Over the past two years, professor Duncan Hollis has given lectures in eight different countries. This year, he has visited, or is scheduled to visit, Estonia, Australia, Germany, India, Mexico, Japan, and Switzerland. Today, however, he\u2019s in Philadelphia, on North Broad Street, in the Temple Law School faculty lounge.<\/p>\n
Hollis has not always been a frequent flier. He grew up in a Massachusetts suburb, roughly 20 minutes from Boston. He was 16 when the first international opportunity presented itself. \u201cI still remember the moment,\u201d Hollis says. His French teacher suggested he apply for a scholarship opportunity in Japan. Hollis earned the scholarship and spent the following summer in Japan. \u201cI probably couldn\u2019t have pointed out Japan from China on a map,\u201d says Hollis. \u201cI don\u2019t even think I had been west of Springfield, Massachusetts at that point.\u201d<\/p>\n
The experience introduced Hollis to new experiences and cultures. He attended Bowdoin College and then law school at Boston College, spending an additional semester and multiple summers in Japan. \u201cI wanted to bridge the two cultures,\u201d says Hollis. \u201cAdvocacy plays a huge role in that because you have to be sensitive to where other people are coming from and convince them to do something that\u2019s out of their comfort zone, or maybe convince yourself that you\u2019re OK doing something that\u2019s not in your comfort zone.\u201d<\/p>\n
Hollis studied international law at Boston College while also pursuing a Masters of Law and Diplomacy at the Fletcher School. On graduation from both programs, he embarked on a rewarding career in the private sector and then with the U.S. Department of State. He joined the Temple Law faculty in 2004, where he has become a widely-published author and authority on international and foreign affairs law, including the law of treaties.<\/p>\n
Lately, however, it has been a different kind of international problem that has interested Hollis. Cybersecurity burst onto the public scene in November 2014, when the Sony Corporation was hacked, bringing thousands of private emails into the public sphere. Hollis quips that while it took Angelina Jolie to help his family finally understand what he was working on, cybersecurity is a much larger, and more complex, problem.<\/p>\n
\u201cTechnology touches everything,\u201d he says, \u201cfrom your refrigerator, to the clothes you wear, to the OnStar in your car, to all the cows that are being wired to the Internet to monitor their health and predict mad cow disease. It\u2019s no longer just about your credit card data. Everything is going to be wired up, and as a result, everyone is going to have a stake in the security question.\u201d<\/p>\n
Hollis\u2019s journey into cybersecurity began in 2007, seven years before the Sony hack. The country of Estonia, one of the most wired countries in the world, was hacked. Government and university websites, as well as hospital and mass media networks, were all affected.<\/p>\n
Cybersecurity is famous for its attribution problem.\u00a0It\u2019s a little bit of a cat and mouse game \u2026 with a good hacker, you might not even know you\u2019ve been hacked. With a really good hacker, they can do something called a false flag and make it look like someone else was responsible.<\/p><\/blockquote>\n
In the aftermath of the Estonia hack, an article that Hollis had written on the international legal issues surrounding cyber operations rapidly gained attention. He was invited to lecture at Harvard Law School, where he found himself speaking with not only Harvard law students, but also members of the Massachusetts Institute of Technology\u2019s (MIT) Computer Science and Artificial Intelligence Lab (CSAIL). Hollis laughs now when he recalls wrestling with the audience\u2019s thoughtful, challenging questions. \u201cThen we went to dinner that night with some of the CSAIL folks,\u201d he recollects, \u201cand I remember feeling like I was just hanging onto the edge of the conversation, like someone on a windowsill, hanging on by my fingertips.\u201d<\/p>\n
Since that presentation, Hollis has found himself, on multiple occasions, discussing cybersecurity with professionals steeped in the engineering and computer science arenas. Other meetings and conferences might involve hackers, coders, intelligence officials, and policy makers. \u201cEveryone is coming to this space from their own silos,\u201d says Hollis.<\/p>\n
In an effort to meet in the middle, Hollis has relied on analogies while advocating for new solutions to cybersecurity problems. It\u2019s a method that led Hollis to his \u2018e-SOS Duty to Assist\u2019 idea, his first widely accepted concept in the global cybersecurity dialogue.<\/p>\n
The problem in cybersecurity, says Hollis, is that the law tries to regulate cyber threats by proscription, banning behavior and labeling as \u201cbad actors\u201d those who engage in it. Thus, proscription provides criminal laws for individuals, and international laws for states. But how do you know which laws apply when you\u2019re not sure if you\u2019re being hacked by a teenager in Southern California or a cyber criminal organization in Romania?<\/p>\n
\u201cCybersecurity is famous for its attribution problem,\u201d says Hollis. \u201cIt\u2019s a little bit of a cat and mouse game \u2026 with a good hacker, you might not even know you\u2019ve been hacked. With a really good hacker, they can do something called a false flag and make it look like someone else was responsible.\u201d<\/p>\n
Hollis wondered if the law was trying to regulate the wrong piece of the puzzle. \u201cSo the other question,\u201d says Hollis, \u201cis if you can\u2019t catch and regulate bad actors, can you regulate the victims?\u201d Hollis analogized cyber threats to a more relatable industry \u2013 automobile drivers. \u201cHow do we regulate automobile safety? One way is we punish drunk drivers because of the risks they pose. But we also make drivers take a test so if they\u2019re going to be driving, we know they\u2019ve met some minimum requirements. In addition, we might make you wear a seatbelt so if you do get hit you won\u2019t be injured as much,\u201d says Hollis.<\/p>\n
Applied to cybersecurity, Hollis believes that when a victim is hacked in a serious way, they should be able to call for help, and responding countries and organizations should be required to afford whatever assistance they can offer. \u201cOn the high seas,\u201d Hollis analogizes again, \u201c if your vessel is going down, and you call for help, anybody who is in position to help has to do so. And the victim can even choose, \u2018OK, I have four different people able to help me, I choose this option.\u2019\u201d<\/p>\n
Hollis returns to the attack on Estonia. \u201cSo, when Estonia went to Russia and said we think these directed denial of service attacks are coming through your networks, the Russian response at the time was, \u2018You know how the Internet works. Somebody is probably spoofing us. Good luck with that.\u2019 Whereas if you had a duty to assist, even if they weren\u2019t responsible, they still would have to do something to help because they could have helped block the offending traffic.\u201d<\/p>\n
The idea has legs. Hollis has presented it in front of policy makers, cyber security professionals, and representatives from the U.S. State Department, Defense Department, and the National Security Agency. He has heard Estonia\u2019s Foreign Minister formally call for other governments to adopt an e-SOS system. And the Group of Government Experts (GGE) at the United Nations included a version of Hollis\u2019s \u2018e-SOS Duty to Assist\u2019 among the peacetime norms they called on states to apply in 2015.<\/p>\n
Lately, Hollis has begun to consider how such an idea would take shape. Hollis, and Tim Maurer, a colleague from Carnegie Endowment for International Peace, used analogies again to consider a possible tangible vehicle for coordinating assistance: A Red Cross for cyberspace. If an organization or individual is hacked, says Hollis, the first instinct is often to stay quiet, so as not to show signs of weakness. And even if a victim wants help, there\u2019s the fear that giving governments access may cause more problems, particularly if any assistance is shared with law enforcement or the intelligence community. \u201cWhy can\u2019t we provide neutral, non-discriminatory, independent assistance to these victims?\u201d asks Hollis.<\/p>\n
The idea, in principle, is already in the works. Back in 1998, in response to the first widespread piece of malware, a group of Internet evangelists created the first Computer Emergency Response Team (CERT). Tasked with ensuring the security of the Internet and the systems that relied on it, other CERTS have emerged subsequently and are now spread across the world, helping secure networks and systems from internal threats, such as inter-operability problems, and external threats from so-called \u201chacktivists,\u201d organized criminal groups, and foreign nations.<\/p>\n
Technology touches everything from your refrigerator, to the clothes you wear, to the OnStar in your car, to all the cows that are being wired to the Internet to monitor their health and predict mad cow disease. It\u2019s no longer just about your credit card data. Everything is going to be wired up, and as a result, everyone is going to have a stake in the security question.<\/p><\/blockquote>\n
While useful, CERTS remain relatively weak. Their independence is consistently under threat, they lack support from policy makers, and their intentions may be secretly biased towards the intentions of their national governments. Hollis believes that equipped with the principles that have made the Red Cross a trusted international symbol \u2013 neutrality, impartiality, and independence \u2013 CERTS could become a building block for a Red Cross-like movement. Such principles would create consistency in who they help, when they help, how they help, and when they turn over their data.<\/p>\n
With the Red Cross idea, Hollis is acting much more openly as an advocate. \u201cThis is more like playing in the policy space than just being a lawyer trying to describe to people what the state of the law is or what it requires or permits,\u201d he says. His advocacy is paying off. The Dutch government is intrigued by the proposal, and has offered its support to Hollis and Maurer to develop a more academic treatment of their idea.<\/p>\n
\u00a0<\/strong>Part of what makes playing in the policy space so much fun for Hollis is the \u201cMadisonian moment\u201d he believes cyberspace faces. \u201cEveryone thought the whole constitution of cyberspace such as it is was being worked out in the 90s,\u201d says Hollis. \u201cBut I think we\u2019re now at a new constitutional moment or we just haven\u2019t finished the original one.\u201d<\/p>\n
In this Madisonian moment, Hollis has concerns, and chief among them is the speed at which technology is changing. \u201cPeople don\u2019t remember that 10 years ago there was no iPhone,\u201d says Hollis. Can society agree to norms, laws, and regulations at a pace that keeps up with technological improvements?<\/p>\n
Despite his doubts, Hollis does not feel a sense of urgency. Rather, he views cybersecurity as the project of a lifetime; he predicts that he will be able to write about cyberspace for the next four decades. \u201cIt will not have gone away. It will only have gotten bigger.\u201d<\/p>\n
Hollis appreciates that he does not represent any individual client or industry in his current role as an academic. As such, he is able to advocate for what\u2019s in the best long-term interest of the system itself. Concurrently, however, he recognizes that there isn\u2019t an endgame to cyberspace. \u201cI\u2019m not a utopian,\u201d says Hollis. \u201cI don\u2019t think we\u2019re ever going to get to a world where there is no cyber crime or risk of horrible tragedies.\u201d<\/p>\n
Hollis does, however, believe we can make the system better. He hopes governments, academics, industries, and society at large can agree on one or two positive steps to improve global cybersecurity, which, if successful, might mark the beginning of an effort to slowly build trust and confidence. Change will be slow and incremental, Hollis admits, but eventually, he thinks that we can reach a point where we can look back on an unstable time in cyberspace and take satisfaction in a more secure system, as opposed to a system that is insecure, or worse, a system that has collapsed. \u201cIt\u2019s a complicated series of problems\u2026but the alternative is chaos. It\u2019s the Wild West, where no one helps anyone, we have no trust, and it\u2019s anarchy. I don\u2019t think we want to live in that world.\u201d<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Changing the world through analogies.<\/p>\n","protected":false},"featured_media":298,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","class_list":["post-294","lens_portfolio","type-lens_portfolio","status-publish","has-post-thumbnail","hentry","lens_portfolio_categories-faculty"],"acf":[],"yoast_head":"\r\n
Duncan Hollis - Temple Law School - Advocacy is...<\/title>\r\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\r\n<link rel=\"canonical\" href=\"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/\" \/>\r\n<meta property=\"og:locale\" content=\"en_US\" \/>\r\n<meta property=\"og:type\" content=\"article\" \/>\r\n<meta property=\"og:title\" content=\"Duncan Hollis - Temple Law School - Advocacy is...\" \/>\r\n<meta property=\"og:description\" content=\"Changing the world through analogies.\" \/>\r\n<meta property=\"og:url\" content=\"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/\" \/>\r\n<meta property=\"og:site_name\" content=\"Temple Law School - Advocacy is...\" \/>\r\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/templelaw\/\" \/>\r\n<meta property=\"og:image\" content=\"https:\/\/www2.law.temple.edu\/advocacyis\/wp-content\/uploads\/2016\/06\/duncan-sitting-looking-up-featured.png\" \/>\r\n\t<meta property=\"og:image:width\" content=\"1780\" \/>\r\n\t<meta property=\"og:image:height\" content=\"890\" \/>\r\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\r\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\r\n<meta name=\"twitter:site\" content=\"@templelaw\" \/>\r\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"11 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"Rebecca Schatschneider\" \/>\r\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/portfolio\\\/duncan-hollis\\\/\",\"url\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/portfolio\\\/duncan-hollis\\\/\",\"name\":\"Duncan Hollis - Temple Law School - Advocacy is...\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/portfolio\\\/duncan-hollis\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/portfolio\\\/duncan-hollis\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/wp-content\\\/uploads\\\/2016\\\/06\\\/duncan-sitting-looking-up-featured.png\",\"datePublished\":\"2016-07-06T11:00:39+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/portfolio\\\/duncan-hollis\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/portfolio\\\/duncan-hollis\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/portfolio\\\/duncan-hollis\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/wp-content\\\/uploads\\\/2016\\\/06\\\/duncan-sitting-looking-up-featured.png\",\"contentUrl\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/wp-content\\\/uploads\\\/2016\\\/06\\\/duncan-sitting-looking-up-featured.png\",\"width\":1780,\"height\":890,\"caption\":\"Duncan Hollis\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/portfolio\\\/duncan-hollis\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Project\",\"item\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/portfolio-archive\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Duncan Hollis\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/#website\",\"url\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/\",\"name\":\"Temple Law School - Advocacy is...\",\"description\":\"Advocacy is...\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www2.law.temple.edu\\\/advocacyis\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\r\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Duncan Hollis - Temple Law School - Advocacy is...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/","og_locale":"en_US","og_type":"article","og_title":"Duncan Hollis - Temple Law School - Advocacy is...","og_description":"Changing the world through analogies.","og_url":"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/","og_site_name":"Temple Law School - Advocacy is...","article_publisher":"https:\/\/www.facebook.com\/templelaw\/","og_image":[{"width":1780,"height":890,"url":"https:\/\/www2.law.temple.edu\/advocacyis\/wp-content\/uploads\/2016\/06\/duncan-sitting-looking-up-featured.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_site":"@templelaw","twitter_misc":{"Est. reading time":"11 minutes","Written by":"Rebecca Schatschneider"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/","url":"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/","name":"Duncan Hollis - Temple Law School - Advocacy is...","isPartOf":{"@id":"https:\/\/www2.law.temple.edu\/advocacyis\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/#primaryimage"},"image":{"@id":"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/#primaryimage"},"thumbnailUrl":"https:\/\/www2.law.temple.edu\/advocacyis\/wp-content\/uploads\/2016\/06\/duncan-sitting-looking-up-featured.png","datePublished":"2016-07-06T11:00:39+00:00","breadcrumb":{"@id":"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/#primaryimage","url":"https:\/\/www2.law.temple.edu\/advocacyis\/wp-content\/uploads\/2016\/06\/duncan-sitting-looking-up-featured.png","contentUrl":"https:\/\/www2.law.temple.edu\/advocacyis\/wp-content\/uploads\/2016\/06\/duncan-sitting-looking-up-featured.png","width":1780,"height":890,"caption":"Duncan Hollis"},{"@type":"BreadcrumbList","@id":"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio\/duncan-hollis\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www2.law.temple.edu\/advocacyis\/"},{"@type":"ListItem","position":2,"name":"Project","item":"https:\/\/www2.law.temple.edu\/advocacyis\/portfolio-archive\/"},{"@type":"ListItem","position":3,"name":"Duncan Hollis"}]},{"@type":"WebSite","@id":"https:\/\/www2.law.temple.edu\/advocacyis\/#website","url":"https:\/\/www2.law.temple.edu\/advocacyis\/","name":"Temple Law School - Advocacy is...","description":"Advocacy is...","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www2.law.temple.edu\/advocacyis\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www2.law.temple.edu\/advocacyis\/wp-json\/wp\/v2\/lens_portfolio\/294","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www2.law.temple.edu\/advocacyis\/wp-json\/wp\/v2\/lens_portfolio"}],"about":[{"href":"https:\/\/www2.law.temple.edu\/advocacyis\/wp-json\/wp\/v2\/types\/lens_portfolio"}],"replies":[{"embeddable":true,"href":"https:\/\/www2.law.temple.edu\/advocacyis\/wp-json\/wp\/v2\/comments?post=294"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www2.law.temple.edu\/advocacyis\/wp-json\/wp\/v2\/media\/298"}],"wp:attachment":[{"href":"https:\/\/www2.law.temple.edu\/advocacyis\/wp-json\/wp\/v2\/media?parent=294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}