What we’re learning about National Security from COVID-19

As of this writing, Johns Hopkins, is reporting more than 432,438 confirmed cases of coronavirus in the US, and nearly 1.5m confirmed cases worldwide.  While the battle to save lives is expected to continue until a vaccine is developed (which experts say could still be 12-18 months out), national security experts are focusing on what we’ve learned so far, not only about COVID-19, but about whether we have a national security structure that is suited to detect and mitigate future viral and biological threats.

As part of a special series of expert-led, web-based briefings to keep our members connected, The Cipher Brief spoke with former Secretary of Homeland Security Michael Chertoff, who is also co- founder and Executive Chairman of The Chertoff Group, about his experience leading DHS and what we can learn from COVID-19.  We caught up with the Secretary in his home, where he’s been practicing social distancing with this family.  For the short-term, he told us that he believes the actions that Americans are taking right now will ultimately flatten the curve and will allow us to engage again sooner rather than later, but he also urged patience, telling us “This is going to be a while.” 

Because we include our members in these conversations, you’ll be reading some of their questions for Secretary Chertoff along with our own.  This is a shortened and lightly edited version of the full briefing.

The Cipher Brief:  Let’s start by talking about what we’re facing generally, because of COVID-19, for individuals, governments and business.

Chertoff:  Having lived through September 11 as the head of the Criminal Division at the Justice Department – that was – until now, my metric for what constitutes a very serious crisis. It was national in scope and it transformed the way we live. We now take for granted the security measures we have to engage in before we get on an airplane or get into a building. But at the time, it was transformative.

The Cipher Brief: For years, since you were at DHS, you’ve often talked about the bio threat and the fact that you didn’t feel like we were taking it seriously enough.  What are you thinking now? Why weren’t we better prepared for a pandemic?

Chertoff:  I think you’re absolutely right. As we began to look at the terrorism threat over 10 years ago, our biggest concern was a deliberate bio attack, which would be sustaining through contact or through contagion. Because in that case, you’re not simply dealing with one set of bad actors that you can incapacitate and stop the threat, but you’re dealing with an ongoing threat until the virus either works itself out or you get some kind of vaccination.

We were concerned about the bio threat, because you need all hands-on deck, and that’s very challenging. It was really about developing three things: planning, surveillance, and resilience. What do I mean by that?

Planning means you’ve got to look at all the consequences of a viral attack, not just the obvious ones which are medical, but economic, social, et cetera. You’ve got to have some idea of how you’re going to deal with all of those simultaneously.

Surveillance is about knowing when the attack has come. We actually set up a system of surveillance to detect pathogens in certain urban areas as an early warning sign.  That’s becoming the issue of testing that we now see in the US.

Finally, resilience. Resiliency is your ability to bounce back when you get a setback. One of the challenges we’ve had here is that many of our economic and social activities are built around the idea of hyper efficiency. We only have as much in the system as we need right now, and we count on delivery of what we’ll need in the future just in time. That saves money, but it also saps resiliency.

The Cipher Brief:  What are your thoughts on how the pandemic is being managed and how much of this should actually be managed by the federal government versus how much could effectively be managed by the states?

Chertoff:  Part of this is our federal system. Obviously, the federal government has certain authorities at the interstate and international level. At the local level it tends to be more on a state basis. Although we do have experience in natural disasters of coordinating between the federal and state government. What I think is important here though, is that we need a unity of effort across the border. We haven’t seen that entirely. Some states are coordinating well with the federal government and are basically applying the same set of standards like the ability for example to have people shelter in place.

But there are some states that are not. For example, Rhode Island and Florida have talked about and implemented some restrictions on interstate travel. That not only is of questionable legality, but it also interferes with the supply chain. If you’re trying to get supplies, or get medical personnel from one place to another, and there’s a problem at the state boundary, that creates an inefficiency and a problem.

I think we need to get the state governors on the same general page and review the approach we’re taking across the board, so we have consistency. That helps us drive down the virulence of the virus.

The Cipher Brief:  What about the private sectors role in this, this obviously is not something that government can tackle by itself. Should the government do more to bring the private sector into this?

Chertoff: I do think we ought to use the powers we have under the federal government and the Defense Production Act to make sure that we are coordinating production in the private sector. That we do not have price gouging or pricing inflation, and that to the extent we can move resources into the production of personal protective equipment, or even ventilators, we ought to do that. Again, it’s not a time to stand on ceremony.

Putting that to one side, the private sector has to work with its employees and its customers, to maximize the ability of people to work from home while still performing essential services.

The Cipher Brief:  We’re all learning as we go with this, but you know a little bit more than the rest of us do. What are you worried about right now as we’re focused on when this curve is going to flatten, and how long it might take to develop a vaccine?

Chertoff:  I’m concerned about three things. One is cyberattacks and someone exploiting the fact that people are distracted and there are also many more people getting online to find vulnerabilities in the networks and then either stealing things or interfering with things. We have adversaries or terrorists who might well do that. As we’re bringing people online – many of them from home – we’re adding endpoints to the network that are not necessarily secure. We need to find a way to mitigate that risk.

The second issue is that I’m a little concerned we may start to see physical acts of violence. Most people view this as an opportunity to come together as Americans as we did for example, after 911. But you do have in this day and age, some people with extreme views, who will see this as an opportunity to create disorder and disruption. Particularly again, when people in the law enforcement and intelligence communities are distracted by the urgency of this pandemic, that is going to be an opportunity to exploit.  We need to also not lose our eye on that ball.

Finally, I’m worried about the election.  We have an election coming up in November. We need to put in place now, the provisions we need for maximizing the ability for people to vote without putting themselves at risk, because some people will be afraid to go to the polls.

What does that mean? It means making mail-in ballots widely available. It may mean more early voting. It may also mean more polling places, including where some people have suggested, which is curbside voting. You get a voting ballot. You fill it out, you put it in an envelope, and you hand it to someone, or you drop it in a secure box someplace near your home. Maybe at a gas station or something.

These are all solutions to the problem of people not wanting to go to stand in line at the polls or poll workers not wanting to go to work. But we’ve got to start doing this now. It’s not a two-week process. It’s something that’s going to require months of preparation.

The Cipher Brief:  We have a question, Mr. Secretary from Larry Pfeiffer, who of course runs the Hayden Center at George Mason University. He says former DNI, John Negroponte, has recently written that this crisis should force a critical reexamination of our intelligence priorities to include emphasis on public health and bio defense. Would you agree and what would you recommend?

Chertoff: Well, let me first give a shout out to Larry who’s worked at our firm for a period of time as a colleague.  I think he’s right. One of the challenges we had with the intelligence community when I was at DHS, was that we wound up, understandably, focusing on tactical warning. When is the next attack coming? Because of that, there was less invested in collecting, analyzing and operationalizing intelligence about more strategic threats.

I actually co-authored a piece with some colleagues, one from Norway and one from Britain that appeared in RUSI’s (Royal United Services Institute) online journal on precisely this issue that intelligence needs to have a broader mandate.

The Cipher Brief:  How does the current pandemic change things for DHS moving forward and also for the IC overall?

Chertoff: I think for DHS, there’s always been the need for DHS to deal with natural disasters.  I led through a succession of hurricanes during my four years and we had a very significant focus on building resiliency planning and other capabilities. Then, we had a period of respite from hurricanes for a while. Recently we’ve had a few, but this underscores the importance of DHS building resilience capabilities and working with the states, on planning, and with the private sector on developing contracts and capabilities to respond.

We don’t have the luxury of only doing one thing at a time. We have to be able to do many things: counterterrorism, cyber security, infrastructure protection, as well as dealing with disasters. That applies to the intelligence community as well. We’ve got to look not just at the question of when is the next terrorist attack – which is important – but also at where our rivals are moving geopolitically and what will they do to exploit this?

The Chinese, for example, are now pushing an information campaign in which they’re talking about what a great job they’ve done. They’re blaming us to some degree for what’s going on. They’re doing that because they want third countries to begin to reorient themselves from looking to the US and the West for guidance to instead looking to the Chinese authoritarian model. We need to understand that. We need to understand what to do to counteract that, but also potentially to get the Chinese to work with us on dealing with what is a global issue that affects everybody in the world.

The Cipher Brief:  This question comes from Andy Maner. He says thank you very much, Mr. Secretary for joining us. He feels like the definition of national security may change and is changing in light of this pandemic, moving to election security, climate change, and away from terrorism, China expansion, et cetera. I think what he’s asking is how quickly do our priorities need to shift now?

Chertoff:  A shout out to Andy, who is a former colleague. I do think there’s going to be a shift. Just like we shifted out of the Cold War mentality to terrorism, and then we got into cyber security. Of course, bio attacks were – and bio events were – part of dealing with terrorists. I think what we realize is security, broadly speaking, is about any threat to the stability or safety of our people and our society.

If you look at the Russians, for example, they’ve used information operations or so-called active measures as a tool of conflict. This is not new. We’ve tended to be very siloed in the way we look at security issues. Partly because we tend to want to do one thing at a time and partly because we’re organized in a way that tends to focus people on an area of expertise.

But really what the White House and the National Security Council are supposed to do is mediate and integrate among the various individual perspectives to take the broadest sense of what security is. Recognizing that threats don’t come with nice labels, they often cross boundaries.

When you look at what we’re dealing with here, we have the actual medical issue, we have the possibility of an adversary exploiting this to create dissension and even violence, we have an economic threat, which if it becomes sustained, will also have very serious impact on the public. We’ve got to be able to balance all of these things and adjudicate among them, which is a very challenging task.

The Cipher Brief:  We have a question, Secretary Chertoff from General Joe Votel. He would like to know what your thoughts are on the role of the private sector in this. He asks, “What are some of the best practices for getting the private sector in early and most effectively when we’re facing a threat like this?”

Chertoff:  First of all, a shout out to the General. Thank you for the question. You’ve got to give the private sector clear guidance about what is necessary because you’re dealing with sophisticated things like ventilators, so how do you actually produce those using for example, auto assembly lines?

It’s not hard to make masks and gowns. The key is to be in touch with the companies that have the scale to produce a large volume and to get them whatever they need in order to begin to produce them and then deal with the issue of paying them afterwards, but keenly make sure they know what is required.

Then there’s also an issue about supply chain.  That’s where I think FEMA and DHS can play a role in identifying where the need is most urgent, so we don’t have the phenomenon that some governors have complained about which is that you’re competing against each other and bidding against each other. That’s not very helpful. I think those are all areas the private sector can help in.

One thing that I’d like to acknowledge, as restaurants have been shut, a lot of these restaurants have been willing to deliver food or take out. The supermarkets have remained open. I mean, these are part of the private sector. These are heroes because they are people who are putting themselves at risk in order to keep the basic life blood of the country moving and particularly for those who can’t really shop for themselves, making sure they have enough to eat.

The Cipher Brief:  You’re both the founder and the executive chairman of the Chertoff Group and you advise clients all over the world on a number of issues. What are they most concerned about right now?

Chertoff:  Well, I think everybody’s concerned about wanting to know how does this end? How do we get in control of this? What do they need to do to protect their cyber workforce and to do their teleworking? Also, what is the impact on their businesses both in terms of the safety of their workers but also long term in terms of where the businesses are?

Many clients are actually coming to us asking, how can we help? We may be in the business of providing technology that is useful for security, but how can we adapt this? For example, if you’re a screening company, you’re doing things for screening at the airport to see whether people are carrying weapons, can some of the technology be adapted to see whether people have a fever or are otherwise exhibiting signs of contagion that should keep them from getting on an airplane?  There are people who really want to step up and be engaged here. We’re working with them to see where there’s a need and how they can best fulfill it.

The Cipher Brief:  This is a question from Heather Honey who works with the Haystack Group. She reminds us of recent reporting that sources inside China have been indicating that the Communist Party has significantly under reported the number of deaths from COVID-19. It was Bloomberg that first reported that, citing anonymous intelligence sources and pointing to the operations of crematoriums, shipments of urns, etc.  She asks if you believe that the US or the world will ever get accurate information about the true impact of COVID-19 inside China? Do you believe China will be held accountable for a lack of transparency?

Chertoff:  I think it’s really problematic. I’ve read the same story. I can’t say I’d be shocked. I think the Chinese put a rosy image out to the world about how great they’re doing so they can propagate their model to other countries. I think frankly, domestically they were trying to sell the people the idea that they’ve got this under control.

What’s been interesting to me is to watch online how many Chinese citizens are actually expressing real skepticism and anger about that. I think that’s something the Chinese government will have to reckon with.

Will we ever get the whole truth? I’m not sure I’m confident that we will. I think some of it is people covering their own rear ends by under reporting to their superiors. Some of it is, as we’ve seen elsewhere, when you have asymptomatic people, they may not know they have it.

Some of it may just be the difficulty of getting ground truth in a very widely dispersed country. But I do think there’s a lot of effort to put lipstick on the pig here. We need to be mindful and do what we can using our intelligence capabilities to triangulate what we think the real truth might be.

The Cipher Brief:  What closing thoughts do you have for us about what frame of mind we need to be in as we go through the coming weeks with still a lot of unknowns, as we wait for more testing to be done?

Chertoff:  First of all, I do take the advice of reputable people like Tony Fauchi, about what to do. Second, I try not to overdose on predictions because I can find a prediction for every possible point of view you might want to hear. All that does is induces anxiety and a sense of confusion. Third, I think you want to seize the opportunity to actually maybe do some things you often don’t get a chance to do. Spend time with your family, read books, maybe brush up on your learning of a foreign language.

What I’m discovering is that online we’re able to do quite a lot of work as well as to reconnect with old friends from around the world. I’ve been really pleased when some of my friends in other parts of the world shoot me an email and we communicate. There’s some upside. The bottom line is this, this is going to be a matter of patience.

I know we all want answers right away. I do too. I’m trying to remind myself we don’t really have all the data yet. Let me give you just one example.

Early on with mortality rates, my concern was that we had a problem with the denominator. We don’t know how many people die. We don’t know how many people were sick that never reported. There’s even a question about whether we’re counting all people who died when the coronavirus was a contributor to their death, but they had an underlying fatal condition.

Again, as we develop numbers, we need to be careful to remember that this is still a moving target. We need to not assume that somehow this has all been resolved.

Keep in close contact with The Cipher Brief throughout this pandemic.  We’re bringing you expert-led briefings on issues you can’t afford to ignore. Check our daily newsletter for latest briefing schedule.  And become a member of this national security community of experts.