CyberWire Daily at 10: Examining a decade of public-private partnerships. [Special Edition]

Maria Varmazas begins by asking Dave Bittner to define “public-private partnerships” in cybersecurity rather than assuming listeners share the same meaning. Dave describes cybersecurity as an “accident of history,” or perhaps an intentional arrangement, in which substantial capabilities, resources, and responsibilities are divided between the private sector and government. Those two silos must interact and support one another because private companies operate much of the infrastructure while governments possess authorities and intelligence that companies do not. Maria jokingly awards Dave a “gold star” for the definition. Dave says the basic interdependence was always present, but the way the two sides worked together has changed. Around the time the CyberWire Daily began, roughly 2016, collaboration was more episodic and relationship-driven: an incident occurred, people who already knew one another got on the phone, and they improvised a response. Information-sharing organizations and established relationships existed, but companies were often unsure what they gained by bringing the government into a crisis—and worried that officials might inspect their operations, create regulatory complications, or slow things down. Today, Dave sees more standing relationships and established channels, along with broader recognition that neither side can handle the problem alone. He also acknowledges that hiring people who moved from a “three-letter agency” into the private sector remains a practical way to gain access to government contacts, although that pathway has both advantages and drawbacks.

Dave does not identify one event that transformed public-private cooperation. Instead, he points to the accumulation of incidents that repeatedly blurred the line between private risk and public risk. He names SolarWinds, Colonial Pipeline, the rise of ransomware, and attacks on healthcare and critical infrastructure. In each case, something that began as a cybersecurity incident inside a private organization could become a national-security, economic-security, or public-safety issue. He says ransomware was especially important because it made cyber risk tangible to ordinary people. When a hospital cannot see patients or people worry about obtaining gasoline, cybersecurity is no longer an abstract problem confined to a server room. Those consequences pressured government and industry to build relationships before the next emergency rather than trying to create them during one. Colonial Pipeline was a particularly clear lesson. A ransomware attack against one company became a national story about fuel supplies, transportation, and critical infrastructure. Dave says executives saw that contacting the government might be more than a compliance choice for lawyers to debate: government agencies might have intelligence about the attacker, visibility into other victims, foreign-partner relationships, or response resources. Companies still reasonably fear regulatory exposure, litigation, reputational damage, and losing control of the process. But Colonial also demonstrated that once an incident reaches a sufficient scale, government involvement may be inevitable, whether the affected company wants it or not.

Maria points to the evolution from informal email lists and relationships that depended on knowing the right person to more formal structures such as Information Sharing and Analysis Centers and the Joint Cyber Defense Collaborative. Dave agrees that the “needle” has moved in the right direction, primarily because organizations have learned that relationships are difficult to build during a crisis. The first exchange of phone numbers should not occur while an attacker is actively inside a network. Standing partnerships allow participants to establish trust, understand what each organization can contribute, and work through bureaucratic friction before an emergency. Dave cautions, however, that putting a partnership on an organizational chart does not make it effective in practice. People change jobs, priorities shift, administrations change, and relationships therefore have to be maintained. Even so, having the machinery in place is far better than “reinventing the wheel” every time something catches fire. The speakers connect this lesson to the interdependence of modern infrastructure. Private-sector software operates on public infrastructure, and incidents such as Colonial Pipeline require a mix of companies, government agencies, and other organizations to respond. Dave says organizations must have the relevant numbers available and train and practice for major incidents. Government-private collaboration efforts already exist for large emergencies, and looking at what worked and failed during events such as Colonial Pipeline should help participants improve the next response. Still, the two sides operate under different laws, obligations, constituencies, and definitions of success: companies answer to customers, shareholders, regulators, and lawyers, while government agencies answer to the public, oversight systems, and political responsibilities.

Maria asks whether future organizations might put too much faith in collaboration, assuming that getting the government on the phone means the government can fix a problem that remains primarily private-sector work. Dave says people often overestimate what information sharing accomplishes by itself. Cybersecurity professionals have discussed information sharing for as long as he has covered the field, but shared information helps only when it is timely, actionable, and delivered to someone who can do something with it. Trust remains a central obstacle. Companies want to know what the government will do with information they provide, while agencies face legitimate restrictions on what they can disclose, particularly intelligence. Lawyers and legal concerns exist on both sides. Dave also emphasizes the resource gap: collaboration tends to work best among major technology companies and other organizations that already have sophisticated security teams, whereas a rural hospital, small manufacturer, or local government may lack the personnel and capabilities needed to participate effectively. Reaching those organizations is a much harder problem. The conversation then turns to the question of who is obligated to help. Maria compares a cyber emergency with a house fire: if someone calls the fire department, firefighters do not normally respond that the problem is outside their jurisdiction. In cybersecurity, however, much of the capability sits with private companies, which can choose whom they help. Dave says there are cases where that is appropriate, but there may also be situations in which government officials wonder why a company is not doing more even though they cannot require it. Collaborative government-industry response efforts can bring experts together during a major incident, but their effectiveness is shaped by each side’s different authorities and incentives.

Looking ten years ahead, Maria asks whether the government will take a heavier role in cybersecurity, leave more responsibility to the private sector, or act as a deputy for private companies. Dave says AI will force a reconsideration of existing relationships. If AI agents increasingly find vulnerabilities, authorize defenses, respond to incidents, or conduct offensive operations, cybersecurity will move even faster than it already has. Current processes often assume that humans have time to receive a warning, evaluate it, hold a meeting, make a decision, and act. Dave expects that sequence increasingly to become a luxury. The key future questions will be how government and industry coordinate when machines are operating at “machine speed,” which decisions can be automated, who establishes the rules, what happens when an automated defense is wrong, and how accountability can be preserved when institutions and their human overseers cannot keep pace. Maria calls the questions terrifying and observes that the issue extends beyond cybersecurity because it concerns how to maintain human accountability when humans are no longer directly involved in decisions. She also points to active geopolitical realignment and changing relationships among nations. Rules and standards established by one country or group may not be followed by adversaries, so the future of public-private cybersecurity cooperation will depend not only on AI but also on alliances, international expectations, and the strategic environment. Dave jokes that, ten years from now, AI avatars may be interviewing one another, but neither speaker offers a confident prediction about how the larger system will work.

Maria asks what each side misunderstands about the other after a decade of Dave interviewing government and private-sector professionals. Dave says both sides underestimate the constraints under which the other operates. Industry asks why government processes take so long, while government asks why companies will not simply provide the needed information. Each question sounds reasonable from inside the organization asking it. Companies must account for customers, shareholders, regulators, lawyers, and competitive pressure. Government agencies face laws, classification rules, oversight, procurement requirements, and political accountability. Dave’s recurring lesson is that cybersecurity technology is usually easier than the organizational problem around it. The technology remains complicated, but getting groups with different incentives, authorities, and definitions of risk to trust each other and move in the same direction is the continuing challenge. Maria adds that both sides may be pursuing their own definition of the public good, and that the incompatibilities become more pronounced as difficult decisions require sacrifice. Dave compares sacrificing a business department because sales are down with sacrificing soldiers for a strategic reason: both involve serious decisions, but the stakes and responsibilities are not equivalent. He nevertheless sees progress. After going through incidents together, participants have more trust, a better understanding of their respective roles, and more realistic expectations. He attributes this partly to the professionalization of cybersecurity: the field has moved beyond the lone “tech wizard” who mutters “I’m in” and now has systems, standards, and people progressing through established roles.

In his closing thoughts, Dave raises a question he says is not discussed often enough: what role should the federal government play in defending the nation against cyberattacks? He contrasts cyber defense with physical defense. In the United States, the military protects borders, including through the use of force if necessary, while cyber capabilities are distributed heavily across private companies. Dave wonders whether the government will eventually claim more responsibility or acquire more of the capabilities currently held by industry. He recalls a well-known cyber defender—whom he does not name—saying that some threat actors “deserve a missile through the front door.” Dave notes that direct physical, kinetic responses to cyber incidents have not become the norm. An attack on a hospital does not ordinarily result in a missile strike. He asks what would happen if a future government decided it had tolerated enough cyberattacks and introduced kinetic action as a regular response. He does not know whether that will happen and says he hopes these problems can be solved without unnecessary violence, but he acknowledges that people are gaming out those possibilities. Maria observes that distributed data, people, and infrastructure may make a direct physical response difficult, while noting that governments have sometimes considered targeting a cyber operation’s “ringleader.” She agrees that escalation is not outside the realm of possibility. Dave and Maria end by returning to the decade-long improvement in collaboration, while acknowledging that major questions about accountability, government responsibility, escalation, and the future of cyber conflict remain unresolved.