Search

Begin New Search Topic Cybersecurity

171. Taking Action on Cyber Enforcement: Assessing US Legislative Progress in the 116th Congress

Author:
Michael Garcia and Pat Shilo
Publication Date:
02-2021
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
The 116th Congress experienced events like no other in American history, including unprecedented levels of malicious cyber activity. Global estimates say that ransomware attacks have increased by 148% since February 2020, with many US hospitals and schools falling victim and having their operations suspended.1 Leading up to and during the pandemic, Members of the 116th Congress responded and drafted cybersecurity legislation, introducing 316 bills to tackle the issue—a 40% increase from the previous Congress. This memo presents a comprehensive analysis of the cybersecurity legislation introduced in the 116th Congress and is a successor to our memo assessing the cybersecurity legislation in the previous Congress. Unlike the 115th Congress, the two chambers of the 116th were each under the control of a different party. Still, more than half of the introduced bills were bipartisan, including 85% of the bills signed into law. However, only 11% of the introduced bills focused on imposing consequences for the human actors behind cyberattacks, such as imposing sanctions or strengthening laws to prosecute criminals to hold them accountable for their actions. Following the trend of past congresses, most of the bills focused on protecting data and securing critical infrastructure. But while defending data and infrastructure is important, the lack of legislation to address the challenges of imposing consequences on the human actor suggests that Congress should prioritize introducing and passing bipartisan legislation that reduces the impunity with which malicious cyber actors, particularly cybercriminals, act. Here are the main takeaways from the bills introduced last Congress: Cybersecurity-related legislation increased by 40% since the 115th Congress. Of the 316 bills introduced, 14 became law, with nine related to appropriations or agency authorizations legislation. However, only 36 of the 316 bills introduced in the 116th Congress, and just three of the 14 provisions signed into law, focused on imposing consequences on the human actors behind cyberattacks. Cybersecurity remains a largely bipartisan issue. Over 50% of all legislation and 85% of all bills signed into law had a bipartisan co-sponsor.
Topic:
Security, Science and Technology, Cybersecurity, Legislation, and Cyberspace
Political Geography:
North America and United States of America

172. Follow the Money: Few Federal Grants are Used to Fight Cybercrime

Author:
Michael Garcia
Publication Date:
02-2021
Content Type:
Special Report
Institution:
Third Way
Abstract:
Like traditional crime, not all cybercrime rises to the level that requires a federal response. And like other crimes, victims will call upon state and local law enforcement to respond.1 They are unprepared. The 18,000 law enforcement agencies in the United States lack the tools, personnel, and resources to respond to cybercrime effectively. State and locals have turned to federal funding to fill these gaps, but federal government grants do not prioritize combatting cybercrime. The Justice Department (DOJ) has never identified cybercrime as an “Area of Emphasis” for their main criminal justice grant that awards state and local criminal justice agencies $400-$550 million annually.2 And while DOJ and the Department of Homeland Security (DHS) provided nearly $2 billion that state and local officials could use for cyber enforcement purposes in Fiscal Year (FY) 2019, data from DHS implies that very little is used for cybercrime. Only 2% of all DHS preparedness grant programs were used for all cybersecurity needs in FY 2019.3 Moreover, just three grants in FY 2019 were solely dedicated to cybercrime with a total budget of $12.7 million.4 As a result, only 45% of local law enforcement agencies have access to adequate digital evidence resources, according to one survey. This leads to a backlog of un-analyzed evidence needed to investigate cybercrime and a sense of futility about law enforcement’s ability to close cases.5 While Members of Congress have introduced several bills to create dedicated cybersecurity grant programs for state and local entities, these proposals tend to not include cyber enforcement needs as an eligible expense.6 Moving forward, Congress should: Call on DOJ and DHS to prioritize combatting cybercrime as a main law enforcement issue within their grants. Require prioritization of cyber enforcement needs in grant programs administered by DOJ and DHS in annual appropriations bills; and List cyber enforcement spending as an eligible expense in any bills creating new cybersecurity grant programs for state and local governments.
Topic:
Crime, Law Enforcement, Cybersecurity, Police, Justice, and Cyberspace
Political Geography:
North America and United States of America

173. Digital Currencies' Role in Facilitating Ransomware Attacks: A Brief Explainer

Author:
Kristine Johnson and Michael Garcia
Publication Date:
05-2021
Content Type:
Policy Brief
Institution:
Third Way
Abstract:
This paper details how Bitcoin—the most popular digital currency—is used to facilitate ransomware attacks and how criminals try—and sometimes fail—to cover their tracks. Understanding how criminals use digital currencies for ransomware attacks can lead policymakers to solutions in thwarting and enforcing cybercrimes.
Topic:
Cybersecurity, Digital Economy, Bitcoin, Digitalization, and Digital Currency
Political Geography:
North America and United States of America

174. To Patch or Not to Patch: Improving the US Vulnerabilities Equities Process

Author:
Josh Kenway and Michael Garcia
Publication Date:
06-2021
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
The process that determines when and how the US government discloses unknown cybersecurity vulnerabilities to relevant companies or withholds them for government purposes lacks sufficient accountability, transparency, and public trust. Malicious actors do not hesitate to exploit “zero-day vulnerabilities,” or vulnerabilities that a company has had zero days to patch, with Chinese-based hackers most recently using a zero-day in Microsoft Exchange Servers to infect hundreds of thousands of systems.1 Yet, the government also uses zero-days to carry out activities that are in the nation’s interest and, as a result, does not tell the impacted software or hardware vendor about the vulnerability. In this case, the government determines that the benefit of not disclosing the vulnerability outweighs the consequence of a bad actor potentially exploiting the vulnerability for nefarious purposes. In 2010, the US government created the Vulnerabilities Equities Process (VEP) to convene federal agencies that represent a range of national interests—including security, intelligence, foreign policy, commerce, and civil rights and liberties protection—to weigh distinct perspectives on how vulnerabilities should be patched or briefly kept open for law enforcement, intelligence gathering, or military purposes. However, the VEP is not codified in law and has failed to deliver greater transparency around government retention of vulnerabilities nor ensures accountability for the government’s decisions. Congress and the Biden administration should address deficiencies with the VEP to increase transparency, strengthen accountability, build public and industry trust, and establish a world-leading model for decision-making around what to do about high-value vulnerabilities. This paper details seven steps for the Biden administration to enhance transparency and accountability in the VEP while preserving government priorities, as well as flexibility for the defense of democratic values and institutions.
Topic:
Security, Defense Policy, Science and Technology, Governance, Cybersecurity, and Transparency
Political Geography:
North America and United States of America

175. 2021 Reader’s Guide to Understanding the Proposed US Cyber Enforcement Budget

Author:
Aaron Clarke
Publication Date:
09-2021
Content Type:
Commentary and Analysis
Institution:
Third Way
Abstract:
Cyber attacks in the United States continue to devastate and disrupt day-to-day operations in the private and public sectors. Marked by events like the ransomware attack on Colonial Pipeline that created gas shortages and increased prices, cybercrime impacts everyday citizens, even if they are not directly targeted by an attack. The Department of Homeland Security (DHS) reported that in 2020 there were “over $4 billion in cybercrime losses reported to the U.S. government.”1 This growing cybersecurity threat has only been exacerbated by the rise of cryptocurrencies like Bitcoin and exposed network vulnerabilities from those working from home during the pandemic.2 In response to this influx of cyber attacks, the Biden Administration has taken steps to both bolster the federal government’s ability to detect and respond to cyber attacks as well as protect its own systems.3 The Department of Energy (DOE) and DHS have both made cybersecurity a top priority in their latest initiatives. President Biden called on DOE to launch a 100 day plan aimed at preventing disrupted services for electric utilities, and DHS announced a series of 60-day “sprints” to support private and public partners against ransomware.4 The FY2021 National Defense Authorization Act also created the first U.S. National Cyber Director, tasked to lead the implementation of U.S. cyber policy and strategy, and rapidly improve cybersecurity defense capabilities. Although ransomware attacks have spiked, the federal government has made inroads on combatting cyber criminals. The Cyber Enforcement Budget for FY2022 should continue funding and seek to build on the key improvements and actions taken by the Biden administration. In this guide, we will look at the budget implications for cyber enforcement, recommendations for Congress, and provide a detailed breakdown of the proposed budget’s funding allocations. Specifically, we recommend that Congress should: Restore the $15 million of funding cut from the State Homeland Security Program. The program provides critical grants to states that require recipients spend at least 10% of their grants on cybersecurity needs. Require an alignment of cybercrime goals and outcomes across law enforcement agencies within the Departments of Homeland Security, Justice, and Treasury. Ensure that federal agencies are prepared to implement President Biden’s cybersecurity executive order.
Topic:
Defense Policy, Science and Technology, Law Enforcement, Budget, and Cybersecurity
Political Geography:
North America and United States of America

176. Journal of Advanced Military Studies: Political Warfare and Propaganda

Author:
James J. F. Forest, Daniel De Wit, Kyleanne Hunter, Emma Jouenne, Glen Segell, Lev Topor, Alexander Tabachnik, Donald M. Bishop, Phil Zeman, Michael Cserkits, and Anthony Patrick
Publication Date:
03-2021
Content Type:
Journal Article
Journal:
Journal of Advanced Military Studies
Institution:
Marine Corps University Press, National Defense University
Abstract:
The digital age has greatly expanded the terrain and opportunities for a range of foreign influence efforts. A growing number of countries have invested significantly in their capabilities to disseminate online propaganda and disinformation worldwide, while simultaneously establishing information dominance at home. Each of the contributions to this issue addresses the central theme of influencing perceptions and behavior. First, Daniel de Wit draws lessons from a historical analysis of the Office of Strategic Services (OSS), America’s intelligence and special operations organization in World War II. In addition to its efforts to collect intelligence on the Axis powers and to arm and train resistance groups behind enemy lines, the OSS also served as America’s primary psychological warfare agency, using a variety of “black propaganda” methods to sow dissension and confusion in enemy ranks.82 As noted earlier, psychological warfare plays a significant role in the conduct of today’s military operations, so de Wit’s research offers important historical lessons for contemporary campaign planners. Next, Kyleanne Hunter and Emma Jouenne examine the uniquely troubling effects of spreading misogynistic views online. Their analysis of three diverse case studies—the U.S. military, the incel movement, and ISIS— reveals how unchecked online misogyny can result in physical behavior that can threaten human and national security. Glen Segell then explores how perceptions about cybersecurity operations can have positive or negative impacts on civil-military relations, drawing on a case study of the Israeli experience. Lev Topor and Alexander Tabachnik follow with a study of how Russia uses the strategies and tactics of digital influence warfare against other countries, while continually seeking to strengthen its information dominance over Russian citizens. And Donald M. Bishop reveals how other countries do this as well, including China, North Korea, Iran, Cuba, and Venezuela. Each is engaged in these same kinds of efforts to control the information that circulates within their respective societies, while using various forms of propaganda against other countries to strengthen their influence and national power. Phil Zeman’s contribution to this issue looks at how China and Russia are trying to fracture American and Western societies through information, disinformation, economic coercion, and the creation of economic dependencies— in many cases capitalizing on specific attributes and vulnerabilities of a target nation to achieve their strategic objectives. Through these efforts, he concludes, China and Russia hope to prevent the will or ability of American or Western states to respond to an aggressive act. Next, Michael Cserkits explains how a society’s perceptions about armed forces can be influenced by cinematic productions and anime, drawing on a case study comparison of Japan and the United States. And finally, Anthony Patrick examines how social media penetration and internet connectivity could impact the likelihood that parties within a conventional intrastate conflict will enter negotiations. As a collection, these articles make a significant contribution to the scholarly research literature on political warfare and propaganda. The authors shed light on the need for research-based strategies and policies that can improve our ability to identify, defend against, and mitigate the consequences of influence efforts. However, when reflecting on the compound security threats described at the beginning of this introduction—involving both cyberattacks and influence attacks—a startling contrast is revealed: we have committed serious resources toward cybersecurity but not toward addressing the influence issues examined in this issue. We routinely install firewalls and other security measures around our computer network systems, track potential intrusion attempts, test and report network vulnerabilities, hold training seminars for new employees, and take many other measures to try and mitigate cybersecurity threats. In contrast, there are no firewalls or intrusion detection efforts defending us against digital influence attacks of either foreign or domestic origin. Government sanctions and social media deplatforming efforts respond to influence attackers once they have been identified as such, but these efforts take place after attacks have already occurred, sometimes over the course of several years. The articles of this issue reflect an array of efforts to influence the perceptions, emotions, and behavior of human beings at both individual and societal levels. In the absence of comprehensive strategies to more effectively defend against these efforts, the United States risks losing much more than military advantage; we are placing at risk the perceived legitimacy of our systems and institutions of governance, as well as our economic security, our ability to resolve social disagreements peacefully, and much more.83 Further, many other nations are also facing the challenges of defending against foreign influence efforts. As such, the transnational nature of influence opportunities and capabilities in the digital age may require a multinational, coordinated response. In the years ahead, further research will be needed to uncover strategies for responding to the threat of digital influence warfare with greater sophistication and success.
Topic:
Security, National Security, Politics, Science and Technology, Military Affairs, Women, Radicalization, Cybersecurity, Internet, History, World War II, Propaganda, Deterrence, Disinformation, Israel Defense Forces (IDF), Digital Policy, Psychological Warfare, and Misogyny
Political Geography:
Russia, Japan, China, Israel, Global Focus, and United States of America

177. Effects of botnets – a human-organisational approach

Author:
Zsolt Bederna and Tamás Szádeczky
Publication Date:
09-2021
Content Type:
Journal Article
Journal:
Security and Defence Quarterly
Institution:
War Studies University
Abstract:
Botnets, the remotely controlled networks of computers with malicious aims, have significantly affected the international order from Ukraine to the United States in recent years. Disruptive software, such as malware, ransomware, and disruptive services, provided by those botnets has many specific effects and properties. Therefore, it is paramount to improve the defences against them. To tackle botnets more or less successfully, one should analyse their code, communication, kill chain, and similar technical properties. However, according to the Business Model for Information Security, besides technological attributes, there is also a human and organisational aspect to their capabilities and behaviour. This paper aims to identify the aspects of different attacks and present an analysis framework to identify botnets’ technological and human attributes. After researching the literature and evaluating our previous findings in this research project, we formed a unified framework for the human-organisational classification of botnets. We tested the defined framework on five botnet attacks, presenting them as case studies. The chosen botnets were ElectrumDoSMiner, Emotet, Gamover Zeus, Mirai, and VPNFilter. The focus of the comparison was motivation, the applied business model, willingness to cooperate, capabilities, and the attack source. For defending entities, reaching the target state of defending capabilities is impossible with a one-time development due to cyberspace’s dynamic behaviour and botnets. Therefore, one has to develop cyberdefence and conduct threat intelligence on botnets using such methodology as that presented in this paper. This framework comprises people and technological attributes according to the BMIS model, providing the defender with a standard way of classification.
Topic:
Defense Policy, Science and Technology, Cybersecurity, and Botnets
Political Geography:
Global Focus

178. Simulation framework for practical cybersecurity training in the public service sector

Author:
Veronika Deák
Publication Date:
03-2021
Content Type:
Journal Article
Journal:
Security and Defence Quarterly
Institution:
War Studies University
Abstract:
The public service sector is a key target of cyberattacks. In order to prevent and effectively tackle such attacks, organisations should continuously develop their defence capabilities. As part of developing such capabilities, public service cybersecurity training is required to teach students about cyberattacks. The present study uses quantitative research techniques including (i) how to identify key requirements for the practical aspects of public service cybersecurity training and (ii) sampling to utilise international best practices from cybersecurity education and conceptual architectures from existing public service organisations. A schematic structure with a two-level practical training course is proposed. On the first level, the students learn about the defence mechanisms of their own info-communication devices and try to prevent attacks in a simulated environment. On the second level, the students apply protection strategies against cyberattacks in organisational infrastructure. Finally, a technical framework is defined to simulate cyberattacks against (a) personal devices and (b) a fictional organisational infrastructure. The specification of a public service cybersecurity training programme should not only focus on theoretical education but also provide practical knowledge to students. By simulating specific attacks, theoretical and practical knowledge can be combined. As a result, students will be able to recognise threats and potential risks from cyberspace.
Topic:
Education, Cybersecurity, Training, Public Service, and Simulation
Political Geography:
Global Focus

179. Mechanisms for providing cybersecurity during the COVID-19 pandemic: Perspectives for Ukraine

Author:
Oleksandr Karpenko, Aleksander Kuczabski, and Vitalii Havryliak
Publication Date:
03-2021
Content Type:
Journal Article
Journal:
Security and Defence Quarterly
Institution:
War Studies University
Abstract:
The article analyses key cybersecurity trends against the background of the COVID-19 pandemic, trends that could lead to an increase in cyber threats. It also looks at cyber threats related to remote work in this period. Foreign experience in counteracting the spread of disinformation online, about COVID-19, has been studied. A global trend for strengthening law enforcement control over cyberspace content, network traffic, and digital devices of users has been identified. It has been established that some states are finding it difficult to counteract the spread of coronavirus-related threats and are sometimes resorting to violating the traditional balance of rights and freedoms of citizens in cyberspace, in fact, legalising cyber-surveillance of citizens. The paper investigates the limits of state intervention in the lives of citizens in the face of a real threat to national security. In matters of cybersecurity in the medical sphere, a shift of emphasis from the problem of protection of personal data of patients to the protection of key functions of the medical sphere is revealed. Mechanisms for implementing cybersecurity to counter the spread of fake news (misinformation) on the internet, about COVID-19, are substantiated. Practical tools and cybersecurity measures used during the COVID-19 pandemic are recommended for Ukrainian authorities. The importance of creating appropriate conditions for ensuring the balance between the implementation of restrictive policies in the field of cybersecurity and ensuring freedom of speech and openness of the internet is proven.
Topic:
Cybersecurity, Pandemic, COVID-19, and Fake News
Political Geography:
Ukraine and Eastern Europe

180. Cybersecurity in Brazil: an analysis of the national strategy

Author:
Louise Marie Hurel
Publication Date:
04-2021
Content Type:
Special Report
Institution:
Igarapé Institute
Abstract:
n February 2020, the Decree 10.222 established Brazil’s National Cybersecurity Strategy (E-Ciber) — the first official document to provide an overview regarding Brazil’s role in cybersecurity, as well as objectives and guiding principles for its development between 2020 and 2023. With the Covid-19 pandemic, thousands of people, governmental agencies, and businesses have rapidly adapted their activities to a largely virtual environment. This sudden migration led to new threats and attack surfaces for exploiting vulnerabilities. More than ever, different sectors must be prepared and trained to respond to and resist these threats. However, this was precisely the period in which Brazil suffered the worst cyber attack in its history – highlighting, yet again, that many challenges remain for ensuring that concerns with security turn into action across different sectors. This strategic paper identifies the main gaps and challenges for cybersecurity governance in Brazil. We unpack the main elements of E-Ciber in order to understand and place the country’s strategic vision historically as well as in relation to other international experiences. We adopt a principles-based approach that seeks to strengthen and inform the implementation of strategic cybersecurity objectives in Brazil, which include: national and international coordination and cooperation; knowledge integration; sustainability of efforts; and cybersecurity-related training.
Topic:
National Security, Science and Technology, Cybersecurity, Internet, Digital Policy, and Cyberspace
Political Geography:
Brazil and Latin America