Julia Voo and the National Cyber Power Index

Transcript

Jonathan Reiber:
Welcome, viewers, to the sixth episode of the Think Bad Do Good podcast. Today we’re so lucky to have Julia Voo on the line with us. Hey, Julia.

Julia Voo:
Hey, Jonathan.

Jonathan:
Julia is in Plymouth… not Plymouth, Massachusetts. Have you been to Plymouth?

Julia:
The original Plymouth. The original Plymouth, Jonathan.

Jonathan:
Have you been to the new Plymouth?

Julia:
No, because someone just told me it’s a rock. And I was , “Why would I just go and see a rock?”

Jonathan:
Wait. There’s also Plymouth Plantation. So you didn’t go to-

Julia:
Oh, is there?

Jonathan:
Yeah. See this … In your Kennedy School reunion, you can go to the Plymouth Plantation. You’ve never heard of Plymouth Plantation, because you weren’t 12 when you were there?

Julia:
No, I haven’t. I haven’t heard of Plymouth Plantation. But I haven’t been to… What is it? It was the Cape, the nicer side of Plymouth, that area.

Jonathan:
Yes.

Julia:
My geography of America is terrible. Maybe it’s nowhere near.

Jonathan:
No, you’re exactly right. I just hope that nobody from Plymouth, Massachusetts, heard you say that, to say that it’s nicer where you are. But they probably know that. So she’s in Plymouth, England, which is in Sussex. Is that right?

Julia:
Devon.

Jonathan:
Devon.

Julia:
Now I feel better about my geography.

Jonathan:
Oh, gosh. Yes, you should. So Plymouth Plantation, for the record… And this is not what this podcast is about. Plymouth Plantation is this historical recreation. It’s like those Renaissance Fairs. And it’s an historical recreation of Plymouth. So you can go and eat a meal and see how they interacted with the Native Americans. It’s quite cool.

Julia:
Ohhh.

Jonathan:
So you missed out.

Julia:
Is it like that scene that they reenact in Boston every so often, this war scene of the Brits attacking and…

Jonathan:
A hundred percent. Yeah. And then, all the families sleep on one big cot, one big bed or whatever it is. Anyway, this is tangential, completely tangential.

So thank you for joining us today. Julia. Julia is, you’ll see, in the on the podcast page here and the links below… Julia’s a non-residents fellow at the Belfer Center, where she… Recently, you were the director for the China Project? What’s the name of the previous thing you did there?

Julia:
China Cyber.

Jonathan:
China Cyber.

Julia:
Called the China Initiative.

Jonathan:
Right, which for viewers obviously is something… China cyber is something to be concerned about. And she has just led the production and publication of Belfer’s National Cyber Report. Sorry, the Cyber Power Index, which is a study in countries’ comparative cyber power across criteria. So she’s going to talk to us about that.

Jonathan:
But before we dive in, so you’re at Kennedy School, and you studied at Harvard. So you have this background in trade, too. You had a career with the British Foreign Service, including a trade posting in Beijing, right after the end of Brexit. Tell us about that. What was that like?

Julia:
Yeah. So I was moved to the trade policy team just after the EU referendum. And I was in a little bit of like two lines. So first, I was sad, because I didn’t want the UK to leave the European Union. And actually, I remember I was in Beijing when the vote happened, and we’re all in a bit of shock. So then, we decided to do what we tend to do when we’re sad during the work hours, which is go and eat some dumplings.

So we’re at, this is my favorite dumpling restaurant.

It’s really good. You should go. Ooh, I think you have some in America. And we’re eating these dumplings, and then, my Chinese colleague just turns around to me, and she’s like, “What do you think of democracy now?” And I’m just like, “Ooh, that’s too soon,” and just continue shoving dumplings in my face.

Julia:
So I was new to the trade policy team, and that’s a function that the UK hasn’t had for four decades. And so I was a little bit curious. But I was in… Our team has six people. I was surrounded by amazingly talented diplomats, and we had this shared mission of wanting to make sure that the UK isn’t totally screwed, but then we also had this shared WTF is trade policy.

Jonathan:
Naturally.

Julia:
So we had to figure that out. And it was also a very interesting time, because the Cyber Security Law in China was just being drafted and implemented. A month later, the AI Development Plan came out. All this discussion around, “What is the social credit system?” So I was leading the trade angle on cyber issues.

Jonathan:
Mm-hmm (affirmative). Wow. That sounds totally fascinating and historical. And obviously for those of us watching who aren’t experts on trade policy, the reason why Britain hadn’t had a trade policy in China for so long is because all of the trade policy was done through the EU. Is that right? Or is it through the Customs Union, originally founded?

Julia:
Their trade is a EU competency, so we hadn’t had to do it in house.

Jonathan:
So that was outsourced to the EU for the last 40 years.

Julia:
Basically, yeah. Yeah.

Jonathan:
Huh. That is fascinating. So what was it like covering these issues in China at a time? What were some of your top takeaways from your experience in China doing that work?

Julia:
Well, so one is that, generally, from another country, considering their commercial interests, there are a lot of challenges for the China market, right? There’s a lot of market access barriers. There’s a very unlevel playing field for foreign competitors or foreign businesses. And then, trying to get my head around what that means. And then, when the Cyber Security Law came out and related things…

Julia:
I have a social science background. At the time, I’d been a foreign policy nerd in China for seven years. And then, you introduce these laws that have technical implications. And I could feel it was important, but I couldn’t quite understand, “What are the policy implications, like critical infrastructure.” “What does data localization…. What could it mean between countries and competitive advantage?” Or “What’s cryptography?”

Julia:
So it was, there was a lot of things coming to a head. And I found it really interesting, but also, I was curious to really get my teeth sunk into the more, specifically, what the cyber policy side of things meant for UK interests.

Jonathan:
Yeah. Nah, it’s so cool. So that’s why you decided to go to the Kennedy School? Is that what your goal was?

Julia:
Yeah, yeah, because I was like, “Okay. I feel like this issue is here to stay. I don’t know a whole lot about it, but I’m super interested.” So I wanted to find the place in the world where other people had thought about it more. And so, I found the Belfer Center at Harvard’s Kennedy School. And they focus on the intersection of science and international affairs, so they’ve got a really strong track record in nuclear policy. And Ash Carter is the head of Center. He’s a former DOD Secretary of the State and has a PhD in Physics-

Jonathan:
Defense.

Julia:
Yeah, sorry. I know that.

Jonathan:
It’s not you. I’m just clarifying for the world; you knew that. Of course you did.

Julia:
And, yeah, so I hung around there a lot when I got in.

Jonathan:
It’s amazing. I was there. I worked with Graham Allison as his course assistant in 2006.

Julia:
Wow.

Jonathan:
Yeah. Thanks Julia.

Julia:
No, no. He’s something of kingmaker, so I’ll keep my eye on you, Jonathan.

Jonathan:
Yes. Well, he tried with me, and all I’ve done is become a vassal coming out of his course… It was great.

Working for Graham Allison was excellent training for working for senior officials in government, because – and he might appreciate this if he sees this – but he sort of acted like a senior official in government when he was running Belfer. He once asked me before a class. We did this whole thing on climate policy. We were doing policy memos. So we [as his course assistants] wrote his policy memos for his course on for foreign policy making. And there was some question about… Anyway, it was a case on the environment [climate].

And right before class, he says to me, he’s like, “If we drop a certain amount of barrels per day, what’s it going to do with the price of oil in Saudi Arabia? Let me know by class.”

And class started in like six minutes. And I majored in religion.

I was like, “Come on, man. How am I going to figure this out? I can’t figure this out at all.”

But it does have this tradition of attracting some of the brightest minds in national security policy from across the spectrum. So you went there, and you got a job working on China cyber coming out of it. Is that what happened?

Julia:
Yeah, basically. Because when I just rolled up in Cambridge, Massachusetts, at the time, Michael Sulmeyer was the cyber director, and Harvard had just got this grant to start a Track II dialogue, which is a policy discussion, between the Belfer Center and a Chinese think tank.

And so, they just needed someone on the Belfer side to head it up. So I was heading up this Track II between former members of the PLA, Ash and Eric, the Belfer.

Jonathan:
That’s awesome. That’s such a good, important thing to do. Well, to the degree that you can offer lessons about that experience and your experience in the government throughout this conversation, I think would be good for us.

So, okay. So you’ve written this study. Actually you and… You seem to have attracted a remarkable amount of talent from across the British government, past and present, to help you with the study. So tell us about it. What were you trying to achieve and what were its objectives? And for those who are watching, again, on our podcast page, the link is right below. You can click on it. We’ll reference it here in a minute.

Julia:
Well, so it’s funny really, because obviously, as we’ve mentioned, I wasn’t hired to do this. And this came up, because I had just come out of an event, and I was with one of the other team members, Hemani, and someone in the talk had said, “Oh, the cyber superpowers are the US, the UK, Russia, Israel, China.” And then, I was just like… We’re just talking and I was like, “Why? What is it that makes them super and tips them over the threshold? And who’s number six? I never hear about who comes after these five powers.”

So we were just… I think I was a student at the time, as well as being the research director. And we’re like, “Oh, we should write something.” I saw the research director. He was a fellow. And I was like, “This sounds like a good report. We should write something together.” And I’m pretty sure, at some point, I was like, “This is great. This will be our first product. It will take us one month.” This was like a year ago. Fast forward, add four other brains, thousands of strategy documents, Excel spreadsheets and a lot of heated discussions… Here we are.

Jonathan:
Excellent work.

Julia:
So I was really bad at reading time.

Jonathan:
That’s excellent. You can ask Eric and Ash Carter some time about how long I took me to write the DOD Cyber Strategy. It was almost as long.

Julia:
You wrote that? That’s amazing.

Jonathan:
Oh, no. It wasn’t. It took too long. There were a lot of people involved, but, yes… That took longer than anticipated, the coordination process. But I think your report is of more long-lasting import.

Julia:
Oh, my god. I’m totally going to interview you for the next iteration. I’ll be like, “Tell us.”

Jonathan:
Tell us. Do tell us. But wow, that’s great. So it is a comprehensive report, and it obviously applied this element of social science rigor that I think is the hallmark of the Belfer tradition. I want to get into the study.

What did you think you really want to achieve? Was it an assessment, like a database assessment of who they are, so you can make a clear statement? Is that the main thing, or was there… Let me ask this question a different way.

Actually, you know what? Let me just dive into this one question here. Okay. You have a you have a point in the report. It says, “The most comprehensive cyber power is the country that has, one, the intent to pursue multiple national objectives using cyber means and, two, the capabilities to achieve those objectives.” 

That’s a great statement. “The most comprehensive cyber power is the country that has, one, the intent to pursue multiple national objectives using cyber means, and, two, the capabilities to achieve those objectives.” Can you talk a little bit about what that means? How did you come to that formulation?

Julia:
Yeah. So a “comprehensive cyber power” is our term for “cyber superpower.” And so this was, as it stemmed from that random conversation after the event, this was us trying to figure out exactly, what does it take to be the most influential state actor in cyberspace? And so, I guess, perhaps the most interesting part of our framework is that we consider the different ways that, over the years, states have conducted activities using cyber means to achieve their national objectives.

And so, we identified buckets of activities. And it’s not just offensive that seems to be at the top of the mind of most people and also national defense. There’s also domestic surveillance, censorship, intelligence gathering, just making money and also to shape global norms, like the UN and stuff, and also, technical standards.

So the first thing about this report is that we have said that states use cyber power to do these seven things, which is new in itself. No one had stated that as such in an academic context. And so, for us, the most comprehensive cyber power is the one that can do and intends to do all of these things.

So it wants to do them and it has the capability to do them. So I’m trying to think about how I could explain this most interestingly. Let me try it out on you, and if it doesn’t work, you can cut it, obviously. So imagine you’re a chef, right?

Jonathan:
Uh-huh (affirmative). Okay.

Julia:
That you’re a chef, and you’ve got an empty kitchen. You’re not going to be cooking anything. But if you’re a chef and you’ve got some ingredients, then you can make some things. And if I saw those ingredients, they’re going to kind of guess what you can make. But there comes a point, I think, where you don’t know what the hell is going to come out of the kitchen until you know who will play the chef.

So this is our inventory. What does the state want to do with cyber power and what can it do?

Jonathan:
No. That’s so important. That’s exactly right. I love that. When I first started working on cyber, it was after the Shamoon incident in 2012. Actually, it was right before. It was before Shamoon. It was after this other thing that happened, that’s been reported called the Olympic Games, people have written about. So after that, I thought, “Okay. There is this thing has just happened. Chances are the Iranians are going to go after Persian Gulf assets.” That’s just the first thing that came to my mind.

And so, I wrote a strategy paper about. It’s like, “How do we help the Persian Gulf shore up its cyber defenses?” And it gets to your point right there. It was an easy extrapolation.

It was the only time I ever prognosticated an international event, because a year later, obviously, they attacked with Shamoon. And we hadn’t done enough to help the Persian Gulf at that point. But it gets to your point. If you start with intent and the nature of the chef, then you can imagine, on the basis of past behavior, what this hot power might do from a cyber standpoint. Is that about right?

Julia:
Yeah, yeah, basically. That’s basically what it is. The thing is, a lot of indices, like military indices and other kind of indices in the past, that didn’t really consider the state’s intent.

Jonathan:
Yeah.

Julia:
Yeah, so exactly. But that’s so cool that you prognosticated it.

Jonathan:
It’s the one time in my life I’ve ever seen something coming. But now I’ve told the world about it, so guys send me money. Can you just read out the top ten for those listening by audio?

Julia:
Sure. Sure. So top ten from one to ten is US, number one. I hear this, too. Sorry. Said this to my American family, and the response was just, “USA! USA!”

Jonathan:
Yeah. Exactly.

Julia:
Sure. Sure. So, one to ten. Number one is the US. Number two is China. Number three is the UK. Four, Russia. Five, Netherlands. Six, France. Seven, Germany. Eight, Canada. Nine, Japan. Ten, Australia.

Jonathan:
There’s some surprises in this list, which I want to get into. But that’s a great list. Incredibly helpful. Can you tell us how are the US and China similar and how are they different?

Julia:
Sure. So based on our rankings, there are seven objectives, as I mentioned earlier. And the US tops four of these seven categories, and those are intelligence gathering, offensive, norms and information control. And then China tops, surveillance, commerce and defense. And this is the calculation where we’re looking at, “Do they want to do it? Can they do it?” And then, we also offer some more data points in the report, where we’re like, “Okay, so what do they actually do they just want to do?” And on intent, actually, China ranks higher, is number one.

So I guess in terms of the current great power discussion and stuff and the fact that the technology and this kind of competition is the center of the US-China tensions, it seems to be, I think, one of the things that people can take away from this report is there’s actually still a significant gap if we looked at our assessment of capabilities across all of the objectives. Even though China comes second overall, it’s still a substantive gap.

Jonathan:
What was the last point you made?

Julia:
Even though China comes second in this list of 30, there’s still quite a bit of a gap between the US and China.

Jonathan:
Yeah. There’s a question I was going to ask later, but I want to jump ahead. Do you see any… In your research, did you find any core investment areas that were driving the top tier players to elevate? Did there have to be a certain amount of education in information technology or were there ever tech companies clustered in a certain business or region, like here in Silicon Valley, or were there personnel trends that you noticed from an investment standpoint, over time, from a government… or maybe you didn’t look at those drivers as you did the assessment. I’m just curious if it came up at all.

Julia:
Yeah. No. There were definitely. Well, so, let me just have a look. So you’d obviously, like the… Not obviously, but you did rank highly if you had a lot of large international technology companies. Also, we noticed a trend in strategies across the board where governments were developing specific cyber defense and offensive teams. So there’s specific resources being put aside to grow those capabilities in the military and across government.

And another thing I think is that some people might forget is that our index considers how cyber capabilities can also be a weakness. So a smaller attack surface…. Like a large attack surface on our ranking actually counts against you, because it’s harder to defend. And so, for example, I think that’s probably one of the reasons why Singapore ranks very highly on defense, and also the Netherlands.

Jonathan:
That’s why Singapore ranks highly, because it has a smaller attack surface. Is that why?

Julia:
Yeah.

Jonathan:
That’s fascinating. So the smaller attack surface of Singapore and the Netherlands is what elevates them into the top ten.

Julia:
Well, so Singapore’s not in the top ten.

Jonathan:
Oh, sorry.

Julia:
I think I’ve gone on a tangent based on your question.

Jonathan:
No, no, no. You’re doing great. It’s perfect. All right. Singapore’s not… Where is Singapore? What number is it, Julia?

Julia:
So I have a rule… Singapore… Let me just pull up the longer list.

Jonathan:
You didn’t go on a tangent. I put it in an alternative fact and moved them onto the list.

Julia:
So Singapore’s actually pretty far down the list, but on defense, specifically, I think it’s in the…

Jonathan:
We’re getting a really good shot of Julia’s ear at the moment.

Julia:
Sorry. I forgot there’s a camera there.

Jonathan:
Hilarious. We’re definitely not cutting this. We’re not cutting this. It’s too good.

Julia:
I can’t really… Sorry, this is really small. But I remember when we were going through-

Jonathan:
No worries. Yeah.

Julia:
…assessments and stuff, that was something like how much connectivity. They were both given bad points in our ranking.

Jonathan:
Well, what’s interesting is the US comparatively… US and Japan and the UK, if I was guessing… Last time I looked at these, this was a little bit ago… would be the three of the most user populous on the list… France, too. So the US must have invested really significantly in other areas to counteract the sheer size of its attack surface.

Julia:
Yeah. I mean, the US trumps… It’s super strong in a lot of areas that lifts their overall average. Because when we’re talking about the ten, we’re talking about across all of them. So that’s why there’s a bit of balancing out.

Jonathan:
And so, what has the Netherlands done? This is just mind boggling to me. It’s like cyber weed, is that what makes it the mean? It’s no longer unique. It used to be that in Amsterdam, that’s why they went there, to get stoned, but now…

Julia:
Ahhh, now I get it. I’m so slow.

Jonathan:
Yeah, but this is fascinating. Windmills? That’s not going to do it. Sorry for all of our Dutch colleagues watching this. I don’t mean to be a jerk. So small attack surface, but what have they done to differentiate themselves, to get a… What number are they? Six? Is that right?

Julia:
Oh, god. You’re going to see my ear again.

Jonathan:
No, never mind. They’re on the list. What have they done to get there?

Julia:
Well, so yeah, Netherlands is one of those powers that we would classify as a high capability that has slightly lower intent. But they’re still in the top ten, right? So that capability… They have a strong capability and other areas that are not traditionally associated with cyber power. So the reason why most people would be like, “Oh my, God. The Netherlands is there,” is because most people associate cyber power offensive capabilities, and it’s not like you hear every day that the Dutch are attacking everyone.

But it’s actually very openly signaling that it plans to develop cyber capabilities. It has a very specific type of strategy. It’s clear who owns it, what it seeks to do. It’s up to date. It has resources delegated to it. And the thing is, to score highly, you need to not only, as I said, have the intent, but there also needs to be some demonstration that you can do it or have done it. So that’s why it’s up there. And actually, they’re really establishing themselves as a thought leader, particularly in Europe on cyber norms. We’re actually presenting this paper at their cyber conference later this year.

Jonathan:
Cool. That’s awesome. Oh, that’s really neat. So when I look at this ranking, I immediately think about competition, particularly for potential adversaries or adversaries, right?

And given your background on China… I mean, I have so many questions about each country on here, but I think for the viewer and given your deep expertise in China, how do you see the US and China managing their long-term cyber relationship? And maybe part of that answer is just about the realistic overall, but I’m curious if you could offer thoughts.

Julia:
Yeah. Well, so this is basically drawn from the Track II dialogue work that I was doing.

So one of the reasons why we had funding to do it anyway was because both governments weren’t really talking to each other, so they needed an avenue of communication. And one of the things that people tend to do in these forms – it’s a very common tool in diplomacy – is try to get a better understanding of the other person’s strategy, like, “What are the lines of communication, and who makes the decisions on each side?”

And in the event of a crisis, the point is to avoid any kind of unnecessary escalation in crisis. And there are a number of these different kinds of dialogues that happen. But I think one of the most unfortunate things is that, currently, US and China communication is so bad. So, for example, earlier this week… you probably didn’t even come across your radar… but the EU and China have their summit. President Xi Jinping dialed into a call with Angela Merkel and Ursula von der Leyen and Charles Michel, of the European Union, to talk about – for God knows how long that Zoom call was – to talk about trade and investment, climate change, like everything that matters to the EU and China that happens between them. And that was the second time they did it this year, right?

In contrast, every single high-level, US-China dialogue, over the past few years, has just dropped off a diplomatic calendar. And the emergency talks, like [Secretary of State] Pompeo met with Yang Jiechi in June in Hawaii, but that doesn’t count, because emergency talks have a very narrow set of talking points. As you know from working in government, these kinds of big pieces get the whole machinery of government together, and they get to see all their strategy, interests lined up. They can figure out what are the key – what can they afford to negotiate with, develop a strategy. And that’s just not happening on this side, at least it seems.

And so, I think that if channels of communication aren’t reestablished, then… People have already said that “tough on China” is not a strategy. You need to have these other issues in order to find areas to collaborate.

Jonathan:
Mm-hmm (affirmative). So tell us a little bit, if you can, about the degree of Track II communication between former government officials or senior folks in business, and not just from the Harvard standpoint, but if you have a competitive understanding of other Track II programs, how are things going?

Julia:
So there are a number of other Track II dialogues between the US and China with a focus on cyber and related issues, like digital governance or something. One of the interesting things is they all clock into different parts of the system, right? So on the Chinese side, they’ll be part of the different think-tank that clocks into maybe a different ministry or whatever.

And so, that’s really useful, because the Chinese government is not like many other governments. It’s not totally linked up, so you need to get a better understanding of what is driving each ministry, who is doing what. And the point is, ideally, that you piece all of these pieces together and get a better understanding of China. And there are a handful… I don’t know, maybe like 10 US-China dialogues. And just before I wrapped up this position at the Belfer Center, it was the first time we all got on a conference call together to exchange insights.

Jonathan:
Oh, good.

Julia:
Yeah. I mean, better late than never.

Jonathan:
Yeah, that’s right. Yes.

Julia:
And that’s-

Jonathan:
I’m trying to be positive. Explain it to me.

Julia:
But there is that kind of expertise and those kind of more informal relationships. But the truth is, even though they have existed over the years, my read is that actually there’s less activity. It’s much hard for senior officials on both sides to travel to… Even before COVID, they would get hold up at immigration if they had links to the PLA. And you want to be able to speak to these people, but…

Both sides of people are finding it hard to travel, to communicate. And funding for Track II dialogues is also being cut.

Jonathan:
Really?

Julia:
Yeah.

Jonathan:
That’s pre-COVID?

Julia:
Yeah. Yeah. And I think that’s a real shame. There is a criticism of Track II dialogues that they can just be like talking shops and stuff. I mean, that is true. That is true. It really does depend who’s around the table and what is the global context. But if we can get the right people around the table, this is the time that we need to have these channels of communication.

And it just seems incredibly short-sighted to me that they’ve cut funding for it. But there’s also these political – I think there’s a risk some people don’t want to be seen as engaging with China, because there’s a huge – it’s kind of tainted in a way, because you could very easily be then put in a “soft on China” box.

Jonathan:
Oh, for sure. That’s so ironic. It reminds me of the ’50s or McCarthyism in the United States. It’s really easy for domestic leaders… or domestic actors to pigeonhole you in that way. So I haven’t told you this, but in 2010, one of the reasons why I got into cyber security… I started as a counter extremism expert. I majored in religion. I studied in the Middle East, looked at counter extremism. And when I entered the Obama Administration working for Jim Miller, and I got a top secret clearance… My son’s contributing. That’s when I learned that China was taking apart the stealing IP. And at that point in time, with cyber command standing up, we were extremely focused on China. Russia was much less of a concern. Iran wasn’t even on the table. North Korea was just something everybody was terrified about but hadn’t… Iran and North Korea, in particular, hadn’t invested.

Jonathan:
And we had the first strategic and economic dialogue where it had gone on under the previous administration. And we decided to include cyber within it. And just getting cyber on the docket took forever. It took forever to just get the Chinese to agree. And they finally agreed… or maybe they didn’t agree. Maybe we’re just asking if we could raise it. I can’t remember. It was a lot of work on the US side that had to be done initially. And there was a deputy secretary of state, who will remain nameless, who at the last minute… I stayed up until 3:00 in the morning, working with talking points to raise this issue with Chinese.

At the last minute, he’s like, “We can’t talk to them about it.” So it was initially this fear of raising it with them, that we would offend them, because we had to confront them about intellectual property theft. And ultimately, that’s what happened with the help of Mandiant. A few years later, the government said, “Look, we know you’re doing all this theft.” So there’s been this evolution from a cyber standpoint in the relationship, but there was a real hesitancy to talk about it.

Jonathan:
And now, of course, we’ve got this decoupling, which now that I’ve moved to California, I’ve had to make much more effort to understand, because people don’t talk about it all the time around me. But from a strategic standpoint, it makes me think about World War I. If you decouple…. [It reminds me of] Britain and Germany in World War I, they were close allies, and they still went to war.

Now we’ve got this major disruption with China rising in Asia. Is now really the time to sever levels of communication? I don’t think so. So what strategically, as you look at the relationship, what would be your recommendations going forward for, particularly around emerging technology and cyber, for the two countries to be able to avoid going to war? It’s a loaded question.

Julia:
Yeah. Whew. So I think there’s a lot, and it wouldn’t just be about setting up these… For example, reviving that kind of cyber dialogue. Actually, when Trump first came into office, I think DHS still had its high-level cyber crime dialogue with one of the Chinese ministries. But I feel like I would focus very much on the US figuring out exactly what emerging technologies, down to the components, it thinks is most important for its future security.

And there’s a lot of information gathering in terms of decoupling and supply chains, like who is currently leading in that area at the moment? There’s a lot of mapping but needs to be done, I think, to a very granular level, before we can really think about how to negotiate with China and how to go forward.

Julia:
Oh, but on a people thing, the restrictions around students and researchers I think is a really bad idea. Anecdotally, when I was at school at Harvard, I remember thinking in a lot of the classes, the bad guy in the story was always China. I was just thinking…

And there’s a lot of Chinese students, right? And to be honest the Chinese students that are in the classrooms are probably the ones that are most international and outward looking. And if they spend the whole time in America feeling completely alienated, it’s like one massive soft power opportunity gone. I think what’s also… Did you guy cancel all the Fulbright Scholarships as well?

Jonathan:
Probably. I don’t know.

Julia:
Yeah, these long-term people links are just being severed. And there are so many things that I would do. I’m a huge nerd on technical standards and stuff and what’s happening there, in terms of geopolitics. That’s the kind of thing where I think where I think we should really look into who’s doing what, as well as using the Development Financing Corporation to fund more infrastructure projects with allies, because obviously, the US doesn’t have all that industry.

Jonathan:
Wait. Can we pause on that? You’re not saying in China. You’re meaning external, like in third-party countries?

Julia:
Yes, because I think there’s an… There’s what, 48% of the world that isn’t connected to the internet yet?

Jonathan:
48%? Really?

Julia:
Yeah. Yeah. It’s 48% of the world not connected to the internet. And over the past 20 years, not just through the Belt and Road Initiative, China has focused extensively on being trading partners with these countries and developing, providing infrastructure of all kinds, whereas, in contrast, the US has not really gone in there to provide infrastructure.

From a US business perspective, it’s high-risk, whereas, there’s the whole China debt trap thing where they’re funding a lot of these contracts as well, but that also gives them a strategic insight into these markets. And so, a lot of the infrastructure you find in these developing countries are provided by Chinese suppliers. And, to me, in the long term, I see this is a strategic advantage that the US has not really got a leg in at the moment.

Julia:
But, I have to say one thing, and that is pretty good. A couple years ago I think Trump signed into an act, the BUILD Act, which is basically reshaping the US’s overseas development financing mechanisms, which means that now you guys can… You have like $60 billion to fund infrastructure projects in developing markets, not just places like technology, and help US companies compete in order to bring in contracts. And so, that’s another arm of it, how can US-China… like the US might navigate this competition with China on the cyber front.

There are just so many angles from a development policy.

Jonathan:
Oh, completely. Yeah. Yeah. Yep. A colleague and I, Arun Mohan Sukumar, wrote a book-like study called Asian Cybersecurity Futures a couple years ago. And the Belt and Road initiative… It’s too long. No one read it. It’s like a hundred pages long.

Julia:
[crosstalk]. I’ll read it.

Jonathan:
If anyone read it… Yeah. Oh, thanks. It’ll put you right to sleep. The executive summary might be worth reading. It’s also a little bit dated at this point. But the Belt and Road Initiative, these recommendations were exactly what we were concerned about. China’s doing this massive amount of investment, and it’s going to affect other states’ cybersecurity behaviors and their views on data and their views on privacy. And there has to be some diplomatic push from the US side.

Jonathan:
Now, on the other hand, this is sort of a softer power level of influence to ensure that the Belt Road Initiative doesn’t lead us to getting completely cut out of whatever trying China ends up doing, right? There’s a bunch of is a bunch of pluses and minuses. Well, there’s a bunch of benefits with us paying a lot of attention to it.

However, let me also ask, China is doing egregious things. There’s no doubt about it. What’s going on with the Uyghurs, Xi Jinping’s consolidation of power over the military… There is clearly, to a degree, their behavior is not contributing to us staying on the path of peace. Right? So we have to balance our investments strategically at the same time in case things do go sideways with China in a way that we don’t want. How do you think about that problem set and Xi Jinping’s behavior and the regime overall?

Julia:
Yeah. Well, I agree, of course, but I think that in terms of how… I feel we should be dealing with these issues within international structures where possible or creating international structures that function better.

There are so many problems with the world right now. But I actually quite respect – surprise – the EU way of dealing with it, which is tackling these difficult issues, like the awful treatment of Uyghurs and the national security law in Hong Kong front on at the summit this week.

The US can’t do it by itself, I think. So there’s a lot that the US needs to do with allies. And one of the best forums in which to do with allies is international governance, which is… And I feel very sad when I think about the years turning away from engaging internationally on these issues, because I think the self-harm it does is it makes the US lose legitimacy by not operating within these structures.

And that kind of legitimacy and that soft power and that respect as a global leader is actually quite fragile. And I think that over… And it’s something that, in contrast, China is operating in these international institutions pretty sophisticatedly.

Jonathan:
Very sophisticated. Yeah.

Julia:
And this is a narrative that America and in Europe has driven, over the years, this international governance and rule of law and multilateralism and whatever. If the issues is not to operate, then it shoots itself in the foot.

Jonathan:
Yeah, totally. Yeah. Yeah. It’s 2020. It’s easy to look at the world and wring our hands and be worried about the future quite easily. I have faith in all these institutions, right?

I have faith in institutional memory. I have faith in the fact that there are all these good people who are watching out for this and who don’t want these pathways to come forward.

So hopefully, no matter what happens in November, what you’re talking about will change, right? It doesn’t look like it’s a path toward success. On the other hand, being hard on China, what are the benefits that we’ve seen from President Trump being hard on China? Do you see any benefits there?

Julia:
I don’t disagree actually with the criticisms of China and all the things that he’s done wrong. I just don’t think that the method is the best way. I also think that it’s not a full enough response to a country that there’s a whole range of interests that are just falling to the wayside, because we’re focusing on three things. And I don’t think it’s sustainable.

And it’s probably more damaging, I think… I really do think the soft power thing and the global leadership. I like how the rest of the world is viewing the US is a really important thing that needs to be protected, and a lot of that has been… And it’s not just the way Trump has responded to China. It’s generally Trump, unfortunately. But hopefully, whatever happens, remember, they’ll be a more comprehensive consideration of what’s going to happen over the next four years, because I really do think it’s a critical point for the US to come back.

Jonathan:
Mm-hmm (affirmative). No. Completely. Yep. Yep. Yeah. It’s an anxious moment here in this country. There’s no doubt about it. And that’s something that we talked about with your colleagues, Siobhan Gorman and Robby Mook, on the disinformation campaign discussion. So for folks that are interested in that topic, we have a full treatment of it with one of Julia’s colleagues.

Jonathan:
The one thing that I remember at the end of the… There are a couple things at the end of the Obama Administration that powered me forward, one of which was the Climate Agreement, which my college classmate, Brian Deese, helped negotiate, working with China and India in particular. And getting an agreement between the US, China and India on the Paris Accords to decrease emissions and really just setting quite an aggressive path.

After the fires here in California this week, that to me, trumps almost every other issue, no pun intended. But to solve the climate problem makes cybersecurity and so many of these other issues… which are significant and require management from a deterrence and escalation standpoint… but if we could solve the climate problem, it’s like, “Hello.” I’m willing to put a whole bunch of other things on the table to get back to that point.

Julia:
Yeah. No, absolutely. There are things if the US and China work together, they can do a huge amount of good. But there doesn’t seem to be the political will at the moment to do it.

Jonathan:
Yes. Yeah. Gosh, this is a darker note to end on than we probably should. Is there something positive we can talk about? Yeah, actually, yeah… Thank you for doing this Cyber Power Report… Cyber Power Index. Sorry, National Cyber Index. Is that right?

Julia:
Thank you for reading it. I wasn’t sure anyone would.

Jonathan:
Yes, this is always the view when you publish these deeply thought out academic papers. But thank you for your work. Thank you for all you’ve done for international peace and security in your career, and that you’re going to do going forward. It’s exciting that you’re in the UK. So if you had to pick between Plymouth, Boston, and Beijing right now, right now.

Julia:
Alright now.

Jonathan:
Let’s assume a sunny day. It’s sunny in all three places. Which one would you pick?

Julia:
I can’t… I would choose Plymouth.

Jonathan:
You would choose Plymouth? That’s probably just a safe call. You don’t want your parents to throw you out of the house.

Julia:
I’d go to Beijing for dinner. I’d come back.

Jonathan:
Beijing for dinner. Yes. Totally. I’ve only been there once. I was supposed to be there for two weeks. Such a beautiful city.

Julia:
It’s so beautiful and vibrant. And the people that actually are very, very nice.

Jonathan:
When I first went to China, that was when I realized that the Chinese could eat America’s economic lunch in heartbeat. I’ve never seen a group of people that are working so hard and seem so driven and motivated. Also, Japanese whiskey’s incredibly affordable.

Julia:
Oh my gosh. Yeah, they’ve got like… Oh, if you go again, I can give you such a good list of where to go and all the hidden Japanese bars and the ones that are just populated with just Japanese customers, and you’re like, “Yes, this is the place.” And they fly in their fish every day from Tokyo.

Jonathan:
Oh, my gosh. That’s so great. Yeah, well, hope you go back someday. Anything else you want to share before we sign off.

Julia:
No, not really. I’m kind of like. Thank you so much for having me on the show, be on the show.

Jonathan:
Yes, of course.

Jonathan:
It’s great to have you.