EAGER: Collaborative: Policies for Enhancing U.S. Leadership in Cyberspace

网络安全受到零日漏洞（以前未披露的软件漏洞，因此是潜在的攻击媒介）的威胁。对于潜在敌对国家的主要网络大国来说，这种威胁是严重的。公布零日漏洞可以增强国内网络基础设施的弹性（如果对手发现了相同的漏洞），它可以给其他国家提供主动修补系统的机会，增加他们不会被渗透的信心。然而，传播零日漏洞有一个明显的缺点，即该漏洞失去了作为武器的价值，因为各国可以修补自己的系统来抵御它。因此，发布的成本是在威慑和/或未来进攻性网络行动中使用此类漏洞的损失。最近，美国的政策开始着手解决政府已知的哪些零日漏洞应该被公布的问题，这既是为了加强国家安全，也是为了让其他国家对其产生信心。该项目分析了发布漏洞或补丁的各种成本和收益，并研究了如何通过政策或技术手段降低成本。在一项新的合作中，计算机科学家斯蒂芬妮·福雷斯特和政治科学家罗伯特·阿克塞尔罗德结合历史分析、技术研究、战略分析和计算建模，正在开发一种综合方法来解决迅速扩大的网络冲突问题。该项目侧重于美国政策可以在网络空间提供额外领导的三个领域：发布零日漏洞；为中立的基础设施（如与医院或宗教场所相关的网络）贴上标签，并制定保护中立网络空间的共同规范；维护互联网互操作性，使不同网络上的互联网用户能够不受干扰地直接通信。这一发现可能有利于国家安全，因为它为政策制定者提供了一种评估发布漏洞或补丁的成本和收益的方法。该项目为有关网络议程的辩论注入了新鲜而及时的声音，提出了减少国家行为体之间冲突的可能性和影响的具体措施。

Cybersecurity is threatened by the zero-day exploits (software vulnerabilities that have not been previously disclosed and are therefore potential vectors for attack). The threat is serious for exploits in the hands of major cyber powers that are potentially hostile nations. Publication of a zero-day exploits can enhance the resilience of domestic cyber-infrastructure (if an adversary has discovered the same exploit), and it could give other countries the opportunity to patch their systems proactively, increasing confidence that they will not be penetrated. Communicating zero-day exploits, however, has the obvious drawback that the exploit loses value as a weapon, because countries could patch their own systems to resist it. Thus, the cost of publication is the loss of such exploits for use in deterrence and/or future offensive cyber operations. U.S. policy has recently begun to address the question of which zero-day exploits known to the government should be published, both to enhance national security and to instill confidence by others. The project analyzes various costs and benefits of publishing exploits or patches, and studies how the costs might be mitigated whether through policy or technical means. In a new collaboration, computer scientist, Stephanie Forrest, and political scientist, Robert Axelrod, are developing integrated approaches to the rapidly expanding problem of cyber conflict, combining historical analysis, technical research, strategic analysis, and computational modeling. This project focuses on three areas where U.S. policy could provide additional leadership in cyberspace: publication of zero-day exploits; labeling of neutral infrastructure, such as networks associated with hospitals or religious sites, and shared norms to protect neutral cyberspaces; and sustainment of Internet interoperability, which allows Internet users on different networks to communicate directly without interference. The findings may benefit national security by giving policymakers a way of assessing the costs and benefits of publishing exploits or patches. This project injects a fresh and timely voice into debates about the cyberagenda, suggesting concrete measures for minimizing the likelihood and impacts of conflict among state actors.