# data[].attributes.headline
The Lawfare Podcast: Unpacking Cyber Diplomacy with Ambassador Nathalie Jaarsma

# data[].attributes.subject
The Lawfare Podcast: Unpacking Cyber Diplomacy with Ambassador Nathalie Jaarsma

# data[].attributes.attachment_link.readable_text
This week, the UN ad hoc committee tasked with elaborating a cybercrime convention is meeting in New York. Delegates will be involved in in-depth negotiations of the draft convention, ahead of the concluding session in January 2024. The cybercrime convention is only one of many initiatives in the growing field of cyber diplomacy. Looming over this work is a big question: Is there enough common ground to pave the path for consensus?

Lawfare 's Fellow in Technology Policy and Law Eugenia Lostri sat down with Ambassador Nathalie Jaarsma, the Netherlands Ambassador at-Large for Security Policy and Cyber. They discussed the tensions plaguing the cyber negotiations in the UN, how diplomacy can help ensure accountability for malicious state behavior in cyberspace, and how to think about progress in the field.

# data[].attributes.attachment_link.title
The Lawfare Podcast: Unpacking Cyber Diplomacy with Ambassador Nathalie Jaarsma

# data[].attributes.attachment_link.description
Is there enough common ground to pave the path for consensus in cyber diplomacy?

# data[].attributes.headline
BLACKOUT : Approvisionnement et sécurité énergétique (conférence complète)

# data[].attributes.subject
BLACKOUT : Approvisionnement et sécurité énergétique (conférence complète)

# data[].attributes.attachment_link.title
BLACKOUT : Approvisionnement et sécurité énergétique (conférence complète) #blackout #energie

# data[].attributes.headline
Journalism in the Age of Spyware: Defending Freedom of the Press and Countering Threats

# data[].attributes.subject
Journalism in the Age of Spyware: Defending Freedom of the Press and Countering Threats

# data[].attributes.attachment_link.title
Journalism in the Age of Spyware: Defending Freedom of the Press and Countering Threats

# data[].attributes.headline
The Limits of AI: an overview of the history and philosophy of artificial thinking

# data[].attributes.subject
The Limits of AI: an overview of the history and philosophy of artificial thinking

# data[].attributes.attachment_link.title
The Limits of AI: an overview of the history and philosophy of artificial thinking

# data[].attributes.headline
Unrealistic expectations exacerbate the cybersecurity talent shortage

# data[].attributes.subject
Unrealistic expectations exacerbate the cybersecurity talent shortage

# data[].attributes.body
Consumers believe today’s cybersecurity talent shortage is in large part due to limited exposure to the profession and a lack of cybersecurity education and training at a younger age within school systems, according to ThreatX.

# data[].attributes.attachment_link.readable_text
Consumers believe today's cybersecurity talent shortage is in large part due to limited exposure to the profession and a lack of cybersecurity education and training at a younger age within school systems, according to ThreatX.

90% of consumers polled say they have concerns about the future of cybersecurity if more isn't done at an earlier stage to expose students to the field, and 62% agree that if they or their child had more established education around cybersecurity in school, including courses, clubs, and access to STEM programs, they would have considered entering the cybersecurity field.

Cybersecurity talent shortage

ThreatX surveyed 2,000 consumers across the US and UK to examine how they feel about today's cybersecurity talent shortage, their outlooks and concerns for the future if this trend continues, and what needs to be done to bring more exposure to this increasingly important field.

Results found that nine in 10 agree that not enough is being done to educate students on the opportunities open in cybersecurity, and 88% of consumers are concerned that today's cybersecurity talent shortage will negatively impact the security of their personal information.

The results show that limited exposure to and educational resources focused on cybersecurity are contributing to the industry's talent shortage as consumers are less inclined to explore these types of careers.

72% of consumers agree that limited exposure to the profession at a younger age, the belief that cybersecurity job candidates need a 4-year college degree to be considered, and the lack of cybersecurity education and training in schools are all to blame for the cybersecurity talent shortage.

It's clear that more needs to be done to ensure all students, from all backgrounds, receive more access to the field, and the opportunities that lie within it, to help shrink the gap.

"With more than 3.4 million cybersecurity jobs still open worldwide, the cybersecurity industry is in desperate need of professionals, but at the same time, it's still hard to get into the industry - both due to the unrealistic expectations of practitioners hiring today, but also in part due to limited exposure early on showcasing what's available in this field, as our survey results have found," said Gene Fay, CEO at ThreatX.

"To close the cybersecurity talent gap, security vendors and education systems will need to partner to create more opportunities from mentorship and learning in schools, to considering more diverse candidates who might not meet today's rigid degree requirements," Fay continued.

Focus on credentials

Opportunities in cybersecurity shouldn't be limited by resumes: 67% agree a career in cybersecurity should be achievable through certifications or apprenticeships versus a 4-year+ university degree.

Diverse exposure is important to shrink the talent gap: 52% say engaging students of all backgrounds earlier in proper STEM/cybersecurity courses will help minimize the talent shortage in the cybersecurity industry.

Cybersecurity training/exposure is best introduced at ages 12 - 15: 54% of consumers feel that adding STEM/cybersecurity courses into school curriculums at the US middle school/UK secondary school level is the best way to increase interest in a cybersecurity career later in life.

The findings from ThreatX's survey highlight that a larger effort needs to be put forth to ensure students of diverse backgrounds are given opportunities to learn about and interact with cybersecurity courses, trainings, and clubs.

By doing so, the industry will have a stronger chance at shrinking the current talent gap and diversifying the demographics currently dominating the profession. On top of this, the survey shows how security vendors can get involved by recognizing today's traditional hiring practice limitations.

Instead of looking for talent "unicorns," leaders should focus more on credentials like certifications, or on training candidates with potential to fill roles, in addition to pursuing those with diverse backgrounds, education, and ethnicities. The cyber community also has an important role to play in mentorship to help bring more talent to the field.

# data[].attributes.attachment_link.title
Unrealistic expectations exacerbate the cybersecurity talent shortage - Help Net Security

# data[].attributes.attachment_link.description
The lack of cybersecurity education and training in schools and degree expectations are to blame for the cybersecurity talent shortage.

# data[].attributes.body
Openai is releasing a guide for teachers using ChatGPT in their classroom—including suggested prompts, an explanation of how ChatGPT works and its limitations, the efficacy of AI detectors, and bias.

# data[].attributes.attachment_link.description
We’re releasing a guide for teachers using ChatGPT in their classroom—including suggested prompts, an explanation of how ChatGPT works and its limitations, the efficacy of AI detectors, and bias.

# data[].attributes.headline
Elevating the Role of Critical Minerals for Development and Security

# data[].attributes.subject
Elevating the Role of Critical Minerals for Development and Security

# data[].attributes.body
Over the next few decades, the role that copper and critical minerals play in achieving the energy transition, spurring economic development, and strengthening national security will continue to grow. The world is slowly shifting its energy mix to one that is greener, but this transition will require significant mining resources. This may seem counterintuitive, but many low-carbon technology components consist of key minerals and metals. According to the International Energy Agency, within 20 years, the energy sector’s demand for minerals may increase by as much as six times, and demand from the low-carbon energy generation sector will triple. One estimate by S&P Global suggests that more copper will need to be mined in the next few decades than has been extracted in the past several thousand years of human history.

# data[].attributes.attachment_link.readable_text
China and its state-owned enterprises are significantly ahead of the United States in production and ownership of smelting, refining, and mining assets, thereby giving it a leg up with respect to global processing. After making a shrewd bet in the 2000s by running operations at a loss with state subsidies making up the difference, China now dominates the industry. China accounts for 63 percent of the world's rare earth mining and has the most reserves of REEs in the world with 44 million metric tons of as of 2022. Meanwhile, the United States ranks sixth with 2.3 million metric tons. As of 2019, China was processing 65 percent of the world's cobalt, an important component of permanent magnets used in military technologies such as smart bombs, aircraft, and precision-guided missiles. What is most concerning is that China has already demonstrated its willingness to exploit supply-chain vulnerabilities by imposing sanctions against U.S. defense contractors and limiting exports of germanium and gallium; a Chinese trade policy official warned in July 2023 that such export controls are "just the start."

The United States has too little production capacity and possesses too few of the world's reserves to entertain the idea of self-sufficiency. It will need the support of partners and allies. Fortunately, countries in the Western Hemisphere are promising sources for many critical minerals, including REEs. Chile and Peru lead the world's copper production, while Mexico and Peru lead in silver production. Colombia is positioning itself to become a leading copper and gold producer. Moreover, Argentina, Bolivia, and Chile together possess roughly half of the world's current lithium reserves. Brazil has the third-largest reserves of REEs (tied with Russia) at 21 million metric tons.

Latin America's emergence as a source of some of these critical minerals is gaining attention, and competition for investment is increasing in the region. China is investing heavily in mining and energy projects throughout Latin America. State-owned enterprise PowerChina has more than 50 current energy projects across at least 15 countries in Latin America, including in Argentina, Brazil, Bolivia, Chile, and Peru. China has invested over $10 billion in Peru's mining industry, "controlling seven of Peru's largest mines, 100% of Peru's iron production, and 25% of their copper output." In 2021, Chinese company Ganfeng Lithium partially purchased one of Argentina's leading lithium mining projects, and Chinese company Zijin Mining plans to invest $380 million in a lithium carbonate plant in Argentina. The United States cannot afford for China to carry on without contest.

Broaden the Definition of Which Minerals Are 'Critical'

First, the U.S. government needs to reassess its current mineral-related definitions since rigid lists can stifle innovation, limit manufacturing capacity, and create future bottlenecks. For example, copper is the DOD's second-most utilized material, making it central to national security. Copper is an ideal material for building a sustainable world due to its resistance to corrosion, high ductility, malleability, recyclability, and thermal and electrical conductivity. Yet unlike some strategic allies, the U.S. government does not consider copper to be a critical mineral. The Canadian Critical Minerals Strategy, for example, recognizes copper's significance, and Canada has proposed a Critical Minerals Exploration Tax Credit of 30 percent to companies that support the exploration of copper and other minerals. In February 2023, a bipartisan group of U.S. senators wrote an open letter questioning the USGS's rejection of copper as an official critical mineral. The USGS's response acknowledged copper's importance and the possibility of reevaluation but ultimately dismissed its concerns.

Rather than overlooking what is not deemed "critical" or "strategic," the mineral security strategy should be more expansive. It is impossible to know which minerals future generations of cutting-edge technology will require. Disfavoring certain minerals could inhibit innovation and create shortages down the line. The validity of a mining operation should not be contingent on lists that fail to update at a satisfactory rate or rely on limited data. Rather, the U.S. mineral strategy should seek to be as nimble as possible.

Designate a Lead Agency and Craft a Comprehensive Strategy

Second, the U.S. government should designate a lead agency to spearhead a comprehensive mining strategy and harmonized federal regulations. Since 2010, U.S. policymakers have been refocusing attention on critical mineral supply chains by forming interagency working groups, issuing executive orders, and publishing white papers. However, the U.S. government has a fragmented approach in which several agencies and bureaus-including the Department of Energy, the Department of Labor, the Department of the Interior, the Department of Agriculture, the Army Corps of Engineers, and the Environmental Protection Agency -are involved in drafting mining regulation. Consolidating the development, management, and execution of mining policy would allow all branches of government to carry out a singular, comprehensive, and well-coordinated mining strategy that weaves this central sector into the economic, energy, environmental, and national security of the United States. Harmonizing U.S. agencies' efforts would benefit mining-related activities by preventing duplicative or clashing domestic and foreign policy agendas.

This is yet another way in which China is clearly outpacing the United States. Mining is a priority for China's economic diplomacy, especially through its Belt and Road Initiative-to which 22 Latin American countries have signed on since its launch in 2013. Beijing has free trade agreements with Chile, Costa Rica, Ecuador, and Peru, granting it easier access to their exports of minerals such as lithium, copper, gold, and iron ore. Nicaragua has also reportedly completed negotiations for a free trade agreement with China, and Honduras began its own negotiations in July. By contrast, U.S. engagement on mining issues in its backyard is woefully behind.

Increase Extraction and Processing at Home to Signal Commitment Abroad

Third, increasing mining operations domestically would signal to potential partners in the Western Hemisphere that the United States is not merely a buyer and is invested in developing its own mining capacity. In other words, the United States needs to overcome a firmly held "not in my backyard" attitude and start digging at home.

One main challenge is the cumbersome permitting process that stifles the level of domestic extraction. The U.S. permitting process is headed by the Department of Interior, which has timelines that are unfeasible for investors. In addition, it is not unheard of for the government to retroactively revoke permits, further disincentivizing firms from establishing domestic operations. In 2023, for example, the Army Corps of Engineers, at the Environmental Protection Agency's behest, retroactively revoked a permit to expand nickel and copper mining operations in Minnesota after Indigenous groups protested that the mine would fail to comply with more stringent tribal environmental standards.

Overhauling the permitting process has been dismissed as too daunting a task, but reforming the 151-year-old Mining Law of 1872 would not take much time-especially compared to the 7 to 10 years the average U.S. mining company waits to obtain a permit. For perspective, obtaining a mine permit takes 2 to 3 years in Australia and Canada.

Develop a More Compelling Narrative

Fourth, the United States needs to develop a more compelling narrative on the need to invest in mining abroad. China is central to U.S. supply chain vulnerabilities, but many developing nations see this as irrelevant. More captivating messaging could make potential partners in the Western Hemisphere view the United States as more attractive than China.

Similarly, the argument for U.S. defense needs falls flat with many Latin American countries, many of which already view expanded cooperation with the United States with a certain degree of suspicion. Some Latin American countries have raised concerns that U.S. attempts to spur greater collaboration on exploring, extracting, and processing critical minerals may not be mutually beneficial. For example, the establishment of the Minerals Security Partnership (MSP) in 2022, which does not include any Latin American countries, has reinforced worries that the United States is merely interested in extracting resources, not developing local industry. The United States should identify the areas in which it has comparative advantage and showcase its competitive strengths (including transferring technology and know-how, employing local professionals, and applying quality standards in mining and processing) to deter these countries from doing business with China.

At the same time, U.S. foreign policy is sometimes at odds with its domestic agenda. The Inflation Reduction Act of 2022 seeks to prioritize domestic production of minerals, yet few such operations exist. The Clean Vehicle Tax Credit and the Advanced Manufacturing Production Tax Credit of 2022 privilege domestically sourced critical materials over most foreign-sourced products-conflicting with other U.S. requirements for obtaining minerals from partners and coming as a shock to countries such as Brazil, with whom the United States had established a Critical Minerals Working Group in 2020.

Conclusion

Mining's strategic importance in ensuring decarbonization, strengthening national security, and contributing to economic development is understated, and the U.S. government currently lacks a coherent approach to it. The mineral-related imbalance in which the United States finds itself will only worsen if it does not adopt a comprehensive and bipartisan strategy. As the Department of Defense has articulated, correcting course will require a whole-of-government approach that includes companies, nongovernmental organizations, and government agencies. Mining's centrality to an effective, green transition and to military readiness makes reaching a consensus on this issue dire.
Daniel F. Runde is a senior vice president, director of the Project on Prosperity and Development, and holds the William A. Schreyer Chair in Global Analysis at the Center for Strategic and International Studies (CSIS) in Washington, D.C. Austin Hardman is a research assistant with the Project on Prosperity and Development at CSIS. The authors would like to thank Romina Bandura and Jasper Litton for their research support. This white paper was made possible by support provided by the Rio Tinto Group and was informed by a roundtable of experts held on June 27, 2023, also made possible by support from the Rio Tinto Group.

# data[].attributes.attachment_link.title
Elevating the Role of Critical Minerals for Development and Security

# data[].attributes.attachment_link.description
While China is reaping the benefit of being an early investor in the Western Hemisphere's mineral reserves, the United States is inadequately prepared for a mineral-intensive future.

# data[].attributes.headline
Nervous About ChatGPT? Try ChatGPT With a Hammer

# data[].attributes.subject
Nervous About ChatGPT? Try ChatGPT With a Hammer

# data[].attributes.body
Once generative AI can use real-world tools, it will become exponentially more capable. Companies and regulators need to get ahead of these rapidly evolving algorithms.

# data[].attributes.attachment_link.readable_text
Last March, just two weeks after GPT-4 was released, researchers at Microsoft quietly announced a plan to compile millions of APIs-tools that can do everything from ordering a pizza to solving physics equations to controlling the TV in your living room-into a compendium that would be made accessible to large language models (LLMs). This was just one milestone in the race across industry and academia to find the best ways to teach LLMs how to manipulate tools, which would supercharge the potential of AI more than any of the impressive advancements we've seen to date.

The Microsoft project aims to teach AI how to use any and all digital tools in one fell swoop, a clever and efficient approach. Today, LLMs can do a pretty good job of recommending pizza toppings to you if you describe your dietary preferences and can draft dialog that you could use when you call the restaurant. But most AI tools can't place the order, not even online. In contrast, Google's seven-year-old Assistant tool can synthesize a voice on the telephone and fill out an online order form, but it can't pick a restaurant or guess your order. By combining these capabilities, though, a tool-using AI could do it all. An LLM with access to your past conversations and tools like calorie calculators, a restaurant menu database, and your digital payment wallet could feasibly judge that you are trying to lose weight and want a low-calorie option, find the nearest restaurant with toppings you like, and place the delivery order. If it has access to your payment history, it could even guess at how generously you usually tip. If it has access to the sensors on your smartwatch or fitness tracker, it might be able to sense when your blood sugar is low and order the pie before you even realize you're hungry.

Perhaps the most compelling potential applications of tool use are those that give AIs the ability to improve themselves. Suppose, for example, you asked a chatbot for help interpreting some facet of ancient Roman law that no one had thought to include examples of in the model's original training. An LLM empowered to search academic databases and trigger its own training process could fine-tune its understanding of Roman law before answering. Access to specialized tools could even help a model like this better explain itself. While LLMs like GPT-4 already do a fairly good job of explaining their reasoning when asked, these explanations emerge from a "black box" and are vulnerable to errors and hallucinations. But a tool-using LLM could dissect its own internals, offering empirical assessments of its own reasoning and deterministic explanations of why it produced the answer it did.

If given access to tools for soliciting human feedback, a tool-using LLM could even generate specialized knowledge that isn't yet captured on the web. It could post a question to Reddit or Quora or delegate a task to a human on Amazon's Mechanical Turk. It could even seek out data about human preferences by doing survey research, either to provide an answer directly to you or to fine-tune its own training to be able to better answer questions in the future. Over time, tool-using AIs might start to look a lot like tool-using humans. An LLM can generate code much faster than any human programmer, so it can manipulate the systems and services of your computer with ease. It could also use your computer's keyboard and cursor the way a person would, allowing it to use any program you do. And it could improve its own capabilities, using tools to ask questions, conduct research, and write code to incorporate into itself.

It's easy to see how this kind of tool use comes with tremendous risks. Imagine an LLM being able to find someone's phone number, call them and surreptitiously record their voice, guess what bank they use based on the largest providers in their area, impersonate them on a phone call with customer service to reset their password, and liquidate their account to make a donation to a political party. Each of these tasks invokes a simple tool-an internet search, a voice synthesizer, a bank app-and the LLM scripts the sequence of actions using the tools.

We don't yet know how successful any of these attempts will be. As remarkably fluent as LLMs are, they weren't built specifically for the purpose of operating tools, and it remains to be seen how their early successes in tool use will translate to future use cases like the ones described here. As such, giving the current generative AI sudden access to millions of APIs-as Microsoft plans to-could be a little like letting a toddler loose in a weapons depot.

# data[].attributes.attachment_link.title
Nervous About ChatGPT? Try ChatGPT With a Hammer

# data[].attributes.attachment_link.description
Once generative AI can use real-world tools, it will become exponentially more capable. Companies and regulators need to get ahead of these rapidly evolving algorithms.

# data[].attributes.headline
Emerging Cybersecurity Challenges from AI-Powered Threats

# data[].attributes.subject
Emerging Cybersecurity Challenges from AI-Powered Threats

# data[].attributes.body
In the midst of the Ukraine crisis, the ever-expanding digital frontier faces a new breed of threats, empowered by artificial intelligence, as nations collaborate to fortify their cyber defenses.

Larger attack surfaces, with a growing amount of critical services online, as well as an larger pool of nefarious actors leveraging artificial intelligence, have shaped how defenders cooperate and operate. Still, this is only part of the puzzle, as adversaries also team up to empower their activities.

# data[].attributes.attachment_link.title
Emerging Cybersecurity Challenges from AI-Powered Threats

# data[].attributes.attachment_link.description
Growing online attack surfaces, AI-fueled threats, and international cooperation reshape cyber defense amid the Ukraine crisis.

# data[].attributes.headline
Schatz, ich habe die Daten geschrumpft: Wie die DNA-Speicherung Rechenzentren revolutioniert

# data[].attributes.subject
Schatz, ich habe die Daten geschrumpft: Wie die DNA-Speicherung Rechenzentren revolutioniert

# data[].attributes.body
Das wachsende Datenvolumen stellt für viele Anbieter von Datenspeichern eine große Herausforderung dar: Die Anforderungen an Speicherkapazität und Langlebigkeit steigen weiter konstant an. Hier kommt die DNA-Speicherung ins Spiel. Das sagen Experten zum aktuellen Stand.

# data[].attributes.attachment_link.readable_text
Registrierungspflichtiger Artikel

Datenspeicherung Schatz, ich habe die Daten geschrumpft: Wie die DNA-Speicherung Rechenzentren revolutioniert

Anbieter zum Thema

Das wachsende Datenvolumen stellt für viele Anbieter von Datenspeichern eine große Herausforderung dar: Die Anforderungen an Speicherkapazität und Langlebigkeit steigen weiter konstant an. Hier kommt die DNA-Speicherung ins Spiel. Das sagen Experten zum aktuellen Stand.

Kapazität, Kosten und Leistung. Drei der wichtigsten Prioritäten bei der Datenspeicherung? Ja. Und das ist kein Wunder. Das von uns produzierte Datenvolumen wächst rasant, täglich werden 2,5 Quintillionen Bytes an Daten erzeugt - und das hat Auswirkungen auf die Größe Ihres Rechenzentrums, die Reichweite Ihres Budgets sowie die Geschwindigkeit, mit der Daten verschoben werden können.

Die DNA-Speicherung verspricht Abhilfe. Diese Technologie ist in der Lage, Millionen und Abermillionen von Gigabytes in nur wenigen Partikeln zu speichern, und das für Tausende von Jahren.

# data[].attributes.attachment_link.title
Schatz, ich habe die Daten geschrumpft: Wie die DNA-Speicherung Rechenzentren revolutioniert

# data[].attributes.attachment_link.description
(Bild: frei lizenziert) Das wachsende Datenvolumen stellt für viele Anbieter von Datenspeichern eine große Herausforderung dar: Die Anforderungen an Speicherkapazität und Langlebigkeit steigen weiter konstant an. Hier kommt die DNA-Speicherung ins Spiel. Das sagen Experten zum aktuellen Stand.

# data[].attributes.headline
Cyber-Angriffe nehmen weltweit um 8 Prozent zu

# data[].attributes.subject
Cyber-Angriffe nehmen weltweit um 8 Prozent zu

# data[].attributes.body
Ein neuer Security Report wirft ein Licht auf die Verschmelzung alter und neuer Cyber-Kriminalitätsformen. Die Nutzung von KI und USB-Geräten als unerwartete Komplizen sowie die Dominanz von Lockbit3 bei Ransomware-Angriffen prägen die erste Jahreshälfte 2023.

# data[].attributes.attachment_link.readable_text
Check Point Research (CPR), die Threat-Intelligence-Abteilung von Check Point Software Technologies, hat den 2023 Mid-Year Security Report veröffentlicht. Der Bericht enthüllt eine beunruhigende Entwicklung: Die wöchentlichen Cyber-Angriffe weltweit stiegen im zweiten Quartal 2023 um acht Prozent an - der markanteste Anstieg der letzten zwei Jahre. Dabei kombinieren Angreifer auf raffinierte Weise modernste KI-Technologie mit bekannten Werkzeugen wie USB-Geräten, um innovative Angriffe durchzuführen. Der Bericht beleuchtet zudem den Anstieg von Ransomware-Angriffen in der ersten Jahreshälfte und das Auftauchen neuer Ransomware-Gruppen.

Der Mid-Year Security Report deckt verschiedene Aspekte auf:

Ransomware-Banden intensivieren ihre Angriffe und nutzen Schwachstellen in gängiger Unternehmens-Software aus. Ihr Fokus verlagert sich von der reinen Datenverschlüsselung hin zum Diebstahl von Daten.

USB-Geräte werden wieder zu einer bedrohlichen Waffe, da sowohl staatliche Gruppen als auch Hacker diese zur Infizierung von Organisationen weltweit einsetzen.

Hacker-Aktivismus (Hacktivism) nimmt zu, wobei politisch motivierte Gruppen gezielte Angriffe durchführen.

Künstliche Intelligenz wird sowohl für Angriffe als auch für Verteidigungszwecke immer häufiger genutzt. Dies erfordert strengere Kontrollen und Maßnahmen.

Der Bericht beleuchtet zudem Ransomware-Angriffe, bei denen Lockbit3 in der ersten Jahreshälfte 2023 besonders aktiv war und die Opferzahlen im Vergleich zum Vorjahr um 20 Prozent steigerte. Neue Gruppen wie Royal und Play treten auf den Plan, nachdem die Ransomware-as-a-Service-(RaaS)-Gruppen Hive und Conti aufgelöst wurden. 45 Prozent der Opfer befinden sich in den USA, wobei russische Organisationen unerwartet durch MalasLocker betroffen sind, eine Ransomware, die Lösegeldforderungen durch Spenden ersetzt. Die meisten Angriffe fanden im Produktionssektor und Einzelhandel statt.

Maya Horowitz, VP Research bei Check Point, unterstreicht die Wichtigkeit proaktiver Sicherheitsstrategien: „Kriminelle Aktivitäten sind in der ersten Jahreshälfte angestiegen. Ransomware und Hacktivismus sind gefährlicher geworden, mit verbesserten Methoden und Werkzeugen. Selbst alte Technologien wie USB-Geräte werden wieder genutzt. Unternehmen müssen eine Cyber-Resilienz-Strategie verfolgen, die Prävention und Sicherheitstechnologien kombiniert."

Die Ergebnisse basieren auf Daten aus der der Check Point ThreatCloud Cyber-Threat Map, welche die Taktiken von Hackern analysiert. Der vollständige Bericht ist hier erhältlich.

# data[].attributes.attachment_link.title
Cyber-Angriffe nehmen weltweit um 8 Prozent zu

# data[].attributes.attachment_link.description
Ein neuer Security Report wirft ein Licht auf die Verschmelzung alter und neuer Cyber-Kriminalitätsformen. Die Nutzung von KI und USB-Geräten als unerwartete Komplizen sowie die Dominanz von Lockbit3 bei Ransomware-Angriffen prägen die erste Jahreshälfte 2023.

# data[].attributes.body
KI-Systeme werden mit immer mehr Aufgaben in der Cybersicherheit betraut. Doch wie werden sich dadurch die Rollen von menschlichen CISOs und KI weiterentwickeln?

# data[].attributes.attachment_link.readable_text
Würde man eine Liste der Entwicklungen erstellen, mit denen sich CISOs am häufigsten beschäftigen, stünde KI sicherlich ganz oben auf der Liste. CISOs und Cybersicherheitsexperten sehen gleichzeitig enorme Risiken, Chancen und potenziellen Wohlstand in der Einführung von maschinellem Lernen (ML) und anderen KI-Entwicklungen.

Zudem wird KI laut dem IBM Global AI Adoption Index 2022 bereits von mehr als einem Drittel der Unternehmen eingesetzt. Mindestens 40 Prozent erwägen mögliche Anwendungen.

Wenn KI in absehbarer Zukunft eine zentrale Säule der Cybersicherheit wird, lohnt es sich, über eine Merkwürdigkeit im Diskurs über ihren Nutzen zu sprechen. Die Rolle der menschlichen Nutzer und der maschinellen Systeme, die im Idealfall viele der Sicherheits- und Wirtschaftsprobleme der digitalen Welt lösen, wird oft auseinandergehalten.

Die Interaktion zwischen Maschinen und Menschen wird dualistisch gesehen. Maschinen sind demnach Werkzeuge, die in verschiedenen Bereichen spezielle Vorteile bieten, während der Mensch einen Großteil der operativen Kontrolle behält.

Diese Tendenz ist bis zu einem gewissen Grad verständlich. Ohne die Entwicklung einer glaubwürdigen künstlichen Intelligenz (AGI), die meschliche Handlungen besser simulieren kann, werden KI-Systeme in der Tat nichts weiter sein als eine begrenzte, aber leistungsstarke Technik, um Aufgaben zu erfüllen. Selbst generative KI-Anwendungen, die zunehmend bestimmte Bereiche der Industrie zu revolutionieren scheinen, sind lediglich Musterdetektoren, die bei begrenzten Eingaben beeindruckende Vorhersagefähigkeiten bieten.

Gleichzeitig sindjedoch Unterstützungssysteme auf einer breiten Basis im Einsatz, die auf Grundlage menschlicher Einschätzungen arbeiten. Schließlich werden Werkzeuge und Modelle, die strategischen, moralischen und wirtschaftlichen Präferenzen von Unternehmen im Laufe der Zeit simulieren können, mehr Verantwortung gegenüber den menschlichen Akteuren erhalten.

Das Ergebnis ist, vereinfacht ausgedrückt, das Aufkommen von KI-CISOs. Sie werden de facto als Autoritäten für die Taktiken, Strategien und Ressourcenprioritäten ganzer Organisationen fungieren. Die heutigen menschlichen CISOs sollten darüber nachdenken, was dies für ihr Unternehmen bedeutet.

Lesetipp: Wäre GPT ein guter CISO?

Stellen Sie sich das folgende Szenario vor. Wir befinden uns einige Jahre in der Zukunft und KI-gestützte Cyber-Kampagnen aller Art - Spionage, Angriffe auf kritische Infrastrukturen - werden immer häufiger. Die durchschnittliche Kompromittierung von Systemen der Privatwirtschaft erfolgt um mehrere Größenordnungen schneller als im Jahr 2023.Die Rendite eines Angriffs pro Zugriffsstunde ist für Cyberkriminelle zwei- bis dreimal höher als heute.

Dies gilt jedoch nicht für Situationen, in denen defensive KI - ob intern entwickelt oder von Cybersicherheitsunternehmen bezogen - als Gegenmaßnahme eingesetzt wird, um Angriffe zu vereitel. Solche Gegenmaßnahmen sind jedoch kein Allheilmittel. Vielmehr handelt es sich um wirksame Instrumente, die sich jedoch in einem ständigen Beta-Zustand zu befinden scheinen. Die Logik des Wettrüstens beim Lernen der gegnerischen KI bedeutet, dass eine gute Verteidigung zu einem verbesserten Angriff führt.

Das logische Ergebnis einer solchen Situation ist der KI-CISO. Schließlich wird das, was so lange in menschlicher Hand lag, zwangsläufig in den Zuständigkeitsbereich von KI-Reaktionssystemen übergehen. Dazu gehören nicht nur grundlegende Aufgaben, die auf Entscheidungsregelwerke reagieren, sondern auch dynamische. Zum Teil könnte dies die Auswahl defensiver - oder aktiver - Verteidigungstaktiken und die Analyse der gegnerischen Strategie bedeuten.

Aber es geht auch um Werturteile und moralische Überlegungen. Die Entscheidung, welche Arten von Daten oder Datenzugriffen vorrangig geschützt werden sollten, enthält von Natur aus variable ethische Grundlagen, die sich auf Aktionärsinteressen, staatsbürgerliche Verantwortung, Gewinnkennzahlen, Governance-Grundlagen und Compliance-Standards beziehen. An einem bestimmten Punkt treffen menschliche Intelligenz und maschinelle Intelligenz in sinnvoller Weise aufeinander.

Lesetipp: Wie CISOs Risiken von KI abwägen können

Wie bereits angedeutet, birgt die Zusammenarbeit zwischen KI und Mensch potenzielle Vorteile in sich. Aber es gibt auch besorgniserregende Auswirkungen. Wenn der KI-Verteidiger von morgen als eine Art verteilte Schnittstelle zwischen Maschine und Mensch zu betrachten ist, dann müssen die heutigen Planer erkennen, dass die menschliche Handlungsfähigkeit in Zukunft eher repräsentiert als aktiv eingesetzt wird.

Die Vorteile des Aufbaus von Systemen, die de facto die Kontrolle über verschiedene Facetten der Cybersicherheit haben, liegen auf der Hand. Wenn ein KI-Wettrüsten, das sich an der Entwicklung bösartiger Bedrohungen für Unternehmen orientiert, unvermeidlich ist, dann sind KI-CISOs der Schlüssel dazu, dass die Verteidiger mithalten können. Da der Zeitrahmen, um auf Vorfälle zu reagieren, immer kürzer wird, werden Systeme, die Bedrohungen schnell erkennen und analysieren, mit ziemlicher Sicherheit dort ihre Stärken ausspielen, wo menschliche Mitarbeiter nicht mithalten können.

Ebenso werden die Metriken, die sich aus dem Einsatz solcher Systeme ergeben, mit ziemlicher Sicherheit zu iterativ besseren Produktionen von maschinellen Lernmodellen führen. Diese weisen klare Wertstrukturen auf, die sich für die Priorisierung von Bedrohungsabwehrmaßnahmen eignen. Kurz gesagt: Effizienz ist der klare Vorteil des KI-CISOs.

# data[].attributes.attachment_link.description
KI-Systeme werden mit immer mehr Aufgaben in der Cybersicherheit betraut. Doch wie werden sich dadurch die Rollen von menschlichen CISOs und KI weiterentwickeln?

# data[].attributes.headline
Unmasking Hypnotized AI: The Hidden Risks of Large Language Models

# data[].attributes.subject
Unmasking Hypnotized AI: The Hidden Risks of Large Language Models

# data[].attributes.body
The emergence of Large Language Models (LLMs) is redefining how cybersecurity teams and cybercriminals operate. As security teams leverage the capabilities of generative AI to bring more simplicity and speed into their operations, it’s important we recognize that cybercriminals are seeking the same benefits. LLMs are a new type of attack surface poised to make certain types of attacks easier, more cost-effective, and even more persistent.

# data[].attributes.attachment_link.readable_text
Cost of a data breach 2023: Financial industry impacts

According to the IBM Cost of a Data Breach Report 2023, the global average cost of a data breach in 2023 was $4.45 million, 15% more than in 2020. In response, 51% of organizations plan to increase cybersecurity spending this...

# data[].attributes.attachment_link.title
Unmasking Hypnotized AI: The Hidden Risks of Large

# data[].attributes.attachment_link.description
To what extent can Large Language Models (LLMs) be hypnotized into giving responses that pose a clear security risk?

# data[].attributes.headline
Baseline cyber threat assessment: Cybercrime - Canadian Centre for Cyber Security

# data[].attributes.subject
Baseline cyber threat assessment: Cybercrime - Canadian Centre for Cyber Security

# data[].attributes.body
This assessment is intended to inform cybersecurity professionals and the general public about the threat to Canada and Canadians posed by global cybercrime. This assessment will consider cybercrime’s early history, the development of the most significant cybercrime tactics, techniques and procedures (TTPs), and the current (at the time of writing) nature of the global cybercrime threat and its implications for Canada.

# data[].attributes.attachment_link.readable_text
About this document

This assessment is intended to inform cybersecurity professionals and the general public about the threat to Canada and Canadians posed by global cybercrime. This assessment will consider cybercrime's early history, the development of the most significant cybercrime tactics, techniques and procedures (TTPs), and the current (at the time of writing) nature of the global cybercrime threat and its implications for Canada.

Assessment base and methodology

The key judgments in this assessment rely on reporting from multiple sources, both classified and unclassified. The judgments are based on the Canadian Centre for Cyber Security's (Cyber Centre) knowledge and expertise in cyber security and are further supported by input from the Royal Canadian Mounted Police (RCMP).

Defending the Government of Canada's information systems provides the Cyber Centre with a unique perspective to observe trends in the cyber threat environment, which also informs our assessments. The Communication Security Establishment's (CSE) foreign intelligence mandate provides us with valuable insight into adversary behaviour in cyberspace. While we must always protect classified sources and methods, we provide the reader with as much justification as possible for our judgments.

Our judgments are based on an analytical process that includes evaluating the quality of available information, exploring alternative explanations, mitigating biases, and using probabilistic language. We use the terms "we assess" or "we judge" to convey an analytic assessment. We use qualifiers such as "possibly," "likely" and "very likely" to convey probability.

Assessments and analysis in this report are based on information available as of January 12, 2023.

Table of contents

Estimative language

The chart below matches estimative language with approximate percentages. These percentages are not derived via statistical analysis, but are based on logic, available information, prior judgements, and methods that increase the accuracy of estimates.

Long description - Estimative language chart

1 to 9% Almost no chance

10 to 24% Very unlikely/very improbable

25 to 39% Unlikely/improbable

40 to 59% Roughly even chance

60 to 74% Likely/probably

75 to 89% Very likely/very probable

90 to 99% Almost certainly

Key judgements

Ransomware is almost certainly the most disruptive form of cybercrime facing Canada because it is pervasive and can have a serious impact on an organization's ability to function.

We assess that organized cybercrime will very likely pose a threat to Canada's national security and economic prosperity over the next two years. Organized cybercriminal groups can impose significant financial costs on their victims. These groups often have planning and support functions in addition to specialized technical capabilities, such as bespoke malware development.

We assess that over the next two years, financially motivated cybercriminals will almost certainly continue to target high-value organizations in critical infrastructure sectors in Canada and around the world.

We assess that Russia and, to a lesser extent, Iran very likely act as cybercrime safe havens from which cybercriminals based within their borders can operate against Western targets.

We assess that Russian intelligence services and law enforcement almost certainly maintain relationships with cybercriminals and allow them to operate with near impunity. They do so as long as cybercriminals focus their attacks against targets outside of the Commonwealth of Independent States (CIS). The CIS currently consists of Russia, Belarus, Moldova, Armenia, Azerbaijan, Kyrgyzstan, Kazakhstan, Tajikistan, and Uzbekistan.

Overview

This assessment looks at the strategic threat to Canada posed by the global cybercrime market. The global cybercrime market is a connected ecosystem that is continuously evolving. It is made up of profit-driven cybercriminals who leverage different TTPs, and operate in regional networks across the globe. This assessment will consider cybercrime's early history, the development of the most significant cybercrime TTPs, and the current (at the time of writing) nature of the global cybercrime threat and its implications for Canada.

Cybercrime, for the purposes of this baseline threat assessment, refers to "criminal activity that targets a computer, a computer network, or a networked device for profit". While the RCMP defines cybercrime as "any crime where a cyber element has a substantial role in the commission of a criminal offence", this baseline threat assessment regards the former, more limited definition. We assess that this category of cybercriminal activity is almost certainly committed by individuals who are primarily financially motivated, regardless of where they are located. Cybercriminals vary widely in sophistication. However, most cybercriminals are opportunistic in their targeting and attempt to compromise targets in bulk using common "spray and pray" tactics such as phishing, social engineering, and exploit kits. Some cybercriminals have also adopted sophisticated targeted attack methodologies in their operations.

We assess that organized cybercrime will very likely pose a threat to Canada's national security and economic prosperity over the next two years. Cybercriminal groups often have planning and support functions in addition to specialized technical capabilities, such as bespoke malware development.

Cybercriminals are continuously evolving the tactics that let them achieve their primary goal of maximizing profits. Cybercrime has evolved from online theft and credit card fraud to more elaborate ways of extorting victims as the attack surface for cybercriminals has expanded. The increasingly interconnected nature of the modern global economy has provided a growing number of opportunities for cybercriminals as victims' dependencies on technology continue to grow.

A brief early history of cybercrime

The birth of profit-driven cybercrime

The 1990s marked the beginning of a technical revolution whereby home computers and Internet access became commonplace and humans across the globe were more connected than ever before. The digitization of personal data and commerce in the '90s created new and novel opportunities for financial prosperity, both licit and illicit, contributing to an emergence of profit-driven cybercrime in a range of countries including the US, Russia, and the People's Republic of China (PRC). In fact, each geographical location produced its own brand of cybercrime. The North American cybercrime community is more open and accessible to both cybercriminals and law enforcement, whereas the Russian-speaking community is more closed. For example, Russian forums are generally more closed and often require a vetting process to gain entry.

The dawn of forums and marketplaces

In its early days, cybercrime was a largely informal, recreational cottage industry. The turn of the millennium brought the introduction of online forums that facilitated the exchange of information and acted as marketplaces. This was the effective birth of the true cybercrime market and the increasingly professional industry that followed.

Today, cybercriminals use highly developed and specialized forums, or dark web marketplaces (see text box), to seek advice and discuss the latest TTPs. Vendors also commonly offer access to internal systems, website accounts, databases, credentials, tools, malware, credit card details, and exploit kits.

Forums have emerged that specifically focus on various aspects of cybercrime. For example, some address the technical aspects of cybercrime, such as malware and botnets. Others specialize in areas like hacking and zero-day vulnerabilities. Still more exist to support click fraud and spam. Some forums focus on trade, while others centre on discussion. Sites for generalists provide a broad range of sub forums on various topics, while specialist boards emphasize core topics like spam.

Certain forums have also been developed to specialize not only by subject, but also by language. While cybercriminals conduct business in many different languages, Russian-language forums have stood alongside English-language ones as the most significant for the global market. These forums can be thought of as the technical engine rooms of global cybercrime, hosting hackers, coders and those representing them. A key factor of these forums is that they provide a "safe space" to discuss ideas, share information, and coordinate attacks.

Dark web, deep web, and beyond

The dark web is an unindexed segment of the Internet that is only accessible by using specialized software or network proxies such as Tor. Due to the inherently anonymous and privacy-centric nature of the dark web, it facilitates a complex ecosystem of cybercrime, and illicit goods and services trade.

Adjacent to the dark web is the deep web, which is made up of websites and content that are not indexed by search engines. Instant chat platforms play an increasingly critical role in facilitating access to this illicit information.

Pseudo-anonymous discussion forums and vendor marketplaces hosted on the deep and dark web, along with private and public Telegram channels, provide additional platforms by which cybercriminals communicate and circulate sensitive and stolen credential data.

Profit-driven TTP development

The historic development of the global cybercrime market was led by the profit-driven nature of cybercrime. This has similarly influenced the development of cybercrime TTPs to the present day. Financially motivated cybercriminals have continuously chosen targets and deployed tools to maximize their potential profits within their particularly assessed level of risk. TTPs range from credential phishing and stealing funds directly from individual customers to deploying ransomware on large networks and extorting profits from large organizations.

The evolution of phishing

The term "phishing" was first used and recorded in 1996 by a group of hackers who posed as employees of America Online, a then-popular online service provider. They used instant messaging and email to steal users' passwords and gain access to their accounts. In the early 2000s, phishers turned their attention to online payment systems. For example, in 2003, cybercriminals started registering domain names that were slight variations of legitimate commerce sites, such as eBay and PayPal. They then sent mass mailings asking customers to visit the sites, enter passwords, and update their credit card and other identifying information.

As online social networks proliferated, phishing attacks started harvesting personal data to customize messages to better fool recipients. This gave rise to spear-phishing, whereby cybercriminals send personally tailored messages to more precisely selected sets of recipients to improve their chances of success. It also introduced whaling, a highly customized spear-phishing attack that targets executives or other high-profile recipients with privileged access and authorities. Both techniques are very common, widely successful, and are used by state-sponsored cybercriminals.

Throughout the pandemic, cybercriminals have used COVID-19-related content in phishing campaigns to trick victims into clicking on malicious links and attachments. These in turn distribute information-stealing malware and, to a lesser extent, ransomware on personal computers and mobile devices.Footnote 6 Cybercriminals have also used major events, such as elections and the Russian invasion of Ukraine, as a lure in phishing and malware campaigns.Footnote 7 Today, phishing emails are a common initial access point for ransomware attacks.

Phishing lures

Cybercriminals and fraudsters use tactics to trick victims into providing personal information. These tactics can be referred to as "phishing lures" or "bait". Common phishing lures leverage themes related to current events (e.g. Ukrainian relief efforts, COVID-19), or make messages appear to be coming from trusted entities to compel victims to click a phishing link and share personal information or download a malicious attachment.

According to Canadian Anti-Fraud Centre (CAFC) victim reporting (January 1, 2022 to January 1, 2023), these are the top sectors and entities being impersonated.ootnote 8

Banking trojans unleashed

Figure 1: Cyber threat tools

Botnet

A network of computers forced to work together on the command of an unauthorized remote user. This network of compromised computers is used to attack other systems.

Repurposed legitimate tools

Some legitimate tools which were designed for use by cyber security professionals to identify security vulnerabilities. These same tools can be used for criminal purposes.

Exploit kit

A type of toolkit used by cybercriminals to attack vulnerabilities in systems so they can distribute malware or perform other malicious activities. Exploit kits are packaged with exploits that can target commonly installed software.

Malware

Malware is malicious software that allows an individual to perform unauthorized tasks on a computer. There are many categories of malware like viruses, spyware, keyloggers, and ransomware.

Commodity malware infections: Precursors to ransomware attacks

Malware such as Emotet and Trickbot that were initially used as banking trojans have morphed into initial access tools for follow-on activity, such as the deployment of ransomware (see Figure 2). Specialized cybercriminals, known as initial access brokers, compromise victims using first-stage malware. Once they gain access, they then sell that access to ransomware operators to deploy data theft and encryption operations.

Long description - Bots and banking trojans timeline

A timeline depicting the use and evolution of certain banking trojans (Zeus, Gozi, QakBot, Gozi ISFB, Dyre, Emotet and Trickbot), malware loaders (BazartLoader and Bumblebee) and botnets (Kelihos and GameOver Zeus) from 2005 to 2022.

Although the original version of Zeus has been largely neutralized by anti-virus software, its source code has been publicly available since 2011, and a number of variants have been developed, including GameOver Zeus, Dridex, and Shylock.

Also known as Ursnif, Gozi is one of the oldest banking trojans. In 2010, and again in 2015, the Gozi source code was leaked, which led to the creation of several different versions of the malware. Although the scope has expanded for many other banking trojans, Gozi continues to primarily target financial institutions.

Emotet has been connected to other banking trojans - including Dridex and Trickbot - and is also used for initial access by ransomware operators. Despite coordinated disruption of its infrastructure by international law enforcement in January of 2021, Emotet once again began spamming malicious emails worldwide as of November 2022.

This shift is representative of a larger transformation across the global cybercrime market. Some cybercriminal enterprises are moving away from mass-scale smash-and-grab attacks, which continue to impact targets with less hardened defences, towards operations that demonstrate more patience and sophistication.

The rise of ransomware

While proof-of-concept ransomware appeared as early as 1989, the first modern campaign is typically attributed to the CryptoLocker ransomware, administered by Russian cybercriminals from September 2013 to May 2014. During this timeframe, according to Federal Bureau of Investigation reports, CryptoLocker infected nearly 500,000 victims, earning as much as CAN$27 million.Footnote 11 From 2014 to 2016, the CryptoLocker model of ransomware (typically emails with malicious attachments distributed through scattershot campaigns) proliferated, emerging mostly from the Russian-speaking cybercrime community.

Ransomware has become one of the most devastating types of cybercrime, impacting individuals, businesses, and government agencies. Successful cybercriminals in the ransomware industry can rapidly develop and adapt their malware to capitalize on evolving global, national, or regional contexts, and the resultant changes in the vulnerabilities of target organizations. Many of them operate from safe havens, countries which willingly turn a blind eye to, or are unable to interrupt, cybercrime within their borders.

The global cybercrime market

Like any legal marketplace, the global cybercrime market exists for buyers and sellers to find each other and transact. Unlike a legal marketplace, the global cybercrime market facilitates an array of cybercrime including banking attacks, payment card frauds, identity theft, and ransomware. This market operates mostly in closed and private Internet forums, or private (or encrypted) messaging platforms.

An interconnected threat environment

This industrialization of the global cybercrime market increases the potential impact of any cybercrime incident, which might involve several different types of cybercrime before it is discovered. For example, a cybercriminal engaged in the theft of privileged or personal information can profit from this activity by selling that data to criminals, including other cybercriminals, who in turn might use it to gain privileged access and conduct separate activity. Ransomware, in particular, depends on and is enabled by several other forms of cybercriminal activity. Before cybercriminals can deploy ransomware onto victim networks, they must determine their targets, gain access to target systems or networks, and escalate their access privileges to stage their attack.

The ransomware-as-a-service industry

The predominant business model of ransomware is called ransomware-as-a-service (RaaS). RaaS starts with a core group developing the ransomware itself. They then let contractors, known as "affiliates," use their ransomware to attack victims. The core group often handles the malware development, sets rules for target selection (such as avoiding targeting certain institutions or countries), oversees affiliate activity, carries out negotiations, and accepts ransom payment.

Affiliates are often responsible for gaining access to victim networks, ensuring the collection of data, locating data backups, and deploying the ransomware. Often, affiliates take a large cut of the proceeds, sometimes up to 80%. These are not hard-and-fast rules, and they can change depending on the group.

The presence of the certain strategic and supply chain elements is required for RaaS to be a successful business model (see figure 3).

Long description - Strategic and supply chain elements of the global cybercrime market
Strategic elements

Permissive state attitudes / geopolitical alignment

Available talent pool

Victim availability and susceptibility

Cryptocurrencies

Policy and governance

Supply chain elements

Marketplaces / Forums

Hosting infrastructure

Access

Malware

Communications

Financial services

Strategic elements of the global cybercrime market

The top-level strategic elements of the global cybercrime market are system-wide elements that modern organized cybercriminal groups and individual cybercriminals require to successfully engage in, and profit from, the business of cybercrime.

Permissive state attitudes: Cybercriminals often operate in jurisdictions where governments either overtly permit or at least turn a blind eye to cybercrime activities, so long as they only target victims outside their home country.Footnote 17

Available talent pool: Currently, there is a significant body of technically skilled individuals who are willing to participate in organized criminal activities.Footnote 17

Victim availability and susceptibility: A large pool of victims needs to be available and have sufficient weaknesses that can be exploited. Organizations and individuals are predominately targeted by cybercriminals in an opportunistic manner.

Cybercriminals perceive that organizations which possess valuable intellectual property or significant personally identifiable information (PII), and organizations that have a low tolerance for downtime are more likely to pay ransoms to prevent the publication of stolen files to restore hijacked systems, or both.

Cryptocurrencies: The emergence of cryptocurrencies has provided new and novel ways to transfer money among victims, cybercriminals, and organized cybercriminal groups. Cryptocurrencies allow cybercriminals to receive and launder large payments in an anonymous or pseudo-anonymous way. By contrast, transferring large ransom payments via a bank or conventional payment service provider would quickly be flagged and traced.

Cryptocurrencies and blockchain technology offer cybercriminals an array of obfuscation tools to efficiently launder illicit funds. They do so by obscuring the flow of value from sender to receiver within and across blockchains.

Policy and governance: Policies regarding cyber security, support for compromised companies, and the legality/permissibility of payments impact the ability or willingness of cybercriminals to conduct attacks. Policy and governance may encompass laws, industry norms, and insurance policies.

The cybercrime supply chain

The cybercrime supply chain refers to the global production and coordination of goods and services that support cybercriminal activity. Like many other businesses, there are many links to the supply chain that hold up cybercrime industries across the world, including the following 6 high-level categories:

Marketplaces/Forums: Areas in which cybercriminals procure services, share tradecraft, purchase exploits, and/or recruit additional members. These can be open (i.e. anyone can access) or closed, requiring payment, vouching, or some other submission to enter. These marketplaces and forums are typically hosted on the dark web.

Hosting infrastructure: Cybercriminals require dedicated hosting infrastructure to host their malware, enable communication, and store exfiltrated data. Some hosting infrastructure that is operated by legitimate entities, such as public cloud service providers, is abused for the purpose of engaging in cybercrime activities.

Access: Cybercriminals require ways to access a victim's system. This often includes purchasing exploits, zero days, or access directly from an access broker online. An access broker is an individual who specializes in gaining illicit access to an organization.

Malware: Cybercriminals develop, purchase, or simply use already existing malware to conduct their attacks. A typical cybercrime operation will require several forms of malware throughout its campaign including reconnaissance, intrusion/staging, and exploitation/infection before proceeding to cause specific impact to the victim.

Communications: Cybercriminals need to be able to acquire the infrastructure and capabilities to communicate, both internally and externally.

Financial services: This consists of the tools and means that illicit organizations use to conduct their business, including different ways of accepting or transferring money which may include cryptocurrencies or money laundering techniques.

The state-cybercrime nexus

Beyond solely financially motivated cybercrime, the Cyber Centre has observed some cases where state-sponsored cyber threat activity and cybercrime overlap. This activity ranges from state-sponsored threat actors tasking cybercriminals to achieve strategic goals or fulfill intelligence requirements, to state-sponsored cyber actors engaging in cybercrime outside of their official capacity in pursuit of personal profit.

We assess that Russia and, to a lesser extent, Iran very likely act as cyber-crime safe havens from which cybercriminals based within their borders can operate against Western targets with immunity. We further assess that both Russian and Iranian state-sponsored cyber threat actors will use ransomware to obfuscate the origins or intentions of their cyber operations.

Russia

We assess that Russian intelligence services and law enforcement almost certainly maintain relationships with cybercriminals and allow them to operate with near impunity. They do so as long as cybercriminals focus their attacks against targets located outside Russia and CIS countries. Consequently, many of the most sophisticated and prolific cybercriminals are Russia-based. In 2019, the US Department of Justice indicted the leader of the Russia-based EvilCorp cybercriminal group for providing direct assistance to the Russian Federation's malicious cyber efforts. In April 2021, the US Department of the Treasury stated that the Russian Federal Security Service cultivates and co-opts cybercriminals, including EvilCorp, enabling them to engage in disruptive attacks.

In November 2022, vendor reporting attributed the Prestige ransomware campaign, which targeted organizations in the transportation and related logistics industries in Ukraine and Poland, to Russian military intelligence cyber actors. In June 2017, cyber threat actors launched destructive cyber attacks masquerading as ransomware, dubbed NotPetya, against Ukraine that quickly proliferated globally, causing over CAN$10 billion in global damages.Footnote 21 Canada has assessed that Russian actors developed the NotPetya ransomware.Footnote 22 AustraliaFootnote 23, New ZealandFootnote 24, the United KingdomFootnote 25, and the USFootnote 26 assess that Russia was directly responsible for the June 2017 attack.

Iran

The relationship between Iran-based cybercriminal groups and Iranian intelligence remains unclear. For example, Iran-based cybercriminals have been observed carrying out ransomware attacks and website defacements against targets in the US, Israel, and the Gulf States in response to major geopolitical events such as the killing of Islamic Revolutionary Guard Corp (IRGC) commander Qassem Soleimani in 2020.Footnote 27 However, while the US, Israel, and the Gulf States are Iran's main geopolitical rivals, they are also relatively wealthy countries that provide financially motivated Iranian cybercriminals with lucrative targets to attack and exploit.

According to third-party industry reporting, between late July 2020 and early September 2020, Iran's IRGC operated a state-sponsored ransomware campaign through an Iranian contracting company. It mimicked the TTPs of financially motivated ransomware groups to avoid attribution and maintain plausible deniability.

How cybercrime impacts Canada

Cybercrime continues to be the cyber threat activity that is most likely to affect Canada and its allies, including Canadian organizations of all sizes.

Fraud, scams, and theft in Canada

Fraud and scams are almost certainly the most common form of cybercrime that Canadians will experience over the next two years, as cybercriminals attempt to steal personal, financial, and corporate information via the Internet. Fraud and scams, including malicious cyber threat activity such as phishing, result in significant financial losses. According to the CAFC there were 70,878 reports of fraud in Canada with over $530 million stolen in 2022.Footnote 30 Cybercriminals sell stolen PII, credit card information, and compromised credentials on darknet marketplaces and Telegram channels. In some cases, information stolen during frauds and scams is leveraged to conduct other cybercrime, such as ransomware.

SuperPhish: Business email compromise

One of the most financially damaging forms of cybercrime targeting Canadian organizations is business email compromise (BEC). BEC is a type of email cybercrime scam in which attackers infiltrate a legitimate corporate email account and use the access to send phony invoices of initial contract payments that trick the business or its clients into wiring money to cybercriminals when they think they're just paying their bills.

BEC attacks, many of which originate in West Africa and specifically Nigeria, are historically less technical. They rely more on social engineering, the art of creating a compelling narrative that tricks victims into taking actions against their own interests, making them also a sophisticated endeavour to complete successfully.

Ransomware in Canada

We assess that ransomware is almost certainly the most disruptive form of cybercrime that Canadians face and has significant impacts beyond the financial cost of the ransom itself. Cyber security reporting indicates that ransom payments have increased since 2020, likely driven in part by increasingly significant demands against larger organizations. The emergence of cyber insurance policies which cover ransomware payments may have implications for the prevalence of ransomware in Canada.

Long description - Canadian victims of ransomware in 2022 (by sector)

Canadian victims of ransomware, by sector, from January 1, 2022 to December 31, 2022.Footnote 33

Business and professional services 14%

Construction 3%

Energy and utilities 3%

Finance 3%

Food 4%

Government 6%

Healthcare and pharmaceuticals 7%

Information and communication technology 8%

Insurance 1%

Manufacturing 18%

Media 1%

Non-profit, international organizations, NGOs 7%

Other 1%

Other education 2%

Post-secondary academia and research institutions 7%

Real estate 3%

Retail and consumer goods 8%

Tourism 1%

Transportation 4%

The value of the ransom paid often represents only a portion of the total cost to the organization, which can also include lost value associated with downtime, lost value of unrecoverable data, costs of repairing systems, and reputational damage from downtime or leaked information associated with the ransomware event. Many ransomware operators use "double extortion" tactics in which they both encrypt victim systems and threaten to publish or sell stolen victim data.

Paying a ransom demand does not guarantee that a victim's systems will be restored, that they will not be targeted again in the future, or even that exfiltrated data will be deleted by the cybercriminal. One survey of Canadian businesses found that only 42% of organizations who paid the ransom had their data completely restored. Further, some ransomware operators retain backdoor access to victim networks following ransom payment. At least one ransomware platform has generated false evidence to reassure a victim that their stolen sensitive information has been deleted from the attacker's servers.

Ransomware affecting Canada

The Cyber Centre maintains a database of ransomware incidents affecting Canadian victims. Based on incident data from January 1, 2022 to December 31, 2022, the top 10 ransomware threats to Canada are:

LockBit

Conti

BlackCat/ALPHV

Black Basta

Karakurt

Quantum

Vice Society

Hive

Royal

AvosLocker

Most of these ransomware variants are maintained by financially motivated, Russian-speaking cybercriminals based in CIS countries.

Big game hunting

We assess that over the next two years, financially motivated cybercriminals will almost certainly continue to target high-value organizations in critical infrastructure sectors in Canada and around the world.

Although business email compromise is very likely more common and costlier than ransomware to victims, we assess that ransomware is almost certainly the main cybercrime threat to the integrity of systems, facilities and technologies, and the supply of products and services essential to the well-being of Canadians and the Government of Canada.

CI is a particularly attractive target for ransomware. CI operators are perceived by cybercriminals to be more willing to pay significant ransoms to limit or avoid physical disruption and follow-on impacts to their customers. Two ransomware incidents in May 2021 against Colonial Pipeline and JBS Foods in the United States alone resulted in multimillion-dollar payouts for cybercriminals in addition to significant disruptions to fuel and food supply chains.

Five months later in October 2021, Canada fell victim to a ransomware attack on a healthcare system in the province of Newfoundland and Labrador. Hive ransomware group was responsible for the attack that caused an IT systems outage, affecting more than one in every 10 people in the province and incurring just under $16 million in damages.

Once again, the Canadian healthcare sector was disrupted in December 2022 when SickKids hospital in Toronto was attacked by a "partner" of LockBit ransomware group. While the impact of the attack on patients and families was minimal, some patients did experience diagnostic or treatment delays. Despite a public apology from LockBit and an offer to share the decryptor with the hospital, this attack on the country's largest paediatric hospital is representative of the large-scale impact that ransomware groups such as LockBit can have on Canadian CI.

Long description - Cybercrime incidents impacting operational technology in 2020

Date

Lead

Description

We assess that organized cybercriminal groups will almost certainly continue to target CI providers, including organizations in Canada, in medium-sophistication attacks to try to extract ransom, steal intellectual property and proprietary business information, and obtain personal data about customers.

Cybercriminal activity has the potential to disrupt operations and critical delivery of products by limiting a company's access to essential business data in the IT network or preventing safe control of industrial processes in the operational technology (OT) network. The disruption or sabotage of OT systems in Canadian CI poses a costly threat to owner-operators of large OT assets and could conceivably jeopardize national security, public and environmental safety, and the economy.

Targeting supply chains and MSPs

We assess that cybercriminals are likely to continue compromising Managed Service Providers (MSPs) (companies that host and manage their clients' IT resources) and software supply chains to maximize the number of potential victims and profits per compromise. Cybercriminals conducting operations against these types of targets are financially motivated and either seek to exfiltrate commercially valuable information for sale, extort victims through the deployment of ransomware, or deploy cryptojackers (malware that "mines" cryptocurrency using the resources of an infected device).

Cybercriminal supply chain compromises are particularly concerning given the lack of discrimination in their targeting. Supply chain compromises have the potential to expose a wide cross-section of organizations to business disruptions, including elements of critical infrastructure such as schools, hospitals, utilities, and other typical Big Game Hunting targets.

For example, in July 2021, Russia-based ransomware actors compromised and spread ransomware via Kaseya's Virtual System Administrator service, a system used by MSPs to manage their clients' networks. Cybercriminals were able to distribute the ransomware to approximately 60 MSPs and 1,500 of their clients from across North America, Europe, Australia, and New Zealand.Footnote 43 After a few days of demanding ransoms from individual victims, the cybercriminals reportedly demanded an extremely high ransom of US$70 million in Bitcoin to decrypt the files of all affected organizations.

Outlook

Over the next two years, we assess that cybercrime activity in Canada will very likely increase. So long as cybercriminals can extract financial profit from Canadian victims, they will almost certainly continue to mount campaigns against Canadian organizations and individuals. Moreover, cybercriminals continue to show resilience and an ability to innovate their business model to remain profitable.

# data[].attributes.attachment_link.title
Baseline cyber threat assessment: Cybercrime - Canadian Centre for Cyber Security

# data[].attributes.attachment_link.description
Assessment of the threat to Canada and Canadians posed by global cybercrime

# data[].attributes.body
Laut einer Studie wurden 45% der hiesigen Grossunternehmen bereits einmal angegriffen. Dabei sind längst nicht alle Firmen so gut vorbereitet, wie sie sein sollten. Beinahe jedes zweite Grossunternehmen in der Schweiz ist bereits einmal Opfer eines Cyberangriffs geworden. Dies zeigt der Swiss-VR-Monitor, eine halbjährlich durchgeführte Umfrage unter Verwaltungsräten. Die Resultate zeigen, dass KMU im Gegensatz zu grösseren Unternehmen deutlich weniger von Cyberkriminalität betroffen sind: Nur 18% der Firmen mit unter 50 Mitarbeitenden gaben an, dass sie einen schwerwiegenden Angriff zu bewältigen hatten.

Als Grund für den Zusammenhang zwischen der Unternehmensgrösse und der Häufigkeit der Angriffe erklärte Deloitte, dass Grossunternehmen global stärker exponiert seien und Cyberkriminellen grössere Angriffsflächen bieten würden. "Eine weitere Erklärung für die vermeintlich geringere Betroffenheit bei kleineren Unternehmen ist das teilweise fehlende Reporting über solche Vorfälle gegenüber dem Verwaltungsrat", heisst es im Bericht.

# data[].attributes.attachment_link.readable_text
SPONSORED BY:

Senior Consultant SAP CX/CRMBaden/Dübendorf/Oftringen/Homeoffice

PCP-Gruppe macht dicht, alle Filialen geschlossen

Die PCP-Gruppe stellt den Betrieb aufgrund fehlender Finanzierung vorläufig ein. Noch im Frühling hatte Steg Eletronics, das zur Gruppe gehört, weitere Filialen eröffnet.

Von Reto Vogt, aktualisiert am 9.9.2023 1

Spionagefirma NSO Group nutzt brandneue Apple-Lücken

Die umstrittene Spyware-Firma ist bereits vom iPhone-Konzern verklagt worden. Sie macht aber weiter: Derzeit sind iPhones, iPads, Macs und Apple Watches bedroht.

Von Thomas Schwendener, publiziert am 8.9.2023

DDoS-Angreifer NoName gehen wieder auf die Schweiz los

Die Gruppe hat zahlreiche europäische CERTs attackiert, auch die Website govcert.ch. Der Angriff sei aber schnell abgewehrt worden, erklärt uns das NCSC.

Von Philipp Anz, publiziert am 8.9.2023

Lockbit legt Stadtverwaltung von Sevilla lahm

Ein Ransomware-Angriff hat heftige Auswirkungen auf Polizei, Feuerwehr und andere Dienste der spanischen Stadt. Diese weigert sich, Millionen an Lösegeld zu bezahlen.

Von Philipp Anz, publiziert am 8.9.2023

# data[].attributes.attachment_link.description
Laut einer Studie wurden 45% der hiesigen Grossunternehmen bereits einmal angegriffen. Dabei sind längst nicht alle Firmen so gut vorbereitet, wie sie sein sollten.

# data[].attributes.body
Cybersecurity law has many silos. If a teenager’s private photo is hacked from Google Drive, lawyers think about anti-hacking statutes like the Computer Fraud and Abuse Act. If the U.S. government seeks access to the same photo from the same account, lawyers think about the Fourth Amendment and criminal procedure rules like the Electronic Communications Privacy Act. If the British government seeks access to that photo, lawyers think about mutual legal assistance treaties and the CLOUD Act. If the Russian government accesses that photo, lawyers think about national security law. If Google were to launch a new social network that automatically shares its users’ photos, lawyers would think about privacy policies and privacy statutes. Cybersecurity law is the intersection of all those silos; it is the law of who may control which computer.

As I argue in this article, cybersecurity is both a technical problem and a social problem. Network defense is the technical half of cybersecurity, but law is the social half. While regulating how computers behave is an important part of cybersecurity, regulating how humans and governments behave is just as important. Law is the foundation of cybersecurity because law defines the “security” in cybersecurity, who is entitled to that security, and how human beings and governments should behave to guarantee cybersecurity.

# data[].attributes.attachment_link.readable_text
Cybersecurity law has many silos. If a teenager's private photo is hacked from Google Drive, lawyers think about anti-hacking statutes like the Computer Fraud and Abuse Act. If the U.S. government seeks access to the same photo from the same account, lawyers think about the Fourth Amendment and criminal procedure rules like the Electronic Communications Privacy Act. If the British government seeks access to that photo, lawyers think about mutual legal assistance treaties and the CLOUD Act. If the Russian government accesses that photo, lawyers think about national security law. If Google were to launch a new social network that automatically shares its users' photos, lawyers would think about privacy policies and privacy statutes. Cybersecurity law is the intersection of all those silos; it is the law of who may control which computer.

As I argue in this article, cybersecurity is both a technical problem and a social problem. Network defense is the technical half of cybersecurity, but law is the social half. While regulating how computers behave is an important part of cybersecurity, regulating how humans and governments behave is just as important. Law is the foundation of cybersecurity because law defines the "security" in cybersecurity, who is entitled to that security, and how human beings and governments should behave to guarantee cybersecurity.

# data[].attributes.headline
Navigating the Risks of Artificial Intelligence on the Digital News Landscape

# data[].attributes.subject
Navigating the Risks of Artificial Intelligence on the Digital News Landscape

# data[].attributes.body
For decades, newsrooms have found themselves in varying states of crisis as much-hyped technologies emerged, again and again, threatening to upend their business models. Artificial intelligence (AI) is the most recent dilemma confronting the news industry, particularly following the public research release of OpenAI’s ChatGPT in December 2022. A few outlets like BuzzFeed, News Corps Australia, and G/O Media quickly moved to incorporate generative AI into their content production. In early 2023, BuzzFeed rolled out ChatGPT-fueled quizzes, travel articles, and a recipe recommendation chatbot named Botatouille. Many others are scoping longer-term strategies, like the Washington Post, which announced the creation of two internal teams in May 2023 to explore future uses for AI. Writers, on the other hand, have generally been more cautious: both the Writers Guild of America, East and the Gizmodo Media Group Union condemned G/O Media in July 2023 for publishing AI-generated articles without first consulting editorial staffers, warning “unreliable AI programs notorious for creating falsehoods and plagiarizing the work of real writers” were “an existential threat to journalism.”

# data[].attributes.attachment_link.readable_text
Photo: Hulton Archive/Getty Images

Audio Brief

Description: A short, spoken-word summary from CSIS's Caitlin Chin on her report, Navigating the Risks of Artificial Intelligence on the Digital News Landscape.

For decades, newsrooms have found themselves in varying states of crisis as much-hyped technologies emerged, again and again, threatening to upend their business models. Artificial intelligence (AI) is the most recent dilemma confronting the news industry, particularly following the public research release of OpenAI's ChatGPT in December 2022. A few outlets like BuzzFeed, News Corps Australia, and G/O Media quickly moved to incorporate generative AI into their content production. In early 2023, BuzzFeed rolled out ChatGPT-fueled quizzes, travel articles, and a recipe recommendation chatbot named Botatouille. Many others are scoping longer-term strategies, like the Washington Post, which announced the creation of two internal teams in May 2023 to explore future uses for AI. Writers, on the other hand, have generally been more cautious: both the Writers Guild of America, East and the Gizmodo Media Group Union condemned G/O Media in July 2023 for publishing AI-generated articles without first consulting editorial staffers, warning "unreliable AI programs notorious for creating falsehoods and plagiarizing the work of real writers" were "an existential threat to journalism."

Some AI developers are attempting to get ahead of the controversy by framing their chatbots as value-added features for the news industry-in other words, helpers, not displacers, of human journalists. Over the past few months, Google has reportedly met with both national and local news outlets to pitch Genesis, a generative AI chatbot that can draft headlines, social media posts, and articles, framed as a productivity booster. In July 2023, OpenAI partnered with the American Journalism Project to provide $5 million in direct grants to enable local newsrooms to test-drive AI. The same month, it struck an agreement with the Associated Press to access archived articles through 1985 to train large language models (LLMs) in exchange for both licensing fees and experimental use of OpenAI software. But these limited partnerships gloss over technology's strained history with newsrooms, one where most journalists have received no compensation for the use of their work to train algorithms even as digital ad-tech monopolies have contributed to their long-term decline in marketing revenue.

A common refrain has been that newsrooms must evolve to accommodate technological advancements, but this characterization is neither accurate nor fair. Even publishers that have adapted to the whims of powerful technology corporations have faced repercussions for doing so. For example, some digital news outlets redesigned their distribution strategies to capitalize on social media's peak growth in the early 2010s, allowing individual users to view and share article links on decentralized channels in exchange for a steady stream of clicks. BuzzFeed, which initially gained traction through social media virality instead of traditional print subscriptions, epitomized this novel business model. But when Facebook unilaterally modified its content ranking algorithm in January 2018 to prioritize advertiser and connection-based engagement, which reduced visibility to external news websites, early movers like BuzzFeed were hit the hardest. BuzzFeed abruptly closed its Pulitzer-winning news division in April 2023 citing revenue shortfalls, while outlets like the New York Times, which had diversified its income stream with traditional subscriptions, were less vulnerable to opaque decisions by large technology companies.

The sustainability of news cannot fall on publishers alone; large digital platforms must share responsibility to understand and address their sizable impacts on society. Yet search engine and social media companies operate with relatively few U.S. legal requirements to build fairness and transparency into algorithms, protect sensitive personal information when serving personalized advertisements, engage in ad-tech practices that promote fair competition with news publishers, and mitigate the spread of harmful content online. Without bright-line U.S. regulations for technology companies, the recent acceleration in AI adoption presents at least four major risks that could severely undermine both news availability and public access to information in the long term.

(1) Search engines may adopt AI to answer user queries, which would significantly decrease web traffic to external news websites.
There are also negative societal externalities to walling off access to accurate and relevant information on topics including climate change, public health, and civil rights. Stephen Bates, a professor at the University of Nevada, Las Vegas, warns that the rising prevalence of paywalls could create "income rather than geographic news deserts." In other words, individuals who cannot afford multiple newspaper subscriptions may be more likely to believe misinformation and lower-quality content-whether human- or AI-generated-that they view on social media or search engines for free. In a more fragmented internet, people are more likely to exist within their ideological bubbles, as chatbots cannot offer diverse perspectives like a human journalist can. Social media algorithms, which typically recommend or promote content based on past browsing activity or personal interests, further reinforce echo chambers based on user engagement and not the common good.
(2) Social media platforms are using AI to automatically rank posts, which enables the mass de-prioritization of legitimate news outlets in favor of fake, spammy, or manipulative user-uploaded content.
Prior to the internet age, news outlets controlled public attention in centralized destinations, effectively serving as the primary window for mass audiences to understand current events. But social media platforms democratized publishing in the past two decades by allowing anyone to gain international virality, transforming content-ranking algorithms into the new gatekeepers of attention and relevance. Newspapers face legal liability for publishing defamatory or false claims, but social media platforms generally do not. Section 230 of the Communications Decency Act allows "online computer services" immunity over most types of content that third-party users upload. Subsequently, many social media platforms employ AI recommendation systems that automatically rank content based on users' predicted interests or personal connections, with the goal of maximizing screen time instead of collective public knowledge.

When Facebook chose to algorithmically de-prioritize public news content in January 2018, external news websites lost visitors. Within six months of that algorithmic change, BuzzFeed's traffic decreased by 13 percent and ABC News's by 12 percent, according to the analytics firm Comscore. The Pew Research Center found that only 31 percent of U.S. adults reported consuming news on Facebook by 2022, compared to 66 percent in 2016. Facebook's power to singlehandedly decrease automated referrals to news websites, coupled with the platform's first-ever decrease in U.S. users in 2022, had the indirect effect of deepening many publishers' reliance on Google for web visitors and their ensuing digital advertising dollars. Furthermore, as Facebook whistleblower Frances Haugen revealed in 2021, the 2018 algorithmic policy shift may have harmed not only the bottom line of newspapers but also their perceived legitimacy within the social media ecosystem itself. In a leaked internal memo, company data scientists discovered the decision "had unhealthy side effects on important slices of public content, such as politics and news," since the algorithm frequently ranked user-generated misinformation higher than trustworthy publisher-generated news.
(3) Chatbots cannot perform the same functions as a human journalist, but news executives may still leverage AI to streamline operations or justify workforce reductions in the short term.
At the moment, artificial general intelligence cannot match human writers and editors in technical capability. LLMs like ChatGPT are best equipped to automate specific functions like summarizing documents-but not advanced editorial skills like relationship building with sources, original analytical thinking, contextual understanding, or long-form creative writing. LLMs predict patterns and word associations based on their training datasets but, during large-scale deployments, are known to contain factual inaccuracies or even generate fake stories altogether. In February 2023, Penn State researchers also found that LLMs can spit out plagiarized text, whether by inadequately paraphrasing or copying training material verbatim. Such behavior is doubly problematic for some models, like ChatGPT, which do not attribute or cite sources by default. In addition, since many LLMs build upon text from online websites and forums-many of which have historically excluded or exhibited hostility toward individuals based on factors like gender identity, race, or sexual orientation-their automated outputs can reproduce broader societal biases.

(4) Generative AI can increase the prevalence of spammy or false content online, which obscures legitimate news and funnels advertising dollars away from traditional publishers.

MFA websites provide no material public benefits but, without proper safeguards, could create significant negative externalities in an AI era. LLMs are designed to generate outcomes at scale-a perfect fit for content farms whose sole purpose is search engine optimization (SEO) through nonsensical keywords, summarized or verbatim text from news sources, and highly repetitive spam. These articles often list fake authors or anonymous bylines and appear to lack human oversight. The rising prevalence of AI-generated spam could decrease public trust and understanding of critical current events, especially if it distorts the market for real news and obscures legitimate newsrooms as centralized sources of information. It will become exponentially harder for human journalists to disseminate trustworthy information when the internet ecosystem is stuffed with bots.

Content farms divert more than user attention away from legitimate news websites; they also cost valuable digital advertising dollars. The AI-generated websites that NewsGuard detected were stuffed with programmatic advertisements, including from major brands like Subaru and Citigroup-almost all of which were automatically routed through Google's Ad Exchange. Google Ads maintains policies against servicing "spammy automatically-generated content" but does not publicly reveal the results of its placement algorithm or content review outcomes. In June 2023, an Adalytics study showed that Google frequently served video ads on lower-quality clickbait or junk websites without the awareness of its buy-side advertising clients. The same month, the Association of National Advertisers estimated that about $13 billion in digital advertising revenue is algorithmically funneled into clickbait MFA websites, which amounts to approximately 15 percent of the total $88 billion pie that marketers spend on automated ad exchanges every year. If not for the proliferation of AI-generated MFA content, those funds could otherwise provide a much-needed lifeline for legitimate news outlets.

Analysis of Policy Approaches

A massive legislative push to compel large technology platforms that host news content to pay publishers is playing out all over the world. In June 2023, the Canadian Parliament enacted the Online News Act, which requires designated search engines and social media platforms to pay news publishers for any external article links or quotes their users view or share. Australia and the European Union respectively passed the News Media Bargaining Code (NMBC) and Copyright Directive in 2021, and legislators in Brazil, India, the United Kingdom, the United States, and California have either proposed or are actively considering similar measures.

Canada's parliamentary budget officer predicts that news organizations could share an additional $329 million in annual revenue after the Online News Act becomes effective. However, this figure is a small fraction of the estimated $4.9 billion that Canadian news outlets lost from 2010 to 2022, and it will never be realized if Google and Meta choose to boycott the law altogether. Just hours after the passage of the Online News Act, Meta announced plans to permanently shut down news access for Canadian users. Shortly after, Google stated it too would block all Canadian news links on its search engine. Their responses should not come as a surprise: directly prior to Australia's passage of the NMBC in 2021, Meta abruptly cut off users from viewing news pages, and Google announced it might have "no real choice" but to withdraw search services within the country. Faced with those ultimatums, Australian lawmakers soon amended the NMBC's final text in a manner that exempted Meta and Google from any binding actions. And after France began enforcing the Copyright Directive in 2021, Google throttled users from seeing article previews in France, which drastically decreased click-throughs. Their actions underscore the problem with forced negotiation: it is very difficult to enforce payment schemes when digital gatekeepers can simply choke off access to the news content internet users see.

These legislative measures, sometimes referred to as "link taxes," create the wrong incentives. In the past, they have discouraged Google and Meta from displaying news content on their platforms, which decreases critical streams of traffic to external news websites. In the future, such policies may even motivate search engines to accelerate the adoption of generative AI to answer user queries instead of displaying external links. Forced payment measures also seek to reinforce newspapers' dependency on large technology companies, as they do not address the structural reasons for Google and Meta's market dominance. For these reasons, U.S. technology companies need bright-line rules that meaningfully prevent harmful ad-tech, data collection, and AI practices. Such rules, in turn, can foster a healthier and more sustainable online environment in which newsrooms can evolve in the long term.
(1) Dominant technology platforms need clear ex ante rules to prevent anticompetitive practices that reinforce their gatekeeper power over news publishers.
Two-party negotiations cannot work if the playing field is not level. Because Google and Meta have taken steps to lock in gatekeeper power over digital advertising and content distribution in recent years, they basically own the league newspapers operate in. For example, Google's 2008 acquisition of DoubleClick enabled it to effectively monopolize all three stages of the ad-tech process: the buy-side advertiser network, sell-side publisher tools, and the ad exchange through which most news websites auction online advertising spots. In turn, market dominance enables the search giant to demand up to 35 percent of proceeds that would otherwise flow to publishers. It also provides Google with ample means to compel news websites to adopt Accelerated Mobile Pages formatting and control their ability to engage in header bidding, among other actions. Similarly, Meta also increased its gatekeeper power by acquiring nascent competitors like Instagram (2012) and WhatsApp (2014), which allowed it to combine user data across multiple subsidiaries to curate personalized advertisements much more granularly than traditional newspapers can.

These behaviors have raised alarm bells in numerous jurisdictions. In June 2023, the European Commission filed a formal statement of objection to Google's ad-tech practices, arguing that the company's control over all stages of the digital advertising process allows it to illegally disadvantage website publishers. In January 2023, the U.S. Department of Justice similarly sued Google over alleged anticompetitive actions that distort free competition in the ad-tech space, seeking to split up its Ad Manager suite. In November 2021, the Federal Trade Commission (FTC) challenged Meta's acquisitions of Instagram and WhatsApp, seeking a possible divestiture of both platforms. Also in 2021, an Australian Competition and Consumer Commission (ACCC) investigation found that Google had engaged in "systemic competition concerns" like blocking ad-tech competitors from placing ads on YouTube and other subsidiaries. Further, ACCC chair Rod Sims noted at the time, "Investigation and enforcement proceedings under general competition laws are not well suited to deal with these sorts of broad concerns, and can take too long if anti-competitive harm is to be prevented." The ACCC report summarizes a widespread issue: enforcement actions occur after the fact and are not guaranteed to undo the years of consolidation that have helped Google and Meta lock in market power and divert advertising revenue from news organizations.

Traditional antitrust law requires a modernized approach in the digital age-one that implements forward-looking guardrails to prevent dominant technology companies from harming nascent rivals, news publishers, and society at large. The European Union recently put new ex ante rules into place with its Digital Markets Act, which aims to prohibit gatekeeper technology platforms from abusing their control over multiple sides of a market. Members of the U.S. Congress have floated several bills containing similar proposals to limit practices like self-prioritization and acquisitions, but their momentum stalled following debates over their possible effects on malware prevention, content moderation, and other issues. In March 2023, Canada's Competition Bureau put forward over 50 recommendations to modernize its antitrust legal framework, which has not undergone significant updates since the 1980s. Comprehensive antitrust reform is never quick or straightforward to implement, but it is essential to preventing anticompetitive acquisitions, growing news websites' ad-tech options and revenue, and fostering a more diverse and sustainable news ecosystem overall.
(2) Both technology platforms and newsrooms need formal guardrails to promote ethics, fairness, and transparency in any development and deployment of AI.
Approximately 100 million entities registered for ChatGPT within two months of its release, meaning numerous companies, including search engines and newsrooms, are deploying LLMs before direct legal safeguards are in place. The United States has existing federal and state privacy, copyright, consumer protection, and civil rights laws that apply to some aspects of the digital space, but there are broad legal uncertainties about how to interpret them in the context of generative AI (see sections 3 and 4).

As politicians additionally debate mandatory safeguards to mitigate the risks of AI, it is important to consider how any forthcoming laws could better support journalism and trustworthy information-sharing online. In 2022, Congress introduced the draft American Data Privacy and Protection Act (ADPPA), which contains provisions for large companies to publicly explain how high-risk AI systems make decisions, incorporate training data, and generate output. In April 2023, the National Telecommunications and Information Administration at the Department of Commerce issued a request for comment on AI accountability measures like audits and certifications. Transparency measures, such as these, could help news readers evaluate the credibility and fairness of the AI-generated text they view. They could also assist marketers in contesting automated advertisement placement with MFA websites instead of traditional news publishers. Both internet users and news publishers could benefit from increased public visibility into all AI development, regardless of the algorithm's perceived level of risk of any given algorithm, which could include high-level statistics into methodology, specific sources of training data, generalized outcomes, and error rates.

In June 2023, the European Parliament passed the draft AI Act, which could require developers to proactively mitigate automated output that perpetuates existing societal inequities. Under the act, "general purpose" algorithms (which would likely include LLMs like ChatGPT) would be required to identify "reasonably foreseeable risks" in their design and test training datasets for bias. Furthermore, "high-risk systems" (which would include social media ranking algorithms with over 45 million users) would be subject to more intensive standards like human oversight, assessments of an algorithm's potential impact in specific contexts, and documentation of training datasets. Going further, evaluations for high-risk AI use by large search engines and social media companies should also include their potential impacts on journalism and information-sharing, including the spread of harmful content or burying of legitimate news online.

While technology platforms need legal responsibilities to ensure fairness and accountability in AI development, any newsrooms that choose to deploy LLMs must also develop clear and transparent processes when doing so. Some news organizations have already published initial principles for generative AI. For example, the Guardian and the News/Media Alliance (NMA) both recommend public disclosures of any AI-generated output. The Guardian additionally pledges to retain human oversight over generative AI deployment, while the NMA also states that publishers who use LLMs should continue to bear responsibility for any false or discriminatory outcomes. However, there is a clear gap in the development and publication of formal standards: according to a May 2023 World Association of News Publishers survey, 49 percent of newsroom respondents had deployed LLMs, but only 20 percent had implemented formal guidelines. As a baseline, newsrooms need to identify clear purposes or contexts in which they might deploy LLMs, including conditions, safeguards, and limitations. Going further, newsrooms also need to strengthen labor protections for positions that AI deployment might substantially affect.
(3) Technology platforms should recognize the IP rights of news outlets and human creators, especially when using copyrighted articles to train algorithms.
AI developers have trained LLMs by scraping billions of written articles, images, audio, and lines of software code from humans, typically without compensating, citing, obtaining permission from, or even informing the original creators. A wide range of professionals, ranging from the NMA to comedian Sarah Silverman to computer programmers, are asking-or, in some cases, suing-AI developers to pay their training data sources, stating their unlicensed use of content violates IP rights. Days after the Associated Press reached a licensing deal with OpenAI in July 2023, thousands of authors signed an open letter to urge LLM developers to both obtain consent from and compensate writers in order to scrape their work. In January 2023, a group of software developers sued OpenAI and GitHub for building the code-generating algorithm Copilot based on their licensed work. That same month, several artists filed a class action lawsuit against Stability AI, Midjourney, and DeviantArt for processing their copyrighted material to train algorithms that generated images in their unique styles. Shortly after, Getty Images sued Stability AI in the United Kingdom and the United States for training algorithms based on 12 million copyrighted images. In addition, the Daily Mail is reportedly considering legal action against Google for scraping hundreds of thousands of copyrighted articles to develop Bard without permission.

But even if some copyright holders manage to successfully negotiate or sue for compensation from AI developers, one-time payments are a narrow solution that will not prevent more seismic long-term impacts on journalism and other professional careers. ChatGPT is estimated to require trillions of data points, while OpenAI is currently valued at up to $29 billion. In other words, the sheer scale of training datasets alone means that most creators will not receive substantial payments. Better-known creators might wield more power to negotiate payouts compared to smaller or lesser-known ones, but technology corporations would likely retain disproportionate power to decide. Moreover, the licensing agreements would likely be short term or otherwise limited, while the disruption to writers' jobs and living wages would be permanent. Since algorithms continually generate inferences based on past outputs, it would be difficult, if not impossible, to engineer a long-term residual payment system that both quantifies the monetary value of original data points and tracks subsequent usage in perpetuity.

Generative AI has created novel questions over the interpretation of existing IP rights, particularly whether algorithms fall under the fair use exception in the Copyright Act

Although copyright infringement lawsuits, if successful, are unlikely to lead to a long-term residual solution, they could drastically slow or even pause commercial sales of LLMs. Some image hosting websites, such as Getty Images, have already banned AI-generated images to prevent exposure to litigation. Stability AI, alternatively, has announced future plans to allow content creators to opt out of the processing of their work. In the case of generative AI, a more cautious and gradual pace of adoption could perhaps benefit the field in the long term. AI developers need time to devise creative ways to work collaboratively with copyright holders, increase the integrity of their training data, and mitigate the overall pitfalls of their algorithms on journalism. They should not commercially deploy these tools without a solid understanding of the legal and ethical IP risks they raise.
(4) Modernized data privacy regulations are necessary to curb surveillance-based advertising and, in turn, return some market power from large technology companies to news publishers.
In July 2023, the FTC requested information on OpenAI's training data sources, risk mitigation measures, and automated outputs that reveal details about specific people. However, the consumer protection agency primarily acts against companies that engage in "unfair or deceptive" practices, as the United States lacks a comprehensive federal privacy law that directly regulates how LLMs collect and process personal information. Dozens of privacy bills were introduced in the 116th and 117th Congresses that would have modernized U.S. privacy protections, most prominently the ADPPA in 2022, but none were enacted into law. Many of these proposals, including the ADPPA, shared a similar framework that would (a) allow individuals to access, modify, and delete personal information that companies hold; (b) restrict companies to processing personal information only as necessary to provide an initial service that users request; and (c) require minimum transparency standards in data usage.
(5) Large technology platforms need robust content moderation policies that promote a safe and healthy information ecosystem for news organizations to thrive in.
Section 230 of the 1996 Communications Decency Act indirectly reinforces the gatekeeper power of large social media platforms and search engines. With the legal power to independently choose which content to promote, demote, host, or block, technology platforms exercise substantial control over the distribution and visibility of news content, even as they directly compete with external websites for traffic and screen time. Gatekeepers have economic incentives to keep users hooked on their platforms, which sometimes means algorithmically promoting scandalous or enraging clickbait that captures the most user attention while de-ranking news reporting that benefits the public interest. In turn, a higher influx of false or toxic posts simultaneously subjects journalists to increased hostility and impedes readers' ability to parse online junk to identify real news.

Despite legitimate concerns about Section 230, a complete repeal of the statute could negatively impact both the news industry and internet users. Section 230 protects the free exchange of information and allows technology platforms to host news content without fear of frivolous litigation from right-wing extremists. For example, it shields technology platforms that host news articles about abortion access, even as some states like Texas have tried to block people from obtaining reproductive health information in the aftermath of Dobbs v. Jackson Women's Health Organization (2022). As seen from the unintended consequences of the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA), a Section 230 repeal would likely lead technology platforms to drastically reduce the availability of third-party content. In turn, journalists would likely lose social media users as a diverse resource for leads and article ideas. Independent or freelance journalists might have difficulty maintaining their online audiences or public brands, and smaller news start-ups could disproportionately struggle to get off the ground, especially if technology platforms face legal pressure to exclusively work with well-known incumbent entities.
(6) Governments should promote policies that recognize the value of journalism as a public good.
The news industry creates positive externalities that benefit far more than direct subscribers or readers. Newsrooms dedicate substantial resources to sourcing, fact-checking, and disseminating information in the public interest, and journalists serve as independent mechanisms to hold powerful institutions accountable. However, their immense societal value does not suit the system of free market capitalism in which it exists. Newsrooms earn income based on advertisements and subscriptions and not the public benefit of the information they communicate, leaving their overall bottom line vulnerable to ranking algorithms, reader or marketer demand, and even macroeconomic fluctuations. Some venture capitalist firms or wealthy individuals have attempted to invest in newsrooms, but their goals can be misaligned. Andreessen Horowitz invested $50 million in BuzzFeed News in 2014, but its constant pressure for perpetual growth, high returns, and profitability ultimately did not fit the company's journalistic mission.

Apart from public funding, governments could consider other avenues to help newspapers diversify revenue sources, which, in turn, could reduce reliance on volatile traffic streams. For example, both France and Canada offer tax credits to incentivize individuals to subscribe to newspapers, and Canada amended its tax laws in 2020 to permit newsrooms to seek charitable donations. U.S. legislators could take a similar route. Some pitched tax deductions for newspaper subscribers, advertisers, and employers in the Local Journalism Sustainability Act in 2020 and 2021, though these measures did not reach a vote. Congress could also consider mechanisms to help newsrooms function as nonprofit or hybrid organizations-for example, by changing rules that prevent nonprofit editorial boards from endorsing candidates. In March 2023, the nonprofit Texas Observer reversed its closure decision after crowdfunding over $300,000, demonstrating the potential for newsrooms to tap into alternative support like philanthropic donations or grants. That said, nonprofit status alone is not a one-track solution; there is a limited pool of foundation grants, and the relatively low rates of existing news subscribers suggest the onus cannot fall on grassroots donors to sustain the industry.

Conclusion

As AI becomes more ubiquitous, the news industry will need to carve out space in a more crowded, more chaotic, and less original information ecosystem. The relationship between technology platforms and newsrooms will continue to evolve in both the short and long terms, but robust data governance frameworks are necessary now to support the financial viability of newspapers and cultivate a diverse and trustworthy online sphere. Large search engines and social media platforms need clear boundaries around their monetization of personal information to target advertisements, acquisitions of nascent competitors, exclusionary actions like self-prioritization, use of copyrighted material, and amplification or de-amplification of online traffic. In turn, both technology platforms and newsrooms require bright-line responsibilities to promote ethical and human-centered standards at every stage in the AI development and deployment process.

These policies are not exhaustive. The long-term health and sustainability of the news industry will require more than technological solutions alone. Direct financial support for newsrooms is critical-whether through nonprofit models, direct or indirect government funding, or even nontraditional monetization methods. For example, some newsrooms have embraced side ventures like consulting or hosting events to raise income. But neither the production requirements nor the societal benefits of journalism alone can translate into dollars and cents. To succeed, news outlets also require a civically engaged society-one bound by critical thinking and collective interest in the community. In addition, corporate executives will need to urgently prioritize the input and well-being of human writers, including through job protections and union contracts, in order to sustain journalism as a stable and accessible career option. Ultimately, the actions that technology platforms, newsrooms, governments, and individuals take today will shape the long-term trajectory of the news industry.
Caitlin Chin is a fellow with the Strategic Technologies Program at the Center for Strategic and International Studies in Washington, D.C. This report is made possible by general support to CSIS. No direct sponsorship contributed to this report.

This report is produced by the Center for Strategic and International Studies (CSIS), a private, tax-exempt institution focusing on international public policy issues. Its research is nonpartisan and nonproprietary. CSIS does not take specific policy positions. Accordingly, all views, positions, and conclusions expressed in this publication should be understood to be solely those of the author(s).

© 2023 by the Center for Strategic and International Studies. All rights reserved.

Tags

Data Governance , Technology , , Technology and Innovation and Civic Education

Fellow, Strategic Technologies Program

# data[].attributes.attachment_link.title
Navigating the Risks of Artificial Intelligence on the Digital News Landscape

# data[].attributes.attachment_link.description
AI can increase the gatekeeper power that search engines and social media platforms wield over digital news outlets. Robust data governance frameworks are necessary to support the financial sustainability of newsrooms and cultivate a more diverse and trustworthy internet.

# data[].attributes.headline
The AI-Powered, Totally Autonomous Future of War Is Here

# data[].attributes.subject
The AI-Powered, Totally Autonomous Future of War Is Here

# data[].attributes.body
Ships without crews. Self-directed drone swarms. How a US Navy task force is using off-the-shelf robotics and artificial intelligence to prepare for the next age of conflict.

# data[].attributes.attachment_link.readable_text
Ships without crews. Self-directed drone swarms. How a US Navy task force is using off-the-shelf robotics and artificial intelligence to prepare for the next age of conflict.

A fleet of robot ships bobs gently in the warm waters of the Persian Gulf, somewhere between Bahrain and Qatar, maybe 100 miles off the coast of Iran. I am on the nearby deck of a US Coast Guard speedboat, squinting off what I understand is the port side. On this morning in early December 2022, the horizon is dotted with oil tankers and cargo ships and tiny fishing dhows, all shimmering in the heat. As the speedboat zips around the robot fleet, I long for a parasol, or even a cloud.

The robots do not share my pathetic human need for shade, nor do they require any other biological amenities. This is evident in their design. A few resemble typical patrol boats like the one I'm on, but most are smaller, leaner, lower to the water. One looks like a solar-powered kayak. Another looks like a surfboard with a metal sail. Yet another reminds me of a Google Street View car on pontoons.

These machines have mustered here for an exercise run by Task Force 59, a group within the US Navy's Fifth Fleet. Its focus is robotics and artificial intelligence, two rapidly evolving technologies shaping the future of war. Task Force 59's mission is to swiftly integrate them into naval operations, which it does by acquiring the latest off-the-shelf tech from private contractors and putting the pieces together into a coherent whole. The exercise in the Gulf has brought together more than a dozen uncrewed platforms-surface vessels, submersibles, aerial drones. They are to be Task Force 59's distributed eyes and ears: They will watch the ocean's surface with cameras and radar, listen beneath the water with hydrophones, and run the data they collect through pattern-matching algorithms that sort the oil tankers from the smugglers.

A fellow human on the speedboat draws my attention to one of the surfboard-style vessels. It abruptly folds its sail down, like a switchblade, and slips beneath the swell. Called a Triton, it can be programmed to do this when its systems sense danger. It seems to me that this disappearing act could prove handy in the real world: A couple of months before this exercise, an Iranian warship seized two autonomous vessels, called Saildrones, which can't submerge. The Navy had to intervene to get them back.

The Triton could stay down for as long as five days, resurfacing when the coast is clear to charge its batteries and phone home. Fortunately, my speedboat won't be hanging around that long. It fires up its engine and roars back to the docking bay of a 150-foot-long Coast Guard cutter. I head straight for the upper deck, where I know there's a stack of bottled water beneath an awning. I size up the heavy machine guns and mortars pointed out to sea as I pass.

The deck cools in the wind as the cutter heads back to base in Manama, Bahrain. During the journey, I fall into conversation with the crew. I'm eager to talk with them about the war in Ukraine and the heavy use of drones there, from hobbyist quadcopters equipped with hand grenades to full-on military systems. I want to ask them about a recent attack on the Russian-occupied naval base in Sevastopol, which involved a number of Ukrainian-built drone boats bearing explosives-and a public crowdfunding campaign to build more. But these conversations will not be possible, says my chaperone, a reservist from the social media company Snap. Because the Fifth Fleet operates in a different region, those on Task Force 59 don't have much information about what's going on in Ukraine, she says. Instead, we talk about AI image generators and whether they'll put artists out of a job, about how civilian society seems to be reaching its own inflection point with artificial intelligence. In truth, we don't know the half of it yet. It has been just a day since OpenAI launched ChatGPT, the conversational interface that would break the internet.

Back at base, I head for the Robotics Operations Center, where a group of humans oversees the distributed sensors out on the water. The ROC is a windowless room with several rows of tables and computer monitors-pretty characterless but for the walls, which are adorned with inspirational quotes from figures like Winston Churchill and Steve Jobs. Here I meet Captain Michael Brasseur, the head of Task Force 59, a tanned man with a shaved head, a ready smile, and a sailor's squint. (Brasseur has since retired from the Navy.) He strides between tables as he cheerfully explains how the ROC operates. "This is where all the data that's coming off the unmanned systems is fused, and where we leverage AI and machine learning to get some really exciting insights," Brasseur says, rubbing his hands together and grinning as he talks.

The monitors flicker with activity. Task Force 59's AI highlights suspicious vessels in the area. It has already flagged a number of ships today that did not match their identification signal, prompting the fleet to take a closer look. Brasseur shows me a new interface in development that will allow his team to perform many of these tasks on one screen, from viewing a drone ship's camera feed to directing it closer to the action.

"It can engage autonomously, but we don't recommend it. We don't want to start World War III."

Brasseur and others at the base stress that the autonomous systems they're testing are for sensing and detection only, not for armed intervention. "The current focus of Task Force 59 is enhancing visibility," Brasseur says. "Everything we do here supports the crew vessels." But some of the robot ships involved in the exercise illustrate how short the distance between unarmed and armed can be-a matter of swapping payloads and tweaking software. One autonomous speedboat, the Seagull, is designed to hunt mines and submarines by dragging a sonar array in its wake. Amir Alon, a senior director at Elbit Systems, the Israeli defense firm that created the Seagull, tells me that it can also be equipped with a remotely operated machine gun and torpedoes that launch from the deck. "It can engage autonomously, but we don't recommend it," he says with a smile. "We don't want to start World War III."

No, we don't. But Alon's quip touches on an important truth: Autonomous systems with the capacity to kill already exist around the globe. In any major conflict, even one well short of World War III, each side will soon face the temptation not only to arm these systems but, in some situations, to remove human oversight, freeing the machines to fight at machine speed. In this war of AI against AI, only humans will die. So it is reasonable to wonder: How do these machines, and the people who build them, think?

Glimmerings of autonomous technology have existed in the US military for decades, from the autopilot software in planes and drones to the automated deck guns that protect warships from incoming missiles. But these are limited systems, designed to perform specified functions in particular environments and situations. Autonomous, perhaps, but not intelligent. It wasn't until 2014 that top brass at the Pentagon began contemplating more capable autonomous technology as the solution to a much grander problem.

Bob Work, a deputy secretary of defense at the time, was concerned that the nation's geopolitical rivals were "approaching parity" with the US military. He wanted to know how to "regain overmatch," he says-how to ensure that even if the US couldn't field as many soldiers, planes, and ships as, say, China, it could emerge victorious from any potential conflict. So Work asked a group of scientists and technologists where the Department of Defense should focus its efforts. "They came back and said AI-enabled autonomy," he recalls. He began working on a national defense strategy that would cultivate innovations coming out of the technology sector, including the newly emerging capabilities offered by machine learning.

This was easier said than done. The DOD got certain projects built-including Sea Hunter, a $20 million experimental warship, and Ghost Fleet Overlord, a flotilla of conventional vessels retro-fitted to perform autonomously-but by 2019 the department's attempts to tap into Big Tech were stuttering. The effort to create a single cloud infrastructure to support AI in military operations became a political hot potato and was dropped. A Google project that involved using AI to analyze aerial images was met with a storm of public criticism and employee protest. When the Navy released its 2020 shipbuilding plan, an outline of how US fleets will evolve over the next three decades, it highlighted the importance of uncrewed systems, especially large surface ships and submersibles--but allocated relatively little money to developing them.

In a tiny office deep in the Pentagon, a former Navy pilot named Michael Stewart was well aware of this problem. Charged with overseeing the development of new combat systems for the US fleet, Stewart had begun to feel that the Navy was like Blockbuster sleepwalking into the Netflix era. Years earlier, at Harvard Business School, he had attended classes given by Clay Christensen, an academic who studied why large, successful enterprises get disrupted by smaller market entrants-often because a focus on current business causes them to miss new technology trends. The question for the Navy, as Stewart saw it, was how to hasten the adoption of robotics and AI without getting mired in institutional bureaucracy.

Others at the time were thinking along similar lines. That December, for instance, researchers at RAND, the government-funded defense think tank, published a report that suggested an alternate path: Rather than funding a handful of extravagantly priced autonomous systems, why not buy up cheaper ones by the swarm? Drawing on several war games of a Chinese invasion of Taiwan, the RAND report stated that deploying huge numbers of low-cost aerial drones could significantly improve the odds of US victory. By providing a picture of every vessel in the Taiwan Strait, the hypothetical drones-which RAND dubbed "kittens"-might allow the US to quickly destroy an enemy's fleet. (A Chinese military journal took note of this prediction at the time, discussing the potential of xiao mao, the Chinese phrase for "kitten," in the Taiwan Strait.)

In early 2021, Stewart and a group of colleagues drew up a 40-page document called the Unmanned Campaign Framework. It outlined a scrappy, unconventional plan for the Navy's use of autonomous systems, forgoing conventional procurement in favor of experimentation with cheap robotic platforms. The effort would involve a small, diverse team-specialists in AI and robotics, experts in naval strategy-that could work together to quickly implement ideas. "This is not just about unmanned systems," Stewart says. "It is as much-if not more-an organizational story."

Stewart's plan drew the attention of Vice Admiral Brad Cooper of the Fifth Fleet, whose territory spans 2.5 million square miles of water, from the Suez Canal around the Arabian Peninsula to the Persian Gulf. The area is filled with shipping lanes that are both vital to global trade and rife with illegal fishing and smuggling. Since the end of the Gulf War, when some of the Pentagon's attention and resources shifted toward Asia, Cooper had been looking for ways to do more with less, Stewart says. Iran had intensified its attacks on commercial vessels, swarming them in armed speed boats and even striking with drones and remotely operated boats.

Cooper asked Stewart to join him and Brasseur in Bahrain, and together the three began setting up Task Force 59. They looked at the autonomous systems already in use in other places around the world-for gathering climate data, say, or monitoring offshore oil platforms-and concluded that leasing and modifying this hardware would cost a fraction of what the Navy normally spent on new ships. Task Force 59 would then use AI-driven software to put the pieces together. "If new unmanned systems can operate in these complex waters," Cooper told me, "we believe they can be scaled to the other US Navy fleets."

As they were setting up the new task force, those waters kept getting more complex. In the early hours of July 29, 2021, an oil tanker called Mercer Street was headed north along the coast of Oman, en route from Tanzania to the United Arab Emirates, when two black, V-shaped drones appeared on the horizon, sweeping through the clear sky before exploding in the sea. A day later, after the crew had collected some debris from the water and reported the incident, a third drone dive-bombed the roof of the ship's control room, this time detonating an explosive that ripped through the structure, killing two members of its crew. Investigators concluded that three "suicide drones" made in Iran were to blame.

The main threat on Stewart's mind was China. "My goal is to come in with cheap or less expensive stuff very quickly-inside of five years-to send a deterrent message," he says. But China is, naturally, making substantial investments in military autonomy too. A report out of Georgetown University in 2021 found that the People's Liberation Army spends more than $1.6 billion on the technology each year-roughly on par with the US. The report also notes that autonomous vessels similar to those being used by Task Force 59 are a major focus of the Chinese navy. It has already developed a clone of the Sea Hunter, along with what is reportedly a large drone mothership.

Stewart hadn't noticed much interest in his work, however, until Russia invaded Ukraine. "People are calling me up and saying, 'You know that autonomous stuff you were talking about? OK, tell me more,'" he says. Like the sailors and officials I met in Bahrain, he wouldn't comment specifically on the situation-not about the Sevastopol drone-boat attack; not about the $800 million aid package the US sent Ukraine last spring, which included an unspecified number of "unmanned coastal defense vessels"; not about Ukraine's work to develop fully autonomous killer drones. All Stewart would say is this: "The timeline is definitely shifting."

Hivemind is designed to fly the F-16 fighter jet, and it can beat most human pilots who take it on in the simulator.

I am in San Diego, California, a main port of the US Pacific Fleet, where defense startups grow like barnacles. Just in front of me, in a tall glass building surrounded by palm trees, is the headquarters of Shield AI. Stewart encouraged me to visit the company, which makes the V-BAT, an aerial drone that Task Force 59 is experimenting with in the Persian Gulf. Although strange in appearance--shaped like an upside-down T, with wings and a single propeller at the bottom--it's an impressive piece of hardware, small and light enough for a two-person team to launch from virtually anywhere. But it's the software inside the V-BAT, an AI pilot called Hivemind, that I have come to see.

I walk through the company's bright-white offices, past engineers fiddling with bits of drone and lines of code, to a small conference room. There, on a large screen, I watch as three V-BATS embark on a simulated mission in the Californian desert. A wildfire is raging somewhere nearby, and their task is to find it. The aircraft launch vertically from the ground, then tilt forward and swoop off in different directions. After a few minutes, one of the drones pinpoints the blaze, then relays the information to its cohorts. They adjust flight, moving closer to the fire to map its full extent.

The simulated V-BATs are not following direct human commands. Nor are they following commands encoded by humans in conventional software-the rigid If this, then that. Instead, the drones are autonomously sensing and navigating their environment, planning how to accomplish their mission, and working together in a swarm. -Shield AI's engineers have trained Hivemind in part with reinforcement learning, deploying it on thousands of simulated missions, gradually encouraging it to zero in on the most efficient means of completing its task. "These are systems that can think and make decisions," says Brandon Tseng, a former Navy SEAL who cofounded the company.

This version of Hivemind includes a fairly simple sub-algorithm that can identify simulated wildfires. Of course, a different set of sub-algorithms could help a drone swarm identify any number of other targets-vehicles, vessels, human combatants. Nor is the system confined to the V-BAT. Hivemind is also designed to fly the F-16 fighter jet, and it can beat most human pilots who take it on in the simulator. (The company envisions this AI becoming a "copilot" in more recent generations of warplanes.) Hivemind also operates a quadcopter called Nova 2, which is small enough to fit inside a backpack and can explore and map the interiors of buildings and underground complexes.

For Task Force 59-or any military organization looking to pivot to AI and robotics relatively cheaply-the appeal of these technologies is clear. They offer not only "enhanced visibility" on the battlefield, as Brasseur put it, but the ability to project power (and, potentially, use force) with fewer actual people on the job. Rather than assigning dozens of human drone operators to a search-and-rescue effort or a reconnaissance mission, you could send in a team of V-BATs or Nova 2s. Instead of risking the lives of your very expensively trained pilots in an aerial assault, you could dispatch a swarm of cheap drones, each one piloted by the same ace AI, each one an extension of the same hive mind.

Still, as astonishing as machine-learning algorithms may be, they can be inherently inscrutable and unpredictable. During my visit to Shield AI, I have a brief encounter with one of the company's Nova 2 drones. It rises from the office floor and hovers about a foot from my face. "It's checking you out," an engineer says. A moment later, the drone buzzes upward and zips through a mocked-up window on one side of the room. The experience is unsettling. In an instant, this little airborne intelligence made a determination about me. But how? Although the answer may be accessible to Shield AI's engineers, who can replay and analyze elements of the robot's decisionmaking, the company is still working to make this information available to "non-expert users."

One need only look to the civilian world to see how this technology can go awry-face-recognition systems that display racial and gender biases, self-driving cars that slam into objects they were never trained to see. Even with careful engineering, a military system that incorporates AI could make similar mistakes. An algorithm trained to recognize enemy trucks might be confused by a civilian vehicle. A missile defense system designed to react to incoming threats may not be able to fully "explain" why it misfired.

These risks raise new ethical questions, akin to those introduced by accidents involving self-driving cars. If an autonomous military system makes a deadly mistake, who is responsible? Is it the commander in charge of the operation, the officer overseeing the system, the computer engineer who built the algorithms and networked the hive mind, the broker who supplied the training data?

One thing is for sure: The technology is advancing quickly. When I met Tseng, he said Shield AI's goal was to have "an operational team of three V-BATs in 2023, six V-BATs in 2024, and 12 V-BATs in 2025." Eight months after we met, Shield AI launched a team of three V-BATs from an Air Force base to fly the simulated wildfire mission. The company also now boasts that Hivemind can be trained to undertake a range of missions-hunting for missile bases, engaging with enemy aircraft-and it will soon be able to operate even when communications are limited or cut off.

Before I leave San Diego, I take a tour of the USS Midway, an aircraft carrier that was originally commissioned at the end of World War II and is now permanently docked in the bay. For decades, the ship carried some of the world's most advanced military technology, serving as a floating runway for hundreds of aircraft flying reconnaissance and bombing missions in conflicts from Vietnam to Iraq. At the center of the carrier, like a cavernous metal stomach, is the hangar deck. Doorways on one side lead into a rabbit's warren of corridors and rooms, including cramped sailors' quarters, comfy officers' bedrooms, kitchens, sick bays, even a barbershop and a laundry-a reminder that 4,000 sailors and officers at a time used to call this ship home.

Standing here, I can sense how profound the shift to autonomy will be. It may be a long time before vessels without crews outnumber those with humans aboard, even longer than that before drone mother-ships rule the seas. But Task Force 59's robot armada, fledgling as it is, marks a step into another world. Maybe it will be a safer world, one in which networks of autonomous drones, deployed around the globe, help humans keep conflict in check. Or maybe the skies will darken with attack swarms. Whichever future lies on the horizon, the robots are sailing that way.

This article appears in the September 2023 issue. Subscribe now.

Let us know what you think about this article. Submit a letter to the editor at mail@WIRED.com.

# data[].attributes.attachment_link.title
The AI-Powered, Totally Autonomous Future of War Is Here

# data[].attributes.attachment_link.description
Ships without crews. Self-directed drone swarms. How a US Navy task force is using off-the-shelf robotics and artificial intelligence to prepare for the next age of conflict.

# data[].attributes.headline
What is the UN cybercrime treaty and why does it matter? 

# data[].attributes.subject
What is the UN cybercrime treaty and why does it matter? 

# data[].attributes.body
Since May 2021, UN member states have been negotiating an international treaty on countering cybercrime. If adopted by the UN General Assembly, it would be the first binding UN instrument on a cyber issue. The treaty could become an important global legal framework for international cooperation on preventing and investigating cybercrime, and prosecuting cybercriminals.

But without a clearly defined scope and sufficient safeguards, the treaty could endanger human rights – both online and offline – and repressive governments could abuse its provisions to criminalize online free speech. It could also threaten digital rights by legitimizing intrusive investigations and unhindered law enforcement access to personal information.

# data[].attributes.body
The Universal Guidelines on Artificial Intelligence (UGAI) call attention to the growing challenges of intelligent computational systems and proposes concrete recommendations that can improve and inform their design. At its core, the purpose of the UGAI is to promote transparency and accountability for these systems and to ensure that people retain control over the systems they create. Not all systems fall within the scope of these Guidelines. Our concern is with those systems that impact the rights of people. Above all else, these systems should do no harm.

The declaration is timely. Governments around the word are developing policy proposals and institutions, both public and private, are supporting research and development of “AI.” Invariably, there will be an enormous impact on the public, regardless of their participation in the design and development of these systems. And so, the UGAI reflects a public perspective on these challenges.

# data[].attributes.body
We are entering a new world order, one marked by increased nationalism and greater geopolitical competition. While countries are not going to undo all of the global economic systems that took shape under American unipolarity for the past three decades, certain critical sectors will become decoupled in a process we have previously referred to as “re-globalization.”

Most significantly, the technology ecosystem will be split largely into two spheres dictated by the world’s two economic powerhouses, the United States and China. Other states will need to decide which sphere they want to be part of, putting pressure on the United States and China to outpace the other and establish their technological dominance. Unfolding before us is a heightened form of economic competition we understand as the “Digital Cold War.”

# data[].attributes.attachment_link.readable_text
We are entering a new world order, one marked by increased nationalism and greater geopolitical competition. While countries are not going to undo all of the global economic systems that took shape under American unipolarity for the past three decades, certain critical sectors will become decoupled in a process we have previously referred to as "re-globalization."

Most significantly, the technology ecosystem will be split largely into two spheres dictated by the world's two economic powerhouses, the United States and China. Other states will need to decide which sphere they want to be part of, putting pressure on the United States and China to outpace the other and establish their technological dominance. Unfolding before us is a heightened form of economic competition we understand as the "Digital Cold War."

The Digital Cold War will be an economic war, with technological innovations increasingly determining geopolitical prowess. Artificial intelligence (AI), with its capacity to rapidly and radically transform society, will be the most decisive technology in this arena. AI feeds on information, and its most powerful use cases will emerge through its applications across public and private sectors. For the democratic world to pull ahead, companies and countries need to adopt a new approach that prioritizes collaboration and transformation over competition and disruption.

A New Era of Democratic Coordination

Everywhere we are seeing claims that "globalization is dead." Such declarations are fundamentally misguided. The system we are moving toward is more complicated than a reversion of global interconnection. In many cases, trade is simply being rerouted rather than shut down. Most commercial industries will remain open and global, but certain critical sectors will turn inward, toward localized supply chains.

This trend began not with the United States and its policies but rather with Xi Jinping and his 2015 Made in China plan, which made clear that the Chinese government had begun prioritizing national resilience over market efficiency. Xi laid out a plan to outcompete the United States and other global powers in the commanding areas of the economy, most of all high technology. Indeed, China continues to march towards its goal of 70% self-sufficiency in critical technology by 2025. Since then, the United States has responded with its own series of ambitious measures to retain technological supremacy. This reality leads us into a bipolar high technology future.

When it comes to AI - arguably the most decisive technology in this global contestation - we are heading toward two hermetically sealed ecosystems: one that supports open systems but is also associated with democracy, privacy, and individual rights, versus one that supports state control, information-flow restriction, and politically imposed limits on openness. As much as we might hope that China's political model will evolve and that its technology will be subject to democratic feedback, we should not be naïve: That is not the trajectory that it is on. For a future to prevail that prizes openness and individual rights, democratic nations need to be market leaders in AI. The only way to ensure this is by promoting international collaboration, especially between democracies and other defenders of the rules-based order.

In the previous era, the United States could innovate on a technology and other countries would simply adopt it. When American technology leaders made groundbreaking advancements with personal computers and the internet, they operated under the assumption that American companies could work in isolation and spread their technologies across the world in a top-down fashion. The cloud revolution amplified this further, with Amazon, Microsoft, and Google owning 65% of the global market for cloud computing. This strategy may have worked when technologies were intended for pure disruption. AI, however, is geared for societal transformation. This requires a new kind of collaboration across stakeholders.

Along with computing capabilities, the power of AI is based on the amount of aggregated data that is fed to it. This means that the United States, or any country, working in isolation with restricted data flows will fail to maximize the potential of its technology - and yet data localization policies doubled worldwide from 2017 to 2021, further obstructing cross-border collaboration. The summation of human knowledge and capabilities is not siloed in any one country or culture. Even Wikipedia's knowledge base is only 11% in the English language. For AI to thrive in its ability to help us solve our hardest problems, we have to unlock the world's capacity - from French nuclear scientists to Korean philosophers, from Indian researchers to Kenyan artists, and indeed to Chinese researchers who choose to leave China and work and live in the West.

Plus, the capital requirements for investments in the sector are so large at present that very few national markets are big enough to succeed with AI on their own. For example, consider investment in semiconductors - a key input into AI progress. The U.K.'s recently announced 100 million GBP AI plan and 1 billion GBP semiconductor investment pale in comparison to the U.S.'s $280 billion and the EU's 43 billion EUR chips packages - and even these packages are constrained compared to the scale of the investment required to fully develop these technologies. Certainly, few investors globally can support fundraising rounds for startups like the one-year-old Inflection AI's $1.3 billion round.

At the center of this all, a disjointed approach with various patchworks of regulatory frameworks across the West will harm any ability to compete and win against Chinese AI systems. It is not just a function of population, but a function of data points. Chinese society, with a population more than four times larger than the U.S.'s, has become so digitized with data freely shared between its government and domestic technology champions. Soon their models, based largely on American and foreign research, can leapfrog the capabilities of those in the West.

With its size, centralized government, and inroads in other countries, China has the potential to develop one comprehensive AI model that outcompetes the multiplicity of models coming out of democratic nations if there is no international coordination. While the United States is still the AI leader - with the companies that are doing the most cutting-edge research - and while AI seems to have a bias toward open systems with unfettered access to information, the United States risks losing its edge if it fails to coalesce around a uniform strategy with other democratic nations. If this were to happen, Chinese companies could bring their technology to Western markets, influencing democratic politics and signaling to the world China's economic dominance - and its broader colonization of digital infrastructure around the world.

AI is becoming an increasingly critical part of this global infrastructure, and the West must act swiftly and in a unified fashion to ensure the technology remains open and democratically controlled. To develop the most powerful AI models across sectors, the United States will need to collaborate with other allied countries - to name a few, India, Singapore, Japan, South Korea, and European nations - by adopting data-sharing policies and encouraging the co-creation of technological innovations. Much can be gleaned from the European Data Governance Act approved by the EU in 2022, which facilitates data-sharing across member countries to maximize benefits for its citizens and businesses.

Failure to course correct will severely limit the impact of AI. For models tackling climate change, siloed data is an immediate death sentence. Medical and healthcare data and innovations are not limited to any one country, nor any one research institution. Industrial AI powering global supply chains cannot be effective without the constant flow of interconnected data. In consumer applications, varying copyright frameworks would stymie cultural relevance and influence, favoring those with free access to data over others. Moreover, piecemeal data regulation and sovereignty requirements raise compliance costs and complexity, harming the innovation economy's ability to succeed. This is not to suggest that governments should abstain from regulating AI, but rather that they should work together to establish uniform standards and practices across countries. Coordination among democratic nations will empower each country to individually feel resilient when it comes to AI, but also elevate the West as a bloc to be the leader in AI.

Responsible Innovation for AI Transformation

In addition to collaborating across states, if Western companies want to become true market leaders, they will also need to collaborate within states, namely with governmental institutions and civil society. While most of the current discourse surrounding AI focuses on large language models and other generative capabilities, AI's most significant long-term impacts will come from the ways in which it transforms industries and society as a whole. And genuine transformation cannot come about if private actors are disconnected from the wider society.

Already we are seeing AI's transformative potential beginning to take shape. AI has the capacity to massively level the playing field for who has access to information and insights. In the classroom, AI can give individualized attention to students who have never had access to those resources before. In the workplace, AI can free up workers from monotonous tasks like patient data entry in hospitals so they can focus on higher level problems. AI also has the ability to spot things we cannot. Take drug discovery, where AI can test millions of combinations of drugs solving for conditions we can't yet treat. Or medical imaging, where AI can spot diseases much earlier than we have before. Or climate change, where AI can outperform existing prediction models and capture the chances of rare but deadly disasters for vulnerable populations. In defense technology, where perhaps the stakes are greatest, AI can bring clarity to the fog of war and enhance deterrence against acts of aggression. But none of this is guaranteed. Just as AI offers enormous opportunities, it also presents substantial risks.

A lot of recent attention has fixated on the existential threat AI could pose to humanity in the somewhat distant future. But AI is also destabilizing democratic systems in the here and now, providing new avenues for mis- and dis-information through sophisticated bots and realistic deep-fakes. AI will also throw into question the value of democracy itself. What happens when authoritarian systems, augmented by AI, can outperform their democratic counterparts, for instance by massively reducing crime with expanded surveillance? Or by providing vastly better healthcare because of access to centralized information with no restrictions for privacy? Undemocratic alternatives will only become more tempting as AI develops, and these possibilities are not too far off.

We are at a fork in the road when it comes to AI. We can go down the path that leads to automation and destruction, replacing human work and meaning, or we can go down the path that leads to copiloting and enablement, making us more productive, helping us live more balanced lives, and becoming greater masters of our craft. Unlike the social media revolution, which, if regulators really wanted to, they could have slowed or redirected, the AI revolution can only charge forward. Unlike previous platform revolutions, this is a technological revolution, and its mantle has already been picked up by stakeholders across society.

The most successful companies will be those that embrace this forward-looking vision and build to endure, by centering a core set of values that align with society and abide by self-regulatory mechanisms. Taking the further step of partnering with the public sector and incumbent ecosystems is also crucial. We cannot risk AI going awry and putting democracies off track in this competitive race. Since the impacts of AI will be felt across every sector of society, accounting for broad stakeholder interests is both a moral responsibility and the only way to bring about sustainable transformation. In the age of AI, companies will need to pursue an agenda of responsible innovation, working outside of the usual technological silos.

To win the Digital Cold War, the United States and its allies must be the market leaders in AI. And to build the best AI companies, they need to prioritize international collaboration and engender a new mindset - one that aims to innovate responsibly and unleash human potential.

# data[].attributes.attachment_link.description
Globalization is not dead, but it is changing. The United States and China are creating two separate spheres for technology, and artificial intelligence is on the front lines of this new "Digital Cold War." If democracies want to succeed in this new era of "re-globalization" they will need to coordinate across governments and between the private and public sectors.

# data[].attributes.body
The tools used to commit serious international crimes constantly evolve—from bullets and bombs to social media, the internet, and perhaps now even artificial intelligence. As states and other actors increasingly resort to operations in cyberspace, this new and rapidly developing means of statecraft and warfare can be misused to carry out or facilitate war crimes, crimes against humanity, genocide, and even the aggression of one state against another.

International criminal justice can and must adapt to this new landscape. While no provision of the Rome Statute is dedicated to cybercrimes, such conduct may potentially fulfill the elements of many core international crimes as already defined. In particular, the International Committee of the Red Cross has reiterated that cyberattacks must comply with the cardinal principles of distinction and proportionality and should only be directed against military objectives.

# data[].attributes.attachment_link.title
Technology Will Not Exceed Our Humanity - Digital Front Lines

# data[].attributes.attachment_link.description
We must renew our efforts to ensure that justice is not outpaced by the changing character of war.

# data[].attributes.headline
Apple warnt vor Massenüberwachung - "Chatkontrolle" der EU rückt näher

# data[].attributes.subject
Apple warnt vor Massenüberwachung - "Chatkontrolle" der EU rückt näher

# data[].attributes.body
Eine Stellungnahme aus der kalifornischen Firmenzentrale bestätigt, dass auch eine gut gemeinte «On Device»-Überwachung unlösbare Sicherheitsprobleme schaffen würde. Nun fragt sich, was die europäische Politik tut.

# data[].attributes.attachment_link.title
Apple warnt vor Massenüberwachung - "Chatkontrolle" der EU rückt näher

# data[].attributes.attachment_link.description
Stellungnahme aus der kalifornischen Firmenzentrale bestätigt, dass auch eine gut gemeinte "On Device"-Überwachung unlösbare Sicherheitsprobleme schaffen würde.

# data[].attributes.headline
Political Reform - Why Americans Crave Fake News 

# data[].attributes.subject
Political Reform - Why Americans Crave Fake News 

# data[].attributes.body
Misinformation, or “fake news,” has the power to undermine our democracy. This report offers a different way of thinking about what drives people to consume misinformation—and why it is a durable feature of our politics. While existing solutions to curb misinformation ignore the demand side of the problem, this report sheds light on how our political system may be driving our own desire for more fake news. It concludes by recommending new avenues for research.

# data[].attributes.attachment_link.description
Real solutions to misinformation must grapple with the demand-side factors of the problem, including our winner-take-all elections.

# data[].attributes.headline
Mikrochip-Produktion in Taiwan - Handelskrieg gefährdet die Halbleiter-Industrie

# data[].attributes.subject
Mikrochip-Produktion in Taiwan - Handelskrieg gefährdet die Halbleiter-Industrie

# data[].attributes.body
Den Kampf um die globale Mikrochip-Vorherrschaft spürt vor allem der wichtigste Produktionsstandort Taiwan.

# data[].attributes.attachment_link.readable_text
Den Kampf um die globale Mikrochip-Vorherrschaft spürt vor allem der wichtigste Produktionsstandort Taiwan.

Nur dank Mikrochips funktionieren Handys, Autos und Militärjets. Auf der Insel im Pazifik werden mit Abstand am meisten der technisch fortschrittlichsten Halbleiter produziert. Doch der Standort Taiwan ist unter Druck.

Mikrochip-Designer Tu Chih-Chan designt Mikrochips für das 5G-Mobilfunknetz. "Das ist ein wenig wie Pizza machen. Beim Pizza machen musst du entscheiden, tust du Shrimps, Ananas und Zwiebeln darauf? Und wie ordnest du die an? Ich schaue, was wir auf den Mikrochip tun und wie wir die Zutaten anordnen", erklärt der Mittdreissiger zwischen Klavier und Spielzeug im Homeoffice.

Verteilte Wertschöpfungskette

Für seine Arbeit benötigt Tu Chih-Chan eine Spezialsoftware aus den USA. Der fertig designte Halbleiter werde dann von einer anderen Firma in Taiwan, der weltweit grössten Chip-Herstellerin TSMC produziert: "TSMC macht die Pizza. Mit einer Maschine, die sie aus Europa importiert." Das Beispiel zeigt, wie global verteilt, die Werkschöpfungskette der Halbleiterindustrie ist.

Doch genau diese globale Lieferkette versuchen die Regierungen in den USA, Europa und China mit dem Einsatz von hunderten Milliarden von Dollar aufzusprengen. Jeder möchte möglichst alles bei sich haben. Das sei ein Problem für Taiwan, sagt Ökonomin Liu Pei-Chen. Die Direktorin des Taiwan Institute of Economic Research erforscht die lokale Halbleiterindustrie.

"Die Abgrenzung zwischen dem chinesischen und dem nicht-chinesischen Lager wird in Zukunft deutlicher werden", betont Liu Pei-Chen. Grund sei vor allem der Handelskrieg zwischen China und den USA. So haben die USA zum Beispiel den Verkauf von Mikrochips der neusten Generation nach China verboten.

"Ich befürchte also, dass die Aufträge aus China und den Vereinigten Staaten in Zukunft etwas zurückgehen werden. Darauf muss Taiwan gut achten", sagt Liu Pei-Chen.

Fachkräfte fehlen weltweit

Diese Entwicklung sei ein Problem für die Branche rund um den Globus. Das sagt Burn Lin. Der 81-Jährige ist ein Veteran in der Halbleiterindustrie. Er hat lange für IBM und TSCM gearbeitet und baut derzeit ein Institut für Halbleiter-Ingenieure an der Tsinghua Universität in Taipeh auf.

Wenn nun alle das ganze Knowhow für das Chip-Design, die Produktionsmaschinen und -Verfahren haben wollen, verschärfe dies den sonst schon vorherrschenden Fachkräftemangel.

Burn Lin, der mit seiner Forschung in den 1980er-Jahren für einen Quantensprung in der Mikrochip-Produktion gesorgt hat, befürchtet eine Lähmung für die Branche.

"Eine der Hauptzutaten für schnelles Wachstum ist die Quantität. Wenn wir in der Produktion eine Verbesserung vornehmen, sehen wir bei einem hohen Durchsatz schnell, ob es funktioniert. Wenn das Volumen jetzt verteilt wird und sinkt, werden wir als Branche langsamer."

Teurere elektronische Geräte

Die Chip-Industrie werde aber nicht nur langsamer, sondern auch teurer, befürchtet Ökonomin Liu Pei-Chen. Denn der Aufbau von Lieferketten kostet hunderte Milliarden. Diese müssten finanziert werden. Das erhöhe den Preis für Mikrochips. Und: "Das wird sich letztendlich im Preis für elektronischen Produkte niederschlagen, die Sie und ich als Verbraucher kaufen", sagt Ökonomin Liu Pei-Chen.

Bis wir diese Auswirkungen spüren, dauert es aber noch. Anders sieht dies bei Chip-Designer Tu Chih-Chan aus. Er wurde schon von chinesischen und US-Firmen angegangen. Doch wegen der Unsicherheiten hat er andere Pläne. Er wird bald in die Finanzindustrie wechseln. Für die Halbleiter-Branche sind solche Abgänge indes ein weiteres Problem.

Rendez-vous, 28.8.2023, 12:30 Uhr

# data[].attributes.attachment_link.title
Mikrochip-Produktion in Taiwan - Handelskrieg gefährdet die Halbleiter-Industrie

# data[].attributes.attachment_link.description
Den Kampf um die globale Mikrochip-Vorherrschaft spürt vor allem der wichtigste Produktionsstandort Taiwan.

# data[].attributes.headline
US govt is hunting a Chinese malware that can interfere with its military operations 

# data[].attributes.subject
US govt is hunting a Chinese malware that can interfere with its military operations 

# data[].attributes.body
American intelligence officials believe China has implanted malware in key US power and communications networks that can be used in case of conflict, reported The New York Times.

The US newspaper refers to the malware as a “ticking time bomb” that could be activated to disrupt the military.

“The Biden administration is hunting for malicious computer code it believes China has hidden deep inside the networks controlling power grids, communications systems and water supplies that feed military bases in the United States and around the world, according to American military, intelligence and national security officials.” states The New York Times. “The discovery of the malware has raised fears that Chinese hackers, probably working for the People’s Liberation Army, have inserted code designed to disrupt U.S. military operations in the event of a conflict, including if Beijing moves against Taiwan in coming years.”

American intelligence and military officials are hunting a malware developed by China’s People’s Liberation Army that could give China the ability to disrupt US military operations in case of crises that could be triggered by events such as the occupation of Taiwan.

# data[].attributes.attachment_link.title
US govt is hunting a Chinese malware that can interfere with its military operations

# data[].attributes.attachment_link.description
The US govt believes that China has deployed malware in key US power and communications networks that can be activated in case of a conflict.

# data[].attributes.headline
Speed Up America, Slow Down China, or Both? The Key Strategic Question for the 21st Century  

# data[].attributes.subject
Speed Up America, Slow Down China, or Both? The Key Strategic Question for the 21st Century  

# data[].attributes.body
As Congress and the Biden administration consider how to address China’s drive for techno-economic dominance, there is no more important question for U.S. policymakers to resolve than the degree to which America’s response should be to speed up the pace of innovation and growth here, or slow both down in China. The Washington consensus holds that “slowing China down” is a bit unprincipled—perhaps because Trump tried it. Whereas “speeding us up” is as American as apple pie. But policymakers have never fully debated the question, which has resulted in a troubling policy drift. The reality is that if America does not do both—speed itself up, and slow China down—then it will likely lose the techno-economic race in the advanced, traded-sector industries that are most strategically important for the country’s dual-use industrial base and national security.

# data[].attributes.attachment_link.provider_name
Information Technology and Innovation Foundation | ITIF

# data[].attributes.attachment_link.title
Speed Up America, Slow Down China, or Both? The Key Strategic Question for the 21st Century

# data[].attributes.attachment_link.description
The reality is that if America does not do both—speed itself up, and slow China down—then it will likely lose the techno-economic race in the advanced, traded-sector industries that are most strategically important for the country’s dual-use industrial base and national security.

# data[].attributes.headline
Surveillance State: Inside China's Quest to Launch a New Era of Social Control

# data[].attributes.subject
Surveillance State: Inside China's Quest to Launch a New Era of Social Control

# data[].attributes.body
Surveillance State plonge d’abord dans l’extrême de la surveillance numérique chinoise en suivant les pas de Tahir et de sa famille. Citoyen chinois d’ethnie ouïghour, Tahir nous fait ressentir le poids grandissant d’une surveillance toujours plus intrusive au fur et à mesure qu’il la découvre. Ces premiers chapitres décrivent la construction d’un appareil de surveillance aussi efficace qu’intrusif. Un système qui prélude à la disparition et à l’enfermement de millions de Ouïghours, au prétexte de la lutte contre l’extrémisme religieux.

Cette mise en situation est suivie de trois parties, chacune complétant une face du triptyque de la surveillance numérique chinoise : son aspect politique et idéologique ; l’importance de l’international, tant dans la diffusion des technologies que pour le financement de la recherche dans les entreprises chinoises du complexe industriel de la surveillance ; enfin, les limites de la surveillance, tant sur le plan technique que sociétal.

# data[].attributes.attachment_link.readable_text
C ette recension a été publiée dans le numéro de printemps 2023 de Politique étrangère (n° 1/2023). Pierre Sel propose une analyse de l'ouvrage de Josh Chin et Liza Lin, Surveillance State: Inside China's Quest to Launch a New Era of Social Control (St. Martin's Press, 2022, 320 pages).

La force de cet ouvrage doit beaucoup à la qualité rédactionnelle et à l'expérience des auteurs, Josh Chin et Liza Lin, deux journalistes de renom. Josh Chin a vécu de première main la transformation en profondeur du pays depuis les Jeux olympiques de 2008, tandis que Liza Lin a précédemment couvert les sujets numériques et technologiques chinois pour Bloomberg. L'ouvrage a nécessité près de quatre ans de recherche.

Surveillance State plonge d'abord dans l'extrême de la surveillance numérique chinoise en suivant les pas de Tahir et de sa famille. Citoyen chinois d'ethnie ouïghour, Tahir nous fait ressentir le poids grandissant d'une surveillance toujours plus intrusive au fur et à mesure qu'il la découvre. Ces premiers chapitres décrivent la construction d'un appareil de surveillance aussi efficace qu'intrusif. Un système qui prélude à la disparition et à l'enfermement de millions de Ouïghours, au prétexte de la lutte contre l'extrémisme religieux.

Cette mise en situation est suivie de trois parties, chacune complétant une face du triptyque de la surveillance numérique chinoise : son aspect politique et idéologique ; l'importance de l'international, tant dans la diffusion des technologies que pour le financement de la recherche dans les entreprises chinoises du complexe industriel de la surveillance ; enfin, les limites de la surveillance, tant sur le plan technique que sociétal.

Les auteurs expliquent avec brio l'importance des promesses de la surveillance numérique dans une Chine en quête de son " rêve national " de réussite technologique, de sécurité et d'unité. Les auteurs n'oublient pas non plus les influences étrangères de la cybernétique et du rôle de Qian Xuesen ; l'importance du capital-risque et des géants des semi-conducteurs américains.

Au-delà des dénonciations attendues des dangers de la surveillance, tant en Chine qu'aux États-Unis ou encore en Ouganda, Surveillance State s'attache à montrer également les échecs de cette dernière. Un exemple bienvenu est celui du système de crédit social, présenté à la fois comme un projet aux conséquences potentiellement désastreuses mais aussi et surtout comme un " village Potemkine " de la surveillance, à l'efficacité douteuse et mal comprise.

Cet ouvrage est construit autour d'une trame narrative évidente : celle du déploiement de la surveillance numérique, entre réalités et fictions, peurs et promesses de sécurité. Les auteurs évitent cependant les principaux clichés des discours sur la surveillance en Chine : le panoptique n'existe pas encore, les citoyens chinois s'inquiètent aussi pour leurs vies privées, et les nouvelles technologies ne remplissent parfois pas leurs promesses.

Surveillance State n'est pas un ouvrage universitaire et ne doit pas être compris comme tel. C'est un travail d'enquête, qui entend présenter une vision globale mais équilibrée de la surveillance en Chine et de son expansion mondiale. Ce faisant, les auteurs simplifient forcément le récit et les spécialistes resteront sur leur faim de détails et d'apports théoriques : une critique légère pour un ouvrage aussi ambitieux.
Pierre Sel
>> S'abonner à Politique étrangère <<

# data[].attributes.attachment_link.title
Surveillance State: Inside China's Quest to Launch a New Era of Social Control

# data[].attributes.attachment_link.description
Cette recension a été publiée dans le numéro de printemps 2023 de Politique étrangère (n° 1/2023). Pierre Sel propose une analyse de l'ouvrage de Josh Chin et Liza Lin, Surveillance State: In...

# data[].attributes.headline
China plant 40-Milliarden-Finanzspritze für eigene Chip-Industrie 

# data[].attributes.subject
China plant 40-Milliarden-Finanzspritze für eigene Chip-Industrie 

# data[].attributes.body
Die chinesische Regierung hegt offenbar grosse Pläne mit der inländischen Halbleiter-Industrie. Wie "Reuters" auf Berufung von nicht namentlich genannten Quellen berichtet, möchte China einen staatlich geförderten Investitionsfonds in Höhe von 300 Milliarden Yuan errichten, was rund 41 Milliarden Dollar entspricht. Mit diesen Geldern möchte China den Rückstand zu anderen Nationen aufholen und die eigene Halbleiter-Industrie stärken. Sowohl die USA als auch Japan und die Niederlande haben Sanktionen gegen China auferlegt, um dem Land Zugang zu Highend-Technologie für die Chip-Herstellung zu verwehren.

# data[].attributes.attachment_link.readable_text
Die chinesische Regierung möchte einen Fond in Höhe von 300 Milliarden Yuan schaffen. Damit soll die hauseigene Halbleiter-Industrie gefördert werden, um die Unabhängigkeit vom Ausland zu erreichen.

Weitere Artikel zum Thema

Japan und die Niederlande machen beim Chip-Embargo mit
1. Februar 2023 - Jetzt unterstützen auch Japan und die Niederlande die Chip-Sanktionen gegen China - bedeutend, weil der einzige Lieferant von Lithografiemaschinen für kleine Strukturbreiten in den Niederlanden zuhause ist.

# data[].attributes.attachment_link.description
Die chinesische Regierung möchte einen Fond in Höhe von 300 Milliarden Yuan schaffen. Damit soll die hauseigene Halbleiter-Industrie gefördert werden, um die Unabhängigkeit vom Ausland zu erreichen.

# data[].attributes.headline
Meta: Pro-Chinese influence operation was the largest in history 

# data[].attributes.subject
Meta: Pro-Chinese influence operation was the largest in history 

# data[].attributes.body
Meta said on Tuesday that the company has taken down what officials at the firm describe as the largest ever “cross-platform covert influence operation in the world,” which featured thousands of accounts pushing pro-Chinese messages across Facebook, Instagram and other online platforms.

The operation in question targeted audiences in Taiwan, the United States, Australia, the United Kingdom, Japan and the global Chinese-speaking population with messages across more than 50 platforms, ranging from the company formerly known as Twitter, to YouTube, TikTok, Medium and Meta-owned platforms.

# data[].attributes.attachment_link.readable_text
Meta said on Tuesday that the company has taken down what officials at the firm describe as the largest ever "cross-platform covert influence operation in the world," which featured thousands of accounts pushing pro-Chinese messages across Facebook, Instagram and other online platforms.

The operation in question targeted audiences in Taiwan, the United States, Australia, the United Kingdom, Japan and the global Chinese-speaking population with messages across more than 50 platforms, ranging from the company formerly known as Twitter, to YouTube, TikTok, Medium and Meta-owned platforms.

Like other pro-Chinese information operations exposed in recent years, it failed to generate what Meta called "substantial engagement among authentic communities" targeted. Executives at Meta said the operation built on and shared technical infrastructure with previous pro-Chinese propaganda efforts but could not say definitively that it was operated by Chinese state agencies.

"This operation is large, prolific and persistent," Ben Nimmo, Meta's global threat intelligence lead, told reporters during a Monday briefing. "We expect them to keep on trying."

The Chinese embassy in Washington, D.C., did not respond to a request for comment.

The operation disrupted by Meta - which the firm described in its quarterly Adversarial Threat Report published on Tuesday - featured posts and online comments containing pro-Chinese government themes, anti-U.S. messaging and attacks on critics of the Chinese government, including journalists and researchers. The content featured a variety of languages but mostly Chinese and English.

The campaign's operators repeatedly shared identical content across several internet platforms, and their mistakes hint at the level of organization behind the effort. "Occasionally, fake accounts would post a comment together with what appears to have been a serial number, suggesting that it may have been copy-pasted from a numbered list," Meta's researchers wrote.

In total, the operation comprised 7,704 Facebook accounts, 954 pages, 15 groups and 15 Instagram accounts. Roughly 560,000 accounts followed one or more of the pages, but fewer than 10 accounts joined one or more of the Groups and only about 870 accounts followed one or more of the Instagram accounts, according to the researchers.

Meta found indications that the operation relied on common technical infrastructure and that the operators contracted to work the operation "appear to have been centrally provisioned with internet access and content directions." The operators posted at times consistent with the Chinese workday, and Meta uncovered links to "individuals associated with Chinese law enforcement" as part of their investigation.

Company officials declined to elaborate on these links with Chinese law enforcement during a call with reporters ahead of the report's release.

Meta researchers described the operation revealed on Tuesday as an extension of a pro-Chinese influence operation known as "Spamouflage" that dates to 2019.

"While this network's activity on our platform mainly consisted of spammy sharing of links, in addition to memes and text posts, our investigation identified notable distinctive errors, behavioral patterns and operational structure that allowed us to connect it to a number of more complex and long-running large clusters of activity across the internet," the researchers said.

In 2022, Google said it disrupted more than 50,000 "instances" of activity linked to the Spamouflage operation, which it calls " Dragonbridge." Last year, Mandiant researchers said the Dragonbridge operation attempted to influence the 2022 U.S. midterm elections and spark protests in the United States against an Australian mining company's American expansion plans.

The campaign has evolved since first emerging in 2019 and shows signs of emulating a suspected Russian influence operation known as " Secondary Infektion." Both operations posted content to smaller platforms before attempting to share those links on larger platforms, and until the Spamouflage activity detailed on Tuesday, no campaign tracked by Meta had involved more platforms than Secondary Infektion.

Both operations featured messages in a range of languages and relied on obscure sites where false claims first would be posted, which would then be amplified on a larger platform and then commented on and shared by fake personas on yet more platforms. Spamouflage posted material to the same obscure forums targeted by Secondary Infektion that have not been used by other influence operations, Meta said.

There's no indication of any coordination between the operators of the two distinct influence operations, and it's likely more that Spamouflage is trying to copy its Russian predecessor. "Emulation is a good way to describe it," Nimmo said.

Elsewhere in the world, Meta researchers also said on Tuesday that the pro-Russian disinformation operation known as Doppelganger that emerged in the wake of the Russian invasion of Ukraine continues to operate, including by running a network of sites spoofing legitimate news organizations. That operation is "the largest and most aggressively persistent covert influence operation from Russia that we've seen since 2017," Meta said in its report.

Written by AJ Vicens

AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal/WhatsApp: (810-206-9411).

# data[].attributes.attachment_link.title
Meta: Pro-Chinese influence operation was the largest in history

# data[].attributes.attachment_link.description
Meta researchers said the operation relied on thousands of accounts to spread pro-Chinese messages and attack critics of Beijing.

# data[].attributes.headline
China-based hackers target dozens of Taiwanese organizations in espionage operation, Microsoft warns

# data[].attributes.subject
China-based hackers target dozens of Taiwanese organizations in espionage operation, Microsoft warns

# data[].attributes.body
A newly identified espionage operation run by hackers linked to China’s government has targeted dozens of organizations in Taiwan since the middle of 2021.

Microsoft on Thursday attributed the campaign to a previously unidentified group it named Flax Typhoon. The goal of the campaign is to not only perform espionage on targeted Taiwanese entities but “maintain access to organizations across a broad range of industries for as long as possible,” the tech giant said.

The group is mainly targeting government agencies and education, critical manufacturing, and information technology organizations in Taiwan, but Microsoft has also seen victims across Southeast Asia, North America and Africa.

# data[].attributes.attachment_link.readable_text
A newly identified espionage operation run by hackers linked to China's government has targeted dozens of organizations in Taiwan since the middle of 2021.

Microsoft on Thursday attributed the campaign to a previously unidentified group it named Flax Typhoon. The goal of the campaign is to not only perform espionage on targeted Taiwanese entities but "maintain access to organizations across a broad range of industries for as long as possible," the tech giant said.

The group is mainly targeting government agencies and education, critical manufacturing, and information technology organizations in Taiwan, but Microsoft has also seen victims across Southeast Asia, North America and Africa.

"Flax Typhoon gains and maintains long-term access to Taiwanese organizations' networks with minimal use of malware, relying on tools built into the operating system, along with some normally benign software to quietly remain in these networks," the company said in a blog post on Thursday. "Microsoft has not observed Flax Typhoon using this access to conduct additional actions."

The campaign is one of several similar efforts identified by security researchers since Beijing has strengthened its rhetoric around "reunifying" Taiwan with the Chinese mainland.

Some evidence suggests that there are overlaps in this group's activity and another group identified by cybersecurity firm Crowdstrike as Ethereal Panda. They added that the group has used "a distinctive pattern of malicious activity" in its attacks on Taiwanese organizations that could be reused in operations targeting other countries.

Microsoft has been at the center of controversies related to several of the Chinese government's hacking campaigns targeting both U.S. critical infrastructure and the most senior levels of the U.S. government.

Microsoft said it decided to publish this latest report out of "significant concern" for the downstream impact the attacks may have on their customers and because it lacked the "visibility into other parts of the actor's activity."

They urged other researchers to investigate their findings in an effort to better protect the broader community and warned that the group is using living-off-the-land binaries and valid accounts - tactics deployed against Microsoft systems that are now facing withering Congressional scrutiny.

These tactics make detection and mitigation extremely difficult and require compromised accounts to be closed or changed, Microsoft explained. Systems that are compromised need to be isolated and investigated as well.

Gaining access and persistence

Flax Typhoon uses a range of technical tools to maintain persistence, gain access to credentials and move laterally through systems to expand their reach.

The group gains initial access by exploiting vulnerabilities in public-facing servers before deploying a VPN connection and collecting credentials from victim systems. Through VPN access they are able to scan systems for other vulnerabilities and the use of legitimate VPN applications makes the connection harder to identify as malicious. The traffic is nearly indistinguishable from legitimate HTTPS traffic, which most network security appliances would not block, Microsoft explained.

"While the actor's observed behavior suggests Flax Typhoon intends to perform espionage and maintain their network footholds, Microsoft has not observed Flax Typhoon act on final objectives in this campaign," they explained.

"Defending against techniques used by Flax Typhoon begins with vulnerability and patch management, particularly on systems and services exposed to the public internet. The credential access techniques used can also be mitigated with proper system hardening."

They urged affected organizations to assess the scale of Flax Typhoon activity in their network, remove malicious tools and check logs for compromised accounts alongside a host of other measures that need to be taken.

Cybersecurity experts have long identified dozens of hacking campaigns targeting Taiwan since the Chinese government made it more explicit that they planned to eventually retake the island - which considers itself a separate county.

Researchers at cybersecurity firm Trellix said in May that they have observed a significant rise in extortion emails aimed at Taiwanese government officials, with a 30-fold increase year-on-year in the number of malicious emails in January.

Last week, researchers at Black Lotus Labs said that it discovered a complex campaign that infected business-grade routers used by Taiwanese organizations and U.S. military websites.

The advisory from Microsoft comes one week after Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly warned that the Chinese government would consider destructive or disruptive attacks on American pipelines, railroads and other critical infrastructure if it believed the U.S. would get involved during a potential invasion of Taiwan.

Get more insights with the

# data[].attributes.attachment_link.title
China-based hackers target dozens of Taiwanese organizations in espionage operation, Microsoft warns

# data[].attributes.attachment_link.description
A newly identified espionage operation run by hackers linked to China's government has targeted dozens of organizations in Taiwan since the middle of 2021.

# data[].attributes.headline
How China Demands Tech Firms Reveal Hackable Flaws in Their Products

# data[].attributes.subject
How China Demands Tech Firms Reveal Hackable Flaws in Their Products

# data[].attributes.body
For state-sponsored hacking operations, unpatched vulnerabilities are valuable ammunition. Intelligence agencies and militaries seize on hackable bugs when they're revealed—exploiting them to carry out their campaigns of espionage or cyberwar—or spend millions to dig up new ones or to buy them in secret from the hacker gray market.

# data[].attributes.attachment_link.readable_text
Some foreign companies may be complying-potentially offering China's spies hints for hacking their customers.

For state-sponsored hacking operations, unpatched vulnerabilities are valuable ammunition. Intelligence agencies and militaries seize on hackable bugs when they're revealed-exploiting them to carry out their campaigns of espionage or cyberwar-or spend millions to dig up new ones or to buy them in secret from the hacker gray market.

But for the past two years, China has added another approach to obtaining information about those vulnerabilities: a law that simply demands that any network technology business operating in the country hand it over. When tech companies learn of a hackable flaw in their products, they're now required to tell a Chinese government agency-which, in some cases, then shares that information with China's state-sponsored hackers, according to a new investigation. And some evidence suggests foreign firms with China-based operations are complying with the law, indirectly giving Chinese authorities hints about potential new ways to hack their own customers.

Today, the Atlantic Council released a report-whose findings the authors shared in advance with WIRED-that investigates the fallout of a Chinese law passed in 2021, designed to reform how companies and security researchers operating in China handle the discovery of security vulnerabilities in tech products. The law requires, among other things, that tech companies that discover or learn of a hackable flaw in their products must share information about it within two days with a Chinese agency known as the Ministry of Industry and Information Technology. The agency then adds the flaw to a database whose name translates from Mandarin as the Cybersecurity Threat and Vulnerability Information Sharing Platform but is often called by a simpler English name, the National Vulnerability Database.

The report's authors combed through the Chinese government's own descriptions of that program to chart the complex path the vulnerability information then takes: The data is shared with several other government bodies, including China's National Computer Network Emergency Response Technical Teams/Coordination Center, or CNCERT/CC, an agency devoted to defending Chinese networks. But the researchers found that CNCERT/CC makes its reports available to technology "partners" that include exactly the sort of Chinese organizations devoted not to fixing security vulnerabilities but to exploiting them. One such partner is the Beijing bureau of China's Ministry of State Security, the agency responsible for many of the country's most aggressive state-sponsored hacking operations in recent years, from spy campaigns to disruptive cyberattacks. And the vulnerability reports are also shared with Shanghai Jiaotong University and the security firm Beijing Topsec, both of which have a history of lending their cooperation to hacking campaigns carried out by China's People Liberation Army.

"As soon as the regulations were announced, it was apparent that this was going to become an issue," says Dakota Cary, a researcher at the Atlantic Council's Global China Hub and one of the report's authors. "Now we've been able to show that there is real overlap between the people operating this mandated reporting structure who have access to the vulnerabilities reported and the people carrying out offensive hacking operations."

Given that patching vulnerabilities in technology products almost always takes far longer than the Chinese law's two-day disclosure deadline, the Atlantic Council researchers argue that the law essentially puts any firm with China-based operations in an impossible position: Either leave China or give sensitive descriptions of vulnerabilities in the company's products to a government that may well use that information for offensive hacking.

The researchers found, in fact, that some firms appear to be taking that second option. They point to a July 2022 document posted to the account of a research organization within the Ministry of Industry and Information Technologies on the Chinese-language social media service WeChat. The posted document lists members of the Vulnerability Information Sharing program that "passed examination," possibly indicating that the listed companies complied with the law. The list, which happens to focus on industrial control system (or ICS) technology companies, includes six non-Chinese firms: Beckhoff, D-Link, KUKA, Omron, Phoenix Contact, and Schneider Electric.

WIRED asked all six firms if they are in fact complying with the law and sharing information about unpatched vulnerabilities in their products with the Chinese government. Only two, D-Link and Phoenix Contact, flatly denied giving information about unpatched vulnerabilities to Chinese authorities, though most of the others contended that they only offered relatively innocuous vulnerability information to the Chinese government and did so at the same time as giving that information to other countries' governments or to their own customers.

The Atlantic Council report's authors concede that the companies on the Ministry of Industry and Information Technology's list aren't likely handing over detailed vulnerability information that could immediately be used by Chinese state hackers. Coding a reliable "exploit," a hacking software tool that takes advantage of a security vulnerability, is sometimes a long, difficult process, and the information about the vulnerability demanded by Chinese law isn't necessarily detailed enough to immediately build such an exploit.

But the text of the law does require-somewhat vaguely-that companies provide the name, model number, and version of the affected product, as well as the vulnerability's "technical characteristics, threat, scope of impact, and so forth." When the Atlantic Council report's authors got access to the online portal for reporting hackable flaws, they found that it includes a required entry field for details of where in the code to "trigger" the vulnerability or a video that demonstrates "detailed proof of the vulnerability discovery process," as well as a nonrequired entry field for uploading a proof-of-concept exploit to demonstrate the flaw. All of that is far more information about unpatched vulnerabilities than other governments typically demand or that companies generally share with their customers.

Even without those details or a proof-of-concept exploit, a mere description of a bug with the required level of specificity would provide a "lead" for China's offensive hackers as they search for new vulnerabilities to exploit, says Kristin Del Rosso, the public sector chief technology officer at cybersecurity firm Sophos, who coauthored the Atlantic Council report. She argues the law could be providing those state-sponsored hackers with a significant head start in their race against companies' efforts to patch and defend their systems. "It's like a map that says, 'Look here and start digging,'" says Del Rosso. "We have to be prepared for the potential weaponization of these vulnerabilities."

If China's law is in fact helping the country's state-sponsored hackers gain a greater arsenal of hackable flaws, it could have serious geopolitical implications. US tensions with China over both the country's cyberespionage and apparent preparations for disruptive cyberattack have peaked in recent months. In July, for instance, the Cybersecurity and Information Security Agency (CISA) and Microsoft revealed that Chinese hackers had somehow obtained a cryptographic key that allowed Chinese spies to access the email accounts of 25 organizations, including the State Department and the Department of Commerce. Microsoft, CISA, and the NSA all warned as well about a Chinese-origin hacking campaign that planted malware in electric grids in US states and Guam, perhaps to obtain the ability to cut off power to US military bases.

Even as those stakes rise, the Atlantic Council's Cary says he's had firsthand conversations with one Western tech firm on the Ministry of Industry and Information Technology's list that directly told him it was complying with China's vulnerability disclosure law. According to Cary, the lead executive for the Chinese arm of the company-which Cary declined to name-told him that complying with the law meant that it had been forced to submit information about unpatched vulnerabilities in its products to the Ministry of Industry and Information Technology. And when Cary spoke to another executive of the company outside of China, that executive wasn't aware of the disclosure.

Cary suggests that a lack of awareness of vulnerability information shared with the Chinese government may be typical for foreign companies that operate in the country. "If it's not on executives' radar, they don't go around asking if they're in compliance with the law that China just implemented," says Cary. "They only hear about it when they're not in compliance."

Of the six non-Chinese firms on the Ministry of Industry and Information Technology's list of compliant ICS technology firms, Taiwan-based D-Link gave WIRED the most direct denial, responding in a statement from its chief information security officer for North America, William Brown, that it "has never provided undisclosed product security information to the Chinese government."

German industrial control system tech firm Phoenix Contact also denied giving China vulnerability information, writing in a statement, "We make sure that potential new vulnerabilities are handled with utmost confidentiality and by no means get into the hands of potential cyber attackers and affiliated communities wherever they are located."

Other companies on the list said that they do report vulnerability information to the Chinese government, but only the same information provided to other governments and to customers. Swedish industrial automation firm KUKA responded that it "fulfills legal local obligations in all countries, where we operate," but wrote that it offers the same information to its customers, publishes known vulnerability information about its products on a public website, and will comply with a similar upcoming law in the EU that requires disclosing vulnerability information. Japanese technology company Omron similarly wrote that it gives vulnerability information to the Chinese government, CISA in the US, and the Japanese Computer Emergency Response Team, as well as publishing information about known vulnerabilities on its website.

German industrial automation firm Beckhoff spelled out a similar approach in more detail. "Legislation in several nations requires that any vendor selling products in their market must inform their authorized body about security vulnerabilities prior to their publication," wrote Torsten Förder, the company's head of product security. "General information about the vulnerability is disclosed as further research and mitigation strategies are developing. This enables us to notify all regulatory bodies quickly, while refraining from publishing comprehensive information on how to exploit the vulnerability under investigation."

French electric utility technology firm Schneider Electric offered the most ambiguous response. The company's head of product vulnerability management, Harish Shankar, wrote only that "cybersecurity is integral to Schneider Electric's global business strategy and digital transformation journey" and referred WIRED to its Trust Charter as well as the cybersecurity support portal on its website, where it releases security notifications and mitigation and remediation tips.

Given those carefully worded and sometimes elliptical responses, it's difficult to know to exactly what degree companies are complying with China's vulnerability disclosure law-particularly given the relatively detailed description required on the government's web portal for uploading vulnerability information. Ian Roos, a China-focused researcher at cybersecurity R&D firm Margin Research who reviewed the Atlantic Council report prior to publication, suggests that companies might be engaging in a kind of "malicious compliance," sharing only partial or misleading information with Chinese authorities. And he notes that even if they are sharing solid vulnerability data, it may still not be specific enough to be immediately helpful to China's state-sponsored hackers. "It's very hard to go from 'there's a bug here' to actually leveraging and exploiting it, or even knowing if it can be leveraged in a way that would be useful," Roos says.

The law is still troubling, Roos adds, since the Chinese government has the ability to impose serious consequences on companies that don't share as much information as it would like, from hefty fines to revocation of business licenses necessary to operate in the country. "I don't think it's doomsday, but it's very bad," he says. "I think it absolutely does create a perverse incentive where now you have private organizations that need to basically expose themselves and their customers to the adversary."

In fact, China-based staff of foreign companies may be complying with the vulnerability disclosure law more than executives outside of China even realize, says J. D. Work, a former US intelligence official who is now a professor at National Defense University College of Information and Cyberspace. (Work holds a position at the Atlantic Council, too, but wasn't involved in Cary and Del Rosso's research.) That disconnect isn't just due to negligence or willful ignorance, Work adds. China-based staff might broadly interpret another law China passed last year focused on countering espionage as forbidding China-based executives of foreign firms from telling others at their own company about how they interact with the government, he says. "Firms may not fully understand changes in their own local offices' behavior," says Work, "because those local offices may not be permitted to talk to them about it, under pain of espionage charges."

Sophos' Del Rosso notes that even if companies operating in China are finding the wiggle room to avoid disclosing actual, hackable vulnerabilities in their products today, that's still no guarantee that China won't begin tightening its enforcement of the disclosure law in the future to close any loopholes.

"Even if people aren't complying-or if they are complying but only to a certain extent-it can only devolve and get worse," says Del Rosso. "There's no way they're going to start asking for less information, or requiring less of people working there. They'll never get softer. They'll crack down more."
Updated 9:20 am, September 6, 2023: A previous version of this article incorrectly identified Margin Research's Ian Roos. We regret the error.

# data[].attributes.attachment_link.title
How China Demands Tech Firms Reveal Hackable Flaws in Their Products

# data[].attributes.attachment_link.description
Some foreign companies may be complying-potentially offering China's spies hints for hacking their customers.

# data[].attributes.headline
Russian APT Intensifies Cyber Espionage Activities Amid Ukrainian Counter-Offensive

# data[].attributes.subject
Russian APT Intensifies Cyber Espionage Activities Amid Ukrainian Counter-Offensive

# data[].attributes.body
Russian APT group Gamaredon has intensified its cyber espionage activities ahead of and during Ukraine’s counter-offensive operations, according to a new report from the National Security and Defense Council of Ukraine.

The government agency said the Russia-affiliated group, which has consistently targeted Ukraine since 2013, is ramping up attacks on military and government entities with the aim of stealing sensitive data relating to its counter-offensive operations against Kremlin troops.

The war in Ukraine has reached a critical point, with Kyiv currently undertaking a much-publicized counter-offensive designed to push back Russian forces from its territory.

The Council observed a “notable surge” in Gamaredon’s infrastructure preparations in the build-up to the counter-offensive, during April and May 2023.

# data[].attributes.attachment_link.readable_text
Russian APT group Gamaredon has intensified its cyber espionage activities ahead of and during Ukraine's counter-offensive operations, according to a new report from the National Security and Defense Council of Ukraine.

The government agency said the Russia-affiliated group, which has consistently targeted Ukraine since 2013, is ramping up attacks on military and government entities with the aim of stealing sensitive data relating to its counter-offensive operations against Kremlin troops.

The war in Ukraine has reached a critical point, with Kyiv currently undertaking a much-publicized counter-offensive designed to push back Russian forces from its territory.

The Council observed a "notable surge" in Gamaredon's infrastructure preparations in the build-up to the counter-offensive, during April and May 2023.

Going Under the Radar

It registered a substantial number of domains and subdomains in this period, which were subsequently used to launch attacks against Ukrainian military and security organizations.

This dynamic infrastructure, utilizing legitimate services, enables the group to rotate quickly and obfuscate its activities, making detection and attribution challenging, stated the report.

In one example from earlier this year, Gamaredon used Cloudflare's public DNS resolver, cloudflare-dns.com, and the popular messaging app Telegram as conduits for extracting IP addresses required for the following stages of their operations. These services camouflaged the true intent behind this action.

The report noted: "By leveraging services like Cloudflare DNS, Telegram, and Telegraph, the group underscores their commitment to maintaining secrecy and adaptability."

The Council also observed an escalation of phishing attacks by the group amid Ukraine's counteroffensive. It said these campaigns stand out due to Gamaredon's use of legitimate documents stolen from compromised entities. These documents are disguised as reports or official communications, increasing the chances of recipients downloading the malicious file.

The report added that the group has a "formidable" arsenal of malware used in its phishing campaigns, including GammaDrop, GammaLoad, GammaSteel and LakeFlash.

Concluding, the Council emphasized the dangers posed by Gamaredon's strategic timing, and urged military organizations to be vigilant to its tactics.

"The alignment of their activities with critical military events amplifies their potential impact. Organizations must recognize the evolving nature of their threat and bolster their cybersecurity measures and international cooperation in cyber threat intelligence sharing accordingly," it stated.

The report follows an advisory issued by the Ukrainian government's Computer Emergency Response Team (CERT-UA) in July 2023 that unveiled the rapid data theft methods used by Gamaredon.

# data[].attributes.attachment_link.title
Russian APT Intensifies Cyber Espionage Activities Amid Ukrainian Coun

# data[].attributes.attachment_link.description
The Gamaredon group has ramped up attacks against Ukrainian military entities, with the aim of hindering Ukraine's counter-offensive operations

# data[].attributes.headline
Moscow helping cybercriminals operate with "near impunity"

# data[].attributes.subject
Moscow helping cybercriminals operate with "near impunity"

# data[].attributes.body
A new federal report predicts Russian intelligence services and police will help cybercriminals operate with "near impunity" against their targets — including Canadians — in coming months. The assessment says Russia, and to a lesser extent Iran, very likely act as cybercrime safe havens from which digital criminals based within their borders can operate against Western targets. The cybercrime forecast is the latest assessment from the Canadian Centre for Cyber Security, with support from the RCMP.

# data[].attributes.attachment_link.readable_text
A new federal report predicts Russian intelligence services and police will help cybercriminals operate with "near impunity" against their targets - including Canadians - in coming months.

The assessment says Russia, and to a lesser extent Iran, very likely act as cybercrime safe havens from which digital criminals based within their borders can operate against Western targets.

The cybercrime forecast is the latest assessment from the Canadian Centre for Cyber Security, with support from the RCMP.

It says ransomware - malware that holds vital digital information hostage for payment - is likely the most disruptive form of cybercrime facing Canada because it is pervasive and can have a serious effect on an organization's ability to function.

Officials believe cybercriminals bent on making money will almost certainly continue to target high-value organizations in critical infrastructure sectors in Canada and around the world over the next two years.

The report says organized cybercriminal groups can reap large sums through their specialized technical capabilities, including development of tailored malware.

Some forms of cybercrime, particularly ransomware, have both financial and physical effects on their victims, the report notes.

"For example, some hospitals that were victims of cybercrime indicated the incidents disrupted their ability to care for patients, leading to longer hospital stays for patients, delayed tests or procedures, complications from medical procedures, and, in some cases, increased death rates."

Cybercrime can also disrupt the flow of essential goods and services by throwing a virtual wrench into an industrial supply chain, the report adds.

It notes a May 2021 ransomware attack on Colonial Pipeline led to a shutdown of the largest fuel pipelines in the United States, leading to price surges and fuel shortages for millions of Americans.

Cybercriminals are continuously coming up with new tactics to help them maximize profit, the report says.

"Cybercrime has evolved from online theft and credit card fraud to more elaborate ways of extorting victims as the attack surface for cybercriminals has expanded. The increasingly interconnected nature of the modern global economy has provided a growing number of opportunities for cybercriminals as victims' dependencies on technology continue to grow."
This report by The Canadian Press was first published Aug. 28, 2023.

# data[].attributes.attachment_link.title
Moscow helping cybercriminals operate with "near impunity": Canadian Cyber Centre - BNN Bloomberg

# data[].attributes.attachment_link.description
A new federal report predicts Russian intelligence services and police will help cybercriminals operate with "near impunity" against their targets - including Canadians - in coming months.

# data[].attributes.body
As Russia advanced toward Kyiv, the country mounted a massive digital evacuation while sustaining vital digital services to minimize the looming humanitarian crisis.

# data[].attributes.attachment_link.description
As Russia advanced toward Kyiv, the country mounted a massive digital evacuation while sustaining vital digital services to minimize the looming humanitarian crisis.

# data[].attributes.headline
Elon Musk a coupé Starlink pour stopper une attaque ukrainienne 

# data[].attributes.subject
Elon Musk a coupé Starlink pour stopper une attaque ukrainienne 

# data[].attributes.body
SpaceX a coupé, en 2022, le service Internet par satellite Starlink pour empêcher des drones sous-marins ukrainiens de lancer une attaque sur la flotte russe en mer Noire, selon une nouvelle biographie du milliardaire.

# data[].attributes.attachment_link.title
Réveil Courrier du 8 septembre 2023 | Courrier international

# data[].attributes.attachment_link.description
Chaque matin à 6 heures, une sélection des meilleurs articles de la presse étrangère, un résumé de l’actualité internationale utile pour bien commencer la journée. Le réveil de Courrier international.

# data[].attributes.headline
Schweizer Unternehmen schlecht gegen Cyberangriffe gewappnet 

# data[].attributes.subject
Schweizer Unternehmen schlecht gegen Cyberangriffe gewappnet 

# data[].attributes.body
Cyberangriffe beschäftigen die Schweiz. Davon betroffen sind insbesondere Grossunternehmen mit mehr als 250 Mitarbeitenden. 45 Prozent von ihnen melden, dass sie schon einmal Opfer eines Cyberangriffs wurden, wie die 14. Ausgabe des SwissVR-Monitors von Deloitte zeigt. Der SwissVR-Monitor ist eine halbjährlich von der Verwaltungsratsvereinigung SwissVR durchgeführte Umfrage.

Bei den KMUs zeigt sich ein ganz anderes Bild: Nur 18 Prozent aller Firmen mit weniger als 50 Mitarbeitenden wurden Opfer von Cyberattacken. Insgesamt vermelden 28 Prozent aller Unternehmen Cyberangriffe.

# data[].attributes.headline
Studie: Fast Hälfte der Grossunternehmen Opfer von Cyberangriffen

# data[].attributes.subject
Studie: Fast Hälfte der Grossunternehmen Opfer von Cyberangriffen

# data[].attributes.body
Internetkriminelle nehmen oft Grossunternehmen ins Visier: Laut einer Studie sind 45 Prozent der Firmen mit über 250 Mitarbeitern bereits mindestens einmal Opfer einer Attacke geworden. Dies zeigt der am Montag veröffentlichte Swiss-VR-Monitor, eine halbjährlich von der Verwaltungsratsvereinigung swissVR in Kooperation mit dem Prüfungs- und Beratungsunternehmen Deloitte Schweiz und der Hochschule Luzern durchgeführte Umfrage. Für die Studie wurden 400 Verwaltungsräte zur Cyberresilienz befragt.

# data[].attributes.attachment_link.readable_text
Studie: Fast Hälfte der Grossunternehmen Opfer von Cyberangriffen

Internetkriminelle nehmen oft Grossunternehmen ins Visier: Laut einer Studie sind 45 Prozent der Firmen mit über 250 Mitarbeitern bereits mindestens einmal Opfer einer Attacke geworden.

Dies zeigt der am Montag veröffentlichte Swiss-VR-Monitor, eine halbjährlich von der Verwaltungsratsvereinigung swissVR in Kooperation mit dem Prüfungs- und Beratungsunternehmen Deloitte Schweiz und der Hochschule Luzern durchgeführte Umfrage. Für die Studie wurden 400 Verwaltungsräte zur Cyberresilienz befragt.

KMU weniger betroffen

Im Gegensatz zu Grossunternehmen scheinen KMU deutlich weniger betroffen: Nur 18 Prozent der Firmen mit unter 50 Angestellten gaben einen schwerwiegenden Angriff an.

Als Grund für den Zusammenhang zwischen der Unternehmensgrösse und der Häufigkeit der Angriffe erklärte Deloitte, dass Grossunternehmen global stärker exponiert seien und Cyberkriminellen grössere Angriffsflächen bieten würden. "Eine weitere Erklärung für die vermeintlich geringere Betroffenheit bei kleineren Unternehmen ist das teilweise fehlende Reporting über solche Vorfälle gegenüber dem Verwaltungsrat", hiess es.

Das Problem: Es fehlt an Cyberstrategien

Hier bestehe Handlungsbedarf: Bei fast der Hälfte der Unternehmen fehle eine klare Cyberstrategie, hiess es. Und 30 Prozent der Unternehmen hätten keine Geschäftsführung ernannt, die Cyberthemen angemessen manage. Immerhin verfügen acht von zehn Aufsichtsgremien über eine Risikopolitik, die Cybergefahren angehe.

Cyberangriffe hätten oftmals gravierende Folgen für das operative Geschäft. Die mit Abstand häufigste Konsequenz sei ein Betriebsunterbruch. Dies ist bei 42 Prozent der von einem Cyberangriff betroffenen Unternehmen der Fall. Bei einem Viertel der angegriffenen Firmen kam es zu Datenlecks, bei 20 Prozent zu Fehlfunktionen von Produkten und fehlerhaften Dienstleistungen.

Neben Umsatzeinbussen durch Betriebsunterbrüche drohen hohe Folgekosten, etwa für die Wiederherstellung von Daten. Abflüsse von Vermögenswerten gab es nur bei 7 Prozent der attackierten Firmen. Aber die finanziellen Folgen seien nicht zu unterschätzen, schrieb Deloitte. (sda/awp)

Diese Schweizer Seen hauen dich mit ihrer Farbe um

Bergseen verzaubern uns immer wieder mit einem farblichen Schauspiel. Insbesondere jetzt im Herbst lohnt sich der Besuch des einen oder anderen "Seelis" für ein zauberhaftes Erlebnis.

Bergseen wirken auf viele Wanderer magisch. Ihre Faszination zieht uns an. So war das auch bei unseren Bergseen-Tipps vor einigen Wochen. Weil ihr die so geliebt habt, kommt hier Teil 2. Allerdings legen wir hier den Fokus auf das Farbenspiel. Übrigens: Wer gerne Bergseen einfach erreicht, der ist hier gut aufgehoben.

# data[].attributes.attachment_link.title
Studie: Fast Hälfte der Grossunternehmen Opfer von Cyberangriffen

# data[].attributes.attachment_link.description
Laut einer Studie von Deloitte sind 45 Prozent der Firmen in der Schweiz mit über 250 Mitarbeitern bereits mindestens einmal Opfer einer Attacke geworden.

# data[].attributes.headline
Un danger de mort pour les concernés: Le piratage des données de la Confédération ne cesse de s'étendre

# data[].attributes.subject
Un danger de mort pour les concernés: Le piratage des données de la Confédération ne cesse de s'étendre

# data[].attributes.body
Le piratage de données de la Confédération est plus grave qu'évoqué jusqu'à présent. Désormais, ce sont des dossiers d'enquêtes de l'Office fédéral de la police et du Ministère public de la Confédération qui se retrouvent sur le Darknet.

# data[].attributes.attachment_link.title
Un danger de mort pour les concernés: Le piratage des données de la Confédération ne cesse de s’étendre

# data[].attributes.attachment_link.description
Le piratage de données de la Confédération est plus grave qu’évoqué jusqu’à présent. Désormais, ce sont des dossiers d’enquêtes de l’Office fédéral de la police et du Ministère public de la Confédération qui se retrouvent sur le Darknet.

# data[].attributes.headline
Nachgefragt: «Die öffentliche Debatte ist mir oft zu schwarz-weiss» 

# data[].attributes.subject
Nachgefragt: «Die öffentliche Debatte ist mir oft zu schwarz-weiss» 

# data[].attributes.body
Per Anfang 2024 wird das Nationale Zentrum für Cybersicherheit zum eigenständigen Bundesamt unter dem VBS. Wir haben uns mit Florian Schütz, dem Leiter des NCSC, getroffen, um über die Rolle des NCSC und den Cyberangriff auf Xplain zu sprechen.

# data[].attributes.attachment_link.readable_text
2. September 2023 - Per Anfang 2024 wird das Nationale Zentrum für Cybersicherheit zum eigenständigen Bundesamt unter dem VBS. Wir haben uns mit Florian Schütz, dem Leiter des NCSC, getroffen, um über die Rolle des NCSC und den Cyberangriff auf Xplain zu sprechen.

Seit 2019 ist Florian Schütz Delegierter des Bundes für Cybersicherheit und damit Leiter des Nationalen Zentrums für Cybersicherheit (NCSC), welches im Generalsekretariat des Finanzdepartementes angesiedelt ist. Per 1. Januar 2024 wird das NCSC in ein Bundesamt im Verteidigungsdepartement VBS transformiert. Das NCSC und damit sein Chef stehen derzeit im Rampenlicht der Öffentlichkeit - Grund ist der Cyberangriff auf das Softwarehaus Xplain, das zahlreiche Bundesbehörden und Kantone beliefert. Die Aufarbeitung des Falls ist in vollem Gange. Es gibt also Gründe genug, Florian Schütz zum Gespräch zu treffen.

"Swiss IT Magazine": Mit dem Schritt, das NCSC zu einem eigenständigen Bundesamt unter dem Eidgenössisches Departement für Verteidigung, Bevölkerungsschutz und Sport (VBS) zu machen, beginnt gewissermassen ein neuer Lebensabschnitt für Ihre Abteilung. Lassen Sie uns zum Start aber erst auf den ersten Lebensabschnitt - die letzten vier Jahre - zurückblicken. Was sind für Sie die wichtigsten Ereignisse und Schritte seit dem Start des NCSC?
Florian Schütz: Der erste Punkt ist die Überarbeitung unserer Strategie. Bisher haben wir uns sehr auf Risiken fokussiert. Nun haben wir versucht, Chancen abzubilden respektive Chancen mehr Raum zu geben und unsere strategischen Ziele politischer zu machen. Zweitens richten wir das NCSC gezielt darauf aus, Prävention und Reaktion angemessen zu balancieren.

Welche Punkte stehen bei der Prävention im Fokus?
Neue Massnahmen sind etwa unser Schwachstellen-Management und Responsible Disclosures, im Rahmen derer wir auch im engeren Kontakt mit Herstellern stehen. Weiter haben wir etwa ein Bug-Bounty-Programm ins Leben gerufen, sowie gegen aussen die Sensibilisierung gestärkt und dadurch begonnen, Best Practices aufzeigen.

Sind die Präventionsbemühungen in Ihren Augen genügend?
Wir haben damit angefangen, die Investitionen in Richtung Prävention zu verschieben. In meinen Augen könnten und sollten wir hier aber noch mehr leisten. Denn nach einem Angriff ist der Schaden schon passiert und es geht nur noch um Schadensbegrenzung.

Wie ist das NCSC in der Schweiz heute diesbezüglich positioniert?
Dieser Punkt ist mir persönlich besonders wichtig: Wir konnten uns in den letzten Jahren stark vernetzen und es ist uns gelungen, den Austausch zum Thema Cybersicherheit in der Schweiz massgeblich zu erhöhen. Auch bei der Zusammenarbeit innerhalb des Bundes haben wir einen grossen Schritt gemacht - auf operativer Ebene können wir heute schneller und einfacher zusammenarbeiten.

# data[].attributes.attachment_link.title
Nachgefragt: "Die öffentliche Debatte ist mir oft zu schwarz-weiss"

# data[].attributes.attachment_link.description
Per Anfang 2024 wird das Nationale Zentrum für Cybersicherheit zum eigenständigen Bundesamt unter dem VBS. Wir haben uns mit Florian Schütz, dem Leiter des NCSC, getroffen, um über die Rolle des NCSC und den Cyberangriff auf Xplain zu sprechen. - Artikel erschienen in Swiss IT Magazine 2023/09

# data[].attributes.headline
It’s Official: Cars Are the Worst Product Category We Have Ever Reviewed for Privacy 

# data[].attributes.subject
It’s Official: Cars Are the Worst Product Category We Have Ever Reviewed for Privacy 

# data[].attributes.body
Ah, the wind in your hair, the open road ahead, and not a care in the world… except all the trackers, cameras, microphones, and sensors capturing your every move. Ugh. Modern cars are a privacy nightmare.

Car makers have been bragging about their cars being “computers on wheels" for years to promote their advanced features. However, the conversation about what driving a computer means for its occupants' privacy hasn’t really caught up. While we worried that our doorbells and watches that connect to the internet might be spying on us, car brands quietly entered the data business by turning their vehicles into powerful data-gobbling machines. Machines that, because of their all those brag-worthy bells and whistles, have an unmatched power to watch, listen, and collect information about what you do and where you go in your car.

All 25 car brands we researched earned our *Privacy Not Included warning label -- making cars the official worst category of products for privacy that we have ever reviewed.