Two months ago, the Trump White House published its National Cyber Strategy. It was followed a few days ago with the release of its draft NSTAC Cybersecurity “moonshot.”

The Strategy document was basically a highly nationalistic America-First exhortation that ironically bore a resemblance to China’s more global two-year-old National Cybersecurity Strategy.

However, the Moonshot draft comes across as a Public Relations gambit meant to underpin the Strategy pronouncement by borrowing on the Von Braun project pitched to President Kennedy and implemented in the 1960s as the Apollo program. Apart from the rather ludicrous comparison, the draft itself serves up little more than another cybersecurity word salad found around Washington with six “strategic pillars” sprinkled on top. We are told that these pillars achieve “a more enduringly safe and secure Internet within the next 10 years [that] will require a holistic and multi-disciplinary approach.” A “word salad” rendition of the draft is attached as an image.

These kinds of documents have appeared everywhere around the world over the past decade. Perhaps not unexpectedly, they all tend to have the same salad ingredients: Technology, Human Behavior, Education, Ecosystem, Privacy, and Policy. NATO has an extensive library of them.

And, almost every regional and global organization and intergovernmental body today have their own versions. The EU has several, and nearly two hundred Nation States at the ITU Plenipotentiary at the moment, are redrafting a bundle of them.

There is not much new in the NSTAC draft except the Moonshot packaging plus potentially creating a few new mini-government bureaucracies among existing government agencies to oversee the effort and lobby for additional funding. The last point—funding—figures prominently into the recommendations even as the document plainly offers nothing substantively new.

The report places considerable faith in “U.S. Government leadership” when the historical record in creating joint efforts like SEMANTECH and MCC have been problematic at best in sectors far less abstruse. Furthermore, as opposed to the UK’s NCSC, the aversion within the U.S. to supporting its most valuable expert Information Assurance assets at NSA, creates an enduring institutional dysfunction. Additionally, scores of other national government agencies and thousands of companies and institutes scattered globally are pursuing similar well-funded initiatives that are largely unknown within the U.S. government, and with no ability to discover them and bring about convergence and harmonization.

What is most unfortunate is the model itself—which suggests there is some kind of achievable endpoint of cybersecurity. The complexities and dynamics of contemporary electronic components, code, and networks—coupled with business economics, adversarial incentives, legal constraints, and human foibles—result in an ecosystem where risk management and cyber-hygiene are the necessary courses of action.

On the positive side, the draft recommendations do harken back to a period when NSTAC hosted its own R&D;expert community and regular R&D;workshops. There are, however, several faux pax. While the draft repeatedly mentions that 5G is extremely important and that it will replace existing internets, it somewhat embarrassingly in the Glossary does not know where 5G work is done (i.e., 3GPP and NFV ISG) and that it is already being rolled out. The lack of engagement by U.S. government agencies in existing 5G industry technical developments has long been endemic.

More significantly, the report continues to push the politically motivated “open internet” when NSTAC was warned two decades ago by the DARPA Director who approved the TCP/IP platform development—that the “open internet” notion was flawed and meaningful cybersecurity is fundamentally impossible with open internets. Indeed, the dangers of open internets have come vividly home to roost over the past year courtesy of Russia’s FSB and GRU.

Fortunately, the legacy DARPA internets are rapidly transitioning to a world of virtually instantiated network slices under a 5G aegis. While considerable attention is being devoted to 3GPP and related venues to security, it is unclear whether unknown and unforeseen vulnerabilities and attacks will not emerge.