Search

Begin New Search Topic Security Publishing Institution Center for Strategic and International Studies (CSIS)

51. Securing Intellectual Property for Innovation and National Security

Author:
Sujai Shivakumar
Publication Date:
03-2022
Content Type:
Special Report
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
The United States is engaged in a global competition for innovation, with critical implications for the nation’s continued technological leadership, competitiveness, and security. To win, the United States will need to leverage its advantages at home, including its robust intellectual property (IP) rights system and the innovative zeal of its entrepreneurs. It should also look abroad—setting the pace for scientific cooperation with allies and strategic partners, as well as developing shared international technical standards through the contributions of experts from around the globe. Most pressingly, the United States should not adopt policies that weaken protection of U.S.-owned patents—which would both disincentivize innovation in the United States and support Chinese efforts to dominate critical standards and other advanced technologies. Yet a recent proposal of the Antitrust Division of the U.S. Department of Justice (DOJ) does just that. Launched as a consultation, its Draft Policy Statement on Licensing Negotiations and Remedies for Standards-Essential Patents Subject to F/RAND Commitments is promoted as an effort to encourage good-faith licensing negotiations and to address the scope of remedies available to patent owners who have agreed to license their essential technologies on fair, reasonable, and non-discriminatory (F/RAND) terms. While this draft policy seems like an innocuous administrative change, it has the potential to do significant damage to the United States’ innovation engine and, by extension, to its national security.
Topic:
Security, Intellectual Property/Copyright, Innovation, and Strategic Competition
Political Geography:
North America and United States of America

52. Creating Accountability for Global Cyber Norms

Author:
James A. Lewis
Publication Date:
02-2022
Content Type:
Special Report
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
The year 2021 saw all UN member states agree in the Open-Ended Working Group (OEWG) on a framework for responsible state behavior in cyberspace, based on norms developed in the United Nations Group of Governmental Experts (GGE) in 2015.1 The OEWG formalized global agreement on the 2015 norms. This consensus agreement means that the framework for responsible state behavior is now politically binding for all member states. Global agreement on the obligations for responsible state behavior is a substantial step forward in building international cybersecurity in a rules-based environment. Unfortunately, international experience since 2015 has shown that agreement on norms, even when politically binding, is by itself not enough to ensure their observation or create stability in cyberspace. This has shifted discussion from what norms are needed to how to build accountability and what to do when norms are ignored. While the norms agreed to by all member states will ultimately reinforce international stability, to make progress, it will be necessary to develop a collective diplomatic strategy to improve the observation of norms and increase accountability when they are ignored. A strategy of sustained engagement and the imposition of consequences is necessary for norms to have effect. Our assumption is that accountability for malicious cyber actions can only be strengthened if there are consequences for a state’s decision not to observe norms. If nothing else, a failure to take action in response to transgressions seems to only encourage opponents. An immediate task is to define the conditions for collective action. There has been an initial and informal agreement among like-minded democratic nations that accountability requires the imposition of consequences for a failure to observe norms, but several issues must be addressed. These include agreement on standards for attribution of the source of a malicious action and agreement on a proportional, lawful, and effective response. A collective approach is essential if efforts to create accountability are to succeed, and any response to a cyber incident will require political heft and sustained engagement.
Topic:
Security, International Cooperation, United Nations, Cybersecurity, Accountability, Transparency, and Cyberspace
Political Geography:
Global Focus

53. Comments to the Department of Commerce, Bureau of Industry and Security

Author:
James Andrew Lewis
Publication Date:
01-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
Recent legislative changes call for enhanced scrutiny on potential transfers of “emerging and foundational technologies.” These are broadly defined as technologies essential to U.S. national security. The Congressional intent is for agencies to develop a more specific list, with robotics and artificial intelligence as primary concerns. Developing this list raises several issues. These include how to determine the military utility of an emerging technology, how to control the diffusion of the technology, and how to manage the risks of increased control for American innovation. Enhancing controls on the transfer of emerging technologies is necessary for several reasons. First, the U.S. finds itself in a contest with China. China intends to eventually displace the U.S as a global leader in technology, part of its larger effort to expands its influence and power. China is a technological rival of a kind the U.S. has never had before, given the deep interconnections between the two economies. China is still dependent on the West for advanced technology and uses a combination of techniques to acquire it. The 2015 Obama-Xi agreement on commercial cyber espionage attempted to address the problem, but China now ignores that agreement. In this environment, strengthening oversight of technology transfers from the U.S. and its allies to China is essential. In particular, new rules are needed to review technology transfers through co-production, joint ventures, or intangible exports, as these have been a major source of China’s access to technology. Second, current controls on technology transfers do not adequately protect emerging and foundational technologies. The current technology transfer control system is too close to its Cold War roots. Thresholds were set by asking what was the state of the art, how close our Soviet competitor was to this, and whether a technology was “controllable” or if it had become a commodity or was widely available from foreign sources. These are no longer the right questions to ask. The approach needed now is whether we want to transfer a technology to China and whether an effort to prevent this would do more harm than good to America’s own technological capabilities. This calls the whole complex structure of precise control thresholds into question. Modernizing export controls will be difficult, but the proposed rulemaking offers an opportunity to begin the process of revision. Export controls have their background in the 20th Century, when two bifurcated economic blocs were in competition and where thresholds for controls could be set with a degree of precision. This is no longer the case. Attempting to layer a 20th century export control regime over the new dynamics of global trade and innovation will not adequately protect emerging technologies. Reform will necessarily be an iterative process, part of a larger restructuring of export controls for a new international environment. A key point to bear in mind is that since China is still dependent on advanced Western technology (and this is an unlikely change in the near future), access to western technology should be used to gain leverage in talks to change China’s aggressively mercantilist policies. This will be difficult, and it will take time, but a failure to confront China and bring about change will lead to the outcomes that technology controls seek to avoid. The goal is not to defeat or contain China, but to bring its practices in line with international expectations in ways that allow commercial relationships to continue without risk to national security.
Topic:
Security, Industry, and Emerging Technology
Political Geography:
North America and United States of America

54. America’s Military Spending and the Uncertain Costs of its Wars: The Need for Transparent Reporting

Author:
Anthony H. Cordesman
Publication Date:
01-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
The United States has now been continuously at war for more than seventeen years. It is still fighting an active war in Afghanistan, has yet to fully defeat ISIS in Syria and Iraq – much less establish a state of lasting security in either country – and is playing a role in low level conflicts against extremist and terrorists in many other parts of the world. The U.S. government, however, has never developed a convincing method of reporting on the cost of the wars, and its estimates are a confusing morass of different and conflicting Departmental, Agency, and other government reporting that leave major gaps in key areas during FY2001-FY2019. It has never provided useful forecasts of future cost, instead providing empty "placeholder" numbers or none. It has failed to find any useful way to tie the cost estimates it does release to its level of military and civil activity in each conflict or found any way to measure the effectiveness of its expenditures or tie them to a credible strategy to achieve some form of victory. The result is a national embarrassment and a fundamental failure by the Executive Branch and Congress to produce the transparency and public debate and review that are key elements of a responsible government and democracy.
Topic:
Security, Military Strategy, Budget, and Military Spending
Political Geography:
North America and United States of America

55. The Cybersecurity Workforce Gap

Author:
James Andrew Lewis and William Crumpler
Publication Date:
01-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
As cyber threats continue to grow in sophistication, organizations face a persistent challenge in recruiting skilled cybersecurity professionals capable of protecting their systems against the threat of malicious actors. With cybercriminals now responsible for billions in losses per year and state-sponsored hacking groups posing an ever-greater threat, the need for individuals capable of securing networks against attackers has never been greater. However, education and training institutions in the United States have so far found it difficult to keep pace with the growing need for cyber talent. This paper highlights the gaps that exist in the nation’s current cybersecurity education and training landscape and identifies several examples of successful programs that hold promise as models for addressing the skills gap. It then highlights recommendations for policymakers, educators, and employers. A recent CSIS survey of IT decisionmakers across eight countries found that 82 percent of employers report a shortage of cybersecurity skills, and 71 percent believe this talent gap causes direct and measurable damage to their organizations.1 According to CyberSeek, an initiative funded by the National Initiative for Cybersecurity Education (NICE), the United States faced a shortfall of almost 314,000 cybersecurity professionals as of January 2019.2 To put this in context, the country’s total employed cybersecurity workforce is just 716,000. According to data derived from job postings, the number of unfilled cybersecurity jobs has grown by more than 50 percent since 2015.3 By 2022, the global cybersecurity workforce shortage has been projected to reach upwards of 1.8 million unfilled positions.4 Workforce shortages exist for almost every position within cybersecurity, but the most acute needs are for highly-skilled technical staff. In 2010, the CSIS report A Human Capital Crisis in Cybersecurity found that the United States “not only [has] a shortage of the highly technically skilled people required to operate and support systems already deployed, but also an even more desperate shortage of people who can design secure systems, write safe computer code, and create the ever more sophisticated tools needed to prevent, detect, mitigate and reconstitute from damage due to system failures and malicious acts.”5 At the time, interviews indicated that the United States only had about 1,000 security specialists with skills and abilities to take on these roles, compared to a need for 10,000 to 30,000 personnel. In the nine years since that report, these challenges have persisted. In 2016, CSIS found that IT professionals still considered technical skills like intrusion detection, secure software development, and attack mitigation to be the most difficult to find skills among cybersecurity operators.6 A 2018 survey of California businesses revealed that a lack of required technology skills was one of the greatest challenges facing organizations when hiring cybersecurity candidates.7 These challenges were particularly acute for mission critical job roles, with over a third of organizations reporting a lack of technology skills in candidates for vulnerability assessment analyst positions and half of employers reporting deficiencies for cyber defense infrastructure support candidates. Employers today are in critical need for more cybersecurity professionals, but they do not want more compliance officers or cybersecurity policy planners. What organizations are truly desperate for are graduates who can design secure systems, create new tools for defense, and hunt down hidden vulnerabilities in software and networks.8
Topic:
Security, Science and Technology, Cybersecurity, and Information Technology
Political Geography:
Global Focus

56. On the Horizon: A Collection of the Papers from the Next Generation

Author:
Sarah Minot Asrar
Publication Date:
02-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
Meeting the security challenges of the future will require a sustained effort over the long-term by a multidisciplinary cadre of nuclear experts who are equipped with critical knowledge and skills. The Project on Nuclear Issues (PONI) runs two signature programs – the Nuclear Scholars Initiative and the Annual Conference Series – to engage emerging nuclear experts in thoughtful and informed debate over how to best address the nuclear community’s most pressing problems. The papers included in this volume comprise research from participants in the 2018 Nuclear Scholars Initiative and the PONI Conference Series. These papers explore such topics as the impacts of emerging technologies and capabilities, deep-diving on nuclear strategy and national policies, proposing paths forward for addressing proliferation challenges, and enhancing arms control in contentious environments.
Topic:
Security, Arms Control and Proliferation, Energy Policy, Environment, and Nuclear Weapons
Political Geography:
Global Focus

57. Harnessing Multilateral Financing for Health Security Preparedness

Author:
Center for Strategic and International Studies
Publication Date:
04-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
The economic consequences of large-scale disease outbreaks can be enormous: pandemics could cause $570 billion per year in average economic losses over the coming decades. Health security threats have an especially destructive impact on development investments and GDP in low-income and lower-middle-income countries (LICs and LMICs): the 2014-2015 Ebola outbreak in West Africa wiped out nearly five years of existing investments in the region, gravely setting back the region’s future development prospects. By contrast, upgrading countries’ preparedness is relatively inexpensive and affordable; recent data demonstrates most countries would need to spend approximately $0.50-$1.50 per person per year to get an acceptable level of epidemic preparedness. The financing gap for preparedness is one of the starkest problems in health security, especially among LICs and LMICs. That gap is estimated at $4.5 billion per year. Investments in preparedness are cost-effective and affordable, but low-income and lower-middle-income country governments continue to underinvest at dangerously low levels. These governments bear lead responsibility for addressing financing gaps, but external funding can be catalytic. At present, there is no financing mechanism and no adequate incentive structure to motivate governments in high-risk countries to invest in preparedness, particularly when those investments compete with more visible priorities such as education, housing, transport infrastructure, and other pressing health needs. As a consequence, countries remain ill-prepared and vulnerable to the persistent threat of pandemics and large-scale disease outbreaks. The World Bank Group’s International Development Association (IDA) replenishment takes place every three years and presents a choice opportunity to make adjustments that reflect important emerging priorities. In the current IDA19 replenishment, stakeholders can take a major step towards closing the preparedness financing gap by incentivizing $1 billion or more per year in preparedness investments in LICs and LMICs.
Topic:
Security, Health, Multilateralism, and Public Health
Political Geography:
North America and United States of America

58. Space Threat Assessment 2019

Author:
Todd Harrison, Kaitlyn Johnson, and Thomas G. Roberts
Publication Date:
04-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
While the vulnerabilities of U.S. national security space systems are often discussed publicly, the progress other nations are making in counterspace systems is not as readily accessible. Space Threat Assessment 2019 reviews the open-source information available on the counterspace capabilities that can threaten U.S. space systems. The report is intended to raise awareness and understanding of the threats, debunk myths and misinformation, and highlight areas in which senior leaders and policymakers should focus their attention. Space Threat Assessment 2019 focuses on four specific countries that pose the greatest risk for the United States: China, Russia, Iran, and North Korea. A fifth section analyzes the counterspace capabilities of select other countries, including some allies and partners of the United States, and some non-state actors. This report is not a comprehensive assessment of all known threats to U.S. space systems because much of the information on what other countries are doing to advance their counterspace systems is not publicly available. Instead, it serves as an unclassified assessment that aggregates and highlights open-source information on counterspace capabilities for policymakers and the general public.
Topic:
Security, Military Strategy, and Space
Political Geography:
North America and United States of America

59. Shifting the Burden Responsibly: Oversight and Accountability in U.S. Security Sector Assistance

Author:
Melissa Dalton
Publication Date:
04-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
The United States increasingly relies on allies and partners to accomplish shared security objectives around the globe. In recent years, a greater emphasis has been placed from burden sharing to burden shifting—enabling allies and partners to assume responsibility for their own security challenges through security sector assistance. Burden shifting responsibly to allies and partners requires the United States to integrate oversight and accountability measures into the implementation of security sector assistance. Oversight and accountability mechanisms for security sector assistance allow the United States to better direct, track, and calibrate its assistance to partners to ensure the full scope of U.S. policy goals are met. However, amid reforms being undertaken by the U.S. government to adapt security sector assistance policy and processes, greater clarity is needed on how to connect policy goals of oversight and accountability to planning, operations, doctrine, and training across the security assistance enterprise. This study conducted by the CSIS Cooperative Defense Project builds upon its previous initiative, entitled Oversight and Accountability in Security Sector Assistance: Seeking Return on Investment, to assess the levels of progress on implementing reforms throughout the security sector assistance enterprise and developing an action plan that addresses specific issues along planning, operations, policy and doctrine, and training lines of effort.
Topic:
Security, Defense Policy, Military Strategy, and Hegemony
Political Geography:
North America and United States of America

60. Financial Sector Cybersecurity Requirements in the Asia-Pacific Region

Author:
William A. Carter and William Crumpler
Publication Date:
04-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
As the threat of cyberattacks has risen in recent years, financial institutions (FIs) and regulators have taken a range of steps to strengthen the security and resilience of the financial system to cyber threats. In the Asia-Pacific region (APAC), regulators have introduced a raft of new regulations and controls to bolster the resilience of FIs in their jurisdictions. While greater attention to—and engagement on—these issues is important, the development of new regulatory regimes across APAC has created challenges for multinational FIs and regulators, and could hinder the growth of the financial services and fintech industries within the region. We reviewed the cybersecurity requirements impacting the financial industry in five key jurisdictions, including the largest regional financial centers and consumer markets in APAC: Singapore, Hong Kong, Japan, China, and India. Through a combination of open-source research and on-the-ground interviews—with regulators; local, regional, and global FIs; policymakers; technology experts; and academics—we sought to understand the range of requirements and approaches from different regulators across the APAC region, and the ways in which they impact cyber risks to the regional financial system. Harmonizing regulators’ approaches to cybersecurity regulation in the region could help reduce systemic risks, improve regulatory efficiency, and make it easier for FIs across APAC to grow. This will not be easy and will require sustained engagement on multiple levels. Cyber threats are a transnational issue and will require a transnational response, particularly in highly integrated regions like APAC. Strengthening the security and resiliency of financial networks across the region will require looking at FIs from an enterprise perspective and understanding the cyber risks they face from the perspective of defenders, not the narrow lens of national borders. This will require principles-based approaches that allow for the wide range of business models and capacities of FIs and regulators across the region, and consolidated auditing, examination, and testing procedures to ensure that regulators have an accurate picture of the risks and controls at institutions under their care. Ultimately, regulators’ goals must be to ensure that strong security and resilience, not redundant compliance, is the focus for FIs.
Topic:
Security, Cybersecurity, and Financial Markets
Political Geography:
Global Focus