Building the cyber policy field

In July 2015, FBI Director James Comey was preparing to appear before Congress to argue in support of a government backdoor in encrypted devices, essentially a special “way in” reserved for an authorized entity, such as a law enforcement agency. Two days before that testimony, a group of MIT researchers published a report that would be critical in how the debate played out.

Law enforcement officials in the U.S. and around the world wanted a built-in backdoor to bypass encryption and unlock communications or data whenever they judged it necessary for national security. The report, titled “Keys Under Doormats,” laid out why that would weaken cybersecurity for everyone, not just hackers and criminals. 

Some of the era’s leading cryptographers signed their names to the report. Journalists covered its 11th-hour release, including at Lawfare, a nonpartisan publication focused on national security law. Within months, the Obama administration dropped its push for backdoor access. The following year, Harvard’s Berkman Center released “Don’t Panic. Making Progress on the ‘Going Dark’ Debate.”

The debate had come down to one question: Can you build a door that only the good guys can open? A backdoor built for law enforcement doesn’t check badges. Anyone who finds it, whether a criminal, foreign intelligence agency, or a teenage tech nerd, can “walk” through it. That’s the tradeoff at the center of many cyber policy fights.

Everyone wants powerful technology, security, and privacy but none of its costs, and somebody neutral has to hold those tradeoffs up to the light, explains Eli Sugarman, who served as director of the Hewlett Foundation’s Cyber Initiative for most of its 10 years. “You need a neutral third party that doesn’t have a profit incentive and isn’t vested with the power the way the government is to actually identify what those tradeoffs are.”

That was the impetus for the Cyber Initiative, launched in 2014 to fill the gap for nonpartisan, charitable funding of research and institutions for the fractured cyber policy field. The goal was to provide people across the debate access to knowledge, research, and experts in this nascent field. Over the next decade, it helped inform outcomes like the encryption-backdoor debate. 

The foundation never took an institutional position on whether encryption should be regulated. Instead, Hewlett supported the researchers who produced work like “Keys Under Doormats,” the kind of granular technical research that made it harder for decision makers to act without first reckoning with what new mandates could actually break. 

Cyber policy on purpose

In 2013, former NSA contractor Edward Snowden had leaked classified documents exposing the scope of U.S. government surveillance. The disclosure blew open a public argument over encryption, surveillance, and how far government could reach into private data, such as bulk phone records and email metadata, the kind of everyday communication most people assumed was private and theirs alone. And almost nobody outside of a narrow technical community had the standing to referee the issue.

Larry Kramer, Hewlett’s president at the time, saw an opportunity to make an impact. In March 2014, the foundation committed $20 million over five years to launch the Cyber Initiative, ultimately granting $163 million over its 10-year lifespan. Its first step was to fund policy research and academic programs at three of the country’s leading institutions: MIT, Stanford, and UC Berkeley.

Before 2014, Sugarman recalls, the expertise that existed was scattered: a few people at think tanks, “one-person bands putting out the occasional white paper,” some technical research at RAND, a nonpartisan think tank that often focuses on national security, and law and international relations scholars far removed from the technology underpinning cybersecurity questions. Government agencies were consumed with putting out the most pressing fire, while industry approached cybersecurity from a narrowly technical, product- and profit-driven lens. Nobody occupied the space in between, where legal, policy, and technical expertise met. As journalist and historian Garrett Graff said, “Cybersecurity, at the time, had almost none of that policy infrastructure.” 

Hewlett chose to focus on cyber policy over cybersecurity on purpose. Cybersecurity is the technical work of keeping systems safe from attack. Cyber policy covers the legal and governance questions surrounding it: who gets access to encrypted data, how much surveillance is too much, and who’s accountable when a breach happens. 

The work was too technical and slow-building for industry, whose incentives run quarter to quarter, and too politically fraught for the government, especially in the years right after Snowden, when public trust in Washington’s handling of digital privacy was at a low point. Sugarman says that’s why the job fell to a foundation instead. 

Philanthropy is often described as “society’s risk capital:” it can support work that might fail. Hewlett has embraced that role since it was founded. “It should be the role of foundations to try things that haven’t been tried,” Walter Hewlett, the founders’ son and longtime board member, has said. 

Building around three pillars

When the Cyber Initiative launched in 2014, its goal was to build a field of institutions with expertise that decision makers could trust for answers to the era’s hardest cyber policy questions. Eight months later, Hewlett added $45 million more, split three ways as anchor grants, to stand up cyber policy centers at MIT, Stanford, and UC Berkeley. As Kramer put it, the money was meant as “seed capital to begin generating thoughtful options.” This was considered the first of a three-pillar strategy that also funded talent pipelines and the translation work that turned research into usable policy guidance. 

The grants allowed each university to build an on-campus interdisciplinary center staffed by researchers committed to producing and publishing cyber policy research, paired with a dedicated degree program in the field. As part of the grants, they each agreed to eventually raise their own money to keep the center alive after Hewlett’s seed funding ran out. 

The three schools pursued different directions.

• Stanford folded its effort into a cyber concentration inside the Ford Dorsey Master’s in International Policy, which now draws roughly 60% of that program’s students and built out a Cyber Policy Center (now named the Tech Impact and Policy Center) within its Freeman Spogli Institute for International Affairs. 

• MIT built out policy research and teaching before using the work as a template for a new school, the MIT Stephen A. Schwarzman College of Computing, built to train technologists broadly literate in the societal stakes of what they build. Sugarman says he didn’t see that coming at the initiative’s outset and calls it one of the happiest surprises of the Cyber Initiative’s decade. 

• Berkeley may have gained the most durable return. Its Center for Long-Term Cybersecurity still carries the same name it launched with, from day one building a network of cyber clinics (now roughly 60 of them) seated in universities around the country. They send graduate students to consult with nonprofits and local governments that do not have strong IT infrastructure and need better cybersecurity to protect their networks and services, such as local water utilities.

Beyond those three anchor grants, the Hewlett initiative supported a broader set of groups, including:

• The Institute for Security and Technology, which ran what Sugarman calls one of the most impactful pieces of civil society work anywhere in the field. It established a ransomware task force, a coalition of more than 60 experts from government, industry, and law enforcement, that published a 48-point framework for deterring and responding to ransomware attacks in April 2021, days before the Colonial Pipeline attack made the threat impossible to ignore. Several of its recommendations later became law, including a requirement that critical-infrastructure operators report ransomware attacks. 
• Girl Security built pathways into technical security and cybersecurity careers for girls, young women, and gender minorities, from high school through college. 
• The German think tank called Interface (formerly Stiftung Neue Verantwortung) balanced digital-rights concerns against what Sugarman calls ‘a clear-eyed read of AI and cybersecurity policy’ for the German government and European decision makers more broadly.
• Lawfare, a publication born inside the Brookings Institution in Washington, D.C. (one of the most prominent and oldest policy research organizations in the U.S) before becoming its own independent nonprofit, became the place where national-security law experts hashed out hard questions in public, work that fed directly into mainstream reporting on two of 2016’s biggest election-year stories: the Russian hacking campaign and the fallout over Hillary Clinton’s private email server. Susan Hennessy, Lawfare’s managing editor during the initiative, also ran a Hewlett-backed clearinghouse that connected female national security experts with reporters, widening who got to speak with authority on cyber issues. She later took a senior post at the Justice Department.

Expanding influence and learning through challenges

Sugarman says some of the initiative’s highest returns on investment were the modest grants that trained journalists and built platforms for smarter cyber policy coverage in the media. This includes the Verify media roundtables, hosted in later years in partnership with grantee Aspen Digital, that put cyber experts in a room with the reporters covering them. “They were relatively modest grants,” he says, “that had outsized influence.” 

Hewlett’s tracking data supports this. Over the decade, the foundation tracked how often its grantees’ experts were quoted in news coverage and whether that coverage shifted from narrow “hack of the day” stories to broader analysis of what a given data breach meant for policy. Both numbers rose.

But not everything landed. Sugarman is straightforward about the early years when, he says, Hewlett has acknowledged spreading its first round of grants too thin across many small institutions, hoping to learn by letting ideas complete, before it concluded within a few years that the approach didn’t sustain the field. The strategy then shifted to larger, flexible, multi-year funding for fewer institutions.

He also acknowledges some of the initiative’s early blind spots, including its focus on elite academic institutions, a gap the initiative’s own 2021 talent pipeline evaluation directly surfaced, and one the foundation moved to close near the end with grants to a broader set of academic institutions such as UC San Diego and Temple University, grants to nonprofits focused on the talent pipeline, including Girl Security, as well as new, large-scale grants supporting cyber centers at four minority-serving institutions: Florida A&M University, Florida International University, Spelman College, and Turtle Mountain Community College, a tribal college in North Dakota. 

Exiting responsibly

As with all Hewlett Foundation initiatives, from its start, the Cyber Initiative was built knowing it was time-limited, initially approved for a five-year term, Hewlett’s board decided early that it would be renewed for a second five-year term, but that the funding had a hard stop at year ten. The foundation let grantees know about the end date, and doubled the annual commitment to make sure the field had room and support to mature. It also spent its final years providing fundraising consultants for grantees, and building out other forms of transition support. 

At the final grantee convening in Philadelphia in late 2023, Sugarman braced for the vibe to be similar to a wake. But, he recalls fondly, it didn’t feel like one. “We had built a really strong nucleus of really great organizations and people who genuinely enjoyed talking with each other, learning from each other, and partnering to solve problems,” he says. “It felt like, ‘Okay, it’s a new age, and we need to figure some things out, but we can do this.’” 

The field has largely held that shape since. Verify, the media roundtable Hewlett launched to bring journalists and experts into the same room, ran its fifth edition in 2024 in partnership with Aspen Digital, drawing 90 attendees to talk through AI’s collision with cybersecurity. The Center for Long-Term Cyber Security still runs the national cyber clinic network. Lawfare still shapes national security reporting. 

And in July 2026, with the pace of AI-powered technological change increasing rapidly, Hewlett turned again to how it might support the independent voices of civil society in a conversation at the intersection of technology, policy, and security by announcing a five-year, $100 million Emerging Technology and Security Initiative focused on AI, biotechnology, and quantum computing, with Sugarman returning to the Hewlett Foundation to lead it in its startup phase. The new initiative will apply lessons learned from the earlier initiative, continuing a tradition of nonpartisan support that has an enduring benefit to communities in a world shaped by technology. 

“We are going to try a slightly different approach to field building this time,” Sugarman says. He notes that the field has drawn far more philanthropic interest than cyber policy had in 2014 and that there are key opportunities where Hewlett can partner with others to help ensure that the most consequential technologies of the current era develop in ways that keep people safe and foster innovation.