Search

Begin New Search Topic Cybersecurity Publication Year within 5 Years

41. Digitising the social safety net: Lessons from Indonesia

Author:
Hilman Palaon
Publication Date:
07-2024
Content Type:
Commentary and Analysis
Institution:
Lowy Institute for International Policy
Abstract:
The digitisation of social safety nets can help drive inclusion and reduce poverty while fostering more resilient social and economic development. Indonesia’s experience offers important lessons for other countries in how to do so. There is no one-size-fits-all approach. Indonesia learned from international examples while developing specific solutions tailored to its needs. Experimentation, sustained political will, and keeping pace with fast-changing technology have been key to its success. A well-executed digitised social safety net offers direct operational gains, including by combatting inefficiency, fraud, and corruption in the provision of social welfare, many spin-off benefits such as expanding digital and financial literacy in society, and contributes to macro-level stability by managing economic shocks and enhancing public trust in government. The next steps in Indonesia’s journey should focus on incorporating digital ID and data analytics to improve the performance and integrity of an expanded social safety net system. Strengthening cybersecurity and data protection will also be critical. A key political test will be the recertification and eligibility agenda, to graduate citizens from social assistance programs once they are no longer in need of them.
Topic:
Cybersecurity, Resilience, Digitization, Inclusion, and Social Assistance
Political Geography:
Indonesia and Southeast Asia

42. Building Resilience? The Cybersecurity, Economic & Trade Impacts of Cloud Immunity Requirements

Author:
Matthias Bauer
Publication Date:
03-2023
Content Type:
Policy Brief
Institution:
European Centre for International Political Economy (ECIPE)
Abstract:
EU Member States should call on the EU’s Cybersecurity Agency (ENISA) and the European Commission to abandon immunity requirements in the proposed EU Cloud Certification Scheme (EUCS). With immunity requirements in the EUCS, the EU risks opening a Pandora’s box, paving the way for data localisation, foreign ownership restrictions, and local establishment requirements in digital industries globally leading to rising trade tensions. ENISA’s current proposal could increase policymakers’ appetite for data localisation in the EU. It would empower the European Commission and Member State authorities to exclude foreign businesses from domestic cloud services markets and set a dangerous precedent for any data-intensive sector. The list of “sectors of high criticality” could be logically extended to both existing services (e.g., financial services) and to new technologies and business models, such as IoT in the energy and healthcare sectors, and autonomous driving in the transport sector. Non-EU jurisdictions would be pressured to respond in kind. EUCS immunity requirements would increase cloud adopters’ exposure to cybersecurity risks. Data localisation often creates obstacles to an integrated management approach towards cybersecurity risks. Country of headquarter and foreign ownership restrictions in the proposed EUCS risk removing global frontier cybersecurity technologies from Member State markets. Excluding these and other EU and non-EU companies from EU Member States could result in a long-lasting security deficit of EU cloud adopters vis-à-vis organisations that are still able to use reliable and often best-practice cloud services offered by providers from outside EU Member States. Immunity requirements in the EUCS are discriminatory by design. They could provoke retaliatory measures by EU trading partners, either unilaterally or through WTO or bilateral FTA (e.g., UK-EU) Dispute Settlement. Local establishment requirements and foreign ownership restrictions would by design discriminate against foreign cloud providers. US-headquartered companies, which currently serve more than 75% of the EU market, would be most affected by EU immunity requirements.[1] Depending on US preferences and the scope of the proposed EUCS, the EU could be subject to retaliatory tariffs of up to USD 12 billion worth of EU goods exports or equivalent restrictions for EU services exports to the US. Other governments could lodge complaints via the WTO as well (e.g., Singapore, Japan, Canada and others, where cloud development is advancing rapidly). EU suppliers are currently in no position to manage a broad-based transition to cloud, and thus such requirements would delay significant efficiency and security gains that current foreign suppliers could offer. A blanket exclusion of non-EU cloud vendors would also likely undermine Europe’s objective to achieve a 75% cloud adoption rate for EU enterprises. Sensitive European businesses and public sector organisations would have to delay migration and make do with legacy systems for a very long time. Contrary to large countries, these negative impacts would be much more pronounced for smaller EU Member States, which lack the presence of large domestic incumbents and generally rely much more on an open international trading regime for digital services. ENISA’s cloud certification scheme should be limited to technical and transparency requirements. Immunity requirements for non-personal data should be addressed in bilateral initiatives such as the EU-US Trade and Technology Council (TTC) or agreements requiring a company that sought to offer services of the highest level of sensitivity to be headquartered in a country granted adequacy with EU data protection rules, or a country that is an adherent to the OECD’s Trusted Government Access principles, or (concerning the US) a participant in the upcoming Trans-Atlantic Data Privacy Framework. Excluding foreign companies from operating in the EU would have far-reaching consequences. If that is the intent, it should require a sound legal analysis and the decision should be taken through a formal legislative procedure at the EU level.
Topic:
Economics, Markets, European Union, Cybersecurity, Digital Economy, Trade, and Resilience
Political Geography:
Europe

43. De-risking authoritarian AI: A balanced approach to protecting our digital ecosystems

Author:
Simeon Gilding
Publication Date:
07-2023
Content Type:
Special Report
Institution:
Australian Strategic Policy Institute (ASPI)
Abstract:
Artificial intelligence (AI)–enabled systems make many invisible decisions affecting our health, safety and wealth. They shape what we see, think, feel and choose, they calculate our access to financial benefits as well as our transgressions, and now they can generate complex text, images and code just as a human can, but much faster. So it’s unsurprising that moves are afoot across democracies to regulate AI’s impact on our individual rights and economic security, notably in the European Union (EU). But, if we’re wary about AI, we should be even more circumspect about AI-enabled products and services from authoritarian countries that share neither our values nor our interests. And, for the foreseeable future, that means the People’s Republic of China (PRC)—a revisionist authoritarian power demonstrably hostile to democracy and the rules-based international order, which routinely uses AI to strengthen its own political and social stability at the expense of individual human rights. In contrast to other authoritarian countries such as Russia, Iran and North Korea, China is a technology superpower with global capacity and ambitions and is a major exporter of effective, cost-competitive AI-enabled technology into democracies.
Topic:
Security, Science and Technology, Authoritarianism, Cybersecurity, and Artificial Intelligence
Political Geography:
China and Asia-Pacific

44. Getting regulation right: Approaches to improving Australia’s cybersecurity

Author:
Rajiv Shah
Publication Date:
08-2023
Content Type:
Policy Brief
Institution:
Australian Strategic Policy Institute (ASPI)
Abstract:
As well as having a global impact, Cybersecurity is one of the most significant issues affecting Australia’s economy and national security. On the one hand, poor cybersecurity presents a risk to the interconnected digital systems on which we increasingly rely; on the other hand, well-managed cybersecurity provides an opportunity to build trust and advantage by accelerating digital transformation. Cyber threats can originate from a diverse range of sources and require a diverse set of actions to effectively mitigate them. However, a common theme is that much better cyber risk management is needed to address this critical threat; the current operation of the free market isn’t consistently driving all of the required behaviours or actions. Regulation can provide a powerful mechanism to modify incentives and change behaviours. However, securing cyberspace depends on the intersection of many factors—technical, social and economic. Current regulations are a patchwork of general, cyber-specific and sector-specific measures with a lack of cohesion that causes overlaps and gaps. That makes the environment complex, which means that finding the right approach that will truly improve overall security and minimise unwanted side effects is difficult. It’s necessary to analyse the interconnected factors that determine the net effectiveness of cybersecurity regulations. Furthermore, the pace of technological change is so fast today that, even if regulation is successful when first implemented, it needs to be appropriately futureproofed to avoid becoming irrelevant after even a few months. Recent rapid developments in artificial intelligence are an example of the risks here that will need to be anticipated in any changes to the regulatory regimes.
Topic:
Security, Science and Technology, Cybersecurity, and Regulation
Political Geography:
Australia and Australia/Pacific

45. Gaming public opinion: The CCP’s increasingly sophisticated cyber-enabled influence operations

Author:
Albert Zhang, Tilla Hoja, and Jasmine Latimore
Publication Date:
04-2023
Content Type:
Special Report
Institution:
Australian Strategic Policy Institute (ASPI)
Abstract:
The Chinese Communist Party’s (CCP’s) embrace of large-scale online influence operations and spreading of disinformation on Western social-media platforms has escalated since the first major attribution from Silicon Valley companies in 2019. While Chinese public diplomacy may have shifted to a softer tone in 2023 after many years of wolf-warrior online rhetoric, the Chinese Government continues to conduct global covert cyber-enabled influence operations. Those operations are now more frequent, increasingly sophisticated and increasingly effective in supporting the CCP’s strategic goals. They focus on disrupting the domestic, foreign, security and defence policies of foreign countries, and most of all they target democracies. Currently—in targeted democracies—most political leaders, policymakers, businesses, civil society groups and publics have little understanding of how the CCP currently engages in clandestine activities online in their countries, even though this activity is escalating and evolving quickly. The stakes are high for democracies, given the indispensability of the internet and their reliance on open online spaces, free from interference. Despite years of monitoring covert CCP cyber-enabled influence operations by social-media platforms, governments, and research institutes such as ASPI, definitive public attribution of the actors driving these activities is rare. Covert online operations, by design, are difficult to detect and attribute to state actors. Social-media platforms and governments struggle to devote adequate resources to identifying, preventing and deterring increasing levels of malicious activity, and sometimes they don’t want to name and shame the Chinese Government for political, economic and/or commercial reasons.
Topic:
Public Opinion, Cybersecurity, Social Media, and Chinese Communist Party (CCP)
Political Geography:
China and Asia

46. Digital China: The Strategy and Its Geopolitical Implications

Author:
David Dorman and John Hemmings
Publication Date:
02-2023
Content Type:
Working Paper
Institution:
Pacific Forum
Abstract:
Over the past few years, there has been growing concern inside the United States, Europe, and in the Indo-Pacific on the strategic direction behind China’s technology policies. Beginning with the debate over 5G and Huawei, this debate has covered Artificial Intelligence (AI), quantum teachnology, and semi-conductors – a foundational technology. And despite a large number of policies in place – Made in China: 2025, Cyber Super Power, and the New Generation AI Development Plan – few in the West have known China’s overall digital grand strategy. In the first installment of a three-part research project, Dr. Dorman and Dr. Hemmings lay out the rise of China’s overall digital grand strategy, Xi’s role in it, and how it has been organized to fulfil Party objectives. The report tracks the rise of the strategy over the past 10 years, the acceleration of that rise during the Covid-19 pandemic, and the current state of the strategy. In particular, it finds Digital China has been supported and designed by General Secretary Xi Jinping himself, and is a bid to make China more competitive vis a vis the West through the digital transformation of rules, institutions, and infrastructure at the national level. Over the past few years, the strategy has risen to become the “overall” strategy for digital development in the eyes of the Chinese Communist Party leadership, bigger than the Digital Silk Road, deeper than the Belt and Road Initiative, more far reaching than 5G or AI, more important than Made in China: 2025, and wider than Cyber Great Power. A renewed Digital China seeks to challenge a hegemonic global system anchored to a previous age. A successful Digital China has profound implications for China’s developmental path, great power competition, and for the norms that will undergird the international system for decades to come. The Party leadership has re-written Marxist economic theory in its bid to incorporate “data” as the basis of its digital economy and in order to foster a Chinese “Digital Marxism”. Digital China seeks to whet the “sharp weapon” of innovation to facilitate its great power rise and challenge to the West. Beijing is testing whether innovative thinking can be created through the digital transformation of tools, talent, and learning. The US and its allies have begun to effect strategic counter-effect to the myriad of PRC technology policies, there is almost zero understanding or public discussion of this digital grand strategy. Whether inattention, mistranslation, or obfuscation, Digital China has been mostly missed by the West over the past decade.
Topic:
Science and Technology, Cybersecurity, Innovation, and Artificial Intelligence
Political Geography:
China, Asia, and Indo-Pacific

47. A History of Shared Values, A Future of Shared Strategic Interests: US-Australia Relations in the Indo-Pacific

Author:
Rob York, Craig Kafura, Rick Umback, Rose Rodgers, and Thom Dixon
Publication Date:
04-2023
Content Type:
Special Report
Institution:
Pacific Forum
Abstract:
The United States and Australia have been treaty allies for more than 70 years. This bond endured throughout the Cold War and the War on Terror, and it increasingly looks as though they will be close partners throughout the great power competition with the People’s Republic of China. The two partner countries were among the earliest critics of the PRC’s handling of the COVID-19 pandemic, have shared concerns over Chinese investment and its impact on their national security, and what growing PRC influence means for them the future of democracy in the Indo-Pacific. The two countries were early and enthusiastic members of the Quadrilateral Security Dialogue, which includes fellow Indo-Pacific democracies Japan and India, and which has moved to address pressing regional challenges such as pandemic response and climate change. Plus, with 2021’s announcement of the Australia-UK-US (AUKUS) pact Canberra proved its willingness to defy not only Beijing, but also other democracies—especially in Europe—to build out its capacity to defend itself and counter the PRC’s growing regional power. The contributions to this volume each address the nature, not only of the alliance, but the challenges it will face in the years to come. Craig Kafula of the Chicago Council on Global Affairs notes that public polling in both countries reveals overwhelming agreement on most subjects related to the alliance and its forthcoming challenges, but also differences of opinion that will have to be navigated. Rick Umback of Australian National University’s School of Politics and International Relations examines the growth of PRC influence over local governments and Australia, and the ramifications this has for other liberal democracies in the Indo-Pacific. Rose Rodgers at the Center for Naval Analyses says the AUKUS has not limited, but actually increased the need for scrutiny of PRC investment in critical and emerging technologies, and other means of screening technological investments. Moving away from what the alliance means for relations with the PRC, Thom Dixon examines the field of cyberbiosecurity—the intersection of cybersecurity and biosecurity—and how US-Australian cooperation in this field is essential to meet two of the great challenges of this age: climate change and pandemic response. Taken together these analyses—brought to you by the next generation of American-Australian analysts—richly detail the nature of the challenges the allies face, and offer recommendations on how to meet them over the next 70 years of their partnership.
Topic:
Security, Bilateral Relations, Cybersecurity, Alliance, and Strategic Interests
Political Geography:
Australia, United States of America, and Indo-Pacific

48. Arms Control Tomorrow: Strategies to Mitigate the Risks of New and Emerging Technologies

Author:
Shannon Bugos
Publication Date:
05-2023
Content Type:
Special Report
Institution:
Arms Control Association
Abstract:
Over recent years, the topic of new and emerging technologies with military applications has ignited a dynamic debate among defense officials, political leaders, diplomats, policy experts, and technical experts. This report provides an overview of the potentially destabilizing effects of several new and emerging technologies and their respective military applications. It aims to provide decision-makers with a better understanding of how to mitigate the risks and reduce the chances that a major power conflict or confrontation escalates to the nuclear level through a range of arms control and risk reduction measures. This report focuses on six significant, distinct emerging military capabilities: hypersonic weapons systems, direct offensive cyberoperations, offensive counterspace capabilities, artificial intelligence (AI)-enabled capabilities, drones, and lethal autonomous weapons systems. This report distills information and ideas from a series of workshops, involving dozens of technical and policy experts in each technology area, that the Arms Control Association conducted in 2021 and 2022. It identifies four overarching themes that highlight the greatest concerns over how the military employment of new and emerging technologies might increase the risk of nuclear weapons use. Increasing the pace of conflict. Increasing uncertainty. Reducing the human role. Incentivizing arms racing. This report identifies near-term risk mitigation measures that are likely achievable now or within the next five years: crisis communications systems, definition establishment, norms, unilateral declarations and actions, and confidence-building measures. This report also outlines long-term measures that are achievable within the next 10 years or beyond: arms control and risk reduction arrangements (e.g., treaties, agreements) that involve more than one country and are more formal than confidence-building measures, although not necessarily legally binding.
Topic:
Arms Control and Proliferation, Science and Technology, Cybersecurity, Risk, and Artificial Intelligence
Political Geography:
Global Focus

49. Why Does the Global Spyware Industry Continue to Thrive? Trends, Explanations, and Responses

Author:
Steven Feldstein and Brian (Chun Hey) Kot
Publication Date:
03-2023
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
The global spyware and digital forensics industry continues to grow despite public backlash following an array of surveillance scandals, many linked to NSO Group’s Pegasus program. This paper explores the resilience of the commercial spyware market and offers ideas about how to limit the spread of invasive cyber surveillance tools. It highlights several factors driving the industry, including elevated demand for intrusion technology from government clients and private customers, as well as inconsistent political will from democratic governments to crack down on these technologies.
Topic:
Science and Technology, Cybersecurity, Democracy, Surveillance, Industry, Forensic Science, and Autocracy
Political Geography:
Global Focus

50. Integrating Cyber Into Warfighting: Some Early Takeaways From the Ukraine Conflict

Author:
Ariel Levite
Publication Date:
04-2023
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
It is too early to draw definitive conclusions about cyber warfare in the lead-up to and the execution of the Ukraine war. Data are lacking, and the outcome of the conflict remains uncertain. Yet through monitoring and analysis of a single year in the first major war into which cyber has been extensively woven, we do know enough to be able to generate some tentative, high-level, generic propositions on the nature of cyber conflict. These propositions draw on wide-ranging press reporting and extrapolate from several superb pieces recently published by my colleagues Jon Bateman, Nick Beecroft, and Gavin Wilde, as well as Microsoft’s recent report on the cyber dynamics of the conflict.1 However, we must still tread cautiously. Our propositions draw on highly imperfect empirical knowledge of a single historical case that is still unfolding.2 Current and future antagonists are also constantly learning from their own and others’ analyses and enhancing their performance, which can render current assessments obsolete.3 For this and other reasons it is quite possible that some of the cyber dynamics unfolding in and around Ukraine may play out differently later in Ukraine as well as in other, future confrontations. As we have observed over millennia, the balance between offense and defense can shift over time; this dynamic may well play out in cyberspace as well. It is also important to note at the outset that widespread assessments disparaging the utility and expediency of Russian cyber operations in the Ukrainian conflict (and projections regarding future conflicts) are presently limited by far more than a lack of comprehensive and reliable empirical data. We also lack insights into the metrics and criteria that each of the protagonists uses to assess the success and failure of cyber’s overall performance in the conflict, and we have only fragmentary evidence of the role each party expected cyber operations to perform. Moreover, even if we had such information, Ukraine-specific answers might not apply elsewhere because the expectations for cyber and the metrics for assessing its performance may vary not only over time and between protagonists but also from one conflict to another. In this context it is important to underscore that some specific factors that possibly helped diminish the efficacy of Russia’s offensive cyber operations in Ukraine may not apply elsewhere. Three in particular deserve to be noted here: Russia’s unique approach toward cyber warfare; the level of external support that Ukraine received before and during the war from some leading national and multinational cyber powers; and the sophistication and battle-tested experience of Ukraine’s cyber warriors.4 Nevertheless, even if some of the cyber characteristics of the Ukraine conflict ultimately turn out to be sui generis, they are instructive given the novelty of the field and the involvement of major powers in the conflict. Hence, there is considerable value in advancing these propositions to focus attention on certain questions and facets of cyber conflict, facilitating their review and reassessment as more comprehensive and reliable information becomes available and developments on the battlefield evolve. But the reader should consider the interim observations and propositions offered here as hypotheses employed as a heuristic to encourage debate and invite feedback. All the propositions offered below pertain to our core conception of what cyber warfare is about. Some of the propositions we advance are novel; others reaffirm or refine tentative assertions made before the war. Taken together they suggest a more subdued view of the utility and impact of cyber warfare than was generally found in prewar speculations. More importantly, the Ukraine war reveals that nations diverge significantly in the role and aims they assign to offensive cyber operations as well as the institutional setup and operational modalities they use for conducting them. Most glaringly, the U.S. perspective and approach (emulated in whole or in part by several other Western nations) differs deeply from that of Russia, which makes it reasonable to expect similar divergence across similar regimes. We group our propositions under three temporal headings: the prewar period (starting in 2014);5 the war itself (beginning on February 24, 2022); and finally, the postwar period, after kinetic hostilities eventually die down. Obviously, we cannot know when this last phase will begin; nevertheless, analysis of trends that were manifest in the two earlier phases of the conflict provides a tentative basis for predictions as to what might be expected down the road. This broad scope is driven by two considerations. First, it is designed to underscore the considerable relevance of cyber operations across various phases and types of conflicts. And second, it highlights continuity as well as change between cyber action in peacetime, in wartime, and in grey area situations, as well as during the transitions between these states of confrontation.
Topic:
Cybersecurity, Conflict, Non-Traditional Threats, and Russia-Ukraine War
Political Geography:
Russia, Eurasia, Ukraine, and United States of America