Search

Begin New Search Topic Cybersecurity Journal Fletcher Security Review

1. Cybersecurity: State Attack and Response Strategies

Author:
Josephine Wolff and Ta-Chun Su
Publication Date:
07-2020
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
. One of the questions that has always been very interesting to me is “Who do we hold responsible when something goes wrong with cybersecurity?” While that is a technical question—because often when something goes wrong, there is a technical component since you are dealing with a computer and the Internet—it also very much has to do with what our liability regimes say, what our policies say, what our social norms and expectations say about who we hold accountable and who is expected to pay for the damage. So for me, I think cybersecurity is about trying to understand what we mean when we talk about the "secure Internet,” what it looks like to have a secure Internet, and who we hold responsible for all the different components of how you get there. To whom do we say “It’s your job not to answer the phishing emails,” or “It’s your job to look for bug traffic on the network.” How do we piece together that entirely complicated ecosystem of different stakeholders, and how do we identify what their different roles and responsibilities should be? ...
Topic:
Security, Science and Technology, Cybersecurity, and Interview
Political Geography:
Global Focus

2. The Need for Countries to Establish Robust and Transparent Vulnerabilities Equities Processes

Author:
Sharon Bradford Franklin
Publication Date:
07-2019
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
In 2017, leaders of the U.S. Intelligence Community warned that “more than 30 nations are developing offensive cyberattack capabilities.”1 This means that more than 30 countries may be conducting hacking operations as a method for surveillance, disruption, or destruction. Unregulated cyber surveillance and cyberattacks by government actors can pose risks not only to a government’s foreign adversaries, but also to its own citizens. Thus, as the United States and other nations work to enhance their own offensive cyber capabilities, as well as to develop strategies to defend against potential attacks, it is critical that these countries establish legal regimes to govern such conduct in cyberspace. Although Germany has established a legal framework to regulate government hacking activities,[2] few countries have done so.[3] ​ To bring government hacking operations within the rule of law, a crucial step is to design rules regarding the management of vulnerabilities that governments discover or acquire. As with other cyber actors, when governments conduct hacking operations, this frequently involves exploiting vulnerabilities in computer hardware and software systems. But these same flaws can also be manipulated by a government’s foreign adversaries or other malicious actors. Therefore, when countries consider their abilities to rely on hacking as an investigative tool, as well as their interests in exploiting vulnerabilities for military and intelligence operations, they must also evaluate the capacity of information and communications technology providers to repair bugs and protect the cybersecurity of all users. Determining whether to exploit a vulnerability or disclose it to a vendor for patching involves balancing a variety of different security concerns against each other. ​ Some countries have made progress in formalizing the rules for making these decisions and in publicizing these rules to promote public accountability. In November 2017, the United States released a charter governing its Vulnerabilities Equities Process (VEP), which outlines how the U.S. government weighs the various competing equities.[4] The charter delineates which components of the government will participate in determinations regarding whether to disclose or retain each newly discovered vulnerability, and it sets forth the criteria to be used and the process to be followed in making such assessments. One year later, the United Kingdom (UK) announced its Equities Process, which follows a similar approach.5 Most recently, in March 2019, Australia released its “Responsible Release Principles for Cyber Security Vulnerabilities,”[6] and Germany is currently working to develop a VEP and is expected to make information about its process public in early 2019.[7] However, as described below, the VEP procedures revealed to date need further improvement,[8] and most of the nations with offensive cyber capabilities have not developed—or at least have not announced—any such framework...
Topic:
Security, Intelligence, Science and Technology, and Cybersecurity
Political Geography:
North America and United States of America

3. How Much Does a “Privacy” Weigh?

Author:
Paul Rosenzweig
Publication Date:
07-2019
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
Benjamin Franklin is famous, in part, for having said, “Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.” Though historical evidence suggests Franklin’s quote has been misinterpreted,[1] the aphorism has come to stand for the proposition that privacy and security stand in opposition to each other, where every increase in security likely results in a commensurate decrease in privacy, and vice versa. ​ Couched in those terms, the privacy/security trade-off is a grim prospect. We naturally want both privacy and security to the greatest extent possible. But Franklin tells us this is impossible — that privacy and security are locked in a zero-sum game where the gain of one comes only at the loss of the other. ​ Of course, this characterization is assuredly flawed; it is certainly possible to adopt systems that maximize both privacy and security in a Pareto optimal way. That is one of the reasons why so many privacy and security experts simply revile the “balancing” metaphor — it obscures more than it illuminates... ​
Topic:
Security, Science and Technology, Cybersecurity, and Privacy
Political Geography:
Global Focus and United States of America

4. The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age by David Sanger

Author:
David Sanger and Travis Frederick
Publication Date:
07-2019
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
In The Perfect Weapon, David Sanger argues that the nature of global power itself is undergoing dramatic changes, brought about by the proliferation of highly advanced cyber capabilities. Today, internet access is nearly ubiquitous, the cost of entry is low, and, particularly in the domain of cyberwarfare, there is one fundamental fact: offensive capabilities have critically outpaced cyber defenses. A weak and impoverished nation like North Korea can hold large swaths of public and private infrastructure in America at risk, steal military OpPlans, and pilfer millions of dollars from foreign banks. A Kremlin reeling from sanctions, low oil prices, and historically low public trust is able to threaten the very foundations of American democracy through targeted social media campaigns and hacking and leaking the emails of a major political party. But while the offensive advantage has given weaker powers greater capacity to pursue their geopolitical objectives, U.S. leadership has found that their response options have not similarly benefitted. America’s offensive cyber prowess so exceeds its own defensive capabilities that officials often hesitate to strike back for fear of establishing norms of retaliation against vulnerable infrastructure or inciting unintended escalation. Sanger argues that without an open public debate among government policy makers, military planners, and academics to coordinate a grand strategy, the United States will be forced to accept a world of constant cyberattacks, limited response options, and the greater risk of capitulating to foreign coercion...
Topic:
Security, Intelligence, Science and Technology, Cybersecurity, and Book Review
Political Geography:
North America and United States of America

5. North Korea: The Myth of Maxed-Out Sanctions

Author:
Joshua Stanton
Publication Date:
01-2015
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
On December 19, 2014, President Obama publicly blamed North Korea for the cyberattack against Sony Pictures and for the subsequent cyberterrorism against the American people, and promised to "respond proportionally." Almost immediately thereafter, one could hear a familiar narrative repeated, typified by New York Times correspondent David Sanger, who wrote that "North Korea is under so many sanctions already that adding more seems futile." One could have heard similar arguments in 2006, after North Korea's first nuclear test, and in 2013, after its third nuclear test. A variation of this argument is that “Washington … can do little ... without the cooperation of China.” ​ For years, journalists have quoted “experts” who insisted that U.S. sanctions options against North Korea were exhausted and had failed as an instrument of policy. As a matter of both fact and law, however, that is false; it even suggests that these experts have not read and understood the sanctions authorities. Why does this view persist, then? Some scholars may accept and propagate it because they oppose sanctions as a matter of policy. Others have simply ceased to question a myth that has entered the received wisdom. A true understanding of the potential effectiveness of sanctions first requires an understanding of what these sanctions are, what they are not, and how they work. This article will first summarize the sanctions authorities – U.N. Security Council resolutions, and the U.S. sanctions that should be an important part of the effective enforcement of the measures that the U.N. Security Council has adopted. It will also explain the role of the Treasury Department in regulating the international financial system, and the power this gives the United States to isolate the North Korean government from that system. It will explain which U.S. and U.N. sanctions against North Korea have succeeded and failed, and why. Finally, it will explain what current U.S. national sanctions do, and what they do not do. Only after one understands how little the current sanctions do – and how much they could do – can one begin to understand how to strengthen them into an effective part of a coherent foreign policy... ​
Topic:
Science and Technology, United Nations, Sanctions, Cybersecurity, and Economy
Political Geography:
Asia, North Korea, North America, and United States of America

6. Full Issue: Emerging Domains of Security

Author:
Meg Guliford, Thomas McCarthy, Alison Russell, Michael M. Tsai, Po-Chang Huang, Feng-tai Hwang, Ian Easton, Matthew Testerman, Nikolas Ott, Anthony Gilgis, Todd Diamond, Michael Wackenreuter, Sebastian Bruns, Andrew Mark Spencer, Wendy A. Wayman, and Charles Cleveland
Publication Date:
09-2015
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
The theme of this special edition is “Emerging Domains of Security.” Coupled with previously unpublished work developed under a prior “Winning Without War” theme, the articles therein honor Professor Martel’s diverse, yet forward-leaning, research interests. This edition maintains the journal’s four traditional sections of policy, history, interviews, and current affairs. Our authors include established academics and practitioners as well as two Fletcher students, Nikolas Ott and Michael Wackenreuter. Each of the articles analyzes critical issues in the study and practice of international security, and our authors make salient arguments about an array of security-related issues. The articles are borne out of countless hours of work by FSR’s dedicated editorial staff. I deeply appreciate the time and effort they devoted to the publication of this volume. They are full-time graduate students who masterfully balanced a host of responsibilities.
Topic:
Security, Defense Policy, Intelligence, International Cooperation, International Law, History, Military Affairs, Counter-terrorism, Cybersecurity, Navy, Conflict, Space, Interview, Army, Baath Party, and Norms
Political Geography:
China, Iraq, Europe, Middle East, Taiwan, Germany, Asia-Pacific, Global Focus, and United States of America

7. Roadmap for a Code of Conduct for Cyberspace

Author:
Thomas McCarthy and Alison Russell
Publication Date:
09-2015
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
Professor Martel, author of Grand Strategy in Theory and Practice: The Need for an Effective American Foreign Policy, offers three guiding principles for U.S. grand strategy: rebuilding domestic foundations of power; exercising American leadership to restrain sources of disorder that directly threaten U.S. vital interests; and forging both alliances and partnerships to confront the most pressing threats to global stability.[2] The last of Martel’s three principles foreshadows the three cyber security activities at the heart of the newly released U.S. Department of Defense Cyber Strategy. The three activities around which the new U.S. DoD cyber strategy revolves are: Information sharing and interagency coordination; building bridges to the private sector; and building alliances, coalitions, and partnerships abroad.[3] These three coordinating and collaborating activities are the key to building relationships between actors influencing the development of the cyber domain, and are necessary to identify and counter threats. To advance global cyber security, the Cyber Strategy suggests the U.S. must “build and maintain robust international alliances and partnerships to deter shared threats and increase international security and stability.”[4] As part of this effort, the United States seeks to build security relationships to respond to shifts in the international environment, including sources of disorder. These relationships are built upon trust and cooperation of many actors with varied interests and objectives in cyberspace. Given the wide variety of actors and interests within the cyber domain, establishing relationships of trust based on a shared understanding of acceptable conduct, expected behavior, and governing principles represents a daunting challenge...
Topic:
Security, Foreign Policy, Cybersecurity, and Grand Strategy
Political Geography:
North America and United States of America

8. Conflict in Cyberspace: How International Legal Norms Can Reduce Military Escalation in Cyberspace

Author:
Nikolas Ott
Publication Date:
09-2015
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
This paper examines the current technical and legal considerations around the development of international legal norms and confidence-building measures in cyberspace. With an emphasis on state-based armed attacks and the use of force in cyberspace, it summarizes the current status of international efforts within the United Nations and several regional organizations. The paper concludes with several suggestions on how policymakers can reduce the gap between technological and legal considerations.
Topic:
International Law, Military Affairs, and Cybersecurity
Political Geography:
United Nations, North America, and United States of America