Event Information

Register for the Event

Although research suggests that considerable efficiencies can be gained from cloud computing technology, concerns over privacy and security continue to deter government and private-sector firms from migrating to the cloud. By its very nature, storing information or accessing services through remote providers would seem to raise the level of privacy and security risks. But is such apprehension warranted? What are the real security threats posed to individuals, business and government by cloud computing technologies? Do the cost-saving benefits outweigh the dangers?

On October 26, the Brookings Institution hosted a policy forum on the privacy and security challenges raised by cloud computing. Governance Studies Director Darrell West moderated a panel of technology industry experts examining how cloud computing systems can generate innovation and cost savings without sacrificing privacy and security. West will also present findings from his forthcoming paper “Privacy, Security, and Innovation in Cloud Computing.”

After the program, panelists took audience questions.

Transcript

• Uncorrected Transcript (.pdf)

Event Materials

• 20101026_cloud_computing

      

Executive Summary

Cloud computing can mean different things to different people, and obviously the privacy and security concerns will differ between a consumer using a public cloud application, a medium-sized enterprise using a customized suite of business applications on a cloud platform, and a government agency with a private cloud for internal database sharing (Whitten, 2010). The shift of each category of user to cloud systems brings a different package of benefits and risks.

What remains constant, though, is the tangible and intangible value that the user seeks to protect. For an individual, the value at risk can range from loss of civil liberties to the contents of bank accounts. For a business, the value runs from core trade secrets to continuity of business operations and public reputation. Much of this is hard to estimate and translate into standard metrics of value (Lev, 2003) The task in this transition is to compare the opportunities of cloud adoption with the risks. The benefits of cloud have been discussed elsewhere, to the individual to the enterprise, and to the government (West, 2010a, 2010b).

This document explores how to think about privacy and security on the cloud. It is not intended to be a catalog of cloud threats (see ENISA (2009) for an example of rigorous exploration of the risks of cloud adoption to specific groups). We frame the set of concerns for the cloud and highlight what is new and what is not. We analyze a set of policy issues that represent systematic concerns deserving the attention of policy-makers. We argue that the weak link in security generally is the human factor and surrounding institutions and incentives matter more than the platform itself. As long as we learn the lessons of past breakdowns, cloud computing has the potential to generate innovation without sacrificing privacy and security (Amoroso, 2006; Benioff, 2009).

Downloads

• Download the Full Paper

      

EXECUTIVE SUMMARY

Many web services are examples of cloud computing, from storage and backup sites such as Flickr and Dropbox to online business productivity services such as Google Docs and Salesforce.com. Cloud computing offers a potentially attractive solution to customers keen to acquire computing infrastructure without large up-front investment, particularly in cases where their demand may be variable and unpredictable, as a means of achieving financial savings, productivity improvements and the wider flexibility that accompanies Internet-hosting of data and applications.

The greater flexibility of a cloud computing service as compared with a traditional outsourcing contract may be offset by reduced certainty for the customer in terms of the location of data placed into the cloud and the legal foundations of any contract with the provider. There may be unforeseen costs and risks hidden in the terms and conditions of such services.

This document reports on a detailed survey and analysis of the terms and conditions offered by cloud computing providers.

The survey formed part of the Cloud Legal Project at the Centre for Commercial Law Studies (CCLS), within the School of Law at Queen Mary, University of London, UK. Funded by a donation from Microsoft, but academically independent, the project is examining a wide range of legal and regulatory issues arising from cloud computing. The project's survey of 31 cloud computing contracts from 27 different providers, based on their standard terms of service as offered to customers in the E.U. and U.K., found that many include clauses that could have a significant impact, often negative, on the rights and interests of customers. The ease and convenience with which cloud computing arrangements can be set up may lull customers into overlooking the significant issues that can arise when key data and processes are entrusted to cloud service providers. The main lesson to be drawn from the Cloud Legal Project’s survey is that customers should review the terms and conditions of a cloud service carefully before signing up to it.

The survey found that some contracts, for instance, have clauses disclaiming responsibility for keeping the user’s data secure or intact. Others reserve the right to terminate accounts for apparent lack of use (potentially important if they are used for occasional backup or disaster recovery purposes), for violation of the provider’s Acceptable Use Policy, or indeed for any or no reason at all. Furthermore, whilst some providers promise only to hand over customer data if served with a court order, others state that they will do so on much wider grounds, including it simply being in their own business interests to disclose the data. Cloud providers also often exclude liability for loss of data, or strictly limit the damages that can be claimed against them – damages that might otherwise be substantial if a failure brought down an e-commerce web site.

Although in some U.S. states, in E.U. countries and in various other jurisdictions the validity of such terms may be challenged under consumer protection laws, users of cloud services may face practical obstacles to bringing a claim for data loss or privacy breach against a provider that seems local online but is, in fact, based in another continent. Indeed, service providers usually claim that their contracts are subject to the laws of the place where they have their main place of business. In many cases this is a US state, with a stipulation that any dispute must be heard in the provider’s local courts, regardless of the customer’s location.

Perhaps the most disconcerting discovery of the Cloud Legal Project’s survey was that many providers claimed to be able to amend their contracts unilaterally, simply by posting an updated version on the web. In effect, customers are put on notice to download lengthy and complex contracts, on a regular basis, and to compare them against their own copies of earlier versions to look for changes.

The cloud computing market is still developing rapidly, and potential cloud customers should be aware that there may be a mismatch between their expectations and the reality of cloud providers' service terms, and be alive to the possibility of unexpected changes to the terms.

Downloads

• Download the Full Paper

      

Our former Brookings colleague Rebecca Blank, now at the Commerce Department, is today leading the first meeting of the Obama Administration’s Innovation Advisory Board, looking at the innovative capacity and economic competitiveness of the United States.

I applaud the effort.  Nothing is more important to America’s longterm competitiveness than emphasizing innovation.  As the council looks to the private sector and global markets, I urge it to examine how the U.S. government can lead innovation and contribute to economic growth.  The best place to look is new and emerging digital technologies that can make government more accessible, accountable, responsive and efficient for the people who use government services every day.

Here are some of the recommendations I made in a recent paper I wrote with colleagues here at Brookings as part of our “Growth Through Innovation” initiative:

• Save money and gain efficiency by moving federal IT functions “to the cloud,” i.e., using advances in cloud computing to put software, hardware, services and data storage through remote file servers.

• Continue to prioritize the Obama administration’s existing efforts to put unparalleled amounts of data online at Data.gov and other federal sites, making it easier and cheaper for citizens and businesses to access the information they need.

• Use social media networks to deliver information to the public and to solicit feedback to improve government performance.

• Integrate ideas and operations with state and local organizations, where much of government innovation is taking place today. 

• Apply the methods of private-sector business planning to the public sector to produce region-specific business plans that are low cost and high impact.

These improvements in government services innovations in the digital age can help spur innovation and support a robust business climate.  And, as a sorely needed side benefit, they can also serve to eliminate some of the current distrust and even contempt for government that has brought public approval of the performance of the federal government to near historic lows.  

      

Event Information

While research suggests that considerable efficiencies can be gained from cloud computing technology, concerns over privacy and security continue to deter governments and private-sector firms from migrating to the cloud. Senator Amy Klobuchar (D-Minn.) has advanced discussion of the “Cloud Computing Act of 2011,” draft legislation that would address these challenges by encouraging the U.S. government to negotiate with other countries to establish consistent laws related to online security and cloud computing. The bill also creates new enforcement tools for investigating and prosecuting those who violate online privacy and security laws.

On June 16, the Brookings Institution hosted a forum on the policy proposals in the Cloud Computing Act of 2011. Discussion included an overview of the international policy implications as governments and firms adjust to a coherent legal framework, changes and innovations in public procurement, and challenges for private industry as it balances consumer needs and compliance with these proposed cloud computing safeguards.

After the program, panelists took audience questions.

Transcript

• Uncorrected Transcript (.pdf)

Event Materials

• 20110616_cloud_computing

      

Listen to the chatter from top officials, and you’d think that World War III was about to break out on the Internet. The defense secretary is warning about a digital “Pearl Harbor.” Former director of national intelligence Mike McConnell declares that the United States is “fighting a cyber war, and we’re losing.” Every new hack brings more pronouncements of network doom.

The scare talk, however, is misplaced. Yes, we’re facing enormous cybersecurity problems — just look at the high-profile penetrations of such companies as Sony and Lockheed or the millions of Americans whose personal information has been stolen online.

But these aren’t signs of some impending cataclysmic showdown as I explain in my new cybersecurity paper for The Brookings Institution. They’re markers of a rising tide of online crime that, in its own way, could be more dangerous than a cyberwar. According to the British government, online thieves, scammers and industrial spies cost U.K. businesses an estimated $43.5 billion in the past year alone. Crooks-for-hire will infect a thousand computers for $7 — that’s how simple it’s become. Sixty thousand new malicious software variants are detected every day. Forget “Pearl Harbor”; if we’re not careful, the Internet could be in danger of looking like the South Bronx circa 1989 – a place where crooks hold such sway that honest people find it hard to live or work there.

Could there be some online conflict in the future? Maybe. But crooks are draining billions from the legitimate global economy right now. Even the Pentagon’s specialists are worried, noting in their new cybersecurity strategy that “the tools and techniques developed by cyber criminals are increasing in sophistication at an incredible rate.”

Those tools also are becoming easier to use. The latest crimeware makes stealing passwords about as simple as setting up Web pages. One gang, recently arrested, used it to drain $9.5 million in just three months.

Read the full article at washingtonpost.com >>

       

Executive Summary

The move to the cloud is one of the defining information technology trends of the early 21st century. By providing businesses, universities, government agencies, and other entities with access to shared and often physically dispersed computing resources, cloud computing can simultaneously offer increased flexibility, reduced cost, and access to a wider array of services.

Cloud computing has also created a set of new challenges. For example, the issues of privacy and security in the cloud are well recognized and have been extensively discussed in the business and popular press. However, one critical issue that has received very little attention with respect to cloud computing is export control.

In the broadest sense, export control relates to regulations that the United States and many other countries have put in place to restrict the export of various sensitive items, information, and software.

There is an inherent tension between cloud computing and export control. While the concept of the cloud is centered on the premise of removing the need to track the details of data movement among various destinations, export control regulations are built largely around restrictions tied to those very movements.

If cloud computing is to reach its full potential, it is critical for providers and users of cloud services to address its implications with respect to export control. It is equally important to adapt the export control regulations to reflect the increasing prevalence of cloud computing in a manner that preserves the ability of American companies to benefit from the efficiencies of the cloud while also ensuring that American national security and foreign policy interests are adequately protected.

Downloads

• Download the Paper

       

The appointment of new federal chief information officer Steven VanRoekel comes at a challenging time for President Barack Obama. The national economy continues to be weak. Congress plans to cut trillions from the federal budget. And in the time leading up to the 2012 election, American voters remain cynical about the ability of the government to address important policy problems in an effective manner.

In an era of deficit reduction and public cynicism, the tasks facing federal officials are to determine how to do more with less and persuade voters the government can become smarter and more effective. There are going to be fewer dollars for virtually every federal program so it is important to figure how ways to innovate and perform more efficiently.

Former CIO Vivek Kundra sought to do this through encouraging agencies to move software applications to the cloud, consolidating federal data centers, improving transparency, and improving the information technology procurement process. It is important to continue this progress even as agencies are forced to downsize their operations.

As shown in the private sector, government administrators should use technology to cut costs, improve worker productivity, and streamline operations. This is not just a matter of using technology in more innovative ways, but changing the operations and culture of the public sector. Public officials must improve its data mining activities to identify fraud and abuse in Medicare, Medicaid, the Defense Department, and other domestic programs.

New software gives managers better tools to evaluate how money is being spent and whether it is fulfilling intended goals. If it is not, programs need to be modified or eliminated. The most important weapon in Mr. VanRoekel’s arsenal may be the scalpel as he goes through the federal government’s $80 billion IT budget.

       

Event Information

Register for the Event

In his new book The Mobile Wave: How Mobile Intelligence Will Change Everything (Vanguard Press, 2012), CEO of MicroStrategy Michael Saylor examines the transformative possibilities of mobile computing on business, society, economies and everyday life. Saylor argues that mobile technologies such as smartphones and tablet computers – “the fifth wave of computer technology” – will be indispensible tools for modern life and completely alter how we live.

On October 5, the Center for Technology Innovation at Brookings hosted a forum on mobile computing and its monumental impact on our future. Moderated by Vice President Darrell West, Michael Saylor discussed key highlights from his book and offered insights as to what sort of change we can expect from the macro level down to the most mundane of everyday humans tasks.

 

Audio

• Riding the Mobile Wave: The Future of Mobile Computing

Transcript

• Transcript (.pdf)

Event Materials

• 20121005_mobile_wave

       

“Missed connections” is the personals ads category for people whose encounters are too fleeting to form any union – a lost-and-found for relationships.  I gave that title to my paper on the conversation between the United States and for Europe on data, privacy, and surveillance because I thought it provides an apt metaphor for the hopes and frustrations on both sides of that conversation.

The United States and Europe are linked by common values and overlapping heritage, an enduring security alliance, and the world’s largest trading relationship.  Europe has become the largest crossroad of the Internet and the transatlantic backbone is the global Internet’s highest capacity route.

[I]

But differences in approaches to the regulation of the privacy of personal information threaten to disrupt the vast flow of information between Europe and the U.S.  These differences have been exacerbated by the Edward Snowden disclosures, especially stories about the PRISM program and eavesdropping on Chancellor Angela Merkel’s cell phone.  The reaction has been profound enough to give momentum to calls for suspension of the “Safe Harbor” agreement that facilitates transfers of data between the U.S. Europe; and Chancellor Merkel, the European Parliament, and other EU leaders who have called for some form of European Internet that would keep data on European citizens inside EU borders.  So it can seem like the U.S. and EU are gazing at each other from trains headed in opposite directions.

My paper went to press before last week’s European Court of Justice ruling that Google must block search results showing that a Spanish citizen had property attached for debt several years ago.  What is most startling about the decision is this information was accurate and had been published in a Spanish newspaper by government mandate but – for these reasons – the newspaper was not obligated to remove the information from its website; nevertheless, Google could be required to remove links to that website from search results in Spain. That is quite different from the way the right to privacy has been applied in America.  The decision’s discussion of search as “profiling” bears out what the paper says about European attitudes toward Google and U.S. Internet companies.  So the decision heightens the differences between the U.S. and Europe.

Nonetheless, it does not have to be so desperate.  In my paper, I look at the issues that have divided the United States and Europe when it comes to data and the things they have in common, the issues currently in play, and some ways the United States can help to steer the conversation in the right direction.

[I] "Europe Emerges as Global Internet Hub," Telegeography, September 18, 2013.

       

The United States exports digital goods worth hundreds of billions of dollars across the Atlantic each year.  And both Silicon Valley and Hollywood do big business with Europe every year.  Differences in approaches to privacy have always made this relationship unsteady but the Snowden disclosures greatly complicated the prospects of a Transatlantic Trade and Investment Partnership.  In this paper Cameron Kerry examines that politics of transatlantic trade and the critical role that U.S. privacy policy plays in these conversations.

Kerry relies on his experience as the U.S.’s chief international negotiator for privacy and data regulation to provide an overview of key proposals related to privacy and data in Europe.  He addresses the possible development of a European Internet and the current regulatory regime known as Safe Harbor. Kerry argues that America and Europe have different approaches to protecting privacy both which have strengths and weaknesses.

To promote transatlantic trade the United states should:

• Not be defensive about its protection of privacy
• Provide clear information to the worldwide community about American law enforcement surveillance
• Strengthen its own privacy protection
• Focus on the importance of trade to the American and European economies

Downloads

• Download the paper

       

The first instance of “cloud” computing came in 2006, when Amazon released its Elastic Compute Cloud, a service for consumers to lease space on virtual machines to run software. Now, the cloud enables the transfer and storage of data around the world, in an almost seamless fashion. Using cloud services are a seamless experience from the consumer perspective. This ease of use obscures significant regulation from governments on both sides of the Atlantic. The Safe Harbor Principles is a framework that ensures that personal consumer data being transferred from the EU to the US is still subject to a level of security in compliance with the EU’s stricter regulation on data protection. US companies must be certified within this framework, in order to transfer consumer data outside the EU.

A comprehensive data privacy arrangement that satisfies both sides of the Atlantic is necessary to preserve the free flow of data, and the resulting commerce, between the two regions. Speaking at the 2014 Cloud Computing Policy Conference, Cameron F. Kerry suggested that neither side of the Atlantic can afford to partition the Internet. Currently trade negotiators are assessing the viability including an update to Safe Harbor Principles as a part of the Transatlantic Trade and Investment Partnership (TTIP).

TTIP and the Future of Trade

The NSA revelations last year have only increased support for further regulation over the transfer of personal data in the cloud, especially in the European Union (EU). The revelations have also brought to light significant differences in the European and US conceptions of privacy. The ruling by the European Court of Justice on the “right to be forgotten” is a recent example of this transatlantic divide. In EU countries, citizens can now request Google to take down links from search results that lead users to potentially damaging information.

There are several disputes that negotiators must first resolve. Europeans would prefer that American regulators take a more active role in cases where US firms are violating the Safe Harbor principles. EU officials have also indicated they would like to include a mechanism to send an alert if data were improperly shared with US law enforcement officials. The expansion of the codes of conduct within the cloud would serve as a major step towards finalizing TTIP. A European Commission Analysis finds that TTIP would inject about $130 billion into the US economy. Ultimately both the EU and the US have so much to gain that both nations must find a way to resolve these thorny issues.

 

Kevin Risser contributed to this post.

       

Cloud computing is becoming omnipresent in the private sector as companies latch on to this innovation as a way to manage scalability, improve flexibility, and reduce cost. Analysts at IDC predict that, over the next six years, nearly 90 percent of new spending on Internet and communications technology will be on cloud-based platforms. Apple, Google, Amazon, Microsoft, and hundreds of smaller companies are positioning themselves to dominate the estimated $5 trillion worldwide market. While few companies will provide numbers, it is estimated that Amazon and Google may run as many as 10 million servers while Microsoft runs close to one million. In short, it is an innovation that makes a mockery out of Moore’s law.

But, like all innovations, cloud computing has potential pitfalls. Public sector organizations in particular have had difficulty taking advantage of new technologies. The Heritage Foundation keeps a list over 50 examples of government ineptitude including $34 billion in fraudulent Homeland Security contracts, National Institutes of Health renting a lab that it neither needs nor can use for $1.3 million per month, and the Department of Agriculture wasting $2.5 billion in stimulus money on broadband internet. Technological ineptitude received special attention with the failed launch of the Healthcare.gov, the release of classified data from Edward Snowden, and the costly FBI virtual case file debacle.

Cloud computing is far more than just a simple technology change and requires a close examination of governance, sourcing, and security. We sought to understand how well state government is prepared to address the challenges of cloud computing.

The Approach

We have gathered and started to do a content analysis of the IT strategic plans for each state. For each plan, we performed a content analysis, which is looking for certain phrases or text within the IT strategic plan in order to have a structured way to understand the data. Details for our approach can be seen in our previous blog post.

How States Are Implementing the Cloud

We were not surprised to see a number of states preparing to study or embark on cloud computing.

While some states don’t mention it (e.g. Alabama), most states are eagerly exploring it. For example, North Dakota’s plan talks about cloud computing as an integral part of the future and seven of its thirteen major IT initiatives are centered on preparation for transitioning to the cloud “where and when it makes sense”.

Vermont puts itself squarely in the studying period. The plan describes that, “While the risks of enterprise-wide and cloud-based IT must be carefully managed, trends continue to just larger-scale operations.” Wisconsin also clearly lays out its view on cloud computing, writing that, “Flexibility and responsiveness (also) guide Wisconsin’s approach toward adoption of cloud services” and suggests that its version of a private cloud “…offers advanced security and service availability tailored for business needs.” West Virginia provides an equally balanced approach by requiring that only services with an acceptably low risk and cost-effective footprint will be moved to the cloud.

In short, all of the states that are considering cloud computing are taking a thoughtful and balanced approach.

The Good

One of the most critical aspects of cloud computing is security and, without question, states understand the importance of good security. A good example of this is Colorado who designates security as one of its four “wildly important goals” and sets the target of “10 percent reduction in information security risk for Colorado agencies by close of FY15”.

South Carolina echoed the same theme by asserting that security and confidentiality are “overriding priorities at every stage of development and deployment.” Connecticut’s plans explain the need to “continuously improve the security and safeguards over agency data and information technology assets”.

The Bad

Despite the interest in cloud computing, we were only able to find a single state (Georgia) that explicitly links governance to security and, to us, by extension to cloud computing. In Georgia’s plan, they start with the idea that “strong security programs start with strong governance” and then explicitly describe necessary changes in governance to improve security.

We were, however, impressed with the seriousness that New York, North Carolina and Massachusetts took governance but it was difficult to find many other states that did.

The Ugly

Unfortunately the results on sourcing were dismal. While a few states (e.g. Kansas, Ohio, and Massachusetts) specifically discuss partnerships, most states seemed to ignore the sourcing aspect of cloud computing. The most ominous note comes from Alabama where they make a statement that innovation in the state is being stifled by a lack of strong personnel.

While we have great enthusiasm for government to address cloud computing, some of the non-technical issues are lagging in the discussion. Good government requires that these items be addressed in order to realize the promise of cloud computing.

       

Since 2009 the federal government started the process of replacing local computers with cloud platforms. A recent report from the Congressional Research Service (CRS) provides an interesting view into the progress of these investments. It reveals the benefits that public agencies gain when using cloud services and the barriers they face when making the transition.

Advantages of Cloud Computing

Cloud computers are superior to locally-run data centers for a variety of reasons. The CRS report identifies six specific cloud benefits:

• Cost- Cloud computer platforms use resources more efficiently than local servers. An organization that uses local Information Technology (IT) must invest in the infrastructure to support computer systems at times of peak demand. However, most times companies or government agencies require only a fraction of that computing power. Cloud computing allows organizations to pay for all of the resources they need and avoid costly investments in rarely used local IT systems.
• Energy Efficiency- Cloud computing data centers benefit from economies of scale to run more efficiently than local servers. In some cases this can result in huge energy savings. For a large cloud computing center it also makes economic sense to invest in green energy sources like wind or solar for power.
• Availability- Cloud computing systems make it easy for any device with an Internet connection to access files or software. However, if a facility temporarily loses Internet access the files on cloud system are inaccessible. Alternatively, a locally administered IT system could function without Internet connectivity.
• Agility- Cloud systems can make it easier to upgrade operating systems and applications. The available computing power also means that memory intensive software packages are cost effective.
• Security- Cloud providing companies also have the financial resources to purchase the tools necessary to ensure that networks remain safe.
• Reliability- Cloud systems can save data onto multiple servers. If a single server goes down due to a cyberattack or another issue, the data is available on another server.

Government Investments in the Cloud

Determining the exact size of government cloud computing expenditures is difficult. Government spending on IT has increased every year from 2001 to 2013 when it reached a peak of $81 billion. In the three subsequent years it has decreased. Cloud computing expenditures likely represent a tiny fraction of that total. Market research firms have estimated that the federal government spends between $1.4 billion and $7 billion on cloud computers annually.

Trends in Total Federal Investment in Information Technology

Source: Congressional Research Service

Challenges for Migrating to the Cloud

The federal government has encountered several barriers in its plan to shift more functions to cloud platforms:

• High Federal Security Requirements- The government faces new advanced persistent threats routinely. System-wide security updates are necessary more often than for private sector organizations. The short update cycle provides a unique challenge to cloud providers.
• Adopting New Technologies- Government agencies have ingrained cultures that are slow to change. This shift from locally-based servers to the cloud can be slow and tedious for this reason.
• Ancillary Technologies- Cloud technologies are known for their flexibility. However, government agencies may lack the necessary IT infrastructure or speedy Internet connections that leverage the maximum potential of the cloud.
• Technical Know How- Cloud platforms require specialized knowledge to administer. Many government agencies lack the necessary experts to oversee a migration to the cloud.
• IT Expenditure- Migration to the cloud can involve expensive initial costs. Additional funding is necessary to facilitate the shift to the cloud.

The Future of the Government Cloud

An analysis of the costs and benefits of cloud migration uncover a few specific barriers that the federal government must overcome to earn the full value from new technologies. First, lawmakers must be willing to spend more now to save money later. Cloud systems are cheaper to run than local administered servers but the initial transition costs are high. Current funding levels, which are trending down, are too low to finance such a change. Privacy and security are also major challenges. Government servers host troves of data that Americans expect to remain private. Converting these systems to the cloud will require the government’s full confidence that cloud systems are at least as secure. New legislation is likely necessary to achieve the complimentary goals of privacy and security.

More TechTank posts available here

       

INTRODUCTION

Influencing the Islamic Republic of Iran has proven to be a perennial conundrum for American presidents. The complexity of Iranian politics and the intractability of the problems posed by Tehran’s revolutionary theocracy may explain why, over the course of three decades, each U.S. administration has been forced to revise its initial approach to Iran in hopes of achieving better outcomes. The overall result has been an American tendency to oscillate between engagement and pressure, with frustratingly limited results.

And so it goes for the Obama administration. After an initial, high-profile effort to draw Tehran into a serious dialogue both to resolve the nuclear issue as well as transcend it, Washington now finds itself pivoting away from diplomatic engagement to a more coercive policy centered around economic pressure. The shift comes amidst a dramatic new context within the Islamic Republic, characterized by historic turmoil on the streets and bitter divisions among the elites, and at a moment when the international urgency surrounding Tehran’s nuclear ambitions has never been greater. This context raises the stakes and heightens the sensitivities of getting U.S. policy on Iran right after so many years of failure.

The turn toward sanctions is a predictable one. Sanctions have proven to be an instrument of American policy toward Tehran for the past thirty years. American use of economic pressure as a means of dissuading Iranian malfeasance began with the freezing of Iranian assets after Iranian students seized the U.S. Embassy in Tehran in 1979 and culminated in the nearly comprehensive ban on trade and investment in Iran that has been in place since the Clinton administration. But, despite the appeal of sanctions, their protracted duration underlines their limitations—particularly when they are unilateral—as a mechanism for categorically revising Iranian policy. Still, many find sanctions attractive because the overall track record of Iranian decision-making demonstrates that Tehran often considers the costs and benefits of its policy options in determining its course. As Iran’s internal strife exacerbates the regime’s vulnerabilities, the prospects for international consensus around new economic restrictions appear more realistic than ever before.

To examine the options and implications for using sanctions to address the multi-faceted challenges of Iran, the Saban Center for Middle East Policy at the Brookings Institution held a half-day symposium in late October 2009. The workshop featured off-the-record panel discussions led by experts on Iranian internal politics and the key actors shaping the diplomatic landscape. The conclusions from that session are presented below.

Downloads

• Download

      

Introduction: Despite the launch of indirect, “proximity” talks between Palestinians and Israelis, Palestinian President Mahmoud Abbas continues to resist a resumption of direct negotiations with Israel absent a full settlement freeze. As chairman of the Palestine Liberation Organization (PLO) and president of the Palestinian Authority (PA), Abbas also insists that any new negotiations pick up where previous talks left off in December 2008 and that the parties spell out ahead of time a clear “endgame,” including a timetable for concluding negotiations. While these may seem like unreasonable preconditions, Palestinian reluctance to dive headfirst into yet another round of negotiations is rooted in some genuine, hard-learned lessons drawn from nearly two decades of repeated failures both at the negotiating table and on the ground.

Not only have negotiations failed to bring Palestinians closer to their national aspirations but the peace process itself has presided over (and in some ways facilitated) a deepening of Israel’s occupation and an unprecedented schism within the Palestinian polity. Such failures have cost the Palestinian leadership dearly in terms of both its domestic legitimacy and its international credibility. While it remains committed to a negotiated settlement with Israel based on a two-state solution, the PLO/PA leadership has been forced to rethink previous approaches to the peace process and to negotiations, as much for its own survival as out of a desire for peace.

Haunted by past failures, Palestinian negotiators are now guided, to varying degrees, by six overlapping and sometimes conflicting lessons:

1. Realities on the ground must move in parallel with negotiations at the table.

2. Don’t engage in negotiations for their own sake.

3. Agreements are meaningless without implementation.

4. Incrementalism does not work.

5. Avoid being blamed at all costs.

6. Don’t go it alone.

Downloads

• Download Full Paper - English

      

Introduction:

In the ebb and flow of Middle East diplomacy, the two interrelated issues of an Israeli-Syrian peace settlement and Washington’s bilateral relationship with Damascus have gone up and down on Washington’s scale of importance. The election of Barack Obama raised expectations that the United States would give the two issues the priority they had not received during the eight years of the George W. Bush administration. Candidate Obama promised to assign a high priority to the resuscitation of the Arab-Israeli peace process, and separately to “engage” with Iran and Syria (as recommended by the Iraq Study Group in 2006).

In May 2009, shortly after assuming office, President Obama sent the assistant secretary of state for Near Eastern affairs, Jeffrey Feltman, and the senior director for the Middle East in the National Security Council, Daniel Shapiro, to Damascus to open a dialogue with Bashar al-Asad’s regime. Several members of Congress also travelled to Syria early in Obama’s first year, including the chairman of the Senate Committee on Foreign Relations, John Kerry, and the chairman of the House Committee on Foreign Affairs, Howard Berman. In addition, when the president appointed George Mitchell as special envoy to the Middle East, Mitchell named as his deputy Fred Hof, a respected expert on Syria and the Israeli-Syrian dispute. Last summer, both Mitchell and Hof visited Damascus and began their give and take with Syria.

And yet, after this apparent auspicious beginning, neither the bilateral relationship between the United States and Syria, nor the effort to revive the Israeli-Syrian negotiation has gained much traction. Damascus must be chagrined by the fact that when the Arab-Israeli peace process is discussed now, it is practically equated with the Israeli-Palestinian track. This paper analyzes the difficulties confronting Washington’s and Jerusalem’s respective Syria policies and offers an approach for dealing with Syria. Many of the recommendations stem from lessons resulting from the past rounds of negotiations, so it is important to understand what occurred.

Downloads

• Download Full Report - English

      

Introduction:

There is an Egyptian proverb that says those who worry about demons will tend to run into them. Like much folk wisdom, it has solid psychological foundations; the likelihood of a problem rearing its head often appears to be exacerbated by constantly fretting about it. Ever since Hosni Mubarak stepped down as president of Egypt on February 11, 2011, the demon named “Now What?” has been keeping the Israeli government up at night. On August 18, it finally leapt up at them.

That day, a group of armed men attacked Israeli buses, as well as civilian and military vehicles north of Eilat, near the Egyptian border. Eight Israelis, both civilians and soldiers, were killed. The Israel Defense Forces (IDF) set off in hot pursuit, shooting at the attackers from a helicopter. The helicopter crew either failed to notice, or ignored, that they were shooting over the Egyptian side of the border. In the pursuit, three Egyptians— an officer and two enlisted men—were killed and another three later died of their wounds. Israeli minister of defense Ehud Barak, while blaming Palestinian groups for the assault, made comments to the effect that the attacks were largely Egypt’s fault as there had been a major security collapse in Egypt since the former regime had been ousted six months earlier.

The way matters unfolded over the next few days pointedly illustrated the answer to a question that had been asked repeatedly both by international media and the Israeli government since Hosni Mubarak’s ouster: What did Egypt’s January 25 Revolution mean for Israel? The simplest answer is that it is no longer business as usual. The relationship between Egypt and Israel has changed and both countries will have to navigate new waters carefully and wisely.

Downloads

• Download the Full Memo

      

Syria is trapped on a crumbling precipice, and however it might fall will entail significant risks for the United States and for the Syrian people.

The brutal regime of Bashar al-Asad is employing its loyal military forces and sectarian thugs to crush the opposition and reassert its tyranny. Even if Bashar fails, Syria may not be out of the woods: an increasingly likely alternative to the current regime is a bloody civil war similar to what we saw in Lebanon, Bosnia, Congo, and most recently in Iraq. The horrors of such a war might even exceed the brutal reassertion of Asad’s control, and would cause spillover into Syria’s neighbors—Turkey, Iraq, Jordan, Lebanon, and Israel—that could be disastrous for them and for American interests in the Middle East.

But the unrest in Syria, which is now entering its second year, also offers some important opportunities, ones that would come from the fall of the regime of Bashar al-Asad, whose family has ruled the country with an iron grip for over forty years. Syria is Iran’s oldest and most important ally in the Arab world, and the Iranian regime has doubled down on Asad, providing him with financial aid and military support to shore up his regime. Asad’s departure would deal a significant blow to Tehran, further isolating it at a time when it has few friends in the region or the world. In addition, Damascus is steadfast in its hostility toward Israel, and Asad’s regime is also a longtime supporter of terrorist groups like Hizballah and Hamas, and has at times aided al-Qa’ida terrorists and former regime elements in Iraq. The regime’s collapse, therefore, could have significant benefits for the United States and its allies in the region.

Actually ousting Asad, however, will not be easy. Although the Obama administration has for months called for Asad to go, every policy option to remove him is flawed, and some could even make the situation worse—seemingly a recipe for inaction. Doing nothing, however, means standing by while Asad murders his own people, and Syria plunges into civil war and risks becoming a failed state. Already the violence is staggering: as of March 2012, at least 8,000 Syrians have died and thousands more have been arrested and tortured in trying to topple the regime. At the same time, Syria is fragmenting. The Syrian opposition remains divided, and the Free Syrian Army is more a brand than a meaningful, unified force. Al- Qa’ida is urging fighters to join the fray in Syria, and sectarian killings and atrocities are growing. Should the violence continue to intensify, Syria’s neighbors may increase their meddling, and instability could spread, further weakening already-fragile neighbors like Iraq and Lebanon.

So to protect U.S. interests, Asad cannot triumph. But a failed Syria, one wracked by civil war, would be just as bad. Thus, U.S. policy must walk this tightrope, trying to remove Asad, but doing so in a way that keeps Syria an intact state capable of policing its borders and ensuring order at home. At the end of the day, however, removing Asad may not be doable at a price the United States is willing to pay. If so, the U.S. government may be forced to choose between living with a brutal but weakened Asad or getting rid of Asad regardless of the consequences.

This memo lays out six options for the United States to consider to achieve Asad’s overthrow, should it choose to do so:

1. Removing the regime via diplomacy;
2. Coercing the regime via sanctions and diplomatic isolation;
3. Arming the Syrian opposition to overthrow the regime;
4. Engaging in a Libya-like air campaign to help an opposition army gain victory;
5. Invading Syria with U.S.-led forces and toppling the regime directly; and
6. Participating in a multilateral, NATO-led effort to oust Asad and rebuild Syria.

The options are complex, and policymakers will probably try to combine several in an attempt to accentuate the positives and minimize the negatives, which will inevitably be difficult and bring out new complications. But by focusing on discrete approaches, this memo helps expose their relative strengths and weaknesses. For each course of action, this memo describes the strategy inherent to the option and what it would entail in practice. It also assesses the option’s advantages and disadvantages.

This memo does not endorse any particular policy option. Rather, it seeks to explain the risks and benefits of possible courses of action at this moment in time. As conditions change, some options may become more practical or desirable and others less so. The authors mostly agree on the advantages and disadvantages of each approach but weigh the relative rewards and costs differently.

Downloads

• Read the full paper

      

Last winter, Salafi parties in Egypt proved themselves a formidable political force, winning a quarter of the vote in the country’s first elections in the post-Mubarak era. For many in Washington, the unexpected strength of Egypt’s conservative religious groups raised unsettling questions about the future of U.S.-Egyptian relations and America’s security interests in the region.

 

Will the political success of Salafis turn Egypt into an anti-American power and strengthen jihadist groups like al-Qa’ida that are bent on using violence against the United States and its allies?

In the Saban Center Middle East Memo, William McCants, a Middle East specialist at CNA and adjunct faculty at Johns Hopkins University, examines the implications of the Salafis’ turn to, and success in, electoral politics. McCants argues that while political participation may not moderate Salafis’ positions on social issues, it will likely erode the strength of their most extreme and violent affiliates. For this reason, America’s interests may be best served when Salafis play a role in post-revolution politics.

Downloads

• The Lesser of Two Evils: The Salafi Turn to Party Politics in Egypt

      

In the wake of the U.S. military departure from Iraq and in the midst of Iran’s continued defiance of the international community over its nuclear program, is a new security arrangement for the Gulf in order? If so, is the Gulf Cooperation Council (GCC) capable of such a task, or should other institutions be considered?

In the Saban Center’s newest Middle East Memo, Security in the Persian Gulf: New Frameworks for the Twenty-First Century, Saban Center Senior Fellow Kenneth Pollack examines the possibility of developing a new security architecture for the region.

Pollack analyzes security arrangements in other parts of the world and focuses on two options:  expanding the GCC and turning it into a formal military alliance and creating an arrangement modeled on the Commission on Security and Cooperation in Europe. In weighing each option, Pollack finds that the latter can better furnish a path toward peace and security.

Downloads

• Security in the Persian Gulf: New Frameworks for the Twenty-First Century

      

The Saban Center for Middle East Policy joined with the American Enterprise Institute and the Institute for the Study of War in June 2012 to host a one-day crisis simulation that explored the implications of spillover from the ongoing violence in Syria. The simulation examined how the United States and its allies might address worsening instability in Lebanon, Iraq, Jordan, Turkey, and elsewhere in the Middle East as a result of the internecine conflict in Syria.

The Saban Center’s Middle East Memo, “Unraveling the Syria Mess: A Crisis Simulation of Spillover from the Syrian Civil War,” authored by simulation conveners Kenneth M. Pollack, Frederick W. Kagan, Kimberly Kagan, and Marisa C. Sullivan, presents key lessons and observations from the exercise.

Among the key findings:

• A humanitarian crisis alone is unlikely to spur the international community to take action in Syria.
   
• Turkey is a linchpin in any effort to end the fighting in Syria, but Washington and Ankara may not see eye-to-eye on what the end game should be.
   
• U.S. history in Iraq and Lebanon make intervention there unlikely, even if spillover causes a renewal of large-scale violence.

The simulation suggested a tension between U.S. political antipathy toward greater involvement in Syria and the potential strategic desirability of early action.

Downloads

• Download the paper

Video

• Unraveling the Syria Mess

       

Introduction

The issue of Iran has become a central preoccupation for the international community in recent months, thanks to the intersection of the historic changes in the region, an American presidential election, sharpening rhetoric from Israel, and Tehran’s relentless determination to advance its nuclear capabilities. The focus of policymakers in Washington and around the world remains fixed on the options for forestalling Iran’s determined march toward a nuclear weapons capability. This is the appropriate objective; the best possible outcome for maintaining peace and security in the Gulf and avoiding a deeply destabilizing nuclear arms race remains a credible, durable solution that curtails Iran’s nuclear ambitions. And while achieving such an outcome remains profoundly problematic, largely as a result of Tehran’s intransigence, preventing Iran from crossing the nuclear weapons threshold—either through persuasion, coercion, or some combination of the two—remains fully and unambiguously within the capabilities of the international community.

The shadow cast by Tehran has created a particularly intense sense of existential anxiety for the smaller Gulf states, including Kuwait, Bahrain, the United Arab Emirates, Qatar, and Oman. After all, these are the same states whose civil orders were repeatedly disrupted by Iranian subversion and sponsorship of terrorism during the first decade after Iran’s Islamic revolution, and whose thriving economies rely on unimpeded access to the global commons. The events of the past decade have only exacerbated the smaller Gulf states’ endemic sense of insecurity. Iran has achieved a synergistic, sometimes even parasitic, relationship with the leadership of post-Saddam Iraq that, together with Tehran’s longstanding relationships with Syria and Lebanese Hizballah, greatly enables its bid for predominance in the heart of the Middle East. Today, the uncertainties surrounding the implications of regional flux have left Tehran simultaneously weakened and emboldened—a particularly dangerous combination for this particular array of Iranian leaders.

With Iran’s nuclear program advancing by the month and its efforts to tilt the regional balance in its favor growing more forceful, the small states of the Persian Gulf must face the distinct dilemma of preparing for the possible worst-case scenario of the nuclearization of their neighborhood, while participating ever more robustly in the international efforts to preclude that very possibility. In some respects, the Gulf states’ situation is unique. Unlike Israel, another small state that perceives an existential threat from Iran, the Gulf states cannot fall back upon either a presumptive nuclear deterrent or a primordial bond to the body politic of the world’s only remaining superpower. And in contrast to Iran’s other neighbors, the vast resources and history of ideological and territorial disputes between the Gulf states and Tehran significantly intensify the stakes. Even before the Gulf became the vital transportation corridor for global energy, the fault line in the regional balance of power had always run between the northern states and their southern rivals. The mere possibility that the north may gain a nuclear advantage is reshaping the security environment for Iran’s neighbors in the Gulf.

Because the threat of Iran looms large, the exigency of considering the widest possible array of alternative prospects for the evolution of this protracted crisis is important. This paper tackles the scenarios that successive American presidents have deemed unacceptable—an Iranian development or acquisition of a nuclear weapons capability or of nuclear weapons themselves—and the implications that such scenarios would have for the global nonproliferation regime and regional security, with a particular focus on the special challenges faced by Iran’s southern neighbors. To protect against threats along their borders, the Gulf states have traditionally hedged their bets by seeking balanced relations with their more powerful neighbors while cultivating extra-regional allies. That formula is already changing, as evidenced by a new assertiveness in Gulf states’ postures toward Tehran and a new creativity in deploying strategies for deterring and mitigating Iran’s efforts to extend its influence and/or destabilize its neighbors. The Gulf states must transform this tactical innovation into a full-fledged new hedging policy: one that deploys every possible tool to prevent a nuclear Iran while taking every possible step to prepare for such an eventuality.

Download » (PDF)

Downloads

• Thinking the Unthinkable: The Gulf States and a Nuclear Iran

       

The crisis in Syria continues with no end in sight, and in the Saban Center's latest Middle East Memo, Breaking the Stalemate: The Military Dynamics of the Syrian Civil War and Options for Limited U.S. Intervention, Saban Center Senior Fellow Kenneth Pollack argues that until there is a breakthrough on the battlefield, there will be no breakthroughs at the negotiating table.

In his paper, Pollack lays out the military advantages and disadvantages of both the opposition and the regime's forces, and looks at how different opportunities for U.S. intervention can affect those critical dynamics. This analysis provides a much-needed counterpoint to the debate over the possible cost of U.S. options in Syria with an analysis of their likely impact on the conflict.

Highlights include:

• The strengths and weaknesses of the opposition, including: greater numbers, a history of deprivation of political power, the aid of Islamist militias affiliated with the Muslim Brotherhood and Salafist groups, and support from Arab and Western countries.
   
• The strengths and weaknesses of the regime, including: motivation to defend against a determined majority, a geographic advantage, the remnants of the Syrian armed forces, help of foreign contingents like Hizballah, and the support of foreign countries like Iran and reportedly Russia and China.
   
• Options for U.S. interventions to break the stalemate, including:

  • Training and equipping the opposition.
  • Stopping the resupply of the regime in order to diminish its ability to generate firepower.
  • Attacking regime infrastructure targets, such as military bases, power-generation plants and transportation choke points like bridges.
  • Establishing and maintaining a no-fly zone.
  • Engaging in a tactical air campaign against regime ground forces.

Downloads

• Download the paper

       

This summer, the world has watched as an al Qaeda offshoot, the Islamic State group, launched a militant offensive into Iraq, seizing large swaths of land. This Center for Middle East Policy’s Middle East Memo, Kurdistan Rising: To Acknowledge or Ignore the Unraveling of Iraq, examines how the fall of Iraq’s key city of Mosul has changed matters for Kurds in Iraq, and the necessity for American policymakers to take stock of the reality of the Kurdistan Region in this “post-Mosul” world.

Highlights: 

• A look at the Kurds of Iraq, their history and how the United States has largely spurned a partnership with them. Having been autonomous in Iraq since 1991, the Kurds heeded the aspirations of the United States in 2003 to assist in the removal of the Baath regime of Saddam Hussein, and played by the rules of the game established in the post-2003 period, albeit unwillingly at times. However, they have consistently refused to follow a path that would result in relinquishing the powers they enjoy. They have even taken steps to extend their autonomy to the point of having economic sovereignty within a federal Iraq, thus bringing them into serious dispute with Baghdad and the government of Nouri al-Maliki and earning the rebuke of the United States.

• An examination of how, since 2011, failed U.S. and European policies aimed at healing Iraq’s sectarian and ethnic fissures have contributed to the current situation. By so strongly embracing the concept of Iraq’s integrity as crucial to American interests in the region, key allies and partners have been marginalized along the way.

• Policy recommendations for the United States and its western allies, given that the Kurdistan region now stands on the threshold of restructuring Iraq according to its federal or confederal design, or exercising its full right to self-determination and seceding from Iraq. By ignoring the realities of Kurdish strength in Iraq, U.S. and European powers run the risk of losing influence in the only part of Iraq that can be called a success story, and antagonizing what could be a key ally in an increasingly unpredictable Middle East.

Downloads

• Kurdistan Rising: To Acknowledge or Ignore the Unraveling of Iraq

       

Complexity and ambivalence are inherent in Israel’s relationship with its Middle Eastern environment. Israel’s national security agenda is shaped by the hostility of a large part of the Arab and Muslim worlds. During the past 66 years, Israel has been able to crack the wall of Arab hostility, to make peace with two Arab neighbors, and to establish semi-normal relations with several Arab states. But the Arab-Israeli conflict, and its Palestinian core in particular, rages on, and Iran has joined the fray as a powerful and determined adversary.

In Israel, debates over the state’s identity, its place and role in the region, and the more specific issues of the future of the West Bank and Israel’s relationship with the Palestinians, govern the country’s politics and national discourse. The March 2015 Israeli elections are being conducted over a wide range of issues, but they are seen first and foremost as a referendum on these key questions. Politics and policy can hardly be separated. Appearances can be misleading. Currently, the focus of the election campaign seems to be on socio-economic issues. The main challenger of Netanyahu’s current government and potential right-wing coalition is “The Zionist Camp” led by Isaac Herzog and Tzipi Livni. They are strong advocates of reviving a peace process with the Palestinians, but they realize that the Israeli public has drifted to the right. Furthermore, the primaries in the Labor Party produced a left-leaning list of candidates. But whatever the current drift of the campaign, in the elections’ immediate aftermath, whoever forms the next government will have to deal primarily with the Palestinian issue and the national security challenges facing the country.

Downloads

• Israel and the Changing Middle East