We also have a sort of honeybee role where we fly around flower to flower proliferating the message and sharing information. We’re able to learn what products are out there. We don’t recommend certain brands, but we do recommend certain kinds of services.


What’s the administration’s position on holding vendors accountable for products that aren’t secure? And liability for products that aren’t secure?
Clarke: I think they’re two separate issues. One is holding vendors accountable, one is doing [something about] it in court. We’re in favor of holding vendors accountable. When a product fails, the vendor has a responsibility to quickly identify a way of fixing it and getting that patch out, and the patch not only should fix the problem, it should not interact badly with other widely utilized applications. But we don’t think it’s terribly valuable to litigate such problems. We’d like to try to find solutions that are quicker than long, multiyear litigation.

We spend a lot of time worrying about patches, but we don’t want to just put bandages on the current generation of systems. We want to think about what the next generation of systems should look like.


What would be the signs that things were getting better?
Clarke: It’s mostly anecdotal. You can look at the number of computer incidents; you can look at the dollar value of damage done by such incidents. Unfortunately the numbers are skyrocketing. That doesn’t mean we’re not making progress. If you look at traditional measures of effectiveness?the number of incidents and how bad they are?it would tell you we’re getting worse. The number of people and functions connected to the Internet is going up, and the sophistication of the attack tools is increasing. At the same time, we are getting the awareness message out, getting more CEOs to care, getting spending in security in the public and private sectors, getting the hardware and software manufacturers to develop more secure systems.

Then there’s the unknown unknown. Have our enemies already penetrated our critical infrastructure successfully and we don’t know it? Or are they in a position where, if there is a big conflict between us and them, they are already in a position to disable our critical infrastructure?


Who’s the "them"?
Clarke: We’ve stopped asking that question. Before Sept. 11, people tended to think in terms of a threat paradigm: Who’s the them, and when are they going to do it? They waited for that information before they acted. So, tell me the name of the terrorist group, what airplane they’re going to hijack, what city they’re going to attack. Tell me when it’s going to occur, and then I’ll do something to prevent it. We learned you don’t always get the information?the attack just occurs.