Search

Begin New Search Topic Science and Technology Publishing Institution Carnegie Endowment for International Peace

31. International Strategy to Better Protect the Financial System Against Cyber Threats

Author:
Tim Maurer and Arthur Nelson
Publication Date:
11-2020
Content Type:
Special Report
Institution:
Carnegie Endowment for International Peace
Abstract:
In February 2016, a few months after Carnegie began its work on this project, a cyber attack shook the finance world. Hackers had targeted SWIFT, the global financial system’s main information network, trying to steal 1 billion U.S. dollars, nearly 0.50 percent of Bangladesh’s GDP, from the Bangladeshi central bank over the course of a weekend. It was a wake-up call revealing that cyber threats targeting the financial sector were no longer limited to low-level theft but could now pose systemic risk. Only a few months earlier, in 2015, the Carnegie Endowment for International Peace had launched an initiative to better protect the global financial system against cyber threats. Our first step was to develop a proposal for the G20 to launch a work stream dedicated to cybersecurity in the financial sector. In March 2017, the G20 Finance Ministers and Central Bank Governors outlined an initial road map to increase the cyber resilience of the international financial system. In the wake of the Bangladesh incident, Carnegie expanded its work, complementing the G20 project with the development of an action-oriented, technically detailed cyber resilience capacity-building tool box for financial institutions. Launched in 2019 in partnership with the IMF, SWIFT, FS-ISAC, Standard Chartered, the Global Cyber Alliance, and the Cyber Readiness Institute, this tool box is now available in seven languages. And we are continuing to track the evolution of the cyber threat landscape and incidents involving financial institutions through a collaboration with BAE Systems. To raise more awareness among senior officials of the growing threat, Carnegie also hosted a series of roundtables at the Munich Security Conference, including a cyber war game, dedicated to cybersecurity and the financial system. We co-hosted a high-level roundtable with the IMF for central bank governors and launched a workshop series at Wilton Park to strengthen the relationships among financial authorities, industry, and law enforcement as well as national security agencies. In July 2019, an international group—convened by Carnegie—of leading experts in governments, central banks, industry, and the technical community decided that there would be value in developing a longer-term international cybersecurity strategy for the financial system. This report is the result of that project and offers a vision for how the international community could better protect the financial system against cyber threats. The recommendations are designed to inform the deliberations among the G20, the G7, relevant standard-setting bodies as well as the Annual Meeting of the World Economic Forum and the Munich Security Conference. Written by Carnegie experts, this document includes feedback obtained through consultations with more than 200 stakeholders in government, the financial regulatory community, industry, and academia. An international advisory group, formed in fall 2019, provided strategic advice throughout the project. In February 2020, following Carnegie’s presentation of this project at the Forum’s annual meeting in Davos the previous month, the World Economic Forum became an official partner.
Topic:
Science and Technology, Cybersecurity, Finance, and Non-Traditional Threats
Political Geography:
Global Focus and United States of America

32. The EU’s Role in the Fight Against Disinformation: Developing Policy Interventions for the 2020s

Author:
James Pamment
Publication Date:
09-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
The EU needs a disinformation strategy that is adaptable and built to last. The European Union (EU) needs a well-conceived and forward-looking policy for countering threats in the information space, especially those posed by disinformation, influence operations, and foreign interference. Because of the amorphous and ever-changing nature of the threat, EU officials and their counterparts in EU member states would do well to craft an approach that draws on a variety of effective tools, including strategies for altering adversaries’ behavior, nonregulatory principles and norms to foster a well-functioning digital public sphere, and regulatory interventions when necessary to ensure that digital platforms uphold suitable norms, principles, and best practices.
Topic:
Science and Technology, European Union, Disinformation, Non-Traditional Threats, and Digital Policy
Political Geography:
Europe

33. Cross-Border Data Access for Law Enforcement: What Are India’s Strategic Options?

Author:
Smriti Parsheera and Prateek Jha
Publication Date:
11-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Access to cross-border data is an integral piece of the law enforcement puzzle. India is well placed to lead the discussions on international data agreements subject to undertaking necessary surveillance reforms. Access to cross-border data for the state’s law-and-order-related functions is an integral piece of the law enforcement puzzle. State agencies’ ability to access data for such purposes is, however, shaped not only by domestic laws and practices but also by the laws of other countries and the state’s international commitments. In the case of India, the use of international cooperation mechanisms to balance efficient data access with protections for citizens’ privacy remains a relatively underexplored facet of its digital strategy. With its growing digital market, economic relevance for large global businesses, and strategic relationships with countries like the United States and those in the European Union (EU), India is well placed to not merely participate in but rather to lead the discussions on international data agreements on behalf of the developing world. This paper evaluates India’s present mechanisms for data access by law enforcement authorities and existing arrangements for cross-border data access. It also analyzes the emerging global movement toward direct data access arrangements. Such arrangements authorize agencies in one jurisdiction to make direct data requests to service providers based in another jurisdiction. The Clarifying Lawful Overseas Use of Data (CLOUD) Act in the United States is an example of a legislative instrument that allows the United States to enter into executive agreements of this nature. Similar discussions are also underway in Europe under the European Commission’s e-evidence proposal involving its twenty-seven member countries and among the sixty-five states that are party to the Budapest Convention on Cyber Crimes. To date, India has not taken any concrete steps to evaluate the pros and cons of such arrangements. Neither has it paid serious regard to the critical and interconnected issue of reforming its domestic framework on lawful data access to ensure adherence with the fundamental right to privacy.
Topic:
Science and Technology, Law Enforcement, Borders, and Data
Political Geography:
South Asia and India

34. Reinventing Transatlantic Relations on Climate, Democracy, and Technology

Author:
Erik Brattberg
Publication Date:
12-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
To get the transatlantic relationship back and on track and to ensure that it will remain relevant in the future, the United States and the European Union should prioritize putting forward concrete ideas and taking actionable steps on climate and energy, democracy and human rights, and digital technology issues. While the election of Joe Biden to the U.S. presidency presents an opening to restore the transatlantic relationship after Donald Trump, the real question facing U.S. and European officials is whether they can successfully manage to advance a new transatlantic agenda for the coming decade. Three pivotal areas where cooperation has fallen short in recent years but where there is now significant potential to do more are climate and energy, democracy and human rights, and digital technology issues. Representing the most pressing challenges our societies are facing in the twenty-first century, progress in these three areas could also help rebuild trust and promote cooperation in other policy areas. To get the transatlantic relationship back and on track and to ensure that it will remain relevant in the future, the United States and the European Union should therefore prioritize putting forward concrete ideas and taking actionable steps in each of these areas over the coming four years.
Topic:
Climate Change, Human Rights, Science and Technology, Democracy, and Transatlantic Relations
Political Geography:
Europe and United States of America

35. New Tech, New Threats, and New Governance Challenges: An Opportunity to Craft Smarter Responses?

Author:
Camino Kavanagh
Publication Date:
08-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Significant technological advances are being made across a range of fields, including information communications technology (ICT); artificial intelligence (AI), particularly in terms of machine learning and robotics; nanotechnology; space technology; biotechnology; and quantum computing to name but a few. These breakthroughs are expected to be highly disruptive and bring about major transformative shifts in how societies function. The technological advances in question are driven by a digital revolution that commenced more than four decades ago. These innovations are centered on the gathering, processing, and analyzing of enormous reams of data emerging from the information sciences with implications for countless areas of research and development. These advances promise significant social and economic benefits, increased efficiency, and enhanced productivity across a host of sectors.
Topic:
Science and Technology, Governance, Economy, and Artificial Intelligence
Political Geography:
Global Focus

36. Moving the Encryption Policy Conversation Forward

Author:
Encryption Working Group
Publication Date:
09-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Strong data encryption thwarts criminals and preserves privacy. At the same time, it complicates law enforcement investigations. A Carnegie working group looks to move the debate forward.
Topic:
Security, Science and Technology, Law Enforcement, and Privacy
Political Geography:
Global Focus and United States of America

37. The Global Expansion of AI Surveillance

Author:
Steven Feldstein
Publication Date:
09-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Artificial intelligence (AI) technology is rapidly proliferating around the world. Startling developments keep emerging, from the onset of deepfake videos that blur the line between truth and falsehood, to advanced algorithms that can beat the best players in the world in multiplayer poker. Businesses harness AI capabilities to improve analytic processing; city officials tap AI to monitor traffic congestion and oversee smart energy metering. Yet a growing number of states are deploying advanced AI surveillance tools to monitor, track, and surveil citizens to accomplish a range of policy objectives—some lawful, others that violate human rights, and many of which fall into a murky middle ground. In order to appropriately address the effects of this technology, it is important to first understand where these tools are being deployed and how they are being used. Unfortunately, such information is scarce. To provide greater clarity, this paper presents an AI Global Surveillance (AIGS) Index—representing one of the first research efforts of its kind. The index compiles empirical data on AI surveillance use for 176 countries around the world. It does not distinguish between legitimate and unlawful uses of AI surveillance. Rather, the purpose of the research is to show how new surveillance capabilities are transforming the ability of governments to monitor and track individuals or systems. It specifically asks: Which countries are adopting AI surveillance technology? What specific types of AI surveillance are governments deploying? Which countries and companies are supplying this technology?
Topic:
Science and Technology, Privacy, Surveillance, and Artificial Intelligence
Political Geography:
China, Asia, and Global Focus

38. Cyber Risk Scenarios, the Financial System, and Systemic Risk Assessment

Author:
Lincoln Kaffenberger and Emanuel Kopp
Publication Date:
09-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Cyber risk has become a key issue for stakeholders in the financial system. But its properties are still not precisely characterized and well understood. To help develop a better understanding, we discuss the properties of cyber risk and categorize various cyber risk scenarios. Furthermore, we present a conceptual framework for assessing systemic cyber risk to individual countries. This involves analyzing cyber risk exposures, assessing cybersecurity and preparedness capabilities, and identifying buffers available to absorb cyber risk–induced shocks.
Topic:
Science and Technology, Cybersecurity, Finance, Internet, and Risk
Political Geography:
Global Focus

39. ICT Supply Chain Integrity: Principles for Governmental and Corporate Policies

Author:
Ariel Levite
Publication Date:
10-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
In an increasingly digitized world, information and communication technologies (ICTs), and especially operational technologies (OTs), have assumed critical importance for governments, industry, and the general public worldwide. Yet trust in the integrity of these products and services is declining because of mounting concerns over inadvertent vulnerabilities in the supply chain and intentional backdoor interventions by state and corporate actors. Compounding the problem, these legitimate security concerns are sometimes exaggerated for political and commercial reasons—a counterproductive dynamic that fuels rivalries, fragments the marketplace, increases anxiety, stifles innovation, and drives up costs. Inarguably, some governments have been intervening in the ICT/OT supply chain or at least laying the groundwork for such interventions. They believe the pursuit to be justifiable and legal, citing objectives related to intelligence, law enforcement, and military operations. Whether valid or not, the concern is that certain corporations are actively or passively weakening the security of the supply chain and final products either at the behest of governments or for questionable purposes. Another concern is that both state and corporate interventions could leverage or mask what are purely lax security standards or flaws in products and services. And this further reduces trust in ICT/OT.
Topic:
Security, Government, Science and Technology, and Private Sector
Political Geography:
Global Focus

40. Lessons Learned and Evolving Practices of the TIBER Framework for Resilience Testing in the Netherlands

Author:
Petra Hielkema and Raymond Kleijmeer
Publication Date:
10-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Financial institutions face an evolving threat landscape with a wide range of hostile actors targeting them. Regulators and consumers reasonably expect the institutions to make themselves more secure. The question then emerges as to whether financial institutions are complying with the different standards, rules, and regulations regarding their security. International standard-setting bodies have recognized the need to raise the bar higher for the resilience of financial institutions. The publication of the Committee on Payments and Market Infrastructures-International Organization of Securities Commissions (CPMI-IOSCO) guidance on cyber resilience in June 2016 has been pivotal in emphasizing the need to have an integrated approach for financial market infrastructures, with the institution’s board being ultimately responsible and accountable for cyber resilience.1 Increasingly, authorities and financial institutions alike recognize that, in addition to assessing the overall resilience posture of a financial institution against sophisticated attacks, it will be important to actually test this posture. The CPMI-IOSCO guidance includes a chapter dedicated to testing, containing several examples of activities to that end. Recently, frameworks for testing the resilience posture of institutions in practice have been developed internationally.
Topic:
Markets, Science and Technology, Finance, and Resilience
Political Geography:
Europe, Netherlands, and Global Focus