A Tech Industry Pioneer Targets Cybersecurity, and Calls for a New Era of “Cyber Civil Defense”

You, along with virtually everyone you know, have almost certainly been the victim of a cybercrime — a hack of your email or social media account, your credit card or bank account, or worse.

A hacker breaking into your personal account is bad enough, especially if it's your checking account. But the signature feature of cyberattacks, in a time when so much of modern life is digitized or in the cloud, is how easily they can be scaled up to target major companies, public infrastructure and governments.

Back in 2014, the film and TV studio Sony Pictures was the victim of a costly hack of its computer system, allegedly sponsored by North Korea. In 2020, a cyberattack on the SolarWinds information technology company sneaked malicious code into software that enabled the perpetrators to spy on clients of the Texas-based software company. Those clients included major U.S. companies and government agencies like Homeland Security; federal officials have said the cyberattack was engineered by Russia. And just a week ago, the Ukrainian government said it foiled an attempted cyberattack by Russia to shut down Ukraine's energy grid.

These are the kinds of events that have motivated Craigslist founder Craig Newmark to intensify his advocacy and philanthropy in service of what he terms “cyber civil defense.” This builds upon one of his longtime philanthropic interests: support for ethical journalism and the battle against disinformation, causes for which he's given somewhere between $180 million and $200 million — he hasn't added it all up lately. After a $20 million gift a few years ago, for example, the City University of New York renamed its J-school the Craig Newmark Graduate School of Journalism. A 2021 gift of $5 million went to the Shorenstein Center on Media, Politics and Public Policy at Harvard Kennedy School. Central to much of Newmark’s giving is his concern over the threat to democracy posed by disinformation and media manipulation.

Other focuses of Newmark's philanthropy over the years have included food insecurity, help for veterans and their families, support for teachers, promoting women in technology, and protecting voting rights and elections from foreign and domestic interference, But his newest major philanthropic interest is cybersecurity, a topic for which the self-described computer nerd is well-prepared.

"Cybersecurity is about hacking systems," Newmark said. "Disinformation is about hacking brains." As a successful dot-com pioneer with Craigslist, he has long been concerned with computers, the online space, and the many weaknesses that remained as the world transitioned so quickly into the cloud. Now, he wants to help build the awareness, the tools, and the workforce that individuals need to protect themselves from garden-variety criminals—and that the nation needs to protect itself from more potentially serious attacks on its economy, infrastructure and security.

Recently, Craig Newmark Philanthropies announced that it has committed $50 million to a variety of organizations engaged in educating Americans about escalating cybersecurity threats, and to building the tools and civic infrastructure to keep the country's networks and computers secure. Funds will also go toward the education and training of a workforce with the skills to build and operate these tools. So far, CNP has awarded about $30 million, Newmark says, with another $20 million — and probably more beyond that — to be pledged in the coming months. Grants have gone to Black Girls Hack, Girls Who Code, R Street's Making Space Initiative, Shadowserver and the Stanford Internet Observatory, among others.

CNP’s cyber defense efforts will be managed by the Aspen Institute, which hosts a public-private cybersecurity forum of former government officials, industry veterans, security practitioners and other thought leaders.

Newmark and other security professionals and advocates say it’s critical that philanthropy increases focus on cyber threats; currently, very few funders are active within these areas. Almost exactly a year ago, Newmark was a signatory, along with 30 others in the field, to an open letter calling on philanthropy to increase funding for cybersecurity beyond what the letter called the "practically nonexistent" level. The letter said cybercrime — "the master problem of the Internet age" — was increasing quickly, and that much more needed to be done to protect the public.

Unfortunately, Newmark told me recently, funding levels are virtually unchanged from those practically nonexistent levels of a year ago when the letter was released. But the risks are only getting more pressing. "Bad actors can, in theory, bring down our electrical grid, our water distribution networks, or our supply chains," he said.

Of course, the risk is far from theoretical: just last year, hackers paralyzed a major U.S. fuel line in a ransomware attack. The owners of the line, the Colonial Pipeline Co., paid a $4.4 million ransom. The attack led to gas and airplane fuel shortages across the East Coast, causing President Biden to declare a state of emergency.

"Philanthropists and others need to provide civilians with the tools to protect themselves, their families and their businesses," Newmark said. "Meanwhile, we need to get people education so they can have good cybersecurity careers to help protect enterprises and the country. America has never been seriously attacked on our own soil before now, and that's a new kind of challenge. People of goodwill need to stand up, and people with resources — money, or influence — need to stand up."

The William and Flora Hewlett Foundation is among the few philanthropies that have addressed cybersecurity. According to Kelly Born, director of Hewlett’s Cyber Initiative, a handful of funders have been active in combating disinformation in recent years. "But the cyber side remains harder," she said. "Funders don't see a clear way in, or they think it's not philanthropy's job."

But Born, like Newmark, argues that philanthropy definitely has a role to play. "Larger companies can protect themselves, but there are lots of nonprofits, and individuals, and other organizations that can't," she said. "There are a lot of spaces where you need a third party in the conversation that can represent the public's interest."

Incidentally, Hewlett will, as planned, sunset its 10-year, $130 million Cyber Initiative at the end of next year. At that point, there will be an even greater vacuum in cyber philanthropy.

Featured