Search

Begin New Search Topic Cybersecurity Publishing Institution Third Way

1. Chinese Surveillance Devices: Coming to a Neighborhood Near You

Author:
Jayson Browder, Valerie Shen, and Mike Sexton
Publication Date:
06-2022
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
The Chinese government conducts cyber espionage against the US on an unprecedented scale. Senior US intelligence officials have warned the “Internet of Things” is a US counterintelligence and cybersecurity vulnerability. Tens of billions of connected physical devices from Chinese-made webcams to “smart” appliances could be exploited at scale by the Chinese intelligence services. In 2016, the malware “Mirai” was able to weaponize more than half a million devices in a Denial-of-Service attack causing a massive East Coast Internet outage. Unaddressed, these threats will only increase as China exports surveillance devices around the world.
Topic:
Science and Technology, Cybersecurity, Surveillance, and Innovation
Political Geography:
China and Asia

2. Taking Action on Cyber Enforcement: Assessing US Legislative Progress in the 116th Congress

Author:
Michael Garcia and Pat Shilo
Publication Date:
02-2021
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
The 116th Congress experienced events like no other in American history, including unprecedented levels of malicious cyber activity. Global estimates say that ransomware attacks have increased by 148% since February 2020, with many US hospitals and schools falling victim and having their operations suspended.1 Leading up to and during the pandemic, Members of the 116th Congress responded and drafted cybersecurity legislation, introducing 316 bills to tackle the issue—a 40% increase from the previous Congress. This memo presents a comprehensive analysis of the cybersecurity legislation introduced in the 116th Congress and is a successor to our memo assessing the cybersecurity legislation in the previous Congress. Unlike the 115th Congress, the two chambers of the 116th were each under the control of a different party. Still, more than half of the introduced bills were bipartisan, including 85% of the bills signed into law. However, only 11% of the introduced bills focused on imposing consequences for the human actors behind cyberattacks, such as imposing sanctions or strengthening laws to prosecute criminals to hold them accountable for their actions. Following the trend of past congresses, most of the bills focused on protecting data and securing critical infrastructure. But while defending data and infrastructure is important, the lack of legislation to address the challenges of imposing consequences on the human actor suggests that Congress should prioritize introducing and passing bipartisan legislation that reduces the impunity with which malicious cyber actors, particularly cybercriminals, act. Here are the main takeaways from the bills introduced last Congress: Cybersecurity-related legislation increased by 40% since the 115th Congress. Of the 316 bills introduced, 14 became law, with nine related to appropriations or agency authorizations legislation. However, only 36 of the 316 bills introduced in the 116th Congress, and just three of the 14 provisions signed into law, focused on imposing consequences on the human actors behind cyberattacks. Cybersecurity remains a largely bipartisan issue. Over 50% of all legislation and 85% of all bills signed into law had a bipartisan co-sponsor.
Topic:
Security, Science and Technology, Cybersecurity, Legislation, and Cyberspace
Political Geography:
North America and United States of America

3. Follow the Money: Few Federal Grants are Used to Fight Cybercrime

Author:
Michael Garcia
Publication Date:
02-2021
Content Type:
Special Report
Institution:
Third Way
Abstract:
Like traditional crime, not all cybercrime rises to the level that requires a federal response. And like other crimes, victims will call upon state and local law enforcement to respond.1 They are unprepared. The 18,000 law enforcement agencies in the United States lack the tools, personnel, and resources to respond to cybercrime effectively. State and locals have turned to federal funding to fill these gaps, but federal government grants do not prioritize combatting cybercrime. The Justice Department (DOJ) has never identified cybercrime as an “Area of Emphasis” for their main criminal justice grant that awards state and local criminal justice agencies $400-$550 million annually.2 And while DOJ and the Department of Homeland Security (DHS) provided nearly $2 billion that state and local officials could use for cyber enforcement purposes in Fiscal Year (FY) 2019, data from DHS implies that very little is used for cybercrime. Only 2% of all DHS preparedness grant programs were used for all cybersecurity needs in FY 2019.3 Moreover, just three grants in FY 2019 were solely dedicated to cybercrime with a total budget of $12.7 million.4 As a result, only 45% of local law enforcement agencies have access to adequate digital evidence resources, according to one survey. This leads to a backlog of un-analyzed evidence needed to investigate cybercrime and a sense of futility about law enforcement’s ability to close cases.5 While Members of Congress have introduced several bills to create dedicated cybersecurity grant programs for state and local entities, these proposals tend to not include cyber enforcement needs as an eligible expense.6 Moving forward, Congress should: Call on DOJ and DHS to prioritize combatting cybercrime as a main law enforcement issue within their grants. Require prioritization of cyber enforcement needs in grant programs administered by DOJ and DHS in annual appropriations bills; and List cyber enforcement spending as an eligible expense in any bills creating new cybersecurity grant programs for state and local governments.
Topic:
Crime, Law Enforcement, Cybersecurity, Police, Justice, and Cyberspace
Political Geography:
North America and United States of America

4. Digital Currencies' Role in Facilitating Ransomware Attacks: A Brief Explainer

Author:
Kristine Johnson and Michael Garcia
Publication Date:
05-2021
Content Type:
Policy Brief
Institution:
Third Way
Abstract:
This paper details how Bitcoin—the most popular digital currency—is used to facilitate ransomware attacks and how criminals try—and sometimes fail—to cover their tracks. Understanding how criminals use digital currencies for ransomware attacks can lead policymakers to solutions in thwarting and enforcing cybercrimes.
Topic:
Cybersecurity, Digital Economy, Bitcoin, Digitalization, and Digital Currency
Political Geography:
North America and United States of America

5. To Patch or Not to Patch: Improving the US Vulnerabilities Equities Process

Author:
Josh Kenway and Michael Garcia
Publication Date:
06-2021
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
The process that determines when and how the US government discloses unknown cybersecurity vulnerabilities to relevant companies or withholds them for government purposes lacks sufficient accountability, transparency, and public trust. Malicious actors do not hesitate to exploit “zero-day vulnerabilities,” or vulnerabilities that a company has had zero days to patch, with Chinese-based hackers most recently using a zero-day in Microsoft Exchange Servers to infect hundreds of thousands of systems.1 Yet, the government also uses zero-days to carry out activities that are in the nation’s interest and, as a result, does not tell the impacted software or hardware vendor about the vulnerability. In this case, the government determines that the benefit of not disclosing the vulnerability outweighs the consequence of a bad actor potentially exploiting the vulnerability for nefarious purposes. In 2010, the US government created the Vulnerabilities Equities Process (VEP) to convene federal agencies that represent a range of national interests—including security, intelligence, foreign policy, commerce, and civil rights and liberties protection—to weigh distinct perspectives on how vulnerabilities should be patched or briefly kept open for law enforcement, intelligence gathering, or military purposes. However, the VEP is not codified in law and has failed to deliver greater transparency around government retention of vulnerabilities nor ensures accountability for the government’s decisions. Congress and the Biden administration should address deficiencies with the VEP to increase transparency, strengthen accountability, build public and industry trust, and establish a world-leading model for decision-making around what to do about high-value vulnerabilities. This paper details seven steps for the Biden administration to enhance transparency and accountability in the VEP while preserving government priorities, as well as flexibility for the defense of democratic values and institutions.
Topic:
Security, Defense Policy, Science and Technology, Governance, Cybersecurity, and Transparency
Political Geography:
North America and United States of America

6. 2021 Reader’s Guide to Understanding the Proposed US Cyber Enforcement Budget

Author:
Aaron Clarke
Publication Date:
09-2021
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
Cyber attacks in the United States continue to devastate and disrupt day-to-day operations in the private and public sectors. Marked by events like the ransomware attack on Colonial Pipeline that created gas shortages and increased prices, cybercrime impacts everyday citizens, even if they are not directly targeted by an attack. The Department of Homeland Security (DHS) reported that in 2020 there were “over $4 billion in cybercrime losses reported to the U.S. government.”1 This growing cybersecurity threat has only been exacerbated by the rise of cryptocurrencies like Bitcoin and exposed network vulnerabilities from those working from home during the pandemic.2 In response to this influx of cyber attacks, the Biden Administration has taken steps to both bolster the federal government’s ability to detect and respond to cyber attacks as well as protect its own systems.3 The Department of Energy (DOE) and DHS have both made cybersecurity a top priority in their latest initiatives. President Biden called on DOE to launch a 100 day plan aimed at preventing disrupted services for electric utilities, and DHS announced a series of 60-day “sprints” to support private and public partners against ransomware.4 The FY2021 National Defense Authorization Act also created the first U.S. National Cyber Director, tasked to lead the implementation of U.S. cyber policy and strategy, and rapidly improve cybersecurity defense capabilities. Although ransomware attacks have spiked, the federal government has made inroads on combatting cyber criminals. The Cyber Enforcement Budget for FY2022 should continue funding and seek to build on the key improvements and actions taken by the Biden administration. In this guide, we will look at the budget implications for cyber enforcement, recommendations for Congress, and provide a detailed breakdown of the proposed budget’s funding allocations. Specifically, we recommend that Congress should: Restore the $15 million of funding cut from the State Homeland Security Program. The program provides critical grants to states that require recipients spend at least 10% of their grants on cybersecurity needs. Require an alignment of cybercrime goals and outcomes across law enforcement agencies within the Departments of Homeland Security, Justice, and Treasury. Ensure that federal agencies are prepared to implement President Biden’s cybersecurity executive order.
Topic:
Defense Policy, Science and Technology, Law Enforcement, Budget, and Cybersecurity
Political Geography:
North America and United States of America

7. Where Are We Now? Examining the Trump Administration’s Efforts to Combat Cybercrime

Author:
Michael Garcia and Anisha Hindocha
Publication Date:
06-2020
Content Type:
Special Report
Institution:
Third Way
Abstract:
Amid the COVID-19 pandemic, the United States has seen an acceleration of an already massive cybercrime wave. Daily reports of cybercrime to the FBI’s Internet Crime Complaint Center have nearly quadrupled since the pandemic began, to roughly 4,000 reports per day. Unfortunately, even before this crisis began, the enforcement rates for these crimes are low – for every 1,000 reported cyber incidents, only three arrests of the perpetrators occur. In the fall of 2018, the White House released the “National Cyber Strategy of the United States,” which detailed how the Administration would create or update policies for combating cybercrime. While no implementation plan for this Strategy was ever published, Third Way conducted an analysis of publicly available information of the Administration’s actions and budgetary allocations since the strategy’s release to examine their cybercrime enforcement efforts.
Topic:
Security, Defense Policy, Science and Technology, Cybersecurity, Pandemic, COVID-19, and Digitalization
Political Geography:
North America and United States of America

8. US Global Cybercrime Cooperation: A Brief Explainer

Author:
Allison Peters and Anisha Hindocha
Publication Date:
06-2020
Content Type:
Policy Brief
Institution:
Third Way
Abstract:
Cybercrime is a persistent and transnational threat with the rates in the United States estimated to have up to quadrupled during the COVID-19 pandemic. Unfortunately, law enforcement in the United States and globally has struggled to keep up with this crime, resulting in a considerable enforcement gap that allows cybercriminals to operate with near impunity. In the United States, only 3 in 1,000 malicious cyber incidents will ever see an arrest and the global enforcement gap is likely to be similar.1 The investigation of one cybercrime case often involves criminal justice systems in many different countries, requiring intense international cooperation to bring the perpetrators to justice. The United States is a member of a number of formal and informal mechanisms that help facilitate this cooperation. This includes being a party to a number of binding treaties—particularly the only global cybercrime treaty known as the Budapest Convention—as well as a member of key networks and in multilateral forums. The United States is also a member of a number of entities aimed at developing norms to guide the behavior of nation-states in cyberspace where cooperation in cybercrime investigations is encouraged.
Topic:
Defense Policy, Crime, Cybersecurity, Pandemic, and COVID-19
Political Geography:
North America and United States of America

9. Weakened Encryption: The Threat to America’s National Security

Author:
Mieke Eoyang and Michael Garcia
Publication Date:
09-2020
Content Type:
Special Report
Institution:
Third Way
Abstract:
For years, law enforcement officials have warned that, because of encryption, criminals can hide their communications and acts, causing law enforcement to struggle to decrypt data during their investigation—a challenge commonly referred to as “going dark.” They called on technology companies to build a process, like a “master key,” to enable law enforcement to unlock encrypted communications. While this may seem like a tempting idea, it would have grave implications for our national security. As more and more of our communications move online, users seek out encrypted services to protect their privacy. Unlike telephonic communications, and despite repeated requests by law enforcement to do so, Congress has not required internet communications platforms to give law enforcement access to intercept user communications or access stored communications. In this paper, we assess the national security risks to a requirement to provide that master key (referred to throughout as “exceptional” or “backdoor” access) to encrypted communications and propose alternative approaches to address online harms.
Topic:
Security, Science and Technology, Cybersecurity, and Encryption
Political Geography:
North America and United States of America

10. 2020 Thematic Brief: US Cybersecurity Efforts

Author:
Third Way
Publication Date:
09-2020
Content Type:
Policy Brief
Institution:
Third Way
Abstract:
Cybercrime is exploding. Malicious cyber actions by America’s adversaries are becoming more sophisticated. And cybersecurity remains a top national security issue for the United States. But while we are spending huge amounts of effort to secure our systems, our ability to go after attackers is woefully outdated. As COVID-19 continues to ravage the globe, malicious actors are exploiting the pandemic and committing cyberattacks for a variety of motives. Nation-states, terrorists, criminal groups, and lone actors have launched cyberattacks and committed cybercrime against large businesses and private citizens, causing devastating impacts to US national and economic security. While federal, state, and local agencies have taken steps to reduce cyber threats, the Trump Administration has not provided nearly enough resources, does not coordinate efforts, and denies risks posed to election infrastructure. Here’s what Congress must do: Go after the bad actors. We must improve the US government’s capabilities to identify, stop, and punish human cyber attackers in order to close the yawning cyber enforcement gap: the number of cyberattacks launched per year in the United States versus the number of arrests of malicious cyber actors; Secure America’s election infrastructure and combat foreign interference and disinformation efforts; and Re-establish the United States as a global leader in setting policy around how different actors should behave in cyberspace and boost international cooperation and capacity around these issues.
Topic:
Security, Defense Policy, Science and Technology, Cybersecurity, and COVID-19
Political Geography:
North America and United States of America