# data[].attributes.headline
Podcast: Emergency Pod: AI Executive Order!

# data[].attributes.subject
Podcast: Emergency Pod: AI Executive Order!

# data[].attributes.attachment_link.description
Listen to this episode from ChinaTalk on Spotify. Biden just dropped a 50 page executive order that's going to make the world safe for AI, hopefully? To discuss the sprawling EO we've brought on three CNAS analysts, Vivek Chilukuri, Bill Drexel and Tim Fist.

# data[].attributes.headline
Subcommittee on Cybersecurity, Information Technology, and Government Innovation Hearing

# data[].attributes.subject
Subcommittee on Cybersecurity, Information Technology, and Government Innovation Hearing

# data[].attributes.attachment_link.title
Subcommittee on Cybersecurity, Information Technology, and Government Innovation Hearing

# data[].attributes.headline
The Philosophy of AI: Learning From History, Shaping Our Future - Committee on Homeland Security & Governmental Affairs

# data[].attributes.subject
The Philosophy of AI: Learning From History, Shaping Our Future - Committee on Homeland Security & Governmental Affairs

# data[].attributes.attachment_link.provider_name
Committee on Homeland Security & Governmental Affairs

# data[].attributes.attachment_link.title
The Philosophy of AI: Learning From History, Shaping Our Future - Committee on Homeland Security & Governmental Affairs

# data[].attributes.headline
EVENT | Mind the Gap: Federal Cybersecurity Workforce Initiatives

# data[].attributes.subject
EVENT | Mind the Gap: Federal Cybersecurity Workforce Initiatives

# data[].attributes.attachment_link.title
EVENT | Mind the Gap: Federal Cybersecurity Workforce Initiatives

# data[].attributes.headline
A Discussion of the 2023 Counter Ransomware Initiative

# data[].attributes.subject
A Discussion of the 2023 Counter Ransomware Initiative

# data[].attributes.attachment_link.authors[].name
Center for Strategic & International Studies

# data[].attributes.attachment_link.title
A Discussion of the 2023 Counter Ransomware Initiative

# data[].attributes.headline
NASA Just Shut Down Quantum Computer After Something Insane Happened

# data[].attributes.subject
NASA Just Shut Down Quantum Computer After Something Insane Happened

# data[].attributes.attachment_link.title
NASA Just Shut Down Quantum Computer After Something Insane Happened

# data[].attributes.body
Central bankers on both sides of the Atlantic are paying attention to the ways generative artificial intelligence may create hidden new risks to the global financial system.

As banks, hedge funds and other major institutions explore using AI in their trading strategies, it could fuel rapid flows of capital and create hidden risks of financial crisis. That, at least, is the fear of some who study financial risk.

Imagine a future in which big-money investors worldwide rely on AI-driven algorithms to identify and execute trades. It is plausible that trillions of dollars could move in and out of assets rapidly.

That could have massive economic consequences that regulators, and even the humans running those financial entities themselves, don't understand.

# data[].attributes.attachment_link.description
Generative AI could fuel rapid flows of capital and create hidden risks of financial crisis.

# data[].attributes.headline
Surprise, surprise: the data shows the impact of ChatGPT on the creative professions

# data[].attributes.subject
Surprise, surprise: the data shows the impact of ChatGPT on the creative professions

# data[].attributes.body
Two professors from Washington University and one from NYU have pre-published in the SSRN repository one of the first studies on the impact of ChatGPT, which joins another from last month by several Harvard professors on the productivity of Boston Consulting Group consultants using ChatGPT.

The study’s conclusions are hardly surprising, but which someone had to provide concrete data for, and that’s what we academics are for: the introduction of the ChatGPT generative algorithm a year ago has had significant negative effects on creative professions such as graphic designers and copywriters.

# data[].attributes.attachment_link.title
Surprise, surprise: the data shows the impact of ChatGPT on the creative professions

# data[].attributes.attachment_link.description
Two professors from Washington University and one from NYU have pre-published in the SSRN repository one of the first studies on the impact…

# data[].attributes.headline
Supporting the Future Effectiveness of Post-Quantum Cryptography

# data[].attributes.subject
Supporting the Future Effectiveness of Post-Quantum Cryptography

# data[].attributes.body
Cryptography is the study of methods of secure communication, and its applications are ubiquitous in everyday life. Results from cryptography naturally enter policy discussions through issues of national defense. Despite its prevalence and importance, modern cryptography can be difficult for general audiences to understand because it is deeply rooted in technical ideas from theoretical and applied sciences.

# data[].attributes.attachment_link.readable_text
Cryptography is the study of methods of secure communication, and its applications are ubiquitous in everyday life. Results from cryptography naturally enter policy discussions through issues of national defense. Despite its prevalence and importance, modern cryptography can be difficult for general audiences to understand because it is deeply rooted in technical ideas from theoretical and applied sciences.

The convergence of highly technical topics from cryptography with important policy objectives, such as cybersecurity, creates a need to understand recent developments in cryptography at a granular level. The National Institute of Standards and Technology has predicted that advancements in quantum computing will threaten certain communication technologies by overcoming modern protections against eavesdropping and unwanted viewing of secured messages. Determining the scope and severity of the threat is a problem for a broad audience of stakeholders.

The goal of this Perspective is to provide a focused view of the search for quantum-resistant cryptographic methods. The authors explain different avenues for securing communications from quantum attacks and argue that cryptographic research in the quantum era will benefit from open access to results. They conclude by identifying activities that policymakers can consider to positively influence the outcome of the pending postquantum cryptography migration.

Funding for this work was provided by gifts from RAND supporters and income from the operation of the RAND Homeland Security and Defense Center (HSRD). This research was conducted by the Management, Technology, and Capabilities Program within HSRD.

This commentary is part of the RAND Corporation Expert insight series. RAND Expert Insights present perspectives on timely policy issues. All RAND Expert Insights undergo peer review to ensure high standards for quality and objectivity.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.

Document Details

Explore

Related Topics

Stay Informed
RAND Policy Currents
Get updates from RAND delivered straight to your inbox.

Citation

Format:

Moon, Alvin and Michael J. D. Vermeer, Supporting the Future Effectiveness of Post-Quantum Cryptography. Homeland Security Operational Analysis Center operated by the RAND Corporation, 2023. https://www.rand.org/pubs/perspectives/PEA2690-1.html.

Moon, Alvin and Michael J. D. Vermeer, Supporting the Future Effectiveness of Post-Quantum Cryptography, Homeland Security Operational Analysis Center operated by the RAND Corporation, PE-A2690-1, November 2023. As of November 4, 2023: https://www.rand.org/pubs/perspectives/PEA2690-1.html

# data[].attributes.attachment_link.title
Supporting the Future Effectiveness of Post-Quantum Cryptography

# data[].attributes.attachment_link.description
The authors of this Perspective describe the search for quantum-resistant cryptographic methods, explain options for securing communication from quantum attacks, and argue that research will benefit from open access to results.

# data[].attributes.headline
ChatGPT Just Silently Rolled Out A (No-Code) Feature That Will Wreck 10+ Startups

# data[].attributes.subject
ChatGPT Just Silently Rolled Out A (No-Code) Feature That Will Wreck 10+ Startups

# data[].attributes.body
ChatGPT has tech founders biting their nails.

Not because of the chat feature.

Not because of the plugin feature.

Not even because of the browsing feature.

But because of a new feature that allows anyone to create their own version of ChatGPT tailored to their specific needs.

The GPT transforms AI customization into a seamless, code-free experience, exclusively for the ChatGPT Plus community.

# data[].attributes.attachment_link.title
ChatGPT Just Silently Rolled Out A (No-Code) Feature That Will Wreck 10+ Startups

# data[].attributes.attachment_link.description
What would you do if it was your startup?

# data[].attributes.headline
Wachsende Cyberbedrohung für kleine und mittelständische Unternehmen

# data[].attributes.subject
Wachsende Cyberbedrohung für kleine und mittelständische Unternehmen

# data[].attributes.body
Mit neuen Bedrohungen Schritt zu halten, ist die größte IT-Sicherheitsherausforderung für kleine und mittlere Unternehmen (KMU). Über Hälfte davon fordern deshalb Hilfe zur Bewältigung von Cyberrisiken. Das zumindest ist die Kernaussage der weltweit durchgeführten Studie im Auftrag von Sage, eines führenden Anbieters von spezifisch auf KMU zugeschnittenen Tools in den Bereichen Buchhaltung, Finanzen, Personal und Gehaltsabrechnung. Die Studie zeigt auf, wie KMU Cybersicherheit wahrnehmen und skizziert die wichtigsten Hürden, die man in diesem Bereich nehmen muss. Mit der Studie sei Sage bestrebt, das Thema Cybersicherheit zu entmystifizieren und es von einer beängstigenden Herausforderung in ein Instrument zu verwandeln, das es KMU ermögliche, sich auf das Wachstum ihres Unternehmens und andere wichtige Maßnahmen zu konzentrieren.

# data[].attributes.headline
The Mirai Confessions: Three Young Hackers Who Built a Web-Killing Monster Finally Tell Their Story

# data[].attributes.subject
The Mirai Confessions: Three Young Hackers Who Built a Web-Killing Monster Finally Tell Their Story

# data[].attributes.body
Netflix, Spotify, Twitter, PayPal, Slack. All down for millions of people. How a group of teen friends plunged into an underworld of cybercrime and broke the internet—then went to work for the FBI.

# data[].attributes.attachment_link.readable_text
Netflix, Spotify, Twitter, PayPal, Slack. All down for millions of people. How a group of teen friends plunged into an underworld of cybercrime and broke the internet-then went to work for the FBI.

Early in the morning on October 21, 2016, Scott Shapiro got out of bed, opened his Dell laptop to read the day's news, and found that the internet was broken.

Not his internet, though at first it struck Shapiro that way as he checked and double-checked his computer's Wi-Fi connection and his router. The internet.

The New York Times website was offline, as was Twitter. So too were the websites of The Guardian, The Wall Street Journal, CNN, the BBC, and Fox News. (And WIRED.) When Twitter intermittently sputtered back online, users cataloged an alarming, untold number of other digital services that were also victims of the outage. Amazon, Spotify, Reddit, PayPal, Airbnb, Slack, SoundCloud, HBO, and Netflix were all, to varying degrees, crippled for most of the East Coast of the United States and other patches of the country.

Shapiro, a very online professor at Yale Law School who was teaching a new class on cyber conflict that year, found the blackout deeply disorienting and isolating. A presidential election unlike any other in US history loomed in just under three weeks. "October surprises" seemed to be piling up: Earlier that month, US intelligence agencies had jointly announced that hacker breaches of the Democratic National Committee and Hillary Clinton's presidential campaign had in fact been carried out by the Russian government. Meanwhile, Julian Assange's WikiLeaks had been publishing the leaked emails from those hacks, pounding out a drumbeat of scandalous headlines. Spooked cybersecurity analysts feared that a more climactic cyberattack might strike on Election Day itself, throwing the country into chaos.

Those anxieties had been acutely primed just a month earlier by a blog post written by the famed cryptographer and security guru Bruce Schneier. It was titled "Someone Is Learning How to Take Down the Internet."

"Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the internet," Schneier, one of the most highly respected voices in the cybersecurity community, had warned. He described how an unknown force appeared to be repeatedly barraging this key infrastructure with relentless waves of malicious traffic at a scale that had never been seen before. "These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don't know who is doing this, but it feels like a large nation-state. China or Russia would be my first guesses."

Now it seemed to Shapiro that Schneier's warning was coming to fruition, right on schedule. "This is the attack," he remembers thinking. Was it "the big one?" he asked himself. Or was it perhaps a test for the true "big one" that would hit on November 8? "Obviously, it has to be a nation-state," Shapiro thought. "It has to be the Russians."

For Shapiro, the internet outage was a kind of turning point: In the months and years that followed, he would become obsessed with trying to understand how someone could simply stamp out such a large swath of digital connectivity across the world, who would do such a thing, and why. But meanwhile, a little less than 500 miles west of Shapiro's Connecticut home, in the town of Washington, Pennsylvania, another sort of observer was watching the attack unfold.

After a typical sleepless night at his keyboard, 19-year-old Josiah White sat staring at the three flatscreen monitors he'd set up on a workbench in a messy basement storage area connected to the bedroom he shared with his brother in their parents' house. He was surrounded by computer equipment-old hard drives and a friend's desktop machine he had offered to fix-and boxes of his family's toys and Christmas tree ornaments.

For weeks, a cyber weapon that he'd built with two of his young friends, Paras Jha and Dalton Norman, had wreaked havoc across the internet, blasting victims offline in one unprecedented attack after another. As the damage mounted, Josiah had grown accustomed to the thrills, the anxiety, the guilt, the sense that it had all gotten so absurdly out of hand-and the thought that he was now probably being hunted by law enforcement agencies around the world.

He'd reached a state of numbness, compartmentalizing his dread even as he read Bruce Schneier's doomsday post and understood that it was describing his own work-and now, even as a White House press secretary assured reporters in a streamed press conference that the Department of Homeland Security was investigating the mass outage that had resulted directly from his actions.

But what Josiah remembers feeling above all else was simply awe-awe at the scale and chaotic power of the Frankenstein's monster that he and his friends had unleashed. Awe at how thoroughly it had now escaped their control. Awe that the internet itself was being shaken to its foundations by this thing that three young hackers had built in a flurry of adolescent emotions, whims, rivalries, rationalizations, and mistakes. A thing called Mirai.

Part One

None of the three young men who built Mirai fit the profile of a cybercriminal, least of all Josiah White, who could lay perhaps the most direct claim to being its inventor. Josiah had grown up in a rural county an hour south of Pittsburgh. He was the youngest of four children in a close-knit Christian family, all homeschooled, as his mom put it, to better "find out how God had created them and what he had created them to pursue." She describes the thin, dark-haired baby of the family as a stubborn and independent but unusually kind child, who would sit beside the new kid in Sunday school to make them feel welcome.

Josiah's father was an engineer turned insurance salesman, and the family lived in a fixer-upper surrounded by woods and farmland. As early as he can remember, Josiah followed his father around the house while he tinkered and made repairs. In 2002, when he was 5, Josiah was delighted to receive for Christmas the components of an electrical socket. Later his parents gave him a book called 101 Electronics Projects, and he would beg his mother to drive him to RadioShack, arriving with a shopping list of breadboard componentry. Before he was 10, he was advising his father on how to wire three-way switches.

Josiah's father would take him along to their church's "car ministry," where they'd repair congregants' cars for free and refurbish donated vehicles for missionaries. Josiah would stand in the corner of the shop, waiting for the foreman to give him a task, like reassembling a car's broken water pump.

Josiah reveled in impressing the adults with his technical abilities. But he was always drawn to computers, cleaner and more logical than any car component. "You give it an input, you get an output," he says. "It's something that gave me more control." After years of vying for time on his family's computer, he got his own PC when he was close to his 13th birthday, a tower with a Pentium III processor.

Around the same time, Josiah's brother, seven years older than him, figured out how to reprogram cell phones so they could be transferred from one telephone carrier to another. Josiah's brother started to perform this kind of unlocking as a service, and soon it was so in demand that their father used it to launch a computer repair business.

By the time he was 15, Josiah would work in the family's shop after school, setting up Windows for customers and installing antivirus software on their machines. From there, he got curious about how HTML worked, then began teaching himself to program, then started exploring web-hosting and network protocols and learning Visual Basic.

As wholesome as Josiah's childhood was, he felt at times that he was being raised "on rails," as he puts it, shepherded from homeschooling to church to the family computer shop. But the only rules he really chafed against were those set by his mother to limit his computer time or force him to earn internet access through schoolwork and household chores. Eventually, on these points, she gave up. "I sort of wore her out," he says. She relented in part because a hands-on understanding of the minutiae of computing was quickly becoming essential to the family business. Josiah, now with near-unlimited computer time, dreamed of a day when he'd use his skills to start a business of his own, just as his brother had.

In fact, like most kids his age, much of Josiah's time at the keyboard was spent on games. One of them was called Uplink. In it, the protagonist is a freelance hacker who can choose between two warring online movements, each of which has built a powerful piece of self-spreading code. One hacker group is bent on using its creation to destroy the internet. The other on stopping them. Josiah, not the sort of kid to do things in half measures, played through the game on both sides.

immersing himself in that cyberpunk simulation-and learning about famous hackers like Apple cofounder Steve Wozniak and Kevin Mitnick, who had evaded the FBI in a cat-and-mouse pursuit in the 1990s-cultivated in Josiah's teenage mind a notion of hacking as a kind of secret, countercultural craft. The challenge of understanding technical systems better than even their designers appealed to him. So did the subversive, exploratory freedom it offered to a teenager with strict Christian parents. When he googled a few hacking terms to learn more, he ended up on a site called Hack Forums, a free-for-all of young digital misfits: innocent explorers, wannabes, and full-blown delinquents, all vying for clout and money.

On the internet of 2011, the most basic trick in the playbook of every unskilled hacker was the denial-of-service attack, a brute-force technique that exploits a kind of eternal, fundamental limitation of the internet: Write a program that can send enough junk data at an internet-connected computer, and you can knock it offline.

The previous year, for instance, the hacker group Anonymous had responded to the refusal by Visa, Mastercard, PayPal, and Bank of America to allow donations to WikiLeaks by urging its plebes to bombard the companies' servers with data requests, creating so-called distributed denial-of-service attacks that briefly took down the companies' online services. But most DDoS attacks were less principled: the constant AK-47 cross fire of the cybercriminal internet's internecine wars and vandalism.

On Hack Forums, many hackers ran their own "booter" services that, for a few dollars a month, would launch denial-of-service attacks against anyone a customer chose-often online gaming services, to troll or sabotage rival players. Users and admins of booters talked casually of "hitting off" targets, or worse, "holding off" a service or a single user's connection, repeatedly bombarding it to prevent it from coming back online.

Some booters launched attacks from botnets, collections of thousands of unwitting users' PCs, hijacked with hidden malware to form a lemming-like swarm of machines pummeling a target with data. Other booters used "reflection" or "amplification" attacks: If a hacker could find an online service that would respond to a query by sending back a larger chunk of data than the request itself, they could spoof the origin of their question so the service would send its answer to a victim. By bouncing a stream of thousands of questions off a server, the hacker could bombard the victim with its responses and vastly multiply their attack's firepower.

Josiah, fascinated by the cleverness of those tricks, was naturally determined to understand them at their deepest level. He stumbled upon a blog post from a cybersecurity blogger describing a reflection attack that used the servers of the online first-person-shooter game Quake III Arena. Ping them with a simple "getinfo" or "getstatus" request, and the servers would send back information that included the usernames of the players on the server and the map of the level they were playing on-an answer that was nearly 10 times as big as the question and could be directed at any spoofed IP address a hacker chose.

The post was intended as a warning. It cautioned that this kind of attack could be used to take down a service with as much as 23 megabits per second of bandwidth, a pipe that seemed enormous to Josiah on his 1.5-megabits-per-second home DSL connection. A competent programmer exploiting the problem, the blog post's author wrote, "can easily create a full-fledged attack suite in a lazy afternoon."

Josiah took this as a challenge. He cobbled together a simple script to perform the attack and posted it to Hack Forums under his handle, "Ohnoes1479." He asked only for anyone who used it to give him an upvote "if its good ✌" to increase the prestige of his forum profile.

Josiah didn't think too much about the morality of his creation. After all, it took a computer offline only temporarily, right? More of a mischievous hiccup than a crime, he figured. He couldn't use it himself anyway, because his home internet connection didn't allow the IP spoofing the attack required. Still, as other hackers on the forum-some of whom he suspected ran their own booter services-asked questions about how to use the program and even requested feature updates, he was happy to help.

Mostly, like the technical wunderkind he'd once been in his church's auto shop, he aimed to impress. "I wanted to make something cool," he says. "And I wanted respect."

in that anarchic Hack Forums scene, Josiah soon found a kindred spirit, a user who called himself "moldjelly." In the offline world, his name was Dalton Norman. He was a teenage hacker just a year older than Josiah who was far more in touch with his rebellious side.

Like Josiah, Dalton had grown up with an engineer for a father. His dad led the maintenance team for a skyscraper in New Orleans, where the family lived. And like Josiah, Dalton had a natural technical talent. As a preteen, he wrote cheating mods for video games that he presented on his own YouTube channel in a squeaky voice. He and his father would work in their spare time on his dad's souped-up Chevrolet Monte Carlo, which had so much horsepower that Dalton remembers the feeling of its exterior twisting as it accelerated. He says he inherited that same drive to push technology to its limits.

But far more than Josiah's, Dalton's childhood was tinged with adversity. As a small child, he had struggled with a stutter that deeply scarred him. He remembers his family laughing at him at the dinner table as he labored in vain to pronounce his younger sister's name. "It was awful and kind of contributed to me just being in my room and having low self-esteem and trying to raise it by being super good at something," Dalton says.

By the end of elementary school, to Dalton's relief, the stutter had faded away. But just as it seemed like he might enjoy a normal adolescence, his life was disrupted by misfortune on a far larger scale: Hurricane Katrina. Dalton's family evacuated to Mississippi and didn't return for more than five years. In exile one state over, Dalton found himself at a "culty" Christian private school, where students prayed before class and, as he remembers it, a math teacher assured him that Barack Obama was the Antichrist. "When I wouldn't pray or do any of that," he says, "I would get shit for it."

Dalton wrote his first program when he was 12. It was a spam tool that he used to torture a teacher he disliked, wrecking her inbox. He says he carried out his first denial-of-service attack not long after, targeting his school's network from within.

While connected to the school's Wi-Fi, he flooded its router with junk requests until the entire intranet collapsed. "It's easy to take down a network when you're inside of it," he says. Ironically, as Dalton describes it, he had gotten enough of a reputation for IT know-how that school staff asked for his help fixing the problem. He stopped his attack script, unplugged the router, plugged it back in, and showed the school administrators that it magically worked again. During another attack, however, he says he overheated the router so badly in its poorly ventilated closet that it was fried.

In his early teens, he remembers watching The Social Network and taking exactly the wrong message from the movie: Rather than feeling cautioned by the film's fictionalized origin story of an icily amoral Mark Zuckerberg, Dalton was profoundly inspired. "That movie basically changed how I viewed the world," he says. "It's like, with a laptop and a great idea, you can take control of your life and build something cool."

After a failed attempt to launch his own social network-he had no idea how to gain users and no budget to advertise it-he returned to hacking: He wrote a keylogger program, designed to snoop on a victim's keystrokes after infecting their PC via thumb drive. He also found his way onto Hack Forums. Soon he was running his own booter service, hiring other hackers to handle customer service so he could focus on finding new methods to amplify his attack traffic.

It was around this time that Dalton encountered Josiah, who was, he says, the smartest hacker he'd ever met. The two teens soon moved off Hack Forums to talk regularly on Skype and then later TeamSpeak, another internet conferencing service. In those conversations, Dalton eventually used his real name, while Josiah went by "Joey," a thin veneer of a pseudonym. They enjoyed competing with each other to find new denial-of-service amplification tricks. In a friendly rivalry, they'd stay up into the early morning hours, plumbing the internet for eclectic servers that they could use to multiply their attack traffic dozens and eventually hundreds of times over.

In those late-night cyberattack sessions, the two hackers say, they would typically set up their own website for target practice, or use a friend's, so that they could measure the size of the traffic they were blasting at it. At times they would clock attacks of more than 100 gigabits a second, they say-more than 4,000 times as big as the 23-megabit attack that had initially amazed Josiah. Very often they would knock their target website offline, along with the server of the hosting service it ran on, causing downtime for an untold number of other websites too.

By this time, Josiah admits, he'd become mildly intoxicated by the power of the tools they'd learned to wield, though he still considered himself a kind of innocent, exploratory hacker. "I was stupid, and I was just angry sometimes, and I wanted to see damage, at points," he says. "But it wasn't my primary motivator-for a while."

Dalton, who was already running a for-profit attack service, had no such illusions of innocence and admits-a little proudly-to using his growing arsenal of booter artillery on any Hack Forums rival who sufficiently annoyed him. In some cases, he boasts, he would "hit people off so hard" that their internet service providers would cut the victim's connection for 24 hours to avoid further collateral damage. "It was a lot of power," he says. "If someone was bullying or being an asshole, then yeah, they went offline for a while."

both teenagers managed to hide these dalliances with illegal hacking from their families. But for Dalton, the consequences soon spilled violently into his physical world.

It began when he discovered that someone who worked for his booter service, an older kid to whom he'd foolishly given his real name, had been stealing their profits. He fired the guy. A few days later, Dalton and his family were sitting around the dinner table when a team of police officers in bulletproof vests burst through the door, screaming at everyone to get on the ground. The cops pointed shotguns at Dalton and his terrified parents and siblings, barking orders and questions.

It turned out that the police had received a spoofed 911 call. The caller had warned that Dalton had shot his mother and was now holding the rest of the family hostage. Dalton had been "swatted," targeted with the most dangerous retaliatory measure in the toolkit of nihilist teen hackers. When the police realized there was no hostage crisis, Dalton explained to the cops and his parents that an angry kid online had inflicted this situation on them-leaving out the part about his booter service. As a measure of the skewed risk assessments of his teenager's brain, his biggest fear during the entire incident was how his furious parents would punish him. He was grounded.

Dalton says the real lesson he drew from the incident was to tighten his operational security, no longer telling anyone in the hacking world his real name-except Josiah. "I trusted no one except for Joey," he says.

In the midst of all this, when Dalton was 15, another kind of calamity struck: His stutter came back. He says it happened when he met another stutterer at his high school. Somehow, the event triggered his brain to start tripping up his speech all over again. And the change seemed to be permanent. All the difficulty he'd had speaking as a small child, along with all the anxiety and shame that came with it, flooded back. It was, he says, "a nightmare."

Like many stutterers, Dalton found workarounds for the arbitrary lexicon of words that would halt his speech, substituting others to hide his disability. But names, which allowed no substitutions, were particularly tough. At one point, to get out of gym class, he volunteered with his high school's tech office and found that the job included delivering laptops to students. He remembers standing in front of a classroom trying to say a student's name as the entire class laughed at him. Even his own name was often impossible to get out. "It broke me," he says. "But afterward, I was just like, 'I don't care what other people think. Fuck it.'"

Dalton's stutter, he says, drove him into cybercrime with a renewed fervor. He cut ties with real-world friends, retreated to his computer, and focused his energy on hacking. His skewed teenage logic kicked in again, telling him to abandon any hope of a normal life or legitimate career. "I thought, 'No one's gonna hire me because I can't talk. How am I going to get past an interview when I can barely say my name?'" Dalton remembers.

He had, he told himself, no other option. "I have to find a way to make this blackhat thing work out."

Of the Three young hackers who would go on, together, to be responsible for the biggest DDoS attacks in history, Paras Jha came to that path from the most innocent and childlike place of all: a love of Minecraft.

Born in Mumbai, Paras was less than a year old when his family emigrated to the US, where they eventually settled near central New Jersey. His parents demanded academic perfection, and Paras was gifted enough to easily deliver. Too easily, in fact: For years of elementary and middle school, he would read entire textbooks as soon as he got them, he says, then never study them again and ace every test.

At the same time, Paras was aware that he had a paradoxical problem with focus. He remembers being in third grade and disassociating as a teacher spoke to him, tracing out her face in the air with his finger. That teacher later suggested to Paras' parents that he be tested for attention deficit disorder. Coming from a culture that stigmatized such a diagnosis, Paras says, his family was skeptical of the teacher's warning. His mother and father filled out the school's evaluation for learning disabilities; it came back negative, and he was never treated.

Over Skype, Josiah told the others that he was launching the attack. Across the internet, Paras could hear the tap of the Enter key on Josiah's keyboard. And the world stopped.

As Paras grew older, his scattered mental state meant he often forgot school assignments, and his strict parents would respond by grounding him. To pass the time, he gravitated to computers. His beloved video games were forbidden on weekdays, so he would spend hours playing with Microsoft's Visual Studio, teaching himself to program.

By his early years of high school, Paras had become obsessed with Minecraft, an immersive online world that essentially presents a blocky, lo-res, nearly infinite metaverse. More than playing the game, however, Paras was drawn to the possibilities of running his own Minecraft world on an online server. He would host mini-games of tag or capture the flag, endlessly tinkering with his server's code to modify the rules. He loved to join his own world, turn himself invisible, and then observe how players responded within the universe he controlled and changed at will. It was like watching 8-bit ants with human intelligence move around his very own ant farm.

Paras soon discovered he could make thousands of dollars using his coding skills to build modifications and mini-games for other Minecraft administrators. In fact, it turned out that the Minecraft ecosystem supported its own surprisingly high-stakes industry. Players paid small fees for access to perks and upgrades on their favorite servers, and administrators of the most popular worlds within that decentralized metaverse made as much as six figures a year in revenue. All of that money meant this innocent-seeming industry had developed a surprisingly ruthless dark side. Minecraft servers came under constant barrage from booters' DDoS attacks, launched by aggrieved players, competitors, and trolls. Many paid thousands of dollars a month to DDoS protection firms that promised to filter or absorb the attack traffic.

One day, Paras found himself in a Skype group chat with an acquaintance who also ran a Minecraft server. This person was determined, for reasons Paras can no longer remember, to take down a particular rival's world. Paras read along as the acquaintance asked another member of the chat for help-a figure by the name of LiteSpeed, who had attained a certain infamy for his denial-of-service wizardry.

Josiah had changed his handle on Hack Forums from Ohnoes1479 to this less-cute moniker about nine months after he'd joined the site, and these days he carried himself online with significantly more swagger. He was happy to oblige.

Josiah, Paras, and a few friends all entered the target Minecraft world, apparating into its blocky landscape full of hundreds of other players' lo-res figures. Then, over Skype, now in a voice chat, Josiah told the others that he was launching the attack. Across the internet, Paras could hear the tap of the Enter key on Josiah's keyboard. And the world stopped.

Instead of going dark or returning an error message, the universe hosted on the server that Josiah had knocked offline simply froze, as each player was suddenly disconnected and confined to their own computer's splintered version of it. Paras marveled at how he could move through that world and see other players paralyzed where they stood, or floating in midair.

That frozen state lasted for 30 seconds before the world crashed entirely. To Paras, it was a hilarious magic trick. "It felt like a secret superpower almost," he says. "Even though it wasn't me who did it, it was cool to just be in the know about what's going on."

He became friendly with Josiah and found that this talented hacker was happy to take down practically any target server that Paras asked him to, mostly just for sheer amusement. Josiah also seemed to be surprisingly open to sharing his knowledge. Having moved on from the amplification attacks he and Dalton had experimented with early on, Josiah now carried out his attacks with a botnet of thousands of computers around the internet that he'd infected with his own malware, exploiting a security flaw in the web-hosting software phpMyAdmin to turn the underlying servers into his personal army.

Later Josiah would switch to wielding an even more powerful collection of Supermicro servers that he'd hacked via a vulnerability in their baseboard management controllers, chips meant to allow an administrator to remotely connect to a server and monitor its performance. The attacks he was triggering were soon so powerful that he and his friends had difficulty even gauging their strength: Everything they'd hit with it-the best-protected Minecraft servers, even their own measurement tools-would immediately fall offline.

Paras wanted this superpower too. Josiah was happy to help him troubleshoot his DDoS attack code and even offered thousands of computers from his own botnet for Paras to test it on. "Instead of just pressing the button, I wanted to say I had made the button," says Paras. Soon he was a relatively sophisticated botnet herder with his own DDoS zombie horde.

By 10th grade, to his parents' dismay, Paras had begun to struggle in school as subjects became more complex and his disaffected-prodigy tactics reached their limits. But online, where he went by the handle "dreadiscool," he embraced his new godlike capabilities with roguish abandon, knocking off targets on the slightest whim. He and another friend would even sometimes find the phone number for a company that hosted certain Minecraft servers, call their business line from a burner number, and verbally taunt them as Paras launched a DDoS attack that ripped their machines offline.

Somehow, the rule-following, high-achieving kid from a strict immigrant household had become a rampant online vandal. But at that point, Paras says, it was never quite clear to him-or Josiah, or Dalton-how serious the consequences of their attacks might be. They were, after all, still just taking some computers off the internet, right? "Like, the servers come back online," Paras says. "You wake up the next day and you go to school."

At other times he would almost check himself, coming to grips with his spiraling behavior. He remembers sitting in the bathroom of his parents' house just after taking down one of the biggest Minecraft servers, Hypixel, and realizing that if he kept going, he was bound, sooner or later, to get arrested. "Don't get sucked into it," he told himself. "Don't get sucked into it."

paras got sucked into it. They all did. In particular, Josiah, the Christian homeschooler who'd once kidded himself that he was a harmless hacker-explorer or a Wozniak-style prankster, had taken a rapid, step-by-step slide into moneymaking cybercrime. Under his LiteSpeed handle, he'd begun selling his amplification techniques to known booter service operators for a few hundred dollars a customer, spending most of the money to rent servers in remote data centers to further his hacking. He reverse engineered Skype's code to find ways of extracting users' IP addresses, the identifiers for their home internet connections that could allow them to be directly DDoSed. Soon he was selling this IP-extraction tool on a per-use basis to his fellow hackers and booters.

When one of his friend's would-be victims bragged that he couldn't be hit offline because he had a dynamic IP address that changed every time he rebooted his home router, Josiah figured out he could use a traceroute command to see the IP address of every router between that target and his internet service provider. So he and the friend started hitting the computers farther upstream in that network, going after the bigger arteries that fed data to and from his computer instead of the capillaries that linked to his home machine, until all of those routers were unresponsive too. This indiscriminate tactic, as far as they could tell, took out the internet service for the target's entire town, all just to prevent him from dodging their attack.

Each step, Josiah says, felt small enough that, like the mythical boiling frog, he barely noticed the change in moral temperature. He'd found something he was very good at-better than perhaps anyone he knew. And he wasn't, he told himself, carrying out hardcore cybercrime like breaching networks or stealing credit card data. Another Hack Forums user reassured him that the FBI cared only about botnets bigger than 10,000 computers, a story he naively accepted. "I rationalized a lot of it away," Josiah says. "The pot was boiling."

in early 2014, when Josiah was still 16 years old, he dialed the temperature up another fateful degree with the creation of a powerful new form of botnet. It began when a friend pointed out to him that home routers, aside from making good targets for DDoS attacks, could themselves be hacked and potentially turned into botnets' zombie conscripts. In fact, many routers still used an old protocol called telnet that allowed administrators to remotely configure them, sometimes without the need for any authentication or else requiring only default credentials, like the password "admin." All those routers represented countless thousands of hackable devices, in other words, waiting to be taken over and added into Josiah's army.

The catch was that the routers were small, simple gadgets that used cheap, low-performance embedded-device chips-not the kind of system that most hackers were accustomed to exploiting. But Josiah was never one to be daunted by the task of learning the arcane details of a new machine. He started from scratch, learned to write the native language of routers' ARM chips, and built a compact piece of malware that could be installed over telnet onto the relatively dumb devices to make them obey his attack commands.

The routers' operating systems didn't normally allow software to be installed on them. But Josiah figured out that they did have an "echo" command that could write out any line of text that you typed into a new file. He used that command to copy his code, line by line, into a file small enough to fit into the routers' few megabytes of memory. The feat was the equivalent of assembling a model ship inside a 12-ounce bottle. He called the code Qbot.

Qbot was Josiah's first foray into hacking the so-called internet of things, the vast universe of internet-connected devices beyond traditional computers, from security camera systems to smart appliances, that would turn out to be ripe for exploitation. Even in this first, crude attempt, it was immediately clear that Qbot was a potent new weapon.

Josiah could see the power he'd stumbled into: There seemed to be many thousands of vulnerable routers online that Qbot could commandeer. He was initially more careful with this creation than he'd been with his previous coding projects, keeping Qbot's code private and sharing it only with his friends: Dalton, Paras, and a few other young hackers who had formed a loose network and hung out on Skype and TeamSpeak. But Josiah made the mistake of also giving the code to one other contact. The guy went by the name "vypor" and, Josiah says, had a reputation for trading in other hackers' secrets as a means of impressing more talented acquaintances. Vypor immediately began trading Qbot for favors and clout with, it soon seemed, his entire contact list.

When that betrayal became clear, Dalton retaliated on Josiah's behalf by hiring a rapper through the gig-work service Fiverr to record a profanity-laden track brutally mocking vypor's lack of coding skills. The diss track was uploaded to YouTube. Vypor immediately responded by threatening to swat all of them: Dalton, Josiah, even Paras, who had only recently joined the group.

All three of the young hackers were terrified of being swatted-or swatted again, in Dalton's case. They agreed that their best bet to protect themselves was to knock vypor offline and hold him off as long as possible. If he couldn't reach a VoIP service to spoof a call to the police, their short-term reasoning told them, he couldn't swat anyone. Maybe they could at least enjoy the weekend before he brought armed police to their doorsteps.

So all of them, together, bombed vypor with every DDoS tool they had. For days, they repeatedly hit not only his home connection but also routers two and three steps upstream, using Qbot and every other botnet and amplification technique they'd learned to wield. The three believe they probably blasted vypor's entire town off the internet, though they never got confirmation aside from seeing the entire chain of network devices stop responding to their pings.

Regardless, the attack seemed to serve its purpose. Vypor disappeared from the scene and never bothered them again.

allison nixon, who would become one of the first security researchers in the world to fully understand the dangers posed by weaponized routers and internet-of-things appliances, had no idea who Josiah White was. But she knew LiteSpeed.

At the beginning of her career in New York a few years earlier, Nixon had worked the night shift in the Security Operations Center of Dell's SecureWorks subsidiary, essentially as the cybersecurity equivalent of a patrolling night watchman. A petite, hoodie-wearing security analyst in her early twenties, she monitored the company's clients' networks for attacks in real time and investigated them just enough to know whether to escalate to someone more senior. "Kind of a grind," she remembers.

But she was curious about where all these daily, wide-ranging hacking attempts were coming from. So in the long stretches of downtime between alerts, she started googling and was amazed to discover Hack Forums, a platform on the open web where young digital deviants were bragging about their attacks and brazenly selling their toolkits. She found booter services especially shocking: how publicly, and cheaply, these miscreants sold a kind of cyberattack that could cost companies millions of dollars a year and often made her and her colleagues' lives hell. Many of the young hackers doing this damage could even be identified, thanks to their rash public posting, sloppy operational security, and the frequent "doxing" of rivals-digging up and outing another hacker's real identity. But no one seemed to be doing anything to stop them.

As Nixon lurked longer on the forum, she could see that most hackers on the site weren't actually developing their own techniques. Instead, almost all of their tools seemed to trickle down from just a few skilled individuals. LiteSpeed was one of them. His attack amplification tricks and bot infection tools had established him as a kind of Hack Forums alpha, an unmistakable standout in the scrum. "Sometimes you kind of get a gut feeling when you're tracking someone that they're going to blow up in one way or another," she says. "I knew I wanted to keep an eye on him."

Nixon says the more senior researchers on SecureWorks' counterthreat team had little interest in DDoS attacks, which were considered primitive compared to the cutting-edge intrusion methods that they focused on. But Nixon was fascinated by the anarchic Lord of the Flies world of young hackers building an entire cyberattack industry, seemingly with no repercussions or even notice from law enforcement.

Nixon partnered with a university researcher and began testing out booter services on Hack Forums, barraging a guinea-pig target server with waves of junk traffic. Some of the attacks topped 30 gigabits a second, easily enough to knock someone offline or cripple a website.

By 2014, Nixon had quit the security operations center and taken a job hunting hackers full time, but she couldn't let go of her DDoS obsession. At a meeting in Pittsburgh of cybercrime fighters, called the National Cyber-Forensics and Training Alliance, she stood before a room of several dozen researchers, academics, and law enforcement officials. With the participation of an internet service provider that had just presented its DDoS protection plan, she demonstrated that she could click a button on a booter website and launch a cyberattack at will-a daring move in front of a crowd of federal agents and prosecutors.

One agent from the FBI's Pittsburgh field office, named Elliott Peterson-a former Marine from Alaska who'd recently led the landmark takedown of a Russian-origin cybercriminal malware and botnet known as GameOver ZeuS-was particularly impressed. He and Nixon talked about the booter problem. She pointed out how freely the services operated, how many of the culprits were identifiable, and how powerful any intervention in that world might be. And she shared her growing sense that, if the larger problem were left unchecked, it would pose a serious threat to the operation of the internet.

for josiah, the conflict with vypor was a wake-up call. He felt he'd narrowly avoided watching his secret hacking hobby burst into his peaceful family life. For more than a year, he backed away from Hack Forums and let his LiteSpeed handle go dormant. But he continued to chat with his friends Paras and Dalton, and the three of them began sharing a rented server for coding experiments and internet scanning, which they referred to as the Fun Box.

Paras, meanwhile, continued his free fall into hacker nihilism. In the fall of 2014, he started college at Rutgers and found himself alone and unmoored. He had looked forward to delving into the study of computer science and was appalled to learn that he would have to enroll in other kinds of courses that, to him, seemed like months of wasted time and tuition. Even the computer science exams, to his horror, had to be taken with pencil and paper. "I absolutely hate college," he texted a friend. "There is absolutely nothing for me here."

He sank into a malaise and gained weight, sometimes eating a large Papa Johns pizza in one sitting. He couldn't sleep at night and often couldn't find the motivation to get out of bed, much less go to class. Aside from his roommate, he had little social contact in the real world-certainly nothing that could compare to the rich, battle-tested friendships he'd built online.

"We'll do it a few times," Josiah remembers thinking. "We'll cause trouble for a little bit, and then we'll just forget about it. We'll stop."

Paras was particularly frustrated to find he couldn't even get into some of the computer science courses he wanted to register for: Third- and fourth-years got first dibs, and only once their registration round was over did second- and first-years get a chance to choose from the leftovers.

But Paras soon realized he had just the superpower to right this injustice: He could use one of his botnets, built mostly of vulnerable home routers, to blast the entire registration system offline until it was his turn.

He took a trollish delight in tormenting the institution that he felt was tormenting him. Under the Twitter handle @ogexfocus, accompanied by a picture of a ghostly mask, Paras publicly taunted his target. "Rutgers IT department is a joke," he wrote in a public manifesto, bragging, after three attacks in succession, about crushing the university's network "like a tin can under the heel of my boot ... I'm fairly certain I could run circles around all of you with my eyes closed and one leg amputated."

# data[].attributes.attachment_link.title
The Mirai Confessions: Three Young Hackers Who Built a Web-Killing Monster Finally Tell Their Story

# data[].attributes.attachment_link.description
Netflix, Spotify, Twitter, PayPal, Slack. All down for millions of people. How a group of teen friends plunged into an underworld of cybercrime and broke the internet-then went to work for the FBI.

# data[].attributes.headline
Cyberattacke: Häfen in Australien wieder in Betrieb, 30.000 Container gestrandet

# data[].attributes.subject
Cyberattacke: Häfen in Australien wieder in Betrieb, 30.000 Container gestrandet

# data[].attributes.body
Nach einer Cyberattacke ist der Hafenbetreiber DP World seit dem heutigen Montag dabei, den Betrieb an mehreren betroffenen Terminals in Australien wieder aufzunehmen. Insgesamt befinden sich nach der mehrtägigen Betriebsunterbrechung nun aber rund 30.000 Container nicht an ihrem planmäßigen Standort, berichtet The Sydney Morning Herald. Die Aufarbeitung werde deshalb noch Tage oder gar Wochen dauern. Am Montag sollen die ersten rund 4000 stecken gebliebenen Container die Häfen in Sydney, Melbourne, Brisbane und Fremantle verlassen, heißt es weiter. Während Australien damit zum wiederholten Mal innerhalb weniger Tage die Verletzlichkeit der eigenen IT-Infrastruktur deutlich gemacht wurde, ist noch unklar, was genau vorgefallen ist.

# data[].attributes.attachment_link.readable_text
Nach einer Cyberattacke ist der Hafenbetreiber DP World seit dem heutigen Montag dabei, den Betrieb an mehreren betroffenen Terminals in Australien wieder aufzunehmen. Insgesamt befinden sich nach der mehrtägigen Betriebsunterbrechung nun aber rund 30.000 Container nicht an ihrem planmäßigen Standort, berichtet The Sydney Morning Herald. Die Aufarbeitung werde deshalb noch Tage oder gar Wochen dauern. Am Montag sollen die ersten rund 4000 stecken gebliebenen Container die Häfen in Sydney, Melbourne, Brisbane und Fremantle verlassen, heißt es weiter. Während Australien damit zum wiederholten Mal innerhalb weniger Tage die Verletzlichkeit der eigenen IT-Infrastruktur deutlich gemacht wurde, ist noch unklar, was genau vorgefallen ist.

DP World ist einer der weltweit größten Hafenbetreiber und für rund 40 Prozent der Warenströme in und aus Australien verantwortlich. Insgesamt sind die Häfen des Landes sogar für 98 Prozent aller Waren verantwortlich, die ins Land kommen oder in alle Welt transportiert werden. Ereignet hat sich die angebliche Cyberattacke am vergangenen Freitag, in der Folge ging auf den australischen Terminals von DP World nichts mehr. Bei der Behebung hat der Konzern mit der australischen Regierung zusammengearbeitet, die IT-Systeme waren vom Internet abgekoppelt. Priorität hatte die Wiederherstellung jener Systeme, die für den Frachtbetrieb nötig sind, damit der wieder aufgenommen werden konnte. Das ist nun der Fall.

Der Angriff zeige, "welch ernstes Risiko Cyberangriffe für unser Land und die lebenswichtige Infrastruktur darstellen", hat Australiens Innenministerin und Ministerin für Cybersicherheit, Clare O'Neil, erklärt. Ihr Land war erst vergangenen Mittwoch durch einen Totalausfall beim zweitgrößten Mobilfunkprovider Optus teilweise lahmgelegt worden. Stundenlang kamen mehr als zehn Millionen Menschen nicht ins Internet, Notrufe waren nicht verfügbar und in zahlreichen Geschäften konnte nicht mehr bargeldlos bezahlt werden. Erst nach etwa neun Stunden war der massive Ausfall größtenteils beendet worden. Der hat vielen im Land deutlich gemacht, wie abhängig man von der Internetverfügbarkeit bereits ist. In ähnlicher Weise könnte jetzt die logistische Infrastruktur hinterfragt werden.

# data[].attributes.attachment_link.title
Cyberattacke: Häfen in Australien wieder in Betrieb, 30.000 Container gestrandet

# data[].attributes.attachment_link.description
Mehrere Tage konnte einer der größten Hafenbetreiber der Welt in Australien keine Container verladen. Grund war eine Cyberattacke. Die Folgen sind erheblich.

# data[].attributes.headline
FIRST has officially published the latest version of the Common Vulnerability Scoring System (CVSS v4.0)

# data[].attributes.subject
FIRST has officially published the latest version of the Common Vulnerability Scoring System (CVSS v4.0)

# data[].attributes.body
In June 2023, attendees at the 35th Annual FIRST Conference, in Montréal, Canada got a first-look preview of the new version of the Common Vulnerability Scoring System (CVSS), version 4.0. After two month of public comment followed by two months of addressing those comments, FIRST is proud to announce the official publication of CVSS version 4.0.

# data[].attributes.attachment_link.provider_name
FIRST - Forum of Incident Response and Security Teams

# data[].attributes.attachment_link.readable_text
November 1st, 2023 - Critical in the interface between supplier and consumer, CVSS provides a way to capture the principal characteristics of a security vulnerability and produces a numerical score reflecting its technical severity to inform and provide guidance to businesses, service providers, government, and the public.

The numerical score can be represented as a qualitative severity rating (such as low, medium, high, and critical) to help organizations properly assess and prioritize their vulnerability management processes and prepare defenses against cyber-attacks.

Furthermore, this system allows the consumer to also assess real-time threat and impact, arming them with vital information to help to defend themselves against an attack.

The Common Vulnerability Scoring System is a published standard used by organizations worldwide, and this latest version of CVSS 4.0 seeks to provide the highest fidelity of vulnerability assessment for both industry and the public.

The revised standard offers finer granularity in base metrics for consumers, removes downstream scoring ambiguity, simplifies threat metrics, and enhances the effectiveness of assessing environment-specific security requirements as well as compensating controls. In addition, several supplemental metrics for vulnerability assessment have been added including Automatable (wormable), Recovery (resilience), Value Density, Vulnerability Response Effort and Provider Urgency. A key enhancement to CVSS v4.0 is also the additional applicability to OT/ICS/IoT, with Safety metrics and values added to both the Supplemental and Environmental metric groups.

This is a significant development for cyber security and incident response teams world-wide. With an increasingly complex threat landscape, this new version of CVSS is set to be a game-changer for the sector.

Prior to 2005, custom, incompatible rating systems were used to define severity before a need to standardized vulnerability measurements across software and platforms was identified. CVSS version 1 was released in February 2005, developed then by a small group of pioneers with the aim of industry-wide adoption, with FIRST appointed that April to drive the future development of what would become a critical tool in the sector's arsenal.

Over a dozen FIRST members of the CVSS Special Interest Group (SIG) collaborated extensively through 2006 and 2007 to revise and improve CVSS version 1 by testing and re-testing hundreds of real-world vulnerabilities releasing version 2 in June 2007.

A third version developed the tool further in 2015 introducing the concept of 'Scope' to handle the scoring of vulnerabilities that exist in one software component, but impact a separate software, hardware, or networking component.

Finally, version 3.1 was released in June 2019 which clarified and improved upon version 3.0 without introducing new metrics or values, improving upon clarity of concepts to improve the overall ease of use of the standard and adding the CVSS Extensions Framework.

However, this latest release marks a significant step forward with added capabilities crucial for teams with the importance of using threat intelligence and environmental metrics for accurate scoring at its core.

Another function of note is the nomenclature. CVSS is not just the Base Score, so to further highlight this, new nomenclature has been adopted in version 4.0:

CVSS-B: CVSS Base Score

CVSS-BT: CVSS Base + Threat Score

CVSS-BE: CVSS Base + Environmental Score

CVSS-BTE: CVSS Base + Threat + Environmental Score

As cyber security issues continue to rapidly increase worldwide global coordination is never more vital to make the internet safe for everyone, and the creation of standards like CVSS 4.0 are essential for both the sector and the public.

Chris Gibson, CEO, FIRST commented: "The CVSS system has rapidly developed over the past 18 years, with each version building on our capabilities to defend from cyber criminality.
"I am immensely proud of the CVSS-SIG for the hard work and dedication it has taken to produce version 4.0. And it is timely as we continue to see a significant rise in threats across the world. "As a membership organization, our goal is to empower our members and the sector, demonstrating leadership and ensuring we are dedicated to continuously improving how we work together to defend people across the globe against cyber-attacks."
More can be found here: first.org/cvss

Also available in PDF

Wed, 01 Nov 2023 17:00:00 +0000

# data[].attributes.attachment_link.title
FIRST has officially published the latest version of the Common Vulnerability Scoring System (CVSS v4.0)

# data[].attributes.attachment_link.description
In June 2023, attendees at the 35th Annual FIRST Conference, in Montréal, Canada got a first-look preview of the new version of the Common Vulnerability Scoring System (CVSS), version 4.0. After two month of public comment followed by two months of addressing those comments, FIRST is proud to announce the official publication of CVSS version 4.0.

# data[].attributes.headline
Elon Musk tells Rishi Sunak 'AI will mean people no longer need to work'

# data[].attributes.subject
Elon Musk tells Rishi Sunak 'AI will mean people no longer need to work'

# data[].attributes.attachment_link.title
Elon Musk tells Rishi Sunak 'AI will mean people no longer need to work'

# data[].attributes.headline
Statement to the US Senate AI Insight Forum on "AI and the Workforce"

# data[].attributes.subject
Statement to the US Senate AI Insight Forum on "AI and the Workforce"

# data[].attributes.body
Leader Schumer, Senators Rounds, Young and Heinrich, and distinguished members of the Senate thank you for the opportunity to join you to discuss artificial intelligence (AI) and employment and skills. I am Rob Atkinson, President of the Information Technology and Innovation Foundation (ITIF), a technology policy think tank. While this is an important issue, ITIF does not believe that AI will produce drastic structural changes in the U.S. economy or labor markets. Change will likely be gradual and, if Congress take steps to improve America’s labor market adjustment system, it will be manageable and positive.

# data[].attributes.attachment_link.readable_text
Contents
Dystopian Job Predictions Are Wrong. 1 Evidence That Technological Innovation Does Not Boost Unemployment 2 Worker Dislocation and Job Quality Impacts Are Likely To Be Modest 4 What Should Congress Do? 5
Leader Schumer, Senators Rounds, Young and Heinrich, and distinguished members of the Senate thank you for the opportunity to join you to discuss artificial intelligence (AI) and employment and skills. I am Rob Atkinson, President of the Information Technology and Innovation Foundation (ITIF), a technology policy think tank. While this is an important issue, ITIF does not believe that AI will produce drastic structural changes in the U.S. economy or labor markets. Change will likely be gradual and, if Congress take steps to improve America's labor market adjustment system, it will be manageable and positive.

Despite U.S. labor productivity growth and unemployment rates being near all-time lows, the prevailing narrative is that AI will lead to massive labor market disruption. A 2013 study by Oxford University researchers Carl Benedikt Frey and Michael Osborne set the tone when it concluded that 47 percent of U.S. employment was at risk of job loss from new technology. Today a typical headline warns, "Is AI Coming for Your Job? 65% of Workers Are Worried."

Some are even more distopian. Silcon Valley venture capitalist Vinod Kholsa states that "AI will be able to do within 10 years 80 percent of the jobs that we know of today." Elon Musk is even more extreme: "AI will make jobs kind of pointless. Probably the last job that will remain will be writing AI software, and then eventually the AI will just write its own software." Even AI "thinks" it will kill jobs. When one study asked ChatGPT-3 to list the downsides for workers, it wrote: "Job Losses: One of the potential downsides of AI is that it could lead to increased unemployment as machines begin to replace human workers in a variety of industries." Of course, the AI wasn't thinking; it was simply regurgitating articles scraped from the Internet that had this view.

There is nothing new about these kinds of claims. They have been made every time a new general purpose technology has emerged. President Coolidge's Secretary of Labor stated: "we must ask ourselves, is automatic machinery ... going to leave on our hands a state of chronic and increasing unemployment?" Four decades later President Kennedy worried that "I regard it as the major domestic challenge to maintain full employment at a time when automation, of course, is replacing men." We even have a long history of AI job panics. In the early 1980s, AI scientist Nil Nilson warned, "We must convince our leaders that they should give up the notion of full employment. The pace of technical change is accelerating." It was not and is not.

The problem with these fearful speculations-besides the fact that they are not true-is that they fuel opposition to AI progress. Indeed, a host of commentators have called for slowing the pace of AI, or even putting on the brakes. A recent Vox article was titled "The case for slowing down AI." Elon Musk and others signed a statement earlier this year calling for a 6-month moratorium on AI research. It's as if a collective panic has swept a large share of "experts."

History, research, and logic suggest the AI techno-job panic is not warranted. In a study using Bureau of Labor Statistics data, ITIF measured the rate of job loss by occupations in recent decades (figure 1). Interestingly, the rates in 1960s and 70s were relatively high compared to more recently, but it was those decades where real wages grew significantly, and millions of middle-class jobs were created.

While technology has always eliminated some jobs (e.g., buggy-whip makers), it has also created new jobs (e.g., automobile mechanics) and boosted living standards which have resulted in more demand for workers doing existing tasks (building houses, educating people, selling goods, etc.). Since 1900, U.S. productivity has increased by around 7 times: In other words, the average worker produces more in an hour than the average worker in 1900 produced in almost a full a day. But today's unemployment rate is no higher than back then. Indeed, from 1850 to 2023, employment grew at same rate as the labor force. That's because all those farmers, elevator operators, bowling pin setters, horse stable workers, and others found jobs doing other things. That's not to say that we can't have occasional periods of excess unemployment when the economy is in a recession for some reason (e.g., a financial crisis or a pandemic), but the rest of the time the Federal Reserve ensures full employment, even if AI is automating tasks.

This is why virtually all scholarly studies find no net negative effect on employment from technology-induced productivity gains. An OECD study summed it up, "Historically, the income-generating effects of new technologies have proved more powerful than the labor-displacing effects: technological progress has been accompanied not only by higher output and productivity, but also by higher overall employment."

The argument that AI will lead to high unemployment stems from what economists call the "lump of labor fallacy": the idea that there is a limited amount of work to be done, and if a job is eliminated, it's gone for good. But this is a false reading of the process of technological change because it fails to include second-order effects whereby the savings from increased productivity are recycled into the economy in the form of higher wages, higher profits, and reduced prices to create new demand that in turn creates other jobs-some in new occupations (like "content creator assistant") but most in existing occupations that workers will now spend more money on (e.g., personal trainer).

Studies at the firm and industy level find similar resuts. Babina et al. found that "Data on job postings reveal that firms investing in AI technologies increase their demand for workers with more years of education and workers with data analysis and IT skills." Similarly, Albanesi et al. concluded that: "AI-enabled automation in Europe is associated with employment increases."

Moreover, it's important to note that AI is neither magic nor sentient. There are vastly more things AI cannot do than it can do. Yes, AI program DALL-E can generate cool pictures, but it can't create a robot that lays carpet. Yes, ChatGPT-3 can write a wedding toast, but it can't take care of people in a hospital. Human work is incredibly complex, and there are vast array of tasks AI cannot do: fight a fire, repair plumbing, model clothing, give a manicure, install a house addition, be an airline steward, teach children, be a consultant, and even legislate.

The reason is simple: Machine learning and large language models are just software. Better than anything we have had before, to be sure. But there are limits to what they can do. But that doesn't stop the techno-panic based on the view that artificial general intelligence (AGI) is just around the corner. As MIT professor and Rethink Robotics CEO Rodney Brooks observed with respect to AI:

Misled by suitcase words, people are making category errors in fungibility of capabilities-category errors comparable to seeing the rise of more efficient internal combustion engines and jumping to the conclusion that warp drives are just around the corner.

Finally, many of the benefits from AI will not be greater effiency, but rather greater quality and innovation. AI can make K-12 education more customized to student needs. AI can boost drug discovery. AI can reduce financial fraud. These kinds of uses do not negatively impact employment.

But while higher unemploynment is not in the cards, what about worker dislocation? Despite the hype about how transformative AI is, few companies today use AI in any significant way, and while that number will grow, the rate of adoption, like all other technologies in the past, is likley to be incremental. As such, annual rates of employment disclocation are likley to be modest at worst. It is interesting to note that the share of workers losing their jobs due to organizational downsizing or closures has been falling steadily since 1995 (with the exception of the covid spike in 2020). (See figure 2.) And the 1990s economy was seen as good for U.S. workers, even though the rate of job loss was higher than the last decade. The reason is simple. Workers are hurt far more by stagnation and stasis than they are by technology-driven productivity growth. The latter creates a virtuous cycle of higher wages/lower prices, more demand, and more jobs.

What are the likely dislocation impacts on skill and income levels? In an analysis ITIF conducted in 2018 for the G7 AI meetings, we found that correlation between the average wage of an occupation and its risk of automation, including from AI, is negative and quite large (-0.52). The correlation between average years of schooling and risk of automation is also negative and large (-0.51). In other words, the lower the wage and skill level, the higher the risk of a job being automated. The highest-risk occupations have the lowest median wage ($32,380), while the next-highest have the second-lowest median wage ($34,990), and so on. But that analysis was conducted before the emergence of large language models. Deep learning and LLMs may have more of an impact on some knowledge jobs, particularly more routinized ones.

Finally, it's not clear the impact of AI on job quality. But the OECD recently reported that most workers reported an improvement in job quality from the introduction of AI into the workplace.

Rather than slowing AI development and adoption, policymakers should do everything possible to accelerate both, as AI is needed to compete with China and boost U.S. wage growth. And the goal should not be to slow or even stop AI-induced job loss, for the simple reason that the goal of U.S. technology policy should be to spur improvements in living standards for all Americans. For example, if an insurance company uses AI to automate claims processing and downsizes its workforce by 10 percent, the affected workers may be hurt. But the millions of customers of the insurance company will be helped through slightly lower insurance premiums. This means Congress should reject the advice of some who argue that only AI that complements workers should be supported, not AI that replaces workers. If we had followed that advice in the past, we'd still have telephone operators using better tools to manually switch calls and bank tellers entering in customer information on ATM machines. All AI applications that increase worker productivity are in the national interest, regardless of whether they complement or replace the worker.

So, rather than try to slow the rate of job dislocation from AI, Congress should craft policies that better help workers make employment transitions and be more prepared for an AI-driven economy. ITIF has laid out a detailed and actionable policy agenda to help workers better adjust to technology-driven labor-market churn. One recommendation is to invest more in active labor market adjustment policies. In 2015, the United States ranked 33rd out of 34 nations in expenditures on labor market adjustment programs as share of GDP. In addition, for workers who do get laid off from technology, the U.S. unemployment insurance system is often too parsimonious, depending on the state the worker is in. Congress could fix that by increasing the FUTA tax that all employers pay. Congress should also establish stronger requirements for state governments to let workers collecting unemployment insurance enroll in certified training without losing their benefits. In addition, workers need access to top-quality online reemployment portal that includes free online testing and counseling and career navigation services. Unfortunately, current federally supported state-based employment portals are very poor quality.

We also need to do more to prepare workers, especially lower-skilled workers, for transitions into new jobs and occupations. It is a problem that our K-12 schools and universities as a group significantly underperform in their job of ensuring students have the skills they need to thrive. As economist Manuel Trajtenberg wrote in a study about AI and jobs, "the skills employers desire and demand are poorly related to the competencies taught in school. Employers want workers with strong analytical, creative, and adaptive capabilities, which are competencies few secondary or collegiate schools impart." This is one reason why U.S. workers' digital skills are lacking, especially compared to other advanced economies.

One place to start is high school, where STEM curricula have remained largely unchanged for a century. It is striking that 87 percent of U.S. high school students pass a geometry class, but just 7.7 percent pass statistics. In a data- and AI-driven economy, stats are more important than geometry. Even worse, just 6 percent of high school students take computer science courses. In 2018, just 1 percent of high school students took an AP computer science course. And only 53 percent of U.S. high schools even teach computer science. In contrast, in 2013, 87 percent of high school students took art.

There are several reasons for this, but one is that there is no room in most students' class schedule for stats or CS, as states have crammed on more and high school graduation requirements. But why require biology, chemistry, and physics, but not CS? Why require three or four years of math, but not allow statistics to count toward that requirement? And why do many state universities not count statistics toward math entry requirements? While the federal government does not have direct control over high school and college curricula, it can use incentives to encourage both colleges and high schools to make needed changes.

We need more students to go to career and technical colleges and fewer to get liberal arts degrees from four-year colleges. But we also need a new kind of employer-relevant college focused on ensuring students learn skills employers value, such as business-oriented writing, reasoning and critical thinking skills, statistics, public speaking, computer science, and other related skills. One example of this model is the Harrisburg University of Science and Technology, a private university focused on responding to the needs of employers in the region for workers educated and trained in applied science and technology-related fields. The university provides degrees in areas such as Analytics, Interactive Media, and Geospatial Technology. Another model is the Canadian system of Polytechnics, publicly funded colleges or institutes of technology that offer four-year degrees, advanced two-year diplomas, certificates, and in-class training for apprenticeships.

In summary, the United States needs to lead the world in the development and adoption of AI. If we can do that, in part through supportive policy and not restrictive regulations like the EU is introducing, U.S. workers will benefit significantly, especially if Congress makes the needed workforce and education policy changes.

Thank you for your consideration.

# data[].attributes.attachment_link.title
Statement to the US Senate AI Insight Forum on "AI and the Workforce"

# data[].attributes.attachment_link.description
The United States needs to lead the world on the development and adoption of AI. If we can do that, in part through supportive policy and not restrictive regulations like the EU is introducing, U.S. workers will benefit significantly, especially if Congress makes the needed workforce and education policy changes.

# data[].attributes.headline
Deepfakes - Wenn wir unseren Augen und Ohren nicht mehr trauen können

# data[].attributes.subject
Deepfakes - Wenn wir unseren Augen und Ohren nicht mehr trauen können

# data[].attributes.body
Täuschung und Medienmanipulation sind seit jeher fester Bestandteil der Kriegskommunikation. Nie zuvor aber war es derart einfach, qualitativ hochwertige Fälschungen von Ton-, Bild- und Videoaufzeichnungen zu erstellen. Die menschliche Neigung, emotional auf diese Medien zu reagieren, eröffnet deren Produzenten eine völlig neue Dimension des Missbrauchs. Mit einem Kapitulationsaufruf von Präsident Selenskyj, der umgehend als Deepfake entlarvt wurde, liegt der erste Versuch eines Einsatzes der neuen Technologie in einem bewaffneten Konflikt vor. Derartige Fälschungen werden immer besser, die Erkennung immer aufwendiger und ein Ende dieser Entwicklung ist nicht absehbar. Ein Verbot von Deepfakes ist aussichtslos. Es ist deshalb Zeit, sich mit den aktuellen und potentiellen Anwendungsfällen und mit möglichen Gegenstrategien auseinanderzusetzen.

# data[].attributes.attachment_link.readable_text
Täuschung und Medienmanipulation sind seit jeher fester Bestandteil der Kriegskommunikation. Nie zuvor aber war es derart einfach, qualitativ hochwertige Fälschungen von Ton-, Bild- und Videoaufzeichnungen zu erstellen. Die menschliche Neigung, emotional auf diese Medien zu reagieren, eröffnet deren Produzenten eine völlig neue Dimension des Missbrauchs. Mit einem Kapitulationsaufruf von Präsident Selenskyj, der umgehend als Deepfake entlarvt wurde, liegt der erste Versuch eines Einsatzes der neuen Technologie in einem bewaffneten Konflikt vor. Derartige Fälschungen werden immer besser, die Erkennung immer aufwendiger und ein Ende dieser Entwicklung ist nicht absehbar. Ein Verbot von Deepfakes ist aussichtslos. Es ist deshalb Zeit, sich mit den aktuellen und potentiellen Anwendungsfällen und mit möglichen Gegenstrategien auseinanderzusetzen.

Dass die Wahrheit zu den ersten Opfern des Krieges gehört, ist altbekannt und der Einsatz von Propaganda ist ein bekanntes Phänomen in Konflikten. Zu den gängigen Mitteln zur Verbreitung von Desinformation zählen (soziale) Medien, politische Organisationen, Kulturvereine, Stiftungen und Denkfabriken. Auch wenn die Attribution von Desinformation bisweilen schwierig ist, gehören Russland und China zweifellos zu den bedeutendsten Akteuren in diesem Bereich. Deren Werkzeugkasten wird mit Hilfe von generativer Künstlicher Intelligenz (KI) seit einigen Jahren um ein weiteres Tool ergänzt: Deepfakes - täuschend echt wirkende, künstlich erstellte oder veränderte Foto-, Video- oder Sprachaufzeichnungen. Viele Deepfakes der ersten Generation ließen sich aufgrund typischer Bildfehler oder blecherner Stimmen noch recht gut entlarven. Hochwertige Fälschungen waren selten, und so attestierte die Bundesregierung Deepfakes 2020 zu Recht noch eine " geringe praktische Relevanz " und sah sich nicht gezwungen, eine spezifische Reaktionsstrategie zu erarbeiten.

Heute sind einfach nutzbare KI-Tools, mit denen sich hochwertige Fälschungen produzieren lassen, frei zugänglich. Deepfakes sind ein Massenprodukt und keine Seltenheit mehr. Dazu haben in den vergangenen Jahren vor allem drei Entwicklungen beigetragen: die kontinuierliche Verbesserung der KI, die stetige Zunahme verfügbarer Rechenleistung und der offene Zugang zu immer mehr Daten, mit denen die KI trainiert werden kann. Ein Ende und die volle Tragweite dieses Prozesses sind aktuell kaum absehbar.

# data[].attributes.attachment_link.keywords[]
deutsches institut für internationale politik und sicherheit

# data[].attributes.attachment_link.title
Deepfakes - Wenn wir unseren Augen und Ohren nicht mehr trauen können

# data[].attributes.headline
Cyber espionage: a challenge to international law in the age of intelligence competition

# data[].attributes.subject
Cyber espionage: a challenge to international law in the age of intelligence competition

# data[].attributes.body
States are increasingly using cyber espionage to steal secrets from each other. The global spread of Internet makes it easy to do so, and it is relatively risk-free. Cyber espionage is a way for countries to compete with each other, and an important part of modern intelligence gathering. Cyber espionage is not explicitly prohibited by international law, but spying states must still remain within the general principles of international law. The problem is that these principles are not clearly defined when it comes to cyberspace.

# data[].attributes.attachment_link.readable_text
The rise of cyber espionage has created new challenges for international law, but states are hesitant to let international law limit their ability to spy online

States are increasingly using cyber espionage to steal secrets from each other. The global spread of Internet makes it easy to do so, and it is relatively risk-free. Cyber espionage is a way for countries to compete with each other, and an important part of modern intelligence gathering. Cyber espionage is not explicitly prohibited by international law, but spying states must still remain within the general principles of international law. The problem is that these principles are not clearly defined when it comes to cyberspace.

This report examines how international law applies to peacetime cyber espionage, taking stock of recent legal statements by states and examines how states have interpreted the principles of territorial sovereignty and non-intervention in the cyber context. Most countries have so far been silent about the legal status of cyber espionage, but in recent years several leading countries have started speaking about the interaction between international law and spying. The report also analyses the legal implications of Western states providing intelligence and cyber support to Ukraine.

# data[].attributes.attachment_link.title
Cyber espionage: a challenge to international law in the age of intelligence competition

# data[].attributes.attachment_link.description
The rise of cyber espionage has created new challenges for international law, but states are hesitant to let international law limit their ability to spy online

# data[].attributes.body
Following the example of Intrusion Truth, governments should substantiate their attribution statements that identify the perpetrators of malicious cyber operations with open-source intelligence.

# data[].attributes.headline
Is the Fear of Cyberwar Worse Than Cyberwar Itself?

# data[].attributes.subject
Is the Fear of Cyberwar Worse Than Cyberwar Itself?

# data[].attributes.body
Cyberwar is a scary concept. The thought of the grid going down, markets tanking, and mass riots is chilling. Popular media and entertainment accounts of cyberwar would have us believing we’re living right on the edge, with a few keystrokes enough to take the world to a dark place. This alarmism has found some purchase in more sophisticated circles, which seems to lend credence to the belief that cyberwar is right around the corner, if not upon us.

But this hyperbolic characterization of cyberwar is likely a bigger problem than the threat of cyberwar itself. The problem is one of economic security.

The global insurance market has a cyberwar problem. The industry doesn’t understand the associated risks well, which has caused it to seek to avoid involvement with cyberwar altogether. By excluding cyber risks, the insurance industry buys into the culture of fear that has formed around cyberwar. This culture of fear has led insurers to require that their cyber teams hold extra capital out of concern that a major cyber conflict could devastate their balance sheets. This has to change. By refining its understanding of cyber-war risk, the insurance industry will be able to provide more insurance protection and make it more cost-effective. In the end, that would mean more insurance being provided and, as a result, greater economic security for businesses and society as a whole.

# data[].attributes.attachment_link.readable_text
Cyberwar is a scary concept. The thought of the grid going down, markets tanking, and mass riots is chilling. Popular media and entertainment accounts of cyberwar would have us believing we're living right on the edge, with a few keystrokes enough to take the world to a dark place. This alarmism has found some purchase in more sophisticated circles, which seems to lend credence to the belief that cyberwar is right around the corner, if not upon us.

But this hyperbolic characterization of cyberwar is likely a bigger problem than the threat of cyberwar itself. The problem is one of economic security.

The global insurance market has a cyberwar problem. The industry doesn't understand the associated risks well, which has caused it to seek to avoid involvement with cyberwar altogether. By excluding cyber risks, the insurance industry buys into the culture of fear that has formed around cyberwar. This culture of fear has led insurers to require that their cyber teams hold extra capital out of concern that a major cyber conflict could devastate their balance sheets. This has to change. By refining its understanding of cyber-war risk, the insurance industry will be able to provide more insurance protection and make it more cost-effective. In the end, that would mean more insurance being provided and, as a result, greater economic security for businesses and society as a whole.
Insurers' Engagement With Cyber Risk
The global insurance market seeks to play a significant role in addressing cyber risk, although the industry's engagement with cyber risk is still in its early stages. The cyber insurance sector is still small by broader insurance industry standards, with only about $13 billion in worldwide premium and roughly $400 billion in notional protection outstanding (the amount of insurance protection companies have purchased). Recent rapid growth in aggregate worldwide premium has outpaced notional limit outstanding, suggesting a disconnect between the growth of revenue to the industry and the attendant growth of cyber insurance protection available to society. Growth has come from charging more premium per dollar of protection, which is arguably reasonable after the recent " ransomware epidemic."

The specific role the industry seeks to play as relates to economic security tends to be retrospective rather than preventive. Cyber insurance accelerates the return to normal-or at least functioning-following a cyberattack. This is because the consequences of a cyberattack tend mostly to involve economic damage to the companies affected, in the form of spending necessary to reverse the damage or lost opportunity to continue operations and generate earnings. In this regard, insurance is effective, particularly given the reversibility associated with cyber risk. The damage from such an attack is most easily reversed when supported by an injection of capital to finance remediation-from crisis counsel, to information technology forensics, to consumer notification (when relevant). In fact, this post-event infusion of capital (from an insurance claim) can help an affected company return to normal as quickly as possible while minimizing the need to divert funds from other sources to deal with the consequences of the attack.

Insurers have become quite adept at handling day-to-day cyber losses, such as isolated ransomware attacks and breaches, I learned through 10 interviews I conducted with cyber insurance executives to support my ongoing doctoral research. Known as attritional losses, these are the sorts of claims insurers encounter and handle routinely, similar to slip-and-fall claims in liability classes of business and fender benders in auto.

Systemic risk, by contrast, is more concerning. Also known as "cyber catastrophe" risk, it involves cyberattacks affecting a large number of companies at the same time, resulting in a significant and reasonably simultaneous aggregation of losses. Cyber catastrophe is analogous to hurricanes, earthquakes, and other natural disasters-in which many insureds (and insurers) are hit at the same time.

The reinsurance industry helps insurers address systemic risks outside of cyber, with more than $600 billion in capital allocated for reinsurance globally. This support has been slow to gain ground in the cyber insurance sector, though. Rather than purchase cyber reinsurance designed to hedge against the risk of systemic events, as insurance companies do for property catastrophes, insurers have been more inclined to use proportional structures, through which they effectively give a share of their portfolios to reinsurers. This means that they cede both attritional and systemic risk to reinsurers.

Among the largest and most concerning systemic scenarios for both insurers and reinsurers is cyberwar. There is a persistent fear that cyberwar is virtually uninsurable and needs to be excluded. Leading reinsurer Munich Re, which is also a leader in the cyber reinsurance market, says that cyberwar "risk transfer is not possible" because "its consequences are so large and wide-reaching that private industry simply is not able to bear such a ruinous risk."
Distinguishing Between Cyber Risk and Cyberwar
Cyberwar is a subset of systemic cyber risk, within the broader category of cyber risk. Aside from war, systemic scenarios include, among others, cloud outages and attacks on centralized software vendors ( Kaseya is an example). While the prospect of cyberwar has been heightened by the war in Ukraine, which involves a cyber power, the historical scholarship sees the risk as quite remote-with empirical evidence from the Russia-Ukraine conflict supporting this view.

Thomas Rid, political scientist at Johns Hopkins, offers the classic starting point for contextual discussions regarding the risk of cyberwar, famously declaring it likely impossible as far back as 2012, as it lacked the violence required by the Clausewitzian tradition. Although some of Rid's claims have not stood the test of time, what may seem like holes in his argument are really more akin to pinpricks. For example, he says, "No cyber attack has ever damaged a building," to explain that cyber cannot cause physical damage. The production problems at Norsk Hydro resulting from LockerGoga stand in contrast, but the lack of scale suggests that Rid remains substantially correct-with the same holding true for loss of life.

The first sentence of a response to Rid's article from John Stone, political scientist at King's College, London, reads, "Cyber war will take place!" But that sentence is followed quickly by "perhaps not, but my purpose here is to demonstrate that cyber war could take place." That one word, italicized in the original text, effectively defangs the argument. Stone's potentiality and the alarmism that also characterizes the work of Joe Reeder and Tommy Hall, who make the heavily qualified claim that there are "some accounts" that "literally millions of ransomware attacks go unreported," fail to add up to the imminence of cyber-war risk. Such claims, though, support the hyperbole that has pushed its way into the public consciousness. Jon Lindsay, professor of international affairs and public policy at Georgia Tech, notes media accounts that likened Stuxnet to the "'cyber equivalent of the dropping of the atom bomb,'" a position he identifies as a colorful characterization that could only serve to increase confusion over cyber capabilities and their potential impact. And it's that sort of characterization that keeps the prospect of cyberwar top of mind, despite the fact that cyber operations have yet to play a significant role in a major armed conflict.

The natural starting point in examining a possible major role for cyber operations in armed conflict is the ongoing Russia-Ukraine conflict, given that it is recent and involves a global cyber power. The other wars fought over the past two decades or so have generally involved states without significant cyber capabilities-Afghanistan and Iraq come to mind. Throughout the conflict in Ukraine so far, cyber operations have had a limited impact. Several high-profile attempts have been attempted by both sides, yet they have not amounted to any significant strategic gains.

Cyber has played minor roles in smaller conflicts, with cyber operations in the 2008 conflict in Georgia and the 2014 invasion of Ukraine serving as relevant examples. Russia's cyber campaign during its war with Georgia consisted of attacks on "fifty-four news, government, and financial websites," as part of an overall war effort described by U.S. Army Capt. Sarah White as "remarkable for its inclusion of a series of large-scale, overt cyberspace attacks that were relatively well synchronized with conventional military operations." Yet the impact was still minimal, with "little effect on conventional forces." White also noted that the attacks were "not decisive to the outcome of the conflict" and that the average denial of service lasted two hours and 15 minutes-with the longest lasting six hours. With outage as a point of comparison, cyberattacks on the Ukrainian power grid in 2015 left over 230,000 people without power for as long as six hours. Like the 2008 denials in Georgia, the impact can only be described as underwhelming.

Although the fact that these outages came from hostile acts should not be downplayed, the consequences fail to reach thresholds routinely experienced from other causes, such as natural events. Hurricane Ida left approximately 430,000 households in Louisiana without power for more than a week. Superstorm Sandy kept much of Hoboken (including me) without power for five days and caused 8.5 million power outages spanning 21 states. The comparatively rapid restoration of power to more than 1 million people after Hurricane Ian in 2022 was still measured in days rather than hours, with a similar outcome after Hurricane Irma in 2017. War requires some amount of scale, as Rid and others have observed, and it appears the cyberattacks sometimes considered "war" fall far short of the large-scale outages we experience regularly.

The measures of the scale of cyberattacks described above should signal to reinsurers that the threat of cyberwar is relatively limited. After all, reinsurers have decades of experience with property-catastrophe risks, over which they have absorbed far more loss than cyber has generated. In fact, insured losses from natural catastrophes reached $120 billion in 2022, according to Munich Re. That's nearly 10 times the cyber insurance sector's aggregate premium this year and approximately 30 percent of all cyber insurance that is outstanding worldwide. The fears of cyberwar are generally unfounded, but they persist. While many reinsurers have sought to exclude cyber-war risk, as discussed above, efforts to do so are uncertain due to questions about the consistency and reliability of the definitions they use: Some have indicated that the definitions of terms like "war" may be ambiguous. Further, such exclusions have yet to be meaningfully tested.
Closing the Cyber Gap
There is a sense across the reinsurance industry that cyber is somehow different. Reasons given to me in both research and informal conversations have ranged from the standard "everything is interconnected" and "what happens if the internet goes down around the world, even for just a day?" to simply assuming the worst imaginable because there's no precedent at hand and basic career risk (nobody gets fired for being afraid of cyber risk). The most honest reason I heard for thinking that cyber is somehow different from other forms of risk-with clear ties to the risk of cyberwar-was simply: "My opinion comes from probably watching too many movies." Or as one of my formal research subjects put it: "There's also the perception of the great unknown ... there's only so far it can go until it turns into a war-like situation."

The problem may result from several factors, including a taste for fiction. There is a belief that the worst consequences of cyber risks are harder to envision than what society has experienced already. It's a new domain, unlike natural disasters, for example, which are presumably as old as the planet itself. It's easy to find natural disasters impacting human society from hundreds of years ago. Without a common reference point in the form of historical experience and attendant quantification, there is more room for imagination, making the unrealistic somehow more imminent. Because of this, a clear disconnect between the actual risk of cyberwar-as clearly expressed by scholars and practitioners for over a decade-and the fears that have driven the decisions made by some of the reinsurance industry's largest and most influential companies has been able to emerge. And it's this fundamental misalignment that introduces the most risk.

The focus on cyberwar exclusions not only limits coverage for cyberwar but also perpetuates the belief that cyberwar is an imminent, realistic, and potentially massive and destructive risk. This in itself casts a shadow on cyber risk in general, pushing reinsurers into the position of unspecified uncertainty.

The general fear of cyberwar, along with other unprecedented systemic cyber risks, has without a doubt given many insurers pause when thinking about writing more cyber insurance, a decision that impedes the growth of the insurance market. Constraints on growth translate directly to economic security vulnerability. Insurance is an effective economic security tool within the context of cyber risk, and limiting market penetration thus exacerbates risk. If reinsurers had a more realistic view of cyberwar, they would be able to provide significantly more reinsurance protection to their existing and prospective customers, which itself would make cyberattacks more easily reversed and thus less impactful.

There's an additional, more nuts-and-bolts problem. Unrealistic fears of cyberwar influence the capital requirements that reinsurers have with regard to cyber-war risk. With fears of the risk inflated, the expectation of how much capital reinsurers would have to hold to ensure they would meet their obligations in the event of a cyberwar increases. These high capital requirements limit the amount of cyber risk that reinsurers can assume, acting as a further constraint on their ability to write more cyber insurance-which effectively limits the overall amount of cyber insurance that can be offered. Correcting this misperception and the policies that follow from it provide a straight line toward economic security.

Fortunately, there are potential solutions, and they aren't so difficult to implement. Reinsurers need to understand the nature of the cyberwar risk. That begins with reviewing the scholarship that has analyzed the history and character of cyberwar (which has been neglected) and balancing the need for war exclusions with the potential impact of cyberwar itself. Recent history suggests that cyberwar is not the menacing systemic threat implied by all the hours invested in developing exclusions. I asked a cyberwar panel at the recent ASTIN Cyber Workshop in London how much insured loss cyberwar exclusions have likely prevented. The answer: "Likely none." I've found that the Russia-Ukraine conflict may be responsible for $200-300 million in cyber insurance exposed to war exclusions, through informal conversations and research in my prior role as head of the insurance data and analytics team at PCS, but that's a lot closer to "none" than it is to the forecasted insurance industry-wide insured loss of $26 billion.

A healthy appreciation for the likelihood and potential impact of cyberwar could help improve how insurers and reinsurers model and price this risk, particularly as part of an effort to include coverage for cyberwar rather than exclude it. The industry's actuarial capabilities are robust; they just need to be deployed to better effect with regard to cyberwar risk. Using refined assumptions with lessons from the conflict in Ukraine could help insurers and reinsurers pair their actuarial models with a narrative of the events being analyzed. If they want to hedge against a $20 billion industry-wide insured loss from cyberwar, they should be able to explain the nature of the risk and how such a loss could arise. Essentially, actuaries should be given the chance to be actuaries, rather than see the risk dismissed by timid executives long before the models are built.

Finally, reinsurers need to translate that accumulated knowledge and understanding into underwriting, pricing, and reserving (determining how much capital to hold for future losses) practices. Rather than succumb to fear, reinsurers should equip their professionals with the historical thinking, context, and data available-all of which exists, sometimes to the point of abundance. Done properly, irrational impediments to the flow of capital will fall aside, and the reinsurance market will be able to respond to the nature of the risk rather than to the popular portrayal of it. The natural consequence of this improvement in the treatment of cyberwar should meaningfully fortify global economic security. The United States has made an important bet on cyber insurance by making it a material economic component of the nation's cyber security strategy. If that bet is any guide, then it's clear that an improved flow of capital could be a powerful force in global cyber security.

# data[].attributes.attachment_link.title
Is the Fear of Cyberwar Worse Than Cyberwar Itself?

# data[].attributes.attachment_link.description
Unrealistic cyberwar expectations could hold the insurance industry back, and that's the real economic security problem.

# data[].attributes.headline
How Might AI Affect the Rise and Fall of Nations?

# data[].attributes.subject
How Might AI Affect the Rise and Fall of Nations?

# data[].attributes.body
ations across the globe could see their power rise or fall depending on how they harness and manage the development of artificial intelligence (AI). Regardless of whether AI poses an existential risk to humanity, governments will need to develop new regulatory frameworks to identify, evaluate, and respond to the variety of AI-enabled challenges to come.

With the release of advanced forms of AI to the public early in 2023, public policy debates have rightly focused on such developments as the exacerbation of inequality, the loss of jobs, and the potential threat of human extinction if AI continues to evolve without effective guardrails. There has been less discussion about how AI might affect geopolitics and which actors might take the lead in the future development of AI or other advanced AI algorithms.

# data[].attributes.attachment_link.readable_text
Nations across the globe could see their power rise or fall depending on how they harness and manage the development of artificial intelligence (AI). Regardless of whether AI poses an existential risk to humanity, governments will need to develop new regulatory frameworks to identify, evaluate, and respond to the variety of AI-enabled challenges to come.

With the release of advanced forms of AI to the public early in 2023, public policy debates have rightly focused on such developments as the exacerbation of inequality, the loss of jobs, and the potential threat of human extinction if AI continues to evolve without effective guardrails. There has been less discussion about how AI might affect geopolitics and which actors might take the lead in the future development of AI or other advanced AI algorithms.

As AI continues to advance, geopolitics may never be the same. Humans organized in nation-states will have to work with another set of actors-AI-enabled machines-of equivalent or greater intelligence and, potentially, highly disruptive capabilities. In the age of geotechnopolitics, human identity and human perceptions of our roles in the world will be distinctly different; monumental scientific discoveries will emerge in ways that humans may not be able to comprehend. Consequently, the AI development path that ultimately unfolds will matter enormously for the shape and contours of the future world.

We outline several scenarios that illustrate how AI development could unfold in the near term, depending on who is in control. We held discussions with leading technologists, policymakers, and scholars spanning many sectors to generate our findings and recommendations. We presented these experts with the scenarios as a baseline to probe, reflect on, and critique. We sought to characterize the current trajectory of AI development and identify the most important factors for governing the evolution of this unprecedented technology.

Who could control the development of AI?

U.S. Companies Lead the Way

The U.S. government continues to allow private corporations to develop AI without meaningfully regulating the technology or intervening in a way that changes those corporations' behavior. This approach fits with the long-standing belief in the United States that the free market (and its profit-driven incentives) is the most effective mechanism to rapidly advance technologies like AI. In this world, U.S. government personnel continue to lag behind engineers in the U.S. technology sector, both in their understanding of AI and in their ability to harness its power. Private corporations direct the investment of almost all research and development funding to improve AI, and the vast majority of U.S. technical talent continues to flock to Silicon Valley. The U.S. government seeks to achieve its policy goals by relying on the country's innovators to develop new inventions that it could eventually purchase. In this world, the future relationship between the U.S. government and the technology sector looks much like the present: Companies engage in aggressive data-gathering of consumers, and social media continues to be a hotbed for disinformation and dissension.

U.S. Government Takeover

AI advances are proceeding at a rapid rate, and concerns about catastrophic consequences lead the U.S. government-potentially in coordination with like-minded allies-to seize control of AI development. The United States chooses to abandon its traditional light-handed approach to regulating information technology and software development and instead embarks on large-scale regulation and oversight. This results in a monopoly by the U.S. government and select partners (e.g., the United Kingdom) over AI computing resources, data centers, advanced algorithms, and talent through nationalization and comprehensive regulation. Similar to past U.S. government initiatives, such as the Apollo Program and the Manhattan Project, AI is developed under government authority rather than under the auspices of private companies. In the defense sector, this could lead to an arms race dynamic as other governments initiate AI development programs of their own for fear that they will be left behind in an AI-driven era. Across the instruments of power, such nationalization could also shift the balance of haves versus have-nots as other countries that fail to keep up with the transition see their economies suffer because of a lack of ability to develop AI and incorporate it into their workforces.

Chinese Surprise

Akin to a Sputnik moment, three Chinese organizations-Huawei, Baidu, and the Beijing Academy of Artificial Intelligence (BAAI)-announce a major AI breakthrough, taking the world by surprise. In this world, AI progress in China is initially overlooked and consistently downplayed by policymakers from advanced, democratic economies. Chinese companies, research institutes, and key government labs leapfrog ahead of foreign competitors, in part because of their improved ability to absorb vast amounts of government funding. State-of-the-art AI models also have been steadily advancing, leveraging a competitive data advantage from the country's massive population. Finally, China's military-civil fusion enables major actors across industry, academia, and government to share resources across a common AI infrastructure. BAAI benefits from strategic partnerships with industry leaders and access to significant computational resources, such as the Pengcheng Laboratory's Pengcheng Cloudbrain-II. This combination of world-leading expertise and enormous computing power allows China to scale AI research at an unprecedented rate, leading to breakthroughs in transformative AI research that catch the world off guard. This leads to intense concerns from U.S. political and military leaders that China's newfound AI capabilities will provide it with an asymmetric military advantage over the United States.

Great Power Public-Private Consortium

Across the world, robust partnerships among government, global industry, civil society organizations, academia, and research institutions support the rapid development and deployment of AI. These partnerships form a consortium that carries out multi-stakeholder project collaborations that access large-scale computational data and training, computing, and storage resources. Through funding from many governments, the consortium develops joint solutions and benchmarking efforts to evaluate, verify, and validate the trustworthiness, reliability, and robustness of AI systems. New and existing international government bodies, including the Abu Dhabi AI Council, rely on diverse participation and contributions to set standards for responsible AI use. The result is a healthy AI sector that supports economic growth that occurs concurrently with the development and evaluation of equitable, safe, and secure AI systems.

What have we learned?

Countries and companies will clash in new ways, and AI could become an actor, not just a factor

Countries and corporations have long competed for power. Big technology companies challenge governments in many of the old ways while adding new approaches to the mix. Similar to traditional multinational corporations, such companies reach across national boundaries; however, big tech companies also influence local communities in much more comprehensive and invasive ways because they touch consumers' lives and gather data on their locations, activities, and habits. Big tech companies also affect national economies, domestic policy, and local politics in new ways because they influence the spread of information (and disinformation) and create new communities and subcultures. This has contributed to polarized populations in several countries and regime change in others. AI companies specifically enjoy access to vast investment funds and massive computing power, giving them additional advantages.

Although technology has often influenced geopolitics, the prospect of AI means that the technology itself could become a geopolitical actor. AI could have motives and objectives that differ considerably from those of governments and private companies. Humans' inability to comprehend how AI "thinks" and our limited understanding of the second- and third-order effects of our commands or requests of AI are also very troubling. Humans have enough trouble interacting with one another. It remains to be seen how we will manage our relationships with one or more AIs.

We are entering an era of both enlightenment and chaos

The borderless nature of AI makes it hard to control or regulate. As computing power expands, models are optimized, and open-source frameworks mature, the ability to create highly impactful AI applications will become increasingly diffuse. In such a world, well-intentioned researchers and engineers will use this power to do wonderful things, ill-intentioned individuals will use it to do terrible things, and AIs could do both wonderful and terrible things. The net result is neither an unblemished era of enlightenment nor an unmitigated disaster, but a mix of both. Humanity will learn to muddle through and live with this game-changing technology, just as we have with so many other transformative technologies in the past.

The United States and China will lead in different ways

Although U.S. policymakers often worry that China will take the lead in a race for AI, the consensus from the experts with whom we consulted was that China is highly unlikely to produce a major new advance in AI because of U.S. superiority in empowering private sector innovation. China is unlikely to catch up to or surpass the United States in producing AI breakthroughs, but it could lead in different arenas. China's demonstrated record of refining technological capabilities produced elsewhere and the Chinese Communist Party's preferred approach of societal use cases mean that China could see greater success integrating today's technologies into its workflows, weapons, and systems, whereas the United States could fall behind in end-to-end systems integration.

Technological innovation will continue to outpace traditional regulation

The U.S. government is already considered behind on understanding AI compared with leading private developers. This is due to several factors: the relative slowness of government policymaking compared with the fast pace of technology development, government's inability to pay competitive salaries for scarce talent, and the lack of clarity on whether and how AI should be regulated at all, among others. Looking ahead, this dynamic is unlikely to change. Governments will continue playing catch-up with the private sector to understand and respond to the newest and most-capable AI developments.

The rapid pace and diffusion of advanced AI technology will make multilateral regulation difficult. AI lacks the chokepoints of traditional models of nonproliferation, such as the global nuclear nonproliferation regime, meaning that it will be comparatively difficult for governments to control AI using traditional regulatory techniques.

What should government policymakers do to protect humanity?

The potential dangers posed by AI are many. At the extreme, they include the threat of human extinction, which could come about by an AI-enabled catastrophe, such as a well-designed virus that spreads easily, evades detection, and destroys our civilization. Less dire, but considerably worrisome, is the threat to democratic governance if AIs gain power over people. Even if AIs do not kill humans or overturn democracy, authoritarian regimes, terrorist groups, and organized crime groups could use AI to cause great harm by spreading disinformation and manipulating public opinion. Governments need to view the AI landscape as a regulatory training ground in preparation for the threats posed by even more-advanced AI capabilities, including the potential arrival of artificial general intelligence.

Governments should focus on strengthening resilience to AI threats

In addition to more-traditional regulatory practices, government policies on AI should focus on strategies of resilience to mitigate potential AI threats because strategies aimed solely at denial will not work. AI cannot be contained through regulation, so the best policy will aim to minimize the harm that AI might do. This will probably be most critical in biosecurity, but harm reduction also includes countering cybersecurity threats, strengthening democratic resilience, and developing emergency response options for a wide variety of threats from state and sub- and non-state actors. Governments will either need to adopt entirely new capabilities to put this policy into action or expand existing agencies, such as the Cybersecurity and Infrastructure Security Agency. Governments should take a more comprehensive approach to regulation beyond hardware controls, which will not be enough to mitigate harms in the long run.

Governments should look beyond traditional regulatory techniques to influence AI developments

Unlike other potentially dangerous technologies, AI lacks obvious inputs that could be regulated and controlled. Data and computing power are widely available to companies large and small, and no single entity can reliably predict from where the next revolutionary AI advance might originate. Consequently, governments should consider expanding their toolboxes beyond traditional regulatory techniques. Two creative mechanisms could be for governments to invest in establishing robust, publicly owned data sets for AI research or issue challenge grants that encourage socially beneficial uses for AI. New techniques could also include creating uniform liability rules to clarify when developers will be liable for harms involving AI, requirements for how AI should be assessed, and controls on whether certain highly capable models can be proliferated. Ultimately, governments could buy a seat at the table by providing economic incentives to companies in exchange for more influence in ensuring that AI is used for the good of all.

Governments should continue support for innovation

U.S. superiority in AI is largely the result of its superiority in innovation. To maintain this lead, the U.S. government should continue to support innovation by funding national AI resources. Although AI development at the frontier is led by private-sector companies with vast computing resources, there is a belief among experts that the next AI breakthrough could stem from smaller models with novel architectures. Academic institutions have led on many of the theoretical developments that made the existing generation of AI possible. Stimulating the academic community with modest resources could build off this legacy and result in significant AI improvements.

Governments should partner with the private sector to improve risk assessments

In light of the likely very widespread proliferation of advanced AI capabilities to private- and public-sector actors and well-resourced individuals, governments should work closely with leading private-sector entities to develop advanced forecasting tools, wargames, and strategic plans for dealing with what experts anticipate will be a wide variety of unexpected AI-enabled catastrophic events.

Notes

Funding for this work was provided by gifts from RAND supporters. This work was conducted by the Acquisition and Technology Policy Program of the RAND National Security Research Division.

This commentary is part of the RAND Corporation Expert insight series. RAND Expert Insights present perspectives on timely policy issues. All RAND Expert Insights undergo peer review to ensure high standards for quality and objectivity.

Our mission to help improve policy and decisionmaking through research and analysis is enabled through our core values of quality and objectivity and our unwavering commitment to the highest level of integrity and ethical behavior. To help ensure our research and analysis are rigorous, objective, and nonpartisan, we subject our research publications to a robust and exacting quality-assurance process; avoid both the appearance and reality of financial and other conflicts of interest through staff training, project screening, and a policy of mandatory disclosure; and pursue transparency in our research engagements through our commitment to the open publication of our research findings and recommendations, disclosure of the source of funding of published research, and policies to ensure intellectual independence. For more information, visit www.rand.org/about/research-integrity.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.

# data[].attributes.attachment_link.title
How Might AI Affect the Rise and Fall of Nations?

# data[].attributes.attachment_link.description
Public policy has not yet caught up to the rapidly expanding use of artificial intelligence (AI) by both states and private entities. The authors of this paper describe potential futures for the use and regulation of AI.

# data[].attributes.headline
Spotting AI-generated content is too hard. Look for credible sources instead.

# data[].attributes.subject
Spotting AI-generated content is too hard. Look for credible sources instead.

# data[].attributes.body
If it follows a pattern set in the last two US presidential elections, the 2024 presidential race could be decided by less than 100,000 votes cast in fewer than four states. It seems possible that fake but credible-sounding audio of a presidential candidate using a racial slur released just prior to the election, without any time for adequate media or official response, could affect turnout in exactly the counties needed to swing the election.

Deep generative models, such as those that power OpenAI’s ChatGPT and Dall-E 3, Google’s Palm, and Meta’s (open-source) LlaMa 2, are capable of extraordinary things. These models can generate audio, visual, and text-based content that is indistinguishable from content created by humans. These capabilities are exciting. The prospect of cheap, easy-to-access image, audio, and text generation promises to revolutionize the way we work, play, and socialize.

# data[].attributes.attachment_link.readable_text
If it follows a pattern set in the last two US presidential elections, the 2024 presidential race could be decided by less than 100,000 votes cast in fewer than four states. It seems possible that fake but credible-sounding audio of a presidential candidate using a racial slur released just prior to the election, without any time for adequate media or official response, could affect turnout in exactly the counties needed to swing the election.

Deep generative models, such as those that power OpenAI's ChatGPT and Dall-E 3, Google's Palm, and Meta's (open-source) LlaMa 2, are capable of extraordinary things. These models can generate audio, visual, and text-based content that is indistinguishable from content created by humans. These capabilities are exciting. The prospect of cheap, easy-to-access image, audio, and text generation promises to revolutionize the way we work, play, and socialize.

But these new capabilities are alarming, too. Despite what some companies claim, it's not currently possible to reliably detect whether a piece of text-based content was generated using a machine learning model. And the "watermarking" of model-generated audio-, image-, and video- based content is vulnerable to easy exploitation and evasion.

So, there's growing interest in enabling human beings to spot the bot-that is, to distinguish model-generated content, also known as synthetic media, from human-generated content across a variety of modalities, including images and audio. But even that is proving ineffective: As generative AI continues to improve it's becoming increasingly difficult for humans to spot model-generated content. The focus, thus, should be on educating the public on the capabilities of current AI models and on trusting only content that comes from verified sources, such as credible news organizations.

The problem with watermarking. To be as clear as possible, there are not right now and never will be in the future an automated, reliable technique for deciding whether a piece of text was written by a state-of-the-art generative model or by a human. If you reflect on the nature of text for just a moment, it should be clear why this is so. Unlike digital images and audio, there is simply nowhere to locate a watermark in text-based content, and the evidence regarding the indistinguishability of human- from model- generated text is already in: People (including those who read for a living) can't tell the difference. Anyone who claims otherwise is selling something (or attempting to avoid a specific kind of regulation).

In fact, after announcing plans for a detector of model-generated text in January, OpenAI quietly pulled it in July, writing in an update to their webpage that "the [detector] is no longer available due to its low rate of accuracy. We are working to incorporate feedback and are currently researching more effective provenance techniques for text."

The internet has been flooded with text-based misinformation and disinformation since long before widespread access to large language models. So the inability to distinguish AI-generated text from human-made text may be bad, but not truly catastrophic.

The prospects for serious harm are more worrying with audio- and image- based content than with text. Model-generated visual content isn't limited to viral pictures of ex-presidents being arrested or swagged out popes. It's possible to generate photorealistic images of soldiers participating in war crimes (leading to riots), or of corporate executives meeting with competitors for secret backroom deals (possibly altering the market), or of politicians taking bribes, or shaking hands with terrorists (thereby changing election outcomes).

On Monday, President Biden issued an executive order outlining recommendations that, among other things, included calls for watermarking content created by artificial intelligence models. For one, federal agencies will be required to provide watermarks or labels when using generative AI in their communications. This might seem like a good sign. But content authentication of this sort, within the very small ecosystem of, for example, notices from the IRS or other federal agencies, doesn't even begin to address the public's current problem. The problem that is presently being exacerbated by highly capable generative models is the creation of arbitrary quantities of inflammatory and harmful content.

This week's executive order builds on a set of voluntary agreements made in July between the Biden White House and large AI developers like OpenAI, Google and Meta, who have promised to "develop tools or APIs [application programming interfaces] to determine if a particular piece of content was created with their system."

Perhaps voluntary agreements of this kind could help-especially if they were hardened into regulation; intuitively, at least, tools for detecting model-generated content hold more promise of mitigating the relevant risks. But the promised tools are red herrings. They do not reduce the risk of being duped by model-generated image- and audio- based content. Pay very close attention to what model developers are promising: tools (or application programming interfaces) that determine whether a piece of content was generated using their system. They are promising, in effect, potentially quite cryptographically sophisticated watermarks for image- and audio- based content. But there are two problems with this approach.

The first, and most serious problem is that watermarking doesn't in fact work to reduce the risk of mistaking model- for human- generated content. Researchers have demonstrated over and over again that every single watermarking technique is vulnerable to exploitation and evasion. And in any case, all these techniques rely on watermarking the image or audio files themselves. Take a picture of an image with your phone, and the watermark is gone. Record an audio snippet of an audio file with your phone, and again the watermark is gone.

Perhaps, governments could adopt regulations that require people disseminating or using content created by generative models to clearly identify the content as such.

Tech companies have already moved toward adopting such a regime. And if backed by legislation, a system like this could in effect make watermarking an industry standard and even result in a world where the removal of watermarks is illegal. But even if it is an industry standard to include watermarks on model-generated content, and in fact illegal to remove such watermarks, if it is also impossible to discriminate between model- and human- generated content that does not carry an accompanying watermark, then such regulation is effectively toothless.

Consider the following analogy: It is illegal to use homemade currency to buy goods and services, and all homemade currency must be clearly labeled as such. But assume that it is possible to easily remove such labels, and that it is (as a result) impossible to tell whether a particular unit of currency is homemade or issued by the government. People wouldn't be expected to trust that any particular bill in circulation was issued by the government. The same goes, here, for model- and human- generated content.

The second problem with calls for watermarking involves the open-source nature of many very capable generative models. In a world where there are open-source models capable of generating content indistinguishable from human-generated content, the only thing a person can learn from a piece of content that does not have a watermark is that it was not created using a particular developer's closed-source model that does produce watermarked content. But this does not tell the person what he or she wants or needs to know: Was this piece of non-watermarked content generated by a model or by a human?

Public education as the start of a solution. What, then, should be done to reduce the flood of new risks from model-generated image- and audio- based content? Rather than promising tools that don't address the underlying problem, regulators and model developers should change tack. What is required is widespread, systematic public education. Recent research-much of it motivated by the perceived effect of misinformation on the 2016 US election-suggests that media and information literacy interventions can mitigate the effects and spread of fake news on social media. The case of distinguishing model- and human- generated content (as opposed to distinguishing fake news from genuine) presents special challenges. But lessons from that research can be adapted to the present context.

As a first step, the broad public needs to understand exactly how capable present models are. Model developers should therefore publicly, visibly, and repeatedly demonstrate to the public how their models can easily be used to generate audio and visual content that's indistinguishable from human-generated content. They should do this in controlled settings, with expert explanations of what enables the technology to work. They should also provide detailed accounts of the limits of existing detection techniques. These accounts need to acknowledge that existing techniques, such as watermarking, cannot provide assurance that a piece of content was not generated using a model. These efforts will help the public understand their own limits in distinguishing between human- and AI- generated media.

Again, education will not enable the public to "spot the bot": indistinguishable things cannot be distinguished. Instead, public education should focus on teaching people not to trust the audio, visual, and text-based content they encounter unless it is from a known, vetted, reliable source. This is a difficult skill to acquire and exercise. It requires overcoming humans' default disposition to trust the testimony of others. The rise of social media-and media fragmentation more generally-has made the challenge of knowing exactly when to trust what one hears, sees, or reads even more difficult. But the rise of generative models capable of creating synthetic media makes developing this epistemic skill essential for navigating a world where we can't spot the bot.

# data[].attributes.attachment_link.title
Spotting AI-generated content is too hard. Look for credible sources instead.

# data[].attributes.attachment_link.description
The public should be educated on the capabilities of AI models and on trusting content only from verified sources.

# data[].attributes.headline
Meta et TikTok contestent le DMA devant la justice européenne

# data[].attributes.subject
Meta et TikTok contestent le DMA devant la justice européenne

# data[].attributes.body
En attendant probablement Apple et peut-être Amazon, Meta et TikTok sont les deux premiers géants technologiques à contester le Digital Markets Act devant la justice européenne. Mercredi, la maison-mère de Facebook et la filiale du groupe chinois ByteDance ont officiellement saisi le Tribunal de l’Union européenne. La date limite était fixée au jeudi 16 novembre.

En juillet, Bruxelles a désigné six sociétés comme des “gatekeepers”, des "contrôleurs d'accès" qui devront respecter de nouvelles règles à partir de mars 2024, dans le but de renforcer la concurrence dans le numérique. En plus des quatre entreprises déjà citées, Google et Microsoft sont aussi concernés. Ces deux groupes ont déjà indiqué qu’ils ne feront pas appel.

# data[].attributes.attachment_link.readable_text
En attendant probablement Apple et peut-être Amazon, Meta et TikTok sont les deux premiers géants technologiques à contester le Digital Markets Act devant la justice européenne. Mercredi, la maison-mère de Facebook et la filiale du groupe chinois ByteDance ont officiellement saisi le Tribunal de l'Union européenne. La date limite était fixée au jeudi 16 novembre.

En juillet, Bruxelles a désigné six sociétés comme des "gatekeepers", des "contrôleurs d'accès" qui devront respecter de nouvelles règles à partir de mars 2024, dans le but de renforcer la concurrence dans le numérique. En plus des quatre entreprises déjà citées, Google et Microsoft sont aussi concernés. Ces deux groupes ont déjà indiqué qu'ils ne feront pas appel.

La désignation de "gatekeeper" est attribuée aux plateformes numériques capitalisées à plus de 75 milliards d'euros ou qui réalisent un chiffre d'affaires supérieur à 7,5 milliards d'euros en Europe. Le texte ne s'applique pas à tous leurs services, seulement à ceux qui sont dits "essentiels", car représentant une "passerelle" entre les entreprises et leurs clients. Les services qui comptent au moins 45 millions d'utilisateurs sur le continent ou 10.000 clients professionnels sont présumés remplir ce critère.

Meta veut exclure Messenger et Marketplace

Meta remet en cause l'inclusion de sa messagerie Messenger et de sa plateforme de petites annonces Marketplace. Si ces deux services dépassent le nombre d'utilisateurs fixé par Bruxelles, ils ne devraient pas être concernés par ce nouveau cadre réglementaire, estime-t-il.

L'entreprise américaine souligne que Messenger n'est en effet qu'une partie de son réseau social Facebook, même si le service n'est plus accessible que depuis sa propre application sur les smartphones. Et que Marketplace n'est utilisé que par les particuliers, ne remplissant ainsi pas le critère de "passerelle" entre des entreprises et leurs clients.

"Ce recours vise à obtenir des éclaircissements sur des points spécifiques de la loi concernant les désignations de Messenger et Marketplace en vertu du DMA", explique la société. Et d'assurer que "cela ne modifie ni ne diminue notre engagement ferme à respecter le DMA". Meta ne conteste, en revanche, pas l'inclusion de Facebook, Instagram et WhatsApp.

TikTok conteste sa désignation comme "gatekeeper"

De son côté, TikTok estime que la Commission européenne n'aurait pas dû le désigner comme "gatekeeper" car l'application de courtes vidéos ne réalise pas 7,5 milliards d'euros de chiffre d'affaires sur le continent. Bruxelles a pris en compte la valorisation de sa maison mère, qui est, souligne la société, principalement tirée par ses activités chinoises.

"Notre appel repose sur la conviction que notre désignation risque de compromettre l'objectif déclaré de la DMA en protégeant les véritables 'gatekeepers' de la concurrence de nouveaux acteurs tels que TikTok", explique la filiale de ByteDance. "Loin d'être un 'gatekeeper', notre plateforme, qui opère en Europe depuis un peu plus de cinq ans, est sans doute le challenger le mieux armé face aux entreprises plus établies sur le marché", poursuit-elle.

Sélectionné pour vous

# data[].attributes.attachment_link.title
Meta et TikTok contestent le DMA devant la justice européenne

# data[].attributes.attachment_link.description
La maison-mère de Facebook et la filiale du groupe chinois ByteDance ont officiellement saisi le Tribunal de l'Union européenne, juste...-DSA - DMA

# data[].attributes.headline
Hunderte Experten warnen vor staatlichen Root-Zertifikaten

# data[].attributes.subject
Hunderte Experten warnen vor staatlichen Root-Zertifikaten

# data[].attributes.body
Die verpflichtende Einführung staatlich kontrollierter qualifizierter Website-Zertifikate ist Experten ein Dorn im Auge. Denn sie ermöglichen staatlichen Diensten das Abhören verschlüsselter Kommunikation durch sogenannte Man-in-The-Middle Attacken. Mehr als 400 namhafte Wissenschaftler, Forscher sowie Organisationen wie der Chaos Computer Club und European Digital Rights (EDRi) fordern die Europäische Union erneut auf, kritische Punkte aus der eIDAS-Verordnung (electronic IDentification, Authentication and trust Services, elektronische Identifizierungs- und Vertrauensdienste) zu überdenken.

# data[].attributes.attachment_link.title
Hunderte Experten warnen vor staatlichen Root-Zertifikaten

# data[].attributes.attachment_link.description
Bald sollen EU-Bürger sich auf grenzüberschreitende elektronische Dienste und Vertrauensstellen verlassen müssen. Experten schlagen Alarm.

# data[].attributes.headline
Bosch, SAP and others back Europe’s answer to OpenAI with $500 million of fresh funds

# data[].attributes.subject
Bosch, SAP and others back Europe’s answer to OpenAI with $500 million of fresh funds

# data[].attributes.body
Aleph Alpha, a German startup taking on Microsoft-backed artificial intelligence firm OpenAI, said Monday it had raised $500 million in a funding round backed by the likes of Bosch, SAP and Hewlett Packard Enterprise.

The company, which has built its own large language models, raised the fresh cash in a series B round, the company’s second major funding round. It is an unusually large sum of cash for a series B investment round.

The fundraise was backed by predominantly German firms, with enterprise IT giant SAP, Schwarz Group, the owner of Lidl, and consulting firm Christ&Company Consulting investing in the company’s new round. Park Artificial Intelligence and Burda Principal Investments also invested.

Aleph Alpha did not disclose its valuation in the latest fundraise.

Aleph Alpha will use the fresh funds to invest in research on foundation models, advanced product capabilities and commercialization of its software, the company said in a statement Monday.

# data[].attributes.attachment_link.title
Bosch, SAP and others back Europe’s answer to OpenAI with $500 million of fresh funds

# data[].attributes.attachment_link.description
Aleph Alpha, which has built its own large language models, raised $500 million in a series B round backed by Bosch, SAP and Hewlett Packard Enterprise.

# data[].attributes.body
Wie die Dena am Dienstag (14. November) mitteilte, wurde ihre Serverinfrastruktur am vergangenen Wochenende von Hackern attackiert. Nach eigenen Angaben ist das Bundesunternehmen seitdem "technisch weitgehend arbeitsunfähig" und weder per Telefon noch per Mail erreichbar. Die Dena bezeichnet sich selbst als "Kompetenzzentrum für angewandte Energiewende und Klimaschutz" und beschäftigt rund 550 Mitarbeiter.

# data[].attributes.attachment_link.readable_text
Wie die Dena am Dienstag (14. November) mitteilte, wurde ihre Serverinfrastruktur am vergangenen Wochenende von Hackern attackiert. Nach eigenen Angaben ist das Bundesunternehmen seitdem "technisch weitgehend arbeitsunfähig" und weder per Telefon noch per Mail erreichbar. Die Dena bezeichnet sich selbst als "Kompetenzzentrum für angewandte Energiewende und Klimaschutz" und beschäftigt rund 550 Mitarbeiter.

Nach Bekanntwerden der Attacke seien laut Energie-Agentur sofort sämtliche IT-Sicherheitsmaßnahmen ergriffen worden, auch mit Hilfe externer IT-Forensiker. Die zuständigen Behörden wie das Bundesamt für Sicherheit in der Informationstechnik (BSI) wurden informiert.

Genauere Informationen zum Ausmaß des Angriffs gibt es bisher nicht. Auch ist unklar, wer für die Tat verantwortlich ist. Medienberichten zufolge handelt es sich um eine Ransomware-Attacke. Forderungen sind demnach aber noch nicht erhoben worden.

Es wäre nicht der erste Ransomware-Fall bei der Dena: Erst im Mai 2023 wurde deren Hosting-Dienstleister gehackt, wodurch es zu einem Ausfall des Dena-Biogasregisters kam.

# data[].attributes.attachment_link.description
Die Deutsche Energie-Agentur GmbH Dena kämpft aktuell mit technischen Problemen. Ursache dafür ist eine Cyberattacke.

# data[].attributes.headline
Next steps in preparing for post-quantum cryptography

# data[].attributes.subject
Next steps in preparing for post-quantum cryptography

# data[].attributes.body
Guidance to help organisations and CNI providers think about how to best prepare for the migration to post-quantum cryptography (PQC).

# data[].attributes.attachment_link.title
Next steps in preparing for post-quantum cryptography

# data[].attributes.attachment_link.description
Guidance to help organisations and CNI providers think about how to best prepare for the migration to post-quantum cryptography (PQC).

# data[].attributes.headline
Recent escalations remind us of the need to combat disinformation

# data[].attributes.subject
Recent escalations remind us of the need to combat disinformation

# data[].attributes.body
There is no doubt that with disinformation becoming more widespread, we are in a war against weaponised information, Oliver Rolofs writes.

Today’s information society offers a lecture on the relativity of truth.

Across the world, there are masters at work in the art of bending the facts. And where the truth no longer matters, it becomes easier to wage war.

But disinformation is not a new concern. As early as 1710, the Irish satirist Jonathan Swift wrote in The Examiner: “Falsehood flies, and the Truth comes limping after it.”

Two centuries later, Britain's legendary Prime Minister Winston Churchill noted: “A lie gets halfway around the world before the truth has a chance to get its pants on.”

The wisdom of Churchill's words was tragically demonstrated again just two weeks ago, when we witnessed Hamas and other malign actors apparently pursue this approach to instrumentalise their supporters.

Upon investigation, some of the widely shared images of the alleged Israeli rocket attack on a hospital in Gaza appear to be a tragic, yet effective example of disinformation.

# data[].attributes.attachment_link.readable_text
There is no doubt that with disinformation becoming more widespread, we are in a war against weaponised information, Oliver Rolofs writes.

ADVERTISEMENT

Today's information society offers a lecture on the relativity of truth.

Across the world, there are masters at work in the art of bending the facts. And where the truth no longer matters, it becomes easier to wage war.

But disinformation is not a new concern. As early as 1710, the Irish satirist Jonathan Swift wrote in The Examiner: "Falsehood flies, and the Truth comes limping after it."

Two centuries later, Britain's legendary Prime Minister Winston Churchill noted: "A lie gets halfway around the world before the truth has a chance to get its pants on."

The wisdom of Churchill's words was tragically demonstrated again just two weeks ago, when we witnessed Hamas and other malign actors apparently pursue this approach to instrumentalise their supporters.

Upon investigation, some of the widely shared images of the alleged Israeli rocket attack on a hospital in Gaza appear to be a tragic, yet effective example of disinformation.

Yet for many observers, clear Open Source Intelligence (OSINT) analysis counted for little, as it did not fit into their preconceived narrative.

This kind of disinformation - whether practised by extremists, state actors like China, Russia, Iran, or other fake news-producing powers, all further enabled by social media platforms, messenger services and AI-based solutions such as ChatGPT - is increasingly a threat to global peace and stability.

Truthfully portraying facts-based reality

For centuries, nation-states have promulgated laws addressing the propagation of falsehoods, and on issues such as defamation, fraud, false advertising and perjury.

However, current discussions on disinformation reflect a new and rapidly evolving communications landscape, in part due to innovative technologies that enable the dissemination of unparalleled volumes of content at unprecedented speeds.

In his 2022 report on countering disinformation, UN Secretary-General António Guterres explored the challenges of navigating this qualitatively different media landscape and ensuring it advances, rather than undermines, human rights and international peace and security.

States, but especially tech companies, have a duty to take appropriate steps to address these harmful impacts. This is not an easy task, as they need to simultaneously limit any infringement on rights, including the right to freedom of opinion and expression.

The 1978 UNESCO Media Declaration could be a useful guiding light in this, however. Even in today's technological age, it could serve as a moral compass for states, tech and media companies providing any sort of communication service.

The tasks for the media formulated in the UNESCO declaration - to contribute to the strengthening of peace and international understanding, to promote human rights and to fight racism, antisemitism, apartheid and warmongering - are more relevant than ever.

Media, journalists, as well as social media platforms and messenger services are challenged to truthfully portray reality based on facts, especially in this digital age where every person can be a publisher with unprecedented reach.

By taking this principle to heart, the antagonism of conflict and the polarisation of societies around the globe can be overcome.

The European approach, a solid blueprint

There is no doubt that we are facing greater challenges on this front than ever before.

Platforms for dialogue and cooperation are crucial. International forums, especially those that bring together the Global North and Global South, such as the Global Media Congress in Abu Dhabi or the Deutsche Welle Global Media Forum in Bonn, in addition to UN formats, can give this issue the space it needs to drive a strong approach at the global level.

ADVERTISEMENT

There is much to discuss. Combating disinformation is a complex challenge. While it is a global issue, the European approach can provide solid guidance for a multilayered approach.

It includes, via the EU Digital Services Act (DSA), new regulations on online platforms and improving EU citizens' information environment by building transparency and security safeguards and holding tech companies accountable.

The DSA is strengthened through the EU Code of Practice on Disinformation, a strong albeit voluntary set of commitments from tech and media firms.

Further Europe-led approaches include the EU vs Disinfo website and database to highlight Russia's influence campaigns against the EU, its member states, and allies.

More projects that actively engage society, like in the case of Finland, which has elevated the way citizens separate fact from fiction through effective media literacy toolkits, are also needed.

ADVERTISEMENT

Across the Atlantic, new collaborative human-technological solutions - like the Public Editor project, a collective intelligence system that labels specific reasoning mistakes in the daily news, so we can all learn to avoid biased thinking now also implemented in Europe - could usefully further efforts in the fight against disinformation.

War against weaponised information

There is no doubt that with disinformation becoming more widespread, we are in a war against weaponised information.

Communicators, politicians, media and opinion leaders need to work together across borders, and they need a whole set of instruments to combat it effectively.

Investing in quality journalism, fact-based education and regulation, and using technologies such as social listening tools are the arsenal we need to help identify and defuse emerging threats before the world is thrown into outright turmoil.
Oliver Rolofs is a strategic security and communication expert and Director of the Vienna-based Austrian Institute for Strategic Studies and International Cooperation (AISSIC). Previously the Head of Communications at the Munich Security Conference, he also runs the Munich-based strategy consultancy, CommVisory.
ADVERTISEMENT
At Euronews, we believe all views matter. Contact us at view@euronews.com to send pitches or submissions and be part of the conversation.

# data[].attributes.attachment_link.title
Recent escalations remind us of the need to combat disinformation

# data[].attributes.attachment_link.description
There is no doubt that with disinformation becoming more widespread, we are in a war against weaponised information, Oliver Rolofs writes.

# data[].attributes.headline
To solve national security problems, the US may have to rethink higher education

# data[].attributes.subject
To solve national security problems, the US may have to rethink higher education

# data[].attributes.body
Advanced STEM degrees take too much time and cost too much, said the former science and tech head at Homeland Security. The state of American higher education, particularly in the sciences, is a bit “ridiculous,” and fixing it is critical to national security, said Dr. Tara O’Toole, senior fellow and executive vice president of In-Q-Tel.

“I think graduate school in the sciences in the United States is ridiculous. It's too costly. It takes too long. It doesn't serve the needs of the students. And we need to rethink it,” O’Toole said Wednesday during a Center for the New American Security event on biotechnology and the economy. “I know, education is supposed to be the realm of the states, not the feds. But this is clearly a matter of national security and the feds are going to have to get involved.  Sooner would be better than later.”

O’Toole, who previously served as the Department of Homeland Security’s top science and technology official, said revamping the education system starts with attracting more teachers.

# data[].attributes.attachment_link.readable_text
The state of American higher education, particularly in the sciences, is a bit "ridiculous," and fixing it is critical to national security, said Dr. Tara O'Toole, senior fellow and executive vice president of In-Q-Tel.

"I think graduate school in the sciences in the United States is ridiculous. It's too costly. It takes too long. It doesn't serve the needs of the students. And we need to rethink it," O'Toole said Wednesday during a Center for the New American Security event on biotechnology and the economy. "I know, education is supposed to be the realm of the states, not the feds. But this is clearly a matter of national security and the feds are going to have to get involved. Sooner would be better than later."

O'Toole, who previously served as the Department of Homeland Security's top science and technology official, said revamping the education system starts with attracting more teachers.

"After Sputnik, we created the National Defense Education Act, which is the primary reason I made it to medical school, because it threw a lot of money at revising the high school curriculum in science, supporting [advanced placement] courses and so forth. And that attracted both teachers and students. We have to do something like that," she said.

It's an urgent need. The U.S. is lagging far behind China when it comes to mathematics, and just two-thirds of college students get their bachelor's degree in six years, she said.

"That's a terrible commentary on college, and it's even worse when you get to graduate school, and even worse if you look at the sciences, so we need to look at the whole educational system," O'Toole said.

The country needs more science-literate government leaders, she said. One way to do that is increasing the number of science-oriented fellowships and making it easier for workers to upskill in technical fields while they're in the federal government.

"These people do great jobs, but we need to create slots for them," O'Toole said. "And China also has an immense talent pipeline that we cannot lay claim to...and I think Congress is having a hard time grappling with these new technologies and what to do about them."

The comments come just a year after the White House issued an executive order on advancing biotechnology, which tasked the government with expanding education opportunities in biotechnology and biomanufacturing. But part of the problem could be that many people still don't know exactly what biotech is.

"It is food, it is health. It is materials, and as all of the things that societies are depending on. And so it shouldn't surprise us that other countries are looking to these technologies, and we really need to as well in a much more concerted way," said Megan Palmer, ​​​​​​​Ginkgo Bioworks' senior director of public impact. "Not knowing and not being able to grapple with what biotechnology is and might be has really stopped us from being able to invest."

Longer-term goals and strategies have started to take form since last year's executive order, she said, but there's still work left to do.

"Biotechnology is democracy's greatest ally," Palmer said. It "enables everyone, everywhere, to participate in and benefit from these types of innovations. And that's a vision and a reality that I believe the U.S. and ... partners and allies can uniquely advance and offer."

# data[].attributes.attachment_link.title
To solve national security problems, the US may have to rethink higher education

# data[].attributes.attachment_link.description
Advanced STEM degrees take too much time and cost too much, said the former science and tech head at Homeland Security.

# data[].attributes.body
The Pentagon's 2023 Data, Analytics and Artificial Intelligence Adoption Strategy builds upon years of DOD leadership in the development of AI and further solidifies the United States' competitive advantage in fielding the emerging technology, defense officials said.

"As we focused on integrating AI into our operations responsibly and at speed, our main reason for doing so has been straight forward: because it improves our decision advantage," Deputy Defense Secretary Kathleen Hicks said while unveiling the strategy at the Pentagon.

# data[].attributes.attachment_link.readable_text
The Defense Department today released its strategy to accelerate the adoption of advanced artificial intelligence capabilities to ensure U.S. warfighters maintain decision superiority on the battlefield for years to come.

The Pentagon's 2023 Data, Analytics and Artificial Intelligence Adoption Strategy builds upon years of DOD leadership in the development of AI and further solidifies the United States' competitive advantage in fielding the emerging technology, defense officials said.

"As we focused on integrating AI into our operations responsibly and at speed, our main reason for doing so has been straight forward: because it improves our decision advantage," Deputy Defense Secretary Kathleen Hicks said while unveiling the strategy at the Pentagon.

"From the standpoint of deterring and defending against aggression, AI-enabled systems can help accelerate the speed of commanders' decisions and improve the quality and accuracy of those decisions, which can be decisive in deterring a fight and winning in a fight," she said.

The latest blueprint, which was developed by the Chief Digital and AI Office, builds upon and supersedes the 2018 DOD AI Strategy and revised DOD Data Strategy, published in 2020, which have laid the groundwork for the department's approach to fielding AI-enabled capabilities.

The new document aims to provide a foundation from which the DOD can continue to leverage emerging AI capabilities well into the future.

"Technologies evolve. Things are going to change next week, next year, next decade. And what wins today might not win tomorrow," said DOD Chief Digital and AI Officer Craig Martell.

"Rather than identify a handful of AI-enabled warfighting capabilities that will beat our adversaries, our strategy outlines the approach to strengthening the organizational environment within which our people can continuously deploy data analytics and AI capabilities for enduring decision advantage," he said.

The strategy prescribes an agile approach to AI development and application, emphasizing speed of delivery and adoption at scale leading to five specific decision advantage outcomes:

Resilient sustainment support

The blueprint also trains the department's focus on several data, analytics and AI-related goals:

Expand digital talent management

Taken together, those goals will support the "DOD AI Hierarchy of Needs" which the strategy defines as: quality data, governance, insightful analytics and metrics, assurance and responsible AI.

In unveiling the strategy, Hicks emphasized the Pentagon's commitment to safety and responsibility while forging the AI frontier.

"We've worked tirelessly for over a decade to be a global leader in the in the fast and responsible development and use of AI technologies in the military sphere, creating policies appropriate for their specific use," Hicks said. "Safety is critical because unsafe systems are ineffective systems."

In January, the Defense Department updated its 2012 directive that governs the responsible development of autonomous weapon systems to the standards aligned with the advances in artificial intelligence.

The U.S. has also introduced a political declaration on the responsible military use of artificial intelligence, which further seeks to codify norms for the responsible use of the technology.

Hicks said the U.S. will continue to lead in the responsible and ethical use of AI, while remaining mindful of the potential dangers associated with the technology.

"By putting our values first and playing to our strengths, the greatest of which is our people, we've taken a responsible approach to AI that will ensure America continues to come out ahead," she said. "Meanwhile, as commercial tech companies and others continue to push forward the frontiers of AI, we're making sure we stay at the cutting edge with foresight, responsibility and a deep understanding of the broader implications for our nation."

# data[].attributes.attachment_link.description
DOD released its strategy to accelerate the adoption of advanced artificial intelligence capabilities to ensure U.S. warfighters maintain decision superiority on the battlefield for years to come.

# data[].attributes.headline
LockBit hackt weltgrösstes Kreditinstitut – Daten nur noch per USB-Stick übermittelbar

# data[].attributes.subject
LockBit hackt weltgrösstes Kreditinstitut – Daten nur noch per USB-Stick übermittelbar

# data[].attributes.body
Ein US-Tochterunternehmen der grössten chinesischen Bank ICBC ist Opfer eines Hackerangriffs geworden. Wie die in New York ansässige ICBC Financial Services am Donnerstagabend (Ortszeit) auf ihrer Website mitteilte, kämpft sie seit Mittwoch mit den Folgen eine Ransomware-Attacke. Diese Attacke führte zu einer Unterbrechung wichtiger Systeme. Gemäss mehreren Berichten steckt die russische Ransomware-Bande LockBit hinter dem Angriff – das ist die seit Jahren aktivste kriminelle Vereinigung in diesem Bereich.

# data[].attributes.attachment_link.readable_text
LockBit hackt weltgrösstes Kreditinstitut - Daten nur noch per USB-Stick übermittelbar

Die russischsprachige Ransomware-Bande LockBit hat erneut in den USA zugeschlagen. Die ICBC-Cyberattacke erschüttert die Finanzwelt.

Ein US-Tochterunternehmen der grössten chinesischen Bank ICBC ist Opfer eines Hackerangriffs geworden. Wie die in New York ansässige ICBC Financial Services am Donnerstagabend (Ortszeit) auf ihrer Website mitteilte, kämpft sie seit Mittwoch mit den Folgen eine Ransomware-Attacke. Diese Attacke führte zu einer Unterbrechung wichtiger Systeme.

Gemäss mehreren Berichten steckt die russische Ransomware-Bande LockBit hinter dem Angriff - das ist die seit Jahren aktivste kriminelle Vereinigung in diesem Bereich.

Grösstes Kreditinstitut der Welt

Der am Donnerstag bekannt gewordene Einbruch bei dem gemessen an der Bilanzsumme grössten Kreditinstitut der Welt verhinderte die Abwicklung einiger Finanzmarktgeschäfte und zwang Makler und Händler, ihre Transaktionen umzuleiten. Wie bei X (Twitter) berichtet wird, mussten wichtige Daten von Kurieren per USB-Stick transportiert werden.

"Das ist ein echter Schock", zitiert Bloomberg den Gründer der schwedischen Cybersicherheitsfirma Truesec, Marcus Murray. Es handle sich um die Art von öffentlichkeitswirksamem Angriff, der grosse Banken auf der ganzen Welt dazu bringe, ihre Abwehrmassnahmen zu verbessern.

ICBC Financial Services habe den Vorfall durch Trennung und Isolierung der betroffenen Systeme eingedämmt, hiess es weiter. Die Systeme liefen unabhängig von denen der ICBC in China.

Markt für US-Staatsanleihen betroffen

Wie die "Financial Times" unter Berufung auf Marktteilnehmer berichtete, habe der Angriff dazu geführt, dass Transaktionen für andere Marktteilnehmer nicht ausgeführt werden konnten. Der Angriff habe demnach auch die Liquidität des Marktes für US-Staatsanleihen bis zu einem gewissen Grad beeinträchtigt, nicht aber die Funktionsfähigkeit des Marktes insgesamt.

Im Januar 2023 hackte LockBit die britische Royal Mail und stoppte den internationalen Postverkehr, ruft Bloomberg in Erinnerung. Keinen Monat später traf es ein britisches Fintech-Unternehmen und den weltweiten Derivatehandel. Aber auch Japans grösster Hafen wurde schon lahmgelegt und auch der Flugzeughersteller Boeing Co. war betroffen. Zuletzt hat es das japanische Unternehmen Shimano erwischt.

Unter Ransomware versteht man Schadprogramme, die den Zugang zu Daten und Systemen einschränken oder komplett blockieren. Für die Freigabe wird in der Regel ein Lösegeld verlangt. Einige der gefährlichsten Ransomware-Banden sind dazu übergegangen, möglichst viele wertvolle Daten zu stehlen, um ihre Opfer anschliessend zu erpressen, indem sie mit dem Leaken der Daten im Darknet drohen.

(dsc/sda/dpa)

# data[].attributes.attachment_link.title
LockBit hackt weltgrösstes Kreditinstitut - Daten nur noch per USB-Stick übermittelbar

# data[].attributes.attachment_link.description
Die russischsprachige Ransomware-Bande LockBit hat erneut in den USA zugeschlagen. Die ICBC-Cyberattacke erschüttert die Finanzwelt.

# data[].attributes.headline
U.S.-China Competition and the Race to 6G

# data[].attributes.subject
U.S.-China Competition and the Race to 6G

# data[].attributes.body
The country that leads the development and deployment of 6G—the next generation of wireless telecommunications—will control critical infrastructure that is integral to global economic competitiveness, national security, and the functioning of society. 6G is thus a key battleground of U.S.-China technology competition. Though 6G is not expected to be commercially available until 2030, China’s dominance of fifth-generation networks highlights the importance of planning and early market entry. The United States must act now to establish 6G leadership and ensure the development of secure and resilient networks.

# data[].attributes.attachment_link.readable_text
Image Credit

November 14, 2023

This article was originally published in Italian by Formiche, this English version was provided by the author.

The country that leads the development and deployment of 6G-the next generation of wireless telecommunications-will control critical infrastructure that is integral to global economic competitiveness, national security, and the functioning of society. 6G is thus a key battleground of U.S.-China technology competition. Though 6G is not expected to be commercially available until 2030, China's dominance of fifth-generation networks highlights the importance of planning and early market entry. The United States must act now to establish 6G leadership and ensure the development of secure and resilient networks.

6G aims to unlock faster, more reliable, and more sustainable communications capabilities. 6G promises to connect significantly more devices to the internet at higher speeds and with lower latency than 5G networks. These advances will allow for dependable communications networks that can connect devices simultaneously and support a range of novel technologies, such as virtual and augmented reality, robotics, and autonomous vehicles.

While 5G focused on advancing the Internet of Things, 6G will enable a more digitally immersive world that can even mirror reality. For example, 6G will enable near-real time human-to-human, human-to-machine, and machine-to-machine communications, opening a range of new capabilities, products, and services across multiple industries, from agriculture and healthcare to transportation and defense. 6G will enable economic and technological competitiveness in the 21 st century, and the first country to operationalize it will gain an upper hand in establishing a favorable market position and setting standards for the design and use of 6G devices. As with 5G, China has jumped to an early lead in the 6G race.

China views telecommunications as central to its geopolitical and strategic objectives. Multiple strategy documents-such as the 14th Five-Year Plan for National Informatization-rank 6G among the government's top priorities. China aims to dominate the development and rollout of 6G infrastructure, just as it did in 5G, where Chinese firms maintain 70 percent of the world's base stations and 80 percent of 5G connected devices.

China's approach to 6G mirrors its approach to 5G. The Chinese government is leveraging subsidies, credit facilities, tax breaks, and related forms of state support to boost domestic equipment manufacturing capacity and position Chinese firms to gain an early 6G market advantage. China is also investing heavily in the enabling technologies that form the backbone of 6G infrastructure, such as legacy chips and artificial intelligence, to reduce dependencies on foreign suppliers and secure a competitive edge across the entire 6G supply chain. Simultaneously, China is increasing its participation in international fora to gain influence over standard-setting processes and make Chinese telecommunications companies the preferred 6G providers around the world.

China views telecommunications as central to its geopolitical and strategic objectives.

A China-led 6G ecosystem poses several challenges for the United States. U.S. 6G vendors may struggle to compete internationally with state-backed Chinese firms that can offer lower prices, invest in high-risk projects, and have more experience operating in remote areas. Further, countries that integrate Chinese 6G technologies into their networks could be vulnerable to espionage, intellectual property theft, or censorship. Widespread global adoption of Chinese technologies could force the United States to rethink its alliance networks and information-sharing mechanisms.

China's 6G ambitions carry implications for U.S. national security and defense as well. Beyond reaping the economic benefits of 6G, China also aims to lead in military applications of the technology. In January 2022, Chinese researchers reportedly developed a 6G laser device that can detect stealth aircraft, enhance high-speed space communications, and bolster China's hypersonic missile program. China could also leverage 6G to improve its surveillance and reconnaissance capabilities, augment military personnel training, or streamline command and control processes. In short, China could employ its 6G capabilities to gain a significant military advantage should conflict with the United States occur.

The United States cannot afford to cede the lead in 6G. To boost American competitiveness in this critical technology area, U.S. policymakers should craft a comprehensive 6G strategy, expand 6G-focused research and development funding, foster mutually beneficial relationships with private industry, and partner with allies to develop best practices and principles for 6G security and implementation. China is moving fast to recreate the conditions that enabled its 5G dominance. The onus is on U.S. policymakers to absorb lessons learned from the 5G race and drive a new approach to 6G that optimizes performance, accessibility, and security.

Read the full article and more from Formiche.

# data[].attributes.attachment_link.title
U.S.-China Competition and the Race to 6G

# data[].attributes.attachment_link.description
China views telecommunications as central to its geopolitical and strategic objectives.

# data[].attributes.headline
Charting China’s Climb as a Leading Global Cyber Power

# data[].attributes.subject
Charting China’s Climb as a Leading Global Cyber Power

# data[].attributes.body
Over the past five years, Chinese state-sponsored cyber operations have evolved into a more mature and coordinated threat, focusing on exploiting both known and zero-day vulnerabilities in public-facing security and network appliances. They have also placed a strong emphasis on operational security and anonymity, making it harder to detect their activities. These changes have been influenced by both internal factors like military restructuring and changes in domestic regulations, as well as external factors including reporting by Western governments and the cybersecurity community. This evolution has made it more challenging for organizations, governments, and the cybersecurity community to defend against these threats.

# data[].attributes.attachment_link.readable_text
Over the past five years, Chinese state-sponsored cyber operations have evolved into a more mature and coordinated threat, focusing on exploiting both known and zero-day vulnerabilities in public-facing security and network appliances. They have also placed a strong emphasis on operational security and anonymity, making it harder to detect their activities. These changes have been influenced by both internal factors like military restructuring and changes in domestic regulations, as well as external factors including reporting by Western governments and the cybersecurity community. This evolution has made it more challenging for organizations, governments, and the cybersecurity community to defend against these threats.

Evolution of Chinese cyber-espionage activity (Source: Recorded Future)

Chinese cyber-enabled economic espionage has shifted from broad intellectual property theft to a more targeted approach supporting specific strategic, economic, and geopolitical goals, such as those related to the Belt and Road Initiative and critical technologies. This poses risks for governments and corporations, impacting negotiations and competitiveness. Due to the focus on exploiting novel vulnerabilities in public-facing devices, a vulnerability-centric defense approach is inadequate, emphasizing the need for better defensive in-depth measures to detect post-exploitation activities.

As China continues to develop its cyber capabilities, there has been a growing focus on exploiting zero-day vulnerabilities in public-facing appliances, which has proven an effective tactic for gaining access to various global targets. With organizations moving to cloud services it is likely they will see a similar emphasis. China's efforts to project power in the South China Sea and Taiwan, along with the U.S. strengthening alliances in the region, will likely lead to increased intelligence gathering and strategic reconnaissance activities. Targeting critical infrastructure is not necessarily a sign of imminent conflict but is done in preparation for potential future actions.

Given China's significant commitment of resources to offensive cyber operations and the evident enhancement of their capabilities, they are poised to become a dominant global force in cyber espionage and information warfare.

To read the entire analysis, click here to download the report as a PDF.

# data[].attributes.attachment_link.title
Charting China's Climb as a Leading | Recorded Future Global Cyber Power

# data[].attributes.attachment_link.description
Chinese state-sponsored cyber operations have transformed, emerging as a more mature, stealthy, and coordinated threat than in previous years.

# data[].attributes.headline
CISA’s Goldstein: Ukrainian response to Viasat hack proves need for redundancy, resilience

# data[].attributes.subject
CISA’s Goldstein: Ukrainian response to Viasat hack proves need for redundancy, resilience

# data[].attributes.body
The Ukrainian military’s ability to recover from the Russian attack on satellite company Viasat is an example of the need for redundant systems and resilient organizations, according to a top U.S. government cybersecurity official.

At the Aspen Cyber Summit in New York on Wednesday, Cybersecurity and Infrastructure Security Agency (CISA) executive director of cybersecurity Eric Goldstein and retired U.S. Air Force general Jack Weinstein spoke about the growing need for awareness about the cybersecurity threats facing space technology.

“Space is a horizontal dependency across every other critical sector. There is no sector that does not depend on space assets,” Goldstein said.

As an example of the importance of space technology, the conversation shifted to the Russian military’s attack on satellite internet provider Viasat.

# data[].attributes.attachment_link.readable_text
The Ukrainian military's ability to recover from the Russian attack on satellite company Viasat is an example of the need for redundant systems and resilient organizations, according to a top U.S. government cybersecurity official.

At the Aspen Cyber Summit in New York on Wednesday, Cybersecurity and Infrastructure Security Agency (CISA) executive director of cybersecurity Eric Goldstein and retired U.S. Air Force general Jack Weinstein spoke about the growing need for awareness about the cybersecurity threats facing space technology.

"Space is a horizontal dependency across every other critical sector. There is no sector that does not depend on space assets," Goldstein said.

As an example of the importance of space technology, the conversation shifted to the Russian military's attack on satellite internet provider Viasat.

The cyberattack last February left Viasat's KA-SAT modems inoperable in Ukraine. The attack had several other downstream effects, causing the malfunction of 5,800 Enercon wind turbines in Germany and disruptions to thousands of organizations across Europe.

According to U.S. and European Union officials, the attack on Viasat was intended to degrade the ability of the Ukrainian government and military to communicate.

But Goldstein explained that the results of the attack, while devastating for some of Viasat's customers, did not have a long-lasting effect on the Ukrainian military's ability to operate.

"What we saw in practice is even though the attack on Viasat was very impactful for Viasat, very impactful for a variety of customers across Europe, it actually wasn't that impactful for the Ukrainian military because they have built in resilient communications to make sure that they were able to quickly alter measures and keep fighting," he said.

"And that, I think, is really the key point here. We know that we're not going to cyber defend our way out of this and have to build resilience."

Weinstein added that this kind of resilience is something the U.S. Space Force is now working on.

Later in the conversation Goldstein warned that attacks on space infrastructure are now moving beyond nation states and into the criminal realm. One of his concerns is that while it is fairly easy to sketch out the goals of nation states, criminal organizations are more difficult to understand.

One way to address this is to have a better understanding of what assets are in space, Weinstein said, noting that an organization like the Federal Aviation Administration (FAA) is needed to catalog what satellites are in the sky.

"While the military is doing this, it's really not a military responsibility," he said.

In August, U.S. intelligence agencies warned of increasing cyberattacks targeting U.S.-based space companies by unnamed foreign intelligence services.

The influential Cyberspace Solarium Commission told The White House in April that it should formally name space as a critical infrastructure sector and take steps to protect satellites and other space systems against cyberattacks.

For years, vulnerabilities in space infrastructure have been a point of interest for cybersecurity researchers. In April, hackers proved they could seize control of a European Space Agency (ESA) satellite, and at the recent DefCon conference in Las Vegas an entire "space village" was created where researchers discussed satellite vulnerabilities and shared tips or concerns about the sector.

There have been several recent claims of cyberattacks and ransomware incidents targeting the space industry, including a March ransomware attack on SpaceX-supplier Maximum Industries that was never publicly acknowledged.

Hackers have also gone after multiple space observatories in the U.S. and in Chile in recent months, targeting researchers using powerful telescopes.

Get more insights with the

# data[].attributes.attachment_link.title
CISA's Goldstein: Ukrainian response to Viasat hack proves need for redundancy, resilience

# data[].attributes.attachment_link.description
The Ukrainian military's ability to recover from the Russian attack on satellite company Viasat is an example of the need for redundant systems and resilient organizations, according to a top U.S. government cybersecurity official.

# data[].attributes.headline
Sandworm Hackers Caused Another Blackout in Ukraine-During a Missile Strike

# data[].attributes.subject
Sandworm Hackers Caused Another Blackout in Ukraine-During a Missile Strike

# data[].attributes.body
The notorious unit of Russia's GRU military intelligence agency known as Sandworm remains the only team of hackers to have ever triggered blackouts with their cyberattacks, turning off the lights for hundreds of thousands of Ukrainian civilians not once, but twice within the past decade. Now it appears that in the midst of Russia's full-scale war in Ukraine, the group has achieved another dubious distinction in the history of cyberwar: It targeted civilians with a blackout attack at the same time missile strikes hit their city, an unprecedented and brutal combination of digital and physical warfare.

# data[].attributes.attachment_link.readable_text
The notorious unit of Russia's GRU military intelligence agency known as Sandworm remains the only team of hackers to have ever triggered blackouts with their cyberattacks, turning off the lights for hundreds of thousands of Ukrainian civilians not once, but twice within the past decade. Now it appears that in the midst of Russia's full-scale war in Ukraine, the group has achieved another dubious distinction in the history of cyberwar: It targeted civilians with a blackout attack at the same time missile strikes hit their city, an unprecedented and brutal combination of digital and physical warfare.

Cybersecurity firm Mandiant today revealed that Sandworm, a cybersecurity industry name for Unit 74455 of Russia's GRU spy agency, carried out a third successful power grid attack targeting a Ukrainian electric utility in October of last year, causing a blackout for an unknown number of Ukrainian civilians. In this case, unlike any previous hacker-induced blackouts, Mandiant says the cyberattack coincided with the start of a series of missile strikes targeting Ukrainian critical infrastructure across the country, which included victims in the same city as the utility where Sandworm triggered its power outage. Two days after the blackout, the hackers also used a piece of data-destroying "wiper" malware to erase the contents of computers across the utility's network, perhaps in an attempt to destroy evidence that could be used to analyze their intrusion.

Mandiant, which has worked closely with the Ukrainian government on digital defense and investigations of network breaches since the start of the Russian invasion in February of 2022, declined to name the targeted electric utility or the city where it was located. Nor would it offer information like the length of the resulting power loss or the number of civilians affected.

Mandiant does note in its report on the incident that as early as two weeks before the blackout, Sandworm's hackers appear to have already possessed all the access and capabilities necessary to hijack the industrial control system software that oversees the flow of power at the utility's electrical substations. Yet it appears to have waited to carry out the cyberattack until the day of Russia's missile strikes. While that timing may be coincidental, it more likely suggests coordinated cyber and physical attacks, perhaps designed to sow chaos ahead of those air strikes, complicate any defense against them, or add to their psychological effect on civilians.

"The cyber incident exacerbates the impact of the physical attack," says John Hultquist, Mandiant's head of threat intelligence, who has tracked Sandworm for nearly a decade and named the group in 2014. "Without seeing their actual orders, it's really hard on our side to make a determination of whether or not that was on purpose. I will say that this was carried out by a military actor and coincided with another military attack. If it was a coincidence, it was a terribly interesting coincidence."

Nimbler, Stealthier Cybersaboteurs

The Ukrainian government's cybersecurity agency, SSSCIP, declined to fully confirm Mandiant's findings in response to a request from WIRED, but it didn't dispute them. SSSCIP's deputy chair, Viktor Zhora, wrote in a statement that the agency responded to the breach last year, working with the victim to "minimize and localize the impact." In an investigation over the two days following the near-simultaneous blackout and missile strikes, he says, the agency confirmed that the hackers had found a "bridge" from the utility's IT network to its industrial control systems and planted malware there capable of manipulating the grid.

Mandiant's more detailed breakdown of the intrusion shows how the GRU's grid hacking has evolved over time to become far more stealthy and nimble. In this latest blackout attack, the group used a "living off the land" approach that has become more common among state-sponsored hackers seeking to avoid detection. Instead of deploying their own custom malware, they exploited the legitimate tools already present on the network to spread from machine to machine before finally running an automated script that used their access to the facility's industrial control system software, known as MicroSCADA, to cause the blackout.

In Sandworm's 2016 blackout that hit a transmission station north of the capital of Kyiv, by contrast, the hackers used a custom-built piece of malware known as Crash Override or Industroyer, capable of automatically sending commands over several protocols to open circuit-breakers. In another Sandworm power grid attack in 2022, which the Ukrainian government has described as a failed attempt to trigger a blackout, the group used a newer version of that malware known as Industroyer2.

# data[].attributes.attachment_link.title
Sandworm Hackers Caused Another Blackout in Ukraine-During a Missile Strike

# data[].attributes.attachment_link.description
Russia's most notorious military hackers successfully sabotaged Ukraine's power grid for the third time last year. And in this case, the blackout coincided with a physical attack.

# data[].attributes.headline
NSA’s Joyce: Israel faces ‘enormous amount of cyber pressure’ from Iran, hacktivists

# data[].attributes.subject
NSA’s Joyce: Israel faces ‘enormous amount of cyber pressure’ from Iran, hacktivists

# data[].attributes.body
Israel is experiencing direct cyber and misinformation attacks from a variety of adversaries as it battles Hamas, according to a senior National Security Agency official.

“There actually is an enormous amount of cyber pressure” on Israel today, said Rob Joyce, the head of the spy agency’s cybersecurity directorate, during a lunch panel Wednesday at the Aspen Cyber Summit moderated by Recorded Future News' Dina Temple-Raston. “Now, the good news is, most of it is either nuisance attacks or not significantly impactful. So you've got some wiper viruses. There's been some ransomware events.”

In some of the most extensive remarks on the cyber aspect of the conflict by a senior U.S. official since it began, Joyce said there are three groups that Israel “is worried about right now.”

The first is the Iranian government. Tehran has been Hamas’ longtime benefactor and U.S. national security leaders have sounded the alarm that Iran could bring its own formidable digital might to the conflict.

“The cyber targeting of American interests and critical infrastructure that we already see conducted by Iran and non-state actors alike we can expect to get worse if the conflict expands, as will the threat of kinetic attacks,” FBI Director Christopher Wray recently testified.

The second main threat comes from hacktivists, according to Joyce, who warned it can be difficult to tell if the groups are independent or backed by actual nation states.

Lastly, ransomware criminals have also sought to take advantage of the conflict, he noted.

# data[].attributes.attachment_link.readable_text
Israel is experiencing direct cyber and misinformation attacks from a variety of adversaries as it battles Hamas, according to a senior National Security Agency official.

"There actually is an enormous amount of cyber pressure" on Israel today, said Rob Joyce, the head of the spy agency's cybersecurity directorate, during a lunch panel Wednesday at the Aspen Cyber Summit moderated by Recorded Future News' Dina Temple-Raston. "Now, the good news is, most of it is either nuisance attacks or not significantly impactful. So you've got some wiper viruses. There's been some ransomware events."

In some of the most extensive remarks on the cyber aspect of the conflict by a senior U.S. official since it began, Joyce said there are three groups that Israel "is worried about right now."

The first is the Iranian government. Tehran has been Hamas' longtime benefactor and U.S. national security leaders have sounded the alarm that Iran could bring its own formidable digital might to the conflict.

"The cyber targeting of American interests and critical infrastructure that we already see conducted by Iran and non-state actors alike we can expect to get worse if the conflict expands, as will the threat of kinetic attacks," FBI Director Christopher Wray recently testified.

The second main threat comes from hacktivists, according to Joyce, who warned it can be difficult to tell if the groups are independent or backed by actual nation states.

Lastly, ransomware criminals have also sought to take advantage of the conflict, he noted.

At #AspenCyber: @NPRDina moderates a luncheon panel exploring the critical relationship between intelligence and law enforcement with Rob Joyce, Director of Cybersecurity, @NSAGov, Megan Stifel, Chief Strategy Officer, Institute for Security and Technology and Amit Kachhia-Patel,... pic.twitter.com/enV2TeKDUh
- The Record From Recorded Future News (@TheRecord_Media) November 15, 2023

The ongoing battle has forced Israel "to get much better at their cyberdefenses," Joyce told the audience. "They have created structures and processes, and done a lot of work" to better protect their critical infrastructure from adversaries.

Of the three, most malicious activity has come from Iran and hacktivists. Joyce declined to say if Russia has also become a digital player in the conflict.

However, misinformation has "probably" had the most impact in the struggle, he added, highlighting an instance where an app used by Israelis to warn of incoming missile strikes went "completely red" with warnings that turned out to be false.

Joyce declined to say who was responsible for the incident.

Get more insights with the

# data[].attributes.attachment_link.title
NSA's Joyce: Israel faces 'enormous amount of cyber pressure' from Iran, hacktivists

# data[].attributes.attachment_link.description
Israel is experiencing direct cyber and misinformation attacks from a variety of adversaries as it battles Hamas, according to NSA's Rob Joyce.

# data[].attributes.headline
Generative AI Is Playing a Surprising Role in Israel-Hamas Disinformation

# data[].attributes.subject
Generative AI Is Playing a Surprising Role in Israel-Hamas Disinformation

# data[].attributes.body
In the weeks since Hamas launched its October 7 surprise attack on Israel, the ensuing conflict has generated an unprecedented wave of disinformation, an “algorithmically driven fog of war” that has tripped up major new organizations and left social media companies floundering.

# data[].attributes.attachment_link.readable_text
Even as some feared the war would be the first in history to be flooded with machine-made fake images, that hasn't happened. The technology's impact on the conflict is far more subtle.

In the weeks since Hamas launched its October 7 surprise attack on Israel, the ensuing conflict has generated an unprecedented wave of disinformation, an " algorithmically driven fog of war" that has tripped up major new organizations and left social media companies floundering.

Yet, amid all of the deceptive images and video moving around on social media, the content generated by artificial intelligence tools has remained relatively peripheral. Even as some wondered if the Israel-Hamas war would be the first conflict dominated by false generative AI images, the technology has had a more complex and subtle impact.

"There are definitely AI images circulating but not to the degree where I think it's playing a central role in the spread of information," says Layla Mashkoor, an associate editor at the Atlantic Council's Digital Forensic Research Lab, which studies online disinformation.

Primarily, Mashkoor says, AI-generated disinformation is being used by activists to solicit support-or give the impression of wider support-for a particular side. Examples include an AI-generated billboard in Tel Aviv championing Israel Defense Forces, an Israeli account sharing fake images of people cheering for the IDF, an Israeli influencer using AI to generate condemnations of Hamas, and AI images portraying victims of Israel's bombardment of Gaza.

"In terms of general use that I've been seeing online, it's mostly been to drum up support, which is not among the most malicious ways to utilize AI right now," she says.

A key factor here is the sheer amount of misinformation circulating, which makes it difficult for AI images to shape conversation. "The information space is already being flooded with real and authentic images and footage," says Mashkoor, "and that in itself is flooding the social media platforms."

This point is reflected in a recent paper from the Harvard Kennedy School Misinformation Review about the role generative AI might play in the spread of false info worldwide. In it, the authors write that concerns about the effects of the technology are "overblown." While, yes, gen AI theoretically lets people proliferate misinformation at a futuristic rate, those who seek out this misinformation-often those who have "low trust in institutions ... [or are] strong partisans"-already have a surfeit of familiar nonsense to pursue, from conspiracy theory websites to 4chan forums. There is no demand for more.

"Given the creativity humans have showcased throughout history to make up (false) stories and the freedom that humans already have to create and spread misinformation across the world, it is unlikely that a large part of the population is looking for misinformation they cannot find online or offline," the paper concludes. Moreover, misinformation only gains power when people see it, and considering the time people have for viral content is finite, the impact is negligible.

As for the images that might find their way into mainstream feeds, the authors note that while generative AI can theoretically render highly personalized, highly realistic content, so can Photoshop or video editing software. Changing the date on a grainy cell phone video could prove just as effective. Journalists and fact checkers struggle less with deepfakes than they do with out-of-context images or those crudely manipulated into something they're not, like video game footage presented as a Hamas attack.

In that sense, excessive focus on a flashy new tech is often a red herring. "Being realistic is not always what people look for or what is needed to be viral on the internet," adds Sacha Altay, a coauthor on the paper and a postdoctoral research fellow whose current field involves misinformation, trust, and social media at the University of Zurich's Digital Democracy Lab.

That's also true on the supply side, explains Mashkoor; invention is not implementation. "There's a lot of ways to manipulate the conversation or manipulate the online information space," she says. "And there are things that are sometimes a lower lift or easier to do that might not require access to a specific technology, even though AI-generating software is easy to access at the moment, there are definitely easier ways to manipulate something if you're looking for it."

Felix Simon, another one of the authors on the Kennedy School paper and a doctoral student at the Oxford Internet Institute, cautions that his team's commentary is not seeking to end the debate over possible harms, but is instead an attempt to push back on claims gen AI will trigger "a truth armageddon." These kinds of panics often accompany new technologies.

Setting aside the apocalyptic view, it's easier to study how generative AI has actually slotted into the existing disinformation ecosystem. It is, for example, far more prevalent than it was at the outset of the Russian invasion of Ukraine, argues Hany Farid, a professor at the UC Berkeley School of Information.

Farid characterizes the technology as a "specter" hanging over audio and video that purports to come from the conflict, and that he receives half a dozen to a dozen calls daily from reporters enquiring about veracity. "For a lot of people, the ability to dismiss inconvenient facts is absolutely playing a role in this conflict," he says.

Farid cites multiple examples that immediately drew this kind of dismissal, including people pointing to various pieces of digital evidence about who was behind the missile strike on the Al-Ahli Arab Hospital in Gaza, as well as images of children buried under rubble, some real, some fake.

Some of the most prominent examples of this are the photos of burned children Israeli prime minister Benjamin Netanyahu posted on his X account. After they were published, someone fed the images into the detection tool AI or Not, which the users said determined that they were AI. Farid says his team analyzed the photos and concluded AI wasn't used, but the seed of suspicion had already been planted. Things were further confused when someone used AI to replace the child in one of the images with a puppy.

"And then that went online, and then people are like, 'Well, wait a minute, if he could have made that one, then that one could be fake, and now these two versions are going around, and everybody started saying, 'Oh, the puppy was the original, this is the fake,' and then you just muddy the water," Farid says.

In other words, this distribution follows a historic pattern: Misinformation gets shared on social media, then amplified via algorithms and humans. "In the broader picture, in our ability to reason about a fast-moving highly impactful world, I think this conflict is worse than what we've seen in the past," says Farid. "And I think gen AI is part of that, but it is not exclusively gen AI. That's too simplistic."

# data[].attributes.attachment_link.title
Generative AI Is Playing a Surprising Role in Israel-Hamas Disinformation

# data[].attributes.attachment_link.description
Even as some feared the war would be the first in history to be flooded with machine-made fake images, that hasn't happened. The technology's impact on the conflict is far more subtle.

# data[].attributes.headline
Truth or Fake - Images of war in Ukraine used to falsely illustrate Israeli ground offensive in Gaza

# data[].attributes.subject
Truth or Fake - Images of war in Ukraine used to falsely illustrate Israeli ground offensive in Gaza

# data[].attributes.body
Since the second phase of the war between Israel and Hamas began over the weekend, some social media users have been sharing images purporting to show Israel's ground offensive in Gaza. But these are actually images of the war in Ukraine. We tell you more in this edition of Truth or Fake.

# data[].attributes.attachment_link.readable_text
Since the second phase of the war between Israel and Hamas began over the weekend, some social media users have been sharing images purporting to show Israel's ground offensive in Gaza. But these are actually images of the war in Ukraine. We tell you more in this edition of Truth or Fake.

# data[].attributes.attachment_link.title
Truth or Fake - Images of war in Ukraine used to falsely illustrate Israeli ground offensive in Gaza

# data[].attributes.attachment_link.description
Since the second phase of the war between Israel and Hamas began over the weekend, some social media users have been sharing images purporting to show Israel's ground offensive in Gaza. But these are...

# data[].attributes.headline
ISRAEL GAZA CONFLICT : THE CYBER PERSPECTIVE 

# data[].attributes.subject
ISRAEL GAZA CONFLICT : THE CYBER PERSPECTIVE 

# data[].attributes.body
Various hacktivist groups have targeted critical infrastructure, government agencies, and organizations in both Israel and Palestine. The attacks include Distributed Denial of Service (DDoS) attacks, defacement attacks and data breaches. As other countries take a stand on the war, the conflict has also spread beyond the immediate region, affecting several other countries. This report provides a concise overview of the escalating cyber conflict in the Middle East, stemming from recent geopolitical events. Notably, we engaged directly with threat actors from hacktivist groups to gain a deeper understanding of their motivations and forthcoming targets.

# data[].attributes.attachment_link.readable_text
EXECUTIVE SUMMARY

Various hacktivist groups have targeted critical infrastructure, government agencies, and organizations in both Israel and Palestine. The attacks include Distributed Denial of Service (DDoS) attacks, defacement attacks and data breaches. As other countries take a stand on the war, the conflict has also spread beyond the immediate region, affecting several other countries. This report provides a concise overview of the escalating cyber conflict in the Middle East, stemming from recent geopolitical events. Notably, we engaged directly with threat actors from hacktivist groups to gain a deeper understanding of their motivations and forthcoming targets.

INTRODUCTION

As cyber conflict advances, the concept of 'hybrid warfare' emerges, blending kinetic and non-kinetic (i.e. digital) operations on the modern battlefield. While traditionally cyber operations have been non-kinetic, a paradigm shift is looming, as cyber-attacks on vital infrastructure - like power plants - have the potential to yield tangible, kinetic outcomes that disrupt local operations, and can lead to extensive chaos and collateral damage. This type of event has precedent: the Russian invasion of Ukraine was proceeded by a synchronized disruption of Viasat nodes by a GRU-initiated DDoS attack, underlining the intertwined nature of modern warfare. With non-state actors increasingly engaging in disruptive operations, we are observing a similar pattern in the ongoing conflict between Israel and Gaza.

TIMELINE

October 6, 2023: Cyber Av3ngers, a hacktivist group, claims responsibility for hacking the Noga Independent Systems Operator and launching Distributed Denial of Service (DDoS) attacks. This event marks the beginning of cyber activity related to the ongoing conflict.

October 7, 2023: Within an hour of the 5000+ missile attack on Israel by Hamas, hacktivist group Anonymous Sudan (suspected to be of Russian origin) launched DDOS attacks on all the alert applications used for notifying citizens about incoming rockets.

October 8, 2023: The Israeli government's official website becomes unreachable worldwide, and the Russian hacker group 'Killnet' claims responsibility for the attack. They accuse the Israeli government of supporting the "terrorist regime" in Ukraine and announce that they will target Israeli government systems.

Anonymous Sudan attacks The Jerusalem Post's website, causing it to go offline for over 2 days. Threat actor Ares Leaks announces that they are willing to purchase data related to Hamas military group. Furthermore, Cyber Aveng3rs claimed responsibility of hacking into the DORAD power plant, and ThreatSec claimed to have breached and shut down Alfanet, Palestine's largest ISP provider.

October 9, 2023: Hacktivist group; AnonGhost, compromised Israel's Alert App and sent threatening notifications by exploiting an API vulnerability in the application. On the other hand, the cyber branch of the Israel Police's Lahav 433 unit, along with the help of Binance, freezes cryptocurrency accounts belonging to Hamas.

October 10, 2023: A threat actor known as "blackfield" announces on a Russian-speaking forum that they possess data belonging to hundreds of IDF soldiers and Shabak members, including phone numbers, photos, and personal information. They may use this data for further targeted attacks and disinformation campaigns. Blackfield also hints at targeting the US in the near future.

Various pro-Israel and pro-Hamas hacker groups engage in cyber activities, shutting down websites and targeting infrastructure. Cyber Av3ngers claims to have CCTV access to Mekorot, the national water company of Israel, adding to the list of attacks on industrial control systems.

October 11 - October 13, 2023: Individuals from various hacktivist groups are looking up stealer logs added to a central public lookup repository, trying to find valid credentials to compromise their targets of interest. Hacktivists are interested in servers belonging to:

The Federal Emergency Management Agency (FEMA),

The Ministry of Health of Kenya,

Texas Attorney General,

The Ministry of Education of Israel,

Prime Minister's Office,

Republic of Iraq,

Alayen Iraqi University,

Middle Technical University in Iraq,

Journal of Petroleum Research and Studies (Iraq),

Bayan University (Iraq).

And more.

October 14, 2023: Cyber Av3ngers announce that they have compromised ORPAK, a company that provides payment and management solutions for fuel, retail and fleet businesses in Israel. This was followed by them leaking CCTV footage and data from multiple gas stations and screenshots of the internal panels using SiteOmat.

October 15, 2023: Hacktivist group AnonGhost Indonesia claims to leak the database of a dating and consolidation project for the Israeli LGBTQ community - "The Gaydar" on Pastebin.

October 16, 2023: Amidst other attacks, Israeli news websites "All Israel News" and "Abu Ali Express" were targeted by hacktivist "YourAnon T13x". "All Israel News" took countermeasures that resulted in the web requests from the hacktivist group initially getting blocked, however, the threat actors were able to DDOS the website again.

October 17, 2023: Hacktivist group AnonGhost dumped a list of Israeli targets vulnerable to CVE-2023-29489 along with the exploit. The vulnerability affects cPanel application hosted commonly on websites. It's a reflected cross-site scripting vulnerability that could be exploited without any authentication by an attacker.

WE SPOKE WITH A THREAT ACTOR WHO HAS TAKEN A NEUTRAL STANCE IN THE ONGOING WAR.

In September 2022, Spid3r and the Kromsec group emerged as significant threats to Iran, both in the digital and real World. They initiated a cyber offensive as part of Anonymous's #OpIran campaign, responding to the tragic death of Mahsa Amini, which has placed considerable pressure on the Tehran regime. Spid3r, who was previously involved in #OpRussia and contributed to the disruption of critical Russian targets, shared insights on the ongoing war. As stated by Spid3r in previous conversations, "Turning off unimportant targets for 5 minutes doesn't work at all - But DDoS can be effective if you lock a specific target for a long time. For example, let's say that the money transfer system of a country's central bank does not work for 6 hours. Loss is unpredictable".

(CYFIRMA): Can you please introduce yourself and describe your group's political stance?
Spid3r (KromSec): Certainly. We are KromSec, a collective of hacktivists. Our primary goal is to respond to global events and issues through hacktivism. We operate from a democratic standpoint, firmly against censorship, corruption, human rights violations, and various modern-day problems. Our group comprises not only hackers but also activists, writers, and journalists. However, the individuals taking responsibility for our actions are mostly hacktivist hackers with a background linked to Anonymous.

We were notably involved in Anonymous' OpRussia, and later, we initiated OpIran. Our activities have targeted various entities, including universities, ministries, national assemblies, and government systems.

After the protests in France, we hacked the French Ministry of Justice and disclosed information about hundreds of judges. Unfortunately, our Twitter account and Telegram channel were suspended due to the French Government's intervention.

You can expect to see more data related to the French Ministry and an important government system on our channel soon. I hope that gives you a good overview. Feel free to ask further questions.

CYFIRMA: Can you confirm your group's involvement in the recent cyber-attacks on the Palestinian Ministry of Foreign Affairs?
Spid3r (KromSec): Yes, it is true that we gained access to their systems. However, we want to clarify that our intentions are not malicious. We believe that wars are tragic and should not be supported by any side.

CYFIRMA: What do you plan to do with the data you obtained from the Palestinian Ministry of Foreign Affairs?
Spid3r (KromSec): Our intention is to reveal any hidden information when we deem it necessary.

CYFIRMA: Are you acting independently, or are you affiliated with a specific organization or group?
Spid3r (KromSec): We operate independently.

CYFIRMA: Do you believe that cyber-attacks will extend beyond the Middle East? There has been significant attention to this issue.
Spid3r (KromSec): In today's world, technology connects everything, including people. Cyber actions can have a far-reaching impact, and we should consider their potential consequences.

CYFIRMA: Given the recent Hamas/Israel confrontation, have you heard of any major actions on the horizon?
Spid3r (KromSec): The media attention on unnecessary DDoS attacks makes us question their significance. We are monitoring an Israeli group closely, and they have targeted various .edu.ps websites. Pro-Palestinian Arab groups tend to focus on DDoS attacks on vulnerable systems or exploit WordPress vulnerabilities or compromised admin accounts. We respect genuine hacks, but DDoS attacks on insignificant sites for bragging rights are questionable.

CYFIRMA: How does your group view the ongoing conflict between Palestinian militant groups and Israel?
Spid3r (KromSec): We believe that the Israeli intelligence services are aware of such attacks, and it's thought-provoking that they coincide with a time when Netanyahu lost support from his own people.

CYFIRMA: Do you have a longer-term strategy?
Spid3r (KromSec): It's too early to discuss long-term strategies. The future is uncertain, and events can change rapidly.

CYFIRMA: What specific targets have you focused on in your cyber-attacks?
Spid3r (KromSec): We always act with consideration for potential consequences on civilians and critical infrastructure. We don't aim to harm the public.

CYFIRMA: Are there specific demands or conditions your group aims to convey through these cyber-attacks?
Spid3r (KromSec): We usually communicate our intentions through attack messages or by contacting the affected system.

CYFIRMA: How do you see your cyber actions fitting into the overall strategy of your organization or group in this conflict?
Spid3r (KromSec): Our primary focus is on positive intentions. We targeted two universities, which are prominent in their country and have students who oppose the current regime. Our goal was to establish a constructive dialogue to prevent the potential misuse of information by others. Unfortunately, the situation didn't unfold as we had hoped.

CYFIRMA: Would your group consider engaging in dialogue or negotiations with relevant parties in the Israel/Hamas conflict to address your concerns without resorting to cyber-attacks?
Spid3r (KromSec): I don't anticipate such an offer. As for the pro-Israeli group we are monitoring, we are open to dialogue.

CYFIRMA: Please share your thoughts on the Hamas/Israel conflict and how you think things will unfold, both on the ground and in cyberspace.
Spid3r (KromSec): The ongoing conflict raises many questions. Is Hamas doing more harm to Israel or to their own people? The actions taken by Hamas, such as dismantling pipes from international organizations for infrastructure and repurposing them for missiles, are concerning. What Hamas is doing is unacceptable, and all Palestinians suffer as a result. However, this doesn't justify Israel's use of phosphorus gas. The lack of international response is baffling.
The situation is shrouded in uncertainty. We are closely watching the Middle East, where complex political games are played behind closed doors. True peace in this region will only be possible when both Israeli and Palestinian children can sleep without fear. We believe that diplomacy, rather than escalating tensions through attacks, is the key to a resolution.

CYFIRMA: You mentioned that your group has some background with Anonymous. Would you like to share a little about your technical capabilities?
Spid3r (KromSec): While I prefer not to boast about my technical skills, I can confirm that I am not new to the realm of cybersecurity. Anonymous has provided us with valuable knowledge and resources.

CYFIRMA: Is there a specific reason you don't want to discuss your skills in detail?
Spid3r (KromSec): I believe that actions speak louder than words, and I prefer to let our activities demonstrate our skills.

A FEW MONTHS AGO, WE SPOKE WITH A THREAT ACTOR WHO IS SUPPORTING GAZA IN THE ONGOING WAR

The conversation below is an excerpt from that interview.
Note: The responses have been slightly modified to improve readability as English is not their native language

CYFIRMA: We appreciate you taking the time to speak with us. Can you begin by telling us more about your group, DeltaBoys, and your role within it?
DeltaBoys: We are a group with a long history, and I'm referred to as "anony." We've had different names in the past, but our recent one is DeltaBoys. We've been involved in various activities, including penetrating government organizations and exposing their information.

CYFIRMA: What prompted you to communicate with the media directly?
DeltaBoys: We are regular people who are interested in communication, and we decided to engage with the media.

CYFIRMA: To introduce you properly, how would you describe your group's activities? Are you primarily access brokers or involved in other aspects of cyber operations?
DeltaBoys: Our activities were initially in the underground, but about a year ago, we rebranded as DeltaBoys. We focus on infiltrating government organizations and disclosing their information.

CYFIRMA: What is your group's technical specialty or passion?
DeltaBoys: For nearly 20 years, we have specialized in penetration and vulnerability detection.

CYFIRMA: Could you share the origins of your group and what motivates your activities?
DeltaBoys: Initially, our focus was on exposing corrupt governments, governmental crimes, and corruption. We were driven by a desire to hold such entities accountable and make people happier through our actions.

CYFIRMA: Have you collaborated with other groups or formed any affiliations?
DeltaBoys: Yes, we have worked with many groups, although our group's rules often didn't align with those of other groups. Unfortunately, most well-known groups have affiliations with security organizations, and it's interesting to note that many hacker groups have been victims of our actions, resulting in us obtaining and publishing information about them.

CYFIRMA: Can you tell us about your targets, particularly those related to Israeli infrastructure, and the ideological reasons behind your attacks?
DeltaBoys: The Israeli government has a history of what we view as wrongdoing and violence worldwide. Hacking and disclosing their information are a way for us to express our opposition to their actions. We have targeted many cyber groups from Israel, identifying their information and operational weaknesses. Their primary goal often revolves around financial control.

CYFIRMA: We've noticed an increase in web defacement attacks. Can you explain this and whether it's due to a growth in your group or an increase in sophistication?
DeltaBoys: We are a small but secretive group. Some of our intrusions occur after thorough information checks on organizations, while others involve sensitive information and documents. The public hacks typically relate to our older targets.

CYFIRMA: How do you select your targets, and what vulnerabilities or criteria attract your attention?
DeltaBoys: We have a vulnerability testing lab and identify the latest vulnerabilities. We also gather information on government targets through our members and by assessing the level of corruption. Occasionally, we hack ordinary people for fun, particularly if they are involved in fraud and corruption.

CYFIRMA: Can you share some insights into your tactics and techniques that set you apart from other threat actor groups?
DeltaBoys: Unfortunately, we cannot disclose our work method, but we achieve significant results by leveraging zero-day vulnerabilities and exploiting human error. A single human error in a security organization, for instance, can provide us with access to the entire organization, including emails, passwords, VPNs, files, virtual networks, and social networks.

CYFIRMA: Let's discuss the financial aspect. How do you monetize your operations, and what brings in the most income for your group?
DeltaBoys: We primarily make money through the sale of data and government and financial access, generating approximately $40,000 per month. This income supports our operations, but it's important to distinguish between hackers and financial fraudsters who steal from ordinary people's databases. We are not thieves.

CYFIRMA: What are your near-term and long-term ambitions as a group?
DeltaBoys: Our goal is to create a powerful group that transcends sect, religion, and racism. We aim to fight against corrupt politics, racism, and corruption while defending human rights. We believe that all human beings have equal rights, and we strive to uphold them.

WE SPOKE WITH A THREAT ACTOR WHO IS SUPPORTING ISRAEL IN THE ONGOING WAR

(CYFIRMA): Can you please introduce yourself? How would you describe yourself in terms of political stance?
fqw (Owner of GlorySec): My handle is fqw, I am the owner of GlorySec, and I would also like to state before we get started that most, if not all hacktivist groups have no idea about the current geopolitics other than what they hear from the media/press. We aren't black hats like GhostSec or SiegedSec; we actually stand up for what's right, we attack everybody with a particular reason.

CYFIRMA: Are you acting independently, or are you affiliated with a specific organization or group?
fqw: GlorySec is a subgroup of a particular darknet cult that we can't go into any further detail about. However, yes - GlorySec is affiliated with another group.

CYFIRMA: Ok, thanks. Can you confirm your involvement in the recent cyber-attacks on the Palestinian territory?
fqw: We are currently prioritizing our involvement within the Israel-Palestine conflict, but we can't go into operational details.

CYFIRMA: How does your group view the ongoing conflict between Palestinian militant groups and Israel?
fqw: GlorySec members have left, and the owner has left as well to start a new operation. We have an entirely new team with the same political agenda. We will be more radical towards terrorists and extremists and those who threaten humanity without justification. We support Israel in the Israeli-Palestinian conflict and Azerbaijan in the Azerbaijan-Armenia war. We have worked on #OPArmenia and #OPPalestine and taken over websites. We have attacked educational institutions in response to attacks on the innocent.

CYFIRMA: So far, we have seen several cyber groups becoming involved in the recent Hamas/Israel confrontation. Are you aware of any major actions that may take place?
fqw: We feel that both countries will be severely attacked, but we can't provide operational details or those of our affiliates.

CYFIRMA: I understand you can't go into too much operational detail about what you are planning, but can you give us an idea of your group's capabilities or what you have previously done?
fqw: Our new team is very advanced, with skills ranging from reverse engineering to network penetration. However, we primarily focus on web penetration testing.

CYFIRMA: Is what you are planning solely a response to recent events in the Gaza Strip, or does it represent a longer-term strategy?
fqw: It's most likely a longer-term strategy, but our first motivation was the Gaza Strip attacks.

CYFIRMA: Do you think cyber-attacks will extend beyond the Middle East?
fqw: It depends on the group and the country.

CYFIRMA: Have you considered the potential consequences of your actions on civilians or critical infrastructure in the affected regions?
fqw: Yes, we have, but we always have a purpose, so we don't take it into critical consideration.

CYFIRMA: Are there any specific demands or conditions that your group is trying to convey through these cyber-attacks?
fqw: It depends on the issue. For example, in the Palestine situation, we are trying to push Palestine out of Israel, although they likely won't listen. Many hacktivist groups are attacking both sides.

CYFIRMA: How do you anticipate what you are planning will affect the situation on the ground or the broader conflict? How impactful is it going to be? We've heard some industrial control systems being attacked; is it in that vein?
fqw: GlorySec isn't like other hacktivist groups that claim they are grey hats, but they are actually black hats. We always have a purpose when we hack, and we do it to push a cause. Our actions will likely impact Palestine financially, making them realize they need to back out. There have been some attacks on industrial control systems.

CYFIRMA: What are your views on Iran, who are widely known to fund Hamas? Isn't that an attractive target?
fqw: We have looked into Iran, and that is our next operation after Palestine. We also have a few people already working on Iran, but it's mainly focused on Palestine.

CYFIRMA: Before we wrap up, could you give us an idea of the background of your group? What makes you all so motivated?
fqw: GlorySec is made up of average citizens, such as cashiers or lawn mowers, everyday people like you. Our motivation comes from tragedies and events caused by companies and countries, like the wrongful invasion of Palestine. We are fighting for justice.

CYFIRMA: Thanks for chatting. If you want to say anything else, always feel free to reach out!

ETLM ASSESSMENT

Adversary

Cybercriminals, Hacktivists, APTs

Infrastructure

Private botnets, Bulletproof VPS, Booters/Stressers, Compromised RDPs/VNCs

Targets/Victims

Pro-Gaza hacktivists are collectively targeting countries such as India, Egypt, Kenya, France, Germany, Italy, United Kingdom, and the United States (other than Israel). On the other hand, Pro-Israel hacktivists are targeting Iran, Iraq, Saudi Arabia, Lebanon and Qatar (other than Palestine and Gaza).

Capabilities

Most of these groups are disorganized and are looking to spread their propaganda using DDOS and defacement attacks. However, there are a few groups on either side that can execute more sophisticated attacks.

Throughout this period, CYFIRMA has observed an increasing number of cybercriminal groups entering the conflict, targeting infrastructure on both sides.

23 Groups - Pro-Israel

103 Groups - Pro-Palestine

4 Groups - Neutral

Note: This information is subject to change due to the dynamic nature of events.

THREAT ACTORS

Pro-Israel Hacktivists/Groups

Anonymiss

Anonymous India

Anonymous Israel

AresLeaks

Arvin

Cyber Club (Support)

Dark Cyber Worrior

Garuna Ops

Gaza parking lot crew

GlorySec

GonjeshkeDarande

ICD- Israel Cyber Defense

Indian Cyber Force

Indian Darknet Association

IT ARMY of Ukraine

Kerala Cyber Thunders

Kerala Cyber Xtractors

Silencers_of_evil

SilentOne

Team NWH Security

TeamHDP

Termux Israel

UCC Team

Pro-Gaza Hacktivists/groups

4 Exploitation

1915 Team

./CsCrew

./Tea Party

Aceh About Hacked World

AnoaGhost

AnonHamz

AnonT13x Group

Anonymous 070

Anonymous Indonesia

Anonymous Morocco

Anonymous Russia

Anonymous Sudan

Arab Anonymous Team

ASKAR DDOS

Awham

Bandung Cyber Team

Bangladesh Civilian Force

Black Security Team

Blackshieldcrew MY

Boom Security

Cubjrnet7

Cscrew

Cyb3r Dragonz Team

Cyber Error Team

Cyb3r Gang

Cyber Sederhana Team

CyberActivism

Dark Storm Team

DumpDataBase

Dragonforce Malaysia

Eagle Cyber Crew

Electronic Tigers Unit

End Sodama

Esteem Restoration Eagle

F7 Xpl0it3r

Fr3dens of Security

Ganosec team

Garnesia Team

Gb Anon 17

Ghost Clan Malaysia

GhostClan

Ghost Hunter Illusion

GhostSec

Hacktivism Indonesia

Hizbullah Cyb3r Team

IndoGhostSec

Islamic Cyber team | Indonesia

islamic hacker army

Jateng Cyber Team

JATIM RedStorm Xploit

KEP TEAM

khalifah cybercrew

Khan cyber Army

KillNet

Kingman world official

Kuningan Exploiter

LGH

Malaysia cyber defacer

MeshSec

Milad Hacking

M.H.T

Moroccan Black Cyber Army

Moroccan Defenders Group

MrWanz

Muslim Cyber Army

Mysterious Team Bangladesh

xNot_RespondinGx

Pakistan Cyber Hunter

Pakistani Leet Hackers

Panoc team

Royal Battler BD

Russian tools

Siber Team

Siegedsec

Skynet

StarsX Team

Storm-1133

Stucx Team

Sukowono Blackhat Team

Sylhet Gang-SG

Synix CyberCrimeMY

Systemadminbd Official (BCF)

Team Anon Force

Team Azrael Angel of Death

Team Herox

The key40

Team R70

Team R

Team_insane_Pakistan

Teng Korak Cyber Crew

The Ghost Squad

The White Crew

Toyonzade

Turk Hack Team

TYG Team

UserSec

VulzSec

WeedSec

x7root

Yemen Legions Team

YourAnon T13x

Groups targeting other countries that are supporting Israel

Neutral Groups

APTs

Given how APT groups usually operate, we have not observed any confirmed activity yet. However, it is highly likely that they will attempt to take advantage of the situation to carry out more sophisticated attacks than we have seen so far from other groups. Below is a list of groups that have a history of targeting Israel:

CONCLUSION

Since the initial attack by Hamas, CISA is "in very close contact" with the Israeli National Cyber Directorate to share intelligence. US President Joe Biden is scheduled to embark on a trip to Israel, followed by Jordan, where he will engage with both Israeli and Arab leaders. On the other hand, Iran's Foreign Minister, Abdollahian, has issued a warning about the possibility of Iran and its allies taking "preemptive action" in the near future in response to Israel's attacks on Gaza. The Israeli-Palestinian conflict saw a significant escalation in cyber attacks by hacktivist groups and threat actors from various regions, targeting government websites, education and media sector, billboards, power plants, alert systems, and even sensitive military information. The involvement of these cyber actors added a new dimension to the ongoing conflict, highlighting the vulnerability of nations to cyberattacks in times of elevated tensions. As the situation began to unfold, it became clear that cybersecurity would play a critical role in this complex and long-standing conflict. The ongoing war has cost a lot of innocent lives on both sides.

RECOMMENDATIONS

Tactical Recommendations

Enhance DDoS Mitigation: Given the prevalence of DDoS attacks in this cyber conflict, organizations and governments should invest in robust DDoS mitigation technologies and strategies. Employing real-time traffic analysis and traffic scrubbing can help minimize service disruptions.

Regular Vulnerability Scanning: Continuous vulnerability scanning of critical infrastructure is crucial. Identify and address vulnerabilities promptly to reduce the risk of exploitation by hacktivist groups.

Multi-Factor Authentication (MFA): Implement MFA for all privileged accounts and critical systems, including RDPs and VNCs. This adds an extra layer of protection against unauthorized access.

Incident Response Planning: Develop and regularly update an incident response plan. Ensure that security teams are well-prepared to respond to cyber incidents swiftly and effectively.

Strategic Recommendations

Threat Intelligence Sharing: Encourage regional and international threat intelligence sharing to improve awareness of ongoing threats. Collaborative efforts can help predict and mitigate attacks more effectively.

Diplomatic Engagement: Governments should engage in diplomatic discussions to de-escalate geopolitical tensions. Reducing the motivation for hacktivist activities at their source can be an effective long-term strategy.

Public Awareness Campaigns: Launch public awareness campaigns to educate citizens about cyber threats, including phishing and disinformation. An informed public is less susceptible to hacktivist propaganda.

International Norms and Agreements: Advocate for international agreements and norms regarding cyber warfare. Establishing clear rules of engagement in cyberspace can deter hacktivist groups.

Management Recommendations

Cybersecurity Training: Invest in training and awareness programs for employees and government officials. A well-informed workforce is a critical defense against social engineering attacks.

Resource Allocation: Allocate resources for enhancing critical infrastructure security. Ensure that budgetary support is provided for cybersecurity measures that protect essential services.

Regular Drills and Exercises: Conduct regular cybersecurity drills and exercises to test incident response plans and identify areas for improvement.

Collaborative Partnerships: Foster partnerships with cybersecurity firms and organizations that can provide threat intelligence, incident response support, and security expertise.

# data[].attributes.attachment_link.title
ISRAEL GAZA CONFLICT : THE CYBER PERSPECTIVE - CYFIRMA

# data[].attributes.attachment_link.description
EXECUTIVE SUMMARY Various hacktivist groups have targeted critical infrastructure, government agencies, and organizations in both Israel and Palestine. The attacks...

# data[].attributes.body
In seinem jüngsten Initiativprojekt hat das Nationale Testinstitut für Cybersicherheit NTC die Schweizer Ladeinfrastruktur für Elektromobilität einer umfassenden Sicherheitsanalyse unterzogen. Bei rund 30 Organisationen wurden schwerwiegende Sicherheitslücken festgestellt. Die Schwachstellen wurden den Herstellern gemeldet und von diesen geschlossen. Zudem wurden generelle Handlungsempfehlungen für die Branche abgeleitet.

# data[].attributes.body
La loi sur la sécurité de l’information (LSI) et ses quatre ordonnances d’exécution entreront en vigueur le 1er janvier 2024. Le Conseil fédéral en a décidé ainsi lors de sa séance du 8 novembre 2023. Il entend ainsi renforcer la protection des informations et la cybersécurité au sein de la Confédération.

La LSI réunira en un seul acte les bases légales les plus importantes pour la sécurité des informations et des moyens informatiques de la Confédération. Se basant sur des normes internationales, la loi et ses quatre ordonnances d’exécution fixeront des exigences minimales dans ce domaine pour l’ensemble des autorités et des organisations de la Confédération.

# data[].attributes.headline
Hackerangriff auf die Firma Concevis: Auch die Bundesverwaltung ist betroffen

# data[].attributes.subject
Hackerangriff auf die Firma Concevis: Auch die Bundesverwaltung ist betroffen

# data[].attributes.body
Das Software-Unternehmen Concevis wurde Opfer eines Ransomware-Angriffes, bei dem sämtliche Server der Firma verschlüsselt wurden. Unter den entwendeten Daten befinden sich nach aktuellem Kenntnisstand mutmasslich auch ältere, operative Daten der Bundesverwaltung. Die vertieften Analysen laufen derzeit noch.

Die Firma Concevis, eine Schweizer Anbieterin von Softwarelösungen für öffentliche Verwaltungen (Bund, Kantone, Städte), den Finanzsektor und Unternehmen aus der Industrie und Logistik, ist Opfer eines Ransomware-Angriffs geworden. Die Angreifer entwendeten Daten und verschlüsselten danach sämtliche Server der Firma. Nachdem die Firma der Lösegeldforderung nicht nachgekommen ist, drohen die Angreifer mit der Veröffentlichung der Daten im Darknet.

# data[].attributes.attachment_link.readable_text
Bern, 14.11.2023 - Das Software-Unternehmen Concevis wurde Opfer eines Ransomware-Angriffes, bei dem sämtliche Server der Firma verschlüsselt wurden. Unter den entwendeten Daten befinden sich nach aktuellem Kenntnisstand mutmasslich auch ältere, operative Daten der Bundesverwaltung. Die vertieften Analysen laufen derzeit noch.

Die Firma Concevis, eine Schweizer Anbieterin von Softwarelösungen für öffentliche Verwaltungen (Bund, Kantone, Städte), den Finanzsektor und Unternehmen aus der Industrie und Logistik, ist Opfer eines Ransomware-Angriffs geworden. Die Angreifer entwendeten Daten und verschlüsselten danach sämtliche Server der Firma. Nachdem die Firma der Lösegeldforderung nicht nachgekommen ist, drohen die Angreifer mit der Veröffentlichung der Daten im Darknet.

Die Firma Concevis hat ihre Kunden über den Cybervorfall informiert. Zudem hat das Software-Unternehmen bei der Staatsanwaltschaft Basel-Stadt Strafanzeige erstattet sowie einen externen Sicherheitsdienstleister für die Bewältigung des Vorfalles beigezogen.

Zu den Kunden von Concevis gehören auch verschiedene Verwaltungseinheiten der Bundesverwaltung. Nach aktuellem Erkenntnisstand sind das Bundesamt für Bevölkerungsschutz, das Bundesamt für Raumentwicklung, das Bundesamt für Statistik, das Bundesamt für Zivilluftfahrt, die Eidgenössische Steuerverwaltung und das Kommando Ausbildung auf der Kundenliste von Concevis. Zurzeit ist in Abklärung, welche Stellen und Daten konkret betroffen sind. Die von Concevis entwickelten Anwendungen werden durch Leistungserbringer der Bundesverwaltung betrieben. Eine Kompromittierung von Systemen des Bundes ist aktuell unwahrscheinlich. Bisherige Analysen haben keinerlei Hinweise dazu ergeben.

Das NCSC koordiniert die weiteren Abklärungen und Massnahmen innerhalb der Bundesverwaltung. Es steht in Austausch mit der Firma Concevis sowie den Strafverfolgungsbehörden und den betroffenen Verwaltungseinheiten der Bundesverwaltung und wird die Öffentlichkeit zu gegebener Zeit über weitere Erkenntnisse informieren.

Wie Ransomware-Angriffe in den meisten Fällen ablaufen:

Nachdem die Angreifer sich unbefugten Zugriff auf die Systeme einer Unternehmung verschafft haben, werden die Daten zuerst gestohlen, danach verschlüsselt und die Firma wird erpresst. Zahlt die betroffene Firma nicht, wird mit der Veröffentlichung der gestohlenen Daten gedroht und bei Nicht-Bezahlung des Lösegeldes werden die Daten veröffentlicht.

Adresse für Rückfragen

Kommunikation NCSC
Tel. 058 465 53 56
ncsc-media@gs-efd.admin.ch

Herausgeber

Eidgenössisches Finanzdepartement
http://www.efd.admin.ch

Letzte Änderung 30.11.2020

# data[].attributes.attachment_link.title
Hackerangriff auf die Firma Concevis: Auch die Bundesverwaltung ist betroffen

# data[].attributes.headline
AI is about to completely change how you use computers

# data[].attributes.subject
AI is about to completely change how you use computers

# data[].attributes.body
To do any task on a computer, you have to tell your device which app to use. You can use Microsoft Word and Google Docs to draft a business proposal, but they can’t help you send an email, share a selfie, analyze data, schedule a party, or buy movie tickets. And even the best sites have an incomplete understanding of your work, personal life, interests, and relationships and a limited ability to use this information to do things for you. That’s the kind of thing that is only possible today with another human being, like a close friend or personal assistant.

In the next five years, this will change completely. You won’t have to use different apps for different tasks. You’ll simply tell your device, in everyday language, what you want to do. And depending on how much information you choose to share with it, the software will be able to respond personally because it will have a rich understanding of your life. In the near future, anyone who’s online will be able to have a personal assistant powered by artificial intelligence that’s far beyond today’s technology.

# data[].attributes.attachment_link.readable_text
I still love software as much today as I did when Paul Allen and I started Microsoft. But-even though it has improved a lot in the decades since then-in many ways, software is still pretty dumb.

To do any task on a computer, you have to tell your device which app to use. You can use Microsoft Word and Google Docs to draft a business proposal, but they can't help you send an email, share a selfie, analyze data, schedule a party, or buy movie tickets. And even the best sites have an incomplete understanding of your work, personal life, interests, and relationships and a limited ability to use this information to do things for you. That's the kind of thing that is only possible today with another human being, like a close friend or personal assistant.

In the next five years, this will change completely. You won't have to use different apps for different tasks. You'll simply tell your device, in everyday language, what you want to do. And depending on how much information you choose to share with it, the software will be able to respond personally because it will have a rich understanding of your life. In the near future, anyone who's online will be able to have a personal assistant powered by artificial intelligence that's far beyond today's technology.

This type of software-something that responds to natural language and can accomplish many different tasks based on its knowledge of the user-is called an agent. I've been thinking about agents for nearly 30 years and wrote about them in my 1995 book The Road Ahead, but they've only recently become practical because of advances in AI.

Agents are not only going to change how everyone interacts with computers. They're also going to upend the software industry, bringing about the biggest revolution in computing since we went from typing commands to tapping on icons.

Some critics have pointed out that software companies have offered this kind of thing before, and users didn't exactly embrace them. (People still joke about Clippy, the digital assistant that we included in Microsoft Office and later dropped.) Why will people use agents?

The answer is that they'll be dramatically better. You'll be able to have nuanced conversations with them. They will be much more personalized, and they won't be limited to relatively simple tasks like writing a letter. Clippy has as much in common with agents as a rotary phone has with a mobile device.

An agent will be able to help you with all your activities if you want it to. With permission to follow your online interactions and real-world locations, it will develop a powerful understanding of the people, places, and activities you engage in. It will get your personal and work relationships, hobbies, preferences, and schedule. You'll choose how and when it steps in to help with something or ask you to make a decision.

To see the dramatic change that agents will bring, let's compare them to the AI tools available today. Most of these are bots. They're limited to one app and generally only step in when you write a particular word or ask for help. Because they don't remember how you use them from one time to the next, they don't get better or learn any of your preferences. Clippy was a bot, not an agent.

Agents are smarter. They're proactive-capable of making suggestions before you ask for them. They accomplish tasks across applications. They improve over time because they remember your activities and recognize intent and patterns in your behavior. Based on this information, they offer to provide what they think you need, although you will always make the final decisions.

Imagine that you want to plan a trip. A travel bot will identify hotels that fit your budget. An agent will know what time of year you'll be traveling and, based on its knowledge about whether you always try a new destination or like to return to the same place repeatedly, it will be able to suggest locations. When asked, it will recommend things to do based on your interests and propensity for adventure, and it will book reservations at the types of restaurants you would enjoy. If you want this kind of deeply personalized planning today, you need to pay a travel agent and spend time telling them what you want.

The most exciting impact of AI agents is the way they will democratize services that today are too expensive for most people. They'll have an especially big influence in four areas: health care, education, productivity, and entertainment and shopping.

Today, AI's main role in healthcare is to help with administrative tasks. Abridge, Nuance DAX, and Nabla Copilot, for example, can capture audio during an appointment and then write up notes for the doctor to review.

The real shift will come when agents can help patients do basic triage, get advice about how to deal with health problems, and decide whether they need to seek treatment. These agents will also help healthcare workers make decisions and be more productive. (Already, apps like Glass Health can analyze a patient summary and suggest diagnoses for the doctor to consider.) Helping patients and healthcare workers will be especially beneficial for people in poor countries, where many never get to see a doctor at all.

These clinician-agents will be slower than others to roll out because getting things right is a matter of life and death. People will need to see evidence that health agents are beneficial overall, even though they won't be perfect and will make mistakes. Of course, humans make mistakes too, and having no access to medical care is also a problem.

Mental health care is another example of a service that agents will make available to virtually everyone. Today, weekly therapy sessions seem like a luxury. But there is a lot of unmet need, and many people who could benefit from therapy don't have access to it. For example, RAND found that half of all U.S. military veterans who need mental health care don't get it.

AI agents that are well trained in mental health will make therapy much more affordable and easier to get. Wysa and Youper are two of the early chatbots here. But agents will go much deeper. If you choose to share enough information with a mental health agent, it will understand your life history and your relationships. It'll be available when you need it, and it will never get impatient. It could even, with your permission, monitor your physical responses to therapy through your smart watch-like if your heart starts to race when you're talking about a problem with your boss-and suggest when you should see a human therapist.

For decades, I've been excited about all the ways that software would make teachers' jobs easier and help students learn. It won't replace teachers, but it will supplement their work-personalizing the work for students and liberating teachers from paperwork and other tasks so they can spend more time on the most important parts of the job. These changes are finally starting to happen in a dramatic way.

The current state of the art is Khanmigo, a text-based bot created by Khan Academy. It can tutor students in math, science, and the humanities-for example, it can explain the quadratic formula and create math problems to practice on. It can also help teachers do things like write lesson plans. I've been a fan and supporter of Sal Khan's work for a long time and recently had him on my podcast to talk about education and AI.

But text-based bots are just the first wave-agents will open up many more learning opportunities.

For example, few families can pay for a tutor who works one-on-one with a student to supplement their classroom work. If agents can capture what makes a tutor effective, they'll unlock this supplemental instruction for everyone who wants it. If a tutoring agent knows that a kid likes Minecraft and Taylor Swift, it will use Minecraft to teach them about calculating the volume and area of shapes, and Taylor's lyrics to teach them about storytelling and rhyme schemes. The experience will be far richer-with graphics and sound, for example-and more personalized than today's text-based tutors.

There's already a lot of competition in this field. Microsoft is making its Copilot part of Word, Excel, Outlook, and other services. Google is doing similar things with Assistant with Bard and its productivity tools. These copilots can do a lot-such as turn a written document into a slide deck, answer questions about a spreadsheet using natural language, and summarize email threads while representing each person's point of view.

Agents will do even more. Having one will be like having a person dedicated to helping you with various tasks and doing them independently if you want. If you have an idea for a business, an agent will help you write up a business plan, create a presentation for it, and even generate images of what your product might look like. Companies will be able to make agents available for their employees to consult directly and be part of every meeting so they can answer questions.

Whether you work in an office or not, your agent will be able to help you in the same way that personal assistants support executives today. If your friend just had surgery, your agent will offer to send flowers and be able to order them for you. If you tell it you'd like to catch up with your old college roommate, it will work with their agent to find a time to get together, and just before you arrive, it will remind you that their oldest child just started college at the local university.

Already, AI can help you pick out a new TV and recommend movies, books, shows, and podcasts. Likewise, a company I've invested in, recently launched Pix, which lets you ask questions ("Which Robert Redford movies would I like and where can I watch them?") and then makes recommendations based on what you've liked in the past. Spotify has an AI-powered DJ that not only plays songs based on your preferences but talks to you and can even call you by name.

Agents won't simply make recommendations; they'll help you act on them. If you want to buy a camera, you'll have your agent read all the reviews for you, summarize them, make a recommendation, and place an order for it once you've made a decision. If you tell your agent that you want to watch Star Wars, it will know whether you're subscribed to the right streaming service, and if you aren't, it will offer to sign you up. And if you don't know what you're in the mood for, it will make customized suggestions and then figure out how to play the movie or show you choose.

You'll also be able to get news and entertainment that's been tailored to your interests. CurioAI, which creates a custom podcast on any subject you ask about, is a glimpse of what's coming.

In short, agents will be able to help with virtually any activity and any area of life. The ramifications for the software business and for society will be profound.

In the computing industry, we talk about platforms-the technologies that apps and services are built on. Android, iOS, and Windows are all platforms. Agents will be the next platform.

To create a new app or service, you won't need to know how to write code or do graphic design. You'll just tell your agent what you want. It will be able to write the code, design the look and feel of the app, create a logo, and publish the app to an online store. OpenAI's launch of GPTs this week offers a glimpse into the future where non-developers can easily create and share their own assistants.

Agents will affect how we use software as well as how it's written. They'll replace search sites because they'll be better at finding information and summarizing it for you. They'll replace many e-commerce sites because they'll find the best price for you and won't be restricted to just a few vendors. They'll replace word processors, spreadsheets, and other productivity apps. Businesses that are separate today-search advertising, social networking with advertising, shopping, productivity software-will become one business.

I don't think any single company will dominate the agents business--there will be many different AI engines available. Today, agents are embedded in other software like word processors and spreadsheets, but eventually they'll operate on their own. Although some agents will be free to use (and supported by ads), I think you'll pay for most of them, which means companies will have an incentive to make agents work on your behalf and not an advertiser's. If the number of companies that have started working on AI just this year is any indication, there will be an exceptional amount of competition, which will make agents very inexpensive.

But before the sophisticated agents I'm describing become a reality, we need to confront a number of questions about the technology and how we'll use it. I've written before about the issues that AI raises, so I'll focus specifically on agents here.

Nobody has figured out yet what the data structure for an agent will look like. To create personal agents, we need a new type of database that can capture all the nuances of your interests and relationships and quickly recall the information while maintaining your privacy. We are already seeing new ways of storing information, such as vector databases, that may be better for storing data generated by machine learning models.

Another open question is about how many agents people will interact with. Will your personal agent be separate from your therapist agent and your math tutor? If so, when will you want them to work with each other and when should they stay in their lanes?

How will you interact with your agent? Companies are exploring various options including apps, glasses, pendants, pins, and even holograms. All of these are possibilities, but I think the first big breakthrough in human-agent interaction will be earbuds. If your agent needs to check in with you, it will speak to you or show up on your phone. ("Your flight is delayed. Do you want to wait, or can I help rebook it?") If you want, it will monitor sound coming into your ear and enhance it by blocking out background noise, amplifying speech that's hard to hear, or making it easier to understand someone who's speaking with a heavy accent.

There are other challenges too. There isn't yet a standard protocol that will allow agents to talk to each other. The cost needs to come down so agents are affordable for everyone. It needs to be easier to prompt the agent in a way that will give you the right answer. We need to prevent hallucinations, especially in areas like health where accuracy is super-important, and make sure that agents don't harm people as a result of their biases. And we don't want agents to be able to do things they're not supposed to. (Although I worry less about rogue agents than about human criminals using agents for malign purposes.)

As all of this comes together, the issues of online privacy and security will become even more urgent than they already are. You'll want to be able to decide what information the agent has access to, so you're confident that your data is shared with only people and companies you choose.

But who owns the data you share with your agent, and how do you ensure that it's being used appropriately? No one wants to start getting ads related to something they told their therapist agent. Can law enforcement use your agent as evidence against you? When will your agent refuse to do something that could be harmful to you or someone else? Who picks the values that are built into agents?

There's also the question of how much information your agent should share. Suppose you want to see a friend: If your agent talks to theirs, you don't want it to say, "Oh, she's seeing other friends on Tuesday and doesn't want to include you." And if your agent helps you write emails for work, it will need to know that it shouldn't use personal information about you or proprietary data from a previous job.

Many of these questions are already top-of-mind for the tech industry and legislators. I recently participated in a forum on AI with other technology leaders that was organized by Sen. Chuck Schumer and attended by many U.S. senators. We shared ideas about these and other issues and talked about the need for lawmakers to adopt strong legislation.

But other issues won't be decided by companies and governments. For example, agents could affect how we interact with friends and family. Today, you can show someone that you care about them by remembering details about their life-say, their birthday. But when they know your agent likely reminded you about it and took care of sending flowers, will it be as meaningful for them?

In the distant future, agents may even force humans to face profound questions about purpose. Imagine that agents become so good that everyone can have a high quality of life without working nearly as much. In a future like that, what would people do with their time? Would anyone still want to get an education when an agent has all the answers? Can you have a safe and thriving society when most people have a lot of free time on their hands?

But we're a long way from that point. In the meantime, agents are coming. In the next few years, they will utterly change how we live our lives, online and off.

# data[].attributes.attachment_link.title
AI is about to completely change how you use computers

# data[].attributes.attachment_link.description
In 5 years, agents will be able to give health care advice, tutor students, do your shopping, help workers be far more productive, and much more