Search

Begin New Search Topic Cybersecurity Publication Year within 5 Years

91. AI Audit-Washing and Accountability

Author:
Ellen P. Goodman
Publication Date:
11-2022
Content Type:
Working Paper
Institution:
German Marshall Fund of the United States (GMFUS)
Abstract:
We are still some distance from a worldwide robot takeover, but artificial intelligence (AI)—the training of computer systems with large data sets to make decisions and solve problems—is revolutionizing the way governments and societies function. AI has enormous potential: accelerating innovation, unlocking new value from data, and increasing productivity by freeing us from mundane tasks. AI can draw new inferences from health data to foster breakthroughs in cancer screening or improve climate modeling and early-warning systems for extreme weather or emergency situations. As we seek solutions to today’s vexing problems—climate disruption, social inequality, health crises—AI will be central. Its centrality requires that stakeholders exercise greater governance over AI and hold AI systems accountable for their potential harms, including discriminatory impact, opacity, error, insecurity, privacy violations, and disempowerment. In this context, calls for audits to assess the impact of algorithmic decision-making systems and expose and mitigate related harms are proliferating1 , accompanied by the rise of an algorithmic auditing industry and legal codification. These are welcome developments. Audits can provide a flexible co-regulatory solution, allowing necessary innovation in AI while increasing transparency and accountability. AI is a crucial element of the growing tech competition between authoritarian and democratic states—and ensuring that AI is accountable and trusted is a key part of ensuring democratic advantage. Clear standards for trustworthy AI will help the United States remain a center of innovation and shape technology to democratic values. The “algorithmic audit” nevertheless remains ill-defined and inexact, whether concerning social media platforms or AI systems generally. The risk is significant that inadequate audits will obscure problems with algorithmic systems and create a permission structure around poorly designed or implemented AI. A poorly designed or executed audit is at best meaningless and at worst even excuses harms that the audits claim to mitigate. Inadequate audits or those without clear standards provide false assurance of compliance with norms and laws, “audit-washing” problematic or illegal practices. Like green-washing and ethics-washing before, the audited entity can claim credit without doing the work. To address these risks, this paper identifies the core questions that need answering to make algorithmic audits a reliable AI accountability mechanism. The “who” of audits includes the person or organization conducting the audit, with clearly defined qualifications, conditions for data access, and guardrails for internal audits. The “what” includes the type and scope of audit, including its position within a larger sociotechnical system. The “why” covers audit objectives, whether narrow legal standards or broader ethical goals, essential for audit comparison. Finally, the “how” includes a clear articulation of audit standards, an important baseline for the development of audit certification mechanisms and to guard against audit-washing. Algorithmic audits have the potential to transform the way technology works in the 21st century, much as financial audits transformed the way businesses operated in the 20th century. They will take different forms, either within a sector or across sectors, especially for systems which pose the highest risk. But as algorithmic audits are encoded into law or adopted voluntarily as part of corporate social responsibility, the audit industry must arrive at shared understandings and expectations of audit goals and procedures. This paper provides such an outline so that truly meaningful algorithmic audits can take their deserved place in AI governance frameworks.
Topic:
Science and Technology, Cybersecurity, Democracy, Regulation, Accountability, and Artificial Intelligence
Political Geography:
Global Focus

92. Cyberattacks Integral to Russia's Political and Military Strategies

Author:
Aleksandra Kozioł
Publication Date:
12-2022
Content Type:
Working Paper
Institution:
The Polish Institute of International Affairs
Abstract:
To destabilise democratic countries that support Ukraine, Russia employs cyberattacks on the target state’s public institutions and critical infrastructure. These activities have clearly intensified since the full-scale invasion began in February 2022 and is in line with the implementation of Russian military strategy. In this context, it would be beneficial within the EU and NATO to develop joint action plans to respond to future threats in cyberspace.
Topic:
NATO, Infrastructure, European Union, Cybersecurity, Cyberspace, Military, and Russia-Ukraine War
Political Geography:
Russia and Europe

93. Frontier influencers: the new face of China’s propaganda

Author:
Fergus Ryan, Daria Impiombato, and Hsi-Ting Pai
Publication Date:
10-2022
Content Type:
Special Report
Institution:
Australian Strategic Policy Institute (ASPI)
Abstract:
This report explores how the Chinese party-state’s globally focused propaganda and disinformation capabilities are evolving and increasing in sophistication. Concerningly, this emerging approach by the Chinese party-state to influence international discourse on China, including obfuscating its record of human rights violations, is largely flying under the radar of US social media platforms and western policymakers. In the broader context of attempts by the Chinese Communist Party (CCP) to censor speech, promote disinformation and seed the internet with its preferred narratives, we focus on a small but increasingly popular set of YouTube accounts that feature mainly female China-based ethnic-minority influencers from the troubled frontier regions of Xinjiang, Tibet and Inner Mongolia, hereafter referred to as ‘frontier influencers’ or ‘frontier accounts’. Despite being blocked in China, YouTube is seen by the CCP as a key battlefield in its ideological contestation with the outside world, and YouTube’s use in foreign-facing propaganda efforts has intensified in recent years. Originally deployed on domestic video-sharing platforms to meet an internal propaganda need, frontier-influencer content has since been redirected towards global audiences on YouTube as part of the CCP’s evolving efforts to counter criticisms of China’s human rights problems and burnish the country’s image. Alongside party-state media and foreign vloggers, these carefully vetted domestic vloggers are increasingly seen as another key part of Beijing’s external propaganda arsenal. Their use of a more personal style of communication and softer presentation is expected to be more convincing than traditional party-state media content, which is often inclined towards the more rigid and didactic. For the CCP, frontier influencers represent, in the words of one Chinese propaganda expert, ‘guerrillas or militia’ fighting on the flanks in ‘the international arena of public opinion’, while party-state media or the ‘regular army’ ‘charge, kill and advance on the frontlines’. The frontier accounts we examine in this report were predominantly created in 2020–21 and feature content that closely hews to CCP narratives, but their less polished presentation has a more authentic feel that conveys a false sense of legitimacy and transparency about China’s frontier regions that party-state media struggle to achieve. For viewers, the video content appears to be the creation of the individual influencers, but is in fact what’s referred to in China as ‘professional user generated content’, or content that’s produced with the help of special influencer-management agencies known as multi-channel networks (MCNs). For the mostly young and female Uyghur, Tibetan and other ethnic-minority influencers we examine in this report, having such an active presence on a Western social media platform is highly unusual, and ordinarily would be fraught with danger. But, as we reveal, frontier influencers are carefully vetted and considered politically reliable. The content they create is tightly circumscribed via self-censorship and oversight from their MCNs and domestic video platforms before being published on YouTube. In one key case study, we show how frontier influencers’ content was directly commissioned by the Chinese party-state. Because YouTube is blocked in China, individual influencers based in the country aren’t able to receive advertising revenue through the platform’s Partner Program, which isn’t available there. But, through their arrangements with YouTube, MCNs have been able to monetise content for frontier influencers, as well as for hundreds of other China-based influencers on the platform. Given that many of the MCNs have publicly committed to promote CCP propaganda, this arrangement results in a troubling situation in which MCNs are able to monetise their activities, including the promotion of disinformation, via their access to YouTube’s platform. The use of professionally supported frontier influencers also appears to be aimed at ensuring that state-backed content ranks well in search results because search-engine algorithms tend to prioritise fresh content and channels that post regularly. From the CCP’s perspective, the continuous flooding of content by party-state media, foreign influencers and professionally supported frontier influencers onto YouTube is aimed at outperforming other more critical but stale content. This new phenomenon reflects a continued willingness, identified in previous ASPI ICPC reports,1 by the Chinese party-state to experiment in its approach to shaping online political discourse, particularly on those topics that have the potential to disrupt its strategic objectives. By targeting online audiences on YouTube through intermediary accounts managed by MCNs, the CCP can hide its affiliation with those influencers and create the appearance of ‘independent’ and ‘authoritative’ voices supporting its narratives, including disinformation that it’s seeking to propagate globally. This report (on page 42) makes a series of policy recommendations, including that social media platforms shouldn’t allow MCNs who are conducting propaganda and disinformation work on behalf of the Chinese party-state to monetise their activities or be recognised by the platforms as, for example, official partners or award winners. This report also recommends that social media platforms broaden their practice of labelling the accounts of state media, agencies and officials to include state-linked influencers from the People’s Republic of China.
Topic:
Cybersecurity, Social Media, Propaganda, and Disinformation
Political Geography:
China and Asia

94. 'With a little help from my friends': capitalising on opportunity at AUSMIN 2022

Author:
John Coyne and Grace Stanhope
Publication Date:
11-2022
Content Type:
Working Paper
Institution:
Australian Strategic Policy Institute (ASPI)
Abstract:
The annual Australia-US Ministerial Consultations have been the primary forum for bilateral engagement since 1985. The Australian Minister for Defence and Minister for Foreign Affairs will meet with their American counterparts in Washington in 2022, in the 71st year of the alliance, and it’s arguably never been so important. The Australian Strategic Policy Institute is proud to release ‘With a little help from my friends’: Capitalising on opportunity at AUSMIN 2022, a report featuring chapters from our defence, cyber and foreign policy experts to inform and guide the Australian approach to the 2022 AUSMIN consultations. In this report, ASPI harnesses its broad and deep policy expertise to provide AUSMIN's principals with tangible policy recommendations to take to the US. The following chapters describe Australia's most pressing strategic challenges. The authors offer policy recommendations for enhancing Australian and US collaboration to promote security and economic prosperity. The collection of essays covers topics and challenges that the US and Australia must tackle together: defence capability, foreign affairs, climate change, foreign interference, rare earths, cyber, technology, the Pacific, space, integrated deterrence and coercive diplomacy. In each instance, there are opportunities for concrete, practical policy steps to ensure cohesion and stability.”
Topic:
Foreign Policy, Climate Change, National Security, Cybersecurity, and Space
Political Geography:
Australia and Australia/Pacific

95. State-sponsored economic cyber-espionage for commercial purposes: Tackling an invisible but persistent risk to prosperity

Author:
Gatra Priyandita, Bart Hogeveen, and Ben Stevens
Publication Date:
12-2022
Content Type:
Special Report
Institution:
Australian Strategic Policy Institute (ASPI)
Abstract:
As part of a multi-year capacity building project supporting governments in the Indo-Pacific with defending their economic against the risk of cyber-enabled theft of intellectual property, ASPI analysed public records to determine the effects, the actual scale, severity and spread of current incidents of cyberespionage affecting and targeting commercial entities. In 2015, the leaders agreed that ‘no country should conduct or support ICT-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors.’ Our analyses suggests that the threat of state-sponsored economic cyberespionage is more significant than ever, with countries industrialising their cyberespionage efforts to target commercial firms and universities at a grander scale; and more of these targeted industries and universities are based in emerging economies.
Topic:
Cybersecurity, Economy, Espionage, and Commerce
Political Geography:
Indo-Pacific

96. Sharing Cyber Capabilities within the Alliance - Interoperability Through Structured Pre-Authorization Cyber

Author:
Jan Kallberg, Todd Arnold, and Stephen S. Hamilton
Publication Date:
07-2022
Content Type:
Research Paper
Institution:
Department of Social Sciences at West Point, United States Military Academy
Abstract:
S haring cyber weapon/cyber capabilities requires trust between the member states, becoming a high-end policy decision due to the concerns of proliferation and the investment in designing a cyber-weapon that has a limited ’shelf-life’. The digital nature of cyber weapons creates a challenge. A cyber weapon can spread quickly, either self-propagating such as worms or via disclosure (and subsequent reuse) by malware researchers or malicious actors, raising proliferation concerns. Additionally, a cyber-weapon can be copied by the adversary or reverse engineered. Once the weapon is released, the adversary will eventually address the vulnerability, and the opportunity is gone. These factors raise the threshold between member states to share cyber weapons and cyber capabilities. Alliances, like NATO, prepare for a unified multinational, multi domain fight; meanwhile, the national cyber forces are still operating as solitaires with limited interoperability and sharing. There is a need in the collective defence posture to integrate the multinational cyber force to achieve interoperability.
Topic:
Security, Defense Policy, NATO, Regional Cooperation, Cybersecurity, and Alliance
Political Geography:
Europe and North America

97. Cybersecurity in the Humanitarian Sector: New Challenges and Solutions

Author:
Christopher Chen
Publication Date:
11-2022
Content Type:
Commentary and Analysis
Institution:
Centre for Non-Traditional Security Studies, S. Rajaratnam School of International Studies
Abstract:
On 3 November 2022, the International Committee of the Red Cross released its report, “Digitalising the Red Cross, Red Crescent and Red Crystal Emblems: Benefits, Risks and Possible Solutions.” It was in response to cyber intrusions the movement faces. As the humanitarian sector integrates digital technologies into its operations, it faces significant cyber risks. How should the sector navigate this increasingly complex space?
Topic:
Science and Technology, Cybersecurity, NGOs, Humanitarian Crisis, and Digital Transition
Political Geography:
Global Focus

98. What Ukraine Taught NATO about Hybrid Warfare

Author:
Sarah J. Lohmann, Chuck Benson, Vytautas Butrimas, Georgios Giannoulis, and Gabriel Raicu
Publication Date:
11-2022
Content Type:
Special Report
Institution:
The Strategic Studies Institute of the U.S. Army War College
Abstract:
Russia’s invasion of Ukraine in 2022 forced the United States and its NATO partners to be confronted with the impact of hybrid warfare far beyond the battlefield. Targeting Europe’s energy security, Russia’s malign influence campaigns and malicious cyber intrusions are affecting global gas prices, driving up food costs, disrupting supply chains and grids, and testing US and Allied military mobility. This study examines how hybrid warfare is being used by NATO’s adversaries, what vulnerabilities in energy security exist across the Alliance, and what mitigation strategies are available to the member states. Cyberattacks targeting the renewable energy landscape during Europe’s green transition are increasing, making it urgent that new tools are developed to protect these emerging technologies. No less significant are the cyber and information operations targeting energy security in Eastern Europe as it seeks to become independent from Russia. Economic coercion is being used against Western and Central Europe to stop gas from flowing. China’s malign investments in Southern and Mediterranean Europe are enabling Beijing to control several NATO member states’ critical energy infrastructure at a critical moment in the global balance of power. What Ukraine Taught NATO about Hybrid Warfare will be an important reference for NATO officials and US installations operating in the European theater.
Topic:
Security, NATO, Economics, Infrastructure, Cybersecurity, Renewable Energy, and Hybrid Warfare
Political Geography:
Russia, Ukraine, Eastern Europe, Central Europe, Western Europe, and Southeast Europe

99. Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency (NATO COE-DAT Handbook 1)

Author:
Carl V. Evans, Chris Anderson, Malcom Baker, Ronald Bearse, and Salih Biçakci
Publication Date:
11-2022
Content Type:
Special Report
Institution:
The Strategic Studies Institute of the U.S. Army War College
Abstract:
In 2014 NATO’s Centre of Excellence-Defence Against Terrorism (COE-DAT) launched the inaugural course on “Critical Infrastructure Protection Against Terrorist Attacks.” As this course garnered increased attendance and interest, the core lecturer team felt the need to update the course in critical infrastructure (CI) taking into account the shift from an emphasis on “protection” of CI assets to “security and resiliency.” What was lacking in the fields of academe, emergency management, and the industry practitioner community was a handbook that leveraged the collective subject matter expertise of the core lecturer team, a handbook that could serve to educate government leaders, state and private-sector owners and operators of critical infrastructure, academicians, and policymakers in NATO and partner countries. Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency is the culmination of such an effort, the first major collaborative research project under a Memorandum of Understanding between the US Army War College Strategic Studies Institute (SSI), and NATO COE-DAT. The research project began in October 2020 with a series of four workshops hosted by SSI. The draft chapters for the book were completed in late January 2022. Little did the research team envision the Russian invasion of Ukraine in February this year. The Russian occupation of the Zaporizhzhya nuclear power plant, successive missile attacks against Ukraine’s electric generation and distribution facilities, rail transport, and cyberattacks against almost every sector of the country’s critical infrastructure have been on world display. Russian use of its gas supplies as a means of economic warfare against Europe—designed to undermine NATO unity and support for Ukraine—is another timely example of why adversaries, nation-states, and terrorists alike target critical infrastructure. Hence, the need for public-private sector partnerships to secure that infrastructure and build the resiliency to sustain it when attacked. Ukraine also highlights the need for NATO allies to understand where vulnerabilities exist in host nation infrastructure that will undermine collective defense and give more urgency to redressing and mitigating those fissures.
Topic:
Security, NATO, Infrastructure, Cybersecurity, Alliance, Crisis Management, and Risk Assessment
Political Geography:
Europe, Ukraine, North America, and United States of America

100. Cyber War and Ukraine

Author:
James Andrew Lewis
Publication Date:
06-2022
Content Type:
Special Report
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
This is a preliminary review of cyber operations in the Ukraine conflict based on publicly available information. Ukraine was not the first “cyber war”—the term itself makes little sense—but it was the first major conflict involving large-scale cyber operations. The so-far inept Russian invasion, where cyber operations have provided little benefit, raises questions about the balance between defense and offense in cyberspace, the utility of offensive cyber operations, and the requirements for planning and coordination. Better-than-expected Ukrainian defenses seem to be one hallmark of this invasion and the primary reason why Russian cyber efforts have had limited effect. It is likely that Ukraine, forewarned by Russian cyber actions that began as early as 2014, was better prepared as a result. It was also assisted in its cyber defense by friendly countries and private actors with whom it had developed cooperative relationships before the conflict. This preparation allowed it to deflect many Russian offensive cyber operations, suggesting that a well-prepared and energetic defense can have the advantage over offense in cyberspace. Russia had previously used cyberattacks against Ukraine to destroy or damage infrastructure and data. It attempted to do so again in 2022. Based on publicly available information, Russia launched a broad cyber campaign shortly before the invasion (see the appendix for a list of known events). Some reporting showed a huge increase in exploits on the first day. The intent appears to have been to create disorder and overwhelm Ukrainian defenses. Russia sought to disrupt services and install destructive malware on Ukrainian networks included phishing, denial of service, and taking advantage of software vulnerabilities. One company identified eight different families of destructive software used by Russia in these attacks. The primary targets were Ukrainian government websites, energy and telecom service providers, financial institutions, and media outlets, but the cyberattacks encompassed most critical sectors. This was a wide-ranging attack using the full suite of Russian cyber capabilities to disrupt Ukraine, but it was not a success. Russia’s most significant cyber success so far was the disruption of the Viasat Inc’s KA-SAT satellite. This created significant damage that spread beyond Ukraine but ultimately did not provide military advantage to Russia. The attack may have been intended to be part of a larger, coordinated cyberattack that proved unsuccessful, or the Russians may not have expected the rapid restoration of service that was provided with outside assistance. The metric for Viasat and for other actions is not whether a cyberattack is effective in terms of network penetration or the disruption of services or data, but whether its effect helps achieve in this case, the occupation of Ukraine and the elimination of its elected government. By this metric, the Viasat attack was not a success.
Topic:
Security, Military Strategy, Cybersecurity, and Russia-Ukraine War
Political Geography:
Russia and Ukraine