Search

Begin New Search Topic Cybersecurity Content Type Policy Brief Publication Year within 25 Years

1. Building Resilience? The Cybersecurity, Economic & Trade Impacts of Cloud Immunity Requirements

Author:
Matthias Bauer
Publication Date:
03-2023
Content Type:
Policy Brief
Institution:
European Centre for International Political Economy (ECIPE)
Abstract:
EU Member States should call on the EU’s Cybersecurity Agency (ENISA) and the European Commission to abandon immunity requirements in the proposed EU Cloud Certification Scheme (EUCS). With immunity requirements in the EUCS, the EU risks opening a Pandora’s box, paving the way for data localisation, foreign ownership restrictions, and local establishment requirements in digital industries globally leading to rising trade tensions. ENISA’s current proposal could increase policymakers’ appetite for data localisation in the EU. It would empower the European Commission and Member State authorities to exclude foreign businesses from domestic cloud services markets and set a dangerous precedent for any data-intensive sector. The list of “sectors of high criticality” could be logically extended to both existing services (e.g., financial services) and to new technologies and business models, such as IoT in the energy and healthcare sectors, and autonomous driving in the transport sector. Non-EU jurisdictions would be pressured to respond in kind. EUCS immunity requirements would increase cloud adopters’ exposure to cybersecurity risks. Data localisation often creates obstacles to an integrated management approach towards cybersecurity risks. Country of headquarter and foreign ownership restrictions in the proposed EUCS risk removing global frontier cybersecurity technologies from Member State markets. Excluding these and other EU and non-EU companies from EU Member States could result in a long-lasting security deficit of EU cloud adopters vis-à-vis organisations that are still able to use reliable and often best-practice cloud services offered by providers from outside EU Member States. Immunity requirements in the EUCS are discriminatory by design. They could provoke retaliatory measures by EU trading partners, either unilaterally or through WTO or bilateral FTA (e.g., UK-EU) Dispute Settlement. Local establishment requirements and foreign ownership restrictions would by design discriminate against foreign cloud providers. US-headquartered companies, which currently serve more than 75% of the EU market, would be most affected by EU immunity requirements.[1] Depending on US preferences and the scope of the proposed EUCS, the EU could be subject to retaliatory tariffs of up to USD 12 billion worth of EU goods exports or equivalent restrictions for EU services exports to the US. Other governments could lodge complaints via the WTO as well (e.g., Singapore, Japan, Canada and others, where cloud development is advancing rapidly). EU suppliers are currently in no position to manage a broad-based transition to cloud, and thus such requirements would delay significant efficiency and security gains that current foreign suppliers could offer. A blanket exclusion of non-EU cloud vendors would also likely undermine Europe’s objective to achieve a 75% cloud adoption rate for EU enterprises. Sensitive European businesses and public sector organisations would have to delay migration and make do with legacy systems for a very long time. Contrary to large countries, these negative impacts would be much more pronounced for smaller EU Member States, which lack the presence of large domestic incumbents and generally rely much more on an open international trading regime for digital services. ENISA’s cloud certification scheme should be limited to technical and transparency requirements. Immunity requirements for non-personal data should be addressed in bilateral initiatives such as the EU-US Trade and Technology Council (TTC) or agreements requiring a company that sought to offer services of the highest level of sensitivity to be headquartered in a country granted adequacy with EU data protection rules, or a country that is an adherent to the OECD’s Trusted Government Access principles, or (concerning the US) a participant in the upcoming Trans-Atlantic Data Privacy Framework. Excluding foreign companies from operating in the EU would have far-reaching consequences. If that is the intent, it should require a sound legal analysis and the decision should be taken through a formal legislative procedure at the EU level.
Topic:
Economics, Markets, European Union, Cybersecurity, Digital Economy, Trade, and Resilience
Political Geography:
Europe

2. Getting regulation right: Approaches to improving Australia’s cybersecurity

Author:
Rajiv Shah
Publication Date:
08-2023
Content Type:
Policy Brief
Institution:
Australian Strategic Policy Institute (ASPI)
Abstract:
As well as having a global impact, Cybersecurity is one of the most significant issues affecting Australia’s economy and national security. On the one hand, poor cybersecurity presents a risk to the interconnected digital systems on which we increasingly rely; on the other hand, well-managed cybersecurity provides an opportunity to build trust and advantage by accelerating digital transformation. Cyber threats can originate from a diverse range of sources and require a diverse set of actions to effectively mitigate them. However, a common theme is that much better cyber risk management is needed to address this critical threat; the current operation of the free market isn’t consistently driving all of the required behaviours or actions. Regulation can provide a powerful mechanism to modify incentives and change behaviours. However, securing cyberspace depends on the intersection of many factors—technical, social and economic. Current regulations are a patchwork of general, cyber-specific and sector-specific measures with a lack of cohesion that causes overlaps and gaps. That makes the environment complex, which means that finding the right approach that will truly improve overall security and minimise unwanted side effects is difficult. It’s necessary to analyse the interconnected factors that determine the net effectiveness of cybersecurity regulations. Furthermore, the pace of technological change is so fast today that, even if regulation is successful when first implemented, it needs to be appropriately futureproofed to avoid becoming irrelevant after even a few months. Recent rapid developments in artificial intelligence are an example of the risks here that will need to be anticipated in any changes to the regulatory regimes.
Topic:
Security, Science and Technology, Cybersecurity, and Regulation
Political Geography:
Australia and Australia/Pacific

3. Fostering ASEAN’s Digital Future through Cybersecurity Policies and Human Empowerment

Author:
Michelle Chandra Kasih
Publication Date:
05-2023
Content Type:
Policy Brief
Institution:
Economic Research Institute for ASEAN and East Asia (ERIA)
Abstract:
The adoption of advanced technology comes with the risk of cyberattacks. Despite the remarkable prospects of the digital economy, the cost of cyberattacks has reached millions of United States (US) dollars and is projected to increase. Investment is needed to provide cybersecurity to help secure the growth of the digital and sustainable economy and anticipate more advanced attacks. As investment in cybersecurity has started to grow in the Association of Southeast Asian Nations (ASEAN), challenges are present in the intangible form of inexistent or strict policies, skill shortages, and insufficient public awareness, which can halt the effectiveness of such investment. This policy brief proposes three policy recommendations to ensure successful investment in cybersecurity: Ensure that cybersecurity policies and legal frameworks are not underdeveloped or overly restrictive. Support small businesses in earning customer trust through cost-effective guidelines. Incentivise and maintain partnerships for education, research, and capacity building with moral and ethical education for future experts. Raise cyber hygiene and establish integrative reporting platforms that help people identify and detect cyber risk.
Topic:
Science and Technology, Cybersecurity, Digital Economy, and ASEAN
Political Geography:
Southeast Asia

4. Kosovo's Take on Cybersecurity

Author:
Vesa Kroci
Publication Date:
08-2023
Content Type:
Policy Brief
Institution:
Kosovar Centre for Security Studies (KCSS)
Abstract:
In 2014, there was a notable surge in cybercrimes in Kosovo. The advancement and widespread adoption of technology during this period brought about a more pronounced occurrence of cyber-related offenses. Fadil Avdyli, the head of the Cybercrime Investigation Sector in the Kosovo Police, reported that eight individuals were apprehended in 2012, eleven in 2013, and seven in 2014. The rising cyberattacks in Kosovo provided an impetus to build a new policy framework dealing with cyber security, resulting with the adoption by the Kosovo government of the National Cyber Security Strategy and Action Plan 2016 – 2019. Program of the Kosovo Government 2021-2025 notes that “cyber security is a growing problem, we will engage in professional capacity building for the prevention of cyber-attacks, completion of the legal framework and modernization of cyber protection equipment”. The Kosovo Security Strategy 2022-2027, puts significant relevance to strengthening cyber security capacities of Kosovo and notes that the government “will invest in the field of cybersecurity, critical infrastructure, innovation and technology and capacity-building”. The strategy also includes the Global Cybersecurity Index as an impact indicator, but Kosovo has not been included. In 2023 Kosovo Assembly adopted Law No. 08/L-173 on Cyber Security, which among others, foresees the establishment of the Cyber Security Agency as well as partially transposes Directive (EU) 2013/40 of the European Parliament and of the Council of 12 August 2013 on attacks against information systems.
Topic:
Security, Crime, Science and Technology, and Cybersecurity
Political Geography:
Eastern Europe and Kosovo

5. The First Space-Cyber War and the Need for New Regimes and Policies

Author:
Eytan Tepper
Publication Date:
05-2022
Content Type:
Policy Brief
Institution:
Centre for International Governance Innovation
Abstract:
Many dubbed the Gulf War of 1991 the “first space war” due to the US Armed Forces’ extensive use of satellites. The cyberwar in Ukraine, although it is mostly playing out in the shadows, may be remembered as the first space-cyber war. This policy brief makes the case that states should adopt national policies to defend against threats to space-based assets and applications, such as communications satellites, that are both vital to national security and economic security and increasingly vulnerable to cyberattacks. It is time to explore and identify principles for responsible space-cyber behaviour that would represent a broad multilateral consensus. Identifying these principles may not prevent space-cyber hostilities but could provide “rules of the game.” States would also benefit from encouraging a space-cyber security industry that, beyond protecting against space-cyber threats, has the potential to be a significant growth engine.
Topic:
Security, Infrastructure, Cybersecurity, Space, and Cyberspace
Political Geography:
Global Focus

6. Why Belgium Needs a Cyber Command

Author:
Alexander Mattelaer
Publication Date:
11-2022
Content Type:
Policy Brief
Institution:
EGMONT - The Royal Institute for International Relations
Abstract:
On 19 October 2022, the Belgian Ministry of Defence declared the Initial Operating Capability of its new Cyber Command. Responding to the trend of states seeking competitive advantages in a new operational domain – as illustrated by several high-profile cyber-attacks on Belgian State institutions – the choice for developing a new instrument of statecraft has been made. This Egmont Policy Brief outlines the growing importance of developing cyber defence capabilities, discusses the organisational set-up for this Cyber Command, and finally zooms in on the challenges ahead.
Topic:
Security, Defense Policy, Cybersecurity, and Leadership
Political Geography:
Europe and Belgium

7. NATO’s Role in Global Cyber Security

Author:
Merle Maigre
Publication Date:
04-2022
Content Type:
Policy Brief
Institution:
German Marshall Fund of the United States (GMFUS)
Abstract:
Malicious cyber activity has increased substantially over the past years, ranging from ransomware and espionage to politically motivated cyberattacks and sophisticated malware used in the war in Ukraine. NATO allies must remain on high alert. The changed nature of military conflict changes the defensive mission of NATO, which faces capable opponents in cyberspace and raises the question of how to create accountability when a hostile state fails to observe globally agreed norms. The set of action for NATO for the next five years evolves around how to impose costs and how to deny benefits against malicious actors in cyberspace.
Topic:
NATO, Cybersecurity, Geopolitics, and Russia-Ukraine War
Political Geography:
Russia, Europe, Ukraine, and Global Focus

8. What do we know about cyber operations during militarized crises?

Author:
Michael Fischerkeller
Publication Date:
01-2022
Content Type:
Policy Brief
Institution:
Atlantic Council
Abstract:
The Department of Defense (DoD) will soon kick off the drafting of its cyber strategy and cyber posture review to align US cyber capabilities and operating concepts with the foreign policy objectives of the Joseph Biden-Kamala Harris administration. Given that the administration describes China as the “pacing threat,” debates over the best use of cyber operations and campaigns will likely be framed by US-China interaction in day-to-day competition, and by a potential militarized crisis and war over the status of Taiwan. This essay focuses on how cyber operations employed during militarized crises are likely to impact escalation management. Policymakers may be attracted to the idea that cyber operations could serve as de-escalatory offramps in a crisis. Such expectations should be tempered, if not completely set aside, for two reasons. First, there is no experience with cyber operations employed during a militarized crisis between two nuclear-armed peers. Absent direct experience, all one can rely on is academic research. Yet, secondly, deductive and empirical academic research provides no basis for confidence that cyber operations are either de-escalatory or non-escalatory in the context of militarized crises.
Topic:
Foreign Policy, Cybersecurity, Crisis Management, and Militarization
Political Geography:
China, Taiwan, Asia, North America, and United States of America

9. Hackers, Hoodies, and Helmets: Technology and the changing face of Russian private military contractors

Author:
Emma Schroeder, Gavin Wilde, Justin Sherman, and Trey Herr
Publication Date:
07-2022
Content Type:
Policy Brief
Institution:
Atlantic Council
Abstract:
The first time Russia invaded Ukraine in the twenty-first century, the Wagner Group was born. The now widely profiled private military company (PMC) played an important role in exercising Russian national power over the Crimea and portions of the Donbas—while giving Moscow a semblance of plausible deniability. In the near decade since, the Russian PMC sector has grown considerably, and is active in more than a dozen countries around the world. PMCs are paramilitary organizations established and run as private companies—though they often operate in contract with one or more states. They are profit-motivated, expeditionary groups that make a business of the conduct of war.1 PMCs are in no way a uniquely Russian phenomenon, yet the expanding footprint of Russian PMCs and their links to state interests call for a particularly Russian-focused analysis of the industry. The growth of these firms and their direct links to the Kremlin’s oligarch network as well as Moscow’s foreign media, industrial, and cyber activities present a challenge to the United States and its allies as they seek to counter Russian malicious activities abroad. As signals intelligence and offensive cyber capabilities, drones and counter-drone systems, and encrypted communications become more accessible, these technologies will prove ever more decisive to both battlefield outcomes and statecraft. More exhaustive research on these issues is necessary. The ongoing conflict resulting from Russia’s second invasion of Ukraine in this young century seems likely to shape the conduct of Russian foreign policy and security behavior for years to come—and these firms will play a part. The activities of these PMCs include high-intensity combat operations, as evidenced in Syria in 2018 and Ukraine in 2022, and a mix of population control, escort and close protection, and local direct-action activities, as seen in Libya, Mali, and elsewhere.2 Given the sourcing and dependence of Russian PMCs on Russian military service personnel and no small influence of Russian doctrine, the questions to reasonably ask include: How do changes in the Russian conduct of war and adoption of new technologies influence these PMCs? Moreover, how might these technological changes influence the role these PMCs play in Russian strategic goals and activity abroad?
Topic:
Security, Defense Policy, Science and Technology, Cybersecurity, Innovation, Wagner Group, Russia-Ukraine War, and Private Military Companies (PMCs)
Political Geography:
Russia, Europe, Eurasia, Ukraine, Middle East, and Africa

10. Behind the rise of ransomware

Author:
John Sakellariadis
Publication Date:
08-2022
Content Type:
Policy Brief
Institution:
Atlantic Council
Abstract:
This issue brief investigates the drivers of the ransomware surge that menaced the United States in the summer of 2021, explains why these attacks remain a persistent threat today, and offers recommendations for mitigating the problem in the future. The 2021 surge in ransomware activity stems from a change in how criminals launch ransomware attacks. Between 2016 and 2019, cybercriminals shifted away from automated ransomware campaigns that emphasized scale to targeted extortion operations against organizations and established businesses. This adaptation made ransomware more disruptive and more profitable, eventually attracting the attention of well-organized cybercrime gangs. The intensification of the ransomware epidemic from that point until the attack on Colonial Pipeline resulted from the growing adoption of this new extortion model among criminals. Though the US government has devoted more attention to ransomware over the ensuing months, ransomware remains a significant and long-term threat to the US economy. Three factors drive the persistence of the problem: the presence of a vast pool of security-poor organizations, the availability of a poorly regulated monetization pipeline in the form of cryptocurrency, and criminals’ ability to evade law enforcement by exploiting jurisdictional boundaries. Mitigating just one of these conditions, let alone all three, will demand years of sustained effort. Because the US government cannot eliminate ransomware overnight, it must begin planning how to manage the problem over the long term. To do so, it should start by investing in new efforts to improve the defenses of small- to medium-sized entities. The ease of compromising these organizations has been key to fueling the appetite for ransomware attacks. Yet, many of these organizations lack the personnel, incentives, and contracting power to secure their own networks. Moreover, the US government should require all US-based organizations to report ransomware payments to the government and publish quarterly reports with anonymized versions of the data. Comprehensive payment transparency offers the best way to measure success against ransomware over the long term. It will ensure that success against targeted ransomware is judged in terms of the overall volume of ransomware payments, not just the absence of attacks on high-risk or high-profile entities.
Topic:
Science and Technology, Cybersecurity, and Ransomware
Political Geography:
North America and United States of America

11. China’s surveillance ecosystem and the global spread of its tools

Author:
Bulelani Jili
Publication Date:
10-2022
Content Type:
Policy Brief
Institution:
Atlantic Council
Abstract:
This paper seeks to offer insights into how China’s domestic surveillance market and cyber capability ecosystem operate, especially given the limited number of systematic studies that have analyzed its industry objectives. For the Chinese government, investment in surveillance technologies advances both its ambitions of becoming a global technology leader as well as its means of domestic social control. These developments also foster further collaboration between state security actors and private tech firms. Accordingly, the tech firms that support state cyber capabilities range from small cyber research start-ups to leading global tech enterprises. The state promotes surveillance technology and practices abroad through diplomatic exchanges, law enforcement cooperation, and training programs. These efforts encourage the dissemination of surveillance devices, but also support the government’s goals concerning international norm-making in multilateral and regional institutions. The proliferation of Chinese surveillance technology and cyber tools and the associated linkages between both state and private Chinese entities with those in other states, especially in the Global South, is a valuable component of Chinese state efforts to expand and strengthen their political and economic influence worldwide. Although individual governments purchasing Chinese digital tools have their local ambitions in mind, Beijing’s export and promotion of domestic surveillance technologies shape the adoption of these tools in the Global South. As such, investigating how Chinese actors leverage demand factors for their own aims, does not undercut the ability of other countries to detect and determine outcomes. Rather it demonstrates an interplay between Chinese state strategy and local political environments. This paper specifically focuses on key features in China’s surveillance ecosystem, while the companion to this report will focus on the key ‘pull factors’ from African countries and their significance for US interests.
Topic:
Science and Technology, Cybersecurity, Surveillance, and Public-Private Partnership
Political Geography:
China, Asia, and Global Focus

12. Trusted connectivity: A framework for a free, open, and connected world

Author:
Kaush Arha
Publication Date:
08-2021
Content Type:
Policy Brief
Institution:
Atlantic Council
Abstract:
Global affairs are increasingly shaped by three important and overlapping trends: 1) the unprecedented and growing demand for trillions of dollars’ worth of global digital and physical infrastructure; 2) the ideological battle between democracy and autocracy for the best path forward to achieve peace and prosperity; and 3) the world’s response to changing climate. As democracies address the global demand for a free, open, and connected world while ensuring that local and global emissions targets are met, they need an organizing framework: the concept of “trusted connectivity.” Democratic governments and institutions function with intricate checks and balances to ensure public trust. Unchallenged aggregation of power is antithetical to democracies and instinctively distrusted by their citizens. While holding unimaginable promise, today’s advancements in digital and physical infrastructure also embody new opportunities for malign actors in general, and authoritarian governments in particular, to accumulate and wield this power. Malign influence or control over data, communications, trade routes, energy, and transportation, all of which becomes possible when countries accept infrastructure investments from authoritarian states, could open potential vectors for coercion, disruption, or attack in times of crisis or conflict. In order to deny malign actors this influence over other countries’ infrastructure, democracies need to work together to ensure that the benefits and terms for the host country in building a bridge, port, rail, road, or telecommunications network are equitable and transparent, thereby leading to greater trust and security in addition to economic prosperity. US President Joseph R. Biden, Jr., rallied the world’s leading democracies behind this cause at the Group of Seven (G7) summit in June 2021 in Cornwall, England. The G7 nations, comprising the world’s leading free economies and free societies, proclaimed that, as they aim to meet global infrastructure demand, among other goals, their efforts will be guided by shared democratic values. For China, the standard-bearer of an alternate, illiberal model, infrastructure investment serves a different purpose: to increase China’s global economic leverage for its political gain. To prevail in this competition, advance their values, and develop much-needed digital and physical infrastructure, the world’s leading democracies should adopt the principle of trusted connectivity.
Topic:
National Security, Infrastructure, Cybersecurity, and Connectivity
Political Geography:
China, Europe, Asia, and United States of America

13. How To Retain Election Officials To Secure Future Elections

Author:
David Levine
Publication Date:
06-2021
Content Type:
Policy Brief
Institution:
German Marshall Fund of the United States (GMFUS)
Abstract:
The 2020 presidential election was called the most secure in U.S. history, largely due to efforts to protect the nation’s different physical and cyber infrastructure. This was a triumph considering the physical, cyber, and even human assets that make up the election infrastructure have been and continue to be susceptible to threats. In 2020, many states adopted measures to mitigate threats to physical and cyber election assets like voting equipment, ballots, and facilities, as well as computer services and databases that store voter information. For example, states with close results in the 2020 presidential race had paper records of each vote, which gave them the ability to go back and count each ballot if necessary. Other measures such as pre-election testing, state and federal certification of voting equipment, and increased collaboration between election officials and their security partners helped provide additional assurance that the 2020 election results were legitimate. Unfortunately, analogous measures were not in place to protect many of the people—from state and local election administrators to poll workers and vendor staff—who administered the elections. Due in large part to the incendiary rhetoric from former President Donald Trump and his followers, many election officials were threatened and harassed, and such behavior shows no signs of abating. Instead of taking steps to address this problem, many states have passed or are considering passing laws that could make this problem worse. Georgia’s new law removed the Georgia’s secretary of state—who rejected Donald Trump’s effort’s to overturn the state’s 2020 results—from decision-making power on the state election board and turned control of the board over to a politicized, less knowledgeable body: the state legislature. Iowa’s new law threatens election officials with criminal prosecution for failing to follow new voting rules. And Florida recently adopted a rule that subjects its local election officials to a civil penalty of $25,000 if a drop box at an early voting site is left accessible for the return of ballots outside of early voting hours. The unrelenting targeting of administrators—along with unfunded election mandates, threats, burn out, and fatigue—has pushed many election officials to leave or consider leaving their positions. According to a recent Democracy Fund/Reed College Survey of Local Election Officials, approximately one-third of chief local election officials will be eligible to retire before the 2024 election, including more than half of those in the largest jurisdictions, which each serve more than 250,000 registered voters. Considering what many of these election officials and their staffs endured during the 2020 election cycle, and continue to experience, it would be unwise to simply wait and hope that they decide to hang on. Instead, every effort should be made to create an environment that is as conducive as possible for retaining these unsung heroes of the 2020 elections. The ability of the United States to conduct future secure elections may well depend on it. This paper focuses on measures state and local governments can take in concert with their election offices to help retain as many of their high-performing election officials as possible. State and local governments should have support from the federal government and Congress to help address this national security issue, but if the fight over funding the 2020 election is any indication, they should begin taking steps to address this problem now. Below are ten suggestions for how state and local governments can retain their high-performing election officials. None is a “silver bullet,” not all of them will be relevant for each state and local government unit, and some governments have already taken many of these steps. But in addressing election official retention solutions, these suggestions provide remedies for some of the thorniest problems that election officials encounter.
Topic:
Politics, Infrastructure, Elections, and Cybersecurity
Political Geography:
North America and United States of America

14. Digital Currencies' Role in Facilitating Ransomware Attacks: A Brief Explainer

Author:
Kristine Johnson and Michael Garcia
Publication Date:
05-2021
Content Type:
Policy Brief
Institution:
Third Way
Abstract:
This paper details how Bitcoin—the most popular digital currency—is used to facilitate ransomware attacks and how criminals try—and sometimes fail—to cover their tracks. Understanding how criminals use digital currencies for ransomware attacks can lead policymakers to solutions in thwarting and enforcing cybercrimes.
Topic:
Cybersecurity, Digital Economy, Bitcoin, Digitalization, and Digital Currency
Political Geography:
North America and United States of America

15. China’s Technological Rise: Implications for Global Security and the Case of Nuctech

Author:
Didi Kirsten Tatlow
Publication Date:
01-2021
Content Type:
Policy Brief
Institution:
International Centre for Defence and Security - ICDS
Abstract:
China under the Chinese Communist Party (CCP) is poised to become the world’s first technology enabled totalitarian superpower. No country will be untouched by this development, including Estonia, where a Chinese state-owned technology company Nuctech specialising in “security solutions” monitors cargo crossing the NATO border with Russia using a radiation-based technology originally copied from Europe. A clear understanding of the Chinese political system shows why there is fundamental cause for concern in all this, and why Chinese technology should not be viewed as politically neutral.
Topic:
Security, Science and Technology, Cybersecurity, and Hybrid Threats
Political Geography:
China and Estonia

16. China’s cyber vision: How the Cyberspace Administration of China is building a new consensus on global internet governance

Author:
Nathan Attrill and Audrey Fritz
Publication Date:
11-2021
Content Type:
Policy Brief
Institution:
Australian Strategic Policy Institute (ASPI)
Abstract:
This report provides a primer on the roots of the Cyberspace Administration of China (CAC) within China’s policy system, and sheds light on the Chinese Communist Party’s (CCP) intentions to use cyberspace as a tool for shaping discourse domestically and internationally. The report details the position of the Cyberspace Administration of China in China’s propaganda system. Considering its origins in the former Party Office of External Propaganda, the authors argue that ‘countries that lack comprehensive cyber regulations should err on the side of caution when engaging with the CCP on ideas for establishing an international cyber co-governance strategy.’ By assessing the CCP’s strategy of becoming a ‘cyber superpower’, its principle of ‘internet sovereignty’, and its concept of ‘community of common destiny for cyberspace’, this report seeks to address how the CCP is working to build a consensus on the future of who will set the rules, norms and values of the internet. The report also examines the World Internet Conference - a ‘platform through which the CCP promotes its ideas on internet sovereignty and global governance’ – and its links to the CAC.
Topic:
Governance, Cybersecurity, Internet, and Surveillance
Political Geography:
China and Asia

17. Trying to govern the ungovernable: International Law on cyber and information operations in Russian

Author:
Asbjørn Thranov and Flemming Splidsboel Hansen
Publication Date:
05-2021
Content Type:
Policy Brief
Institution:
Danish Institute for International Studies (DIIS)
Abstract:
Russia has proposed an international regime governing the use of cyber and information operations. However, ‘digital sovereignty’ means something very different in Moscow than it does in Washington. In September 2020, the Russian authorities launched a new initiative to regulate the use of cyber and information operations by states. The Russian President, Vladimir Putin, introduced the debate by suggesting that Russia and the USA lead the way by signing a bilateral agreement restricting their activities in the field of Information and Communication Technologies (ICTs). The two states, so Putin suggested, should establish regular dialogue and set up a ‘hot line’. Putin also proposed a new agreement on cyber and information operations that should ‘exchange guarantees against interference in the internal affairs of the other side, including into electoral processes, inter alia, by means of the ICTs and high-tech methods’. Shortly afterwards, the Russian Foreign Minister, Sergei Lavrov, added more details. In a statement, he drew a dark picture of the world ‘facing a real cyber pandemic’, pointing to the risk of cyber attacks against critical infrastructure and the interference by some states in the internal affairs of other states. ‘It is high time’, so he claimed, that the international community agreed on a regime to regulate the use of ICTs. Russia has proceeded to promote the new initiative at the current 75th session of the UN General Assembly, which has responded with a decision to renew the mandate of the open-ended working group on the security and use of ICTs in 2021-2025.
Topic:
Security, Defense Policy, Diplomacy, International Organization, Science and Technology, Cybersecurity, Internet, and Cyberspace
Political Geography:
Russia, Eurasia, North America, and United States of America

18. The post-Brexit EU-UK relationship: an opportunity or challenge for cyber security?

Author:
Ellie Templeton and Robert Dewar
Publication Date:
09-2021
Content Type:
Policy Brief
Institution:
The Geneva Centre for Security Policy
Abstract:
With multiple post-Brexit pathways that could still be pursued following the recent adoption of the new security agreements, the EU-UK cyber security relationship is still evolving. Value must be placed on collaboration to tackle shared cyber threats, the role EU institutions play in bringing cyber security actors together, and Britain’s former contribution to European security. These factors strongly indicate that, although new opportunities may present themselves, there will likely be irreversible losses for collective cyber resilience due to Brexit. In order to work towards a new, valuable relationship model, it is recommended that both the EU and UK uphold professional, transparent and non- political security cooperation going forward, whilst remaining open to flexible operational support in the unpredictable and ever-changing cyber threat landscape. Ultimately, within an international system affected by “instability, insecurity and uncertainty”,61 it remains to be seen what opportunities and challenges arise, and if the resulting relationship, whether based on one specific pathway or a combination of all three, could constitute an effective EU relationship model for non-EU entities in the cyber security field.
Topic:
Security, Regional Cooperation, European Union, Cybersecurity, and Brexit
Political Geography:
United Kingdom and Europe

19. Iran’s Authoritarian Playbook: The Tactics, Doctrine, and Objectives behind Iran’s Influence Operations

Author:
Ariane Tabatabai
Publication Date:
09-2020
Content Type:
Policy Brief
Institution:
German Marshall Fund of the United States (GMFUS)
Abstract:
According to a 2013 indictment by the U.S. Department of Justice, hackers backed by a foreign power gained access to the controls of the Bowman Avenue Dam, a small dam in the New York City suburb of Rye, New York. Cyberattacks on infrastructure have long been a concern in the United States: Russia has targeted the U.S. power grid and other critical infrastructure in the past—at times successfully.1 Hackers backed by the People’s Republic of China have targeted U.S. utilities companies.2 However, neither of these strategic adversaries was behind this bold foray into U.S. suburbia: the culprit, according to the indictment, was the Islamic Republic of Iran.3 Over the past decade, Iran has emerged as an important national security challenge for the United States. A novel part of the regime’s effort—facilitated by the advent of the information age and new technology—is its development of a playbook and toolkit designed to undermine the United States at home just as, in the eyes of Tehran, Washington does in Iran. This makes the current Iranian challenge more subtle and nuanced than has been the case for most of the Islamic Republic’s existence. Iran has gradually expanded its capabilities to compete against the United States for influence within the region, and it is now also taking this competition into the United States and even Europe. One hundred days before the 2020 U.S. elections, the Office of the Director of National Intelligence put a fine point on this threat when National Counterintelligence and Security Center Director William Evanina released a statement noting that, “at this time, we’re primarily concerned with China, Russia and Iran,” who are all looking to “use influence measures in social and traditional media in an effort to sway U.S. voters’ preferences and perspectives, to shift U.S. policies, to increase discord and to undermine confidence in our democratic process.”4 The statement characterized the Iranian threat as follows: “Iran seeks to undermine U.S. democratic institutions and divide the country in advance of the elections. Iran’s efforts center around online influence, such as spreading disinformation on social media and recirculating anti-U.S. content.”5 The Islamic Republic’s authoritarian toolkit is unlikely to become as sophisticated as that of China or Russia in the near-term. After all, Iran’s economy is in shambles, its capacity restrained, and the model of society and governance it tries to offer profoundly limited in its appeal. And even the flagship tool used by Iran to interfere in democracies, namely its online influence operations, continues to suffer from such basic shortcomings as misspelled names, the repeated use of the same tactics and techniques, and a lack of proper research into the target and familiarity with its behavior.6 However, a perceived existential threat posed by the United States, an inability to match the conventional capabilities of the United States and its allies, and a strong desire to compete with the same, have encouraged Iran to double down on efforts to develop a set of asymmetric tools allowing it to overcome its shortcomings. In this sense, Iran is not dissimilar to Russia. “Authoritarian learning” (including partnerships with both Beijing and Moscow) has likely helped Tehran to overcome challenges and to develop its toolkit quickly and effectively. The result is that Iran is becoming a significant authoritarian actor challenging democracy in the United States and Europe. Tehran’s influence operations span traditional and digital media. The regime has built a sprawling web of traditional media outlets, as well as networks of accounts on all major social media platforms (even as it bans and limits access to these websites at home), allowing it to reach millions of users abroad. The content Iran creates, distributes, and amplifies is multilingual and seeks to adapt to democracies’ social, cultural, and political contexts—with fairly mixed results. Among the objectives of Iran’s information manipulation efforts are sowing tensions in democracies, dividing democratic nations internally and from each other, and alleging hypocrisy in democratic states’ foreign policies, undermining democratization in Iran and elsewhere. Iranian hackers routinely target U.S. persons, academic institutions, companies, non-profit organizations, and government agencies and departments. And Iran’s illicit finance schemes are considerable; although, they are currently focused on sanctions evasion and support of information operations, rather than used as a standalone vector to undermine democracies. Some of these tools and the tactics used by Iran are similar to those employed by both Russia and China—and both Beijing and Moscow have lent Tehran a hand in developing some of its capabilities,7 particularly in the realm of information manipulation. Iranian, Russian, and Chinese state media and associated social media accounts echo and amplify each other’s messaging. But there are also some differences in how Tehran deploys these tactics. This is in part due to differences in the political culture and structure of the country, the Islamic Republic’s own ideology and worldview, and the country’s status in the international system. Another significant set of differences arises from Iran’s shortcomings vis-à-vis both its adversaries (including the United States) and its authoritarian partners in Russia and China. For example, Russia and China can leverage their vast nuclear arsenal and enormous economic weight, respectively, to compete directly with the United States. Iran is ill-equipped to compete with the United States in either of those domains and, as such, sees this set of tools and efforts to undermine democracy as a means to elevate its level of competition rather than an end in itself. Hence, Tehran’s toolkit is more limited than those of Beijing or Moscow, leading the Islamic Republic to be more deliberate and selective in the programs it develops and, perhaps, more forceful in how it deploys them. As a result, though Iran’s growing efforts to undermine democracy should not be ignored and should be addressed adequately, for now, the Islamic Republic remains a lesser threat than China and Russia. This report tries to make sense of these activities and provide a framework for understanding Iran’s intentions and capabilities. It provides one of the first comprehensive discussions of Iran’s authoritarian toolkit, doctrine, and objectives. It must be noted that unlike other key Iranian initiatives—such as its nuclear program, missile activities, support for non-state actors, and regional interventions—Iran’s authoritarian toolkit remains scarcely studied in the academic literature. Understanding Tehran’s objectives in undermining democracy and the means it leverages to do so is important for a few reasons. First, Iranian activities over the past few years have shown that the regime is increasingly active in this space. And as Iran’s objectives and the tools it employs are different from those of other key malign actors, understanding their strengths and weaknesses and developing specific responses to them is a worthy exercise. Second, authoritarians learn from each other, and observing the Iranian case allows us to better identify the trends and comprehend the ways in which less powerful malign actors (as opposed to Russia and China, for example) may engage in similar activities designed to undermine democracy.
Topic:
Authoritarianism, Elections, Cybersecurity, Foreign Interference, Cyberspace, and Influence
Political Geography:
Iran, Middle East, and Global Focus

20. US Global Cybercrime Cooperation: A Brief Explainer

Author:
Allison Peters and Anisha Hindocha
Publication Date:
06-2020
Content Type:
Policy Brief
Institution:
Third Way
Abstract:
Cybercrime is a persistent and transnational threat with the rates in the United States estimated to have up to quadrupled during the COVID-19 pandemic. Unfortunately, law enforcement in the United States and globally has struggled to keep up with this crime, resulting in a considerable enforcement gap that allows cybercriminals to operate with near impunity. In the United States, only 3 in 1,000 malicious cyber incidents will ever see an arrest and the global enforcement gap is likely to be similar.1 The investigation of one cybercrime case often involves criminal justice systems in many different countries, requiring intense international cooperation to bring the perpetrators to justice. The United States is a member of a number of formal and informal mechanisms that help facilitate this cooperation. This includes being a party to a number of binding treaties—particularly the only global cybercrime treaty known as the Budapest Convention—as well as a member of key networks and in multilateral forums. The United States is also a member of a number of entities aimed at developing norms to guide the behavior of nation-states in cyberspace where cooperation in cybercrime investigations is encouraged.
Topic:
Defense Policy, Crime, Cybersecurity, Pandemic, and COVID-19
Political Geography:
North America and United States of America