Search

Begin New Search Topic Science and Technology Publication Year within 5 Years

661. Taking Action on Cyber Enforcement: Assessing US Legislative Progress in the 116th Congress

Author:
Michael Garcia and Pat Shilo
Publication Date:
02-2021
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
The 116th Congress experienced events like no other in American history, including unprecedented levels of malicious cyber activity. Global estimates say that ransomware attacks have increased by 148% since February 2020, with many US hospitals and schools falling victim and having their operations suspended.1 Leading up to and during the pandemic, Members of the 116th Congress responded and drafted cybersecurity legislation, introducing 316 bills to tackle the issue—a 40% increase from the previous Congress. This memo presents a comprehensive analysis of the cybersecurity legislation introduced in the 116th Congress and is a successor to our memo assessing the cybersecurity legislation in the previous Congress. Unlike the 115th Congress, the two chambers of the 116th were each under the control of a different party. Still, more than half of the introduced bills were bipartisan, including 85% of the bills signed into law. However, only 11% of the introduced bills focused on imposing consequences for the human actors behind cyberattacks, such as imposing sanctions or strengthening laws to prosecute criminals to hold them accountable for their actions. Following the trend of past congresses, most of the bills focused on protecting data and securing critical infrastructure. But while defending data and infrastructure is important, the lack of legislation to address the challenges of imposing consequences on the human actor suggests that Congress should prioritize introducing and passing bipartisan legislation that reduces the impunity with which malicious cyber actors, particularly cybercriminals, act. Here are the main takeaways from the bills introduced last Congress: Cybersecurity-related legislation increased by 40% since the 115th Congress. Of the 316 bills introduced, 14 became law, with nine related to appropriations or agency authorizations legislation. However, only 36 of the 316 bills introduced in the 116th Congress, and just three of the 14 provisions signed into law, focused on imposing consequences on the human actors behind cyberattacks. Cybersecurity remains a largely bipartisan issue. Over 50% of all legislation and 85% of all bills signed into law had a bipartisan co-sponsor.
Topic:
Security, Science and Technology, Cybersecurity, Legislation, and Cyberspace
Political Geography:
North America and United States of America

662. The Militarization of Cyberspace? Cyber-Related Provisions in the National Defense Authorization Act

Author:
Michael Garcia
Publication Date:
04-2021
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
With Congress struggling to pass stand-alone cybersecurity legislation, the National Defense Authorization Act (NDAA) is now the primary vehicle to pass all matters of cybersecurity legislation. Because the annual defense bill typically requires provisions to have a tie to national security, other cyber issues, like those pertaining to criminal justice, tend to be excluded. As a result, the authorities and resources awarded to Department of Defense (DoD) cyber mission far outpace those provided to civilian agencies responsible for partnering with state, local, private, and international partners. With ransomware and cyber incidents at an all-time high, Congress should either include a new title in future Defense bills to bolster US cyber enforcement and civilian agencies’ capabilities or pass a cyber-omnibus bill to fix policy gaps and provide commensurate funds to federal and local agencies to combat malicious cyber activity. In this paper, we analyzed the last five NDAAs (2017-2021) to chronicle Washington’s reliance on the NDAA to shepherd through a wide swath of cybersecurity legislation. We found that: Members of Congress included 290 cyber-related provisions in the past five NDAAs, with the past two NDAAs accounting for 60% of those provisions. In fact, the FY 2021 NDAA contained 380% more cyber-related provisions than the FY 2017 NDAA. The 179 cyber-provisions included in the past two NDAAs far outpace the 14 cybersecurity bills that the 116th Congress passed (two of which were those NDAAs). Across 13 categories, three of the top four were aimed at the DOD core cyber missions, such as changing organizational processes and structures, protecting DoD assets, and engaging with foreign partners while deterring nation-state adversaries. In FY 2020, the number of non-DoD-related cyber provisions began increasing, such as supply-chain security and industrial policy, critical infrastructure protection, and election security. The provisions in these NDAAs helped improve US offensive cyber capabilities, implement measures to deter cyber adversaries, and shore up our cybersecurity defenses, all of which are needed. But because cybersecurity is a multifaceted issue that expands beyond national security and touches on criminal justice, workforce development, private-sector collaboration, and privacy issues, Congress must ensure it takes a holistic approach when creating cybersecurity laws.
Topic:
Defense Policy, Science and Technology, Military Strategy, Legislation, and Cyberspace
Political Geography:
North America and United States of America

663. To Patch or Not to Patch: Improving the US Vulnerabilities Equities Process

Author:
Josh Kenway and Michael Garcia
Publication Date:
06-2021
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
The process that determines when and how the US government discloses unknown cybersecurity vulnerabilities to relevant companies or withholds them for government purposes lacks sufficient accountability, transparency, and public trust. Malicious actors do not hesitate to exploit “zero-day vulnerabilities,” or vulnerabilities that a company has had zero days to patch, with Chinese-based hackers most recently using a zero-day in Microsoft Exchange Servers to infect hundreds of thousands of systems.1 Yet, the government also uses zero-days to carry out activities that are in the nation’s interest and, as a result, does not tell the impacted software or hardware vendor about the vulnerability. In this case, the government determines that the benefit of not disclosing the vulnerability outweighs the consequence of a bad actor potentially exploiting the vulnerability for nefarious purposes. In 2010, the US government created the Vulnerabilities Equities Process (VEP) to convene federal agencies that represent a range of national interests—including security, intelligence, foreign policy, commerce, and civil rights and liberties protection—to weigh distinct perspectives on how vulnerabilities should be patched or briefly kept open for law enforcement, intelligence gathering, or military purposes. However, the VEP is not codified in law and has failed to deliver greater transparency around government retention of vulnerabilities nor ensures accountability for the government’s decisions. Congress and the Biden administration should address deficiencies with the VEP to increase transparency, strengthen accountability, build public and industry trust, and establish a world-leading model for decision-making around what to do about high-value vulnerabilities. This paper details seven steps for the Biden administration to enhance transparency and accountability in the VEP while preserving government priorities, as well as flexibility for the defense of democratic values and institutions.
Topic:
Security, Defense Policy, Science and Technology, Governance, Cybersecurity, and Transparency
Political Geography:
North America and United States of America

664. 2021 Reader’s Guide to Understanding the Proposed US Cyber Enforcement Budget

Author:
Aaron Clarke
Publication Date:
09-2021
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
Cyber attacks in the United States continue to devastate and disrupt day-to-day operations in the private and public sectors. Marked by events like the ransomware attack on Colonial Pipeline that created gas shortages and increased prices, cybercrime impacts everyday citizens, even if they are not directly targeted by an attack. The Department of Homeland Security (DHS) reported that in 2020 there were “over $4 billion in cybercrime losses reported to the U.S. government.”1 This growing cybersecurity threat has only been exacerbated by the rise of cryptocurrencies like Bitcoin and exposed network vulnerabilities from those working from home during the pandemic.2 In response to this influx of cyber attacks, the Biden Administration has taken steps to both bolster the federal government’s ability to detect and respond to cyber attacks as well as protect its own systems.3 The Department of Energy (DOE) and DHS have both made cybersecurity a top priority in their latest initiatives. President Biden called on DOE to launch a 100 day plan aimed at preventing disrupted services for electric utilities, and DHS announced a series of 60-day “sprints” to support private and public partners against ransomware.4 The FY2021 National Defense Authorization Act also created the first U.S. National Cyber Director, tasked to lead the implementation of U.S. cyber policy and strategy, and rapidly improve cybersecurity defense capabilities. Although ransomware attacks have spiked, the federal government has made inroads on combatting cyber criminals. The Cyber Enforcement Budget for FY2022 should continue funding and seek to build on the key improvements and actions taken by the Biden administration. In this guide, we will look at the budget implications for cyber enforcement, recommendations for Congress, and provide a detailed breakdown of the proposed budget’s funding allocations. Specifically, we recommend that Congress should: Restore the $15 million of funding cut from the State Homeland Security Program. The program provides critical grants to states that require recipients spend at least 10% of their grants on cybersecurity needs. Require an alignment of cybercrime goals and outcomes across law enforcement agencies within the Departments of Homeland Security, Justice, and Treasury. Ensure that federal agencies are prepared to implement President Biden’s cybersecurity executive order.
Topic:
Defense Policy, Science and Technology, Law Enforcement, Budget, and Cybersecurity
Political Geography:
North America and United States of America

665. Changes in Oil Markets and New Technology: The Effects of COVID-19 and Climate Change

Author:
Paul Rivlin
Publication Date:
03-2021
Content Type:
Working Paper
Institution:
Moshe Dayan Center for Middle Eastern and African Studies
Abstract:
In our latest issue of Iqtisadi: The Middle East Economy, Paul Rivlin discusses the near and long term prospects for oil pricing, with special attention to new technologies being developed in wealthy Gulf States. In the first two months of 2021, the price of oil rose by almost 38 percent to just over $65/barrel. Was this because of rising demand, supply constraints or increased confidence? All these factors were relevant, but a glance at the OPEC basket price of oil over the past decade puts the rise in prices into perspective. At the end of February, the oil price was well below its 2011-2014 and 2018 highs both nominally terms and even more so when inflation is considered.
Topic:
Climate Change, Energy Policy, Markets, Oil, Science and Technology, Economy, and COVID-19
Political Geography:
Saudi Arabia, United Arab Emirates, and Gulf Nations

666. Journal of Advanced Military Studies: Political Warfare and Propaganda

Author:
James J. F. Forest, Daniel De Wit, Kyleanne Hunter, Emma Jouenne, Glen Segell, Lev Topor, Alexander Tabachnik, Donald M. Bishop, Phil Zeman, Michael Cserkits, and Anthony Patrick
Publication Date:
03-2021
Content Type:
Journal Article
Journal:
Journal of Advanced Military Studies
Institution:
Marine Corps University Press, National Defense University
Abstract:
The digital age has greatly expanded the terrain and opportunities for a range of foreign influence efforts. A growing number of countries have invested significantly in their capabilities to disseminate online propaganda and disinformation worldwide, while simultaneously establishing information dominance at home. Each of the contributions to this issue addresses the central theme of influencing perceptions and behavior. First, Daniel de Wit draws lessons from a historical analysis of the Office of Strategic Services (OSS), America’s intelligence and special operations organization in World War II. In addition to its efforts to collect intelligence on the Axis powers and to arm and train resistance groups behind enemy lines, the OSS also served as America’s primary psychological warfare agency, using a variety of “black propaganda” methods to sow dissension and confusion in enemy ranks.82 As noted earlier, psychological warfare plays a significant role in the conduct of today’s military operations, so de Wit’s research offers important historical lessons for contemporary campaign planners. Next, Kyleanne Hunter and Emma Jouenne examine the uniquely troubling effects of spreading misogynistic views online. Their analysis of three diverse case studies—the U.S. military, the incel movement, and ISIS— reveals how unchecked online misogyny can result in physical behavior that can threaten human and national security. Glen Segell then explores how perceptions about cybersecurity operations can have positive or negative impacts on civil-military relations, drawing on a case study of the Israeli experience. Lev Topor and Alexander Tabachnik follow with a study of how Russia uses the strategies and tactics of digital influence warfare against other countries, while continually seeking to strengthen its information dominance over Russian citizens. And Donald M. Bishop reveals how other countries do this as well, including China, North Korea, Iran, Cuba, and Venezuela. Each is engaged in these same kinds of efforts to control the information that circulates within their respective societies, while using various forms of propaganda against other countries to strengthen their influence and national power. Phil Zeman’s contribution to this issue looks at how China and Russia are trying to fracture American and Western societies through information, disinformation, economic coercion, and the creation of economic dependencies— in many cases capitalizing on specific attributes and vulnerabilities of a target nation to achieve their strategic objectives. Through these efforts, he concludes, China and Russia hope to prevent the will or ability of American or Western states to respond to an aggressive act. Next, Michael Cserkits explains how a society’s perceptions about armed forces can be influenced by cinematic productions and anime, drawing on a case study comparison of Japan and the United States. And finally, Anthony Patrick examines how social media penetration and internet connectivity could impact the likelihood that parties within a conventional intrastate conflict will enter negotiations. As a collection, these articles make a significant contribution to the scholarly research literature on political warfare and propaganda. The authors shed light on the need for research-based strategies and policies that can improve our ability to identify, defend against, and mitigate the consequences of influence efforts. However, when reflecting on the compound security threats described at the beginning of this introduction—involving both cyberattacks and influence attacks—a startling contrast is revealed: we have committed serious resources toward cybersecurity but not toward addressing the influence issues examined in this issue. We routinely install firewalls and other security measures around our computer network systems, track potential intrusion attempts, test and report network vulnerabilities, hold training seminars for new employees, and take many other measures to try and mitigate cybersecurity threats. In contrast, there are no firewalls or intrusion detection efforts defending us against digital influence attacks of either foreign or domestic origin. Government sanctions and social media deplatforming efforts respond to influence attackers once they have been identified as such, but these efforts take place after attacks have already occurred, sometimes over the course of several years. The articles of this issue reflect an array of efforts to influence the perceptions, emotions, and behavior of human beings at both individual and societal levels. In the absence of comprehensive strategies to more effectively defend against these efforts, the United States risks losing much more than military advantage; we are placing at risk the perceived legitimacy of our systems and institutions of governance, as well as our economic security, our ability to resolve social disagreements peacefully, and much more.83 Further, many other nations are also facing the challenges of defending against foreign influence efforts. As such, the transnational nature of influence opportunities and capabilities in the digital age may require a multinational, coordinated response. In the years ahead, further research will be needed to uncover strategies for responding to the threat of digital influence warfare with greater sophistication and success.
Topic:
Security, National Security, Politics, Science and Technology, Military Affairs, Women, Radicalization, Cybersecurity, Internet, History, World War II, Propaganda, Deterrence, Disinformation, Israel Defense Forces (IDF), Digital Policy, Psychological Warfare, and Misogyny
Political Geography:
Russia, Japan, China, Israel, Global Focus, and United States of America

667. China’s Digital Silk Road: integration into national IT infrastructure and wider implications for Western defence industries

Author:
Meia Nouwens
Publication Date:
02-2021
Content Type:
Research Paper
Institution:
International Institute for Strategic Studies
Abstract:
The geopolitical dispute between the United States and China is taking place on the fault line of global telecommunications infrastructure and digital technologies. As this competition grows, so too does the likelihood of a potential bifurcation in the global information and security technological ecosystems, split between US-allied liberal democracies on the one side and countries dependent on Chinese-based information and communications technology (ICT) on the other. The impact of this competition reaches beyond telecommunications companies and those involved in their supply chains. Indeed, second and third order of magnitude implications exist for the security and defence sectors. While this competition unfolds, the Chinese Government’s Digital Silk Road (DSR) continues apace and leverages the strengths of Chinese public- and private-sector giants to further integrate Chinese technologies and standards into the digital ecosystems of the least-developed, emerging and developed economies alike. The existing literature on the security and defence implications of the integration of Chinese ICT into national digital ecosystems is primarily concerned with the potential threats posed to intelligence and defence cooperation. However, the implication of China’s global digital investments for US and other Western defence industries is an understudied subject that deserves greater attention. To provide greater clarity to Western defence industries on these issues, this project has sought to answer four forward-looking questions. Firstly, what risks does the possibility of a bifurcated global digital ecosystem pose for the national and industrial security of key Asian, European and Middle Eastern states and economies? Secondly, to what extent does the integration of Chinese information technology and digital infrastructure create challenges for alliance intelligence and defence cooperation? Thirdly, what level of integration should be considered significant and how might security-cooperation efforts (e.g. Western arms exports) be affected? Lastly, can security risks to companies doing business abroad be mitigated when the integration of Chinese digital technology into national digital ecosystems is already high? This report has aimed to address this gap in current analysis by outlining the potential risks posed by China’s global digital and technological investments to defence industries. It follows with an analysis of the extent of Chinese DSR activity in five case-study countries across Asia, the Middle East and Europe that are of high security and defence importance to the US: Indonesia, the Republic of Korea (ROK), Israel, the United Arab Emirates (UAE) and Poland. In doing so, the report aims to provide greater insight into government decision-making and lessons learned for Western defence industries.
Topic:
Science and Technology, Communications, Infrastructure, Hegemony, Digital Economy, Conflict, Silk Road, and Rivalry
Political Geography:
China, Asia, North America, and United States of America

668. Revitalising arms control: the MTCR and the HCoC

Author:
William Alberque
Publication Date:
11-2021
Content Type:
Research Paper
Institution:
International Institute for Strategic Studies
Abstract:
The paper examines the two most important multilateral frameworks for curbing the spread of uninhabited aerial systems (missiles and UAVs) capable of delivering large conventional payloads and weapons of mass destruction – the Missile Technology Control Regime (MTCR) and the Hague Code of Conduct against Ballistic Missile Proliferation (HCoC). Specifically, the paper discusses the origins and history of the MTCR and HCoC, their evolution over time (or lack thereof) and seeks to measure them against their intended goals. In the end, it urges for radical reform, but also provides suggested incremental changes that should be enacted immediately. It includes analysis of several specific regional security issues and related action–reaction defence-modernisation trends. This paper was drafted within the framework of the Missile Dialogue Initiative (MDI). The MDI was launched by the German Federal Foreign Office in 2019 and is administered by the IISS. The MDI has created a Track 1.5 dialogue (government and non-government experts working together) to contribute to state-level discussions of potential policy responses to the accelerating spread of missile capabilities to state and non-state actors. The MDI appears in the context of the erosion of the global and regional arms-control architecture and during a period of rapid technological change, which includes the evolution and spread of new, advanced missile systems that have contributed to growing instability.
Topic:
Science and Technology, Military Strategy, Conflict, Missile Defense, and Instability
Political Geography:
Global Focus

669. Leading edge: key drivers of defence innovation and the future of operational advantage

Author:
Simona R. Soare and Fabrice Pothier
Publication Date:
11-2021
Content Type:
Research Paper
Institution:
International Institute for Strategic Studies
Abstract:
The ability to develop and integrate emerging and disruptive technologies in defence is rapidly becoming a metric of success in the global competition for power. In this paper, Simona R. Soare and Fabrice Pothier provide a systematic conceptualisation of defence innovation. By empirically analysing innovation efforts in five countries – notably, China, France, Germany, the United Kingdom, and the United States – the paper identifies and analyses four key drivers of defence innovation, provides a better understanding of how the five nations prioritise among them, and explores how they are linked to future operational advantage.
Topic:
Defense Policy, Science and Technology, Military Strategy, Innovation, and Strategic Stability
Political Geography:
Global Focus

670. Armed uninhabited aerial vehicles and the challenges of autonomy

Author:
Douglas Barrie, Oskar Glaese, Niklas Ebert, and Franz-Stefan Gady
Publication Date:
12-2021
Content Type:
Research Paper
Institution:
International Institute for Strategic Studies
Abstract:
Two decades ago, the notion of arming an uninhabited aerial vehicle (UAV) was little more than a niche pursuit. Today, at least 20 countries have weaponised UAV systems in their inventories, with other nations pursuing acquisition, while the capability is also proliferating to non-state actors. The air vehicles range from small, crude, hobbyist-style UAVs favoured by some non-state groups, to large, long-endurance platforms capable of being fitted with a range of sensors and air-to-surface weapons. Technological development continues apace with an increasing emphasis on greater automation and reducing the human workload, along with the emergence of a type of hybrid UAV and air-to-surface munition along side the more established loitering munition. While uninhabited systems are increasingly embraced by many armed forces, they remain an uneasy subject in the wider public realm, where the perceived lack of human control remains an ethical issue. There also continues to be concern in the legal community regarding how increasingly automated – and perhaps one day autonomous – weapon systems fit within the law of armed conflict – legal concept rather than legislation, sometimes also referred to as international humanitarian law. These subjects were the focus of a 21–22 June 2021 seminar organised by IISS Europe to help further the debate and to better understand the implications of weapons-capable uninhabited systems. This paper reflects the discussions and many of the issues raised by the participants.
Topic:
Science and Technology, Military Strategy, Conflict, and Innovation
Political Geography:
Europe