or two. Under today’s standards of competency, the response is “send more money” as Mr. Wray suggested at the Vanderbilt Summit on Modern Conflicts and Emerging Threats.

Federal intelligence and crime agencies have always leaned hard into the ill-defined threat. Russia, it seems, has been on the cusp of destroying the west for almost 75 years now. Federal agencies generally claimed bragging rights when it didn’t happen even if it was undeserved.

The reality of the World Wide Web is the ever-present spider which shifts the accountability for sovereign protection from the government to American business. The unanswered political question is where does the government’s responsibility end and the private sector’s begin?

Policy. The question does not perturb UNH’s CEO Andrew Witty. On the company’s 1Q earnings call he declared that the Change cyber attack would have been so much worse had UNH not seen fit to purchase the company.

The claim was clearly directed at the Federal Trade Commission which attempted to stop the acquisition. It also happens to be true. Outside of the federal government, few domestic entities have the scale and the expertise to make advance payments to providers and restore service in a few weeks.

It is small comfort if you are one of 8M people whose health history and claims record is now floating about the dark web but expect it to be Mr. Witty’s main talking point when he appears at Congressional hearings next week.

Buried in his message is the implication that UNH fully understands where their role begins in protecting its business from intrusion and it is not counting on the U.S. Cavalry.

Power. Finding the line where private sector business interests end, and federal sovereign priorities begin will be much harder at places like Vanderbilt University. Vanderbilt and about 20-30 other Academic Research Centers typically top the list of NIH grant recipients. Scientific research is conducted globally with China’s scientist valued partners for most American Universities.

China, over Japan, has been a preferred target for private equity investment by endowments.

Chinese nationals have made their way to American undergraduate and postgraduate positions in numbers that exceed representation from countries not considered geopolitical threats.

As far as academia is concerned the links between the two countries are difficult to sever.

Things will need to change, assuming the trajectory we are on is sustained but the cost seems almost intolerably high. From inexpensive graduate-level labor to grant collaboration to investment returns, the role China has played in supporting American universities’ income statements, not to mention their prestige, is not to be ignored.

As such, the lines between national interests and private sector priorities are not as clear.

Have a great rest of your weekend.

Emily Evans
Managing Director – Health Policy


X