• Human Rights
    Marriage Equality: Global Comparisons
    A growing number of countries are legalizing same-sex marriage amid a steady advance in rights for LGBTQ+ people, but opposition remains strong in many others.
  • 2022 in Review
    The World Next Year: What to Watch in 2023
    Podcast
    In this special year-end episode, CFR Senior Fellow Carla Anne Robbins joins James M. Lindsay and Robert McMahon to review the biggest events of 2022 and the stories to keep an eye on next year. They discuss precarious U.S.-China relations, climate change, Russia’s war in Ukraine, Iran’s protests, the state of democracy globally, and more.
  • Democracy
    When Democracies Vote Wrong
    There was a joke told during the Cold War about the citizens of the Soviet Union. The Soviet line about human rights was that U.S. human rights and democracy policy constituted an unacceptable interference in its internal affairs. The joke was that “Soviet citizens are the only people in the world who are forbidden to intervene in their own internal affairs.” That line works for any dictatorship, where internal matters are resolved by force and by a tyrannical imposition of what rulers insist on rather than what the ruled wish for. It was long ago settled, in the West anyway, that human rights and democracy policy is not an unwarranted interference in self-rule—because it is an intervention in cases where self-rule does not exist, or is being used by a majority to destroy the rights of minorities. When democracy policy means promoting free elections, freedom of speech and of the press, and other human rights, foreign interventions are meant to establish self-rule in the target countries and to protect fundamental rights. This line of argument is persuasive in most or all cases of dictatorship, but what is the justification for foreign intervention when there are free elections and voters simply “vote wrong?” Many questions arise: How can governments justify pressing other nations for policy changes when those policies have been arrived at democratically? Is the case different if the appeal is not to foreign governments but to foreign pressure groups such as the nation’s diaspora around the world, whether that be a diaspora national group such as Indian Americans, Polish Americans, or Cuban Americans, or a religious group such as Jewish Americans? Is it more legitimate for the electoral losers to appeal for support to private citizens in foreign lands than to their governments? If it is clear that voters have chosen to undermine democracy itself, norms of human rights policy may justify both private and official diplomatic intervention. If for example a majority in some country voted never again to hold an election, or to eliminate freedom of the press, one would expect democratic governments to voice criticism. But those are extreme hypotheticals, because they would affect irreducible minimal conditions for the preservation of democracy. We may be seeing such a case today in Mexico, where that nation’s popular president has persuaded its Congress to approve changes in the hitherto independent National Electoral Institute that may undermine the fairness of all future elections. In many other cases, though, democracies may differ quite a bit in how they conduct their public affairs without bringing democracy itself into doubt. They may have a unicameral legislature, not the bicameral form familiar in the United States. They may demand secularism in public spaces and by public bodies in a way familiar to the French but that would be viewed as a violation of religious freedom by Americans. They may have a state religion and a national language. They may put restrictions of freedom of speech that would be unconstitutional in the United States, but are accepted as proper libel laws in the United Kingdom. The role of the top judicial body may look quite different than it does in the United States, as may the way in which judges are chosen. Such differences are reflections of national experiences and preferences, not obvious compromises of democracy—and entirely acceptable so long as they are democratically chosen. Accordingly, it is improper for those who seek changes in such internal arrangements in their own country to seek foreign pressure as the means of achieving them. The reformers must win over their fellow citizens, not try to substitute foreign pressure for internal political support. These generalities come to mind now because of the case of Israel, where the Right has recently won a free election. There have been no complaints about the election per se, but many about the right-wing government that it produced. And along with those complaints have come appeals to American Jews and the United States government to jump in and press the new government of Israel on issue after issue. We have just noted the distinction between actions that genuinely threaten democracy and those that do not, with only the latter justifying foreign pressure as a matter of human rights policy. Now another distinction is useful: actions that foreign diaspora communities do not like, versus actions that directly affect their own interests. It is reasonable for foreign diaspora populations to jump in when their own direct interests are harmed. It is to be expected that a draft law that would, for example, deny or restore citizenship to anyone whose parents or grandparents were born in the “old country,” or would limit certain forms of land ownership exclusively to citizens who are residents of the country, would elicit diaspora reactions. In the Israel case, American Jews have certain direct interests that may be subject soon to new legislation. What will be the validity in Israel of conversions to Judaism conducted abroad by non-Orthodox rabbis? What is the definition of “Jew” for purposes of the “Law of Return” that allows such persons the right to settle in Israel? There are two cases, then, where intervention is morally justifiable: when the change that is proposed changes directly assaults democracy, and when it directly assaults the interests of diaspora communities in their relationship with the country in question. That leaves a large area of possible political change where it is inappropriate for domestic political actors—who have just lost a free election—to seek foreign support to resist the will of the majority. A fair example in the Israeli case is the selection of supreme court judges. In the United States justices are selected by the president and must then be confirmed by the Senate. In other words, the two political branches control the selection of judges for the judicial branch. In Israel, a nine-person panel selects supreme court judges. Two are cabinet ministers and two are Knesset (parliament) members, representing the elected branch of government, but the other five consist of three members of the supreme court and two members of the Bar Association. A majority of five, then, do not represent the voters, and because 7 votes are needed to be appointed, an appointment can be blocked by sitting judges or a combination of sitting judges and Bar Association members regardless of the votes of elected officials. The new Israeli coalition says it will change this and does not want sitting judges to have such a large role in selecting their colleagues. This position may be right or wrong, but is certainly not “undemocratic” nor is it less democratic than the current Israeli system. There are other examples, in the judicial field and elsewhere, raising again the issue of when what might be called “anti-democratic” foreign pressure is justifiable— “anti-democratic” in that those who seek the foreign pressure have lost an election and want their way nevertheless. Unless the fundamental democratic structures are at risk, such intervention cannot be justified. If for example the government of Romania sought to take away voting rights from the roughly 6 percent of the population that is Hungarian, India restricted suffrage to Hindus, or Israel took away the right to vote from Muslims, human rights policy would justify and indeed demand protests and pressures. But when what’s at stake are “mere” voter preferences for one policy over another, the protection of democracy requires acknowledging that the new majority has every right to go forward with policy changes the voters have just approved. Indeed, what theory of democracy would justify abandoning such steps because foreigners who do not vote do not like them, when election results indicate that citizens and voters do? The case of Israel is complex because it has long depended on support (including especially military sales and assistance, and political support in the United Nations) from the United States—and within the United States from American Jewry. The recent Israeli election result has led some Israelis to wring their hands and tell American Jews that their intervention was now essential to saving Israeli democracy; I participated in a zoom call recently where a just-retired figure of real influence made that case directly to the Americans on the line. The election result has also led some American Jews to threaten they would withhold their own support, including the influential Abe Foxman, leader of the Anti-Defamation League from 1987 to 2015. Even before Israel’s new government had come to office, Foxman told The Jerusalem Post that “it is critical that this new government not do damage to relationships; not tamper with Israel’s democracy, its institutions, its legal systems, its civil rights of Arab minorities; not tamper with the Law of Return and the status of Christians and Muslims....” But if not, “If Israel ceases to be an open democracy, I won’t be able to support it.” This is very broad language, and Foxman is here mixing all our categories: proposed changes that (in his view) directly undermine democracy, policies that he doesn’t like but would not seem to affect democratic structures, matters that directly affect the interests of Jews in the Diaspora, and matters that do not. That is what makes his language, and this case, so instructive. The lack of clear distinctions suggests that he is going beyond what is defensible as a matter of democratic theory, by seeking to oppose policies he doesn’t like and that have just been rejected by voters. Because Israel’s new government has not yet taken office as I write, its policy choices are not yet clear. What is clear is the utility of the Israeli case in clarifying important distinctions. The responsibility to be true to majority voter preferences and avoid seeking support from foreign pressure lies in two places: on the losers and on the foreigners. Losers should be using democratic institutions to resist policies they think wrong, and should be making their best arguments and trying to win the next election. They should not be asking foreign governments and individuals to intervene in domestic affairs to overturn the results of democratic elections. And foreign governments, organizations, and individuals should be careful not to elevate their policy preferences over those of the voters in a true democracy. Of course they should explain and cajole, but demands should be out of place because they seek to defeat the results of democratic elections. It would be ironic indeed if human rights and democracy policy became a means for foreign governments and pressure groups to undermine democratic processes. Every election has winners and losers, but it would be grotesque to make democracy the loser whenever those without the right to vote dislike the results.
  • Peru
    Why Was Peru’s President Impeached?
    The impeachment of President Pedro Castillo Terrones marks Peru’s latest political crisis. As violent protests extend into their second week, what’s in store for the Andean nation?
  • Energy and Environment
    Deadly Droughts: Adapting to a Drier World
    Play
    Several regions across the world are experiencing their worst droughts in decades, if not centuries. Crops are failing, exacerbating the global food crisis, and rivers that serve as vital shipping arteries are becoming dangerously low, threatening the global trade system. Panelists discuss the scope of the challenge and what companies and governments can do to adapt.   GOODMAN: Welcome today’s—to today’s Council on Foreign Relations session on “Deadly Droughts: Adapting to a Drier World.” I’m Sherri Goodman. I’m a senior fellow at the Wilson Center, a longtime member of the Council, and also secretary general of the International Military Council on Climate and Security. We have a great set of panelists today and we’re going to get right to it. Let me just set the scene for a moment by observing that, you know, we’re having this session here in the midst of the Africa Leaders Summit that’s occurring this week in Washington, and that many of the African nations that are here this week, especially in the case of the Horn of Africa, have experienced successive failed rain seasons, causing massive drought leaving almost forty million people insecure, and that that food crisis is multidimensional. But it’s not, as we say, unmanageable. And climate change and conflict are exacerbating this challenge, and we’re going to explore that today. Also, Africa bears the brunt of climate change. Sixteen of the most climate-vulnerable countries are in sub-Saharan Africa. And when we try to climate-proof, we need to look at water infrastructure and water insecurity on the frontlines. I’d also note that earlier this year the White House released its Action Plan on Water Security, declaring water security to be an essential component of U.S. national security. But we’ll get further into that, as well, and we know that stressors—water stressors worldwide from poor management to accelerating climate change, and that almost half the world’s population will be under severe water stress by 2030 according to the U.N. And we’ve got an important U.N. Water Conference coming up next year. With that, I want to go right to our speakers. We really have a fantastic group of panelists today, and—two of whom I have the pleasure of knowing and the third I’m excited that he’s joined us today. Lauren Alexander Augustine is at the National Academies of Science. You should—can read her bio. She’s got a very distinguished career working at all aspects of water, natural disasters, and resilience across many domains and a really fantastic background. Matthias Berninger. I love that he started out in the Green Party from Germany, went to Mars where he also led the global chocolate program, and now is at Bayer. And he’s going to talk to us about his—both his private-sector experience and his current role leading up to the U.N. Water Conference next year. And Aaron Salzberg served for many years as the lead State Department coordinator for water. He led development and implementation of the—of U.S. foreign policy on drinking water and water security. And now he is at the University of North Carolina, where he leads the Water Institute there. So the way we’re going to do this, I’m going to start with a question to each of our panelists, and then we’re going to go into an interactive discussion for the first half-hour, and then we will open it to questions from all of our members. And thank you for joining us today. This session, by the way, is on the record. And that’s thanks to Richard Haass, our president, who said this subject is too important; we need to have this session on the record. So thank you. OK. Lauren, your work—your lifetime work, much of it now at the National Academies but more broadly, has been at the nexus of water, natural disasters, and resilience. Why are you concerned about water security, both in the U.S.—and I note you run the Gulf of Mexico research program—and abroad? AUGUSTINE: Thank you so much, Sherri and CFR, for asking me to be here today. So the reason that water security has me the most concerned is because we all depend on water. We depend on it for food, agriculture, economy, fish, every—you know, municipal purposes. And I think that it’s the most vexing of the—of the natural disasters because it’s kind of a slow on set. You don’t exactly know you’re in a drought until you’re well into a drought, so the slow on set sets up a number of challenges. And they rarely happen alone, right? So you have a water quantity issue, too much or too little, and it starts to trigger other things. Water scarcity gets into famine, it gets into an economic decline, and transportation issues. Too much water gets into life, you know, problems as well. So I think that it’s one of the most vexing because the solutions that we might want to kind of pull off the shelf are not always available during a water-scarcity event. We cannot make it rain. We cannot create water. Now, we can move water. As the engineer in me, we can move water, but water, it’s kind of a sum zero. If you move it from one place, you’ve taken it from one place to another. And when you transfer water, you can get unintended consequences. And I think that the final part of this answer is that it is—it is vexing and it also—it’s connected to everything. And so you start to make changes in where we get water, when we get it, how much, who pays, and you start to change this event down the system. And I work in the Gulf of Mexico, and everyone kind of thinks, oh, the Gulf of Mexico has too much water; it’s a flooding place. Except for when it’s not, and then it creates other problems. So it’s kind of a place where all of these issues really come together in terms of energy production, food, and transportation. So, to me, Sherri, this issue, it’s kind of this hidden one. Kind of creeps up on you and then, boom, you got a problem. So I see it as a massive issue in the United States and of course, as you’re talking about, globally. GOODMAN: Thank you very much, Lauren. Matthias, you were a member of parliament from the Green Party prior to joining first Mars—I love than you ran the global chocolate program—and now you’re at Bayer, you said. So you’ve gone from chocolate to aspirin. I guess you need both. But so why—you know, first, why did you pursue this career path? And why is water and water security so central to you? BERNINGER: Well, I believe that detours sometimes understand—or increase the understanding of the surroundings. And for me to—having been both in parliament, in the government, but also in business helps me in these days of quite complex times to help companies, but also in a broader sense the political spectrum to move from admiring the problem to action. And the challenge with water is that water is this topic, as Lauren said, as long as you don’t think about it, it kind of—almost kind of gets ignored. There is a certain underlying water blankness. But a bit of a warning for the audience today: Once you start a focus on water, it just doesn’t, like, allow you to pivot from it, yeah? So if you’re not interested in doing that, then you should actually leave this meeting right now. Water is the way through which we experience climate change. None of us wakes up and says, oh, there was a lot of carbon in the air, yeah? We experience through water. We talk about droughts today, but let’s not forget the other three—highly polluted water, flooding, and, of course, also extreme heat, which is very high temperature with very high humidity. Those are the four ways we experience the climate crisis. And we talk about drought today. And for a company like Bayer, that is leading in the area of crop science, we have a $2.5 billion budget in R&D to innovative in this space. We can innovate for a lot of things, but without water there is no food. And agriculture today consumes almost 20 percent of all fresh water. And to scare you even more, almost half of all fresh water in Asia at one point passes through only one crop, and that is rice. So here you see how this topic is really connected to security, to the climate debate, and, dare I say, also to the biodiversity debate. And it’s kind of telling that we are talking about biodiversity in Montreal without even mentioning water. That’s one of those challenges I spoke with a lot of delegates in recent days related to biodiversity. Without water, we will not be able to achieve any of the biodiversity targets, any of the targets to reduce hunger or, I also think, climate action will be very difficult. Because without water plants cannot absorb carbon dioxide. GOODMAN: So thank you, Matthias. Let me just pull on that thread with you for a moment. So what do you want our members to know about the innovations or sort of solution set that, for example, Bayer is undertaking today? What one story captures the innovation to improve water security in Bayer, that is so dedicated to agricultural science and innovation? BERNINGER: What we are working on at the moment is irrigated rice. For me, it’s the number-one challenge we have to address. If you think about security in Asia, it’s absolutely vital. We just this week and last week saw these disturbing pictures of the border dispute in India—you know, between India and China, because, you know, India and Pakistan live at a very challenging border. So water is this very big topic. And rice, for me, is the number-one crop we need to focus on. The good news is if we change the way we produce rice, if we innovate also on the rice crop, we can reduce the demand—the water demand of rice in significant ways. And that’s the kind of stuff we need to look at, stopping admiring the problem and focusing on big, bold solutions in this space. GOODMAN: Great. Thank you. That’s a perfect—let me bring Aaron into this discussion. Aaron, you know, we’ve known each other for a long time. You have been the U.S. government’s leader on water security. You developed the first global water strategy. You’ve represented the U.S. in many multilateral processes. You know, tell us a little bit about your journey in this space. And also I just—we’re going to very candid her today, you know, where you think we are in terms of, we’ve got a water strategy out there, and something called an action plan, but the question is, what kind of—as we sometimes say in certain government circles, strategy without resources is hallucination. So why don’t you—(laughs)—respond to where we think we’re going on water strategy in the U.S. SALZBERG: Well, thanks, Sherri. You kind of set me up. And thanks to Lauren and Matthias for making that original point. I mean, because they’re both right, right? You know, I didn’t find water. I wasn’t trained as a hydrologist. I didn’t come in thinking I was going to spend my entire career working on water issues. Water found me. And in large part because it is a wickedly hard problem. And it’s a wickedly hard problem that matters—perhaps more than almost anything else that we’re going to have to work on. And, you know, we have this misnomer when we often think about water. You know, we lump it in with the SDGs. And we get this impression that water is a problem that you can solve. And one of the things we have to come to terms with is that water is a problem that we’re going to be managing every single day forever and ever. Providing basic hydrogeological services to all the people that we need to—clean drinking water, sanitation services, water for food, water for energy—these are things that we’re going to struggle with every single day, day after day, for ever and ever. And that means we have to change our mindset from, oh, let’s come up with solutions that’ll solve a problem to how do we build the institutions, how do we build the capacity, how do we make sure we have the right governance structures in place that enable us communities of people, and partnerships, technologies provider sand service providers and others, to work collectively together to solve this problem in a routine way, so that it becomes a way—just a way of working. You know, people always add this discussion about integrated water resources management, where people think it’s a noun. It’s actually a verb, right? So it’s a way of working. It’s just something you’ve got to embrace, and we’ve got to move forward. You know, we’ve seen a lot of progress recently by the United States on the strategic front. We saw the White House Action Plan, as you mentioned, and we saw the new revised version of the U.S. Global Water Strategy. And kudos to both, right. It’s nice to see that we’re maintaining some political pressure on the United States to actually do some of this work. And also, the recognition of water security. And in both those documents, water security played a central role. And I think that acknowledgement that it’s important for us to ensure that countries are water secure is a really nice shift in direction and something that we should all be lauded for. I think my concern is it’s a lot of nice words. And it’s really backed up by very little action. I think, you know, both the White House Action Plan and the Global Water Strategy were kind of launched in a vacuum, which is a little bit of a shame, right/ Because you really want to use the opportunities of launching initiatives like this to solidify partnerships and to bring together the different entities from the private sector, from other governments, that will work together with you to implement these types of things. And I think that was a very big missed opportunity on both sides, that we didn’t really use the launch of these documents to advance the implementation. The other is, you know, how do we implement these? What are the resources? What’s the—you know, for any major initiative, you know, you need the mandate, you need the money, and you need the institutional home. You need someone who’s going to be responsible and accountable for delivering on that mandate. And it’s really not clear to me who’s responsible and accountable for delivering on this mandate. And whether or not they’re properly resourced both in terms of access to expertise, knowledge and funding to be able to carry out that mandate. So I have some concerns around that. GOODMAN: OK, let’s talk for a minute here about water diplomacy. I’ll bring also Matthias and Lauren into this. You know, as an example, you’ve got a project like under EcoPeace Middle East, to do a water sharing for solar agreement between Israel and Jordan, under the rubric of the Abraham Accord. You know, Israel uniquely, unlike many other countries, does treat water as an element of its national power, but now that we’ve seen its—you know, its rivers dry up, the Jordan River, and now there’s the prospect of a deal between—you know, Jordan has abundant solar, Israel has, you know, grew the desert—you know, greened the desert, and manages its water very adeptly. So is that the type of example that we should see more of to improve water sharing and water security in a cross-border setting? SALZBERG: To some degree. You know, those things get a lot of attention. And transboundary solutions can be an important part of ensuring water security for many countries. And that’s something we need to think about. But, look, at the end of the day, individual countries need to focus on long-term plans and strategies that make them water secure. And that’s focusing on, you know, how do you reduce consumption? As Matthias mentioned, how do you improve the productivity of water, for food production in particular? Rice he mentioned, absolutely. Cotton is another one. There are many foodstuffs where we can improve the productivity of water in those uses, and we should be doing that, and that will help move countries to be more water secure. Augmenting supplies through water reuse or through desalination, those are all important. Improving water storage, because climate’s going to increase that variability problem. And so how do we store water so that we’ve got it for later use, in groundwater, in large-scale dams and infrastructure? And there’s where transboundary solutions can really begin to help. You know, I once—you know, I remember I was in—several years ago I was having this discussion with some folks from the NSC. And I said, look, if you gave me control of the WTO, I can solve the world’s water problems. And while I was being a little flippant, there is some truth to the idea that transborder trade and enabling access to—and improving the access of—the flow of water through other goods could be very important in achieving water security for many individual countries. And so improving the accessibility that countries might have to beef products or to other high water intensive products, if they’re importing it from places where it should be grown rather than trying to grow it inside their own country, where they actually don’t have the resources to do that or conditions aren’t favorable to do that, that’s an important part of this process. And that’s where I think some of these transboundary agreements where we can think about exchanging energy for water or food products and virtual water, and shipping that across borders, can play a really important role in the water security of individual countries. GOODMAN: Thank you. Lauren, I want to bring you in on that question, and also through the very substantial Gulf Research Program that you’ve been leading, what research has come out of that that bears importantly on these questions? AUGUSTINE: Well, just following right on Aaron, these transboundary issues—I mean, you think of the United States, big country, and it has different levels of water security, right? There’s parts that are wet and parts that are dry. But at the borders, you know, we have, you know, the Colorado, which is dry right now. And we have an agreement with Mexico on delivering water to Mexico from the Colorado. That is not being met. And, you know, when we think about the transboundary issues, we often think of—like you set up the question—countries in conflict. We are very lucky that we are not in conflict with Canada in the north nor Mexico in the South. Because, you know, we share the Great Lakes with Mexico—or—with Canada. And there are talks when the Mississippi gets low, can we pull a little bit from the Great Lakes? Just a little bit? And it’s like, nah, we don’t want to do that. We want to keep our friends to the north under the terms around our water. We think about Alaska—and Aaron set it up really nicely—about food products. Well, this year in Alaska the salmon runs were very low, at the time when they were supposed to peak. And so Canada—we share that salmon with Canada, right? And so these transboundary issues will look different in the richer countries than they do in the poorer countries. When we talk about the Gulf of Mexico and we talk about the low water, we’re talking about low water on the Mississippi right now. We’re talking about such low water that we’re dredging more, to the tune of billions of dollars, to make sure that channel stays open. If we go back in time, we go back to the flood of 1927, and all the decisions that came after that to make sure that those ports in southern Louisiana, the Port of New Orleans in particular, has enough flow to convey that $60 billion every single year down the Mississippi and out through the Gulf of Mexico. But the water—I am a trained hydrologist, right? But the water really wants to go to the Atchafalaya, but we’ve moved it. We have put up structures at the old river to make sure that water gets to the big port in New Orleans. And we’re all grateful for it, right? We get the grain, we get the steel out. When we talk about low water flow in this region, we’re talking—in the Gulf of Mexico—it comes out kind in water quality, sediment levels and salinity levels, right? And so when you think about the Gulf of Mexico—now, we share this body with Cuba and Mexico. And we all have really big fisheries as an economy in this region. Gulf of Mexico feeds, like, 40 percent of the U.S. seafood. Sixty percent of commercial fishing comes out of Alaska. So these six states give most of the United States its seafood. You change the salinity, now you change the oyster production. You change other shellfish. And you change the production of the big one, the red snapper, right? So when we look at that and we’re talking about—the United States is a massive producer of national food, global food. And we’re starting to see the changes in the chemistry of the water, the turbidity of the water, sediment loads, salinity. And it’s changing the food economy. So these transboundary issues thankfully, here in North America, are not related to conflict. (Laughs.) We are very, very grateful for that. But they’re not unsolved. These are not problems that are unsolved. And so—and they present differently because these are three relatively rich countries. GOODMAN: Great. That was terrific. So let me ask—I’m going to ask each of you to weigh in on this question. Maybe, Matthias, we’ll start with you now. What—particularly since you’re heading up—have got a lead role in the U.N. Global Water Conference coming up next year—what global hot spots concern you most? And what would you like to see us doing about it? BERNINGER: So it’s the first, obviously, U.N. high-level conference on water—it’s the first U.N. conference on the topic of water since 1997. Without disclosing too much, I just start a primary school when folks met in Argentina to kind of discuss it. So most people have never experienced, actually, U.N. conference on water. So I see that as a huge opportunity for us to rally around a topic, and to create the effect that we really include the dimension of water in all of our decisions in ways that we have obviously not done before. The good and the bad of that conference, and it happens without a framework. So we all know UNFCCC, the climate conferences, as I said earlier, the Montreal Conference on Biodiversity, Chinese-led by hosted by Canada at this moment in time, they have frameworks. They have rules of the game. We have a water conference where the result will be the report about the conference. So that could get terribly wrong, or it could be very exciting. We have an opportunity next year to create a framework almost, since we have the holidays, the Christmas tree, and then all the things we do on board are the ornaments we can position nicely on that. That is—that is what’s in the cards at the moment. So that’s the first part of your question. Business community, multinational institutions, donor institutions on the financial side, and governments, as well as NGOs, can rally around something in ways that we haven’t done in a long time. What concerns me the most? I have to say it is the Horn of Africa, it is East Africa. We are now experiencing the third La Nina weather event or phenomenon in a row. That happened before, but it’s kind of more intense. We already see—and it’s been ironic—flooding in Australia, drought in Argentina, pointing towards quite a dramatic La Nina. And the consequence for East Africa will be another year of drought. Now, I hope that that highly probable prediction does not happen, but we already have a famine in many countries there. Somalia is often mentioned. And if you listen to David Beasley, he is starting to lose it. I mean, two years ago his organization received the Nobel Peace Prize as the World Food Program. Two years later, he has, like, record famine to deal with. And it is all related to water. GOODMAN: Right. So we can’t—and if we’re going to go there, then we have to bring in the consequences of the war in Ukraine for affecting global food supplies. That is intimately connected with water. So given all of that, let me ask you then, Aaron, what do you think is needed to better prioritize water in U.S. and international policy? I mean, you could say that over the last decade, we’ve seen much more attention, obviously, to climate change, as a global security threat. We’re probably at the high-water mark right now—water—(laughs)—pun intended—of addressing that as an international system. Biodiversity, even though it hasn’t gotten quite as much attention as climate—and I take your point, Matthias, it doesn’t include water—also growing—sort of ecological security growing in attention. You might say water is still sort of a lagging, although it is very much part of the climate discussion, but not the full dimension of it. And in some ways, it’s not as politicized, at least in the U.S., as climate. So where do want to go on the priorities there? What would you advise the administration now, Aaron? SALZBERG: Well, you know, in some respects, just to reinforce the point that you made, I think water’s still an orphan issue. And it is, in many, many different fora. And the COP is a good example of that, right? I mean, there really is—there are full sections—if you look at the outcome document for COP27—there are full sections dedicated to oceans, to forests, to agriculture. Water is essential to all of them. There’s no section on water. And then that’s traditional, right? The COP just doesn’t bring water in, in what I think is a full way, into the climate agenda. I mean, there are a couple of nuggets that optimists might cling to from the last COP related to water. You know, one was the focus on early warning and climate information services. I mean, this could be read as trying to strengthen hydrological monitoring, monitoring and forecasting networks which, in my view, are absolutely essential to ensuring water security going forward. And so that’s a plus. But the water wasn’t mentioned, hydrology wasn’t mentioned, within that context. The other, of course, is this conversation around losses and damages. And we can all admit most of that is going to be attributable to water-related types of phenomena. But, again, you know, you also have to read the language really carefully here, because, you know, countries didn’t agree to establish a mechanism to compensate countries for loss and damages. And that’s, of course, what everybody’s saying and what we’re hearing a lot about. that’s not what we agreed to do. What we agreed to do is to put in place funding arrangements to respond and address the losses and damages associated with climate change. And that’s fundamentally different, but that does open up the door for greater investments in water-related adaptation and in, you know, investing in early information, early warning systems, and ways of ensuring water security to prevent the losses and damages that might directly result from hydrological variability. In terms of the leadership, you know, at the U.S. level, you know, again, I think we’re giving a lot of nods to water, but we’re not taking the hard steps that we need to, to really prioritize water. Water is still not addressed in the National Security Strategy in a robust way. And that’s really the document that U.S. government agencies use to budget their resources and to set their strategic priorities. And that’s unfortunate. So there really isn’t a clear call by the administration to prioritize water highly in the documents. You know, I think that, you know, water security in particularly is lagging behind and doesn’t get the same budgetary support within the United States architecture as, let’s say, drinking water and sanitation do. And I don’t want to knock that, right? We do need to invest in providing basic services as part of our humanitarian efforts to ensure that people can move along the development continuum. But if we’re going to be serious about water security, we need to communicate that. Congress needs to communicate that. And it needs to be an integral part of our policy strategies and our budgeting to work with governments to increase their capacity to build the infrastructure, to build the institutions that allow us to manage water every single day. Not just provide humanitarian responses, but to put in place the tools that we need to do this daily work every single day. And this is where I think the U.N.—you know, I’m grateful for the meeting, and we do need this global attention. But at the end of the day, you know, we’re going to see a collection of these initiatives that different partners will put together. But, look, we need governments to lead on this. We need every single government to develop their own national security strategy around water, how they’re going to ensure their own water security. And they need to work through a process where they can mobilize the partners to be able to implement that long-term plan and strategy. And this isn’t something you do in a year or in five years. This is ten, twenty, thirty years. And this is theoretically what the HLPF was intended to do, right? The follow-up mechanisms to the SDGs. And we should really be using some of these other institutional mechanisms within the U.N. system to hold countries accountable to developing those long-term plans and strategies, and to hold other countries accountable, and partners accountable, to supporting them underneath national government leadership. And I fear that this U.N. conference is going to be an opportunity for people to check the box and say, oh, great. We had a great meeting, we did everything we’re supposed to do. But then, shy away from doing the hard work of developing those long-term plans and strategies and investment in strategy that needs to be done to get us to where we need to go. Sorry, that was too much. GOODMAN: OK, well, that was—that was great, Aaron. And that was very important commentary on kind of where we are, and what we could be doing more of both particularly in terms of the early warning systems and predictive capabilities that are on the front lines of saving people’s lives in an increasingly drought-inflicted world. So at this time I’d like to invite our participants, our CFR members, to join the conversation with their questions. A reminder that this meeting is on the record. And, Alexis, may we have the first question, please? OPERATOR: (Gives queuing instructions.) We will take our first question from Marisol Maddox. Q: Hi. Thank you so much. My name is Marisol Maddox. I’m with the Wilson Center. Sherri, Aaron, really great to see you. So, I mean, these issues are more important than ever and, clearly, we have limited time to make decisions that can really have an impact. And, Aaron, I really appreciate your point about the importance of not just checking a box with, you know, the array of issues that we’re dealing with right now. So at the same time, there’s also a growing recognition of the threat that greenwashing poses, because it distorts our ability to find good solutions. And to that point, Congress just released a report on some of those threats around greenwashing. So I do feel like there’s kind of this level of cognitive dissonance with having Bayer on this panel, because they own Monsanto, which has been flooding our waterways and soils with Roundup, the main ingredient being glyphosate, right, which has been found to cause cancer, among other very deleterious health and environmental impacts. And Bayer is still pushing the use of Dicamba, which is a catastrophically destructive poison that contaminates water supplies, kills the crops of neighboring fields through pesticide drift, as well as wreaks havoc on biodiversity. So if we continue to allow these false solutions to be put forward, we’re really ensuring to not get this right. And, honestly, like, we have too much to lose at this point for that to be an option. So the business community is crucial to getting this right but, like I said, we have to navigate the threat of greenwashing. So I would be genuinely interested to hear the thoughts of other panelists on how we can mitigate that risk, to make sure that we’re choosing solutions that really address these issues and actually help to build resilience for the decades to come. GOODMAN: OK, Matthias, you’ve got to take that question. BERNINGER: In any given week I at least once get accused of greenwashing and once of being a woke company representative. So I’m quite used to that. And, Marisol, thank you for addressing the topics. And I really mean it. We have to reduce the overall amount of pesticides being used. One of the interesting facts is that the number-one place where biodiversity loss happens is actually not the oceans, it’s not land, it’s actually sweet water environments. So I’m fully with you on that. And we’ve got to reduce our overall pesticide use quite significantly. We innovate also in alternatives to some of the chemicals you talked about. Currently all the herbicides we use in agriculture, you named two of them, I can add 2,4-D, I can add Glufosinate, all of the herbicides we use have been developed before Pearl Harbor. So they are, like, really, really old. And the question is, can we get to a new generation of herbicides? Can we work more on biologicals? Can we find ways we are not producing fertilizers, but our value chain depends on it? To also reduce the amount of fertilizer being used in agriculture to address one of Lauren’s nightmares. And that is the dead zone in the Gulf of Mexico as a result of runoff of fertilizer. So I’m with you on that. We are working on that. We are investing heavily behind it. And our leadership gets rewarded for moving in that direction. I disagree that we should not participate in that conversation. The reason being that with a $2.5 billion R&D budget, we spend three times more on innovation than all other CGIR publicly-funded research institutions in agriculture. We need to work on that stuff together. And that’s why I’m engaged on the topic. And that’s also why I’ve been asked to work on it. So, no, I don’t smell like greenwashing detergent. But, yes, the problems you address are real problems and we need to take them. GOODMAN: Thank you. OK. Let’s go to the next question. OPERATOR: We will take our next question from Laurie Garrett. Ms. Garrett, please accept the unmute prompt. Q: Yes, hi. Thank you for this important session. Real quick question: If you look across the landscape of available drinking water, what percentage is in the form of sold plastic-encased water? And how does that compare as a trend over time and as a per drop or milliliter, or however you want to put it, price point to the consumer compared to, say, gasoline prices? And how do you deal with the criticism that major soda companies, like Coca-Cola, and Pepsi, and Nestle, are buying up safe drinking water supplies all over the world, and then reselling them at tremendous profit? Is there a way to reconcile all these issues and still go forward with equitable global access to water? Thank you. GOODMAN: Laurie, as always, a great and incisive question. Who would like to answer that? SALZBERG: Well, this is a tough one, so we’re all kind of shying away a little bit. I don’t know the percent of water that’s being delivered in plastic that’s ending up in people’s homes for—to meet their basic needs. I’m not sure what that number is. And clearly in places like the United States, where we buy a lot of that stuff, it’s going to be different than in others. But what I will comment is on the privatization issue, because I think this is an important one and one that we need to be careful about how we talk about. You know, the private sector can play a critically important role in providing services, right? We have both public and private service providers that provide drinking water in many places around the world. And finding the right mix is important. And making sure that communities and stakeholders are involved in determining that relationship with private service providers is critically important. That said, the idea of private ownership of water rights is something that I do think we have to be particularly sensitive to. And in any place where those relationships are being set up, I think there’s got to be a great deal of oversight to make sure that the right checks and balances are in place, that the right ownership rights are attributed, and that we’re being very conscious of the long-term risks that our water supplies will be under, and whether or not we’re compromising our ability to respond to some of those risks by those private agreements. And so I think as we develop PPPs, public-private partnerships, we’re going to have to be very careful about the contractual arrangements that we put in place so that we don’t tie the hands of governments or communities to respond to risks that are going to emerge from climate change, a long-term drought, or something like that, to reprioritize those allocations of waters and to do some of the transfers that you were talking about, Sherri, either transboundary or that Lauren was talking about doing internally. You know, we need to be able to have that flexibility. And so I do think we have to look very carefully at these PPP arrangements going forward. GOODMAN: OK. OPERATOR: We will take our next question from Adam Philipp of Cedar Brook Partners, who asks: This is a fascinating issue for me, living in Cleveland, a Great Lakes city. As water’s importance becomes more and more apparent, how do you see the Great Lakes region changing? I’ve seen books and numerous studies asserting that some of the best places to live amidst climate change are Great Lake states. Curious if you have particular thoughts on water and climate change-oriented trends that may shape the future of the Great Lakes region. GOODMAN: Lauren, over to you. AUGUSTINE: I would say that the Great Lakes will become even more important—recognized as—they will—they will increase in their recognition of being important sources of fresh water, not just in North America, but for the world, right? This is the biggest collection and source of fresh water we have. These Great Lakes move a lot of water from way up in Canada, all the way out through the St. Lawrence seaway. And as commerce, transportation, hypoxia, sediment, all these things, particularly in North America, start to take—start to elevate and become more acute on—for agriculture, all these things, I think there’ll be a lot of recognition on the importance of the Great Lakes. I also think that when we—engineers can do amazing things, right? And so we can move water. We do it all the time. And so there will be more pressure, I can foresee, on the Great Lakes to provide more water to other places. In terms of living there, I’m from Rochester, New York. So I’m a Great Lakes person too. I don’t know what the living experience will feel like or look like as that pressure kind of increases. We do see, under conditions of climate change, for my brethren in Buffalo a couple of weeks ago, getting six, seven feet of lake-effect snow. We will start to see how these lakes might become weather generators, particularly under these conditions of altered climate patterns. So I don’t know the answer to your question, but I feel your—I feel the interest in it. But I think, in terms of water scarcity and water supply, the calls for borrowing from the Great Lakes could possibly increase. And that is, in fact, not a decision the United States can make alone. We do have a pact with Canada for that. So that goes right back to Aaron’s transboundary issues there too. I don’t know. I mean, these are great questions and, wow, these are hard to answer. But those are some thoughts on what you’re asking. GOODMAN: It’s a great question. I will say that I had the privilege a few years ago of traveling to the Middle East with a delegation of water managers from the Great Lakes to share their experience, Canadian and U.S., in transboundary water management with water-parched countries in the Middle East, just for this purpose. And the level of cooperation—of course, we have an abundant resource in the Great Lakes. We’re so blessed. The level of cooperation detail is remarkable. And the problems are increasing. But the cooperation level is also quite extensive here. AUGUSTINE: Can I add one thing to that, Sherri? You know, the one thing I would also say is that at least in the United States, and most places I’ve worked around the world, water management is done at a hyperlocal level, right? I mean, we get our water locally. Most of us can’t afford to move it too far. But water transcends these boundaries. I mean, this is where the Great Lakes become kind of front and center, right, because they’re a source of water under conditions of scarcity. So this connection between the local management, regional, national, global, transboundary supply, that’s one of the pieces that Aaron was alluding to that create this complication of how do we manage this important resource? We manage it hyper local, then we can see differences in inequities. We manage it at a higher level, where maybe we can be a little bit more equitable, but it takes much, much more connection and coordination. OPERATOR: We’ll take the next question as a written question: Could you speak to the state of water stress in indigenous communities in the U.S.? SALZBERG: Yeah, no question it’s not great, for a whole bunch of reasons, right? You know, it’s not just indigenous communities, but many Black communities in the United States as well. You know, we had historical practices that really limited access to some of these services for these communities, both for the Native American population but also for Black communities here in the United States. And, you know, it’s amazing when you see, for example, the progression of municipal services, how in some cases they actually wrapped around these areas. And you have doughnut holes where people are still on wells and on septic—on on-site septic systems because they were never brought into the municipal service network. And this is a real challenge. And, you know, Kudos to the American Recovery Act, because there’s a lot of resources there to hopefully address some of these challenges, and hopefully—you know, I’m certainly seeing states beginning to make lots of investments in correcting some of those longstanding historical practices and extend services into those communities. But that also comes with challenges, right? Paying for services is a complicated process. And this isn’t going to be easy. You know, on some of our tribal areas and tribal lands, they still also lack what we would consider to be, you know, typical service providers. And they’re relying on on-site systems that are not providing good water quality and/or are not providing good septic systems, which are contaminating water quality as well. And so this is a perennial problem that needs greater attention and focus. And I think whenever we talk about the United States meeting its SDG commitment, it’s really focused on how do we ensure access in those areas, and how do we scale up and make sure we’ve got sustainable supplies of safe water? You know, it goes a little bit as well to Marisol’s point. You know, the fact that we have, what, over one hundred thousand chemicals in manufacturing in the United States. And I would venture to guess all of them are inside of our water in some way, shape, or form. And so just keeping up with the challenges of ensuring water quality is hugely complicated. And in many areas, especially out in the West where we’ve got a lot of our superfund sites and things like that, we’ve got some real water challenges that have not been addressed that affect those communities. And I think tribal communities in particular are affected by that. AUGUSTINE: If I could just add, I mean, Aaron is hitting this right on. And I work in the Gulf of Mexico region—Texas, Louisiana, Mississippi, Alabama, and Florida. And I would say that there’s kind of two sides to this. I do want to bring in the Black communities and Latino communities. And just the under-resourced, disenfranchised, in addition to the native peoples, culmination in Louisiana, Jackson, Mississippi, Flint, Michigan. We are seeing—we are seeing examples—we are seeing it play out that decisions on water infrastructure investments, they take years, decades, generations to play out. But that’s what we’re seeing in these places, right? We’re looking—you know, in my region we have cancer alley, kind of between Baton Rouge and New Orleans. We have the Houston ship channel communities, kind of from Galveston to Houston. These are not water scarcity issues, right, but these are water infrastructure issues. There are contaminants. There are decisions that have been made, maybe a long time ago, that are being meted out now. You’re seeing it in health outcomes, high cancer rates. We’re seeing it in, you know, sanitation issues. And, you know, these are—these are, in fact, policy decisions about where public investments do and do not go. So at least in the United States, which is what you asked about, I can’t speak for indigenous populations across the whole country, but what I see in the Gulf of Mexico region I think is pretty reflective that these underserved communities, one, are underserved for a reason. Two, they’re usually not accidental. And three, it can take decades to see the results of these decisions and poor investment. So we have a long way to go. And I think we’re kind of hitting the end of the design life of some of this infrastructure and all these issues are really coming up right now, right? Like, now, we’re, wow, it’s that bad. And so we’re kind of lucky in the sense that we have the IIJA, the Investment Infrastructure and Job Act, that’s really at the precipice of being able to at least rectify through new investments of infrastructure. Because I think a lot of the answers to your questions is around infrastructure. SALZBERG: Yeah, and just to put a fine point on this, because—sorry, I’m passionate about this, and I can tell Lauren is too—this is a key part of addressing systemic inequalities here in the United States. AUGUSTINE: That’s right. SALZBERG: And, you know, when you look at the impact of lead exposure on lifetime economic earnings, you have to understand that, you know, putting communities in a position where they’re drinking water that’s not safe for them actually impacts them, and their kids, and it goes on and on. And so this is a real serious problem that I just don’t think we’ve come to grips with yet. GOODMAN: Thank you, both. Thank you. OK, Alexis, our next question. OPERATOR: We will take our next question as a written question: Can you speak to the potential of groundwater in supplementing agricultural water supplies, and what barriers exist to fully utilizing it? GOODMAN: Oh, go ahead, Lauren, and then I want to bring Matthias in on that. AUGUSTINE: I would just say this goes back to a statement I think we all made at the beginning, that you can move water, but not without unintended consequences. So you can take the water out of aquifers. And it happens all over the United States. It happens all over the world. And you do see impacts of collapsing aquifers, increased overland sheet flow, lack of absorption. These issues are longer term for the short-term gain of being able to irrigate. Usually, you know, it’s for agriculture, right? There’s usually—there’s a mass balance here. You can’t just take the water and think you’ve solved the problem. But I will let others talk, because I can talk too much on this one. (Laughs.) GOODMAN: Matthias. BERNINGER: I think looking at irrigated agriculture is critical in the water debate. And then the factor of energy plays a very important role. So one thing that worries me in the kind of task for transitioning rice production in India is that electricity there is highly subsidized. So in other words, that depletes groundwater in a really, really fast pace, and also means that we will have a water crisis in some of the especially northern Indian states much faster than many predicted. The same is true for the Midwest. You fly over and you see suddenly fields are all round. They are no longer looking like you would think an agricultural sort of land would look like. On the one hand, it looks like a piece of art, and on the other hand it’s clearly indicating that they have a challenge. So I believe that we need to move away from extracting groundwater in order to ensure our food supply, which also means—and that goes back to what Aaron said earlier—we need to have really good strategies as to where we produce food, how we produce food, what kind of food we are consuming. I think as long as we are consuming the amount of mammals we consume today as humanity, we’ll have a much bigger water problem than when it was a different diet. And these are all the questions that need addressing. My biggest worry is when in the midst of the water crisis also energy is subsidized in ways that just accelerates the depletion of major aquifers. SALZBERG: Yeah, I think just to add to that, at the end of the day it’s about reconciling demand with renewable supplies. And so ensuring that whatever extractions you’re making from groundwater or any sources are being replenished, and are being replenished at the same rate that you’re extracting. It’s balancing those two that’s critical. And groundwater is going to be an important part of climate resiliency going forward. Recharging of groundwater—you know, groundwater storage is a great way of—it’s much easier and much more resilient to store water underground if you can, than to sell it in big, large reservoirs that might be subject to evaporative losses. And so it’s an important component. But we really do over-extract it at a rate that’s just not sustainable in many places in the world. And in many critical places in the world—you know, the breadbasket in India—that we’re going to be in serious trouble if we continue to allow those trends to continue. Sorry to be redundant. GOODMAN: OK. Alexis, I think we—I understand we have two questions left. Let’s take both those questions and then we’ll ask all of our panelists to answer them and provide their final comments in our last four minutes. OPERATOR: We will take our next question from Joseph Bower. Q: A very simple question. First, thank you. It’s been fascinating. I’m surprised that there hasn’t been more talk about pricing water. That really one of the—it is obvious that you would then have to provide the poor some way of paying for it. But the simplest way of getting control of this is to price it. We’re taking groundwater and other water and giving it as if it were cheap, rather than expensive. And I mean, Israel had a terrible water problem until they priced it. And then they had to do other things as a matter of policy. Thank you. GOODMAN: OK. Let’s take our next question as well, please. OPERATOR: We’ll take our next question as a written question. NASA just announced a mission to survey global water sources from space. What are your expectations for this mission and what it means for your understanding of water flows? GOODMAN: OK. Great questions. OK. Lauren, can you start with the answers to both those questions and your final comments? AUGUSTINE: I cannot comment on the pricing of water. I could guess and I could extemporize, but I won’t. On the—on the space question, you know, this is—this is one of these wonderful examples of human innovation and engineering prowess. But if we think it’s hard to move water through pipes on Earth, I think it will be extremely expensive and difficult to do it from space. Not impossible, and maybe that is the final frontier. I think it’s an exciting idea and we’ll have to see where and how we can be creative in basically creating new water. And so maybe an extraterrestrial source is in our future. I don’t know. GOODMAN: Matthias. BERNINGER: Let me start with the pricing. There’s a reason that’s similar to the reason for carbon pricing why in the political world folks have difficulties to kind of really impose high prices on both carbon and water. And that is because they get hammered in the elections for doing that. The business community has a bit more freedom here. And we have introduced an internal price for carbon, started with our own operations. We are now moving to our suppliers. And we will do the same on water. And I think that’s a way in the business community to really bring water into the boardroom conversations in ways it is currently not. On the second topic, the GRACE mission NASA is undertaking, which helps us to really understand water flows as well as the current state of aquifers, is the one that excites me much more. Because it helps to put a much stronger focus on depletion. And if you add to it the IPCC work on soil moisture, which is both scary but also very helpful, you really have two very good data points in managing water. And it’s a good foundation for what Aaron talked about, much better water information systems. Last point, I’m actually more optimistic that the topic will get more attention because in Sharm El-Sheikh people decided to combine mitigation and adaptation. Whereas mitigation is all about carbon or carbon equivalents, adaptation is all about water. So as this topic now reaches much more prominence on the climate agenda, I do believe you will also see more energy to focus on water in different ways. SALZBERG: Yeah, so just to follow up, yeah, I’m not sure I share Matthias’ optimism. But on costing, look, this is a really big challenge with water, as to whether it’s an economic good or a public good. And we have this tension that exists. And it’s a real, real problem. I mean, one thing, though, we have to recover the full costs of providing water services. And so whether that’s through the charging of tariffs, whether it’s through taxes, whether it’s through transfers of resources from one sector to another, we’ve got to recover the full costs. And service providers need to be able to operate sustainably—financially sustainably. And that’s critically important. What I’m more concerned about is that we don’t internalize the costs of other production processes on water. And so, for example, we’ve talked about farming. We’ve talked about chemicals. We’ve talked about industry, and stuff like that. We have to remove those things from water to make water palatable to drink again. And so how do we tax then and make sure that the goods that we’re buying—you know, if we’re buying a mug, or if we’re buying a computer, that the costs and the impact that that’s had on our water supplies is integrated into the cost of that product, so that it can get back to those then people who are responsible for cleaning our water. Thank you to whoever asked the question about SWOT. Sorry, if people don’t know about SWOT, you really do need to know about SWOT, the Surface Water and Ocean Topography Mission, which is supposed to be launched today. It’s been postponed for twenty-two hours due to some condensation issues. Hopefully it gets launched tomorrow. This is going to transform our view of the world’s water resources. We are going to know, down to an Olympic-sized swimming pool, what water exists, what surface water exists everywhere on the planet. And everybody will be able to see it. And if we do the right calibrations, we’ll be able to measure discharge rates for every river system—something that we’ve never, ever been able to do. Imagine what that’s going to mean for our transboundary disputes, right? That means Vietnam, Cambodia, Laos will know what the reservoir levels are for every single dam in China and how China is managing those dams. Pakistan will be able to do the same thing for India. Egypt will be able to do the same thing for Ethiopia. All of a sudden, a veil is going to get lifted across the world overnight. And I think that’s going to be transformational. It's also a huge, missed opportunity by the United States. The United States, France, the U.K., Canada, they’re all responsible for this mission. That’s four of the G7 countries. You know, they should—SWOT should be a major initiative within the G7. The SWOT and its data products should be a major initiative that’s launched up at the U.N. in 2023. And we should be mobilizing partners from across the business sector—IBM, Google, and others—who can provide the graphical user interfaces for the consumers on the ground to utilize and access that data, all the way through to the universities, the University of Massachusetts, UNC, others who are providing the software to be able to translate the NASA data into meaningful water metrics. It's a huge opportunity that’s being lost right now by the administration not jumping on it. And I guess if that’s the last message I have to leave with, leadership—there’s really a lack of leadership here. And if the United States is going to capitalize on what’s going on in the U.N. and elsewhere, we need to step up. GOODMAN: OK. Thank you all very much, to our panelists and our participants, for joining us today with such an exciting discussion. We went a few minutes over, but thank you all for staying with us. SALZBERG: Sorry. AUGUSTINE: Thank you. BERNINGER: Thank you. (END)
  • Tunisia
    Tunisia’s Election, U.S. Congress Seeks to Avert Shutdown, World Cup Ends, and More
    Podcast
    Tunisians will vote in the first elections since the adoption of a new constitution that critics say is antidemocratic; the U.S. Congress rushes to pass a spending bill to avert a government shutdown; and Argentina and France compete in the World Cup final as host Qatar faces international scrutiny.
  • Russia
    Ten Lessons from the Return of History
    As 2022 comes to a close, there are important lessons from the year that we ignore at our peril.
  • 2022 in Review
    Five Elections to Watch in 2023
    Numerous countries will hold elections in 2023. Here are five to watch. 
  • Cybersecurity
    Fortifying Cyber Infrastructure
    Play
    Tarah Wheeler, senior fellow for global cyber policy at CFR, discusses the bipartisan Infrastructure Investment and Jobs Act (IIJA) and ways to improve state and local government cybersecurity and critical infrastructure systems. TRANSCRIPT FASKIANOS: Thank you. Welcome to the Council on Foreign Relations State and Local Officials webinar. I’m Irina Faskianos, vice president for the National Program and Outreach here at CFR. We are delighted to have participants from forty-six states and territories for today’s discussion on “Fortifying Cyber Infrastructure.” Thank you for taking the time to join us. Today’s discussion is on the record. CFR is an independent and nonpartisan membership organization, think tank, publisher, and educational institutional focusing on U.S. foreign policy. CFR is also the publisher of Foreign Affairs magazine. And, as always, CFR takes no institutional positions on matters of policy. Through our State and Local Officials Initiative, CFR serves as a resource on international issues affecting the priorities and agendas of state and local governments by providing analysis on a wide range of policy topics. I’m pleased to be joined today by Tarah Wheeler. Her bio we shared with you in advance, but I will—I will give you a few highlights. Tarah Wheeler is senior fellow for global cyber policy at CFR, and CEO of the information security consultancy Red Queen Dynamics. She’s also had positions as a contributing cybersecurity editor at Brookings Institution, cyber project fellow at Harvard’s Belfer Center for Science and International Affairs, and very much more. She was also a U.S.-U.K. Fulbright scholar in cybersecurity, and she is the author of the bestselling book Women In Tech: Take Your Career to The Next Level With Practical Advice And Inspiring Stories. And I commend that to all of you. But today’s discussion is on cyber infrastructure. Tarah, thank you very much for being with us. Perhaps you can talk about there were some provisions in the bipartisan Infrastructure Investment and Jobs Act for strengthening cybersecurity and cyber resilience at the state and local level. It would be great if you could talk a little bit about that, and what officials should be thinking about when they get those funds, how to use them, how to think about cyber policy at the sub-national level, and how important it is in all of these communities across the country. WHEELER: Thank you so much, Irina. It’s just a real pleasure to be here today. As always, the Council on Foreign Relations is doing an incredible job making sure this information gets to the people who need it. And it’s a joy to be here with you all today. Thank you so much for the work that you do in our state and local governments keeping us safe. I am honored and humbled, and I hope I’ll be able to provide some context today and some of the fun esoterica—(laughs)—of the infrastructure act that we’re taking a look at today. I think the top thing that really crosses my mind as I first read it is, first of all, this is a bill sponsored by Rep. DeFazio, from my home state of Oregon. So good things always come from my beautiful home state. And I’m glad to see that this is certainly one of them. I’m glad to see that the Biden administration is focusing on improving our safety and cybersecurity infrastructure. So if you are running a state and local government—if you’re running, essentially, a non-federal government, as I think most of you already know, there are—there’s a grant program that’s coming out from this bill that was approved and passed a month ago. And there’s about a billion dollars that’s available over the next four years for you to apply for, to try to upgrade your cybersecurity posture, your stance. So the question is, do we all go shopping for purses, or do we figure out how to get some of this money allocated in a fashion that lets us really start to drive towards the challenges of local governments in cybersecurity. There’s really a lot of—a lot of questions people have been asking me about over this one. And maybe the number one thing is, should we be thinking about this on, like, a population level? Larger populations should receive a greater priority? Or should we be thinking about this sliced differently, kind of orthogonally, at a sectoral level? For instance, dividing it up amongst health care, power facilities, water facilities. Is there—is there a difference in that grant set and, for instance, tribal grants for cybersecurity and infrastructure? And it certainly does look like we’ve managed to separate this out into a really smart package of grantmaking not only bodies, but slicing it in multiple different, important ways. So if I were you, the first thing I would do is ask myself: Who’s giving me advice about how to spend this money? Because filling out grant applications is a time-consuming process, as I think basically everybody on this call already knows. It takes a lot of energy and effort to set this up, right? So are you applying for the right thing? The very first question I’m going to ask you is this: Have you asked the people inside your organization—whether it’s a municipality, a county government, a state government—have you meaningfully asked everybody in your organization the question: Is your work and home email password different? If you know, the answer to that question and you’re sitting on this call right now and you say to yourself: Yes, we’ve addressed the question of password sharing, of multiple account takeover, of business email compromise. We’ve fundamentally addressed that question, then we have a different conversation to have. I’m not actually sure if we’re able to do something along the lines of a poll in this Zoom or not, but I would sure love to see some feedback on this from you folks. It’s OK if we can’t but think to yourself this question. If you can meaningfully have visibility into whether or not your users have strong, unique passwords for every different account stored in a password manager or not, that’s the break point. If you’re not there yet, that’s where you need to get to. That’s the very first step, ensuring that you’ve got users using strong, independent passwords. That’s your first defense against not only business email compromise, but the growing threat of ransomware. It’s still growing. It’s still getting—the ransomware threats are still doubling every year, year over year, with really no end to that in sight unless we make some very serious changes. One of the key ways that ransomware hits systems is shared passwords. Now, if you’ve gotten to the point where you have meaningfully addressed the question of whether or not your users are using unique passwords stored in a password manager, your next step right after that one is multifactor authentication. Do you have your users using app-based multifactor authentication to have a multiple factor to log into accounts for state and local governments, for all the systems that you’re—that you’re administering? If you do, then what are you doing on this call? It’s happy hour time for you. Get out of here. You’re doing great, comparatively speaking. No, in all seriousness, those are really the two break points I see: Do you have visibility into passwords? Do you have visibility into multifactor authentication? After that, you can start going to topic-based areas in cybersecurity that are based on your threat model. So that’s really the question I’m going to have for you, and I want you to be thinking in those terms. At what level do you find yourself in that sort of hierarchy of cyber—the Maslow’s cyber hierarchy of needs on this one right here? And based on that, we can start with questions about how sort of we slice this budget and this grant up in ways that are most meaningful to you? Does that help us as kind of a starting point, Irina? FASKIANOS: It does indeed. So can you talk a little bit about, you know, state and local governments most notably have been the target of ransomware attacks in recent years. So the risks—what are the risks on not doing this? You know, on not having appropriate cybersecurity protection measures in place? WHEELER: So a couple weeks ago one of the most devastating data breaches, I think, honestly, in history, happened in Australia. In Australia, a couple of weeks ago Medibank was—experienced a massive data breach. And 9.7 million patient records—now, remember, Australia’s got a population of about thirty million people. We’re talking a third of the population. And when we talk about a population-level event, this is one of the most devastating I’ve ever seen. This is the full and complete medical records of essentially every single person in the entire Australian health care system. These records went to things like reproductive health, mental health treatment, substance abuse issues. And the data breach was—the full analysis will come out, but it looks to be a question of inappropriate protections over things like passwords—over unique passwords and over multifactor authentication. When we talk about why this matters, about why we’re trying to prevent ransomware, about why we’re trying to prevent business email compromise, ultimately what we’re talking about is either preventing the theft of or the denial of the use of the kind of data that you use to run your organizations. If you do not have these measures in place, you are looking at the loss of records in your organization in the case of ransomware, or the theft of records, in the case of a data breach. Those two things are very different. Which should you be most concerned about as someone running an organization that likely retains a lot of official data over the people in your—in your area of jurisdiction. Doesn’t matter if it’s a city, if it’s a county, if it’s a tribal government, if it’s a state. If you are somebody who’s running an organization that stores this kind of data, ransomware is intended to deny you the access to the systems that you’re running. Data breaches are intended to steal and then profit off of the use of that data, whether that is literally blackmailing people whose data you now possess, or in the case of ransomware the promise to unlock that data and make it of use again to the organization in exchange for a payment. Typically, in bitcoin, although monero is growing in popularity. It’s a pretty solid choice. Zcash is another really good one to use for anonymity. And if you don’t understand the things that I’m talking about right now, how you pay, stuff like that, I think there’s call to dive a little deeper into the machinery and the economics of how you pay ransoms and pay blackmail for data breaches. But really in this case, the two major things you can do are get to a point of visibility on where you stand in terms of your user data and your—there’s a difference between user data meaning the cliental you serve and your internal users in your organization. Your internal users in your organization need to have that strong, independent password with multifactor authentication in place. But at the point in which you’ve done that, your next question is: How many computers do you have? I’m genuinely—think for yourself. Think about the answer to this question. Do you know how many computers you have, how many endpoints are on your corporate, your organizational, your business, your government network? If you don’t know the answer to that question, that’s the next question after that one. The question of asset inventory is no longer a question that solely belongs to the IT function in your organizations. It’s a major question when it comes to cybersecurity to provide some kind of visibility into whether or not you’ve got rogue devices on your network. The question I think, Irina, I’m going to try to repeat back again a little bit here, like, what is the impact of these kinds of attacks? It’s either to make money or to cause embarrassment, and then to make money. Ultimately, this is—this is about you being farmed, if you are an easy target, for quick cash payments. And it’s being done by people who really, genuinely, don’t care about the people you serve. I do care about the people you serve. I happen to be one of them, for probably a chain of people trailing on up through a couple of states in this country. And I want to see you, believe me, as safe as possible, because that’s my data. It’s everybody’s data in this country. So, yeah, that’s our—that’s our next step. And I’m interested in the technical side of sort of the steps that you’re at, but there are really good and interesting questions about industry-specific and sector-specific protections that can be put into place as well too. So does that help a little on that question? FASKIANOS: It does. And would you say that you would need—that people should invest in a person within the organization, coupled with an outside firm, that would help us—you know, rather than trying to build it from scratch? Somebody—a consultancy, or that kind of thing? Like, how do you—what is—how do you scale this, or make this tangible, and implement this at the state and local level? WHEELER: How do you implement this at the state and local level? So, first of all, it’s a great question, because it’s both complex and a simple one. If you’re—if you’re somebody like me—I want to be cautious here, because this is what I do, also. I’m a—one of the reasons I’m having this conversation with you folks here at Council on Foreign Relations and became a senior fellow here is that this isn’t just what I write about, it’s what I do on an everyday basis. So my company provides this kind of service. I mean, to set that aside for a second—and I’m just going to try to make sure we’ve covered all of the grounds. It is highly unlikely that if you were an organization that has fewer than 500 people in your organization, that you will be able to bring in house even half of the cybersecurity expertise you need in order to keep yourselves safe. It’s expensive to hire cyber—qualified cybersecurity professionals. There’s a reason why there’s a third—why third-party and service providers are there. And that’s because, it has been my experience, that an FTE, a full-time employee, in cybersecurity, as differentiated from just the IT function, doesn’t get hired till about employee number 150 in almost any organization. Now, that’s different in extremely high-tech organizations, but most of who I serve have haystacks, not tech stacks. So it’s unlikely you’re going to be able to bring a lot of the expertise in house. One of the things I’ve loved, I’m going to bring a lesson across the pond for you. One of the things I’d love to see, the NCSC, which is the—essentially the equivalent of CISA in the United Kingdom—CISA’s the Cybersecurity and Infrastructure Security Agency here in the United States. One of the things I’d love to see the NCSC do is they certify third parties for incidence response and cybersecurity provisioning at consulting. Which it doesn’t mean they recommend them. It just means they’ve passed a series of bars that says this organization is worthy of trust. You can go to them, and we know that they’ve handled incident response issues before. So I would love to start seeing something like that in the United States. I believe that moves are being made in that direction. I’ve heard of the possibility of that happening, of getting a little bit more of a sort of cyber civil defense force a little bit, if I can borrow, you know, kind of Craig Newmark’s phrase that he’s been talking about for a while. But just the idea that there are trusted third parties you can go to who have at least been rated and evaluated to give you—to give you a hand. So, yes, the service providers are out there. There is a wide range of skills and capabilities out there in third parties. If you ask smart people on the internet, they’ll give you good people to go to. And I want to be—I want to just be very cautious in how I phrase it, I’ve seen a lot of very good and very bad service providers. So when you go and evaluate them, make sure and have somebody who is also a trusted IT or cybersecurity provider, who’s not going to be that person, do an evaluation of who you want to engage with. They should have several things that you should find when you look at them. They should have a bunch of people who are qualified, and those qualifications can take a lot of different—a lot of different sort of—they can be manifested in a lot of different ways. I don’t mean college degrees. I mean people who demonstrate through their care, willingness to educate the public, that they are people who can and should be trusted with critical infrastructure. People who have the respect of the industry are a good fit. There’s a lot of wonderful cybersecurity third-party providers out there. And I want to be cautious not to just sort of also name all of my friends on this one too, but if you look for the helpers, like Fred Rogers says, you’re going to do—you’re going to do just fine when you find somebody locally. Now, I can also provide a recommendation if you get stuck and you don’t know what else to do. You can find four people. Look for your local college. And whatever respected college is a hundred miles away from you or less. Look for, you know, a research one university. Look for whatever state or tech university is near you. I went, by the way, to Portland State University. Go to Portland State University. That was where my master’s degree was. Go talk to the chair of the computer science department. Ask the chair of your computer science department to help you evaluate someone. Go look for your local ISC, or ISACA, or ISSA chapters. Those are information security professional associations. And ask someone from one of those chapters, perhaps the chapter president, to help you find a third-party provider. You can also go look for somebody in government. The CIO and CTO of most states have a pretty good feel for who in-state third-party providers are. And they often maintain an ad hoc list of who those people are, and who those trusted providers are. And finally, take a look and find out inside your organization, if you did a brief poll, if anybody knows people in information security and information technology, where they would go to ask for something like this. Those are four sources of good information you can go to, to ask for trusted providers as we wait for some kind of certification process for cybersecurity third-party providers for you. Does that help a bit? FASKIANOS: It does. So I’m going to ask one more question before opening up to the group. And, please, we’d love to hear not only questions, comments, and you can share what you’re doing in your community as well. So this is a really good time. We’ve found that people share across municipalities and it’s been very helpful. So at the top, you mentioned what kind of grant are you writing. So if you know the answers, you know, the passwords and all of that, great. But the second part is, if you do know that, then what is the other thing that you should be looking at? How to focus on cybersecurity at a—you know, at the different issues and sectors. So can you talk a little bit about that second part of what you mentioned? WHEELER: The hardest part of this is not just doing it as a one-off. It’s not just kind of once a year or once every two years in a cycle writing essentially a book-length report on how you find yourself doing, your stats, your sort of point-in-time perspective on how your cybersecurity is doing. Your hardest job at that point is to maintain continuous compliance integration. That continuous process of repeatedly fixing small things and nudging your security posture upward, that’s the next step. For that, even if you can’t hire somebody internally, or you can’t get the, eh, quarter-million dollars it’s going to take to hire a good, qualified person at a state and local level to come from private industry and run that program for you, you can take a tenth of that amount and start to get in the habit of asking a few questions every week or two that let you check on your cybersecurity posture and just do one or two things at a time. Keep that continuous process in mind and find somebody who’s willing to be your security champion internally. If you’re a thirty-person organization, find somebody that you can give a small pay bump to and give them the checklist that lets them figure out what’s going on in an ongoing basis and make that part of a quarterly report to you. Just start to decrease the amount of time that you go between those checkups to find out how you’re doing. And if there is absolutely nothing else that you can figure out how to do, and you have no money to do any part of this, you get denied for every grant, just do one thing for me. Turn on automatic updates on every machine, everybody’s phone. Most of you folks, if you’ve been issued a government phone—it could be an Android, it could be an iPhone. Turn on automatic updating on your phone, and the next thing you do right after that is turn on automatic updating on your Windows or Mac machines. You’re probably on Windows machines, I’m going to guess, many of you. Turn on Windows Defender, and don’t ignore the prompts if it tells you to do something. Yes, I know it takes forever to do the update cycle. That’s the thing that’s going to keep you the safest, automatic updates. If you can’t do anything else, do that. Keep your patches up to date. FASKIANOS: Great. Thank you. I am going to open it up to the group, and then we can continue talking. But I really don’t want to—I would like to get to the questions. And you can—we would love to hear from you. And do not be shy. And if there are no questions, I will—that means that you’ve been—you’ve been so thorough. (Laughs.) So if you want to ask a question, you can click on the raised hand icon, and accept the unmute prompt when I call on you. And you can also write a question or comment in the Q&A box. And if you do that, please include your affiliation there so we know what state and where you’re coming from. It just really does help give everybody context. OK, so the first question, raised hand, is from Gail Patterson-Gladney. And please unmute yourself and tell us who you are. Q: Yes. Hello. I’m Van Buren County commissioner. I served for six years and just recently got reelected. And before I served as county commissioner, I worked for the city of South Haven. And I was told in a conference in the Michigan Municipal League that we should not use our personal cellphones for our emails. In the county, it seems to be different. We can go ahead and open our phones and use our emails. Which is the safest way to use our personal phone? WHEELER: That is such a great question. Thank you so much. And congratulations on getting reelected, Gail. Nice work. (Laughs.) So this is the—this is the way I would proceed on that one. It’s a hard question, because I understand the lack of budgets that can lead to you not being issued a phone to conduct work business on. And if you’ve been expected to use your phone, your personal phones, to get your work email, one of the most important things you can do is, like I said, make sure that your passwords on your work and home email are different. And I want to make sure that I’m very clear on that one.  The password I’m talking about isn’t the one to get into your phone. It’s that you’ll set up two different email accounts on your phone. Don’t forward your work emails to your home email address. And open only those home emails on your phone. Does that make sense? I want to make sure that I’m clear. And if I’m saying something you know, I’m so sorry. I just want to make sure I’m clear on this. Does that make sense, first? Q: You said don’t forward your county emails to your personal accounts, like Gmail or Yahoo accounts? Like, personal ones? WHEELER: Yeah. Make sure—yeah, don’t forward your work emails to your personal address. So, for instance, like, my email address might be [email protected]. And when I view my [email protected] emails, even if I’m looking at them on my personal device, I’m not inside Council on Foreign Relations forwarding those emails to [email protected], and then only opening up the Gmail app, and reading my tarah@gmail(.com), and seeing the forwarded emails from my work email. Don’t do that. Does that make sense? Q: Yes. WHEELER: OK. The thing that you do is you go into settings, whether you got an Android phone or an iPhone. You’ll go into settings—let me see if I can just find this real quick. So there’s going to be—there’s going to be a setting in here. It’ll be called general—or it’ll be called—you’ll see where there’s probably something in here called “mail.” So, yeah, inside your iPhone there’s going to be—or in Android—there’ll be a setting called “mail.” And what you need to do is you need to go to this thing right here—see if I can just cover this up a little bit—you’ll see “accounts” in here, OK? Make sure you got two different accounts in there. One’s your work and one’s your home. So you want to make sure that when you’re logging not your work emails, that you’re seeing your work emails as a separate account than your personal emails. I hope that makes sense. And, you know, we can also put a blog out there to help people understand that a little bit better. But the thing that we’re trying to do is make sure that you don’t mix all of those emails up together in one big data pool that’s on your personal email, so that if someone breaks into your personal email, they can see all your government business. Does that make sense? Q: Yes, except for I thought because I have two different email—let’s say I have my government Gmail and then I have my personal Gmail. I thought that separated them enough when I bring up Gmail. WHEELER: So, OK, it depends on how you have your phone set up. But the thing that we want to make sure is happening is that you have two different accounts set up on your phone, as opposed to you forwarding all of your work emails to your personal email address. And if that’s not clear, I want to make sure we got enough time to answer everybody’s questions, but, Gail, also if you want to I’ll help walk you through that. Yeah, and what we’re trying to do here is make sure that if you lost access to either one of those accounts, it wouldn’t mean that you lost access to other. So that’s what’s really important. Now, ideally—in an ideal world, you’re being issued a work phone that you just have work stuff on. Let’s be realistic. Most people aren’t busy getting a $1,000 iPhone for their jobs, right? So that’s the ideal, right? And we’re not sitting in Silicon Valley here. So you’re probably being expected to answer work emails on your personal device. And just making sure that when you have your work emails that you don’t have a setting in your work web or email client that’s forwarding those emails to your personal email address. And we can go into that a little bit more later, but your IT person can probably make sure that you have two different accounts set up on your phone. If you have two different accounts, and you’re viewing them separately, you’re as good as you’re going to be in this situation. Q: OK. Thank you very much. I’ll check with my IT person on that too. WHEELER: Wonderful. FASKIANOS: OK, I’m going to take the next question from Danielle Schonbaum, who’s the finance administrator of Shelby County in Tennessee. And Danielle had a raised hand, put it back down, and put it in the chat. But I would love—we’d love to hear from you directly. So if you want to accept the unmute prompt, that would be great. Q: Sure. Hi. Danielle Schonbaum, Shelby County government. I was just curious about any thoughts you had on cyber insurance. GFOA magazine had a pretty extensive article in the last month or so about some of the pitfalls of cyber insurance and, you know, what it really covers. So just— WHEELER: Well, do you want my thoughts, or do you want my opinions? Because my opinions are funnier, but we should probably start with the thoughts. OK, so the first thought I have here is that cyber insurance is incredibly important. And here’s the reason why: Cyber insurance is really the first sort of attempt that the finance and international regulatory community has really made effectively to price the risk associated with doing cybersecurity poorly, or inappropriately. After the creation of fire insurance, home fire insurance, the number of house fires in this country dropped massively because fire insurance companies figured out very quickly that they could incentivize with their pricing homeowners taking certain steps. Like, making sure that their stoves were located away from the house, or fully tiled, or moving to—away from open flames and open gas flames, to contained sources of light and heat. Moving to baseboard heating away from radiators, that kind of thing. So the insurance company figured out what that risk would look like for a homeowner. And they managed to make it expensive to make choices that were more likely to get you burnt down, and cheaper if you made choices that were less likely to get you burnt down. Cyber insurance is the very beginning of that process right now. If you make choices, like having automatic patching turned on, or using multifactor authentication, or certainly in the case of Gail where you have different devices where you separated out work and home email for people who are employees, those choices mean that cyber insurance programs are going to price safer choices cheaper. So there’s a lot of different providers out there, and it’s still kind of a wild west situation with it. But that’s really important, that they’re doing that. And beginning to stick an actual number on the value of making certain kinds of choices in cybersecurity is the real value of the cyber insurance industry. Are they good at it yet? Some people are better than others at it. I’ve walked clients of mine through the cyber insurance application process before. And the checklists are still really, really—they’re very basic still. They’re still asking questions like, “What kind of encryption do you use?” That’s not a meaningful question for a thirty-person accounting firm, right? Because you’re using Office 365, or you’re using Google Apps, or whatever you’re using. And the answer is, I mean, I guess we use some? There’s a green padlock when I look at my computer, right? That’s the answer to that question. And it’s not that the people who are answering these questions are dumb. It’s that they have a different skill set than those of us who are answering these more specialized questions in cybersecurity. And sometimes the people who design these questionnaires in cyber insurance are sort of copying the patterns they used from homeowners’ insurance, and rental insurance, and auto insurance, without realizing this is a really different world. There’s no independence of risk in cyber insurance. And what I mean by that is, if you house burns down that doesn’t mean your neighbor’s house burns down, even if they have the exact same house and the exact same floorplan, right? In cyber insurance, two different clients who have the same, essentially, floorplan, the same network, the same updates, the same vulnerabilities, if one of them gets hacked the other’s probably going to get hacked as well too. Which means that a cyber insurance company has to figure out how to price risk not only for a single entity, but across an entire spectrum of an industry that likely all has the same version of the same kind of software all the way through it. So that’s the problem we’re tackling. And people who are evaluating businesses and organizations for cyber insurance, are still not really good at understanding independence of risk. A good example is, like, hurricane or flood insurance. If you get flooded, your neighbor gets flooded. There’s no independence of risk in that. If you experience a hurricane, so does your neighbor. House fire’s different. So’s flooding based on plumbing issues in a single-family dwelling, right? I think you can understand kind of the concept we’re going for. So cyber insurance is serving a valuable function. They’re starting to get to the price of real risk. But they’re not good yet at calculating independent risk for individual applicants. I hope that’s useful information for you. FASKIANOS: Great. Thank you. I’m going to go next to Isabelle LaSalle. I don’t know if you want to ask your question that you’ve written, Isabelle. I’ll give you a few seconds to unmute if you’d like. Otherwise, I will read it. And, yeah, and tell us who you are. Tell us who you are. Q: Hi. My name is Isabelle LaSalle. I’m a legislative assistant with the California State Assembly. I was just wondering if you had suggestions for steps that state legislatures can take to improve cybersecurity at the statewide and at the local government level. WHEELER: The CCPA of 2018 did more to make cybersecurity a thing on people’s minds than almost anything else. If you were there getting that being kicked through, thank you for your service. So the California Consumer Privacy Act of 2018 means that people now have to pay attention to what’s happening with data on California citizens, California businesses, anybody doing business in the state of California, data passing through California. It’s basically GDPR for California. The CCPA and the requirement now that companies put a privacy policy that clearly states how they’ll handle privacy policy and data requests from the general public on their website is the thing that’s backing most of these people up into saying: How do we know somebody’s data is deleted if they ask us to do it? And that right there, that question is doing more for most small businesses and most companies than you can possibly imagine. So you can just take the week off. You’re good. But genuinely, seriously, for those folks who are looking to find a way to spur action in their organizations, realize that if you’re storing information using a California company on a California citizen, doing business, storing anything in California—and, let’s be honest, much of the tech industry is located in California. Which means you should probably just do this right now. That’s the question that’s going to get you action because it needs to be public facing and it needs to be true. If you say that someone can send us a request and within sixty days we’ll respond, and within ninety days we will guarantee your data deletion, you better be sure that you are deleting that data. That gets you into what really matters, which is your data security and retention policy. So what can legislative assistants, what can—what can legislatures do across this country, what can anybody do in this particular case? Ask people if they understand whether or not data is getting deleted when you think it is. That is not a trivial question. It’s a technical, interesting question that backs up into heavy-duty applied physics and engineering in my field, in computer science. It does come down to sort of, like, what’s a practical definition of deletion? And there’s a couple of good working practical definitions out there, which is beyond the scope of this conversation. But there’s good definitions of data deleted, we’re pretty sure we’re good going forward from this point out. If you can get to that point, you have started to abide by really the spirit of the law, as well as the letter of it. And the CCPA of 2018, incredibly valuable bill. Thank you very much to the entire state of California for giving us all that kind of lever we need to have those conversations with people. And it can just start with, hey, we’re supposed to have a—we’ve got three employees in California. We’ve been storing data there in a data center. We know we’re supposed to have a privacy policy out by law, right? Otherwise, we could get into some trouble. So use that as a hammer when you need to. FASKIANOS: What other—can you cite other examples of states or municipalities that are doing cyber well, that you would—you would, you know, cite for other states and governments—local governments to look at? WHEELER: Two things. Colorado’s also passing a data privacy law. And some time back New York passed new regulations at DFS that meant that they were—they’re really closely losing at how data is stored, protected, and deleted. If you know what’s happening with your data, you’ve gone past the question of sort of user passwords, of multifactor authentication, of asset inventory, and you’re into the real, serious question. Which is, what are we doing with all this information we’re collecting? There’s—I mean, there’s not many state and local governments doing this really, really, really well. And nobody’s perfect on this one. California’s law in 2018 is a very useful one. And the truth is, that it makes a great deal of sense wherever you are in the United States to just abide by that, because it’s by far the most stringent one. So just start there, and you’re good pretty much every place else. It’s going to be important to see those laws passed, but the truth is we need to see a federal law. And if the—and if the federal government passed, honestly, a version of that CCPA 2018, we’d be in pretty good shape. Basically, all companies right now are squeezed between GDPR and the CCPA. And if you abide by both of those things, you’re doing pretty OK. Just because you’re a nonprofit or state and local government doesn’t mean you shouldn’t be doing those things. It just means you probably have a little bit more exception, wiggle room. Don’t take the exception. Try to do it right, if you can. And the answer is it’s hard to get this stuff through. There’s a lot of lobbyists that don’t want to be told what their companies can be doing with your data, right? FASKIANOS: And how likely is it that such legislation will be passed at the federal level? Is that—is that in Congress now? I mean, is—and is there bipartisan support to things that you can tell—you can talk about that? WHEELER: So there’s, in general, always a version of that privacy act sort of running around and trying to get—trying to get through. I couldn’t speak to the current state of what that looks like. And that’s mostly because, it’s my understanding—I’m not a congressional specialist in any way, shape, or form. But it’s my understanding that now with a split Senate and House, there’s less possibility of bipartisan legislation being passed in terms of privacy bill. But I will leave that up to the congressional scholars to address. The answer is, yes. Almost all the time there is a pretty good—a pretty good version of the bill, and a pretty terrible version of that bill, always sort of getting duked out in subcommittees. FASKIANOS: What would you say officials should be doing to raise awareness with their constituents of the importance of strong cybersecurity protocols? WHEELER: I’m not sure how much constituents need to have their awareness raised. This is—it’s sort like—it’s sort of like saying you need to raise the awareness of constituents about pollution, right? Like, we know. We pick up our own trash. But, like, what do you expect us to do about a river by ourselves, right? So I’m not sure how much the individual constituent can do about a river. If they have also the same strong different passwords and multifactor authentication, and they know how many computers are connecting to their home network, they’re already kind of doing what they’re supposed to be doing. At this point, it’s on you to start protecting them. So that’s a responsibility we’ve sort of taken up at this point. It’s a hard one, but awareness in this case, the thing I would say to not do is throw scare numbers at people. We already know what data breaches look like. Honestly, a lot of data breaches are—people get notified of them again and again, and it’s creating fatigue in them. Maybe instead of raising awareness, we need to be able to raise the sophistication of the conversation, especially at the state and local government, to raise confidence—not necessarily awareness, but confidence—in constituents that people are at the helm who know what they’re doing in cybersecurity. So set an example more than raise awareness, is a good way to put it. It’s a hard—it’s a hard task. But if you can do that, you’re doing the right thing.  FASKIANOS: And you have written that some of the money from the package will go toward establishing new Office of the National Cyber Director. So if you were advising that office, how would you suggest that they interact with state and local officials? And how would you want state and local officials to be engaging with that new office? And what’s the timeline for that office to be created, by the way? WHEELER: Well, the Office of the Cyber Director, if I’m correct, if we’re talking about Chris Inglis and the OCD is Office of the National Cyber Director, I’ve seen that $21 million allocation in there. They’ve done a wonderful job getting set up to have conversations about capacity building. State, local, tribal governments are all receiving some attention as we start to pay attention to grassroots-level building of cyber capacity. How would I advise them? I wouldn’t presume to. There’s some very smart people who are doing that work—Kemba Walden, Rob Knake, Chris Inglis, Camille Stewart Gloster. These are incredible and smart people who are doing this work. I think Camille is focused on workplace and cybersecurity capacity building. And how would we engage? I think they’re getting ready to start—sort of state taking more intake from the public, but they’re also beginning outreach programs. They’re just getting set up, right? This is—this funding, I think, was only approved as of a month ago. So I will look forward to see how they’ll develop a portal out for you. And I would imagine it’s going to be some way of taking information in and disseminating it as well. So the answer is, I think they’ve got to figure out where the light switches are first. FASKIANOS: And I will just note that Rob Knake used to be a fellow here at CFR. We were sad to lose him, but he—our loss and the government’s gain, for sure. WHEELER: Absolutely. FASKIANOS: I want to give people—yeah, absolutely. (Laughs.) I want to give people a last chance to ask questions. I have one more while we’re waiting for something to queue up. Do you think that the—that enough money has been appropriated to tackle this problem? I mean, is it a realistic amount? Or is it just a drop in the bucket? And you did mention—you said, how are we doing it? Allocating it by population, or needs, or whatever. I mean, what is the best path forward to sort of get these funds allocated in a strategic manner? WHEELER: Mmm hmm. I’d say that’s a great question. Before I start in on that, I want to just tell the folks in the room right at the moment, whatever your IT questions are—I loved Gail’s question earlier about how do I—how do I, you know, answer these questions on my personal device. If you have—like, I’m the IT person for a bunch of folks, right? Like, not just mom and dad. So if you have questions and you want to just take a minute and ask those questions now, can I just promise you right now there is no such thing as a dumb question. The only question here that’s problematic is one that you don’t ask when you could have asked now and gotten a quick answer from somebody. Please ask your questions. It doesn’t matter how—literally, where is the setting on my watch for this? Where do I click on my computer to fix the thing? Ask me. This is what I do for a living, so I am more than willing to help. And there is no dumb questions on any of this. You could also—do absolutely feel free to contact me. I think Irina’s going to have information up. I’m more than happy to just answer questions for you, if you want to. It’s completely fine. This is—this is fun for me. So but the question about whether or not—Irina’s, it’s, like, such a great question. Like, is this enough money? Is it too little? Is it too much? It’s like asking if the EPA has been allocated enough money to fight pollution. The answer is that it’s always going to be both enough—it’s always going to be too little or too much. And the reason why is, either it needs to be optimized someplace else, or it—the amount of money is enough to get started on something, but not follow all the way through with it. So the complexity of government budgeting—what do I know? I’m just a hacker. I couldn’t put together a government budget for you. But I can tell you, the complexities of that are beyond me personally. I would say that a billion dollars for the kinds of grants that need to be allocated at the state and local level, that’s enough money to fix three of your problems each, right? You could fix a couple, two, three, problems at that level. You can get $25,000, half—you know, a quarter-million dollars. You can get enough money to fix, like, -ish a few problems. It’s not enough to fix all of it. And I hope at least part of what comes out of this is not that you are fixing these problems by yourself. What I hope comes out of this grant process is a continuing collaboration with, what’s most important of all, networking with other people who are experiencing the same problems so that you can get an economy of scale in fixing these problems. So that you can collaborate on solutions. So that you’re building capacity not just technically but in your human capital, so that you learn these things and can share them with everybody around you. If this is implemented in that fashion, each one of you solving a few of these problems and sharing that information amongst every one of the people that you’re put in touch with, that does start to become a meaningful solution to the problem. And for that, there’s enough money to do that. There’s not enough money for all of you to fix all of your problems on your own without talking to anybody. You’re muted, Irina. FASKIANOS: Oh, your comment elicited a few questions. So from Patrick Whalen (sp). Patrick, do you want to unmute yourself? Or I can ask it myself? Q: Hello. Yes, thank you. My question, as I typed it out, may be a little confusing. But you mentioned not using scare tactics and statistics and numbers in discussing these subjects with constituents. And I wonder if you’d recommend a similar or different approach internally within offices? You know, I kind of get eye rolls when people see what my passwords are and just, you know, a mash of numbers, letters, and symbols, and that I change them trimonthly or bimonthly, you know. It’s kind of seen as alien. And so bringing up this subject internally—strategies, suggestions you have for that. Thank you. Very informative talk. WHEELER: Absolutely. Thank you so much. I appreciate it, Patrick. So, first of all, what I’m going to recommend is the guidance on changing your password quarterly has been updated at NIST. That’s the National Institute for Standards and Technology. The guidance at NIST has been updated to you don’t need to change your password quarterly. What you need is a super solid, strong, long password, paired with multifactor authentication. Changing passwords continuously is how you get passwords like summer22!, autumn22!, winter22!. Like, that’s how you get those passwords, and why that password process is really commonly associated with a lot of breaches. And it’s because very few people will change their passwords and store them in a password manager if they’ve got to change them that quickly. Or they won’t maintain them well. The guidance is to get people onto password managers at this point. There’s a lot of great passwords managers. LastPass. I personally use 1Password, because I can have a family vault that I share with family members, with my spouse. We can share, like, some financial passwords that are required. And they’re stored along with the ability to get to those devices that give us multifactor authentication, whether that’s a security key or an app-based authenticator. So how do you—how do you get to a place where you’ve advocated for this? Well, first of all, don’t advocate for the password changes. Advocate for password managers, not password changes. How do you get the attention of people internally? We are all in situations where everything’s burning down all the time. Those of you who are dealing with local governments that have municipal hospitals have nothing but problems all day long. And I see you and I feel for you and I sympathize for you. You’ve got devices inside local critical infrastructure that haven’t been patched in twenty years. And they are wildly vulnerable to all kinds of different attacks that—I mean, honestly, that’s the kind of stuff that we teach at the kiddie village at my information security conferences at this point. That’s how we get the kids started on hacking. So this—you’ve got—you’ve got a target-rich environment that you’re trying to protect, and nobody’s really helping you. Until now. I think genuinely there’s been a real sea-change over the last five years. And when you see the work that’s coming out of the National Cyber Director, coming out of CISA. If you need help with your administration to get attention on these issues, go to some of the latest guidance from CISA. It’s getting better over time. They’re doing a great job getting some of these advisories out. They’re still at too high a technical level to be of a great deal of use to your leadership, but hopefully you can translate it a little bit more for them. And if you can’t do that, find somebody who can, and get you to the level of, like, a football analogy or a cooking analogy, and that will help at least a little bit. You’re in—you’re in a tough spot. And there’s not a lot of money to solve these problems. If you can’t do anything else, get your executives to take a look at the most vulnerable members of the constituency that you serve, and ask yourself: If the most vulnerable members of your constituency are served by devices that are also the least updated and the least cared-for in your constituency. If the poorest people in our communities are being served by the most outdated machines at the local library, and the kind of terrible run-down sphygmomanometer, and, you know, the blood pressure thingy, those devices are the least cared for the and most out of date. You can at least tell your leadership that there needs to be an investment in the people in your community that need that help the most. That can be the way that you get a little bit more buy-in, and it give them that kind of air cover that they need. And then go get $25,000, go get $100,000, go get a million dollars to update the devices and the technologies that serve the people in your community that need it most and will likely understand it least. Chances are fairly decent, it’s some of your executives as well. FASKIANOS: (Laughs.) Excellent. Let’s see, there’s a new question from Stephen Courtney (sp): How do you feel about using biometrics or physical security tokens for access? WHEELER: Biometrics or physical security tokens for access. So there’s a thing that we talk about when we talk about authentication. There’s a thing that you know, a thing that you do, a thing that you are. A thing that you know, a thing that you do, and a thing that you are, are three different elements of authentication. A thing that you know could be a password. A thing that you are could be biometrics. And a thing that you do can be a process of a second factor, for instance, like a token for authentication. If you have a thing that you know, a thing that you are, and a thing that you do, and a thing that you are is involved with biometrics, it’s a thing that can’t change. So you want to be very cautious about using biometrics, because it’s a thing that is intended to be unique to a person, but once the information is leaked and can be duplicated, it can never be changed. You can’t go back from losing somebody’s retina scans and DNA. You can’t go back from losing somebody’s thumbprints as image files, if you’ve been storing them. Be incredibly cautious about that. Now, there’s a lot of very good, technical implementations of multifactor authentication that involve app-based authentication, they involved a physical token or security device. Like—hang on for a second here—this little guy right here is my YubiKey. I use this to authenticate myself—I know, it’s kind of teeny, right? You can barely see the little guy. FASKIANOS: How do you keep track of that? Oh my goodness, I would lose that! (Laughs.) WHEELER: It just stays plugged in. It just stays plugged into my machine all the time. FASKIANOS: Oh, OK, good. WHEELER: So there’s a lot of—there’s a lot of options. And, yeah, you can have those—you can have devices like this that can be permanently there. And what that device means is that if somebody asks me for my physical authentication, if I kind of touch that little thing and the string of letters matches what my app is expecting, they know I’m at my laptop. That’s my laptop key. Or, they at least know that I possess this, if I go plug it into a different laptop. Somebody who doesn’t physically have this key on them can’t get into stuff like my financial accounts. So are there problems with it? Sure. But is this a pretty good choice? I mean, this is what I have my parents do. So it should tell you something about what your options are. Don’t use retina scans, and fingerprints, and DNA. Just don’t use them. But use physical tokens as an option. FASKIANOS: Now I’m worried because now global entry is with a fingerprint. And CLEAR is with an eye scan. (Laughs.) So are you saying not to use those? Are those safe? WHEELER: I use CLEAR, yeah. I’m saying that—I’m saying that we have absolutely no choice about those. Don’t implement them if you can possibly help it. I don’t like it. But let’s be honest, the airport is an incredible coercive environment. There’s no—for all intents and purposes, you cannot not consent to anything anyone ells you to do in an airport, or you can, I don’t know, be locked in a tiny cell. Who the hell knows at this point, right? So be cautious about that and implementing stuff like that. Because once that genie is out, it’s out. And yeah, you pretty much need to use facial recognition to get in and out of this country at this point at any checkpoint. Can you opt out of it at gates walking onto an airplane to London? I’ve opted out before because I’m stubborn as hell and I want to see what happens. And the answer is—the answer I get from gate agents, they’re like, I mean, it’s fine. We just took your picture anyway. And they’ll wave me on. No passport. I’ll be like, but I opted out of facial recognition. And they’re like, I mean, what do you want me to do, look at your passport? I know who you are, Ms. Wheeler. So the answer is it’s already there. Don’t be the person who does it again badly and loses it. FASKIANOS: Got it. So if somebody, you know, I have two practical questions. If you—you know, we all know now clicking on links is a terrible thing and it can unleash some very bad things. If somebody within your agency clicks on a link, what should—what should be the next step? And then the second part is, if you have a ransomware attack or you are being ransomed, where should local officials go? What should be the first call that they make if they’re getting—if they have that situation happen? WHEELER: These are such great questions. There are two—there are two complicated questions. So I’m going to—the first question is what do you do, and the second is who do you call, I think. So the first question—clicking on links isn’t terrible. That’s the internet. You literally—that is the internet, Irina. Like, clicking on links is a good thing. It’s wonderful. If someone you don’t know send you a link in an email from an external—by the way, one of the best things you can do is turn on that little external email notice. If you have your local IT person, have them turn on the notice that says: This message is from an external source. If you don’t know what I’m talking about, go find out and fix that thing. That is absolutely a thing you can fix, and it’s a big defense against clicking on links that you’re like, oh, I feel like I know a John Smith from where the hell over in the next office. You know, I’ll check out what he’s sending right here. Somebody sends you a link that’s like final quarter, you know, executive salaries.xls, do not click on that. That’s never the salaries. It’s never the salaries. So if you click on something, do let your IT people know as soon as possible. But here’s the thing, there’s a lot of stuff in the media that shows sort of somebody clicking on a link and then somebody in a hoodie in the background—you know, that’s me, by the way. I’m the one in the hoodie—you know, typing away frantically, trying to break into your computer as you tapped on the thing. And if you just close the link quick enough like, oh, dang, I can step back and you see, like, somebody slams the lid of their laptop shut. Oh, we defeated the hackers. Thanks. That’s not how any of this works. (Laugh.) The second that you click on the link, the payload has been delivered. It’s done. It’s over. There’s no—there’s, no, oh, I should just close this popup really quick, and everything’s fine. It was only open for a couple of seconds. It’s probably fine. No. The payload has either been delivered or it has failed, and it happened the second that you clicked on the link. Or that the mail client that you were in evaluated the link to try to preload it for you clicking on it. So don’t worry about that second thing that I just said, just trust me on this one. If you click on a link, it’s over. It’s done. There’s no—there’s no kind of a little bit there. There’s no quick just shut it down. The second that the link gets clicked, the payload has delivered or it has failed. Doesn’t matter what you do at that moment. You do need to go talk to your IT person right away. If there’s one thing that you can do it is isolate your computer or your device immediately from the network. Turn on airplane mode. Don’t shut the computer down. Turn on airplane mode and remove it from the internet as fast as you can. That is different. That’s about the amount of data that can be transferred off of your computer. No whether or not the compromised happened, but about how much they can get from you. It’s, like, the bank has been broken into. That state has already been achieved. How much money can they get out, right? So this is what you’re doing. You can’t stop—they’ve already broken in, but you can slam the vault door shut. You must speak to somebody as fast as you can and get your computer cut off from the internet. That’s going to vary a little bit from person to person and from organization to organization. But please go ask your IT people what to do in the event, and how to turn on airplane mode or get your computer unhooked from the internet. If you’re not sure what to do, there’s a little Wi-Fi symbol probably at the top or at the bottom of your screen right now. If you click on that, you’re going to be able to see something probably called Wi-Fi settings. Click on that, and you’ll be able to—I’m trying to make sure that I don’t actually go offline right now—but there should be something in there that says airplane mode. Do that, and then if you also have a—it’ll look like a network cable, right? A little ethernet cable. Yank that right away. Then go talk to somebody. Not using your computer but go talk to somebody and find someone who can help you with that. That’s the first thing you do. The second thing is who are you going to call when this happens, if you’re an organization and you’ve experienced a massive attack? There’s a lot of—there’s several different answers to this question. The FBI has field offices that you can report this to. Be aware that the FBI is a law enforcement organization. Their job is not to protect you or keep you safe. Their job is to solve the crime of how this happened. And so they may be more focused on who the offenders are, how this happened, do you have evidence? And they tend to be pursuing this from the perspective of someone who’s trying to figure out if this is in their jurisdiction and if they can figure out who to go after. I would highly encourage you to report immediately to CISA, which is the organization—it’s not a law enforcement organization. This is the Cybersecurity and Infrastructure Security Agency. They also have field offices. They can’t necessarily dispatch incident response to you right away, but they can provide guidance about what you can do next, provide references, referrals, and technical guidance for people who can help you get yourselves set back up again. It depends on what you need to do and how quickly you have recovered from this, and if you’ve recovered from it. So the answer is, basically, FBI field office or CISA. It depends if you are a regulated organization. Maybe you’re health care and you need to report to HHS. That’s also very possible. They’re a regulatory body, so they can both help you and possibly penalize you. There’s a lot of weird incentives in our government. We’re working on it. So whoever you talk to, just be aware there’s a spectrum between can advise but can’t prosecute or regulate all the way over to can after the criminals or can regulate you depending upon what the nature of the breach was and what the level of responsibility you have for it was. It's a complicated question. It’s getting a little easier. And there’s starting to be a bit more of a cyber 9-1-1 at .gov. And I would highly recommend, of course, if any of you are not on the .gov system, that will give you a bunch of resources as well. If you are a state or a local government and your website is not on .gov as opposed to .com, .co, .org, whatever, go get on the .gov system. You’ll get a bunch of resources that will help you out with that, and where to go. FASKIANOS: Great. Thank you so much, Tarah. This was fantastic. And to all of you for taking part. Again, if you have questions, you have Tarah here who’s willing to answer them. She’s a fantastic resource. We’re so happy that she’s joined CFR. And obviously she’s still very much running her own company. We will send out a link to this webinar and the transcript. You can follow Tarah Wheeler’s work on CFR.org, on Twitter at @tarah. Very easy to remember. And as always, we encourage you to visit CFR.org, ForeignAffairs.com, and ThinkGlobalHealth.org for more expertise and analysis. You can also email us, [email protected], to let us know how CFR can support the important work you are doing. So wishing you all happy holidays. We will reconvene in the new year. So enjoy the holidays and happy new year in advance. Thank you again, Tarah. WHEELER: Thank you so much. It was absolutely wonderful. Thanks so much, Irina. It was a real pleasure. (END)
  • United States
    Renewing America Series: What to Expect From the Lame-Duck Congress
    Play
    Our panelists discuss the current lame-duck session of Congress, including debates over the spending and the debt ceiling, additional funds for Ukraine, and reforms to the Electoral Count Act, among other competing priorities. With its Renewing America initiative, CFR is evaluating nine critical domestic issues that shape the ability of the United States to navigate a demanding, competitive, and dangerous world.
  • United States
    Distinguished Voices Series With Dick Gephardt
    Play
    Former U.S. Representative Dick Gephardt discusses his distinguished career in politics, including his time as House majority and minority leader, his two U.S. presidential bids, and his work following his retirement from Congress. The Distinguished Voices Series focuses particular attention on the contributions made by a prominent individual at a critical juncture in the history of the country or the world.
  • 2022 in Review
    Ten Anniversaries to Note in 2023
    As 2022 comes to a close, here are ten notable historical anniversaries to mark in 2023.