Search

Begin New Search Topic Cybersecurity Political Geography Global Focus Publishing Institution Carnegie Endowment for International Peace Publication Year within 10 Years Publication Year within 5 Years

1. Why Does the Global Spyware Industry Continue to Thrive? Trends, Explanations, and Responses

Author:
Steven Feldstein and Brian (Chun Hey) Kot
Publication Date:
03-2023
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
The global spyware and digital forensics industry continues to grow despite public backlash following an array of surveillance scandals, many linked to NSO Group’s Pegasus program. This paper explores the resilience of the commercial spyware market and offers ideas about how to limit the spread of invasive cyber surveillance tools. It highlights several factors driving the industry, including elevated demand for intrusion technology from government clients and private customers, as well as inconsistent political will from democratic governments to crack down on these technologies.
Topic:
Science and Technology, Cybersecurity, Democracy, Surveillance, Industry, Forensic Science, and Autocracy
Political Geography:
Global Focus

2. Cyberspace and Geopolitics: Assessing Global Cybersecurity Norm Processes at a Crossroads

Author:
Christian Ruhl, Duncan Hollis, Wyatt Hoffman, and Tim Maurer
Publication Date:
02-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
As cyber insecurity has become a growing problem worldwide, states and other stakeholders have sought to increase stability for cyberspace. As a result, a new ecosystem of “cyber norm” processes has emerged in diverse fora and formats. Today, United Nations (UN) groups (for example, the Group of Governmental Experts [GGE] and the Open-Ended Working Group [OEWG]), expert commissions (for example, the Global Commission on the Stability of Cyberspace), industry coalitions (for example, the Tech Accord, the Charter of Trust), and multistakeholder collectives (for example, the Paris Call for Trust and Security in Cyberspace) all purport to identify or operationalize various normative standards of behavior for states and/or other stakeholders in cyberspace. As some of these processes wind down (for example, the Global Commission) and others wind up (for example, the OEWG), cyber norms are at a crossroads where each process’s potential (and problems) looms large.
Topic:
Security, Science and Technology, Cybersecurity, Geopolitics, and Norms
Political Geography:
Global Focus

3. International Strategy to Better Protect the Financial System Against Cyber Threats

Author:
Tim Maurer and Arthur Nelson
Publication Date:
11-2020
Content Type:
Special Report
Institution:
Carnegie Endowment for International Peace
Abstract:
In February 2016, a few months after Carnegie began its work on this project, a cyber attack shook the finance world. Hackers had targeted SWIFT, the global financial system’s main information network, trying to steal 1 billion U.S. dollars, nearly 0.50 percent of Bangladesh’s GDP, from the Bangladeshi central bank over the course of a weekend. It was a wake-up call revealing that cyber threats targeting the financial sector were no longer limited to low-level theft but could now pose systemic risk. Only a few months earlier, in 2015, the Carnegie Endowment for International Peace had launched an initiative to better protect the global financial system against cyber threats. Our first step was to develop a proposal for the G20 to launch a work stream dedicated to cybersecurity in the financial sector. In March 2017, the G20 Finance Ministers and Central Bank Governors outlined an initial road map to increase the cyber resilience of the international financial system. In the wake of the Bangladesh incident, Carnegie expanded its work, complementing the G20 project with the development of an action-oriented, technically detailed cyber resilience capacity-building tool box for financial institutions. Launched in 2019 in partnership with the IMF, SWIFT, FS-ISAC, Standard Chartered, the Global Cyber Alliance, and the Cyber Readiness Institute, this tool box is now available in seven languages. And we are continuing to track the evolution of the cyber threat landscape and incidents involving financial institutions through a collaboration with BAE Systems. To raise more awareness among senior officials of the growing threat, Carnegie also hosted a series of roundtables at the Munich Security Conference, including a cyber war game, dedicated to cybersecurity and the financial system. We co-hosted a high-level roundtable with the IMF for central bank governors and launched a workshop series at Wilton Park to strengthen the relationships among financial authorities, industry, and law enforcement as well as national security agencies. In July 2019, an international group—convened by Carnegie—of leading experts in governments, central banks, industry, and the technical community decided that there would be value in developing a longer-term international cybersecurity strategy for the financial system. This report is the result of that project and offers a vision for how the international community could better protect the financial system against cyber threats. The recommendations are designed to inform the deliberations among the G20, the G7, relevant standard-setting bodies as well as the Annual Meeting of the World Economic Forum and the Munich Security Conference. Written by Carnegie experts, this document includes feedback obtained through consultations with more than 200 stakeholders in government, the financial regulatory community, industry, and academia. An international advisory group, formed in fall 2019, provided strategic advice throughout the project. In February 2020, following Carnegie’s presentation of this project at the Forum’s annual meeting in Davos the previous month, the World Economic Forum became an official partner.
Topic:
Science and Technology, Cybersecurity, Finance, and Non-Traditional Threats
Political Geography:
Global Focus and United States of America

4. War, Terrorism, and Catastrophe in Cyber Insurance: Understanding and Reforming Exclusions

Author:
Jon Bateman
Publication Date:
10-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Cyber insurance is a promising way to contain the havoc cyber attacks wreak, but endless lawsuits hamper its effectiveness. Reforms and new solutions are sorely needed. Insurance is one of the most promising tools for addressing pervasive cyber insecurity. A robust market for insuring cyber incidents could, among other things, financially incentivize organizations to adopt better cyber hygiene—thereby reducing cyber risk for society as a whole. But cyber insurance is not yet mature enough to fulfill its potential, partly due to uncertainty about what kinds of cyber risks are, or can be, insured. Uncertainties in cyber insurance came to a head in 2017, when the Russian government conducted a cyber attack of unprecedented scale. Data-destroying malware called NotPetya infected hundreds of organizations in dozens of countries, including major multinational companies, causing an estimated $10 billion in losses.1 NotPetya showed that cyber risk was greater than previously recognized, with higher potential for “aggregation”—the accumulation of losses across many insurance policies from a single incident or several correlated events. NotPetya also exposed a serious ambiguity in how insurance policies treat state-sponsored cyber incidents. Some property and casualty insurers declined to pay NotPetya-related claims, instead invoking their war exclusions—long-standing clauses that deny coverage for “hostile or warlike action in time of peace and war” perpetrated by states or their agents.2 War exclusions date back to the 1700s, but they had never before been applied to cyber incidents. This novel use of the war exclusion, still being litigated, has raised doubts about whether adequate or reliable coverage exists for state-sponsored cyber incidents. Some observers have asked whether such incidents are insurable at all, given the potential for aggregated cyber losses even more catastrophic than those of NotPetya.3 And while the war exclusion has attracted the most attention, another exclusion—for terrorism—presents similar challenges to cyber claims.
Topic:
Terrorism, War, Cybersecurity, and Non-Traditional Threats
Political Geography:
Global Focus

5. Deepfakes and Synthetic Media in the Financial System: Assessing Threat Scenarios

Author:
Jon Bateman
Publication Date:
07-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Bad actors could use deepfakes—synthetic video or audio—to commit a range of financial crimes. Here are ten feasible scenarios and what the financial sector should do to protect itself. Rapid advances in artificial intelligence (AI) are enabling novel forms of deception. AI algorithms can produce realistic “deepfake” videos, as well as authentic-looking fake photos and writing. Collectively called synthetic media, these tools have triggered widespread concern about their potential in spreading political disinformation. Yet the same technology can also facilitate financial harm. Recent months have seen the first publicly documented cases of deepfakes used for fraud and extortion. Today the financial threat from synthetic media is low, so the key policy question is how much this threat will grow over time. Leading industry experts diverge widely in their assessments. Some believe firms and regulators should act now to head off serious risks. Others believe the threat will likely remain minor and the financial system should focus on more pressing technology challenges. A lack of data has stymied the discussion.
Topic:
Security, Cybersecurity, Artificial Intelligence, and Non-Traditional Threats
Political Geography:
Global Focus

6. Cyber Risk Scenarios, the Financial System, and Systemic Risk Assessment

Author:
Lincoln Kaffenberger and Emanuel Kopp
Publication Date:
09-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Cyber risk has become a key issue for stakeholders in the financial system. But its properties are still not precisely characterized and well understood. To help develop a better understanding, we discuss the properties of cyber risk and categorize various cyber risk scenarios. Furthermore, we present a conceptual framework for assessing systemic cyber risk to individual countries. This involves analyzing cyber risk exposures, assessing cybersecurity and preparedness capabilities, and identifying buffers available to absorb cyber risk–induced shocks.
Topic:
Science and Technology, Cybersecurity, Finance, Internet, and Risk
Political Geography:
Global Focus