# data[].attributes.headline
Die beste Sicherheitsstrategie beginnt auf Führungsebene

# data[].attributes.subject
Die beste Sicherheitsstrategie beginnt auf Führungsebene

# data[].attributes.body
Cyber-Angriffe gehören längst nicht mehr zur Ausnahme, stattdessen sind sie zur scheinbar omnipräsenten Gefahr geworden. Wie eine Bitkom-Studie belegt, sind bereits neun von zehn Unternehmen in Deutschland Opfer von Datendiebstahl, Spionage oder Sabotage geworden.

Der wirtschaftliche Schaden, der dadurch verursacht wird, belief sich allein 2022 auf rund 203 Milliarden Euro. Das Fatale: Obwohl Unternehmen sich der Risiken bewusst sind, rechnet über die Hälfte der Führungskräfte damit, dass die Problematik auch in diesem Jahr weiter zunehmen wird.

# data[].attributes.attachment_link.readable_text
Cyber-Angriffe gehören längst nicht mehr zur Ausnahme, stattdessen sind sie zur scheinbar omnipräsenten Gefahr geworden. Wie eine Bitkom-Studie belegt, sind bereits neun von zehn Unternehmen in Deutschland Opfer von Datendiebstahl, Spionage oder Sabotage geworden.

Der wirtschaftliche Schaden, der dadurch verursacht wird, belief sich allein 2022 auf rund 203 Milliarden Euro. Das Fatale: Obwohl Unternehmen sich der Risiken bewusst sind, rechnet über die Hälfte der Führungskräfte damit, dass die Problematik auch in diesem Jahr weiter zunehmen wird.

Führungskräften mangelt es an Verantwortungsbewusstsein

Im vergangenen Jahr kam es zu einer Reihe massiver Cyber-Angriffe - zu den wohl bekanntesten Opfern zählten Unternehmen wie Uber, LastPass oder Reddit. Dabei kam interessanterweise des Öfteren eine Kombination aus Social Engineering und anderen Methoden zum Einsatz, deren Ziel darin bestand, die Multi-Faktor-Authentifizierungssysteme (MFA) zu umgehen.

Das allein ist nichts Außergewöhnliches. Um an ihr Ziel zu gelangen, versuchen Hacker:innen immer wieder, MFA-Systeme zu umgehen, die gegen mehr Angriffsklassen schützen als Ein-Faktor-Authentifizierung. Allerdings wird die Vorgehensweise der Cyber-Kriminellen zunehmend professioneller, wie auch die bereits erwähnte Studie von Bitkom belegt: 2019 wurden nur 21 Prozent aller Angriffe von organisierten Hacking-Banden ausgeführt - inzwischen liegt ihr Anteil bei satten 51 Prozent.

Doch die ausgeklügelten Methoden sind nicht das einzige Problem. Auch innerhalb der Unternehmen gibt es zahlreiche Versäumnisse, die den Betrüger:innen zusätzlich in die Karten spielen. Manche befinden sich angesichts der Gefahr in einer regelrechten Schockstarre und wissen vor lauter Überforderung gar nicht, wo sie anfangen sollen, um die eigenen Systeme vor der potenziellen Gefahr zu schützen. Andere messen der Thematik schlichtweg nicht genügend Wichtigkeit bei. In den aller meisten Fällen gehen die Gründe für eine mangelnde Cyber-Sicherheit jedoch mit einer Verantwortungslücke in der Chef:innen-Etage einher - und diese lässt sich auch vom besten IT-Team der Welt nicht ausgleichen.

Angriffsabwehr ist nicht unmöglich

Da Hacker:innen immer raffinierter vorgehen, ist es für viele Mitarbeiter:innen inzwischen unmöglich, Maschen wie Social Engineering oder Phishing-Mails als Betrugsversuch zu enttarnen. Für Unternehmen ist das ein ernstzunehmendes Problem, denn trotz aller Sicherheitsmaßnahmen, die ergriffen werden, ist das schwächste Glied am Ende häufig der Mensch selbst. Bedeutet das etwa, dass Unternehmen keine Chance mehr haben, sich vor Angriffen auf ihre sensiblen Daten zu schützen? Die gute Nachricht lautet: Nein. Dass es möglich ist, Phishing von Zugangsdaten und MFA-Umgehungsversuche zu verhindern, haben Fälle aus der Vergangenheit bereits eindrucksvoll bewiesen.

Im vergangenen Jahr berichtete beispielsweise das US-Unternehmen Cloudflare, wie es Opfer eines 0ktapus-Angriffs wurde: 76 Mitarbeiter:innen erhielten zeitgleich eine Nachricht, die von einer angeblichen IT-Abteilung stammte und dazu aufforderte, auf einer verlinkten Website das Passwort zu ändern. Da die Seite der unternehmenseigenen IT-Plattform zum Verwechseln ähnlich sah, wurde der Angriff von Cloudflares Überwachungssystemen nicht als betrügerisch eingestuft, was zur Folge hatte, dass einige Mitarbeiter:innen ihre Zugangsdaten bedenkenlos weitergaben. Glücklicherweise konnte dank der verwendeten FIDO-Security Keys Schlimmeres verhindert werden.

Wie das Beispiel von Cloudflare beweist, ist es durchaus möglich, sich gegen Datendiebstahl oder Spionage zu wehren. Was hält Unternehmen also davon ab? Wir beobachten in der Regel zwei wesentliche Hindernisse, die den Fortschritt ausbremsen: Entweder liegt die Verantwortung bei den CSOs oder CISOs, die sich der Problematik zwar bewusst, aufgrund begrenzter Ressourcen oder Unterstützung seitens des Unternehmens aber nicht in der Lage sind, effektive Maßnahmen einzuleiten. Oder aber das IT-Team arbeitet isoliert und erfährt nur wenig Unterstützung der Geschäftsführung, weshalb potenziell erfolgreiche Sicherheitsstrategien bereits vor der Umsetzung scheitern. Letzteres ist vor allem in kleineren Unternehmen ein ernstzunehmendes Problem.

Sicherheit beginnt in der Führungsetage

Der derzeitige Umgang mit Cybersicherheit erinnert stark an die Art und Weise, wie ESG-Themen (Environmental, Social and Governance) vor etwa einem Jahrzehnt behandelt wurden. Ein Begriff, der in diesem Zusammenhang geprägt wurde, ist das sogenannte „Purpose Washing", der leere Versprechungen beschreibt, ohne tatsächlich ins Handeln zu kommen. Sowohl Regierungen als auch Konsument:innen verlangen jedoch zunehmend, dass Unternehmen sich nicht nur als ESG-freundlich darstellen, sondern ihre Fortschritte anhand von Zahlen und Fakten belegen. Auch hinsichtlich der eigenen Cyber-Sicherheit reicht es nicht aus, proaktives Handeln nur vorzugeben, um Rufschädigung oder Vertrauensverlust vorzubeugen. Spätestens dann, wenn die Folgen öffentlich werden, ist der Reputationsschaden nur noch schwer zu beheben.

Um messbare und verlässliche Ziele erreichen zu können, ist es wichtig, das stiefmütterliche Verhältnis zur Cybersecurity endlich zu überwinden. Noch immer wird die Thematik als rein technisch missverstanden und die Führungsetage geht davon aus, dass die Verantwortung allein beim IT-Team liegt. Doch genau diese Einstellung hat viele Unternehmen in die prekäre Lage gebracht, in der sie sich heute befinden. Sie müssen sich aus ihrer reaktiven Ohnmacht befreien und stattdessen eine proaktive Herangehensweise etablieren - und die beginnt auf höchster Ebene.

Dass die Geschäftsführung die Verantwortung, die sie trägt, endlich entsprechend wahrnimmt, ist essenziell. Sie müssen in ständigem Kontakt mit den Security-Verantwortlichen stehen, Informationen austauschen, Fragen stellen, Maßnahmen abstimmen und finanzielle Mittel freigeben. Dieses Engagement wird nicht nur untereinander, sondern auch für die gesamte Belegschaft als positives Signal dienen. Denn am Ende ist es nur dann möglich, eine umfassende Strategie zu implementieren, die eine dauerhaft sichere Unternehmensumgebung gewährleistet, wenn alle an einem Strang ziehen.

# data[].attributes.attachment_link.title
Die beste Sicherheitsstrategie beginnt auf Führungsebene

# data[].attributes.attachment_link.description
Dass die Geschäftsführung die Verantwortung, die sie trägt, endlich entsprechend wahrnimmt, ist essenziell.

# data[].attributes.headline
Woche 27: Online-Anlagebetrug - es geht um richtig viel Geld

# data[].attributes.subject
Woche 27: Online-Anlagebetrug - es geht um richtig viel Geld

# data[].attributes.body
Online-Anlagebetrug fängt harmlos an. Zusammen mit einer sympathischen Person soll mit lediglich 250 US-Dollar Einsatz, die Welt der Kryptowährung erkundet werden. Bald kommt die Aufforderung, mehr zu investieren und so wird der Schaden immer grösser. Dies zeigen fünf ähnlich klingende Vorfälle, die dem NCSC gemeldet wurden, bei denen die Betrüger zusammengezählt über 220'000 USD erbeutet haben.

# data[].attributes.attachment_link.readable_text
11.07.2023 - Online-Anlagebetrug fängt harmlos an. Zusammen mit einer sympathischen Person soll mit lediglich 250 US-Dollar Einsatz, die Welt der Kryptowährung erkundet werden. Bald kommt die Aufforderung, mehr zu investieren und so wird der Schaden immer grösser. Dies zeigen fünf ähnlich klingende Vorfälle, die dem NCSC gemeldet wurden, bei denen die Betrüger zusammengezählt über 220'000 USD erbeutet haben.

Alles beginnt mit einer Nachricht über LinkedIn, Facebook, WhatsApp oder anderen Kanälen und wirkt, als wäre sie zufällig an die falsche Person versendet worden. Das Profilbild der Senderin oder des Senders wirken sympathisch, so dass der vermeintlich falsch angeschrieben Empfänger oder die Empfängerin eine kurze Mitteilung sendet, dass es sich wohl um ein Versehen handelt.

Aus dieser gut gemeinten Rückmeldung entsteht in vielen Fällen ein längerer Austausch, mitunter über Wochen oder Monate. Irgendwann kommt die Sprache auf Online-Investitionen und welch hohe Gewinne damit erzielt werden können.

Die "sympathische Person" verspricht, bei einer allfälligen Investition zu helfen und jeden Schritt zu erklären. Die Betrüger verlangen für die Eröffnung eines Kontos eine erste Einlage von 250 US-Dollar. Manchmal kann der Anleger testweise auch einen Teil davon wieder zurückziehen, um sich sicher zu fühlen. So oder ähnlich werden dem NCSC die ersten Schritte auf dem Weg zu einem Online-Anlagebetrug geschildert, wie auch in einer der aktuellen Meldungen an das NCSC.

Nach ersten Schein-Gewinnen - diese sind lediglich online auf dem Portal zu sehen - drängen die Betrüger dann schnell auf höhere Einsätze, im vorliegenden Fall sind dies 80'000 US-Dollar.

Die Webseiten sind sehr aufwändig gestaltet und bieten neben mehrsprachigen Einführungsvideos auch 24Stunden Online-Support an 7 Tagen der Woche. Daraus wird ersichtlich, welchen Gewinn die Betrüger abschöpfen können. Zum Teil werden damit auch teure Werbekampagnen für diese Fake-Anlagebetrug-Portale bezahlt.

In einem zweiten Fall haben sich die Betrüger nach einem Jahr wieder gemeldet und sich als Anwaltskanzlei ausgegeben, welche verspricht, das verlorene Geld zurückzuholen. Natürlich fallen auch da zuerst einmal Gebühren an. Die Betrüger erbeuteten in diesem Fall nochmals 40'000 US-Dollar.

Alleine bei fünf dem NCSC letzte Woche gemeldeten Betrugsfällen entstanden zusammen über 220'000 USD Schaden.

Seien Sie äusserst misstrauisch, wenn sich Personen bei Ihnen melden, welche Ihnen angeblich bei der Wiederbeschaffung Ihres Vermögens helfen wollen;

Zahlen Sie keine Gebühren, um an Ihr (verlorenes) Geld zu gelangen;

Falls Sie von einer derartigen Firma kontaktiert wurden oder selbst Kontakt aufgenommen haben, brechen Sie diesen sofort ab;

Lassen Sie sich nicht unter Druck setzen.

Aktuelle Zahlen und Statistiken

Die Anzahl Meldungen der letzten Woche nach Kategorien sind publiziert unter:
Aktuelle Zahlen

# data[].attributes.attachment_link.title
Woche 27: Online-Anlagebetrug - es geht um richtig viel Geld

# data[].attributes.attachment_link.description
11.07.2023 - Online-Anlagebetrug fängt harmlos an. Zusammen mit einer sympathischen Person soll mit lediglich 250 US-Dollar Einsatz, die Welt der Kryptowährung erkundet werden. Bald kommt die Aufforderung, mehr zu investieren und so wird der Schaden immer grösser. Dies zeigen fünf ähnlich klingende Vorfälle, die dem NCSC gemeldet wurden, bei denen die Betrüger zusammengezählt über 220'000 USD erbeutet haben.

# data[].attributes.headline
Die Schweiz hat das sicherste Internet der Welt: Wieso nur wird es kaum genutzt?

# data[].attributes.subject
Die Schweiz hat das sicherste Internet der Welt: Wieso nur wird es kaum genutzt?

# data[].attributes.body
Nachrichten über Hackerangriffe reissen nicht ab. Dabei gäbe es eine neue Technologie, die Angreifer besser fernhält. Entwickelt hat diese ein ETH-Professor, durchgesetzt hat sie die Schweizerische Nationalbank zusammen mit den Telekom-Anbietern. Doch die weitere Verbreitung stockt.

# data[].attributes.attachment_link.readable_text
Die Schweiz hat das sicherste Internet der Welt: Wieso nur wird es kaum genutzt?

Nachrichten über Hackerangriffe reissen nicht ab. Dabei gäbe es eine neue Technologie, die Angreifer besser fernhält. Entwickelt hat diese ein ETH-Professor, durchgesetzt hat sie die Schweizerische Nationalbank zusammen mit den Telekom-Anbietern. Doch die weitere Verbreitung stockt.

Die Angriffe auf Unternehmen, nationale Institutionen und kritische Infrastrukturen häufen sich: Anfang Februar attackierte eine Ransomware-Gruppe die Universität Zürich, wenig später bestätigten die SBB einen Cyberangriff, auch Gemeinden verzeichnen seit einem Jahr deutlich mehr Angriffe auf ihre Systeme. Zuletzt gehörten auch Kantone, das nationale Parlament und die Bundesverwaltung zu den Opfern von Cyber-Attacken.

So griffen prorussische Hacktivisten mehrere Webseiten der Bundesverwaltung an - drei Tage vor der Rede des ukrainischen Präsidenten Wolodimir Selenski vor der Bundesversammlung.

Gemäss Angaben des Nationalen Zentrums für Cybersicherheit (NCSC) galt der Angriff der ganzen Bundesverwaltung: Die Webseiten waren nicht mehr erreichbar, Anwendungen des Bundes nicht mehr verfügbar. DDoS-Angriffe (Distributed Denial of Service) auf die Informatiksysteme der Verwaltung legten die Systeme lahm.

Letzte Woche wurde das Ausmass des Lecks publik, welche ein Ransomware-Angriff auf die IT-Firma Xplain in Interlaken hatte: Baupläne von Polizei- und Armeesystemen, Adressen und Sicherheitsdaten von Bundesräten sowie Informationen über den Schutz von hiesigen Botschaften stellte die Hackerbande Play ins Netz.

Die Art der Attacken unterscheiden sich zwar. Unbestritten aber ist: Der Schaden ist einerseits finanziell gross und andererseits unterminieren die Angriffe das Vertrauen in die Behörden.

Immenser Aufwand, immenser Schaden

Die Schweiz ist nicht alleine. Weltweit wächst die Schadensbilanz in schnellen Schritten. Denn die Digitalisierung der Wirtschaft schreitet voran, und damit auch die Interaktionen im Internet. Den Hackern bietet sich mehr Angriffsfläche.

Die Unternehmensberater von McKinsey schätzen, dass der Schaden weltweit bis 2025 auf 10,5 Billionen Dollar pro Jahr wächst, fast 10'000'000'000'000 Franken. Das sind drei Mal mehr als noch 2015.

Damit steigt auch das Bedürfnis nach Sicherheit. Private, Unternehmen und Behörden wenden jedes Jahr mehr Geld auf, um sich, ihre Daten, Systeme sowie Dienstleistungen zu schützen. Je nach Schätzung werden weltweit 150 bis 250 Milliarden Dollar pro Jahr in die Cybersicherheit gesteckt - bei einer jährlichen Wachstumsrate von über 12 Prozent.

Der Schweizer Bankenplatz als Wegbereiter

Grössere Unternehmen, die über höchst sensible Daten verfügen und kritische Dienstleistungen anbieten, schützen sich meist aufwendig. Das Paradebeispiel dafür sind Geldtransfers der hiesigen Banken.

Die Schweizerische Nationalbank (SNB) muss sicherstellen, dass die Transfers zwischen den Geldinstituten funktionieren, sie ist verantwortlich für das sogenannte Swiss Interbank Clearingsystem (SIC). 2022 wurden pro Tag im Mittel rund 3,7 Millionen Zahlungen im Wert von 200 Milliarden Franken über dieses System abgewickelt. An Spitzentagen können es über 12 Millionen täglich sein - mit Umsätzen von bis zu 403 Milliarden Franken.

Unvorstellbar, was passieren würde, wenn Überweisungen nicht übermittelt werden könnten und somit nicht mehr beim Adressaten ankommen. Unvorstellbar auch das Chaos, wenn das private Konto plötzlich und für längere Zeit nicht mehr zugänglich ist. Wer verfügt heute noch über so viel Bargeld, um sich mehrere Tage versorgen zu können?

Neues sicheres Netzwerk dank ETH-Technologie

Um das Zahlungssystem vor Angriffen zu schützen und die Transaktionen ohne grössere Unterbrüche sicherzustellen, mietet die SNB sowie alle SIC-Teilnehmer Punkt-zu-Punkt-Verbindungen zum zentralen SIC-System. Über solche privaten Linien kommunizieren auch Militärs oder Nachrichtendienste, um Zugriffe von aussen auszuschliessen.

Die Verbindungen der Banken sind so zwar sicher, aber vergleichsweise wenig resilient: Fällt eine Netzwerkverbindung aus, dauert es bis zu drei Minuten für die Umschaltung auf eine alternative Verbindung. In Zeiten, da Kunden in Sekundenschnelle ihre Ware zahlen oder auch Geld erhalten wollen, ist Geschwindigkeit auch eine Sicherheitsfrage.

Die SNB zeigte sich offen und interessiert an neuer Technologie, die zukunftsfähig und mindestens genauso sicher wie das bisherige Verfahren ist. Das von der ETH Zürich unter Professor Adrian Perrig entwickelte SCION-Protokoll entspricht den strengen Kriterien, weil es eine wesentlich erhöhte Sicherheit und weitere wünschenswerte Eigenschaften verspricht. So beschränkt das geschlossene Netzwerk die Teilnahme auf einen Teilnehmerkreis aus der Finanzbranche und kann die Teilnehmer vor bestimmten Attacken wie DDoS, BGP-Hacking oder Re-Routing schützen.

Zusammen mit dem Finanzdienstleister SIX, welcher die Infrastruktur für den Schweizer Finanzplatz zur Verfügung stellt, entwickelte die SNB das Projekt des Secure Swiss Finance Network (SSFN), über welches in Zukunft der Schweizer Finanzplatz grossmehrheitlich kommunizieren wird. Aktuell findet die Ablösung vom bestehenden Netzwerk bis Ende September 2024 statt.

Für das Projekt haben sich die Betreiber Swisscom, Sunrise und Switch mit ihren Netzwerken zusammengeschlossen, um einen neuen Sicherheitsstandard zu erstellen, eine wesentlich erhöhte Resilienz und Ausfallsicherheit. So ist beim Ausfall eines Providers die laufende Kommunikation nicht tangiert und der Kunde - beispielsweise eine Bank - bemerkt die Störung nicht.

Ein weiterer Vorteil der neuen Technologie gegenüber dem allseits zugänglichen Internet liegt laut SNB-Vertreter Sébastien Kraenzlin, Leiter operatives Bankgeschäft, auch darin, dass nur jene Finanzmarktteilnehmer und -dienstleister, die den strengen Zulassungsvorschriften zum SSFN entsprechen, daran teilnehmen können. Damit sei das Risiko für Angriffe von aussen auf das Netzwerk quasi eliminiert. "Jedoch müssen die Finanzmarktteilnehmer ihre eigenen Infrastrukturen weiterhin selbst schützen." Das sichere Netzwerk schützt die Kommunikation und nicht den gesamten Betrieb.

Eine namhafte Bank wird täglich 80'000 Mal angegriffen

Konkret zeigen Messungen von Anapaya, dem ETH-Spinoff von Perrig und dem Vertreiber der SCION-Router Technologie, eindrücklich, wie Netzwerke durch Einsatz der neuen Technologie geschützt sind. Die Firma hat die Angriffe auf eine grössere Schweizer Bank im letzten Quartal 2022 gemessen und zählte 80'000 Versuche jeden Tag, über das Netzwerk ins System der Bank einzudringen. Davon sind 1000 Angriffe gezielt, also bösartig, sogenannte Code Injection Attempts.

"Mit der Umstellung auf die SCION-Technologie rechneten wir schon mit einer massiven Reduktion der messbaren Attacken", sagt Anapaya-CEO Martin Bosshardt zu den Tests. Das Resultat verblüffte gar die Entwickler:

Einzig Fehlermeldungen, etwa falsch eingegebene Passwörter, erscheinen noch in der Statistik. Doch Angriffe, die einen Schaden hätten anrichten können, wenn der Zugang zum System nicht gut gewartet und gesichert ist, gab es keine mehr.

Die entscheidende Änderung

Der Grund für die erhöhte Sicherheit ist eine direkte Folge der Technologie, welche die Daten nur über vertrauenswürdige Router leitet: Für Aussenstehende, also Angreifer oder deren Bots (Programme, die nach Schlupflöchern suchen), ist das Netzwerk, sowie dessen Teilnehmer gar nicht mehr erkennbar, gar nicht mehr sichtbar, wie Martin Bosshardt erklärt.

Entscheidet also ein Netzwerkteilnehmer, dass er nur andere Teilnehmer aus der Schweiz als vertrauenswürdig erachtet, erscheint sein Anschluss und seine im Netzwerk angebotenen Dienste für Anwender im Ausland nicht.

Und daraus leitet sich der grösste Sicherheitsvorteil ab: In der Regel verschaffen sich Kriminelle über gestohlene Passwörter und Logins Zugang zu Geschäftsnetzwerken oder auch zu privaten Computern. Wenn nun ein System gar nicht auffindbar ist, dann bringen dem Hacker auch die Logins, Passwörter, Zertifikate nichts, weil er das System nicht mehr erreichen kann.

Martin Bosshart spricht von einem "Riesenschritt in der Sicherheit", weil der einzelne Teilnehmer nun definieren kann, wer ihn selbst theoretisch überhaupt noch angreifen kann.

Schweizer Provider kontrollieren Schweizer Datenverkehr

Der Vorteil bei der Anwendung der SCION-Technologie in der Schweiz: Indem Attacken aus dem Ausland verhindert werden können, bleiben den Cyberkriminellen nur noch Angriffsmöglichkeiten aus der Schweiz. Doch hier kontrollieren die Internetprovider Swisscom, Sunrise, Switch und Co. den Datenverkehr. Das heisst, die Adressen der Nutzerinnen und Nutzer sind alle rückverfolgbar und identifizierbar. Das wiederum bedeutet eine grosse Hilfe für die Strafverfolgung, welche die Kriminellen besser auffinden kann.

Eine weitere Statistik von Anapaya zeigt, woher die Angreifer kommen. Die Firma hat die Herkunftsländer der insgesamt fast sieben Millionen Angriffe in nur drei Monaten auf die erwähnte Schweizer Bank ausgewertet: Der Grossteil der Angriffe stammte aus China. Die zweitmeisten Angriffe kommen aus den USA - aus den grossen Cloud-Providern, die Anonymität bieten.

Auch die Bundesverwaltung testet die Technologie

Wieso ist diese Technologie also (noch) nicht weiter verbreitet? Einerseits ist die Gefahr wenig sichtbar: Weil Cyberangriffe in der Schweiz nicht generell meldepflichtig sind, lässt sich das Ausmass der Schäden nur schwer beziffern. So gelangen grosse Angriffe wie bei der SBB nur an die Öffentlichkeit, wenn sich Störungen bemerkbar machen - oder gestohlene Daten veröffentlicht werden.

Weiter ist die Technologie noch wenig bekannt und trifft auf eine grosse Portion Skepsis, wie Martin Bosshardt feststellt. Doch die Cyber-Angriffe nehmen zu - auch auf die Homeoffice-Konten der Unternehmen.

Dank dem Verbund Schweizer Internetprovider zur Umsetzung der neuen Technologie könnten globale Angriffe auf wichtige Systeme unterbunden werden. Die SNB hat beispielsweise ihre Homeoffice-Zugänge für die Mitarbeitenden mittlerweile auch grösstenteils über SCION abgesichert.

Unbekannt ist die Technologie aber nicht: Florian Schütz, Delegierter des Bundes für Cybersicherheit, bestätigt mehrere Testversuche. So band das Eidgenössische Departement für auswärtige Angelegenheiten (EDA) 2019 als Pilotversuch die Schweizer Botschaft in Deutschland über SCION-Technologie an. Einen zweiten Pilotversuch startete das EDA 2021 mit der Anbindung der Botschaft in Südkorea und der Verbindung mit der demilitarisierten Zone an der Grenze zu Nordkorea.

Auch die Armee und das Nationale Zentrum für Cybersicherheit (NCSC) testeten die Technologie. Der Cyber-Defence-Campus von Armasuisse betreibt seit 2022 eine permanente SCION-Netzwerktest-Infrastruktur zur Verbindung seiner Standorte in Zürich, Lausanne und Thun. Diese Testinfrastruktur dient zur Forschung und Innovation und wird aktuell mit einem zusätzlichen SCION-Knoten in Estland am Exzellenzzentrum der NATO für Cyber-Abwehr erweitert, um 5G-Netze über SCION zu testen.

Ob, und wann diese auch in anderen Bereichen angewandt werden kann, sei noch offen, sagt Florian Schütz. "Die Technologie ist interessant, bedeutet jedoch nicht die ultimative Sicherheit." So seien die schützenswerten Systeme nie ganz isoliert. "Es gibt immer einen Eingang", erklärt Schütz. Die Technologie verkleinere aber die Angriffsfläche.

Gewisse Cyberattacken seien auch über andere Massnahmen in den Griff zu bekommen. Beispielsweise könnten DDoS-Attacken über mehr Leistung, also breitere Volumen bei der Verbindung verhindert werden. Das sei letztlich aber eine Kostenfrage. "So ist der Risiko-Appetit für jedes Unternehmen steuerbar", sagt Schütz.

Ein gigantischer Sicherheitsvorteil für die Schweiz

Dass die SCION-Technologie alle Probleme der Cyberkriminalität lösen kann, wird nicht postuliert. "Die granulare Kontrolle über die eigene Angriffsoberfläche ist ein fundamentaler Unterschied was die Sicherheit angeht.

Genügend Druck für eine DDoS-Attacke aufzubauen ist mit SCION schlicht nicht möglich. Damit sind dann auch keine kostspieligen, laufend wachsende Abwehrbandbreiten mehr notwendig", sagt Martin Bosshardt und präzisiert: "Zudem sind anonyme Angriffe über juristische Grenzen hinweg nicht mehr einfach technisch gegeben. Solche Risiken können ausgeschaltet oder dann gezielt eingegangen werden."

Der Anapaya-CEO spricht von einer "sicheren Kommunikation", im Unterschied zu "sicheren Zugängen". Das bedeutet, gängige Sicherheitsanwendungen wie Firewalls, Virenschutz und Verschlüsselung von Informationen braucht es nach wie vor.

Martin Bosshardt ist sich denn auch bewusst: "Es braucht noch viel Energie und einen langen Atem, um die SCION-Technologie weiter zur Anwendung zu bringen." Auch für die Zusammenarbeit mit der SNB musste sich der Anapaya-CEO gedulden.

"Die SNB agiert bei Sicherheitsfragen höchst konservativ", erklärt Sébastien Kraenzlin die lange Testphase. Dass die neue Technologie dereinst angewandt würde, war keineswegs klar. "Wir haben sie zwei Jahre lang auf Herz und Nieren geprüft."

Der Entscheid der SNB, die Technologie für den Bankenplatz Schweiz anzuwenden, gleicht darum einem Ritterschlag: Sie muss die höchsten Sicherheitsanforderungen erfüllen. Gleichzeitig ermöglichte die SNB die Ausbreitung von SCION-Verbindungen in der ganzen Schweiz, indem sie die ansässigen Internetprovider vom Projekt überzeugen konnte, wie Sébastien Kraenzlin sagt.

Swisscom, Sunrise und Co. haben Millionen in die Technologie investiert. Der SNB-Vertreter sieht für das Land darum ein grosses Momentum:

Der Grundstein ist gelegt, bereits heute können Interessierte einen SCION-Zugang bei den Telecom-Providern bestellen und mit dem Einsatz der notwendigen Soft- und Hardware über ein sichereres Netzwerk (Swiss ISD) verbinden.

Daraus erwächst dem Land ein gigantischer Vorteil, weil wichtige Systeme im "White Net" der SCION-Technologie sicherer sind: Dazu gehören nicht nur die Dienste des Finanzplatzes, sondern auch die Spitalversorgung, die öffentlichen Infrastrukturen wie der Schienenverkehr oder die Energieversorgung.

(aargauerzeitung.ch)

Hackerangriff auf Berner IT-Firma Xplain AG

# data[].attributes.attachment_link.title
Die Schweiz hat das sicherste Internet der Welt: Wieso nur wird es kaum genutzt?

# data[].attributes.attachment_link.description
Sicheres Internet aus der Schweiz wurde von ETH-Professor entwickelt. Doch fast niemand nutzt sie, obwohl es so viele Hackerangriffe gibt, wie noch nie.

# data[].attributes.headline
Cyberattaque contre l'entreprise Xplain: un extrait du système HOOGAN datant de 2015 publié sur le darknet - les personnes concernées sont informées

# data[].attributes.subject
Cyberattaque contre l'entreprise Xplain: un extrait du système HOOGAN datant de 2015 publié sur le darknet - les personnes concernées sont informées

# data[].attributes.body
À la suite de l'attaque par ransomware qui a visé le fournisseur informatique Xplain, dont fedpol est client, un extrait du système d'information HOOGAN datant de 2015 a refait surface parmi les données dérobées et publiées. fedpol en informe directement les personnes concernées et, par souci de transparence, rend cette découverte publique.

Depuis la révélation de l'attaque par ransomware contre le fournisseur informatique Xplain, de vastes analyses sont en cours au sein de l'administration fédérale (cf. communiqué de presse du NCSC du 14 juin 2023). L'Office fédéral de la police (fedpol), qui fait partie des nombreux clients de Xplain, est en train d'analyser les données qui le concernent. Dans un premier temps, les analyses visent à identifier les risques afin de pouvoir prendre des mesures au plus vite.

# data[].attributes.body
Die IoT-Technologie hat sich als eines der effektivsten Instrumente für mehr Effizienz, Wirtschaftlichkeit und Lebensqualität entpuppt. Und sie hat ein weiteres Ass im Ärmel. Im Gegensatz zu vielen vorhergehenden technologischen Errungenschaften, die zwar breiten Wohlstand, aber eben auch soziale Probleme und enorme Umweltbelastungen nach sich gezogen haben, ist in den IoT-Technologien ein beachtliches Nachhaltigkeitspotenzial angelegt, das nur darauf wartet, ausgeschöpft zu werden. Das World Economic Forum (WEF) geht jedenfalls fest davon aus, dass sich das IoT auch als effektives Instrumentarium für mehr Nachhaltigkeit etablieren wird. Dieser Hypothese, die bereits im Fokus der diesjährigen IoT-Konferenz der asut stand, gehen wir in diesem Bulletin weiter auf den Grund.

# data[].attributes.headline
L'information à l'épreuve de l'invasion russe de l'Ukraine - La Revue d'Histoire Militaire

# data[].attributes.subject
L'information à l'épreuve de l'invasion russe de l'Ukraine - La Revue d'Histoire Militaire

# data[].attributes.body
La guerre russo-ukrainienne est, en effet, un théâtre de haute intensité, où les deux belligérants, agresseur comme agressé, usent de différents outils pour l’emporter. Si les armes semblent, par nature, être le moyen le plus aisé de triompher, les différentes parties au conflit emploient aussi les autres moyens à leur disposition dans l’ensemble du spectre de la conflictualité. Parmi ceux-ci, l’information détient une place primordiale : elle permet d’exposer sa cause, de la défendre et de la légitimer. Elle permet ainsi d’avoir un impact sur « les cœurs et les esprits », pour reprendre une expression chère au corpus contre-insurrectionnel.

# data[].attributes.attachment_link.readable_text
Le 24 février 2022, la Russie envahissait l'Ukraine, mettant un terme aux nombreux débats sur la possibilité d'une intervention directe, revendiquée et massive du Kremlin. À peine les premières frappes russes entamées contre des positions jugées stratégiques qu'en direct, l'information envahissait déjà nos écrans et nos ondes radios. Les multiplex et alertes infos se succédaient de jour en jour, rythmant les soubresauts de cette guerre. Cependant, au même moment, une autre guerre se menait aussi, bien moins meurtrière, quoique tout aussi destructrice. Une guerre assez paradoxale dans sa forme : menée discrètement par les deux camps, mais exposée aux yeux de tous, une guerre psychologique, transformant l'information en arme, avec pour finalité de gagner l'opinion à sa cause.

La guerre russo-ukrainienne est, en effet, un théâtre de haute intensité, où les deux belligérants, agresseur comme agressé, usent de différents outils pour l'emporter. Si les armes semblent, par nature, être le moyen le plus aisé de triompher, les différentes parties au conflit emploient aussi les autres moyens à leur disposition dans l'ensemble du spectre de la conflictualité. Parmi ceux-ci, l'information détient une place primordiale : elle permet d'exposer sa cause, de la défendre et de la légitimer. Elle permet ainsi d'avoir un impact sur " les cœurs et les esprits ", pour reprendre une expression chère au corpus contre-insurrectionnel.

Il convient aussi de rappeler, qu'en ce siècle d'hyper-connectivité et de haute technologie, toute information traverse les continents en un clin d'œil. Ainsi, une véritable guerre informationnelle peut être menée à moindre frais, avec un impact étendu. Celle-ci, par la transmission d'informations, véridiques ou biaisées voire erronées, cherche à avoir un double impact : envers l'ennemi, mais aussi sur les individus, tant nationaux que par-delà le théâtre des opérations dans une dimension globale, afin d'agréger des partisans à sa cause. Le moral est l'une des cibles premières de cette arme, cependant, nous verrons qu'elle peut aussi avoir des conséquences plus matérielles.

Définitions

Il convient de définir la guerre comme un affrontement interétatique, où s'opposent deux volontés, l'une cherchant à s'imposer sur l'autre. Néanmoins, bien que son essence demeure la même - cette opposition de volontés -, la guerre peut prendre diverses formes en fonction des moyens employés, comme le précisait Clausewitz qui la comparait à un caméléon.

Cette pratique doit être distinguée de la " guerre cognitive " telle qu'elle vous avait été présentée dans l'article " L'attaque des cerveaux : qu'est ce que la guerre cognitive ? ", bien que les deux soient corrélées, puisqu'il s'agit ici d'impacter le contenu de la pensée d'un public cible et non pas justement la manière dont cette pensée s'articule ou ce que " le cerveau fait de cette information ". Nous n'irons d'ailleurs pas aussi loin dans notre analyse, pour nous concentrer principalement sur les incarnations relatives à la dimension informationnelle dans la confrontation qui oppose actuellement la résistance ukrainienne à l'invasion russe.

En effet, le cœur de notre sujet demeure la guerre de l'information en Ukraine. Autant Kyiv que le Kremlin s'évertuent à développer de véritables stratégies de communication à destination de leurs propres sociétés et de l'audience internationale. Côté russe, il s'agit bien entendu de légitimer " l'opération militaire spéciale " telle qu'évoquée par les autorités, d'engager la société civile dans un conflit de longue durée, d'impacter le moral et l'engagement de ses adversaires, ainsi que d'engranger des soutiens sur la scène internationale. Du côté ukrainien, la stratégie mise en place partage les fondements de celle employée par la Russie, mais adaptée à sa posture de nation agressée : sont ainsi recherchés le maintien du moral et de la participation des citoyens, une limitation de l'impact des capacités russes et l'obtention d'appuis depuis l'étranger.

Les moyens employés, en règle générale, peuvent se catégoriser en grandes familles en fonction des objectifs poursuivis. Ainsi, toujours dans son ouvrage sus-cité, Bertrand Boyer présente les procédés de manipulation de l'information identifiés par le général Loup Francart dans ses travaux et regroupés dans quatre ensembles : communication ; mystification ; aliénation ; protection. Pour chacun de ces registres, des outils existent, allant de la diffusion de commentaires ou de narratifs pour la communication, la création d'infox pour la mystification, la mise en place au niveau politique de programmes éducatifs ayant pour but l'endoctrinement pour l'aliénation, à la fermeture de médias servant d'officine à des discours officiels de propagande en ce qui concerne la protection.

Bien entendu et logiquement, qu'il s'agisse des finalités ou des méthodes employées, des convergences, des combinaisons et des complémentarités existent, notamment afin de maximiser les résultats recherchés. Par ailleurs, la guerre de l'information n'est pas une fin en soi et demeure un aspect précis, partie intégrante d'une stratégie plus large.

En reprenant la typologie de ces quatre ensembles tels que relevés par le général Francart et relayés par Bertrand Boyer, il est possible de brosser un portrait général de la guerre de l'information actuellement en cours en Ukraine - quoique malheureusement non exhaustif du fait de l'ampleur et de la nature évolutive de ce sujet.

Communication de guerre

L'aspect le plus visible du conflit en cours est lié à la couverture médiatique couvrant au jour le jour les combats. En première ligne et relayées par les canaux médiatiques traditionnels, les déclarations des différents protagonistes du conflit et les brèves d'agence de presse permettent de suivre le déroulement des événements. Chose récurrente, certaines - notamment lorsqu'issues de parties prenantes - n'en demeurent pas moins constitutives d'un narratif, que chaque camp tente de faire prévaloir, afin de gagner en soutien et en légitimité, mais aussi pour discréditer son adversaire et réduire ses soutiens. Nous entrons ici dans le domaine de la communication de guerre, outil institutionnel ayant pour but d'atténuer les impacts négatifs du conflit et à mettre en lumière les enjeux - officiels ou officieux - afin de sauvegarder la réputation et l'intégrité de la partie qui en fait usage.

Ainsi, côté ukrainien, les autorités - et en premier lieu le président Volodymyr Zelensky - ont mis en avant le courage, la détermination, de même que l'esprit de sacrifice de la population ukrainienne, tout en donnant à voir les effets des actions russes, depuis les destructions matérielles jusqu'aux crimes de guerre. Ici, il s'agit principalement de mettre en relief le statut de pays agressé, la résistance farouche d'un peuple et le caractère illégitime de l'invasion menée par les forces du Kremlin.

De l'autre côté, la communication repose majoritairement sur un narratif exposant les liens - réels ou imaginés - entre Russes et Ukrainiens ; exprimant un sentiment d'encerclement par l'Organisation du traité de l'Atlantique nord (OTAN) pour rejeter ainsi la responsabilité de la guerre sur cette dernière ; brandissant la défense des populations russophones des deux républiques autoproclamées de Donetsk et de Louhansk ou encore dénonçant un régime néo-nazi, corrompu et génocidaire.

Que les informations soient fondées ou non, elles n'en constituent pas moins des jalons dans les stratégies informationnelles de Kyiv et de Moscou. Les communications de guerre des deux pays se confrontent et s'opposent dans une véritable lutte où démentis, critiques, manipulations, menaces et surenchères se côtoient allègrement. Il faut exposer les faits, mais aussi le narratif sous-jacent aux propos ennemis, afin de faire triompher sa vérité et son camp. Le président ukrainien a, par exemple, pu s'exprimer dans de nombreux événements internationaux, comme lors de la cérémonie des Grammy Awards, pour obtenir le soutien de la communauté internationale. La Russie, elle, a brandi à plusieurs reprises ses capacités militaires, notamment nucléaires, menaçant les pays soutenant l'Ukraine si sa survie se trouvait engagée et a même suspendu sa participation au traité New Start sur les armes stratégiques.

Cependant, le moindre faux pas peut avoir des conséquences désastreuses pour la réputation du pays, ses soutiens et son implication dans le conflit. La bataille de Bakhmout constitue ainsi un exemple intéressant. L'affrontement qui y a opposé les forces armées des deux pays entre août 2022 et mai 2023 est caractérisé par sa durée, tout comme son apprêté, qui ont fini par lui conférer une symbolique et donc une importance, soulignées par une certaine exposition médiatique et politique. Au-delà de la portée stratégique de la ville, des deux côtés, la fixation des troupes adverses a constitué un élément non négligeable, pouvant soulager d'autres parties du front ou permettre de mener des initiatives offensives sur d'autres secteurs.

Par ailleurs, la potentialité de réduire par l'usure les effectifs humains et matériels de l'ennemi était non négligeable pour les deux camps. Les forces de Kyiv bénéficiaient de l'avantage défensif, conféré par le terrain urbain, alors que l'armée russe a pu y déployer la même tactique de manœuvre des feux employée à plusieurs reprises dans le Donbass avec succès - mais non sans pertes - notamment à Soledar ou auparavant à Lyssytchansk. À l'heure où ces lignes sont écrites, la ville est tombée au prix d'au moins 20 000 assaillants tués. Toutefois, des contre-attaques ukrainiennes sur les flancs laissent planer l'éventualité d'un futur encerclement pour les combattants du Kremlin, les mercenaires du groupe Wagner s'étant retirés.

Néanmoins, le coût fut tel qu'il ne pouvait être caché et la communication à ce sujet, pour ses aspects les moins manipulés, a bien fait état de la difficulté des combats et des pertes subies, éléments que les deux belligérants ont tendance à minorer habituellement - la Russie davantage que l'Ukraine - pour préserver leur moral. De part et d'autre, le ressenti des combattants s'est exposé dans les médias et sur les réseaux sociaux, et soulignait pour certains un décalage avec les décisions politiques. Ainsi, certains militaires ukrainiens ont pu témoigner de leur lassitude et des difficultés rencontrées. En face, outre la rivalité entre la private military company (PMC) Wagner, qui y a déployé de nombreux détenus, et l'armée du Kremlin, les pertes subies dans les actions offensives menées parallèlement dans l'est de l'Ukraine - Vuhledar, Kremmina, Avdiivka - ont motivé des combattants à enregistrer des messages vidéos destinés au président Vladimir Poutine afin de quémander son aide pour améliorer leur situation.

Le directeur de Wagner, Evgueny Prigozhin, n'a pas non plus caché que le manque de munitions et les pertes qui lui étaient imputables pouvaient conduire au retrait de ses unités de Bakhmout. Par ailleurs, ce constat s'est aussi doublé de vives critiques à l'encontre du commandement militaire russe. Vives critiques qui ont finalement abouti à une confrontation entre le ministère de la Défense russe et la PMC dont le point culminant fut une " marche pour la justice ", à savoir une rébellion contre le Kremlin du 23 au 24 juin 2023. Sans entrer dans les détails de cette mutinerie, encore floue, il semblerait que ces demandes répétées en munitions aient servi à la préparation de cette entreprise finalement avortée. Depuis, Prigozhin a trouvé refuge au Bélarus, tandis que les membres de son organisation se sont vus offrir la possibilité de signer un contrat avec l'armée, de rentrer chez eux ou de rejoindre leur chef.

Cacher l'âpreté des combats ou dissimuler la volonté politique - mûe par l'enjeu stratégique de la ville - de poursuivre les opérations dans le secteur de Bakhmout aurait forcément eu un impact négatif pour les deux camps, autant sur les combattants eux-mêmes que sur les populations nationales ou internationales spectatrices, qui n'y auraient vu que de l'acharnement pur et simple et le sacrifice inutile de nombreuses vies. Les conséquences potentielles d'un tel choc psychologique auraient pu être catastrophiques : effondrement des combattants, opposition de la population, crise politique nationale ou internationale... en résumé, une perte de soutien et de légitimité.

Cette communication institutionnelle est donc essentielle et constitue, pour ainsi dire, la principale information qui parvient en dehors des pays. À première vue, elle semble simplement exposer des faits. Néanmoins, la nature hautement politique de la guerre ne tarde jamais à se rappeler aux consciences et donc à tenir aux aguets des messages en filigrane et des manipulations, réelles ou supposées.

Et guerre de communication...

Ce volet politique n'est cependant pas la seule source de connaissances. Dans la continuité des nombreux conflits qui ont éclaté ces vingt dernières années et tout particulièrement de la guerre civile syrienne, l'invasion russe de l'Ukraine implique une transmission et une diffusion bien plus larges des informations. Là où, précédemment, les principaux vecteurs étaient radiophoniques, télévisuels ou papier, l'utilisation des nouvelles technologies de l'information et de la communication par l'ensemble des parties prenantes aux conflits ouvre de nouvelles perspectives. Qu'elle soit civile ou militaire, actrice, témoin ou victime, n'importe quelle personne peut dorénavant faire office de relais informationnel.

De nos jours, les téléphones étant tous équipés de capteurs photographiques et vidéo, le contenu visuel est facilement accessible et partageable. En complémentarité de la communication diffusée par les canaux traditionnels, il est donc possible de s'informer davantage et en quasi instantanéité. L'avantage informationnel est non négligeable et permet de mener de véritables réflexions sur les événements et leurs évolutions, à l'image des points de situation de certaines agences de renseignement, de commentateurs ou d'analystes, qu'ils soient professionnels ou amateurs. Mais également d'entreprendre des investigations salutaires - à l'instar de celles menées par le collectif Bellingcat -, permettant de dissiper un peu le brouillard de guerre, forcément amplifié par les déclarations des deux camps, et de mettre à jour scandales et crimes de guerre.

Aussi, il n'est pas rare qu'une bataille des chiffres se déroule, les deux camps amplifiant les pertes ennemies estimées, tout en dissimulant les leurs. Ces déclarations ont pour but d'impacter la perception qu'ont les observateurs et les participants au conflit, notamment à des fins psychologiques : la perspective de l'érosion, voire de la destruction du potentiel adverse permet d'impacter le moral, les attentes, mais aussi le soutien national et international avec en horizon l'éventuel règlement du conflit. Ainsi, l'armée ukrainienne tient quotidiennement un décompte des dégâts causés aux forces russes - qui ne correspondent pas forcément aux estimations des services de renseignement occidentaux ou russes -, tandis que le Kremlin ou ses partisans ont plusieurs fois annoncé la destruction d'armements occidentaux promis à Kyiv, alors même que certains d'entre eux n'avaient pas encore été livrés.

Certains sites, communautés et personnalités permettent néanmoins d'y voir plus clair. Le site Oryxspioenkop a ainsi pu établir un état des pertes matérielles russes et ukrainiennes en se fondant sur les photos et vidéos disponibles en ligne. Ces listes ne concentrent donc que ce qui est visuellement attesté et relèvent d'une logique a minima, mais extrêmement fiable, des correctifs étant appliqués en cas de doublons, d'erreurs ou de manques (pouvant d'ailleurs être relevés par le public qui en informe alors l'équipe). Le compte twitter Tatarigami_UA, appartenant d'après sa description à un officier de réserve ukrainien, est aussi une véritable mine d'informations sur les aspects opérationnels du conflit en cours. À tel point que plusieurs de ses tweets informatifs ont été exploités par des médias tiers sans forcément qu'il ne soit crédité, ce qu'il a d'ailleurs récemment déploré.

As our troops advance towards the primary line of defense south of Staromlynivka, whether they proceed directly or choose to breach the line elsewhere, I'd like to share some information about the defenses and other hidden challenges of the current situation.

🧵Thread: pic.twitter.com/zKdRQgIRqF
- Tatarigami_UA (@Tatarigami_UA) June 13, 2023

Côté pro-ukrainien, certains commentateurs ont fait à plusieurs reprises état de contre-offensives qui n'avaient pas eu lieu, par exemple au nord de Bakhmout. Des personnes, comme ce Canadien communiquant sous le pseudo " Canadian Ukrainian Volunteer " et l'Américain James Vasquez, ont aussi pu bénéficier d'une certaine audience, voire de soutiens, en faisant preuve de malhonnêteté. En effet, le premier n'a jamais mis les pieds en Ukraine, tandis que le second a menti sur sa carrière militaire et sur les conditions de sa présence en Ukraine, faisant croire qu'il combattait auprès des forces ukrainiennes, alors même qu'il n'aurait fait que les suivre, un peu en touriste. Nous ne sommes pas loin du cas d'Adrien Boquet, ancien militaire français depuis expatrié en Russie, qui avait menti sur sa carrière sous le drapeau hexagonal, son expérience en Ukraine et qui, depuis, contribue à la propagande du Kremlin.

Nous assistons donc sur les réseaux sociaux à une véritable guerre entre partisans des deux camps - issus des mondes politique, militaire ou civil -, à coup de données, mais aussi, et surtout, d'éléments de langage ou de narratifs. Aux soutiens de la résistance ukrainienne et de ses succès, d'autres opposent un risque d'escalade - bien que le pays soit l'agressé - ou une implication militaire directe de l'OTAN. À l'intérêt d'un renforcement des systèmes d'alliances en Europe d'autres brandissent ce qu'ils perçoivent comme une machination atlantiste. Lorsque des personnes ou des États condamnent et cherchent à ce que justice soit faite pour les crimes de guerre russes, ces derniers et leurs partisans crient au coup monté et nient leur responsabilité, lorsqu'ils ne la rejettent pas tout simplement sur Kyiv. Enfin, d'autres inversent les rôles en plaçant l'Ukraine en responsabilité du conflit, bien entendu sous instrumentalisation américaine.

Certains individus, connus ou non, deviennent ainsi de véritables caisses de résonance pour des informations qui ne sont pas forcément sourcées et créent conséquemment un nouvel espace de conflictualité où les données partagées peuvent se diffuser encore davantage. La légende du fantôme de Kyiv, un présumé pilote de l'armée de l'air ukrainienne qui aurait abattu plusieurs appareils russes au dessus de la capitale au début de la guerre, incarne une bonne représentation de ce phénomène : les avions ukrainiens se relayant, peu étaient aperçus dans le ciel de la ville, laissant imaginer la présence d'un unique chasseur. L'opiniâtreté de la résistance ukrainienne a rapidement renforcé cet imaginaire, pour aboutir à cette légende du fantôme de Kyiv, as aérien défenseur de la ville. Très vite, l'information s'est répandue, avant d'être démentie par le commandement de l'armée de l'air lui-même.

Cependant, ce cas souligne bien l'importance des exemples de bravoure dans des situations désespérées - à l'image du contexte - qui sont particulièrement bienvenus pour alimenter et maintenir le moral. Le " Ghost of Kyiv " prit tellement d'ampleur que des produits dérivés n'ont pas tardé à se multiplier, un manga japonais lui ayant même été consacré ! Il en va de même pour certaines phrases largement diffusées, comme le fameux " Русский военный корабль, иди нахуй " (" Navire de guerre russe, va te faire foutre") proféré par les garde-frontières défendant l'île des Serpents le 24 février, ou encore la réponse présumée qu'aurait prononcé le président ukrainien Zelensky à une proposition d'évacuation américaine rétorquant qu'il avait besoin de munitions et non pas d'un taxi, toutes deux prononcées au début de la guerre et largement diffusées sur les réseaux sociaux.

Ces détails peuvent sembler de véritables non-événements aux yeux de certains observateurs, dans le sens où ils ne sont que mythes ou paroles. Pourtant, leur potentiel repose dans leur caractère rassembleur et inspirant, à même de mobiliser l'empathie et la sympathie, éléments non sans une certaine importance dans cette quête des cœurs et des esprits. Il n'est guère étonnant que certains canaux officiels, notamment le compte Twitter du ministère de la Défense ukrainien, aient largement adopté ce registre, comme en témoignent les nombreuses productions audiovisuelles qui, tour à tour, remercient les pays donateurs d'armes, invectivent les soldats russes en leur conseillant de se rendre, voire de collaborer, ou encore mettent en avant les besoins en matériels via une communication stratégique, le tout mis en scène en empruntant des codes cinématographiques ou un ton léger, parfois décalé.

Bénévolement ou non, des personnes servent donc de relais informationnels. Bénévolement lorsque ceux-ci le font par conviction, croyance, méconnaissance, voire naïveté ; de façon rémunérée quand ceux-ci font partie intégrante d'une stratégie communicationnelle déployée par un acteur. La Russie possède ainsi d'" usines à trolls ", composée d'internautes payés à mener, entre autres, des actions d'influence sur internet. Des passerelles existent d'ailleurs entre ces deux types de relais - bénévoles et rémunérés -, des comptes officiels pouvant récupérer du contenu d'amateurs ou inversement.

L'une des dernières informations de cette nature était une vidéo de deux soldats présumés ukrainiens harcelant une femme et son enfant en voiture. D'abord postée par des comptes pro-russes sur Telegram et Twitter, elle n'a pas tardé à être relayée sur le compte Twitter officiel du ministère des Affaires étrangères russe. Toutefois, et assez rapidement, de nombreux internautes ont pu localiser le lieu de ce qui s'avérait être une mise en scène assez médiocre tournée dans la région de Donetsk occupée par la Russie. Les soldats n'étaient donc pas Ukrainiens et le véritable enjeu de cette production était de provoquer un sentiment négatif envers la légitimité de la résistance des forces de Kyiv.

Aussi, à plusieurs reprises, des vidéos d'événements réels, mais décorrélés, car sortis de leur contexte ou pris en d'autres temps et lieux viennent faussement confirmer des faits tout juste relayés. Une véritable investigation est alors nécessaire pour discerner le vrai du faux, autrement qualifiée de débunkage ou de Fact Checking. Cette tendance s'amplifie et l'évolution des technologies, ainsi que l'apport de l'intelligence artificielle, n'augurent pas d'une amélioration positive de la situation : ces outils permettent d'obtenir des infox de plus en plus crédibles et difficiles à déceler, car pouvant être créées de toutes pièces.

C'est ainsi qu'un faux discours du président russe Vladimir Poutine appelant à la mobilisation générale a pu être diffusé le 5 juin dernier sur les ondes radios et télévisées de trois Oblasts russes par piratage.

Several Russian radio stations were hacked and played a fake Putin speech announcing an invasion from Kyiv's troops and emergency measures in three regions bordering Ukraine.

The voice, very similar to President Putin's, also announced martial law, general mobilisation and the... pic.twitter.com/bCuWSYjsP1
- Yasmina (@yasminalombaert) June 5, 2023

L'objectif de cette intoxication était d'amplifier la méfiance de la population russe de ces régions envers la communication officielle, mais aussi créer un mouvement de panique à même de faciliter les incursions récemment débutées de forces russes ralliées à l'Ukraine - la légion " Liberté de la Russie " et le Corps des volontaires russes - luttant contre le régime en place en Russie.

En répercussion, le travail de vérification de l'information prend une tournure plus large pour anticiper en amont les risques de désinformation. De nombreux comptes sur les réseaux sociaux répertorient les individus de nationalités diverses diffusant la propagande russe, et repèrent aussi les éléments narratifs afin de les cataloguer et de leur apporter des réponses. Par ailleurs, des communautés se sont créées dans les deux camps pour organiser de véritables campagnes de propagande et de contre-propagande à destination du public profane sur les différents réseaux sociaux, ainsi que pour soutenir leur camp de manière plus pratique.

Notons l'existence de la communauté pro-ukrainienne dite " NAFO ", parodie de NATO - l'OTAN -, arborant des photos de profil personnalisées, mais ayant toutes pour point commun la tête d'un chien de race shiba inu (le fameux meme Doge). Leur action ne se limite pas à de la contre-propagande puisque les membres de cette communauté informelle ont aussi organisé des collectes de fonds et de matériels, et mené des opérations de cyber-harcèlement des comptes et plateformes sociales pro-russes pour perturber leur organisation. Leur action a été telle que de nombreux médias et personnalités politiques en ont parlé, le ministre de la Défense ukrainienne, Oleksiy Reznikov, arborant même en photo de profil Twitter un avatar confectionné par cette communauté. Néanmoins, du fait de son caractère de groupe constitué d'individus d'horizons divers, le relai de fausses informations, par exemple sur de prétendus échecs russes ou succès ukrainiens, en est tout autant facilité.

L'importance de l'aspect informationnel a donc été très vite saisie par les deux camps. Toutefois, l'information peut aussi avoir une finalité plus pratique, qui ne se limite pas aux problématiques de légitimité, de moral et de soutien.

Mystification et information : manipuler le brouillard de guerre

Il peut donc y avoir une concrétisation opérationnelle à ces desseins de mystification. Pour comprendre son utilité, il convient de se pencher sur le déroulement des affrontements dans le cadre d'une guerre de haute intensité.

L'un des exemples les plus flagrants de mystification s'observe lors de la double offensive ukrainienne, qui a permis les libérations de la région de Kherson au sud du pays et de Kharkiv au nord-est à l'été-automne 2022. Pour reprendre le territoire perdu au cours des premiers mois de guerre, les Ukrainiens devaient pouvoir compter sur un rapport de force avantageux et sur l'effet de surprise. Le commandement a donc mis sur pied une opération de déception afin de permettre à son offensive sur Kharkiv de réussir dans les meilleures conditions. Celle-ci consistait à cacher les intentions premières en faisant croire à un intérêt particulier pour la tête de pont de Kherson afin de provoquer une relocalisation des troupes du Kremlin et de les prendre au dépourvu sur deux théâtres différents.

Cette région fut d'abord désignée publiquement comme objectif principal de la contre-offensive ukrainienne tant attendue, ce que les médias occidentaux ont, bien entendu, largement relayé. Des frappes en profondeur - jusqu'en Crimée -, des actions de partisans, ainsi que des assauts dans le secteur ont aussi contribué à donner une certaine consistance à ces allégations. La diffusion de l'information a été telle que les forces russes ont commencé à masser des troupes dans le sud du pays pour contrer cette opération présumée. Cependant, ne disposant pas d'effectifs illimités, le Kremlin a dû en prélever dans d'autres secteurs, notamment celui de Kharkiv, intention primaire de l'Ukraine, dorénavant facilitée. Le front fut percé le 7 septembre par l'armée ukrainienne, qui a ensuite exploité son succès pour libérer toute la région.

Précisons qu'il s'agit toutefois d'une interprétation à postériori et qu'il se pourrait, dans un conflit où l'information est une arme, que l'offensive contre Kherson n'ait pas été de prime abord une ruse, mais le serait devenu ensuite dans le narratif en raison de la résistance russe qui lui fut opposée.

Plus récemment, la divulgation dans les colonnes de plusieurs journaux des difficultés de l'armée ukrainienne lors des derniers mois d'affrontements à Bakhmout n'était pas non plus passée inaperçue. Les combats y étaient durs et violents, si bien que l'armée ukrainienne ne contrôlait plus qu'un tiers de la ville en date du 1 er avril 2023. Cela n'enlevait rien au caractère courageux et acharné de sa défense face à une importante concentration de moyens russes. Au regard de cette dernière d'ailleurs, dépeindre une situation encore plus désespérée qu'elle ne l'est déjà peut avoir un avantage indéniable autant au niveau tactique que stratégique. La possibilité qu'il ait pu s'agir de désinformation visant à pousser les Russes à rester focalisés sur cette ville n'est pas impossible, d'autant que les forces ukrainiennes préparaient une offensive majeure dans une direction encore indéterminée, mais dont les premières étapes semblent se dérouler au moment où cet article est rédigé (juin 2023).

Une situation similaire de possible désinformation était d'ailleurs survenue côté ukrainien avec les rapports faisant état d'un possible retrait russe de la ville Kherson en novembre 2022, alors que la région était le théâtre d'affrontements pour sa reconquête. La crainte était que ce retrait soit une feinte visant à précipiter l'attaque de Kyiv droit dans un piège.

Côté russe, la déception a été menée à plusieurs reprises, s'appuyant sur le flou des intentions non divulguées et les interprétations que pourraient en tirer les médias. C'est le cas, par exemple, des différents dispositifs russes conventionnels qui se sont succédés - 9000 militaires envoyés en octobre 2022 pour constituer un groupe régional mixte avec des troupes biélorusses, effectif qui aurait grimpé à 10 000 en janvier sur fond d'exercices militaires conjoints, avant de diminuer de plus de moitié pour se rapprocher des 4000 fin mars 2023 - et celui, non conventionnel, en cours en Biélorussie. Largement documentés et relayés dans les médias, ces divers déploiements de forces dans la région même d'où était partie une des offensives russes du 24 février 2022 avec pour objectif Kyiv, ne manquent pas de soulever des interrogations : véritable intention d'y placer des forces en vue d'une offensive future, réflexe défensif ou simplement moyen de pression ? Difficile de le savoir, mais il ne fait aucun doute que le flou est volontaire : il s'agit de tromper l'adversaire sur ses intentions réelles.

Les nombreuses photos, vidéos, ainsi que les déclarations politiques russes de ce déploiement de personnels, de matériels et d'armes (notamment nucléaires) ont largement contribué à révéler cet état de fait, qui ajoute une menace à la frontière nord de l'Ukraine et y fixe donc des effectifs qui auraient pu être déployés ailleurs, par exemple pour la grande contre-offensive attendue. Kyiv précise tout de même avoir pris ses précautions, surtout avec l'arrivée des forces de Wagner fin juin, relocalisées au Bélarus après l'échec de leur " marche pour la justice ". Cette opacité d'intention est un exemple typique de Maskirovka, cet art du camouflage russe, que l'Ukraine maîtrise tout autant.

La production audiovisuelle peut aussi avoir un but bien plus direct : les vidéos présentant des numéros de lignes téléphoniques pour se rendre ou encore celles de Captain HIMARS, soldat ukrainien au visage dissimulé devant un lance-roquettes multiple HIMARS, conseillant aux soldats russes de transmettre les coordonnées de positions en échange d'un non-ciblage de leurs casernements, ont une finalité claire et annoncée, relevant de la provocation.

L'information devient alors une arme utilisable à des fins opérationnelles. Il convient de préciser que les instigateurs d'une telle pratique ne sont pas essentiellement étatiques : des civils peuvent prendre part aux processus de création, de partage, mais aussi d'exploitation de l'information. Ces différents processus s'illustrent particulièrement dans la défense de la ville de Sumy située dans le nord-est du pays, lors des premiers mois de la guerre. Combattants comme civils y ont contribué en photographiant les unités russes approchant de l'agglomération et en s'organisant via téléphone pour tendre des embuscades. L'information circulait vite et permit à la ville de résister.

Ces utilisations pratiques de l'information appellent donc des réponses adéquates par les belligérants, afin d'éviter tout débordement à même de leur porter préjudice.

Protéger et informer

Lorsque l'information devient une arme, il est nécessaire de se protéger des risques qu'elle peut engendrer, mais aussi des menaces qui peuvent atteindre les outils informationnels à disposition. Puisque le cycle informationnel suit un processus clair de collecte/vérification/exploitation/production/diffusion, il est possible, voire nécessaire, d'apporter à chacune de ces étapes des mesures de protection. Bien entendu, ces procédés ne sont pas de même nature : protéger d'une part ce qui est nécessaire ; restreindre ou empêcher si possible ce qui est nuisible ; contourner les possibles obstacles.

Avant tout, les mesures de sauvegarde sont destinées à garantir en finalité l'accès à l'information. Les deux camps dans la guerre en cours se sont assurés de cela aux différents niveaux du cycle informationnel.

Autant la Russie que l'Ukraine se sont tournés vers des canaux officiels pour gérer leur communication et la diffusion de l'information. Cette dernière est produite, comme vue précédemment, par des professionnels ou des amateurs, à destination de publics différents. Un cadre régit cette activité lorsqu'elle est professionnelle et ses acteurs bénéficient donc d'un statut particulier. Les deux pays sont ainsi signataires de la Convention de Genève dont l'article 79 protège les journalistes en les considérant comme civils.

Une autre manière d'impacter le cycle informationnel, lorsqu'il n'est pas possible d'atteindre le stade de production, est de cibler la diffusion. Cela s'effectue majoritairement par la censure via le contrôle, voire l'interdiction de certains médias. C'est ainsi que le Conseil de l'Union européenne a suspendu, via adoption d'un règlement et d'une décision le 2 mars 2022, la diffusion télévisée et internet des médias russes Sputnik et RT. Ceux-ci servaient, en effet, de relais à la propagande étatique russe. Autrement, autant l'Ukraine que la Russie ont aussi décidé d'agir sur leurs paysages médiatiques respectifs. Le 29 décembre 2022, Kyiv a ainsi fait passer une loi permettant une régulation plus simple des médias, par exemple pour fermer un site sans décision de justice. Bien qu'étant nécessaire pour lutter contre la propagande russe sur les ondes ukrainiennes, cette loi inquiète du côté de certains journalistes qui craignent pour l'indépendance de l'information, d'autant que certaines voix qui s'étaient exprimées contre ce projet de loi avaient été qualifiées - à tort ou à raison - de pro-russes, la propagande du Kremlin allant dans le même sens.

A contrario, la critique du Kremlin sur la décision ukrainienne est quelque peu ironique, la censure russe étant bien plus poussée et coercitive. L'un des acteurs majeurs de celle-ci est le Service fédéral de supervision des communications, des technologies de l'information et des médias de masse ( Роскомнадзор/ Roskomnadzor). Cette instance de régulation surveille le paysage médiatique russe et rappelle à l'ordre tout manquement à la loi. Or, depuis le début de l'invasion de l'Ukraine, le corpus législatif s'est agrémenté de plusieurs lois visant à protéger le pouvoir mais aussi la légitimité de l'opération militaire spéciale, telle que nommée par Moscou.

Ainsi, plusieurs communiqués de Roskomnadzor viennent alimenter cet état de fait : dans un régime autoritaire où l'information est contrôlée et où une réponse pénale, voire arbitraire (élimination par exemple), peut frapper les opposants, le passage à un état de guerre qui ne dit pas son nom s'accompagne de toute une batterie de mesures pour préserver l'illusion d'une simple opération militaire spéciale. Certains termes, comme " déclaration de guerre " ou " invasion ", sont ainsi proscrits ; des constats pragmatiques sur la nature ou le déroulé des événements peuvent être considérés comme des mensonges destinés à porter atteinte à l'image des forces armées russes et donc conduire à des peines pouvant aller jusqu'à quinze ans d'emprisonnement depuis l'adoption d'un amendement allant dans ce sens le 4 mars 2022 ; ou encore des données ou informations relayées depuis l'étranger sont vues comme autant d'infox d'agents étrangers chargés d'intoxiquer la population russe, justifiant la censure des relais occidentaux et l'utilisation exclusive de sources officielles russes par les médias nationaux.

Des médias sont fermés, des journalistes arrêtés et condamnés - à l'instar de Marina Ovsiannikova qui a été arrêtée et condamnée plusieurs fois pour avoir manifesté à diverses reprises son opposition à la guerre, notamment en plein direct d'un journal télévisé, avant de trouver refuge en France avec sa fille -, des rédactions étrangères quittent le pays.

Néanmoins, il existe des moyens pour parer à ces éventualités. Protéger la diffusion de son information, c'est utiliser un maximum de canaux pour contourner la censure. Ainsi, face à la fermeture de leurs rédactions occidentales, certains médias russes, financés par le Kremlin et donc relayant son narratif, ont décidé d'investir d'autres continents. Ils se sont aussi servis d'internet et de sites miroirs - copie de leurs anciens sites, mais au nom de domaine cette fois-ci modifié - pour permettre de contourner censure et blocages pour toucher le public occidental par exemple. De nouveaux médias sont aussi créés par les anciens membres des subdivisions fermées à l'instar d' Omerta, média revendiquant une totale indépendance dont le président est Charles d'Anjou, homme d'affaire et politicien français installé en Russie, et le directeur de la rédaction, Régis Le Sommier, grand reporter, ancien de Paris Match, mais aussi de RT France.

On note l'usage massif qui est fait, dans les deux camps, des messageries instantanées et du format vidéo, permettant à tout un chacun de devenir producteur de contenu et diffuseur. À cet égard, la messagerie Telegram est devenue une véritable arme, servant tour à tour à diffuser les informations liées au camp défendu, à la collecte d'information ou encore d'outil pour porter atteinte au narratif adverse, notamment en menant des actions de harcèlement ou de contre-propagande dans ses propres espaces d'expression. De surcroît, l'usage de tels canaux alternatifs permet de contourner en partie la censure étatique, bien que le public touché reste moindre, puisque forcément limité aux utilisateurs de l'application et/ou ceux au courant de l'existence de ces relais.

Enfin, parmi l'éventail des possibilités dans le domaine de la protection, une pratique se démarque particulièrement par son incidence et les risques qu'elle induit lorsque non respectée : la sécurité opérationnelle. Comme vu précédemment, l'information peut avoir un impact sur le terrain. De ce fait, il importe de tenir compte de cet aspect puisque des vies sont en jeu. Dans nos sociétés hyper-connectées, les délais entre collecte et diffusion se sont restreints au minimum. Ainsi, un événement tout juste débuté peut simultanément être relayé. Cela est notablement problématique dans le domaine militaire où l'effet de surprise demeure essentiel pour l'emporter, comme nous l'avions évoqué. Pour préserver cet avantage, il est nécessaire, autant pour les civils que les militaires, d'adopter la bonne posture : celle de la discrétion et de la rétention de l'information.

Conséquemment, en complémentarité de l'intoxication qui peut être employée pour préparer une offensive - par exemple pour forcer l'ennemi à dégarnir le futur théâtre d'opération - il reste nécessaire de préserver au maximum le déploiement du dispositif. Pour ce faire, il convient de ne pas diffuser d'informations à propos, tout en continuant les mesures de déception. Cela est particulièrement visible dans le cadre de la contre-offensive ukrainienne actuelle où la rétention de l'information a été entretenue et demandée au moyen notamment d'une communication officielle allant en ce sens même sur les réseaux sociaux. Il aura fallu attendre plusieurs jours pour obtenir les premières informations côté ukrainien. Aujourd'hui encore, il semblerait qu'un certain décalage existe entre les opérations - qui se confrontent à la résistance russe - et leur communication, provoquant attentes et réactions positives ou négatives.

L'impact psychologique est ici lié à l'opacité de la situation, dont les bribes d'informations qui remontent dressent immanquablement un portrait biaisé, à même d'atteindre le moral des observateurs et acteurs. En retour, leurs réactions ne sont pas sans conséquences, autant sur le camp menant l'action - à l'image de l'agacement du commandant en chef ukrainien Valery Zaloujny face aux commentaires occidentaux sur le rythme de la contre-offensive - que sur son adversaire.

Face au silence opérationnel de mise côté ukrainien, la communication sur ce théâtre d'opérations à surtout était le fait de la Russie. Ainsi, les pertes de Kyiv en véhicules occidentaux ont-elles fait le tour du monde, provoquant un certain choc psychologique aux yeux du public : les équipements tant attendus et vantés, à l'instar du char d'assaut Léopard 2, semblent ne pas garantir le succès ukrainien.

Pourtant, rien n'est moins certain : une offensive prend du temps à se développer et les pertes sont forcément importantes pour l'attaquant, comme ce fut le cas pour les forces russes lorsque celles-ci étaient à l'offensive. Les gains actuels ne peuvent laisser présager des résultats des prochaines semaines, qui seront à n'en pas douter cruciaux.

Et n'oublions pas que seuls les informations russes parvenaient, certaines surexploitées, contribuant à une vision biaisée de la situation : ainsi, les mêmes matériels détruits furent communiqués comme autant de nouveaux succès alors qu'il ne s'agissait que de photographies et vidéos prises sous des angles différents. Le front évoluant constamment, certains de ces armements endommagés ont d'ailleurs pu être récupérés par l'Ukraine.

Tout le dilemme repose donc sur l'équilibre à trouver entre communication et protection. Néanmoins, cette rétention de l'information ne se restreint pas seulement du point de vue étatique et médiatique. Il faut aussi s'assurer que des pratiques adéquates soient adoptées. Civils comme militaires doivent éviter de divulguer des éléments - à l'instar de photographies - permettant d'identifier le lieu, le moment et les moyens de l'opération envisagée.

À défaut de pouvoir acculturer totalement et de manière permanente les combattants à ces pratiques de sécurité, des mesures coercitives ont pu être prises, via les régulateurs des médias des deux camps, ou des interdits ciblant certains usages dans des situations particulières, par exemple celui du téléphone portable dans les zones de combat.

L'Aliénation par l'information ou quand la coercition devient un moyen de conviction

La coercition est employée dans les deux camps, mais à des degrés divers pour des finalités malgré tout similaires : la protection des personnes, du matériel, des infrastructures, du moral et de l'effort de guerre.

Néanmoins, la Russie en fait davantage usage puisque ces mesures débordent le simple cadre de cette guerre. Il n'est pas question de faire ici l'historique des moyens institutionnels disponibles pour le Kremlin, simplement de se pencher sur un aspect bien particulier, lié justement au régime politique russe. Comme dans tout régime autoritaire ou glissant progressivement vers cet état, l'information sert aussi à modeler les consciences et les représentations populaires. L'URSS, comme bien d'autres régimes durant les XIX e et XX e siècles, en ont fait large usage. Toutefois, dans le cas du sujet traité, l'information revêt un intérêt supplémentaire : modeler l'opinion publique, ainsi que ses pratiques, quitte à faire usage de pression ou d'embrigadement. Cet aspect est particulièrement notable côté russe, mais quasiment anecdotique côté ukrainien du fait de son rapprochement avec les pays occidentaux qui l'oblige à adopter une certaine éthique.

L'une des dimensions les plus intéressantes est l'utilisation de la télévision pour modeler une unité de la Russie contre l'Occident jugé décadent. Cette utilisation est aussi destinée aux publics occidentaux susceptibles d'y être réceptifs. Les différents événements dépassant le seul cadre opérationnel de la guerre, comme les sanctions, y sont illustrées dans leurs supposées conséquences pour les pays qui ont imposé ces dernières : ceux-ci y sont dépeints comme progressivement ruinés, frappés par la famine et le froid. Néanmoins, cette propagande télévisuelle demeure aussi un élément de la guerre informationnelle qui se joue actuellement. Il existe cependant d'autres formats sur ce vecteur, destinés davantage au public russe. Ceux-ci peuvent être des talk-shows, des manifestations ou encore des programmes éducatifs. Ces derniers sont particulièrement notables et permettent de bien saisir l'essence de l'aliénation par l'information.

Ici, le fameux dessin animé sur les rudiments de la guerre de position. Contrairement à ce qui est avancé dans le tweet, rien ne confirme que le ministère de la Défense russe soit à l'origine de la publication de cette vidéo. Néanmoins, si tel était le cas, cette vidéo pourrait alors être destinée à des conscrits ou des volontaires sans expérience militaire préalable.

Il n'empêche que celle-ci est largement partagée sur les réseaux sociaux, facilitant sa diffusion et donc la potentialité qu'elle touche le public initialement ciblé.

Sorties de leur contexte, ces émissions sembleraient simplement une tentative d'embrigadement assez limitée, puisque liée à un seul vecteur et souvent avec une réalisation assez amatrice. Pourtant, avec du recul, on observe que de nombreuses mesures ont été prises par le Kremlin à destination de la jeunesse russe. Ces dessins animés s'inscriraient donc dans une optique plus large d'embrigadement et d'aguerrissement - certes relatif - de la nouvelle génération.

Toutefois, d'un point de vue extérieur à la Russie, les images laissent entrevoir une autre réalité que celle que tentent de promouvoir les reportages dédiés à la Younarmia. Les activités sportives et culturelles sont, pour la plupart, teintées d'un militarisme assumé, qui n'est pas sans rappeler les formations d'embrigadement des jeunes générations des États totalitaires durant le XX e siècle et dont les membres fanatisés ont pu être déployés sur le champ de bataille. Le nom du groupe en lui-même n'est pas innocent. Il est encore difficile de savoir quelle est l'efficacité d'un tel dispositif sur ses adhérents, mais le souvenir de certains épisodes historiques n'en rappelle pas moins que les enfants ou adolescents soldats entraînés et fanatisés ont pu constituer des unités redoutables de régimes autoritaires ou totalitaires aux abois, à l'instar de ceux de la 12 e panzerdivision SS Hitlerjugend durant la Seconde Guerre mondiale ou des bassidjis iraniens lors de la guerre Iran-Irak. Un tel embrigadement a un impact non négligeable sur la psychologie d'un individu : en modelant son esprit dès le plus jeune âge, il est possible de créer en ce dernier un jusqu'au boutisme et une loyauté aveugle en des valeurs qu'il pourra être difficile de défaire.

L'entrainement aux armes de civils, adultes comme mineurs, n'est pas visible qu'en Russie. Des images en Ukraine montrent en effet la population apprendre à les manier : ici pas d'embrigadement institué au niveau étatique, mais un volontariat motivé par une peur de l'invasion russe.

Sur ces images prises par un journaliste de la BBC, des membres du décrié régiment Azov instruisent des civils à des fins d'autodéfense. Cette unité est critiquée en raison de son noyau dur de néo-nazis à ses origines. Mais l'incorporation de l'unité au sein de la Garde Nationale ukrainienne en novembre 2014 et l'ouverture du recrutement lié à cette institutionnalisation, substitue à ce néo-nazisme un nationalisme patriote pour reprendre les termes du chercheur Adrien Nonjon. Nous ne pouvons que vous conseiller son article pour en apprendre davantage.

D'ailleurs, ce point de vue est à mettre en parallèle avec un récent article d'Eliott A. Cohen, politologue américain, adapté d'un discours prononcé lors de la conférence sur l'arche stratégique de l'Institut polonais des affaires internationales, le 17 mai 2023, précisant que l'Ukraine ne devait pas seulement gagner : la Russie devrait parallèlement s'effondrer pour permettre une paix viable. La survie du régime du Kremlin entre dorénavant en jeu, d'autant qu'il semble peu probable que Vladimir Poutine puisse concéder la défaite de son pays. De surcroît, quand bien même il le ferait, le maintien de son régime demeure problématique, en raison de la menace qu'il continuerait à représenter et au ressentiment national que la défaite pourrait susciter. Une issue positive à cette guerre sans conséquences importantes pour l'un ou l'autre pays, ni répercussions internationales, semble donc difficile à envisager.

Conclusion

La guerre informationnelle en cours est partie intégrante de la stratégie totale de chaque belligérant.

Ses objectifs sont clairs et orientent la mise en pratique des différents moyens à disposition. On pourrait d'ailleurs penser que les différents éléments relayés tout au long de l'article, sans former une liste exhaustive, apportent une compréhension générale d'une pratique qui ne semble plus pouvoir évoluer autrement que par le progrès technologique ou capacitaire, du fait de la corrélation de son essence même avec le contexte de la guerre.

Pourtant, rien n'est plus faux, comme le montrent les incursions récentes de forces russes pro-ukrainiennes dans l'Oblast de Belgorod et l'auto-proclamée " marche pour la justice " de Prigozhin, qui s'apparente davantage à une rébellion. Une autre phase de cette guerre débute, avec une extension géographique du conflit en Russie et de potentielles répercussions bien plus importantes pour celle-ci en cas de défaite en Ukraine. De nouveaux narratifs peuvent apparaître, tandis que d'autres évoluent, s'adaptent ou se modifient au gré des évènements. Avec ce début d'opposition armée russe contre le régime du Kremlin, est apparu un nouveau narratif : celui de civils volontaires ou des militaires transfuges qui ont décidé de prendre les armes contre le régime de Poutine.

Cette opposition n'est pas nouvelle, comme en témoigne la lutte que mènent certaines organisations, notamment anarchistes, contre l'État en place. Néanmoins, ici, point de clandestinité, mais des unités militaires bien équipées et entraînées. Il convient toutefois de noter qu'une d'entre elles, le Corps des volontaires russes, est une unité accusée d'être néo-nazie, impliquant que leur lutte est potentiellement, pour ne pas dire certainement, liée à un projet politique extrémiste. Leur leader a d'ailleurs été questionné sur cet aspect par un journaliste :

Au-delà de cet élément, cette conférence de presse, et plusieurs autres déclarations depuis, ont aussi permis l'expression d'une nouvelle guerre informationnelle, opposant cette fois-ci des Russes au régime de Poutine, avec pour objectif d'accroître les soutiens et la légitimité de leur cause.

Quant au groupe Wagner, du fait de son lien avec le Kremlin, outre l'aspect politique, son projet semblait aussi avoir des implications plus concrètes liées à la survie du groupe sur fond d'assujettissement des PMC au ministère de la Défense russe et du risque de cessation de paiement. Précisons que le cadre de cet événement reste encore flou, car toujours en cours : le groupe et son dirigeant se trouveraient actuellement au Bélarus, pour entraîner les forces du président Loukachenko. Quoiqu'il en soit, l'apparition de ces nouveaux théâtres d'opérations, matériels et virtuels, laisse ainsi présager d'une intensification de l'activité des différents belligérants : la guerre de l'information n'est pas finie, elle est même vouée à s'étendre.
Si vous avez aimé cet article, nous vous conseillons également :
Bibliographie

" 12. SS-Panzer-Division Hitlerjugend ", dans 3945km.com, 3945km.com, 2017, [en ligne] https://3945km.com/encyclopedie/unites/unites-allemandes/unites-terrestres-allemandes/divisions-blindees-allemandes/12-ss-panzer-division-hitlerjugend/ (dernière consultation le 03/07/2023)

" Вниманию средств массовой информации и иных информационных ресурсов " (" A l'attention des médias et autres sources d'information "), dans Roskomnadzor, Moscou, Service fédéral de supervision des communications, des technologies de l'information et des médias de masse, 2022, [en ligne] https://rkn.gov.ru/news/rsoc/news74084.htm (dernière consultation le 03/07/2023)

" Покажите это своим детям: Сказка про Ваню и Мыколу " (" Montrez ceci à vos enfants : le conte de Vanya et Mykola "), Moscou, Tsargrad tv, 2022, 2 min 40 s, [en ligne] https://vk.com/video-75679763_456267929 (dernière consultation le 03/07/2023)

" Установлены факты распространения недостоверной информации в СМИ " (" Faits établis de diffusion de fausses informations dans les médias "), dans Roskomnadzor, Moscou, Service fédéral de supervision des communications, des technologies de l'information et des médias de masse, 2022, [en ligne] https://rkn.gov.ru/news/rsoc/news74112.htm (dernière consultation le 03/07/2023)

" Article 79 : Mesure de protection des journalistes ", dans Protocole additionnel aux Conventions de Genève du 12 août 1949 relatif à la protection des victimes des conflits armés internationaux (Protocole I), Berne, Département fédéral des Affaires étrangères, 1977, [en ligne] https://ihl-databases.icrc.org/fr/ihl-treaties/api-1977/article-79 (dernière consultation le 03/07/2023)

" "Fantôme de Kiev" : une légende devenue un manga japonais à succès en Ukraine ", dans Courrier International, Paris, Courrier international SA, 2022, [en ligne] https://www.courrierinternational.com/article/culture-fantome-de-kiev-une-legende-devenue-un-manga-japonais-a-succes-en-ukraine (dernière consultation le 03/07/2023)

" Guerre en Ukraine : le régulateur russe des médias censure les journalistes, sommés de suivre la ligne du Kremlin ", dans Amnesty International, Londres, Amnesty International Limited, 2022, [en ligne] https://www.amnesty.org/fr/latest/news/2022/03/russia-kremlins-ruthless-crackdown-stifles-independent-journalism-and-anti-war-movement/ (dernière consultation le 03/07/2023)

" In Photos: Russian High Schoolers Undergo Basic Military, First Aid Training ", dans The Moscow Times, Amsterdam, Alexander Gubsky, 2023, [en ligne] https://www.themoscowtimes.com/2023/04/07/british-firm-ships-12bln-of-electronics-to-russia-despite-sanctions-ft-a80753 (dernière consultation le 03/07/2023)

" Introducing criminal liability for public dissemination of deliberately misleading information under the guise of credible reports on the use of Russia's Armed Forces ", dans Kremlin.ru, Moscou, Kremlin, 2022, [en ligne] http://en.kremlin.ru/events/president/news/67908 (dernière consultation 03/07/2023)

Journal officiel de l'Union européenne, 65e année, Bruxelles, Office des publications de l'Union européenne, 2022, 7 p., [en ligne] https://eur-lex.europa.eu/legal-content/FR/TXT/PDF/?uri=OJ:L:2022:065:FULL&from=EN (dernière consultation le 03/07/2023)

" Kyiv asks media to stay silent about upcoming counteroffensive ", dans TVP World, Varsovie, Telewizja Polska S. A., 2023, [en ligne] https://tvpworld.com/70343341/kyiv-asks-media-to-stay-silent-about-upcoming-counteroffensive (dernière consultation le 03/07/2023)

" L'attaque des cerveaux : qu'est-ce que la guerre cognitive ? ", dans La Revue d'Histoire Militaire, Les Lilas, 2022, [en ligne] https://larevuedhistoiremilitaire.fr/2022/11/03/lattaque-des-cerveaux-quest-ce-que-la-guerre-cognitive/ (dernière consultation le 03/07/2023)

" Official: Number of Russian troops in Belarus decreases to around 4,000 ", dans The Kyiv Independant, Kyiv, The Kyiv Independant, 2023, [en ligne] https://kyivindependent.com/official-number-of-russian-troops-in-belarus-decreases-to-around-4-000/ (dernière consultation le 03/07/2023)

" Russian court fines Wikipedia again for article about war in Ukraine ", dans Reuters, Londres, Reuters News & Media, Inc., 2023 [en ligne] https://www.reuters.com/world/europe/russian-court-fines-wikipedia-2-mln-roubles-not-deleting-banned-content-military-2023-04-27/ (dernière consultation le 03/07/2023)

" Russia fights back in information war with jail warning ", dans Reuters, Londres, Reuters News & Media, Inc., 2022, [en ligne] https://www.reuters.com/world/europe/russia-introduce-jail-terms-spreading-fake-information-about-army-2022-03-04/ (dernière consultation le 03/07/2023)

" Russia fines Wikipedia owner for failing to delete Azov battalion content, Interfax reports ", dans Reuters, Londres, Reuters News & Media, Inc., 2023, [en ligne] https://www.reuters.com/world/europe/russia-fines-wikipedia-owner-failing-delete-azov-battalion-content-ifax-2023-06-06/ (dernière consultation le 03/07/2023)

" Russia invaded! Evacuate! Mobilize!: hackers broadcast fake Putin speech ", dans TVP World, Varsovie, Telewizja Polska S. A., 2023, [en ligne] https://tvpworld.com/70353099/russia-invaded-evacuate-mobilize-hackers-broadcast-fake-putin-speech (dernière consultation le 03/07/2023)

" Russia sends more troops to Belarus as fears of new attack grow ", dans Al Jazeera, Doha, Al Jazeera Media Network, 2023, [en ligne] https://www.aljazeera.com/news/2023/1/6/russia-sends-more-troops-to-belarus-as-fears-of-new-attack-grow (dernière consultation le 03/07/2023)

" Russia: The Anarcho-Communist Combat Organization ", dans CrimethInc, 2022, [en ligne] https://fr.crimethinc.com/2022/08/22/russia-the-anarcho-communist-combat-organization-an-interview-with-a-clandestine-anarchist-group (dernière consultation le 03/07/2023)

" Russie : dans les écoles, vers un retour des cours de "préparation militaire" ", dans RFI, Issy Les Moulineaux, France Médias Monde, 2022, [en ligne] https://www.rfi.fr/fr/europe/20221108-russie-dans-les-%C3%A9coles-vers-un-retour-des-cours-de-pr%C3%A9paration-militaire (dernière consultation le 03/07/2023)

" 'The only thing worse than war is losing one' Even some of Meduza's readers support the invasion of Ukraine. We asked them to explain why. ", dans Meduza, 2023, [en ligne] https://meduza.io/en/feature/2023/06/03/the-only-thing-worse-than-war-is-losing-one (dernière consultation le 03/07/2023)

" Ukraine's president appears in video message at 2022 Grammys ", dans Guardian News, Londres, Group Guardian Media, 2022, 1 min 29 s, [en ligne] https://www.youtube.com/watch?v=GLQiy6HELQQ (dernière consultation le 03/07/2023)

" West's media admit that civilians died in Bucha in shelling by Ukrainian troops - diplomat ", dans TASS, Moscou, ITAR-TASS News Agency, 2022, [en ligne] https://tass.com/politics/1454827 (dernière consultation le 03/07/2023)

5e BUREAU DE L'ETAT-MAJOR DES FORCES ARMÉES, Instruction provisoire sur l'emploi de l'arme psychologique, Paris, Ministère de la défense nationale et des forces armées, 1957, 63 p., pp. 8-9

AFP, " 'We're tired': Ukraine forces hold out in devastated Bakhmut ", dans RFI, Issy Les Moulineaux, France Médias Monde, 2023, [en ligne] https://www.rfi.fr/en/international-news/20230424-we-re-tired-ukraine-forces-hold-out-in-devastated-bakhmut (dernière consultation le 03/07/2023)

AHMED Kalim, CASTEL Brecht, DORJBAYAR Amra, HEUBL Ben, MEHTA Archit, OLIVIERI Alberto et des volontaires de GeoConfirmed, Killer Coordinates: How a Russian missile hit Kyiv with the help of online sleuths, Londres, Center for Information Resilience, 2022, [en ligne] https://www.info-res.org/post/killer-coordinates-how-a-russian-missile-hit-kyiv-with-the-help-of-online-sleuths (dernière consultation le 03/07/2023)

AUDINET Maxime, " Un an après l'invasion de l'Ukraine : que deviennent RT et Sputnik ? ", dans La Revue des Médias, Créteil, Institut national de l'audiovisuel, 2023, [en ligne] https://larevuedesmedias.ina.fr/guerre-information-russie-ukraine-medias-influence-rt-sputnik-afrique-nouveau-rideau-de-fer (dernière consultation le 03/07/2023)

AUDUREAU William et MAAD Assma, " Massacre de Boutcha : sur les réseaux sociaux, l'opération de désinformation de Moscou ", dans Le Monde, Paris, Société éditrice du Monde, 2022, [en ligne] https://www.lemonde.fr/les-decodeurs/article/2022/04/04/massacre-de-boutcha-sur-les-reseaux-sociaux-l-operation-de-desinformation-de-moscou_6120559_4355770.html (dernière consultation le 03/07/2023)

BOLCHAKOVA Ksenia et DORMAN Veronika, " Comment les écoles russes fabriquent les petits soldats de Poutine: "Les enfants sont un sol fertile et il nous revient d'y planter la bonne graine" ", dans La Libre Belgique, Bruxelles, IPM, 2023, [en ligne] https://www.lalibre.be/international/europe/guerre-ukraine-russie/2023/04/15/les-enfants-sont-un-sol-fertile-et-il-nous-revient-dy-planter-la-bonne-graine-comment-les-ecoles-russes-fabriquent-les-petits-soldats-de-poutine-FXY7EBSA7VEDVBBPK53OWLTHZQ/ (dernière consultation le 03/07/2023)

BLAVO Murielle Stéphanie, " Polémique / Un dessin animé montrant Wagner en Afrique remue la Toile ", dans Afrikmag, AfriMediaWeb Ltd, 2023, [en ligne] https://www.afrikmag.com/polemique-dessin-anime-montrant-wagner-afrique-remue-toile/ (dernière consultation le 03/07/2023)

BOLCHAKOVA Ksenia et DORMAN Veronika, propos recueillis par Isabelle Malin, " "En Russie, Vladimir Poutine a brisé toute indépendance intellectuelle", dénoncent les réalisatrices Ksenia Bolchakova et Veronika Dorman ", dans Franceinfo, Paris, France Télévisions, 2023, [en ligne] https://www.francetvinfo.fr/monde/europe/manifestations-en-ukraine/grand-entretien-en-russie-vladimir-poutine-a-brise-toute-independance-intellectuelle-denoncent-les-realisatrices-ksenia-bolchakova-et-veronika-dorman_5768552.html (dernière consultation le 03/07/2023)

BOYER Bertran d, Guérilla 2.0, guerres irrégulières dans le cyberespace, Paris, Éditions de l'école de guerre, 2020, 362 p.

BREST Aurélien, " Bulles de filtre et chambres d'écho ", dans Fondation Descartes, Paris, Fonds de dotation pour la création de la Fondation Descartes pour l'information, 2020, 8 p., [en ligne] https://www.fondationdescartes.org/wp-content/uploads/2020/07/Synthese-Bulles-Filtre-Chambres-decho-Fondation-Descartes.pdf (dernière consultation le 03/07/2023)

BUBOLA Emma, " The 'Ghost of Kyiv' Is a Myth, Ukraine Acknowledges ", dans The New York Times, New York, H. J. Raymond & Co., 2022, [en ligne] https://www.nytimes.com/2022/05/01/world/europe/ghost-kyiv-ukraine-myth.html (dernière consultation le 03/07/2023)

CHEETHAM Josh et HORTON Jake, " War in Ukraine: Fact-checking Russian claims that Nato troops are fighting in Ukraine ", dans BBC News, Londres, British Broadcasting Corporation, 2022, [en ligne] https://www.bbc.com/news/62974506 (dernière consultation le 03/07/2023)

CHEVALLEREAU Patrick, " TRIBUNE. Guerre en Ukraine : "Attention, d'anciens militaires français contribuent aux intérêts du Kremlin" ", dans Le Journal du Dimanche, Paris, Lagardère media news, 2023, [en ligne] https://www.lejdd.fr/International/tribune-guerre-en-ukraine-attention-danciens-militaires-francais-contribuent-aux-interets-du-kremlin-4161692 (dernière consultation le 03/07/2023)

CLUZEL François (du), Cognitive Warfare, a Battle for the Brain, Norfolk, NATO S&T Organisation, 2021, 12 p., [en ligne] https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjoy77Aovb_AhUMTKQEHUwsCJgQFnoECA4QAQ&url=https%3A%2F%2Fwww.sto.nato.int%2Fpublications%2FSTO%2520Meeting%2520Proceedings%2FSTO-MP-HFM-334%2F%24MP-HFM-334-KN3.pdf&usg=AOvVaw2kTpNOzJnxgilh9DrvcS7N&opi=89978449 (dernière consultation le 03/07/2023)

COHEN Eliot A., " It's Not Enough for Ukraine to Win. Russia Has to Lose ", dans The Atlantic, 2023, [en ligne] https://www.theatlantic.com/ideas/archive/2023/05/ukraine-victory-russia-defeat/674112/ (dernière consultation le 03/07/2023)

COMMITTEE TO PROTECT JOURNALISTS, " Reporters shot, shelled, robbed while covering Russian invasion of Ukraine ", dans Committee to protect journalists, New York, The John S. and James L. Knight Foundation Press Freedom Center, 2022, [en ligne] https://cpj.org/2022/03/reporters-shot-shelled-robbed-while-covering-russian-invasion-of-ukraine/ (dernière consultation le 03/07/2023)

DE CARLO DEVIC Alexandre, " La Guerre au XXIe siècle : la Guerre hybride, nouvel outil stratégique du Kremlin ", dans La Revue d'Histoire Militaire, Les Lilas, La Revue d'Histoire Militaire, 2020, [en ligne] https://larevuedhistoiremilitaire.fr/2020/05/06/guerre-hybride-nouvel-outil-strategique-kremlin/ (dernière consultation le 03/07/2023)

DEPARTMENT OF THE ARMY, Army Operations Security for Division and below, Washington D. C., Army Publishing Directorate, 2019, 66 p., pp. 9-10, [en ligne] https://usacac.army.mil/sites/default/files/documents/FMPC/ATP_3-13.3_Army_Operations_Security_for_Division_and_Below.pdf (dernière consultation le 03/07/2023)

DYLAN Huw, GIOE David V. et LITTELL Joe, " The Kherson Ruse: Ukraine and the art of military deception ", dans Modern War Institute at West Point, West Point, USMA, 2023, [en ligne] https://mwi.usma.edu/the-kherson-ruse-ukraine-and-the-art-of-military-deception/ (dernière consultation le 03/07/2023)

FALCO Elodie, " Guerre en Ukraine : plusieurs milliers de soldats russes vont être déployés en Biélorussie ", dans Le Journal du Dimanche, Paris, Lagardère media news, 2023, [en ligne] https://www.lejdd.fr/International/guerre-en-ukraine-plusieurs-milliers-de-soldats-russes-vont-etre-deployes-en-bielorussie-4141462 (dernière consultation le 03/07/2023)

FAULCONBRIDGE Guy, " Russia's Putin issues new nuclear warnings to West over Ukraine ", dans Reuters, Londres, Reuters News & Media, Inc., 2023, [en ligne] https://www.reuters.com/world/putin-update-russias-elite-ukraine-war-major-speech-2023-02-21/ (dernière consultation le 03/07/2023)

FAYE Olivier, " La contre-offensive des médias prorusses en France ", dans Le Monde, Paris, Société éditrice du Monde, 2023, [en ligne] https://www.lemonde.fr/m-le-mag/article/2023/01/14/en-france-la-contre-offensive-des-medias-prorusses_6157840_4500055.html (dernière consultation le 03/07/2023)

FOUILLET Thibault, " Guerre en Ukraine : étude opérationnelle d'un conflit de haute intensité (premier volet) ", dans Recherches & Documents, n°2, Levallois-Perret, Fondation pour la recherche stratégique, 2023, 56 p., p. 15, [en ligne] https://www.frstrategie.org/sites/default/files/documents/publications/recherches-et-documents/2023/022023.pdf (dernière consultation le 03/07/2023)

FRANCART Loup, " La gestion de l'environnement psychologique dans les opérations extérieures ", IRIS, 2000, 7 p., [en ligne] https://www.iris-france.org/wp-content/uploads/2014/11/epmes_environnement_psychologique_en_operations_exterieures.pdf (dernière consultation le 03/07/2023)

GARNER Ian, " How Putin is preparing children to 'die for the motherland' ", dans The Guardian, Londres, Group Guardian Media, 2022, [en ligne] https://www.theguardian.com/commentisfree/2022/nov/23/how-putin-is-preparing-children-to-die-for-the-motherland (dernière consultation le 04/07/2023)

GAULT Matthew, " 'Fallout'-Style Cartoons Meant to Train Russian Soldiers Are Spreading on Telegram ", dans VICE, New York, Vice Media Group, 2023, [en ligne] https://www.vice.com/en/article/dy3vaa/fallout-style-cartoons-meant-to-train-russian-soldiers-are-spreading-on-telegram (dernière consultation le 03/07/2023)

GENKINE Gabriel, " Russie-Ukraine : la maskirovka ou le bénéfice du doute ", dans Les cahiers de la Revue Défense Nationale, Paris, Economica, 2015, 144 p., pp. 127-130, [en ligne] https://www.calameo.com/read/00055811533cd3636d191 (dernière consultation le 03/07/2023)

GIBBONS-NEFF Thomas et SCHECK Justin, " Stolen Valor: The U.S. Volunteers in Ukraine Who Lie, Waste and Bicker ", dans The New York Times, New York, H. J. Raymond & Co., 2023, [en ligne] https://www.nytimes.com/2023/03/25/world/europe/volunteers-us-ukraine-lies.html (dernière consultation le 03/07/2023)

GLOBALDATA, " Unencrypted communications by Russia undermines operational security in Ukraine ", dans Army Technology, Londres, GlobalData, 2023, [en ligne] https://www.army-technology.com/comment/unencrypted-communications-russia/ (dernière consultation le 03/07/2023)

GOYA Michel, " Penser les Opérations. Attaquer la ligne ", dans Défense & Sécurité Internationale, n°164, Paris, Areion group, 2023, 116 p., pp. 60-63

GRAHAM-HARRISON Emma, " Russia and Belarus extend military drills amid fears of new push into Ukraine ", dans The Guardian, Londres, Group Guardian Media, 2022, [en ligne] https://www.theguardian.com/world/2023/jan/08/russia-belarus-extend-military-drills-fears-new-push-ukraine (dernière consultation le 03/07/2023)

GRYNSZPAN Emmanuel, " L'exil amer de Marina Ovsiannikova, repentie de la télé pro-Poutine : "Ne restent que la peur et la folie guerrière" " dans Le Monde, Paris, Société éditrice du Monde, 2023, [en ligne] https://www.lemonde.fr/international/article/2023/02/17/l-exil-amer-de-marina-ovsiannikova-repentie-de-la-tele-pro-poutine-ne-restent-que-la-peur-et-la-folie-guerriere_6162292_3210.html?random=379915142 (dernière consultation le 03/07/2023)

HARDING Luke, " The Wagner uprising: 24 hours that shook Russia ", dans The Guardian, Londres, Group Guardian Media, 2023 [en ligne] https://www.theguardian.com/world/2023/jun/25/prigozhins-march-on-moscow-chronology-of-an-attempted-coup (dernière consultation le 03/07/2023)

HÉMEZ Rémy, " Surprise tactique et effet de choc ", dans Défense & Sécurité Internationale, n°164, Paris, Areion group, 2023, 116 p., pp. 64-68

HIGGINS Eliot, " How Online Investigators Proved Video of Ukrainian Soldiers Harassing Woman was Staged ", dans Bellingcat, Amsterdam, Stichting Bellingcat, 2023, [en ligne] https://www.bellingcat.com/news/2023/03/29/how-online-investigators-proved-video-of-ukrainian-soldiers-harassing-woman-was-staged/ (dernière consultation le 03/07/2023)

HORN Alexandre, " L'ex-soldat Adrien Bocquet a aussi menti sur son passé militaire ", dans Libération, Paris, SARL Libération, 2022, [en ligne] https://www.liberation.fr/checknews/adrien-bocquet-a-aussi-menti-sur-son-passe-militaire-20220607_JUFIZ2SAFFC43IVQFYEFXDRMOY/ (dernière consultation le 03/07/2023)

HORTON Jake et PALUMBO Daniele, " Wagner: Satellite images show activity at military base in Belarus ", dans BBC News, Londres, British Broadcasting Corporation, 2023, [en ligne] https://www.bbc.com/news/world-europe-66052061 (dernière consultation le 03/07/2023)

HUDSON John, " Wounded Ukrainian soldiers reveal steep toll of Kherson offensive ", dans The Washington Post, Washington D. C., The Washington Post Company, 2022, [en ligne] https://www.washingtonpost.com/world/2022/09/07/ukraine-kherson-offensive-casualties-ammunition/ (dernière consultation le 03/07/2023)

IZAMBARD Antoine, " Guerre en Ukraine : Xavier Moreau, cet ex-militaire français devenu porte-voix du Kremlin ", dans Challenges, Paris, Editions Croque Futur, 2022, [en ligne] https://www.challenges.fr/monde/europe/guerre-en-ukraine-xavier-moreau-cet-ex-militaire-francais-devenu-porte-voix-du-kremlin_830648 (dernière consultation le 03/07/2023)

KELLY Lidia et OSBORN Andrew, " Belarus starts taking delivery of Russian nuclear weapons ", dans Reuters, Londres, Reuters News & Media, Inc., 2023 [en ligne] https://www.reuters.com/world/europe/belarus-has-started-taking-delivery-russian-tactical-nuclear-weapons-president-2023-06-14/ (dernière consultation le 03/07/2023)

KESSLER Glenn, " Zelensky's famous quote of 'need ammo, not a ride' not easily confirmed ", dans The Washington Post, Washington D. C., The Washington Post Company, 2022, [en ligne] https://www.washingtonpost.com/politics/2022/03/06/zelenskys-famous-quote-need-ammo-not-ride-not-easily-confirmed/ (dernière consultation le 03/07/2023)

KHURSHUDYAN Isabelle, " Ukraine's top general, Valery Zaluzhny, wants shells, planes and patience ", dans The Washington Post, Washington D. C., The Washington Post Company, 2023, [en ligne] https://www.washingtonpost.com/world/2023/06/30/valery-zaluzhny-ukraine-general-interview/ (dernière consultation le 03/07/2023)

KILNER James, " Celebrity Ukraine 'volunteer' soldier exposed as fraud by internet sleuths ", dans The Telegraph, Londres, Telegraph Media Group Limited, 2022, [en ligne] https://www.telegraph.co.uk/world-news/2022/07/04/celebrity-ukraine-volunteer-soldier-exposed-fraud-internet-sleuths/ (dernière consultation le 03/07/2023)

KIRBY Paul, " Belarus leader welcomes Wagner boss Prigozhin into exile ", dans BBC News, Londres, British Broadcasting Corporation, 2023, [en ligne] https://www.bbc.com/news/world-europe-66029636 (dernière consultation le 03/07/2023)

KIRBY Paul, " Yevgeny Prigozhin: Wagner Group boss says he will pull fighters out of Bakhmut ", dans BBC News, Londres, British Broadcasting Corporation, 2023, [en ligne] https://www.bbc.com/news/world-europe-65493008 (dernière consultation le 03/07/2023)

KOSHIW Isobel, " How Sumy's residents kept Russian forces out of their city ", dans The Guardian, Londres, Group Guardian Media, 2023, [en ligne] : https://www.theguardian.com/world/2023/jan/02/how-sumy-residents-kept-russian-forces-out-of-their-city (dernière consultation le 03/07/2023)

KOSHIW Isobel et TONDO Lorenzo, " Ukraine's southern offensive 'was designed to trick Russia' ", dans The Guardian, Londres, Group Guardian Media, 2022, [en ligne] https://www.theguardian.com/world/2022/sep/10/ukraines-publicised-southern-offensive-was-disinformation-campaign (dernière consultation le 03/07/2023)

KRAMER Andrew E., " Phantom Retreats and Stolen Bones: The War of Deceit in Ukraine ", dans The New York Times, New York, H. J. Raymond & Co., 2022, [en ligne] https://www.nytimes.com/2022/11/09/world/europe/ukraine-russia-war-weapons.html (dernière consultation le 03/07/2023)

KUZAKOV Andryi, KRASNO Andrei et STANDISH Reid, " 'The Whole Army Must Move Forward': Fighting Rages In Bakhmut As Momentum Builds For Ukraine's Counteroffensive ", dans Radio Free Europe/Radio Liberty, Prague, Radio Free Europe, 2023, [en ligne] https://www.rferl.org/a/ukraine-bakhmut-counteroffensive-russia-fighting/32399805.html (dernière consultation le 03/07/2023)

LEFEVRE Marin, " Le rat, le serpent et les hyènes : en Afrique, la propagande russe passe par les dessins animés ", dans AFP, Paris, Agence France-Presse, 2023, [en ligne] https://factuel.afp.com/doc.afp.com.337T34U (dernière consultation le 03/07/2023)

LE SOIR, " Ukraine: un projet de loi de Zelensky suscite la polémique ", dans Le Soir, Bruxelles, Rossel & Cie, 2022, [en ligne] https://www.lesoir.be/486066/article/2022-12-30/ukraine-un-projet-de-loi-de-zelensky-suscite-la-polemique (dernière consultation le 04/07/2023)

LOH Matthew, " Ukraine says it destroyed a Russian mortar carrier after a pro-Kremlin journalist accidentally exposed its location ", dans Business Insider, New York, Henry Blodget, 2022, [en ligne] https://www.businessinsider.com/russia-news-exposed-mortar-carrier-ukraine-says-journalist-denied-2022-5?r=US&IR=T (dernière consultation le 03/07/2023)

MACFARQUHAR Neil, MAZAEVA Milana, " In Russian Schools, It's Recite Your ABC's and 'Love Your Army' ", dans The New York Times, New York, H. J. Raymond & Co., 2023, [en ligne] https://www.nytimes.com/2023/06/03/world/europe/russia-schools-military-war.html (dernière consultation le 03/07/2023)

MAISHMAN Elsa et VERNON Will, " Makiivka: Russia blames missile attack on soldiers' mobile phone use ", dans BBC News, Londres, British Broadcasting Corporation, 2023, [en ligne] https://www.bbc.com/news/world-europe-64159045 (dernière consultation le 03/07/2023)

MÄKINEN Esa, " Truth about the War ", dans Helsingin Sanomat, Helsinki, Sanoma, 2023, [en ligne] https://www.hs.fi/ulkomaat/art-2000009555855.html (dernière consultation le 03/07/2023)

MATHIEN Michel, " L'emprise de la communication de guerre : médias et journalistes face à l'ambition de la démocratie ", dans Revue Internationale et Stratégique, n°56, Paris, IRIS éditions, 2004, 168 p., pp. 89-98, [en ligne] https://www.cairn.info/revue-internationale-et-strategique-2004-4-page-89.htm (dernière consultation le 03/07/2023)

MEARSHEIMER John, propos recueillis par CHOTINER Isaac, " Why John Mearsheimer Blames the U.S. for the Crisis in Ukraine ", dans The New Yorker, New York, Condé Nast, 2022, [en ligne] https://www.newyorker.com/news/q-and-a/why-john-mearsheimer-blames-the-us-for-the-crisis-in-ukraine (dernière consultation le 03/07/2023)

MENY Lionel, " L'art de la guerre dans un monde hyperconnecté ", dans Revue Défense Nationale, numéro hors-série n°4, Paris, Comité d'étude de Défense Nationale, 2021, 348 p., pp. 155-168, [en ligne] https://www.cairn.info/revue-defense-nationale-2021-HS4-page-155.htm. (dernière consultation le 03/07/2023)

MITCHELL Peter, " Prigozhin's Gambit: How Disastrous Could Wagner's Aborted Coup Be for Putin and His War in Ukraine? ", dans Modern War Institute at West Point, West Point, USMA, [en ligne] https://mwi.westpoint.edu/prigozhins-gambit-how-disastrous-could-wagners-aborted-coup-be-for-putin-and-his-war-in-ukraine/ (dernière consultation le 03/07/2023)

MUSUMECI Nathalie, " Wagner boss Yevgeny Prigozhin says Russian troops are running away from the front lines and threatens to spill more details if Putin doesn't send ammunition ", dans Business Insider, New York, Henry Blodget, 2023, [en ligne] https://www.businessinsider.com/wagner-yevgeny-prigozhin-says-russian-troops-fleeing-front-lines-2023-5?r=US&IR=T (dernière consultation le 03/07/2023)

NONJON Adrien, " Guerre en Ukraine : Azov, un régiment ultra-nationaliste et sulfureux, devenu symbole du martyre de Marioupol ", dans The Conversation, Paris, The Conversation France, 2022, [en ligne] https://theconversation.com/quest-ce-que-le-regiment-azov-ce-bataillon-ultra-nationaliste-devenu-symbole-du-martyre-de-marioupol-183602 (dernière consultation le 03/07/2023)

NOVAYA GAZETA EUROPE, " 'They threatened to shoot us if we didn't advance' - Russian soldiers deployed near Ukraine's Vuhledar ask Putin for help ", dans Novaya Gazeta Europe, Riga, Novaïa Gazeta, 2023, [en ligne] https://novayagazeta.eu/articles/2023/03/26/they-threatened-to-shoot-us-if-we-didnt-advance-russian-soldiers-deployed-near-ukraines-vuhledar-ask-putin-for-help-en-news (dernière consultation le 03/07/2023)

ORYX, " Attack On Europe: Documenting Russian Equipment Losses During The Russian Invasion Of Ukraine ", dans Oryxspioenkop, 2022, [en ligne] https://www.oryxspioenkop.com/2022/02/attack-on-europe-documenting-equipment.html (dernière consultation le 03/07/2023)

ORYX " Attack On Europe: Documenting Ukrainian Equipment Losses During The Russian Invasion Of Ukraine ", dans Oryxspioenkop, 2022, [en ligne] https://www.oryxspioenkop.com/2022/02/attack-on-europe-documenting-ukrainian.html (dernière consultation le 03/07/2023)

PENNEL Felix, " Contre-offensive de l'Ukraine : la ligne de front figée, de lourdes pertes des deux côtés ", dans La voix du Nord, Lille, La voix du Nord, 2023, [en ligne] https://www.lavoixdunord.fr/1342337/article/2023-06-19/contre-offensive-de-l-ukraine-la-ligne-de-front-figee-de-lourdes-pertes-des-deux (dernière consultation le 03/07/2023)

PLATEFORME POUR LA SECURITE DES JOURNALISTES, " Sécurité des journalistes et liberté de la presse après l'agression de la Fédération de Russie contre l'Ukraine ", dans Plateforme pour la sécurité des Journalistes, Strasbourg, Conseil de l'Europe, [en ligne] https://fom.coe.int/fr/pagesspeciales/detail/1 (dernière consultation le 03/07/2023)

PLATEFORME POUR LA SECURITE DES JOURNALISTES, " Une agence ukrainienne assimile les journalistes ukrainiens critiques à des propagandistes russes ", dans Plateforme pour la sécurité des Journalistes, Strasbourg, Conseil de l'Europe, [en ligne] https://fom.coe.int/fr/alerte/detail/107638383 (dernière consultation le 04/07/2023)

POLITYUK Pavel, " Russia claims capture of Ukraine's Soledar, but Kyiv says still fighting ", dans Reuters, Londres, Reuters News & Media, Inc., 2023, [en ligne] https://www.reuters.com/world/ukraine-fights-russian-assault-salt-mining-town-along-eastern-front-2023-01-09/ (dernière consultation le 03/07/2023)

POUTINE Vladimir, " Послание Президента Федеральному Собранию " (" Discours du Président à l'Assemblée fédérale " ), Moscou, Kremlin, 2023, [en ligne] http://en.kremlin.ru/events/president/news/70565 (dernière consultation le 03/07/2023)

RAZOUX Pierre, " 23 - Le calvaire des enfants-soldats ", dans RAZOUX Pierre, La guerre Iran-Irak : 1980-1988 : première guerre du Golfe, Paris, Perrin, " Synthèses Historiques ", 2013, 616 p., pp. 359-375

REUTERS, " 'I'm not bluffing': Putin warns west over nuclear weapons ", dans The Guardian, Londres, Group Guardian Media, 2022, [en ligne] https://www.theguardian.com/world/video/2022/sep/21/not-bluffing-putin-accuses-west-nuclear-blackmail-video (dernière consultation le 03/07/2023)

REUTERS, " Wagner boss Prigozhin says situation on Russian flanks near Bakhmut is bad ", dans Reuters, Londres, Reuters News & Media, Inc., 2023, [en ligne] https://www.reuters.com/world/europe/russias-wagner-boss-prigozhin-ukrainian-offensive-has-started-around-bakhmut-2023-05-11/ (dernière consultation le 03/07/2023)

ROUSSEAU Nicolas, " Le circuit de l'information ", dans ROUSSEAU Nicolas, Le Porte-Plumes, [en ligne] https://leporteplumes.com/ressources-2/le-circuit-de-linformation/ (dernière consultation le 03/07/2023)

SAUER Pjotr, " Russia bans Facebook and Instagram under 'extremism' law ", dans The Guardian, Londres, Group Guardian Media, 2022, [en ligne] https://www.theguardian.com/world/2022/mar/21/russia-bans-facebook-and-instagram-under-extremism-law (dernière consultation le 03/07/2023)

SCARR Francis et The Visual Journalism Team, " The talk-show hosts telling Russians what to believe ", dans BBC News, Londres, British Broadcasting Corporation, 2023, [en ligne] https://www.bbc.co.uk/news/resources/idt-4af5a2e0-10d4-4d4f-b3bb-41e2d1fe35dd (dernière consultation le 03/07/2023)

SEIBT Sébastien, " Guerre en Ukraine : le "fantôme de Kiev", faux pilote mais vrai atout de propagande ", dans France 24, Issy Les Moulineaux, France Médias Monde, 2022, [en ligne] https://www.france24.com/fr/%C3%A9co-tech/20220502-guerre-en-ukraine-le-fant%C3%B4me-de-kiev-faux-pilote-mais-vrai-atout-de-propagande (dernière consultation le 03/07/2023)

SHEVCHENKO Vitaly, " Ukraine war: Who are Russia's war bloggers and why are they popular? ", dans BBC News, Londres, British Broadcasting Corporation, 2023, [en ligne] https://www.bbc.com/news/world-europe-65179954 (dernière consultation le 03/07/2023)

SPECIA Megan, " Ukraine Says It Is Ready for Arrival of Wagner Troops in Belarus ", dans The New York Times, New York, H. J. Raymond & Co., 2023, [en ligne] https://www.nytimes.com/2023/07/01/world/europe/russia-ukraine-war.html (dernière consultation le 03/07/2023)

SOMMERVILLE Quention, " Bakhmut: Russian casualties mount but tactics evolve ", dans BBC News, Londres, British Broadcasting Corporation, 2023, [en ligne] https://www.bbc.com/news/world-europe-64955537 (dernière consultation le 03/07/2023)

@TATARIGAMI_UA, " I would like to address instances where some of the world's largest media outlets, such as the @WSJ and @Reuters, have either plagiarized my materials or used them without providing proper credit. ", dans Twitter, San Francisco, X Corp, 2023, [en ligne] https://twitter.com/Tatarigami_UA/status/1671533874277408770 (dernière consultation le 03/07/2023)

@TATARIGAMI_UA, " Russian forces are revamping their assault tactics after experiencing failures with their current structure. The Battalion Tactical Groups (BTGs) are getting replaced with a new unit called the "Assault Unit" or "Assault Detachment", which I will discuss in this thread. ", dans Twitter, San Francisco, X Corp, 2023, [en ligne] https://twitter.com/Tatarigami_UA/status/1629722073487613953 (dernière consultation le 03/07/2023)

TERAJIMA Asami, " Battle of Bakhmut: Ukrainian soldiers worry Russians begin to 'taste victory' ", dans The Kyiv Independant, Kyiv, The Kyiv Independant, 2023, [en ligne] https://kyivindependent.com/battle-of-bakhmut-ukrainian-soldiers-worry-russians-begin-to-taste-victory/ (dernière consultation le 03/07/2023)

THIER Victor (de), " "Joyeux Noël anti-russe" : la très cynique vidéo de la télévision russe pour faire peur aux Européens ", dans RTBF, Bruxelles, RTBF, 2022, [en ligne] https://www.rtbf.be/article/joyeux-noel-anti-russe-la-tres-cynique-video-de-la-television-russe-pour-faire-peur-aux-europeens-11128411 (dernière consultation le 04/07/2023)

TIIKKAJA Samuli, " Counter-Strikeen kehitetty HS:n sananvapauskartta on estetty venäläisiltä käyttäjiltä " (" La carte HS : liberté d'expression développée pour Counter-Strike a été bloquée pour les utilisateurs russes "), dans Helsingin Sanomat, Helsinki, Sanoma, 2023, [en ligne] https://www.hs.fi/kulttuuri/art-2000009623031.html (dernière consultation le 03/07/2023)

VACHON Paul-Marie, " La communication dans la guerre en Syrie : le véritable champ de bataille ? ", dans Défense & Sécurité Internationale, n°162, Paris, Areion group, 2022, 116 p., pp. 64-69

VASILYEVA Nataliya, " 'Why should I fight?': How Russian soldiers are mutinying in face of 'certain death' ", dans The Telegraph, Londres, Telegraph Media Group Limited, 2023, [en ligne] https://www.telegraph.co.uk/world-news/2023/03/10/new-russian-army-unit-sent-find-soldiers-lost-chaos-faltering/ (dernière consultation le 03/07/2023)

VITKINE Benoit, " Russie : comment le Kremlin a fait des écoles, depuis les petites classes jusqu'à l'université, un terrain d'endoctrinement ", dans Le Monde, Paris, Société éditrice du Monde, 2022, [en ligne] https://www.lemonde.fr/international/article/2022/05/11/l-ecole-champ-de-bataille-du-kremlin_6125599_3210.html (dernière consultation le 03/07/2023)

VON CLAUSEWITZ Carl, De la guerre, Paris, Perrin, 2014, 448 p

ZEDONG MAO, La stratégie de la guerre révolutionnaire en Chine, Paris, Editions sociales, 1951, 122 p.

FRANCART Loup, " La gestion de l'environnement psychologique dans les opérations extérieures ", IRIS, 2000, 7 p., [en ligne] https://www.iris-france.org/wp-content/uploads/2014/11/epmes_environnement_psychologique_en_operations_exterieures.pdf (dernière consultation le 03/07/2023)

La rédaction de cet article s'est faite sur plusieurs mois (janvier à juin 2023) et n'évoque pas l'intégralité des événements marquants du conflit faute de temps suffisant. Ainsi, la destruction du barrage de Kakhovka n'est-elle, par exemple, pas évoquée.

Ces deux entités de l'est de l'Ukraine ont proclamé leur indépendance en avril 2014 à la faveur d'une insurrection pro-russe, marquant le début de la guerre du Donbass. Après reconnaissance de ces deux régions sécessionnistes le 21 février 2022, la Russie les a finalement annexées le 30 septembre 2022 avec les Oblasts de Kherson et de Zaporijia, par l'intermédiaire de simulacres de référendums.

AFP, " 'We're tired': Ukraine forces hold out in devastated Bakhmut ", dans RFI, Issy Les Moulineaux, France Médias Monde, 2023, [en ligne] https://www.rfi.fr/en/international-news/20230424-we-re-tired-ukraine-forces-hold-out-in-devastated-bakhmut (dernière consultation le 03/07/2023) ; TERAJIMA Asami, " Battle of Bakhmut: Ukrainian soldiers worry Russians begin to 'taste victory' ", dans The Kyiv Independant, Kyiv, The Kyiv Independant, 2023, [en ligne] https://kyivindependent.com/battle-of-bakhmut-ukrainian-soldiers-worry-russians-begin-to-taste-victory/ (dernière consultation le 03/07/2023) ; ou encore SOMMERVILLE Quention, " Bakhmut: Russian casualties mount but tactics evolve ", dans BBC News, Londres, British Broadcasting Corporation, 2023, [en ligne] https://www.bbc.com/news/world-europe-64955537 (dernière consultation le 03/07/2023)

Частная Военная Компания (ЧВК) " Вагнер " en russe.

Consultable à cette adresse si vous disposez d'un compte twitter : https://twitter.com/Tatarigami_UA

État de fait à relativiser au regard des conséquences judiciaires qui peuvent découler de l'expression de cette liberté dans le contexte social français actuel marqué, entre autres, par la contestation de la réforme des retraites.

Ils furent d'ailleurs déclarés tués au combat dans un premier temps, avant que leur capture par les forces russes ne soit communiquée.

Qui n'est pas sans rappeler l'une des définitions de la guerre proposée par Clausewitz dans son ouvrage De la Guerre : " un acte de violence destiné à contraindre l'adversaire à exécuter notre volonté ", dans VON CLAUSEWITZ Carl, De la guerre, Paris, Les Éditions de Minuit, 1955, 755 p., p. 51, traduit de l'allemand par NAVILLE Denise

5e BUREAU DE L'ETAT-MAJOR DES FORCES ARMÉES, op. cit., p. 9

AHMED Kalim, CASTEL Brecht, DORJBAYAR Amra, HEUBL Ben, MEHTA Archit, OLIVIERI Alberto et des volontaires de GeoConfirmed, Killer Coordinates: How a Russian missile hit Kyiv with the help of online sleuths, Londres, Center for Information Resilience, 2022, [en ligne] https://www.info-res.org/post/killer-coordinates-how-a-russian-missile-hit-kyiv-with-the-help-of-online-sleuths (dernière consultation le 03/07/2023)

Voir les infographies très claires de l'AFP et les explications du site Le Porte-Plumes : ROUSSEAU Nicolas, " Le circuit de l'information ", dans ROUSSEAU Nicolas, Le Porte-Plumes, [en ligne] https://leporteplumes.com/ressources-2/le-circuit-de-linformation/ (dernière consultation le 03/07/2023)

Journal officiel de l'Union européenne, 65 e année, Bruxelles, Office des publications de l'Union européenne, 2022, 7 p., [en ligne] https://eur-lex.europa.eu/legal-content/FR/TXT/PDF/?uri=OJ:L:2022:065:FULL&from=EN (dernière consultation le 03/07/2023)

AUDINET Maxime, art. cit.

MÄKINEN Esa, " Truth about the War ", dans Helsingin Sanomat, Helsinki, Sanoma, 2023, [en ligne] https://www.hs.fi/ulkomaat/art-2000009555855.html (dernière consultation le 03/07/2023)

MACFARQUHAR Neil, MAZAEVA Milana, " In Russian Schools, It's Recite Your ABC's and 'Love Your Army' ", dans The New York Times, New York, H. J. Raymond & Co., 2023, [en ligne] https://www.nytimes.com/2023/06/03/world/europe/russia-schools-military-war.html (dernière consultation le 03/07/2023) ; VITKINE Benoit, " Russie : comment le Kremlin a fait des écoles, depuis les petites classes jusqu'à l'université, un terrain d'endoctrinement ", dans Le Monde, Paris, Société éditrice du Monde, 2022, [en ligne] https://www.lemonde.fr/international/article/2022/05/11/l-ecole-champ-de-bataille-du-kremlin_6125599_3210.html (dernière consultation le 03/07/2023)

# data[].attributes.attachment_link.title
L'information à l'épreuve de l'invasion russe de l'Ukraine - La Revue d'Histoire Militaire

# data[].attributes.attachment_link.description
Le 24 février 2022, la Russie envahissait l'Ukraine, mettant un terme aux nombreux débats sur la possibilité d'une intervention directe, revendiquée et massive du Kremlin. À peine les premières frappes russes entamées contre des positions jugées stratégiques[1] qu'en direct, l'information envahissait déjà nos écrans et nos ondes radios.

# data[].attributes.headline
The Cyber Domain in the Russo-Ukrainian War

# data[].attributes.subject
The Cyber Domain in the Russo-Ukrainian War

# data[].attributes.body
Cyber attacks have been carried out by both sides in the Ukraine-Russia war to neutralize national infrastructures, banking systems, and government ministries; influence decision-makers, citizens, and soldiers; and gather intelligence. Cyber played no real role in disabling national capabilities or infrastructure, but has had psychological and cognitive effects. The first year of the war sharpened the need to build and upgrade information security measures, especially around critical national infrastructure; strengthen real-time information-gathering capabilities from social networks; strengthen awareness; and maintain information security.

# data[].attributes.attachment_link.title
The Cyber Domain in the Russo-Ukrainian War

# data[].attributes.attachment_link.description
Cyber attacks have been carried out by both sides in the Ukraine-Russia war to neutralize national infrastructures, banking systems, and government ministries; influence decision-makers, citizens, and

# data[].attributes.headline
Ukraine's ground counteroffensive ushers in a new phase of the conflict in cyberspace

# data[].attributes.subject
Ukraine's ground counteroffensive ushers in a new phase of the conflict in cyberspace

# data[].attributes.body
Cyberattacks against Ukraine have surged, linked to attacks on the ground, but their effectiveness has been blunted, according to observers including the deputy chairman of Ukraine’s cyber warfare service.

As its campaign against Ukraine grinds on well into its second year, Russia appears to be making greater use of hacktivists, "patriotic" cybercriminals, and mercenaries in its attacks on the smaller nation. Meanwhile, Western countries neighboring Russia, including recent NATO entrant Finland, have seen an upsurge in hostile attacks that pose a threat to both businesses and government institutions.

# data[].attributes.attachment_link.readable_text
Cyberattacks against Ukraine have surged, linked to attacks on the ground, but their effectiveness has been blunted, according to observers including the deputy chairman of Ukraine's cyber warfare service.

As its campaign against Ukraine grinds on well into its second year, Russia appears to be making greater use of hacktivists, "patriotic" cybercriminals, and mercenaries in its attacks on the smaller nation. Meanwhile, Western countries neighboring Russia, including recent NATO entrant Finland, have seen an upsurge in hostile attacks that pose a threat to both businesses and government institutions.

Attacks by Russia against Ukraine's government, media outlets and utilities predate the full-scale invasion of its southern neighbor by Russian forces in February 2022, stretching back to the annexation of the Crimean Peninsula in 2014. Notable attacks include the NotPetya wiper malware in June 2017 and attacks on Ukraine's power grid in December 2015 that temporarily left about 225,000 customers without power. The latter was subsequently attributed to Sandworm, a unit of Russian military intelligence (GRU).

With the full-scale invasion of Ukraine, feared attacks leading to the degradation of critical infrastructure services failed to materialize -- thanks to the experience, preparations, and expertise of Ukrainian cyber-defenders. Assistance by Ukraine's Western allies also helped to build resilience in the face of determined assaults.

Russia's cyberattacks against Ukraine have surged

Cyberattacks have nonetheless continued throughout the conflict, accompanied by something of an upsurge in activity since the start of 2023. The Computer Emergency Response Team of Ukraine ( CERT-UA) handled 701 incidents between January and April of 2023, with utilities at the sharp end of attacks. About a quarter of the attacks were aimed at government agencies and the military with many of the remainder targeting the power grid, finance, transport, telecoms, and other elements of Ukraine's critical infrastructure. This compares to 2,194 attacks logged by CERT-UA throughout the whole of 2022.

The aims of Russian cyber attackers include reconnaissance (gaining information about government and public infrastructure as well as citizens), destroying infrastructure, spreading panic and distrust in local authorities, and attacking the morale of the population through disinformation and propaganda.

Russian cyberattacks against Ukraine often coincide with physical strikes by rockets and missiles and drones, according to Victor Zhora, the deputy chairman and chief digital transformation officer of the State Service of Special Communication and Information Protection of Ukraine (SSSCIP). "In some cases, we observe the coordination between cyberattacks and kinetic attacks," Zhora says. "For instance, some cyberattacks can be disruptive to [elements of the] critical infrastructure, such as telecoms. In some cases, these attacks can amplify the psychological effect of kinetic attacks."

International support has helped Ukraine fend off cyberattacks

Information harvested through hacking can be used as intelligence to direct conventional (kinetic) attacks. "There are many forms of how these attacks can be really harmful and can be useful in conventional warfare," Zhora says. "Of course, the impact of these attacks cannot be compared to the disruptions provided by conventional warfare."

During the conflict, Ukraine's defence minister famously called for international support from hackers in targeting Russian entities, leading onto the creation of the "IT Army of Ukraine", a band of Ukrainian and foreign volunteers. This syndicate has had a significant impact in disrupting Russian entities, including conducting DDoS attacks, doxing Russian military members and senior officials, conducting defacement attacks, and data breaches.

The IT Army of Ukraine has also played a significant role in PsyOps (psychological warfare) and in raising awareness of the reality of the conflict among Russian citizens, many of whom have had their access to real-time information censored by the Russian state.

Russia's Killnet community has caused increased disruption

Russia, meanwhile, has established a hacktivist community under the name Killnet which has had some success in conducting disruptive attacks against institutions in Ukraine and NATO countries. This has mostly involved the use of DDoS attacks, which while being successful in causing disruptions, have not had a lasting impact.

Other groups supporting Russia include Cyber Front Z, a pro-Russian troll operation, and NoName057, a group largely associated with running DDoS attacks against the websites of utilities and telecoms firms in pro-Ukranian countries. A wiper called Acid Rain affected routers and modems, including 5800 wind turbines in Germany on 24 February 2022.

Cybersecurity experts tell CSO that the Russian state has some level of involvement in influencing hacktivist and cybercriminal operations, but its level of involvement is unclear. Many pro-Russian hacktivist groups that claim to carry out attacks on Russia's enemies are, in fact, fronts for various Russian government agencies, security experts suspect.

For example, the FreeCivilian data extortion group has conducted several attacks that have resulted in the deliberate breaching of data on Ukrainian government websites. While those running the operation have claimed to be an independent cybercriminal (or group), there are several similarities with defacement activity that was attributed to advanced persistent threat (APT) groups associated with Russian military intelligence (GRU). "It is realistically possible that FreeCivilian is instead operated by GRU members," according to Chris Morgan, senior cyber threat intelligence analyst at ReliaQuest.

A member of the "Yanluowang" ransomware group was also doxxed as a member of the Russian Armed Forces. "With threat actors deliberately attempting to obfuscate their identity and motivations -- often by masquerading as a separate entity -- determining where activity sits on the spectrum of attribution is incredibly difficult," Morgan says.

Russian tactics have been shifting

Broadly speaking Russian military intelligence (GRU) is most involved in targeting Ukraine with destructive attacks. The Russian FSB security agency is, by contrast, targeting intelligence operations worldwide. Tactics and targets are shifting as are the cadence of attacks.

"Russian cyber operations have also taken a dramatic change, with reporting suggesting that Russian state-aligned groups - notably those associated with Russia's military intelligence, the GRU - have been changing pace to conduct quick, destructive attacks," Morgan says. "This change involves a tactic of 'living on the edge' by targeting edge devices like firewalls and routers and deploying data-wiping malware in a matter of weeks after initial access. Often, victims were targeted multiple times, with motivations balanced between conducting espionage operations and conducting disruption."

Even financially motivated groups are sometimes encouraged to attack Ukrainian targets with reassurance by the Russian government that they will not be prosecuted. A recent espionage campaign by the hacking group Winter Vivern (a group with links to the Russian and Belarusian governments) targeted government agencies and telecom operators in Europe, Ukraine, and India.

Among the targets it is suspected to have attacked are Ukrainian government websites that offer guidance to Russian and Belarusian troops seeking to surrender during the war in Ukraine. "Russia's tactics have had to change because in the past their reliance on many APT groups who were based in Russia changed," Philip Ingram MBE, a former senior British military intelligence officer and content lead at International Cyber Expo, tells CSO. "Those APTs franchised a lot of their activities out to hackers outside Russia and their access to these individuals dried up almost completely when Russia re-invaded Ukraine in February 2022."

Russia appears to be tolerating more hacktivist groups

Russian hacktivists continue to play a nuisance role both inside Ukraine and across the rest of the world, according to Ingram. The Russian government has probably tolerated cybercriminal ransomware gangs such as REvil and Conti. But in January 2022, just before the invasion of Ukraine, they cracked down on the REvil gang and arrested them.

It seems that some of the cybercriminals arrested by Russia during a short-lived crackdown on ransomware operations prior to February 2022 have been released, according to Mikko Hypp?nen, chief research officer at WithSecure. Over recent months, the Finland-based cybersecurity vendor has tracked an increase in the activity of pro-Russian hacktivist groups.

Tim West, head of threat intelligence at WithSecure, says there has long appeared to be a relationship between Russian hacktivists and the country's government. This month some of these hacktivists have come out self-proclaimed "private military contractors" (mercenaries), openly declaring themselves as more involved than simple self-motivated "patriotic hackers," he tells CSO. At present, these hacktivists are primarily involved in disruptive attacks such as distributed denial of service (DDoS) attacks, ransomware and wiper malware. Most of this is fairly low level, according to West.

Finland has seen a spike in attacks since joining NATO

Finland joined NATO on April 4, 2023, in a decision spurred on by Russia's full-scale invasion of Ukraine. Russian jets have carried out incursions into Finnish airspace since Finland first applied to join the Western defence alliance. The country's accession to NATO has been accompanied by a ramp-up in DDoS attacks against Finnish government organizations, according to West. "We also detected a small spike in malware activity in Finland on the days around Finland's membership was made official."

Technical measures - such as applying software updates, redundancy and remote backups - need to be combined with processes and policies to make countries more resilient to attacks. "The Ukraine is not alone. Unfortunately, it is not the only target," Zhora says. "We see a lot of our friends and partners being attacked by Russia." "I think there are a lot of areas of cooperation, exchanging information on threats, sharing experience and techniques of protection," Zhora says. "Our recommendations for all of our partners are basically the same: sharing cyber rules, building capacities, enhancing collaboration and cooperation between agencies, improving international cooperation, and strengthening existing infrastructures. I think one of the major contributions to our resilience was achieved through international technical assistance projects prior to this full-scale war."

SUBSCRIBE TO OUR NEWSLETTER

Get started by entering your email address below.

# data[].attributes.attachment_link.title
Ukraine's ground counteroffensive ushers in a new phase of the conflict in cyberspace

# data[].attributes.attachment_link.description
Cyberattacks against Ukraine have surged, linked to attacks on the ground, but their effectiveness has been blunted, according to observers including the deputy chairman of Ukraine's cyber warfare service.

# data[].attributes.headline
China ups hacks on US government. Preparing for war? | Semafor

# data[].attributes.subject
China ups hacks on US government. Preparing for war? | Semafor

# data[].attributes.body
Microsoft announced this week that a Chinese cyber unit, codenamed Storm-0558, hacked this spring into U.S. government agencies and the private emails of senior U.S. officials. Among them: Commerce Secretary Gina Raimondo, who’s taken a hawkish stance on constricting American tech exports to China that would make her a prime target for Beijing.

These cyber intrusions came as the Biden administration was publicly working to ease tensions with China. And they dovetail with evidence of China’s stepped-up surveillance operations against the U.S., including the deployment of spy balloons in the Western hemisphere and the establishment of new electronic surveillance bases in Cuba. Microsoft said the Chinese exploited weaknesses in the company’s authentication software to access these U.S. government accounts, which weren’t believed to be hosting classified data.

# data[].attributes.attachment_link.readable_text
The Interview

Jay Solomon: Can you put into context how China's hacks on Microsoft fit into the broader context of its cyber operations?

Adam Marrè: So, targeting various folks in the State Department, and the information we've seen so far, it does appear that this was a more targeted attack. It wasn't just: Hey, we found this vulnerability in authentication tokens in Microsoft's [Outlook systems] so we're just going to look at everyone's email.

Jay Solomon: Is this hacking group, called Storm-0558, a formal arm of the Chinese government?

Adam Marrè: I don't know that the distinction is as important as it might be with other nations - just because of the closeness of the [Chinese Communist Party] to all organizations, be they commercial, independent organizations, or state-sponsored...The information is going to end up in the same place.

Jay Solomon: China has targeted the Pentagon's critical infrastructure in Guam. Is this a symptom of Beijing's improved capabilities or of a worsening relationship with the U.S.?

Adam Marrè: I would say it's a mix of both...We are definitely seeing more of this spy craft, and even some of those preparation-of-the-battlefield-type activities, where they're attacking some sort of critical infrastructure and lying dormant in it - just in case something breaks out in the real world.

Jay Solomon: The U.S. government has voiced its concerns about China controlling telecommunications infrastructure globally. How much does this enhance its ability to spy?

Adam Marrè: It starts with just wanting to get your technology into different places, because if you have the infrastructure, you can control it and you can listen to it and do all of that...There is the option for them to conduct whatever operations they want. And it's difficult to detect that in all of the hardware that they're installing.

Jay Solomon: How would you differ China's cyber operations from countries like Russia, Iran and North Korea?

Adam Marrè: You do see less of the funded sort of smash-and -grab type ransomware attacks coming out of China. That doesn't mean you don't see them. And it doesn't mean you don't see other sorts of fraud...But it's more spy craft, the more sophisticated low-and-slow, quiet-type behavior aimed at gaining information, be that intellectual property or information on the government.

Jay Solomon: How should American companies think about the Chinese cyber threat?

Adam Marrè: It is just a really good reminder that if you're doing business with the [U.S.] government, or with companies that do bleeding edge technology, AI, anything that adversaries or any attackers might be interested in, you need to realize that...Companies do not realize that these threats actually face them, because they think what would they want from me? I don't do this. But they don't realize they're a vector to get into the government's vector.

# data[].attributes.attachment_link.title
China ups hacks on US government. Preparing for war? | Semafor

# data[].attributes.attachment_link.description
Chinese hacks are part of a growing wave of cyber-attacks on high-level U.S. government targets and critical infrastructure that are positioning Beijing for a possible conflict with Washington and its allies.

# data[].attributes.headline
Microsoft meldet Großangriff auf E-Mail-Konten

# data[].attributes.subject
Microsoft meldet Großangriff auf E-Mail-Konten

# data[].attributes.body
Hacker aus China sind nach Angaben des Softwareriesen Microsoft in E-Mail-Konten mehrerer westlicher Regierungseinrichtungen eingedrungen. Der in China ansässige Akteur, den Microsoft als Storm-0558 bezeichnet, habe sich Zugriff auf E-Mail-Konten von 25 Organisationen einschließlich Behörden verschafft, erklärte der Konzern am Dienstagabend (Ortszeit). "Wir gehen davon aus, dass dieser Gegner sich auf Spionage konzentriert - sowie auf das Erlangen von Zugang zu E-Mail-Systemen zum Sammeln von Geheiminformationen." Betroffen sind laut Microsoft die Konten von 25 Organisationen, darunter wohl auch das US-Außenministerium. Zu dem Vorfall wird weiterhin ermittelt.

# data[].attributes.attachment_link.readable_text
(Foto: picture alliance / Karl-Josef Hildenbrand/dpa)

Um Geheiminformationen zu sammeln, sollen sich chinesische Hacker Zugriff auf Mail-Konten westlicher Regierungsbehörden verschafft haben. Betroffen sind laut Microsoft die Konten von 25 Organisationen, darunter wohl auch das US-Außenministerium. Zu dem Vorfall wird weiterhin ermittelt.
Hacker aus China sind nach Angaben des Softwareriesen Microsoft in E-Mail-Konten mehrerer westlicher Regierungseinrichtungen eingedrungen. Der in China ansässige Akteur, den Microsoft als Storm-0558 bezeichnet, habe sich Zugriff auf E-Mail-Konten von 25 Organisationen einschließlich Behörden verschafft, erklärte der Konzern am Dienstagabend (Ortszeit). "Wir gehen davon aus, dass dieser Gegner sich auf Spionage konzentriert - sowie auf das Erlangen von Zugang zu E-Mail-Systemen zum Sammeln von Geheiminformationen."

Ziel der Attacken wurde offenbar auch das US-Außenministerium, auch wenn Microsoft das Ministerium nicht explizit aufführte. Ein Außenamtssprecher erklärte aber in Washington, das Ministerium habe "ungewöhnliche Aktivitäten" ausgemacht und daraufhin "sofortige Schritte unternommen, um unsere Systeme zu sichern". Nähere Angaben wollte das Außenministerium in Washington unter Verweis auf seine "Cybersicherheitspolitik" nicht machen. "Zu dem Vorfall wird weiterhin ermittelt", erklärte der Sprecher.

Die Zeitung "Washington Post" berichtete, die gehackten E-Mail-Konten hätten keine Geheimhaltungsstufen gehabt. Konten des US-Verteidigungsministeriums, von Geheimdiensten oder den Streitkräften des Landes seien mutmaßlich nicht betroffen gewesen. Der Nationale Sicherheitsberater von US-Präsident Joe Biden, Jake Sullivan, sagte im Fernsehsender ABC, der Hackerangriff sei "ziemlich schnell" entdeckt worden. "Wir konnten weitere Breschen verhindern."

Microsoft zufolge greift Storm-0558 in erster Linie "Regierungsbehörden in Westeuropa" an und konzentriert sich dabei auf Spionage, Datendiebstahl und Zugangsdaten. Der Softwarekonzern hatte nach eigenen Angaben am 16. Juni eine Untersuchung zu "ungewöhnlicher E-Mail-Aktivität" eingeleitet und unternahm in der Folge Schritte, um den Hackerangriff zu unterbinden.

Quelle: ntv.de, lno/AFP

# data[].attributes.attachment_link.title
Microsoft meldet Großangriff auf E-Mail-Konten

# data[].attributes.attachment_link.description
Um Geheiminformationen zu sammeln, sollen sich chinesische Hacker Zugriff auf Mail-Konten westlicher Regierungsbehörden verschafft haben. Betroffen sind laut Microsoft die Konten von 25 Organisationen, darunter wohl auch das US-Außenministerium. Zu dem Vorfall wird weiterhin ermittelt.

# data[].attributes.headline
Métaux stratégiques : l'Europe tremble, la Chine menace de freiner ses exportations

# data[].attributes.subject
Métaux stratégiques : l'Europe tremble, la Chine menace de freiner ses exportations

# data[].attributes.body
Pékin a annoncé, lundi, que les exportations de gallium et germanium seront soumises à l’aval du gouvernement. Une étape de plus dans les tensions commerciales sino-américaines et qui place l’Europe dans une position difficile. En effet, la Chine produit l’essentiel de ces métaux précieux et des terres rares, des minerais cruciaux pour le développement de nombreuses technologies.

# data[].attributes.attachment_link.readable_text
Je t'aime, moi non plus. Voilà comment pourraient être décrites les relations entre la Chine et les Etats-Unis. Alors que la secrétaire américaine au Trésor Janet Yellen est arrivée ce jeudi à Pékin et a prôné une " concurrence saine " entre la Chine et les États-Unis, la Chine a lancé de nouvelles menaces non-dites à Washington lundi.

Réindustrialisation : la France peut-elle sécuriser l'approvisionnement des métaux stratégiques ?

À compter du 1er août, les exportations de gallium -un minerai que l'on trouve dans les circuits intégrés, les LED et les panneaux photovoltaïque- et de germanium -indispensable pour les fibres optiques et l'infrarouge- nécessiteront une licence avant de pouvoir être autorisées en Chine. De plus, le destinataire final des exportations et l'objet de leur utilisation devront être précisés, ont annoncé les autorités chinoises.

Bloquer l'accès à des métaux stratégiques aux Etats-Unis

Pékin justifie officiellement ces mesures par la nécessité de " préserver la sécurité et les intérêts nationaux " en faisant passer la Chine avant l'étranger concernant l'approvisionnement de ces métaux stratégiques.

En réalité, il s'agit d'une nouvelle étape dans l'envenimement des relations sino-américaines. " C'est une décision géopolitique qui traduit une tendance de raidissement des relations entre les deux superpuissances qui ne se voit plus seulement avec des mots, mais aussi avec des actions ", analyse, en effet, Sylvain Bersinger, économiste au cabinet Asterès et spécialiste de l'économie chinoise.

Illustration de ces tensions qui concernent notamment Taïwan, convoitée par Pékin, mais défendue par les Etats-Unis : fin 2022, Washington a décidé de limiter les exportations de machines de production de semi-conducteurs de pointe, en particulier celles du fabricant néerlandais ASML. En réponse, fin mai, la Chine a interdit l'utilisation des semi-conducteurs de l'Américain Micron dans certains secteurs pour motifs sécuritaires et menace donc maintenant implicitement de bloquer l'accès de ces métaux stratégiques aux USA et leurs alliés.

Bataille sur le marché des semi-conducteurs : la Chine frappe un grand coup en bannissant Micron

Un risque d'embargo des terres rares chinoises

Pour l'instant, même si la Chine représente 80% de la production mondiale de gallium et de germanium, selon des chiffres de la Commission européenne, " il ne s'agit que d'un coup de semonce " estime Christian Mion Senior Partner chez EY, spécialiste des matières premières. Ce dernier affirme que " l'annonce de la Chine ne va pas avoir d'effet sur la quantité de ressources disponibles, puisque les réserves de ces deux métaux sont présentes ailleurs dans le monde. Un embargo sur ces derniers provoquera, au pire, une tension temporaire sur la chaîne logistique et une augmentation des prix ". De gros mineurs, dont le Congolais, la Gécamines, le Russe, Rostec, et la société néerlandaise, Nyrstar, pourraient, en effet, remplacer les exportations chinoises. " Nous allons produire du germanium (pour remplacer le matériau) qui n'est pas disponible sur le marché ", a d'ailleurs déjà déclaré à Reuters le président de la Gécamines, Guy Robert Lukama.

LIRE ICI NOTRE DOSSIER SPÉCIAL " LES MÉTAUX STRATÉGIQUES, NERF DE LA GUERRE DE LA TRANSITION ÉNERGÉTIQUE "

Mais la vraie menace est ailleurs. Au-delà du gallium et du germanium, avec ces restrictions Pékin fait craindre un arrêt des exportations de terres rares ce qui " serait alors beaucoup plus grave pour nous " alerte le consultant. Et pour cause, bien que ces minerais (qui tirent leur nom de leur faible concentration dans le sol) soient présents sur de nombreux continents, la Chine a extrait 58% de la production mondiale et raffiné 89% en 2022. Problème, ces métaux sont cruciaux dans la confection de nombreux objets électroniques et numériques. Selon l'Agence internationale de l'énergie (IEA), les besoins en technologies bas-carbone, notamment pour les moteurs de véhicules électriques ou les éoliennes en mer, pourraient multiplier par sept la demande mondiale, d'ici 2040, soit près de 2 millions de tonnes par an, contre 280.000 tonnes en 2022.

L'Union européenne pourrait pâtir de la guerre commerciale sino-américaine

Consciente des risques pour son économie, la Commission européenne a annoncé, mardi 4 juillet, préparer " une analyse détaillée de leur impact potentiel [ndlr, des restrictions annoncées par la Chine] sur les chaînes d'approvisionnement mondiales et l'industrie européenne ", a indiqué une porte-parole de l'Union européenne. " Nous appelons la Chine à adopter une approche où les restrictions et contrôles sont basés sur des considérations de sécurité claires dans le respect des règles de l'Organisation mondiale du commerce (OMC) ", a-t-elle ajouté.

En cas d'arrêt des exports de Gallium, germanium ou même de terres rares, " les Européens se retrouveront dans une position délicate, car les Américains et les Australiens vont trouver des sources de productions alternatives ", regrette Christian Mion.

Car le Vieux continent ne dispose pas de mines pour le moment et " l'éventuelle exploitation n'interviendra pas avant dix ou quinze ans, délai minimum pour ouvrir une mine et la mettre en service " affirme le Présidente du groupe d'experts sur les ressources minérales de la transition bas carbone Dominique Viel, dans une note. À l'inverse, l'Australie et les Etats-Unis disposent déjà de nombreuses mines et produisent respectivement 8% et 15% des terres rares au niveau mondial, selon l'Institut des études géologiques des États-Unis.

" En cas d'embargo de la Chine sur les terres rares, il y aura, bien sûr, quelques frictions, car les mines américaines et australiennes, ou autres devront augmenter leurs capacités de production ce qui prendra un peu de temps. Les Européens seront probablement servis après les pays producteurs et pourraient, en conséquence, manquer de ces métaux à court terme ", anticipe François Candelon, directeur monde du BCG Henderson Institute, expert de la Chine.

Malgré ces risques les Européens ont décidé de répondre à la menace... par une autre menace. L'UE pourrait ainsi envisager " des actions dans le cadre de l'OMC ". Mais " l'OMC est une coquille vide car les Etats-Unis et la Chine prennent des décisions en dehors de cette institution depuis plusieurs années ", rétorque Sylvain Bersinger, qui considère cependant que " cela montre que l'Europe est prête à prendre des contre-mesures. Dans les mois à venir, nous pourrions voir d'autres sanctions croisées et des nouvelles restrictions ". Une escalade des tensions qui pourrait finir par nuire au développement des nouvelles technologies et à la transition écologique en Chine comme en Occident.

LIRE NOTRE DOSSIER-

# data[].attributes.attachment_link.title
Métaux stratégiques : l'Europe tremble, la Chine menace de freiner ses exportations

# data[].attributes.attachment_link.description
Pékin a annoncé, lundi, que les exportations de gallium et germanium seront soumises à l'aval du gouvernement. Une étape de plus dans les tensions commerciales sino-américaines et qui place l'Europe dans une position difficile. En effet, la Chine produit l'essentiel de ces métaux précieux et des terres rares, des minerais cruciaux pour le développement de nombreuses technologies.

# data[].attributes.body
In the US-China rivalry, no battle is currently more fierce than the one over technology, with both countries ramping up efforts to pursue global technological leadership. The tech war has intensified under President Joe Biden, with the US’s strangling of China’s technological bottleneck getting tighter and tighter. The US’s stated aims are protecting its national security and foreign policy interests and preventing sensitive technologies with military applications from being acquired by China.

Some analysts point to Beijing’s Made in China 2025 as the trigger of the tech war because that is China’s plan to upgrade manufacturing and seek the top positions in global value chains. The US is pursuing a strategy to outcompete and outmanoeuvre China, as is stated in the Biden administration’s National Security Strategy in October 2022: “this decade will be decisive, in setting the terms of our [the US’s] competition with the PRC”.

# data[].attributes.attachment_link.readable_text
Some analysts point to Beijing's Made in China 2025 as the trigger of the tech war because that is China's plan to upgrade manufacturing and seek the top positions in global value chains. The US is pursuing a strategy to outcompete and outmanoeuvre China, as is stated in the Biden administration's National Security Strategy in October 2022: "this decade will be decisive, in setting the terms of our [the US's] competition with the PRC".

How the tech war will play out has important implications for Western countries and global supply chains. This policy brief will focus on China's responses to the US-waged tech war, specifically: What have been China's domestic measures to respond to the tech restrictions from the US, and what is China's potential for technological breakthrough? What have been China's international responses, and what are China's options for retaliation?

China is estimated by industry experts to be at least five years behind in making the most advanced logic chips, and even more backward-around ten years-in developing the tools and software for making chips. China can produce 14 nm chips at scale, which are mostly used in consumer electronics, cars, artificial intelligence (AI) and application processors. But China still needs more advanced technology (7nm and smaller). In 2022, China reportedly made breakthrough in making chips with a 7nm process, still two steps behind the most advanced 5nm and 3nm processes in Taiwan and South Korea. Because of its reliance on hardware from the US and its allies for the most advanced chips and semiconductor equipment, China is worried about supply chain vulnerability and its technological development for civil and military usages. Like the US, Beijing is also concerned about national security: there is a risk that the US can tap into Chinese networks through backdoors installed in the chips.

Domestically, China has tried the following contingency responses.

One domestic response in China was to turn to alternative sources of import. As US export restrictions tightened, Chinese chip companies relied on costly equipment made by Japanese and Dutch companies, but the latter two are now also planning restrictions. If the restrictions include servicing, Chinese companies would not be able to use their existing imported machines.

Trump's Huawei ban reduced Taiwan Semiconductor Manufacturing Company (TSMC)'s export reliance on China from 20% in 2020 to 10% in 2021, but China still relies on Taiwan for the most advanced chips. More than one third of China's semiconductor imports came from Taiwan in 2021, and China relies on Taiwan for the most advanced chips. According to the chairman of TSMC, Mark Liu, the company will not be operable under an embargo by China because of the company's need for real-time connection with international partners. The so-called Silicon Shield theory - that Taiwan's indispensable role in the global chips value chain and its importance to the mainland would deter Beijing from forcible takeover - is being hotly debated. No matter what, to ensure that China's plan to reunite Taiwan would not be too destructive to the mainland's economy, China must make technological advances.

Another immediate response among Chinese companies has been to find loopholes in the US policies. Some Chinese companies targeted by the US sanctions have reportedly found ways to obtain restricted technology (e.g. American company Nvidia's A100 chips) by first, using cloud providers (companies that establish public clouds, manage private clouds, or offer on-demand cloud computing services) that use A100 chips; second, rental arrangements with third parties instead of buying the chips; and third, purchasing the chips through subsidiaries in China. It should only be a matter of time before the US

A third response is to carry on with less advanced chips or machines. Chinese companies like Alibaba and Biren are reportedly modifying their semiconductors so that their contractor manufacturers like TSMC can continue to produce for them without using the banned US technology. International chips manufacturers including American Nvidia also come up with new, just-below-threshold products for the Chinese market to avoid US restrictions.

A renewed focus on domestic innovation in China

The detours that China has taken to respond to the US tech restrictions have taught China the lesson that it must resort to domestic innovation to realise semiconductor supply-chain self-sufficiency. A government official working closely with chipmakers reportedly told Financial Times: 'China has wasted too much money on non-functional research to bypass the sanctions without harvest. It is time to ditch the delusions and channel all possible resources into the companies, with the capability to guide the industry out of misery.'

China's support for domestic innovation has had mixed results in different sectors. When it comes to semiconductors, China has intensified state funding (including setting up a Big Fund industry investment funds since 2014, but with limited success because of corruption and inefficient usage of funds at local governments that set up numerous small factories. Therefore, China has adopted a new approach to supporting innovation. Instead of distributing most subsidies to local governments and state laboratories, it has realised the importance of supporting leading companies including private businesses. When the US added China's biggest chipmaker Yangtze Memory Technologies Corp (YMTC) to the 'Entities List' in autumn 2022, the Chinese government reportedly poured US$7 billion investment into the company. This year, China is giving a selected group of chip companies (probably SMIC, YMTC, CXMT, Huawei, Hua Hong, NAURA, and AMEC) easier access to subsidies without performance requirements and more say over state-funded research. That does not mean the Communist Party is loosening its grip on the domestic tech sector. It set up a new Central Commission for Science and Technology which can potently gather and coordinate resources.

China's international responses: Options for retaliation?

China brought a lawsuit at the World Trade Organization (WTO) against the US in December 2022 after Washington imposed sweeping restrictions in October. It was largely a symbolic move because the US has blocked the appointment of new judges to the WTO's Appellate Body since September 2018, thus paralysing the WTO dispute settlement system

China has been considering countermeasures for some time. Restricting rare earths export is one of the cards that have been in domestic and international discussions. China accounts for 60% of rare earth mining and around 85% of global processing capacity, and 80% of the US's rare earth imports come from China. Even though the US and its allies are trying to diversify their rare earths supply chains, China's global dominance and its influence on prices will continue for a long time, probably a decade.

There are signs that China's patience with the US restrictions is wearing thin. In February 2023, the Chinese government published a new Catalogue of Prohibited and Restricted Tech Export Items, which included LiDAR technology for automatic driving, photovoltaic silicon wafer technology for solar panels, and rare earth refining technology. It signals a more strategic use of China's dominant position in some high-tech sectors for protecting itself from Western tech restrictions and for global competition.

If China succeeds in developing chip technologies that are on par with global industry leaders, it means more competition in the global market. China's economic scale may give it price advantage and efficiency in businesses processes and thus outcompete its Western peers in market share, as happened with solar panels and lithium batteries.

If the US and its allies continue with tech decoupling policy, Chinese and Western technology will be used in two digital worlds, increasing the transaction costs and security risks for international companies. The success of China's semiconductor industry will depend on its domestic market and on the countries that trust Chinese technology.

If China succeeds in developing more advanced semiconductor technology than Western players or becomes the leader in next-generation transistor technology, as some Chinese scientists are advocating, China will seek to obtain global patents and copyrights that could mean bottlenecks for Western countries.

Whether or not the global digital world splits into two because of the US-China tech war, now is a strategic window where China still needs globalisation and Western technology. That gives European and Asian countries an opportunity to negotiate its interests with both China and the US, to inspect the concept of economic security, and to examine the safety and efficiency of global supply chains.

# data[].attributes.headline
China’s AI Regulations and How They Get Made

# data[].attributes.subject
China’s AI Regulations and How They Get Made

# data[].attributes.body
Beijing is leading the way in AI regulation, releasing groundbreaking new strategies to govern algorithms, chatbots, and more. Global partners need a better understanding of what, exactly, this regulation entails, what it says about China’s AI priorities, and what lessons other AI regulators can learn.

# data[].attributes.headline
Artificial Intelligence: DOD Needs Department-Wide Guidance to Inform Acquisitions

# data[].attributes.subject
Artificial Intelligence: DOD Needs Department-Wide Guidance to Inform Acquisitions

# data[].attributes.body
The Department of Defense is developing artificial intelligence capabilities—computer systems that can do tasks that normally require human intellect.

The private sector has been acquiring AI for years. Thirteen private companies told us about their AI acquisition practices. For example, some companies mentioned the importance of considering intellectual property and data rights when negotiating contracts for AI projects.

Although parts of DOD are already using AI, DOD hasn't issued department-wide AI acquisitions guidance needed to ensure consistency. We recommended it develop such guidance—considering private company practices as appropriate.

# data[].attributes.attachment_link.readable_text
Fast Facts

The Department of Defense is developing artificial intelligence capabilities-computer systems that can do tasks that normally require human intellect.

The private sector has been acquiring AI for years. Thirteen private companies told us about their AI acquisition practices. For example, some companies mentioned the importance of considering intellectual property and data rights when negotiating contracts for AI projects.

Although parts of DOD are already using AI, DOD hasn't issued department-wide AI acquisitions guidance needed to ensure consistency. We recommended it develop such guidance-considering private company practices as appropriate.

Highlights

What GAO Found

The Department of Defense (DOD) designated artificial intelligence (AI) a top modernization area and is allocating considerable spending to develop AI tools and capabilities. AI refers to computer systems designed to replicate a range of human functions and continually get better at their assigned tasks. DOD AI capabilities could be used in various ways, for example in identifying potential threats or targets on the battlefield.

GAO obtained information from 13 private sector companies about how they successfully acquire AI capabilities. Elements of these categories, shown below, are also reflected in GAO's June 2021 AI Accountability Framework report ( GAO-21-519SP).

Categories of Factors Selected Companies Reported Considering When Acquiring Artificial Intelligence Capabilities

Although numerous entities across DOD are acquiring, developing, or already using AI, DOD has not issued department-wide guidance for how its components should approach acquiring AI. DOD is in the process of planning to develop such guidance, but it has not defined concrete plans and has no timeline to do so. The military services also lack AI acquisition-specific guidance, though military officials noted that such guidance would be helpful to navigate the AI acquisition process. Without department-wide and tailored service-level guidance, DOD is missing an opportunity to ensure that it is consistently acquiring AI capabilities in a manner that accounts for the unique challenges associated with AI.

Various DOD components and military services have individually developed or plan to develop their own informal AI acquisition resources. Some of these resources reflect key factors identified by private companies for AI acquisition. For example, DOD's Chief Digital and AI Officer oversees an AI marketplace known as Tradewind, which is designed to expedite the procurement of AI capabilities. Several Tradewind resources emphasize the need to consider intellectual property and data rights concerns when negotiating contracts for AI capabilities, a key factor identified by the companies GAO interviewed.

Why GAO Did This Study

DOD has begun to pursue increasingly advanced AI capabilities. DOD has historically struggled to acquire weapon systems software, and AI acquisitions pose additional challenges. In February 2022, GAO described the status of DOD's efforts to develop and acquire AI for weapon systems.

Senate Report 116-236 accompanying the National Defense Authorization Act for Fiscal Year 2021 includes a provision for GAO to review DOD's AI acquisition efforts. This is the second report in response to that provision. This report examines (1) key factors that selected private companies reported considering when acquiring AI capabilities, and (2) the extent to which DOD has department-wide AI acquisition guidance and how, if at all, this guidance reflects key factors identified by private sector companies.

GAO analyzed information provided by 13 private companies with expertise in designing, developing, and deploying AI systems in various sectors to determine the key factors. GAO also analyzed DOD documentation and compared it with the key factors, and interviewed DOD officials.

Recommendations

Recommendations for Executive Action

Full Report

GAO Contacts

# data[].attributes.attachment_link.title
Artificial Intelligence: DOD Needs Department-Wide Guidance to Inform Acquisitions

# data[].attributes.attachment_link.description
The Department of Defense is developing artificial intelligence capabilities-computer systems that can do tasks that normally require human intellect...

# data[].attributes.headline
Biden-Harris Administration Publishes the National Cybersecurity Strategy Implementation Plan

# data[].attributes.subject
Biden-Harris Administration Publishes the National Cybersecurity Strategy Implementation Plan

# data[].attributes.body
President Biden has made clear that all Americans deserve the full benefits and potential of our digital future. The Biden-Harris Administration’s recently released National Cybersecurity Strategy calls for two fundamental shifts in how the United States allocates roles, responsibilities, and resources in cyberspace:

1. Ensuring that the biggest, most capable, and best-positioned entities – in the public and private sectors – assume a greater share of the burden for mitigating cyber risk

2. Increasing incentives to favor long-term investments into cybersecurity

Today, the Administration is announcing a roadmap to realize this bold, affirmative vision. It is taking the novel step of publishing the National Cybersecurity Strategy Implementation Plan (NCSIP) to ensure transparency and a continued path for coordination. This plan details more than 65 high-impact Federal initiatives, from protecting American jobs by combatting cybercrimes to building a skilled cyber workforce equipped to excel in our increasingly digital economy. The NCSIP, along with the Bipartisan Infrastructure Law, CHIPS and Science Act, Inflation Reduction Act, and other major Administration initiatives, will protect our investments in rebuilding America’s infrastructure, developing our clean energy sector, and re-shoring America’s technology and manufacturing base.

# data[].attributes.attachment_link.readable_text
President Biden has made clear that all Americans deserve the full benefits and potential of our digital future. The Biden-Harris Administration's recently released National Cybersecurity Strategy calls for two fundamental shifts in how the United States allocates roles, responsibilities, and resources in cyberspace:

1. Ensuring that the biggest, most capable, and best-positioned entities - in the public and private sectors - assume a greater share of the burden for mitigating cyber risk

2. Increasing incentives to favor long-term investments into cybersecurity

Today, the Administration is announcing a roadmap to realize this bold, affirmative vision. It is taking the novel step of publishing the National Cybersecurity Strategy Implementation Plan (NCSIP) to ensure transparency and a continued path for coordination. This plan details more than 65 high-impact Federal initiatives, from protecting American jobs by combatting cybercrimes to building a skilled cyber workforce equipped to excel in our increasingly digital economy. The NCSIP, along with the Bipartisan Infrastructure Law, CHIPS and Science Act, Inflation Reduction Act, and other major Administration initiatives, will protect our investments in rebuilding America's infrastructure, developing our clean energy sector, and re-shoring America's technology and manufacturing base.

Each NCSIP initiative is assigned to a responsible agency and has a timeline for completion. Some initiatives, such as the issuance of the Administration's Cybersecurity Priorities for the Fiscal Year 2025 Budget, have been completed ahead of schedule. Other completed activities, such as the transmittal of the May 26th Department of Defense 2023 Cyber Strategy to Congress, and the June 20th creation of a new National Security Cyber Section by the Justice Departmen t, are key milestones in completing initiatives. This is the first iteration of the plan, which is a living document that will be updated annually.

Eighteen agencies are leading initiatives in this whole-of-government plan demonstrating the Administration's deep commitment to a more resilient, equitable, and defensible cyberspace. The Office of the National Cyber Director (ONCD) will coordinate activities under the plan, including an annual report to the President and Congress on the status of implementation, and partner with the Office of Management and Budget (OMB) to ensure funding proposals in the President's Budget Request are aligned with NCSIP initiatives. The Administration looks forward to implementing this plan in continued collaboration with the private sector, civil society, international partners, Congress, and state, local, Tribal, and territorial governments. As an example of the Administration's commitment to public-private collaboration, ONCD is also working on a request for information regarding cybersecurity regulatory harmonization that will be published in the near future.

The NCSIP is not intended to capture all Federal agency activities in support of the NCS. The following are sample initiatives from the plan, which is organized by the NCS pillars and strategic objectives.
Pillar One | Defending Critical Infrastructure

Update the National Cyber Incident Response Plan (1.4.1): During a cyber incident, it is critical that the government acts in a coordinated manner and that private sector and SLTT partners know how to get help. The Cybersecurity and Infrastructure Security Agency (CISA) will lead a process to update the National Cyber Incident Response Plan to more fully realize the policy that "a call to one is a call to all." The update will also include clear guidance to external partners on the roles and capabilities of Federal agencies in incident response and recovery.
Pillar Two | Disrupting and Dismantling Threat Actors

Combat Ransomware (2.5.2 and 2.5.4): Through the Joint Ransomware Task Force, which is co-chaired by CISA and the FBI, the Administration will continue its campaign to combat the scourge of ransomware and other cybercrime. The FBI will work with Federal, international, and private sector partners to carry out disruption operations against the ransomware ecosystem, including virtual asset providers that enable laundering of ransomware proceeds and web fora offering initial access credentials or other material support for ransomware activities. A complementary initiative, led by CISA, will include offering resources such as training, cybersecurity services, technical assessments, pre-attack planning, and incident response to high-risk targets of ransomware, like hospitals and schools, to make them less likely to be affected and to reduce the scale and duration of impacts if they are attacked.
Pillar Three | Shaping Market Forces and Driving Security and Resilience

Software Bill of Materials (3.3.2): Increasing software transparency allows market actors to better understand their supply chain risk and to hold their vendors accountable for secure development practices. CISA continues to lead work with key stakeholders to identify and reduce gaps in software bill of materials (SBOM) scale and implementation. CISA will also explore requirements for a globally-accessible database for end of life/end of support software and convene an international staff-level working group on SBOM.
Pillar Four | Investing in a Resilient Future

Drive Key Cybersecurity Standards (4.1.3, 4.3.3): Technical standards are foundational to the Internet, and U.S. leadership in this area is essential to the vibrancy and security of cyberspace. Consistent with the National Standards Strategy, the National Institute of Standards and Technology (NIST) will convene the Interagency International Cybersecurity Standardization Working Group to coordinate major issues in international cybersecurity standardization and enhance U.S. federal agency participation in the process. NIST will also finish standardization of one or more quantum-resistant publickey cryptographic algorithms.
Pillar Five | Forging International Partnerships to Pursue Shared Goals

International Cyberspace and Digital Policy Strategy (5.1.1 and 5.1.2): Cyberspace is inherently global, and policy solutions must reflect close collaboration with our partners and allies. The Department of State will publish an International Cyberspace and Digital Policy Strategy that incorporates bilateral and multilateral activities. State will also work to catalyze the development of staff knowledge and skills related to cyberspace and digital policy that can be used to establish and strengthen country and regional interagency cyber teams to facilitate coordination with partner nations.

###

# data[].attributes.attachment_link.title
FACT SHEET: Biden-Harris Administration Publishes the National Cybersecurity Strategy Implementation Plan | The White House

# data[].attributes.attachment_link.description
Read the full Implementation Plan here President Biden has made clear that all Americans deserve the full benefits and potential of our digital future. The Biden-Harris Administration's recently released National Cybersecurity Strategy calls for two fundamental shifts in how the United States allocates roles, responsibilities, and resources in cyberspace: Today, the Administration is announcing a roadmap to...

# data[].attributes.headline
Truth Decay Is Putting U.S. National Security at Risk

# data[].attributes.subject
Truth Decay Is Putting U.S. National Security at Risk

# data[].attributes.body
America's troubled relationship with facts is putting national security at risk. A recent RAND paper warned that “Truth Decay”—the diminishing role of facts and analysis in public life—could weaken our military, costs us credibility with our allies, and calls into question our ability to respond to the next big crisis.

Experts from across RAND described Truth Decay as a “huge vulnerability,” an “obvious one,” “a strong weapon” in the hands of our adversaries. Yet the full extent of the damage we are doing to ourselves is only just beginning to come into focus.

“We're stuck in a cycle,” said Caitlin McCulloch, an associate political scientist at RAND who coauthored the paper. “Polarization is feeding into Truth Decay, Truth Decay is feeding into polarization, and round and round we go. The harm that cycle is doing to our national security has not been fully explored.”

Truth Decay is more than just a fact-free rant on cable television or a conspiracy theory bouncing around social media. RAND uses the term to describe a society pulling apart over basic facts, with opinion too often standing in for analysis and debates hardening into distrust. It helps explain why nearly two-thirds of Americans in a recent NPR/Ipsos poll said U.S. democracy is in crisis and at risk of failing.

# data[].attributes.attachment_link.authors[].name
Previous Blog PostThe Wagner Group Will Live to Fight Another Day

# data[].attributes.attachment_link.title
Truth Decay Is Putting U.S. National Security at Risk

# data[].attributes.attachment_link.description
Truth Decay—the diminishing role of facts and analysis in public life—could weaken the U.S. military, costs America credibility with its allies, and calls into question the nation’s ability to respond to the next big crisis. How can the United States guard against these risks?

# data[].attributes.headline
Tech Giants Are Flouting Some New Government Cybersecurity Recommendations

# data[].attributes.subject
Tech Giants Are Flouting Some New Government Cybersecurity Recommendations

# data[].attributes.body
Major technology companies are resisting the Biden administration’s push to make basic security features free and automatic in products like their popular cloud platforms, forgoing changes that could neutralize many cyberattacks.

Amazon, Google, Microsoft, IBM, and Oracle are among the tech giants defying elements of recently issued guidance from the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency that seeks to encourage the adoption of these so-called “secure-by-default” features.

The halting early start to CISA’s campaign to shift the burden of cybersecurity upstream from users to vendors—which represents a major goal of President Joe Biden’s National Cybersecurity Strategy—raises questions about the administration’s ability to shape the behavior of these massive tech companies, which also happen to be some of the government’s most vital cybersecurity partners.

# data[].attributes.attachment_link.readable_text
Major technology companies are resisting the Biden administration's push to make basic security features free and automatic in products like their popular cloud platforms, forgoing changes that could neutralize many cyberattacks.

WASHINGTON, DC - JULY 21: A view of the White House after the White House Press Office announced that U.S. President Joe Biden tested positive for COVID-19 on Thursday morning, July 21, 2022 in Washington, DC. U.S. President Biden was previously scheduled to travel to Wilkes-Barre, Pennsylvania to discuss the recently passed Bipartisan Safer Communities Act aimed at curbing gun violence. (Photo by Drew Angerer/Getty Images) Drew Angerer/Getty Images

Amazon, Google, Microsoft, IBM, and Oracle are among the tech giants defying elements of recently issued guidance from the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency that seeks to encourage the adoption of these so-called "secure-by-default" features.

The halting early start to CISA's campaign to shift the burden of cybersecurity upstream from users to vendors-which represents a major goal of President Joe Biden's National Cybersecurity Strategy -raises questions about the administration's ability to shape the behavior of these massive tech companies, which also happen to be some of the government's most vital cybersecurity partners.

CISA says it's making slow but steady progress convincing companies to adopt its recommendations. The agency has "had very positive conversations with a significant number of technology companies" that are planning to change policies currently at odds with government guidance, according to a CISA official, who requested anonymity to discuss internal deliberation.

"We do expect to see changes in the very near term," the official added, "particularly in some of those areas that require less engineering investment and less architectural change."

In a previously unreported advancement of its campaign, CISA is preparing to publish updated guidance this summer with "perspectives from industry" about what changes are feasible now and in the future, the official said. "You are seeing a full-court press across the administration on the need for technology companies to make necessary changes and investments," the CISA official said.

But the continued refusal of leading tech firms to make relatively basic product changes with colossal security benefits has alarmed cyber experts.

"We're exceptionally vulnerable," said Mark Montgomery, executive director of the congressionally chartered Cyberspace Solarium Commission and its nonprofit successor. "These companies should be held accountable. But they're not."

Glaring gaps

In recent years, cyberattacks have increasingly exploited users' lack of security knowledge and tech platforms' refusal to activate basic protections. Hackers infected hundreds of thousands of routers by guessing their default passwords, breached major corporations through insecure administrator accounts, and roamed through victims' computers undetected because their targets lacked information about what was happening on their networks.

In one of the most devastating attacks to exploit these vulnerabilities, Russian government operatives in 2020 breached nine federal agencies and more than 100 companies by infecting IT management software made by the Texas-based company SolarWinds.

The SolarWinds hack generated frantic investigations by the incoming Biden administration and prompted the president's top cyber advisers to begin highlighting how tech companies' product decisions enabled digital intrusions. Recently, officials began urging companies to make their products "secure by design" (by writing code in a careful, safe way, to minimize flaws like the one that enabled the SolarWinds attack) and "secure by default" (by enabling security features automatically and for free, rather than charging extra for them or hiding them in obscure menus).

"Consumer safety must be front and center in all phases of the technology product lifecycle, with security designed in from the beginning, and strong safety features - like seatbelts and airbags - enabled right out of the box, without added costs," CISA Director Jen Easterly said during a February speech at Carnegie Mellon University.

In April, CISA, other federal agencies, and key foreign counterparts published the secure-by-design and secure-by-default guidance with specific recommendations. "Security is not a luxury option but is closer to the standard every customer should expect without negotiating or paying more," the document said.

The secure-by-design push faces the most daunting technical obstacles: human coders will inevitably make mistakes, and no software development environment can be completely tamper-proof. And while the secure-by-default push is less technically challenging because it mostly requires policy and pricing changes, it may also be more politically fraught, because it involves the government asking tech companies to give up profitable upcharges and force users to jump through new hoops to access their accounts.

"It's not in any way surprising that companies haven't changed their behavior," said Trey Herr, director of the Atlantic Council's Cyber Statecraft Initiative. "Anything that would cost them any money unless there's a hard requirement for it isn't something they're likely to do unless they see a clear [business] case for it."

Flouting the guidance

Nothing epitomizes the tech industry's apparent indifference to the government's advice better than the high-profile violators of two of CISA's most critical recommendations.

To stop attackers from hijacking administrator accounts and abusing their vast privileges, CISA recommends that companies require administrators to use a feature called multi-factor authentication (MFA), which supplements the traditional password with an extra layer of security. But tech giants Amazon Web Services, IBM, and Oracle still haven't done this, according to online documentation, and while Microsoft began auto-enabling MFA on new accounts in 2019, it doesn't require the feature for all administrator accounts created before then.

Another critical recommendation concerns network-activity logs. During the SolarWinds attack, many victims didn't realize the hackers had accessed their Microsoft 365 systems because they weren't paying Microsoft an extra fee for full access to their logs, so they couldn't detect the anomalous activity. CISA recommends that companies offer full log access for free. But Amazon Web Services, Microsoft, and Google still charge extra for some log data.

A Microsoft spokesperson said requiring MFA for more existing accounts could lock out people unprepared to enable the feature. (It's unclear how widespread this problem would be, but it's possible that some organizations, particularly smaller ones, would struggle to educate their users about the new technology.) The spokesperson also said that Microsoft worked with CISA to determine what log data is actually necessary for investigating intrusions and will provide that data for free, with detailed analysis tools still costing extra. Offering all log data for free would significantly increase storage costs for customers, the spokesperson said.

A Google spokesperson said the company offers "a rich set of logs" and some analysis features for free. The spokesperson said Google charges extra for logs stored for more than 30 days and advanced analysis features because "the cost of storing and managing these logs can be quite significant."

An Amazon spokesperson said the company "strongly encourage[s]" the use of MFA but declined to explain why it doesn't require administrators to use the feature when possible. The spokesperson also did not explain why Amazon charges extra for certain logging features.

IBM and Oracle did not respond to requests for comment. The trade group BSA, which represents many large software companies, declined to comment.

No enforcement, no incentives

Tech companies have plenty of reasons to brush off CISA's advice.

One of the biggest: CISA isn't a regulator, so companies don't have to fear consequences for ignoring its guidance. The agency says its non-regulatory status encourages companies to partner with it on various initiatives, but this can also limit the impact of its recommendations - especially when it's acting alone.

The Biden administration needs to "get serious" about secure-by-default by ordering agencies to reinforce CISA's guidance and encouraging independent regulators to do the same, Herr said. "CISA's trying to do the right thing," Herr said, but "they really haven't been backed up by the White House." With pushes from the administration, Herr said,the FTC could investigate companies for claiming to be secure while withholding basic features, and the SEC could require public companies to disclose the material impacts of their failure to arm customers with basic protections.

The White House's National Security Council and Office of the National Cyber Director did not comment for this story.

Another problem is that some of these currently optional security features may be very profitable. Microsoft's security business brought in $20 billion in 2022. Some online service providers charge their customers extra to use a third-party login platform for increased security, another upcharge that CISA discourages.

Exactly how much might the tech giants lose? In Microsoft's case, their lucrative security business wouldn't entirely disappear, but if the company made more features free, Herr said, it might lose "a very significant portion of that."

Meanwhile, vendors face few incentives to abandon these profitable upcharges, because customers aren't pressuring companies to change their practices. "We've created an incentive structure in the marketplace that doesn't support accountability, because it's more about the bottom line," said Megan Stifel, a former White House cyber official who is now the chief strategy officer at the Institute for Security and Technology. The CISA official agreed that the problem "is largely a matter of business incentives."

To address the market failure, CISA plans to enlist the support of large companies from powerful industries like finance and retail to increase pressure on tech vendors. The official didn't offer details about this pressure, but it could involve public letters or private meetings between vendors and coalitions of influential customers. The vendors may not have to worry about losing business, but they "still want happy customers," the official said. "If we can get greater coalescence around those requirements, that's going to drive some real change."

Playing nice with powerful partners

Biden is no stranger to criticizing powerful industries for what he sees as reckless price-gouging, but his administration is taking a different approach with tech companies. Biden's top cyber aides have pointedly avoided naming and shaming vendors that refuse to embrace security defaults.

The CISA official offered several explanations for the discrepancy. For one thing, that person said, "many of the changes that we are demanding are not as simple as lowering a price and actually do require real technical investment." But more broadly, CISA believes that the most effective way to foster more responsible corporate practices is to encourage those changes through friendly conversations.

CISA has been privately pushing companies to make specific commitments to either implementing the recommended changes or establishing timelines for doing so. "We have been having those conversations constantly since our guidance was published, and even beforehand," said the official.

Instead of publicly shaming vendors that are defying government recommendations, Easterly and others are praising companies that adopt them, believing that positive reinforcement will accomplish more.

One elephant in the room is that CISA desperately needs these same companies' help with numerous cybersecurity team-ups. "All of our work is grounded in trust-based voluntary partnerships," the official said. Google and Microsoft, for example, provide vital information about digital threats, and they frequently assist the FBI and CISA with federal investigations, creating what the Atlantic Council's Herr called "a difficult line to walk."

There is evidence that the companies are sensitive to policymakers' criticism. In March 2021, with the U.S. still reeling from the stealthy SolarWinds attacks, lawmakers slammed Microsoft for charging extra for log data. One month later, Microsoft announced that it was giving government customers a free year of log access.

"There may be occasions when naming individual companies is appropriate," the CISA official said, and the agency will "continuously evaluate" the effectiveness of its friendlier approach.

The long road ahead

As the Biden administration continues prodding tech giants to adopt its recommendations, it will have to contend with pressure from Capitol Hill, where key lawmakers are eager to see if the White House can make good on its promise to fundamentally transform the cybersecurity responsibilities of users and vendors.

"The administration's efforts are still new and it will take time for companies to meet these new standards," House Homeland Security Committee ranking member Bennie Thompson (D-Miss.) and cyber subcommittee ranking member Eric Swalwell (D-Calif.) said in a statement. They expressed hope that more time and collaboration would produce the necessary "public demand and private sector buy-in" for improvements.

One looming question is whether Congress will eventually tire of corporate delays and mandate compliance with CISA's guidance.

Legislating technological requirements is tricky, experts said, because of how quickly technology changes. But if major companies continue resisting changes, some kind of mandate might be inevitable.

"We're headed towards regulation," Montgomery said. The tech giants, he added, "are really pennywise and pound-foolish to not step in now and self-regulate."

Another question is whether CISA's plea for patience in its persuasion campaign will generate friction among the outside experts who advise the agency and promote its work.

The CISA official argued that intensive efforts to address this "decades-long challenge" really only began with the National Cybersecurity Strategy's release in March, a point that security experts and lawmakers acknowledged.

But some experts said there's no time to waste, especially with adversaries like Moscow, Beijing and ransomware gangs growing more capable and determined every day.

"You're not going to build unhackable systems," said Jeremy Grant, a former cyber official at the National Institute of Standards and Technology who is now the managing director of technology business strategy at the law firm Venable. "But there's a few really simple things we could be doing that significantly raises the level of resources an attacker has to expend in order to breach the system."

Major technology companies are resisting the Biden administration's push to make basic security features free and automatic in products like their popular cloud platforms, forgoing changes that could neutralize many cyberattacks.

WASHINGTON, DC - JULY 21: A view of the White House after the White House Press Office announced that U.S. President Joe Biden tested positive for COVID-19 on Thursday morning, July 21, 2022 in Washington, DC. U.S. President Biden was previously scheduled to travel to Wilkes-Barre, Pennsylvania to discuss the recently passed Bipartisan Safer Communities Act aimed at curbing gun violence. (Photo by Drew Angerer/Getty Images) Drew Angerer/Getty Images

Amazon, Google, Microsoft, IBM, and Oracle are among the tech giants defying elements of recently issued guidance from the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency that seeks to encourage the adoption of these so-called "secure-by-default" features.

The halting early start to CISA's campaign to shift the burden of cybersecurity upstream from users to vendors-which represents a major goal of President Joe Biden's National Cybersecurity Strategy -raises questions about the administration's ability to shape the behavior of these massive tech companies, which also happen to be some of the government's most vital cybersecurity partners.

CISA says it's making slow but steady progress convincing companies to adopt its recommendations. The agency has "had very positive conversations with a significant number of technology companies" that are planning to change policies currently at odds with government guidance, according to a CISA official, who requested anonymity to discuss internal deliberation.

"We do expect to see changes in the very near term," the official added, "particularly in some of those areas that require less engineering investment and less architectural change."

In a previously unreported advancement of its campaign, CISA is preparing to publish updated guidance this summer with "perspectives from industry" about what changes are feasible now and in the future, the official said. "You are seeing a full-court press across the administration on the need for technology companies to make necessary changes and investments," the CISA official said.

But the continued refusal of leading tech firms to make relatively basic product changes with colossal security benefits has alarmed cyber experts.

"We're exceptionally vulnerable," said Mark Montgomery, executive director of the congressionally chartered Cyberspace Solarium Commission and its nonprofit successor. "These companies should be held accountable. But they're not."

Glaring gaps

In recent years, cyberattacks have increasingly exploited users' lack of security knowledge and tech platforms' refusal to activate basic protections. Hackers infected hundreds of thousands of routers by guessing their default passwords, breached major corporations through insecure administrator accounts, and roamed through victims' computers undetected because their targets lacked information about what was happening on their networks.

In one of the most devastating attacks to exploit these vulnerabilities, Russian government operatives in 2020 breached nine federal agencies and more than 100 companies by infecting IT management software made by the Texas-based company SolarWinds.

The SolarWinds hack generated frantic investigations by the incoming Biden administration and prompted the president's top cyber advisers to begin highlighting how tech companies' product decisions enabled digital intrusions. Recently, officials began urging companies to make their products "secure by design" (by writing code in a careful, safe way, to minimize flaws like the one that enabled the SolarWinds attack) and "secure by default" (by enabling security features automatically and for free, rather than charging extra for them or hiding them in obscure menus).

"Consumer safety must be front and center in all phases of the technology product lifecycle, with security designed in from the beginning, and strong safety features - like seatbelts and airbags - enabled right out of the box, without added costs," CISA Director Jen Easterly said during a February speech at Carnegie Mellon University.

In April, CISA, other federal agencies, and key foreign counterparts published the secure-by-design and secure-by-default guidance with specific recommendations. "Security is not a luxury option but is closer to the standard every customer should expect without negotiating or paying more," the document said.

The secure-by-design push faces the most daunting technical obstacles: human coders will inevitably make mistakes, and no software development environment can be completely tamper-proof. And while the secure-by-default push is less technically challenging because it mostly requires policy and pricing changes, it may also be more politically fraught, because it involves the government asking tech companies to give up profitable upcharges and force users to jump through new hoops to access their accounts.

"It's not in any way surprising that companies haven't changed their behavior," said Trey Herr, director of the Atlantic Council's Cyber Statecraft Initiative. "Anything that would cost them any money unless there's a hard requirement for it isn't something they're likely to do unless they see a clear [business] case for it."

Flouting the guidance

Nothing epitomizes the tech industry's apparent indifference to the government's advice better than the high-profile violators of two of CISA's most critical recommendations.

To stop attackers from hijacking administrator accounts and abusing their vast privileges, CISA recommends that companies require administrators to use a feature called multi-factor authentication (MFA), which supplements the traditional password with an extra layer of security. But tech giants Amazon Web Services, IBM, and Oracle still haven't done this, according to online documentation, and while Microsoft began auto-enabling MFA on new accounts in 2019, it doesn't require the feature for all administrator accounts created before then.

Another critical recommendation concerns network-activity logs. During the SolarWinds attack, many victims didn't realize the hackers had accessed their Microsoft 365 systems because they weren't paying Microsoft an extra fee for full access to their logs, so they couldn't detect the anomalous activity. CISA recommends that companies offer full log access for free. But Amazon Web Services, Microsoft, and Google still charge extra for some log data.

A Microsoft spokesperson said requiring MFA for more existing accounts could lock out people unprepared to enable the feature. (It's unclear how widespread this problem would be, but it's possible that some organizations, particularly smaller ones, would struggle to educate their users about the new technology.) The spokesperson also said that Microsoft worked with CISA to determine what log data is actually necessary for investigating intrusions and will provide that data for free, with detailed analysis tools still costing extra. Offering all log data for free would significantly increase storage costs for customers, the spokesperson said.

A Google spokesperson said the company offers "a rich set of logs" and some analysis features for free. The spokesperson said Google charges extra for logs stored for more than 30 days and advanced analysis features because "the cost of storing and managing these logs can be quite significant."

An Amazon spokesperson said the company "strongly encourage[s]" the use of MFA but declined to explain why it doesn't require administrators to use the feature when possible. The spokesperson also did not explain why Amazon charges extra for certain logging features.

IBM and Oracle did not respond to requests for comment. The trade group BSA, which represents many large software companies, declined to comment.

No enforcement, no incentives

Tech companies have plenty of reasons to brush off CISA's advice.

One of the biggest: CISA isn't a regulator, so companies don't have to fear consequences for ignoring its guidance. The agency says its non-regulatory status encourages companies to partner with it on various initiatives, but this can also limit the impact of its recommendations - especially when it's acting alone.

The Biden administration needs to "get serious" about secure-by-default by ordering agencies to reinforce CISA's guidance and encouraging independent regulators to do the same, Herr said. "CISA's trying to do the right thing," Herr said, but "they really haven't been backed up by the White House." With pushes from the administration, Herr said,the FTC could investigate companies for claiming to be secure while withholding basic features, and the SEC could require public companies to disclose the material impacts of their failure to arm customers with basic protections.

The White House's National Security Council and Office of the National Cyber Director did not comment for this story.

Another problem is that some of these currently optional security features may be very profitable. Microsoft's security business brought in $20 billion in 2022. Some online service providers charge their customers extra to use a third-party login platform for increased security, another upcharge that CISA discourages.

Exactly how much might the tech giants lose? In Microsoft's case, their lucrative security business wouldn't entirely disappear, but if the company made more features free, Herr said, it might lose "a very significant portion of that."

Meanwhile, vendors face few incentives to abandon these profitable upcharges, because customers aren't pressuring companies to change their practices. "We've created an incentive structure in the marketplace that doesn't support accountability, because it's more about the bottom line," said Megan Stifel, a former White House cyber official who is now the chief strategy officer at the Institute for Security and Technology. The CISA official agreed that the problem "is largely a matter of business incentives."

To address the market failure, CISA plans to enlist the support of large companies from powerful industries like finance and retail to increase pressure on tech vendors. The official didn't offer details about this pressure, but it could involve public letters or private meetings between vendors and coalitions of influential customers. The vendors may not have to worry about losing business, but they "still want happy customers," the official said. "If we can get greater coalescence around those requirements, that's going to drive some real change."

Playing nice with powerful partners

Biden is no stranger to criticizing powerful industries for what he sees as reckless price-gouging, but his administration is taking a different approach with tech companies. Biden's top cyber aides have pointedly avoided naming and shaming vendors that refuse to embrace security defaults.

The CISA official offered several explanations for the discrepancy. For one thing, that person said, "many of the changes that we are demanding are not as simple as lowering a price and actually do require real technical investment." But more broadly, CISA believes that the most effective way to foster more responsible corporate practices is to encourage those changes through friendly conversations.

CISA has been privately pushing companies to make specific commitments to either implementing the recommended changes or establishing timelines for doing so. "We have been having those conversations constantly since our guidance was published, and even beforehand," said the official.

Instead of publicly shaming vendors that are defying government recommendations, Easterly and others are praising companies that adopt them, believing that positive reinforcement will accomplish more.

One elephant in the room is that CISA desperately needs these same companies' help with numerous cybersecurity team-ups. "All of our work is grounded in trust-based voluntary partnerships," the official said. Google and Microsoft, for example, provide vital information about digital threats, and they frequently assist the FBI and CISA with federal investigations, creating what the Atlantic Council's Herr called "a difficult line to walk."

There is evidence that the companies are sensitive to policymakers' criticism. In March 2021, with the U.S. still reeling from the stealthy SolarWinds attacks, lawmakers slammed Microsoft for charging extra for log data. One month later, Microsoft announced that it was giving government customers a free year of log access.

"There may be occasions when naming individual companies is appropriate," the CISA official said, and the agency will "continuously evaluate" the effectiveness of its friendlier approach.

The long road ahead

As the Biden administration continues prodding tech giants to adopt its recommendations, it will have to contend with pressure from Capitol Hill, where key lawmakers are eager to see if the White House can make good on its promise to fundamentally transform the cybersecurity responsibilities of users and vendors.

"The administration's efforts are still new and it will take time for companies to meet these new standards," House Homeland Security Committee ranking member Bennie Thompson (D-Miss.) and cyber subcommittee ranking member Eric Swalwell (D-Calif.) said in a statement. They expressed hope that more time and collaboration would produce the necessary "public demand and private sector buy-in" for improvements.

One looming question is whether Congress will eventually tire of corporate delays and mandate compliance with CISA's guidance.

Legislating technological requirements is tricky, experts said, because of how quickly technology changes. But if major companies continue resisting changes, some kind of mandate might be inevitable.

"We're headed towards regulation," Montgomery said. The tech giants, he added, "are really pennywise and pound-foolish to not step in now and self-regulate."

Another question is whether CISA's plea for patience in its persuasion campaign will generate friction among the outside experts who advise the agency and promote its work.

The CISA official argued that intensive efforts to address this "decades-long challenge" really only began with the National Cybersecurity Strategy's release in March, a point that security experts and lawmakers acknowledged.

But some experts said there's no time to waste, especially with adversaries like Moscow, Beijing and ransomware gangs growing more capable and determined every day.

"You're not going to build unhackable systems," said Jeremy Grant, a former cyber official at the National Institute of Standards and Technology who is now the managing director of technology business strategy at the law firm Venable. "But there's a few really simple things we could be doing that significantly raises the level of resources an attacker has to expend in order to breach the system."

WASHINGTON, DC - JULY 21: A view of the White House after the White House Press Office announced that U.S. President Joe Biden tested positive for COVID-19 on Thursday morning, July 21, 2022 in Washington, DC. U.S. President Biden was previously scheduled to travel to Wilkes-Barre, Pennsylvania to discuss the recently passed Bipartisan Safer Communities Act aimed at curbing gun violence. (Photo by Drew Angerer/Getty Images) Drew Angerer/Getty Images

# data[].attributes.attachment_link.title
Why Amazon, Google and Other Tech Giants Are Flouting Some New Government Cybersecurity Recommendations

# data[].attributes.attachment_link.description
google, amazon, tech, cybersecurity, government policy

# data[].attributes.headline
NATO's Christian-Marc Lifländer on how the alliance can take a 'proactive' cyber stance

# data[].attributes.subject
NATO's Christian-Marc Lifländer on how the alliance can take a 'proactive' cyber stance

# data[].attributes.body
Christian-Marc Lifländer, the head of NATO's cyber and hybrid policy section, is concerned whether the West is like the metaphorical frog in hot water amid an increasing number of cyberattacks. Rather than engaging in activities that would halt this increase, he says it seems “we are kind of deterred by ourselves.”

An Estonian who speaks five languages, with a bachelor’s degree in engineering from West Point and a master’s in security studies from Georgetown University, Lifländer began his career in cyber policy with his country’s Ministry of Defence — including for three years at its embassy in the United States — before moving to Brussels more than a decade ago.

Today he is praised as “one of the most experienced and expert individuals at NATO on cyber,” by Paul Chichester, the director for operations at the U.K.’s National Cyber Security Centre and the country’s senior cyber expert with NATO, who also credits Lifländer with making “a unique contribution to the defence of NATO as an enterprise and an alliance.”

Max Smeets, the director of the European Cyber Conflict Research Initiative (ECCRI) and a senior researcher at the center for security studies at ETH Zurich, praised Lifländer’s generosity for “supporting and mentoring the upcoming generation of cyber scholars and practitioners.”

# data[].attributes.attachment_link.readable_text
Christian-Marc Lifländer, the head of NATO's cyber and hybrid policy section, is concerned whether the West is like the metaphorical frog in hot water amid an increasing number of cyberattacks. Rather than engaging in activities that would halt this increase, he says it seems "we are kind of deterred by ourselves." An Estonian who speaks five languages, with a bachelor's degree in engineering from West Point and a master's in security studies from Georgetown University, Lifländer began his career in cyber policy with his country's Ministry of Defence - including for three years at its embassy in the United States - before moving to Brussels more than a decade ago. Today he is praised as "one of the most experienced and expert individuals at NATO on cyber," by Paul Chichester, the director for operations at the U.K.'s National Cyber Security Centre and the country's senior cyber expert with NATO, who also credits Lifländer with making "a unique contribution to the defence of NATO as an enterprise and an alliance." Max Smeets, the director of the European Cyber Conflict Research Initiative (ECCRI) and a senior researcher at the center for security studies at ETH Zurich, praised Lifländer's generosity for "supporting and mentoring the upcoming generation of cyber scholars and practitioners." Smeets said the Estonian's expertise and experience have allowed NATO "to learn from past successes and avoid reinventing the wheel" around the Russian invasion of Ukraine. Recorded Future News spoke to Lifländer over the phone last month about NATO's changing approach to cyber, what the allies disagree on, and what will happen if attacks targeting Western states continue to increase. The interview has been edited for length and clarity. The Record: Speaking at the International Conference on Cyber Conflict in Tallinn, David van Weel - NATO's assistant secretary general for emerging security challenges - said the alliance was going to endorse a new 'cyber concept' at the summit in Vilnius in July. Can you tell us what that will entail?
Christian-Marc Lifländer: At the Vilnius summit, there will be several cyber deliverables. I think what David [van Weel] mentioned is the need to improve national cyber resilience. So there's already an existing tool, the Cyber Defence Pledge, which allies have decided to revamp in this regard. And what we're looking at is no longer something that is just delegated to allies to implement, but is now a tool which for the first time includes national goals, almost minimum requirements, things that everybody needs to have.

Similarly we have attached a maturity model to the instrument, a way for everybody to measure their preparedness, so as to better understand gaps across the alliance, which then can be met by allies helping other allies to get up to that minimum level. So something that has really never been done before and I think that's important.

A second deliverable for us is going to be a virtual cyber incident support capability, otherwise known as the VCISC. So if you think about the first deliverable that I mentioned, the Cyber Defense Pledge, as left of the bang - by which I mean all of the things that need to happen before incidents take place - then VCISC really looks to the right of the bang. If and when the incident has taken place, how can we be useful in helping a stricken ally to recover and mitigate the malicious cyber activity that is happening?

That's a mechanism that really does not mean more NATO, I think it means a way for allies to help other allies, and to do so virtually, also by using industry, and to do so in a flexible and agile kind of a way.
TR: What does it mean to endorse a new cyber concept?
CML: The concept we are putting forward is really not the end of the road but I think the beginning of a longer transformation where we want to bring different players closer together, while respecting everybody's roles and responsibilities, the sovereignty that they have. But there seems to be something about cyber that doesn't really respect organizational boundaries. I mean, you need the technical, the operational, and the political layer to operate better together. So this is exactly what we're trying to achieve here. It means information sharing, it means intelligence sharing, but it also means a better way to react, a better way to shape cyberspace. The results are not expected until next year's summit in Washington. So that's why, to me and to us, it's really a way to start thinking a little bit better of how to be proactive in that space.

Secretary General Jens Stoltenberg at the NATO Cyber Defense Pledge conference in November 2022. IMAGE: NATO

The key thing to understand here is that to us, cyber is always 'on'. So when you're thinking about it, yes, we need to worry about it and build the fire brigades so that if the fire breaks out we're able to put it out, but in some ways it's also about the smoke detectors and focusing on that left of the bang. Remember, the Washington Treaty, Article Three, focuses on the responsibility of allies to defend themselves and there's a whole lot that can be done in order to enable and help allies to do exactly that.
TR: How did the attack on Albania in 2022 contribute to this new concept?
CML: I think the Albanian example is a useful one. It really starts way before the incident itself has occurred. There's this knowledge transfer, there's help when it comes to cyber capacity building, things that can take place in order to deny the benefits for the potential attackers. And then of course, if and when the incident happens, there's really two aspects. One is to help recover, and that needs to be quick, and I would put it to you that many of the things would have to be put in place already before the incident happens, privileges and immunities for example, but also a better understanding of what kind of help and how quickly and under what modalities can it be provided, so as to avoid us having to figure out how to help when the incident has happened.

But then there's also something that can be done using NATO as a political platform. I would put it to you that what the Albanian case demonstrates to us is that cyber can be used, and has been used, for political coercion. And the allies responded. So NATO can, and I think should, be used going forward as a political platform, also at the political level, in order to signal to those that have conducted malicious cyber activities what is okay and what is not okay. And this in support of norms for responsible state behavior.
TR: Another key detail David van Weel raised was the role of the private sector in cyber defense. What is your opinion on that?
CML: I think many of the activities that have taken place in Ukraine demonstrate that without industry it would be very difficult to be successful on the battlefield. By the way, it also tells you that the defender gets a vote, right? It is possible to defend yourself against an adversary as potent and capable as the Russian Federation. So to me Ukraine is a story of hope. That things can be done, if you know what you're doing. And part of that is going to be figuring out how to collaborate and cooperate with industry.

But I think you also need to understand that what we have in Ukraine is not necessarily a sustainable or a scalable business solution. It is not possible, in my opinion, to outsource everything completely to industry and hope that things somehow miraculously will be taken care of. So that's why what we need to focus on is not necessarily formal but certainly flexible arrangements, which allow for industry to make contributions that the public sector can benefit from, and vice versa.

A good example that I would like to use here is the Industry 100 scheme in the United Kingdom, whereby the government, the UK NCSC [National Cyber Security Centre], is able to benefit from those companies that are taking part in the program and vice versa, industry is able to benefit from government information and is able to implement that in their network defense. That's a very flexible arrangement that allows for self-selection, but also improvement over time so that both sides can benefit from that relationship.
TR: Where are NATO allies in disagreement at the moment?
CML: I think what we all agree is that we need to commit to a long term resilience, in other words, we need to deny our adversaries the benefits. So that's why there's such a huge focus on the Cyber Defence Pledge for example. That's why there's such a huge focus on the smoke detectors, to go back to a previous analogy. What we also agree on is that we need to be able to react to and respond to incidents that seem to be occurring more often, much quicker.

NATO headquarters in Belgium switched off its lights in December 2022 in solidarity with Ukraine. Image: NATO

I think the question going forward is really focusing on the question of 'proactive'. What does that mean? In other words, if patching is not going to help us, if just a reactive posture is not going to be really helpful, how can we be more proactive? So that's question number one, what does it mean? And I think the second question then arises almost immediately, and that is how to make use of NATO as part of that proactive mindset. I think that's where a lot of work is still needed.
TR: You said incidents seem to be occurring more often. Why is that?
CML: I'm going to have to speculate here. So there are new technologies and new vulnerabilities that are being exploited, so there's just a whole lot more opportunities for malicious cyber activity. The second [reason] I think is linked to motivation. I think we can be more decisive in imposing costs for many of these malicious cyber activities. I would even say that many of the actors have become quite skilled at operating below the threshold of the use of force. Many have become quite skilled in designing their activities around deterrents. So we have to do more. [With] both of these things - [the] increased opportunities and second, lack of costs imposed on the situation - we're dealing with what I would call the new normal.
TR: What does being more decisive in imposing costs look like?
CML: The key performance indicator here is the change in adversaries' behavior, right? You do not necessarily get rid of malicious behavior, but you're able to have an effect on perhaps the quantity and the quality of it. In other words, you create perhaps more friction at the technical level by activities such as threat hunting, or defensive cyberspace operations. You make it much more difficult for the adversary to achieve an effect, knowing full well that any advantage that you might enjoy is going to be temporary. I guess, you might call it persistent engagement, so persistently engaging in the networks so as to deny all of these possible benefits, to keep the permanent contestation at the tolerable, manageable level. That, to me, is the answer moving forward. Unless we want to resort to just a reactive defensive posture. If so, I'm afraid that it will be difficult to have an impact on what is happening.
TR: Is there a way of being more decisive that isn't more of the same, or isn't in some way escalatory?
CML: What you're trying to do is to have an effect on that particular actor that is conducting malicious cyber activities. But what I sometimes feel is that doing so is viewed almost as escalatory. And then quite often, the actions fall far below those that folks would be entitled to use legally. So sometimes the feeling that I have is that we are kind of deterred by ourselves.
TR: Given that you said attacks are occurring more often, has this response so far failed?
CML: I would say that we can do better in terms of making it more difficult for malicious cyber actors to not only conduct these operations, but to have to have a consequence at the level that you quite often see in public. I think some people refer to what is happening as almost like boiling the frog. And then we become used to this next level of contestation and this becomes the new normal until it's taken to the next level again. That to me is concerning. We should resist it. We shouldn't really become accustomed to that new level of contestation.

If you accept that there's this new level of contestation, if you accept that there's this new normal, then it either can be because we have become accustomed to it and we're willing to accept the risks. In that case, it's not necessarily a failure, but it certainly will have an impact on our quality of life and over time to our competitiveness in a broader sense. Going forward, at what point are we willing to say that we're no longer okay with that new normal? When do we impose or create friction of our own so as to signal that we're resisting that new normal? I think that's the big question going forward.
TR: Perhaps this is my misunderstanding, but NATO has stated that the cyber domain is a permanently contested space. Isn't that already a recognition of the new normal?
CML: NATO's Strategic Concept makes clear that cyberspace is contested at all times. I think the big question is what level of contestation is okay. It tends to be quite abstract. It's certainly difficult to make the case I think, for cyber, when you compare it to kinetic action, which tends to be much more concrete, much more real, and much more violent in this regard... I think a lot of it focuses on risk. How do we manage risk? Quite often, cyber tends to be a non-rewarded risk. So security tends to be viewed as a cost, not necessarily as a reward.

There's almost a race to the bottom, whereby investments are not necessarily made, capabilities are not necessarily developed, until something happens. So it's almost as though you're going along with this contestation, hoping that you're not really affected until you are. We have to accept that we have a role to play and figure out what is the acceptable level of violence, if I may say so, that we can live with.
TR: Is there also a fear of a 'death by a thousand cuts' scenario, where the volume of activity even below a particular threshold becomes the issue?
CML: I completely agree with the thousand cuts thing. We have come to realize that it's not necessarily the single incident that we should be focusing on, but the cumulative effect over time. So if cyber is always on, if it's used continuously in order to target the sources of national power, then at the end of the day, it could very easily be a simple, perhaps even sort of relatively innocent incident, that breaks the camel's back. But that's a very different way of looking at it. You're no longer focusing on the left or right of bang, you're making it a continuous activity, a continuous contestation.

Get more insights with the

# data[].attributes.attachment_link.title
NATO's Christian-Marc Lifländer on how the alliance can take a 'proactive' cyber stance

# data[].attributes.attachment_link.description
An interview with Christian-Marc Lifländer, the head of NATO's cyber and hybrid policy section, about NATO's changing approach to cyber, and what will happen if attacks targeting Western states continue to increase.

# data[].attributes.headline
NATO: Military cyber defenders need to be present on networks during peacetime

# data[].attributes.subject
NATO: Military cyber defenders need to be present on networks during peacetime

# data[].attributes.body
NATO member states will next month endorse a greater role for military cyber defenders during peacetime, alongside the permanent integration of private sector capabilities within the alliance's efforts to battle malicious state-sponsored hacking, a senior official said.

David van Weel, NATO’s assistant secretary general for emerging security challenges, told the 15th annual International Conference on Cyber Conflict (CyCon) in Tallinn last week that NATO members will begin recognizing cyberspace as “a permanently contested environment.”

The endorsement, expected at the 2023 Vilnius summit in Lithuania in July, follows last year's adoption in Madrid of a new strategic concept — effectively a new blueprint outlining the challenges the alliance faces and how it intends to respond to them following the Russian invasion of Ukraine and the broader implications it posed for security in Europe.

# data[].attributes.attachment_link.readable_text
TALLINN, ESTONIA - NATO member states will next month endorse a greater role for military cyber defenders during peacetime, alongside the permanent integration of private sector capabilities within the alliance's efforts to battle malicious state-sponsored hacking, a senior official said.

David van Weel, NATO's assistant secretary general for emerging security challenges, told the 15th annual International Conference on Cyber Conflict (CyCon) in Tallinn last week that NATO members will begin recognizing cyberspace as "a permanently contested environment."

The endorsement, expected at the 2023 Vilnius summit in Lithuania in July, follows last year's adoption in Madrid of a new strategic concept - effectively a new blueprint outlining the challenges the alliance faces and how it intends to respond to them following the Russian invasion of Ukraine and the broader implications it posed for security in Europe.

"Russia's war of aggression in Ukraine has confirmed many theories of what role cyber plays in conflict," said van Weel. "Russia has made ample use of cyber capabilities before invading Ukraine, during hostilities, and it will likely continue using them after the kinetic phase of this conflict."

So far the war has shown that cyberattacks are not an alternative to kinetic actions, but a powerful "part of multi-domain operations that deliver cumulative effects," he said.

Speaking ahead of the expected Ukrainian counteroffensive following the supply of Western military support, he warned: "As the war continues, Russia and its proxies will develop a higher risk appetite as their fortunes on the battlefield change."

While addressing the threat resulting from Russia's military failures in Ukraine, NATO members must be mindful of China's attempts to create a new global approach to state behavior in cyberspace "which favors restrictions over fundamental freedoms," he said.

To address this, NATO allies will adjust their cyber defense posture, becoming more proactive and assertive in response to state-sponsored attacks, said van Weel: "We need to move beyond naming and shaming bad actors in response to isolated cyber incidents, and be clear what norms are being broken."

"We need to strengthen the role of our military cyber defenders during peacetime. And this is important because in most national contexts, the military only gets involved during crisis and conflict," he added.

But, cautioned van Weel, "cyberspace is never fully at peace, there is a constant friction, and we have to prevent scenarios where we expect our militaries to perform some kind of magic handover to take over without having been in the room for the lead-up [to the crisis]."

The key was enabling "civil-military cooperation throughout peacetime, crisis and conflict, and in between all those stages," he added, although the exact nature of this integration is not yet clear.

When he spoke to The Record at the Munich Security Conference earlier this year, the assistant secretary general praised the "unique" work that companies like Microsoft and Google had been doing in Ukraine, and said the alliance needed to consider a more structural cooperation with the private sector.

The concept to be endorsed in Vilnius will also involve integrating "industry expertise and capabilities on a permanent basis to better protect our networks, operate in cyberspace, and shape it in line with our values."

Beside the concept, NATO will also announce a new mechanism to "facilitate assistance between allies if national response capabilities are overstretched during a crisis," which comes in the wake of the Albanian government considering triggering NATO's Article 5 collective defense obligation following a cyberattack by the Iranian state.

"Allies will also raise the bar for national cyber resilience. They will agree to new and more ambitious national cyber defense goals and minimum requirements as part of what we call a revamped cyber defense pledge," said van Weel.

Get more insights with the

# data[].attributes.attachment_link.title
NATO: Military cyber defenders need to be present on networks during peacetime

# data[].attributes.attachment_link.description
David van Weel, NATO's assistant secretary general for emerging security challenges, says the military alliance's members will begin recognizing cyberspace as "a permanently contested environment."

# data[].attributes.headline
NATO and European Union release final assessment report on resilience of critical infrastructure

# data[].attributes.subject
NATO and European Union release final assessment report on resilience of critical infrastructure

# data[].attributes.body
NATO and the European Union released a Final Assessment Report produced by the NATO-EU Task Force on the Resilience of Critical Infrastructure on Thursday (29 June 2023). Launched at the beginning of the year, the Task Force focused on mapping out current security challenges, and the particular importance of resilience in energy, transport, digital infrastructure, and space.

# data[].attributes.attachment_link.readable_text
NATO and the European Union released a Final Assessment Report produced by the NATO-EU Task Force on the Resilience of Critical Infrastructure on Thursday (29 June 2023). Launched at the beginning of the year, the Task Force focused on mapping out current security challenges, and the particular importance of resilience in energy, transport, digital infrastructure, and space.

The report also makes a number of key recommendations to deepen NATO-EU cooperation further, including through more information exchanges; work to identify alternate transport routes for civilian and military mobility; and closer ties in security research.

NATO Secretary General Jens Stoltenberg:
"I thank President von der Leyen for her leadership, and the European Commission and the European External Action Service for their support as part of the NATO-EU Task Force on the resilience of critical infrastructure. This is an excellent example of our cooperation in action. The Task Force's Report sets out the importance of resilience in energy, transport, digital infrastructure, and space, and makes a number of key recommendations to deepen NATO-EU cooperation even more."

European Commission President Ursula von der Leyen:
"Our critical infrastructure faces increasingly complex security threats. We need to step up our efforts to ensure its resilience. This is crucial to protect essential services for citizens and support our economies. I'm glad that with Secretary General Stoltenberg we launched an EU-NATO Task Force and today I'm proud that we are presenting the outcome of its work. The Task Force has identified key security challenges in the areas of energy, transport, digital infrastructure and space, and proposes targeted recommendations. We will follow-up and continue working together."

High Representative / Vice-President of the European Commission Josep Borrell:
" Disruption of critical infrastructure can have massive consequences for our economies, our societies, the security of our citizens, potentially causing disruptions for the military. We must ensure that strengthening resilience of critical infrastructure is an integral part of both civilian and military work. So it is only natural that it is a key part of EU-NATO cooperation. The report prepared by our Task Force provides a solid basis to work together, combining our respective strengths and tools for the benefit of Europe's and our partners' security."

# data[].attributes.attachment_link.title
NATO and European Union release final assessment report on resilience of critical infrastructure

# data[].attributes.attachment_link.description
NATO and the European Union released a Final Assessment Report produced by the NATO-EU Task Force on the Resilience of Critical Infrastructure on Thursday (29 June 2023). Launched at the beginning of the year, the Task Force focused on mapping out current security challenges, and the particular importance of resilience in energy, transport, digital infrastructure, and space.

# data[].attributes.body
Cyber Resilience Act, NIS-2, CER-Richtlinie: Die Cybersecurity-Gesetzeslage für Industrieunternehmen in Europa ist unübersichtlich. Doch durch die Umsetzung der regulatorischen Anforderungen kann dabei geholfen werden, Cyberangriffe erfolgreich abzuwehren.

Laut IDC Studie „Cybersecurity in DACH 2022“ waren im vergangenen Jahr 72 Prozent der Unternehmen in der DACH-Region von Ransomwarebetroffen. Doch wen betreffen die Regulierungen? Welche Pflichten entstehen daraus? Und welche Fristen müssen Industrieunternehmen beachten? Hier ein Überblick der wichtigsten Cybersecurity-Gesetze in Europa.

# data[].attributes.attachment_link.readable_text
Ein Compliance-Leitfaden für Industrieunternehmen Wichtige Cyberregulierungen in Europa

Anbieter zum Thema

Cyber Resilience Act, NIS-2, CER-Richtlinie: Die Cybersecurity-Gesetzeslage für Industrieunternehmen in Europa ist unübersichtlich. Doch durch die Umsetzung der regulatorischen Anforderungen kann dabei geholfen werden, Cyberangriffe erfolgreich abzuwehren.

Laut IDC Studie „Cybersecurity in DACH 2022" waren im vergangenen Jahr 72 Prozent der Unternehmen in der DACH-Region von Ransomware betroffen. Doch wen betreffen die Regulierungen? Welche Pflichten entstehen daraus? Und welche Fristen müssen Industrieunternehmen beachten? Hier ein Überblick der wichtigsten Cybersecurity-Gesetze in Europa.

1. Directive on Security of Network and Information Systems (NIS-2 Richtlinie)

Die NIS-2 Richtlinie ist ein wichtiger Teil der EU-Digitalstrategie „Gestaltung der digitalen Zukunft Europas" und die Weiterentwicklung der bereits 2016 erlassenen NIS Richtlinie. Ziel ist es, ein hohes Cybersicherheitsniveau auf europäischer Ebene sicherzustellen und damit den Binnenmarkt zu stärken. Die Richtlinie ist am 16. Januar 2023 in Kraft getreten. Die EU-Mitgliedstaaten haben bis zum 17. Oktober 2024 Zeit, die Bestimmungen in nationale Gesetzgebung zu überführen.

Betroffene Wirtschaftszweige sind in zwei Kategorien unterteilt: essential/wesentlich - also Sektoren mit hoher Kritikalität - und important/wichtig - weitere kritische Sektoren. Unter erstere fallen beispielsweise Energie, Transport und Verkehr, Finanzmärkte, der Gesundheitssektor, digitale Infrastrukturen sowie die öffentliche Verwaltung. Weitere kritische Sektoren sind unter anderem Post- und Kurierdienstleistungen, produzierendes Gewerbe, Chemie sowie die Fertigung von Medizingeräten, elektronischen Geräten, Maschinen und Transportmitteln. Welche Unternehmen innerhalb der definierten Sektoren genau betroffen sind, wird durch die jeweilige nationale Gesetzgebung definiert.

Für Industrieunternehmen bringt NIS-2 neue Spielregeln und damit neue Aufgaben. So müssen sich Firmen registrieren und Cybersicherheitsvorfälle nach fest definierten Vorgaben an die zuständigen Behörden melden:

Frühwarnung: Meldung innerhalb von 24 Stunden nach einem Vorfall

Vorfallbenachrichtigung / Incident notification: Meldung innerhalb von 72 Stunden nach einem Vorfall

Zwischenbericht / Intermediate Report

Bericht über den Fortschritt der Vorfallbehandlung / Progress Report: im Falle von nicht gelösten Vorfällen ein Monat nach Vorfallbenachrichtigung

Finaler Bericht / Final Report: innerhalb eines Monats nach Vorfallbenachrichtigung oder eines Monats nach abgeschlossener Vorfallbehandlung

Freiwillige Berichterstattung möglich

Unternehmen müssen zudem ein aktives Risikomanagement einführen und sich an Standards beispielsweise für Netzwerk-/Systemsicherheit, Vorfallbehandlung, Krisenmanagement sowie zu sicheren Lieferketten und dem Asset Management halten. Schutzmechanismen und eingesetzte Technologien müssen dem Stand der Technik entsprechen. Eine Zertifizierungspflicht zur Darstellung der Compliance kann durch die Nationalstaaten gefordert und eingeführt werden.

Für den deutschen Markt bedeutet NIS-2, dass es eine Anpassung des bisher bestehenden IT-Sicherheitsgesetzes 2.0 bzw. ein neues Gesetz als Nachfolger zum derzeitigen IT-Sicherheitsgesetz 2.0 geben wird. KRITIS-Betreiber in Deutschland haben durch das IT-Sicherheitsgesetz bereits ein solides Fundament aufgebaut. So sind zum Beispiel Unternehmen, die ein Information Security Management System (ISMS) und die nötige vertrauenswürdige Cybersicherheitstechnologie implementiert haben, gut aufgestellt und müssen nur mit geringen Anpassungen rechnen.

2. EU Cyber Resilience Act - Cybersicherheit für vernetzte Produkte

Der Cyber Resilience Act (CRA) der EU ist ein Gesetzentwurf mit dem Ziel, Endverbraucher und Unternehmen vor Produkten mit unzureichenden IT-Sicherheitsfunktionen zu schützen. Zu diesem Zweck soll das Gesetz Anforderungen an Produkte mit digitalen Elementen hinsichtlich Entwicklung, Ausgestaltung und Produktion definieren und damit Cybersicherheit im gesamten Lebenszyklus sichern - unter anderem auch die Verfügbarkeit von Softwareupdates. Das Sicherheitsniveau von vernetzten Endprodukten soll dadurch erhöht werden, um Cyberkriminalität vorzubeugen. Das Gesetz wird voraussichtlich 2023 in Kraft treten. Danach haben die Betroffenen zwölf bis 24 Monate Zeit für die Umsetzung der neuen Anforderungen.

Von den Vorschriften betroffen sind Hersteller von Hard- oder / und Software sowie von Produkten, die solche Komponenten enthalten und in der EU vertrieben werden. Die Anforderungen werden je nach möglicher Auswirkung unterschieden. Für Produkte, die größere wirtschaftliche Bereiche betreffen, wie IoT- und Mobilfunkgeräte oder Betriebssysteme, werden strengere Vorschriften erwartet. So soll die Cybersicherheit bereits im Produktionsprozess bzw. bei der Konfiguration berücksichtigt werden („Security by Design and Default") - beginnend mit der Planung eines Produktes bis in die Betriebsphase und einige Jahre nach dem Produktverkauf (bis zu fünf Jahre). Zusätzlich müssen Hersteller ausführlich Dokumentation führen. Das Bereitstellen von Softwarepatches und die aktive Kommunikation zu Sicherheitslücken und deren Fehlerbehebung ist ein weiterer wesentlicher Baustein der Regulierung. Des Weiteren müssen für betroffene Produkte klare und verständliche Bedienungs- bzw. Betriebsanleitungen zur Verfügung gestellt werden.

3. Directive on the resilience of critical entities

Die EU-Richtlinie über die Resilienz kritischer Einrichtungen (CER-Richtlinie) hat das Ziel, die physische Widerstandsfähigkeit kritischer Einrichtungen zu stärken. Die CER-Richtlinie ersetzt die alte Richtlinie 2008/114/EC und weitet den Anwendungsbereich aus. Durch diese neuen Vorschriften werden die EU-Mitgliedstaaten zur Identifikation von kritischen Einrichtungen und Stärkung von deren Widerstandsfähigkeit verpflichtet. Die CER-Richtlinie ist am 16. Januar 2023 in Kraft getreten. Die EU-Mitgliedstaaten haben bis zum 17. Oktober 2024 Zeit, die Bestimmungen in nationale Gesetzgebung zu überführen.

Betroffene Wirtschaftszweige sind gemäß der Richtlinie in die Kategorien wesentlich und wichtig unterteilt. Insgesamt elf Sektoren gehören zum Geltungsbereich, die sich teilweise mit der NIS-2 Richtlinie überschneiden: Energie, Verkehr, Bankwesen, Finanzmarktinfrastrukturen, Gesundheit, Trinkwasser, Abwasser, digitale Infrastruktur, öffentliche Verwaltung, Weltraum sowie Produktion, Verarbeitung und Vertrieb von Lebensmitteln.

Unternehmen müssen sowohl organisatorische als auch technische Sicherheitsmaßnahmen umsetzen. Dazu zählt ein funktionsfähiges Risikomanagement, um Betriebsunterbrechungen zu verhindern. Ein Business Continuity Management System (BCMS) kann hier eine geeignete Maßnahme darstellen. Zudem sollen Unternehmen in der Lage sein, adäquat auf Cybersicherheitsvorfälle zu reagieren und dementsprechend einen Plan zur Vorfallbehandlung (Incident Management) zu definieren. Cybersicherheitsvorfälle sollen an die zuständigen Aufsichtsbehörden gemeldet werden. Diese können eigene Inspektionen und Audits durchführen und die Implementierung von angemessenen Maßnahmen einfordern.

Step by step zur Cybersecurity - das können Unternehmen jetzt tun

In fünf Schritten können Industrieunternehmen sich auf die Regulierungen vorbereiten:

1. Betroffenheit prüfen (Produkthersteller, Betreiber, Integratoren)

3. Meldeprozesse vorbereiten bzw. vorhandene Umsetzungen hierzu anpassen

4. Sicherheitskonzepte, Informationssicherheitsmanagement (z.B. auf Basis ISO/IEC 27001 bzw. IEC 62443) inkl. Business Continuity Management etablieren

5. Risikomanagement im definierten Geltungsbereich umsetzen

Ob CRA, NIS-2 oder die CER-Richtlinie: Halten sich Unternehmen nicht an die Vorschriften, können die EU-Staaten Bußgelder verhängen. Diese betragen zum Beispiel beim CRA bis zu 15 Mio. Euro bzw. 2,5 Prozent des Jahresumsatzes. Umso wichtiger ist eine strukturierte und ganzheitliche Cybersecurity-Strategie. Neben technischen Maßnahmen wie der Absicherung der Netzwerke und Geräte zählt dazu auch ein Blick auf die Absicherung der Unternehmensprozesse und die Sensibilisierung für das Thema bei den Mitarbeitenden.

Über den Autor: Steffen Heyde arbeitet als Marktsegmentleiter für die Marktsegmente Critical & Digital Infrastructure in der Division Industrie bei Secunet. Zusätzlich vertritt Steffen Heyde das Unternehmen bei verschiedenen Verbänden, wie dem Bundesverband IT-Sicherheit (TeleTrusT) und dem Bitkom. Er ist seit über 25 Jahren in den Bereichen Cyber-, IT- bzw. OT-Sicherheit tätig. Als Berater war er vor allem in den Unternehmenszweigen Öffentliche Verwaltung, Finanz- und Versicherungswirtschaft, Versorgungswirtschaft (u.a. Energie, Wasser, Lebensmittel), Transport, Automotive und im produzierenden Gewerbe tätig.

(ID:49597901)

# data[].attributes.attachment_link.description
(Bild: Alexander Limbach - stock.adobe.com) Cyber Resilience Act, NIS-2, CER-Richtlinie: Die Cybersecurity-Gesetzeslage für Industrieunternehmen in Europa ist unübersichtlich. Doch durch die Umsetzung der regulatorischen Anforderungen kann dabei geholfen werden, Cyberangriffe erfolgreich abzuwehren.

# data[].attributes.headline
Cyber-Sicherheit in der EU mit dem Digital Operational Resilience Act

# data[].attributes.subject
Cyber-Sicherheit in der EU mit dem Digital Operational Resilience Act

# data[].attributes.body
Eine aktuelle Sicherheitslücke demonstriert die zunehmende Bedrohung von Cyber-Attacken für den Finanzsektor. Ein neuer Gesetzesentwurf soll nun die Widerstandsfähigkeit von europäischen (Finanz)Unternehmen stärken.

Von einer Sicherheitslücke in der Datenübertragungssoftware „MOVEit“ sind aktuell mehr als 40 Länder betroffen, allein in Deutschland mehr als 100 Unternehmen – Tendenz steigend. Das Bundesamt für Sicherheit in der Informationstechnik (BSI) hat die Datenabflüsse bestätigt und auch die US-amerikanische Cyber-Sicherheitsbehörde CISA und die britische Cyber-Sicherheitsbehörde warnen vor der Sicherheitslücke.

MOVEit wird unter anderem in der Finanzbranche genutzt. Dass Finanzunternehmen als Teil der kritischen Infrastruktur besonders von Cyber-Attacken bedroht sind, zeigt eine Untersuchung des Sicherheitsunternehmens Yeswehack: So waren 93 Prozent aller Finanzunternehmen in der DACH-Region im Jahr 2022 regelmäßig Opfer von Hacker-Angriffen.

# data[].attributes.attachment_link.readable_text
DORA stärkt die Widerstandsfähigkeit von Unternehmen Cyber-Sicherheit in der EU mit dem Digital Operational Resilience Act

Anbieter zum Thema

Eine aktuelle Sicherheitslücke demonstriert die zunehmende Bedrohung von Cyber-Attacken für den Finanzsektor. Ein neuer Gesetzesentwurf soll nun die Widerstandsfähigkeit von europäischen (Finanz)Unternehmen stärken.

Von einer Sicherheitslücke in der Datenübertragungssoftware „MOVEit" sind aktuell mehr als 40 Länder betroffen, allein in Deutschland mehr als 100 Unternehmen - Tendenz steigend. Das Bundesamt für Sicherheit in der Informationstechnik (BSI) hat die Datenabflüsse bestätigt und auch die US-amerikanische Cyber-Sicherheitsbehörde CISA und die britische Cyber-Sicherheitsbehörde warnen vor der Sicherheitslücke.

MOVEit wird unter anderem in der Finanzbranche genutzt. Dass Finanzunternehmen als Teil der kritischen Infrastruktur besonders von Cyber-Attacken bedroht sind, zeigt eine Untersuchung des Sicherheitsunternehmens Yeswehack: So waren 93 Prozent aller Finanzunternehmen in der DACH-Region im Jahr 2022 regelmäßig Opfer von Hacker-Angriffen.

Einheitliche Regeln mit DORA

Im europäischen Raum existiert jedoch kein einheitlicher Rechtsrahmen, um die Cyber-Sicherheit im Finanzsektor zu organisieren. Mit dem „ Digital Operational Resilience Act " (DORA) möchte die Europäische Union (EU) nun die Regelungen harmonisieren und europäische Finanzunternehmen und deren Dienstleister für Informations- und Kommunikationstechnologie (IKT) gegen Cyber-Attacken wappnen. Durch DORA soll sichergestellt werden, dass die Unternehmen über angemessene Sicherheitssysteme verfügen, damit der Betrieb im Fall eines Angriffs reibungslos weiterlaufen kann.

Mit der neuen EU-Verordnung werden die Regelungen zur Cyber-Sicherheit nicht nur unternehmensübergreifend harmonisiert, sondern auch grenzübergreifend. Mitgliedstaaten haben mit der Verabschiedung von DORA keinen Anlass mehr, im Alleingang nationale Vorschriften und Standards zu erlassen.

Vor allem international tätige Finanzunternehmen erhalten dadurch Rechtsklarheit zu Vorschriften für digitale Resilienz. Die Verordnung ist am 16. Januar dieses Jahres in Kraft getreten und wird am 17. Januar 2025 angewendet.

Änderungen auch für IKT-Drittdienstleister

Es ist zu erwarten, dass die Verordnung mehr als 22.000 Unternehmen betreffen wird. Dabei gilt DORA nicht nur für alle auf EU-Ebene regulierten Finanzunternehmen, wie Banken, Kreditinstitute, Ratingagenturen und Anbieter von Krypto-Dienstleistungen, sondern auch für Unternehmen die IKT-bezogene Dienstleistungen für diese Finanzunternehmen erbringen.

Zu diesen IKT-Drittdienstleistern zählen beispielsweise Cloud-Speicheranbieter. Ziel ist es, Cyber-Bedrohungen entlang der gesamten Wertschöpfungskette zu mindern. Denn die Cyber-Sicherheit großer Unternehmen kann auch durch Schwachstellen in den Netzwerken der Dienstleister bedroht sein, wenn Hacker dadurch Zugriff auf sensible Daten erhalten.

Um den Anforderungen von DORA bis zum Januar 2025 nachzukommen, müssen alle betroffenen Unternehmen Sicherheitsmaßnahmen in fünf Bereichen vornehmen:

im IKT-Risiko-Management,

in der Berichterstattung über IKT-bezogene Vorfälle,

im Management des IKT-Drittparteienrisikos,

in der digitalen operationellen Widerstandsfähigkeit

und dem Informationsaustausch.
Das IKT-Risiko-Management
DORA verpflichtet Unternehmen dazu, einen umfassenden Rahmen für das IKT-Risiko-Management zu schaffen und diesen zu dokumentieren. Dazu gehört die Entwicklung von geeigneten Plänen, um auf mögliche digitale Störungen vorbereitet zu sein, sowie die Nutzung von IKT-Systemen, die anormale Aktivitäten sofort erkennen.
Berichterstattung über IKT-bezogene Vorfälle
Zukünftig müssen alle IKT-bezogenen Vorfälle unverzüglich an die zuständigen EU-Behörden gemeldet werden. Dazu sollte ein Management-Prozess eingerichtet werden, der Vorfälle überwacht und protokolliert. Das inkludiert Pläne zur Klassifizierung, Bewältigung und Berichterstattung dieser Vorfälle.
Management des IKT-Drittparteienrisikos
Bei vertraglichen Vereinbarungen müssen Finanzunternehmen und IKT-Dienstleister Regelungen zum Abschluss, zur Erfüllung und Beendigung des Arbeitsverhältnisses nachkommen. Außerdem etabliert DORA einen Aufsichtsrahmen für kritische IKT-Dienstleister, die entscheidend zur Betriebsfähigkeit des Finanzsektors beitragen. Diese werden zukünftig durch die European Supervisory Authorities (ESA) überwacht. Eine Liste kritischer IKT-Anbieter wird jährlich veröffentlicht.
Digitale operationelle Widerstandsfähigkeit
Ab sofort sollten Unternehmen Programme implementieren, die regelmäßig die Abwehrbereitschaft und Schwachstellen des IT-Sicherheitssystems testen. Werden bei den Tests Lücken erkannt, müssen umgehend Strategien zur Klassifizierung und Behebung erarbeitet werden. Je nach Größe und Risikoprofil des Unternehmens bestehen verschiedene Anforderungen an diese Tests. So werden für kleinere Unternehmen Standardtests der IKT-Werkzeuge und -Systeme genutzt, für größere Häuser hingegen Tests auf der Grundlage von Threat-Led Penetration Testing (TLPT).
Informationsaustausch
Nicht nur die Unternehmen melden zukünftig IKT-bezogenen Vorfälle, sondern die EU-Aufsichtsbehörden teilen ihrerseits relevante anonymisierte Informationen über Cyber-Risiken. DORA ermöglicht Finanzunternehmen zudem, Vereinbarungen zum Austausch von Informationen über Cyber-Bedrohungen zu treffen. Durch den Informationsaustausch soll das Bewusstsein für IKT-Risiken gestärkt und Methoden zur Erkennung von Bedrohungen optimiert werden.

So werden Unternehmen DORA-konform

Um alle Anforderungen der Verordnung bis 2025 zu erfüllen, sollten Finanzunternehmen und IKT-Dienstleister zunächst umfangreiche Gap-Analysen durchführen. Dabei wird die eigene IT-Sicherheit auf Lücken geprüft. Fallen hier Schwachstellen auf, sollte ein sicheres Netzwerk auf Basis eines stabilen Schwachstellen-Managements und automatisierten Penetrationstests eingerichtet werden.

Schwachstellen-Management-Tools führen regelmäßige, professionelle Scans durch und schlagen Alarm, wenn etwas mit einer Konfiguration nicht stimmt oder Passwörter unsicher sind. Werden Sicherheitslücken bereits mit einem etablierten Schwachstellenmanagement-Prozess kontrolliert, sind im nächsten Schritt Penetrationstests (auch Pentesting genannt) sinnvoll.

Beim Pentesting wird die Vorgehensweise von Hackern imitiert und Exploits werden ausgeführt. Schwachstellen werden also tatsächlich ausgenutzt und es kann ermittelt werden, welcher Schaden daraus entstehen würde. Sicherheitslücken, die auf dem ersten Blick nicht bedrohlich aussehen, können sich nämlich als äußerst kritisch erweisen. Herkömmliche Schwachstellen-Scanner haben nicht die Fähigkeit, dies zu ermitteln.

SIEM-Werkzeuge

Eine weitere Maßnahme zur DORA-Konformität sind sogenannte SIEM-Tools. Das Security Information and Event Management (SIEM) ist eine automatisierte Sicherheitstechnik, welche Daten auf Anomalien prüft - und zwar in Echtzeit. SIEM-Tools sind fester Bestandteil von Security Operation Centers.

Ein SOC besteht aus einem unternehmensinternen oder externen Team von IT-Sicherheitsexperten, die das IT-Netzwerk eines Unternehmens überwachen - rund um die Uhr. So wird sichergestellt, dass Bedrohungen auf Anhieb erkannt werden und der größtmögliche Schaden aufgrund der schnellen Reaktion abgewendet werden kann.

Die Umsetzung von DORA bedeutet für die betroffenen Unternehmen Abstimmungs-, Schulungs- und Implementierungsaufwände. Daher sollten Finanzinstitute und IKT-Dienstleister so früh wie möglich angemessene Sicherheitsmaßnahmen implementieren. Und am Ende bietet sich mit DORA die Chance auf langfristige Cyber-Sicherheit: Denn ein Schaden durch Cyber-Attacken verursacht höhere Kosten als die Investition in Sicherheitsmaßnahmen.

*Der Autor
Sebastian Brabetz ist in der Geschäftsleitung bei der Mod IT GmbH für die Professional Security Solutions verantwortlich. Er ist als „Offensive Security Certified Professional" sowie als „Tenable Certified Security Engineer" zertifiziert und hat darüber hinaus zwei Bücher zum Thema „Penetration Testing" veröffentlicht.

Bildquelle: Mod IT Services GmbH

(ID:49599856)

# data[].attributes.attachment_link.title
Cyber-Sicherheit in der EU mit dem Digital Operational Resilience Act

# data[].attributes.attachment_link.description
(Bild: Eduardo - stock.adobe.com) Eine aktuelle Sicherheitslücke demonstriert die zunehmende Bedrohung von Cyber-Attacken für den Finanzsektor. Ein neuer Gesetzesentwurf soll nun die Widerstandsfähigkeit von europäischen (Finanz)Unternehmen stärken.

# data[].attributes.headline
Cybersecurity and privacy in AI : forecasting demand on electricity grids.

# data[].attributes.subject
Cybersecurity and privacy in AI : forecasting demand on electricity grids.

# data[].attributes.body
Given the great influence of artificial intelligence (AI) in people's daily lives due to the key role it plays in digital transformation through its automated decision-making capabilities, ENISA aims to raise awareness of cybersecurity and privacy threats related to various scenarios using artificial intelligence. To this end, ENISA, with the support of the Ad-Hoc Working Group on Artificial Intelligence Cybersecurity, has published two reports in the last two years: Cybersecurity Challenges of Artificial Intelligence and Securing Machine Learning Algorithms. ENISA continues its momentum with a new report on cybersecurity and privacy in forecasting demand on electricity grids. An in-depth study of the scenario has been conducted by identifying first the assets, the actors and their roles, relevant processes, the AI algorithms used, as well as the requirements in terms of cybersecurity and privacy needed for it.

# data[].attributes.headline
European sovereignty between autonomy and dependence: A guide for EU policy

# data[].attributes.subject
European sovereignty between autonomy and dependence: A guide for EU policy

# data[].attributes.body
Is the idea of ‘European sovereignty’ still relevant? It was originally developed as an EU response to the rise of populism within its territory and the disruption of transatlantic relations brought about by the Trump presidency. But today its relevance appears uncertain in the face of Russia’s invasion of Ukraine and the growing assertiveness of China. This brief argues that European sovereignty (and related concepts such as strategic autonomy) is still an important and necessary guide for EU policy, but only if it is dissociated from some of the excessive and overambitious definitions given to the concept when it was first developed. European sovereignty is bound to fail if it is defined as taking an equidistant position between the US and China or as aiming for the atavistic goal of autarky in all conceivable policy areas, from security and energy to economy and technology. Instead, the brief argues, European sovereignty must be understood as a moderate and pragmatic agenda of defending EU interests and priorities within the wider framework of the transatlantic relationship, protecting the EU’s internal liberal political and economic order, and defending international openness where the EU still has comparative advantages. Most of all, the necessary objective of protecting European sovereignty against external forces must not become a backdoor for the undue centralisation of political and economic power inside the EU, a process that would be bound to generate new populist reactions and constrain the EU’s room of manoeuvre internationally. The brief concludes by proposing an understanding of European sovereignty as a compound term, containing both the ideal of EU autonomy of action internationally and the protection of the Union’s internal heterogeneity, diversity and level playing field. Understood in this way as a ‘sovereignty of sovereignties’, European sovereignty can serve as an important guide for EU policy.

# data[].attributes.attachment_link.readable_text
Is the idea of 'European sovereignty' still relevant? It was originally developed as an EU response to the rise of populism within its territory and the disruption of transatlantic relations brought about by the Trump presidency. But today its relevance appears uncertain in the face of Russia's invasion of Ukraine and the growing assertiveness of China. This brief argues that European sovereignty (and related concepts such as strategic autonomy) is still an important and necessary guide for EU policy, but only if it is dissociated from some of the excessive and overambitious definitions given to the concept when it was first developed. European sovereignty is bound to fail if it is defined as taking an equidistant position between the US and China or as aiming for the atavistic goal of autarky in all conceivable policy areas, from security and energy to economy and technology. Instead, the brief argues, European sovereignty must be understood as a moderate and pragmatic agenda of defending EU interests and priorities within the wider framework of the transatlantic relationship, protecting the EU's internal liberal political and economic order, and defending international openness where the EU still has comparative advantages. Most of all, the necessary objective of protecting European sovereignty against external forces must not become a backdoor for the undue centralisation of political and economic power inside the EU, a process that would be bound to generate new populist reactions and constrain the EU's room of manoeuvre internationally. The brief concludes by proposing an understanding of European sovereignty as a compound term, containing both the ideal of EU autonomy of action internationally and the protection of the Union's internal heterogeneity, diversity and level playing field. Understood in this way as a 'sovereignty of sovereignties', European sovereignty can serve as an important guide for EU policy.
Download the publication See the publication in a flipbook

# data[].attributes.attachment_link.title
European sovereignty between autonomy and dependence: A guide for EU policy

# data[].attributes.attachment_link.description
Is the idea of 'European sovereignty' still relevant? It was originally developed as an EU response to the rise of populism within its territory and the disruption of transatlantic relations brought about by the Trump presidency. But today its relevance appears uncertain in the face of Russia's invasion of Ukraine and the growing assertiveness of [...]

# data[].attributes.headline
Cyberangriffe: "Die Mehrheit schwankt zwischen Ignoranz, Verleugnung oder Hilflosigkeit"

# data[].attributes.subject
Cyberangriffe: "Die Mehrheit schwankt zwischen Ignoranz, Verleugnung oder Hilflosigkeit"

# data[].attributes.body
Wenn Security-Fachleute betroffenen Firmen Datenlecks melden, erhalten sie ganz unterschiedliche Antworten. Dabei haben die Wenigsten die Bedrohung im Blick.

Der IT-Security-Anbieter Kaspersky hat im vergangenen Jahr zahlreiche Unternehmen auf der ganzen Welt darüber informiert, dass ihre Datenbanken oder kompromittierten Konten im Darknet zum Verkauf angeboten wurden. Ein Viertel dieser Firmen stammte aus Europa, 14 davon aus der DACH-Region. Besonders problematisch dabei sei jedoch, dass 28% der betroffenen Unternehmen nicht oder nur mit Gleichgültigkeit auf die Meldung reagierten.

Die Organisationen erhielten eine Benachrichtigung, wenn ein Cybersicherheitsvorfall im Zusammenhang mit kompromittierten Unternehmensdaten im Darknet entdeckt wurde. Zur Analyse wurden dazu zahlreiche Darknet-Foren und -Blogs sowie verborgene Telegram-Kanäle überwacht. Insgesamt entdeckte Kaspersky 258 kritische Vorfälle, die eine umgehende Reaktion seitens der Opfer erfordert hätten.

Das Problem dabei: Bei 42% aller betroffenen Unternehmen fehlte dazu eine zentrale Anlaufstelle für Cybervorfälle. Nur 22% der Firmen reagierten angemessen, akzeptierten die Informationslage und gingen auf die konkrete Bedrohungslage ein. Lediglich 6% waren bereits über den Vorfall informiert, weil sie über eine proaktive Überwachung und Erkennung von Cyberbedrohungen verfügten.

# data[].attributes.attachment_link.title
Cyberangriffe: "Die Mehrheit schwankt zwischen Ignoranz, Verleugnung oder Hilflosigkeit"

# data[].attributes.attachment_link.description
Wenn Security-Fachleute betroffenen Firmen Datenlecks melden, erhalten sie ganz unterschiedliche Antworten. Dabei haben die Wenigsten die Bedrohung im Blick.

# data[].attributes.headline
What policymakers need to know about artificial intelligence

# data[].attributes.subject
What policymakers need to know about artificial intelligence

# data[].attributes.body
Despite an abundance of books, articles, and news reports about artificial intelligence (AI) as an existential threat to life and livelihoods, the technology is not a grave menace to humanity in the near term. Undeniably, the commentsof deep learning pioneer Geoffrey Hinton, who resigned from Google, are concerning. “I have suddenly switched my views on whether these things are going to be more intelligent than us. I think they’re very close to it now and they will be much more intelligent than us in the future. How do we survive that?” Hinton said in a recent interview. Hinton fears that AI may come to intentionally or inadvertently exert control over humanity, a hypothetical scenario known as an “AI takeover.” He is also worried about the potential spread of AI-generated misinformation or the possibility that an oppressive leader may attempt to use AI to create lethal autonomous weapons systems (LAWS). But AI programs have no agency to act on their own. Generative AI language models currently operate only within the controlled environments of computer systems and networks, and their capabilities are constrained by training datasets and human uses.

# data[].attributes.attachment_link.readable_text
Table of contents

Despite an abundance of books, articles, and news reports about artificial intelligence (AI) as an existential threat to life and livelihoods, the technology is not a grave menace to humanity in the near term. Undeniably, the comments of deep learning pioneer Geoffrey Hinton, who resigned from Google, are concerning. "I have suddenly switched my views on whether these things are going to be more intelligent than us. I think they're very close to it now and they will be much more intelligent than us in the future. How do we survive that?" Hinton said in a recent interview. Hinton fears that AI may come to intentionally or inadvertently exert control over humanity, a hypothetical scenario known as an "AI takeover." He is also worried about the potential spread of AI-generated misinformation or the possibility that an oppressive leader may attempt to use AI to create lethal autonomous weapons systems (LAWS). But AI programs have no agency to act on their own. Generative AI language models currently operate only within the controlled environments of computer systems and networks, and their capabilities are constrained by training datasets and human uses.

The generative transformer architecture that is powering the current wave of artificial intelligence may reshape many areas of daily life. OpenAI CEO Sam Altman has been making a global tour to engage with legislators, policymakers, and industry leaders about his company's pathbreaking Generative Pre-trained Transformer (GPT) series of large language models (LLMs). While acknowledging that AI could inflict damage on the world economy, disrupt labor markets, and transform global affairs in unforeseen ways, he emphasizes that responsible use and regulatory transparency will allow the technology to make positive contributions to education, creativity and entrepreneurship, and workplace productivity.

At present, however, Altman's generative AI is most useful in improving natural language processing and machine translation. Generative transformers are flexible and scalable models that outperform recurrent neural networks-which made voice-activated assistants on smartphones possible-in certain tasks, such as capturing relationships between different words within long documents and answering questions about them. Examples include GPT, BERT, T5, and LaMDA. They do not on their own possess independent capabilities associated with artificial general intelligence or superintelligence, and it is unlikely that a truly versatile human-like cognitive AI will become a reality before 2050. Even an ultrasmart AI program may never bootstrap itself into consciousness. And there is almost zero chance that-as in the Roko's Basilisk thought experiment-a spiteful and malicious AI will emerge that rewards those humans who assist it and punishes any who dare attempt to stop it. As Sam Altman puts it " GPT4 is a tool not a creature."

What is certain is that AI tools and methods will be crucial for confronting a slew of slow-motion catastrophes unfolding across the world. COVID-19 has claimed almost seven million lives worldwide, and based on excess mortality likely many more. Strife, stress, and conflict endangers democracies on both sides of the Atlantic. Unschooling and remote work movements mingle with cultural and political divisions and societal disruptions. Climate change brings extremes in heat, drought, and wildfires along with melting ice caps and sea level rise.

Machine learning (ML) is able to tackle these issues head-on. Admittedly, it has a long way to go before it's a feasible tool for pandemic control, but AI is attaining good performance in the diagnosis, evaluation, and prognosis of infected individuals; predictions of pandemic spread; and COVID-19 drug discovery as well as vaccine development. Responsible applications of AI are strengthening communities and empowering democracies. Over the past few years, this technology played a particularly powerful role in knitting humanity together virtually amidst the spread of disease, snarled traffic, scarce fuel, and the high cost of living. AI-enabled technologies are also monitoring the world's climate, agriculture, and economies, as well as providing solutions to feed and clothe the world without further damaging the environment. They can facilitate many paths to sustainable planet-wide development. Green AI technologies representative of the convergence of social innovation and technological change include ecobots, biodiversity and ecosystem services, and renewable energy solutions.

Nonetheless, humanity is living in uncertain, complex, and ambiguous times. But as Sun Tzu explained in The Art of War, in the midst of chaos, there is also opportunity. It is not surprising that the current generation has invented AI and social media-fueled empathy scorecards intended to replace or supplement credit scores, prescription video games and other "calmtainments," and AI-assisted chatbot therapists (Woebot and Wysa). AI is being brought to bear against the labor squeeze and workers' demands for higher wages, supply chain disruptions and volatilities in manufacturing, and the omnipresent threats of wars of occupation.

Defining artificial intelligence

The ultimate goal of AI is to emulate human-like thinking or perform tasks that normally require human activity. John McCarthy, Marvin Minsky, Nathaniel Rochester, and Claude Shannon, in their original proposal to bring together mathematicians, cyberneticists, and information processing innovators for a formative 1956 summer research workshop on AI at Dartmouth College, contended that "every aspect of learning or any other feature of intelligence can be so precisely described that a machine can be made to simulate it." AI can be subdivided in several different ways, but the major branches are usually described as artificial narrow intelligence (ANI), artificial general intelligence (AGI), and artificial superintelligence (ASI).

ANI is the branch where the overwhelming majority of AI-inclined developers work. ANI thereby represents the state of the art in AI. It is a category that includes all useful applications of AI to specific problems such as calculating risks and reducing errors, handling repetitive or boring tasks, making informed recommendations or decisions quickly, or automating job duties that are difficult or dangerous. ANI developers are rarely concerned about whether their AI systems are capable of true cognition, awareness, metacognition, or affectivity. Instead, they are content to regard them as models for understanding intelligent behavior and building useful tools. Common areas of activity in ANI are speech recognition, natural language processing, chatbots, search engines, recommender systems, digital assistants, computer vision, image recognition, and machine translation. Every sort of machine intelligence encountered in daily life is limited to specific tasks and knowledge domains that are not readily translated into other tasks or domains irrespective of how sophisticated they are.

How artificial intelligence works

The typical AI developer writes code-sometimes employing the assistance of context-aware intelligent code-completion software like IntelliSense or Copilot. At the core of all AI systems written today are intelligent agents. The classical approach to AI is in the form of sense-think-act: agents perceive their environment using sensors, consider choices and make decisions, and react using effectors. They may be physical (robots) or virtual (software) and are often both. Agents now have all sorts of different abilities, goals, preferences, knowledge representations, and memories of past experiences. Humans themselves are considered very complex intelligent agents by AI developers, albeit biological ones. This is why it is sometimes said that the "holy grail" of AI is to understand man as a machine.

Agents are ubiquitous in everyday life. Siri, Cortana, and the Google Assistant are agents, as are tabletop smart home appliances like Amazon Echo, Google Home, Samsung Bixby, Xiaomi Xiao Ai, and Apple HomePod. Agents are also embedded in many autonomous and semiautonomous robotic devices like the Roomba vacuum cleaner, Tesla driver-assistance system, and General Atomics Gray Eagle Extended Range unmanned aerial military drone. Large, pretrained language models are the foundation of the latest-potentially disruptive and transformative-conversational agents like Google Bard, Jasper Chat, OpenAI's ChatGPT, and Microsoft's Bing chatbot.

Practitioners of symbolic AI, a dominant early approach to simulating humanlike cognition, compared the brain to a sophisticated computer program. From the mid-1950s and continuing into the 1980s, computer scientists created general and specific problem solver programs. Software developers also created general inference engines upon which specialized rule bases could be applied interchangeably. These so-called expert systems consisted of heuristics or rules of thumb developed from direct interviews with experts and professionals (e.g., physicians, lawyers, mechanics, and chemists). Heuristic programming assumed as a given that an expert is a specialist.

Expert knowledge, however, is rarely fixed. Indeed, it is regularly updated through new discoveries and experience. Heuristic systems struggle to keep up with all but the most predictable definitions and structured reasoning methods. AI researchers describe this as the "knowledge acquisition bottleneck." Training an AI program to serve as a clinical decision support system, for example, is only feasible if there is a reasonably efficient way to keep up with an exponentially growing reservoir of medical knowledge and know-how. Often, the domain expert and the programmer find it difficult to maintain their systems and keep them current.

Knowledge engineers argue among themselves about whether the right approach is to carefully simulate the reasoning abilities of experts in models of human information processes or rather to discover entirely new methods for weighing evidence that can only be accomplished using computers. Ironically, as expert system prototypes proliferated, they became more specialized, limited in scope, and fragmentary. The history of expert systems has proven that machines, like humans, perform better in specialized domains. Exceptional general-purpose thinking is rare among machines, and perhaps also among human beings.

Expert systems gave way to directly mining the data of extremely large numbers of cases. Data mining requires figuring out how to represent knowledge and extract useful patterns through automatic or semiautomatic analyses so that they might be used effectively. Data mining techniques include cluster analysis, anomaly detection, and association rule mining. This movement away from the primacy of experts has been likened to the demise of the Greek Oracle of Delphi.

By the 1990s, connectionist approaches featuring artificial neural networks (ANNs) eclipsed symbolic AI in popularity. The metaphor for the connectionist approach to AI is the brain as a collection of billions of neurons that both wire and fire together. The application of neural networks to AI also dates to the 1950s but had fallen out of favor until resuscitated by Hinton, the cognitive psychologist who recently left Google, and others who described a new procedure called " backpropagation " for training multilayered neural networks. The connectionist approach became even more exciting as advances in computing hardware and schemes for handling large volumes of structured, semi-structured, and unstructured data ("big data") made it possible to improve the efficacy of neural networks.

Machine learning

ML today is a subset of AI which relies on both the symbolic and neural network approaches. The synthesis of neuro-symbolic AI and development of hybrid architectures is relatively new. Computer scientists use ML and data analytics to train algorithms and neural networks with statistical methods to discern patterns, make classifications, predict outcomes, and uncover significant insights from available masses of information. In ML, models of learning are used to dexterously organize the capabilities of intelligent agents as they improve themselves using data extracted from online systems or the environment. ML is divided into roughly three categories-supervised, unsupervised, and reinforcement learning.

In supervised learning, labeled data are used to train algorithms. The computer is "taught" to recognize general rules using "training data" (labeled inputs and desired outputs). Supervised learning algorithms may engage in active learning to label new data points with desired outputs, classification to organize data into relevant categories, regression analysis to investigate relationships between independent features or variables and dependent variables or outcomes, or similarity learning, where the goal is to measure the resemblance or relatedness between things.

In unsupervised learning, the algorithm discovers structure, features, and insights from unlabeled data. Unsupervised learning is helpful where common properties of the dataset are unknown or poorly understood. Additionally, unsupervised learning is helpful in solving clustering and association-type problems. Clustering algorithms group data based on similarities and differences. Marketing companies often use clustering and demographic segmentation of customers to identify and group households that are similar to one another in wealth, buying behavior, or lifestyle. These clusters are given names like Married Sophisticates, Penny Pinchers, Skyboxes and Suburbs, Summit Estates, Shotguns and Pickup Trucks, Rolling Stones, Single City Struggles, Aging Upscale, and Timeless Elders. Association algorithms find interesting relationships between variables. Association rule learning can be useful in market-based analyses of customer purchases, allowing retailers to recognize relationships between items that customers frequently buy together and predict the likelihood of purchases of an item based on the occurrence of other items in an individual transaction.

Deep learning

Deep learning is a type of ML that depends primarily on ANNs and training data. The neural networks train by imitating the natural neural interconnectivity of the brain using layers of nodes and connections. These nodes are composed of various inputs and weights, a given threshold, and an output value. When the output value surpasses the predefined threshold, it "fires" like a biological neuron, activating the node and passing data along to the next layer of the network. AlexNet, one of the pioneering technologies in the field of computer vision, was designed by Hinton and his students. This deep learning tool used to analyze visual imagery is composed of eight layers-five convolutional layers, two hidden layers, and one output layer. AlexNet was trained on graphics processing units (GPUs). It outperformed all other challengers in the 2012 ImageNet Large Scale Visual Recognition Challenge. Deep neural networks and platforms are employed in many contexts today; they promote cybersecurity ( Deep Instinct), predict criminal recidivism ( COMPAS Core), make early diagnoses in oncology ( Behold.ai), teach next-gen driverless cars ( Tesla, Waymo, Nvidia), and boost the creativity of artists ( DALL-E, Stable Diffusion) and writers ( GPT-4, Charisma). Generative transformer models are a prime example of deep learning, and they are revolutionary in their ability to quickly find relationships and capture context across large datasets.

Computational creativity is one subfield of AI that has been dramatically reshaped by deep learning. Computational creativity applications attempt to generate original ideas and artifacts. These "generative AI" applications are transforming our understanding of machines as helpmates to humans and altering bedrock conceptions of novelty. Is the goal to replicate human storytelling or to create new media for storytelling? Can an AI agent create a real emotional connection with a person? Can a machine have an original thought or imagination? How would an AI program recognize that something is imaginary? In a world of computational creativity, some common tropes and normative modes of seeing, hearing, and knowing may have to be unlearned.

All sorts of possibilities are being explored with generative AI. The annual National Novel Generation Month ( NaNoGenMo) contest is the brainchild of computer programmer and internet artist Darius Kazemi. NaNoGenMo is the artificial spiritual twin of the National Novel Writing Month (NaNoWriMo), a nonprofit organization that encourages human authors to find their voices by banging out drafts of fifty-thousand-word novels in November. Programmers following Kazemi's rules instead write code that generates fifty thousand words of machine-made fiction. NaNoGenMo provides a standard corpus of public domain lists and texts for rapid prototyping, but participants use all sorts of public domain writings to train their AIs. In the NaNoGenMo submission The Seeker, the intelligent agent is at once algorithm, agent, protagonist, and narrator. The Seeker reads differently each time because the code randomly shuffles in a new selection from its corpus to parse, deconstruct, and reconstruct.

In 1958, Simon and Newell wrote that "within ten years a digital computer will write music that will be accepted by critics as possessing considerable aesthetic value." This prediction has now been fulfilled by the subfield of generative music and algorithmic composition. One of the most famous examples is David Cope's Experiments in Musical Intelligence ("Emmy"). Emmy is an algorithmic composer capable of analyzing existing musical compositions, rearranging and recombining them, and ultimately inventing new works that are indistinguishable from those of Johann Sebastian Bach, Frédéric Chopin, and Wolfgang Amadeus Mozart. Shimon at Georgia Tech University is a marimba-playing improvisational jazz-bot musician. DeepMusic.AI, OpenAI's MuseNet, and the Magenta Music Transformer are all online tools for creating music with deep learning and generative AI. Recently, two programmers have been trying to make music infringement lawsuits obsolete by securing copyright to every combination of eight quarter notes in the C major scale using tones generated with the Musical Instrument Digital Interface (MIDI) standard electronic music protocol. And, similar to NaNoGenMo, a song contest has sprung up that is exclusively for artificially generated music. The first AI "Eurovision Song Contest " winner, the Australian group Uncanny Valley, sampled kookaburra bird calls and koala grunting noises. Additionally, there are AI painters, Dungeons & Dragons dungeon masters, journalists, filmmakers, dancers, stunt performers, and theater players.

Global competition and controversies

A number of countries have established national strategies, initiatives, and funding mechanisms to promote AI innovation and adoption. Former US President Donald J. Trump established the American AI Initiative by signing an executive order in 2019. The order did not allocate any direct federal funding, but it highlighted the significance of employing AI in a responsible manner and taking action to respond to significant investments made by other nations. In 2020, the US Congress passed the National AI Initiative Act. The National AI Initiative (NAII) establishes a coordinated program that spans the federal government. It is aimed at expediting AI research and development (R&D) to strengthen the country's economic growth and national security. The act provides almost $6.5 billion in funding over five years for R&D, education, and standards related to AI. The National Science Foundation, the Department of Energy, the Department of Commerce, the National Aeronautics and Space Administration, and the Department of Defense will jointly oversee a nationwide network of interdisciplinary AI research institutes.

The Russian Federation also has a National AI Development Strategy designed to bolster investment in AI research, education, and industrial development. Somewhat surprisingly, the 2019 Russian AI strategic decree does not mention national defense, though it does emphasize the importance of AI for economic development and healthcare. The decree also does not mention budget, deadlines, or enforcement mechanisms. Due to the recent military conflicts in Libya, Syria, Nagorno-Karabakh, and Ukraine, it is anticipated that Russia will allocate significant resources toward developing AI systems for unmanned aerial drones, counter-drone technologies, and AI-powered surveillance systems.

Significant and unheralded projects are also underway in Africa. The African Union has unveiled an Artificial Intelligence Continental Strategy for Africa, which is intended to facilitate the participation of stakeholders, initiate capacity-building efforts, and fortify regulatory frameworks for AI technology and data management. Artificial Intelligence for Development in Africa (AI4D) is a four-year initiative launched in 2020 by Canada's International Development Research Centre and Sweden's International Development Cooperation Agency. The objective of AI4D is to team up with Africa's government and scientific communities to encourage AI research, innovation, and talent. The ultimate aim is to elevate the standard of living for people in Africa and beyond. African nations are particularly concerned with issues of machine bias and ethics and wary of patterns of manipulation and abuse in the form of automated imperialism, algorithmic colonialism, and digital extractivism.

Canada, Australia, Japan, South Korea, Germany, France, and the United Kingdom also have significant national strategies to address challenges posed by a future empowered by AI. Many of these nations are worried about the likelihood of global competition in AI leading to an arms race or authoritarianism fueled by information technologies. Entrepreneurs, politicians, and engineers warn of an impending " AI Cold War." An AI arms race to create near-autonomous weapons systems is in full swing, despite being a topic of controversy. The banning of these so-called killer robots may not even be practical. Governments around the world have developed a number of other controversial applications of AI, such as image recognition and mass surveillance, predictive policing, deepfakes and misinformation campaigns, and social credit scoring.

Dangers, myths, and misconceptions

Deep learning pioneer and serial entrepreneur Andrew Ng has said that worrying about AI is like worrying about overpopulation on Mars. Artificial agents will not need to be excused or incarcerated for crimes and misdemeanors that upon analysis and reflection can be traced to human error, indifference, or greed. Whole brain emulation, artificial consciousness, technological singularity, and AI apocalypse are all well over the horizon. The threats that remain are still significant. The chief near-term dangers of AI technology are pervasive and more subtle. They include risks such as over-optimization, weaponization, deception and distraction, complexification, moral and practical deskilling, amplification of competition and conflict, job losses due to automation, and harms to human uniqueness, privacy, and accountability.

Philip L. Frana is an associate professor in the Interdisciplinary Liberal Studies and Independent Scholars programs at James Madison University. His scholarly interests focus on the social and cultural aspects of robotics, automation, and information technology.

Related content

# data[].attributes.attachment_link.title
What policymakers need to know about artificial intelligence

# data[].attributes.attachment_link.description
Behind the hype and fear lies a crucial truth-AI is designed to augment human intelligence, not replace it. This primer explains how developers strive to create systems that mimic human capabilities by finding patterns, making predictions, and generating meaningful and actionable insights using data generated by our information-rich world.

# data[].attributes.headline
Critical Infrastructure and the Cloud: Policy for Emerging Risk

# data[].attributes.subject
Critical Infrastructure and the Cloud: Policy for Emerging Risk

# data[].attributes.body
Cloud computing is so ubiquitous to modern digital and internet infrastructure that it often, perversely, eludes our notice. Cloud’s benefits—cost savings, scalability, and outsourced management of infrastructure security and availability—have precipitated its rapid adoption. But, perhaps because the focus has been so strongly on these benefits , policy has lagged behind in reckoning with how essential cloud computing is to the functioning of the most critical systems and in the development of oversight structures commensurate with that new centrality.

The cloud, just like its on-premises predecessors, faces risks. In the Sunburst hack, the compromise of core cloud services—in this case, Microsoft Azure’s Identity and Access Management services—was one vector that exposed multiple US government agencies to snooping by malicious actors.¹ The cloud, too, is vulnerable to the perennial fallibility of software systems: in a 2019 Google cloud outage, a misconfiguration cascaded into an hours-long brownout for services like YouTube and Snapchat, as Google’s network became congested and the very network management tools needed to resolve the issue were themselves throttled.² The combination of the cloud’s increasing role as fundamental infrastructure for many other services and its status as a complex, technical, system-of-systems  imply a simple follow-on question: are the policy tools at hand suited to govern cloud’s increasing complexity and criticality?

This report zeros in on an area where the stakes for cloud risk management are high: critical infrastructure (CI) sectors. The US government designates sectors as CI because their incapacity or destruction would have a “debilitating effect on security, national economic security, national public health or safety, or any combination of those matters.”³ The potential for a cloud compromise or outage to incapacitate, even temporarily, such a sector is one which policymakers must take seriously.

# data[].attributes.attachment_link.readable_text
Table of Contents

Executive summary

Cloud computing is so ubiquitous to modern digital and internet infrastructure that it often, perversely, eludes our notice. Cloud's benefits-cost savings, scalability, and outsourced management of infrastructure security and availability-have precipitated its rapid adoption. But, perhaps because the focus has been so strongly on these benefits , policy has lagged behind in reckoning with how essential cloud computing is to the functioning of the most critical systems and in the development of oversight structures commensurate with that new centrality.

The cloud, just like its on-premises predecessors, faces risks. In the Sunburst hack, the compromise of core cloud services-in this case, Microsoft Azure's Identity and Access Management services-was one vector that exposed multiple US government agencies to snooping by malicious actors.Simon Handler. "Broken Trust: Lessons from Sunburst." Brian Barrett, "How a Google Cloud Catch-22 Broke the Internet," Atlantic Council (blog), March 29, 2021. WIRED, June 17, 2019, https://www.wired.com/story/google-cloud-outage-catch-22/. The combination of the cloud's increasing role as fundamental infrastructure for many other services and its status as a complex, technical, system-of-systems imply a simple follow-on question: are the policy tools at hand suited to govern cloud's increasing complexity and criticality? https://www.atlanticcouncil.org/in-depth-research-reports/report/broken-trust-lessons-from-sunburst/. The cloud, too, is vulnerable to the perennial fallibility of software systems: in a 2019 Google cloud outage, a misconfiguration cascaded into an hours-long brownout for services like YouTube and Snapchat, as Google's network became congested and the very network management tools needed to resolve the issue were themselves throttled.

The research draws on public information to examine cloud adoption in five specific CI sectors: healthcare, transportation and logistics, energy, defense, and financial services. In doing so, it pays particular attention to three factors that can make the cloud an operational benefit or necessity for the ongoing functionality of a sector.

1. Data storage and availability: How much data, and of what kind, has a given critical sector put into the cloud? Could the sector maintain operations without access to this data? Are there on-premises data backups and/or regulatory requirements mandating them?To the reader, "on-premises data backups" refers to off the cloud and stored locally.

2. Scale and scalability: Has a given sector come to rely on scale that only cloud computing can enable, or upon the cloud's ability to scale to larger workloads rapidly? Do the sector's core services now rely on such capacity?

3. Continuous availability requirements: Has a given sector permanently moved systems that require constant availability into the cloud without local back-ups? And, if there are back-ups, what delay do they require to resume function in the case of a cloud compromise or outage?

This report aims to raise awareness of the risks that a potential cloud compromise or outage poses to CI and, in so doing, to make the case that these risks necessitate the maturation of current policy tools, and creation of others, to address these risks. It does not seek to vilify cloud adoption by CI sectors or preach a return to on-premises data processing. Instead, it suggests that CI sector regulators must consider cloud security and resilience a key question within their remit.

The report goes on to describe two features that make the risk profile of cloud computing markedly different from that of previous computing paradigms and that must inform the design of cloud risk management policy at a national level: compounded dependence and delegated control and visibility . Compounded dependence describes how widespread cloud adoption causes a huge range of organizations to depend upon a few shared linchpin technology systems, including unglamorous subsystems within the cloud, where the failure of one node could precipitate a cascading collapse. Delegated control and visibility describe how organizations that adopt cloud services cede control of and lose visibility into the operations and failure modes of these technology systems, posing challenges for both businesses and policymakers seeking to measure and manage cloud risks.

The factors of compounded dependence and delegated control and visibility pose challenges to managing potential risks to the cloud with existing policy tools, which remain more focused on end products and services than their shared architecture and infrastructure. These risk factors will only become more pronounced as organizations accelerate their move to the cloud, and policy structures designed to manage them will be essential to smoothly navigating the ongoing transition towards cloud computing as the dominant computing paradigm.

The report concludes with policy recommendations to help policymakers gain more visibility into and eventually a better hold on cloud risks for CI sectors, building on the 2023 cloud security report from the US Department of the Treasury and the 2023 National Cybersecurity Strategy. These recommendations center on equipping Sector Risk Management Agencies (SRMAs)-the entities currently tasked with managing cybersecurity risk in CI sectors-with appropriate tools to understand cloud usage and risk within their sector, as well as mapping out the beginnings of a structure for cross-sector cloud risk management to facilitate greater transparency and oversight. These ideas are a start, rather than an end state, for cloud risk policy-visibility is a prerequisite for risk management, but other tools will be required in concert to fully confront the problem.

The conversation about cloud security is no longer just about the security of services, but about the durability of infrastructure underpinning fundamental economic and political activities. For policymakers, that recognition must now become as tangible as it is urgent.

Introduction

A risk to the security or availability of cloud computing is a risk to US economic and national security. Over 95 percent of Fortune 500 companies use cloud systems, To the reader, as of 2018, 95 percent of Fortune 500 companies were already using Microsoft Azure in some capacity. See: Arpan Shah, "Microsoft Azure: The Only Consistent, Comprehensive Hybrid Cloud," September 25, 2018, "For DOD, Software Modernization and Cloud Adoption Go Hand-in-Hand," https://azure.microsoft.com/en-us/blog/microsoft-azure-the-only-consistent-comprehensive-hybrid-cloud/. and many sectors considered critical infrastructure (CI)-healthcare, transportation and logistics, energy, defense, and financial services, for example-are increasingly using cloud computing to support their core functionality. The government too is adopting cloud computing, with more and more critical governmental functions built in the cloud, from systems development at the US Department of Defense (DOD) to national public health crisis response systems. Federal News Network, webinar announcement, September 26, 2022, https://federalnewsnetwork.com/cme-event/federal-insights/pushing-forward-on-dod-software-modernization/;"For DOD, Software Modernization and Cloud Adoption Go Hand-in-Hand," Federal News Network, webinar announcement, September 26, 2022, https://federalnewsnetwork.com/cme-event/federal-insights/pushing-forward-on-dod-software-modernization/.

The widespread and increasing use of the cloud, especially for high-value computing workloads, has also raised the stakes for cloud security. The cloud's centralization of data and computing capabilities has made it a target of, and battlefield for, creative, persistent threats engaging in economic espionage, offensive cyber operations, and even destructive attacks on civilian infrastructure, as well as a stage for arcane regulatory disputes and outmatched procurement processes. As a form of centralized infrastructure for computing, cloud deployments are exposed to both the security risks of their customers and the malintent of those customers' adversaries. Cloud service providers (CSPs) thus make architectural, operational, and security decisions with potentially vast, cascading effects across sectors. And still, they must build and operate this cloud infrastructure while straddling a highly contested global marketplace that crisscrosses political boundaries often fraught under the strain of immense technical complexity.

The aim of this paper is not, notably, to suggest that cloud adoption should be avoided or that cloud computing deployments innately bear more risk than their on-premises counterparts. Cloud computing offers real efficiency and cost benefits to organizations by obviating the need to maintain data centers and enabling flexible compute scaling in response to demand. Arguments can be made that on average cloud deployments are more secure than on-premises systems (though opinions are far from definitive Kevin Townsend, "More Than Half of Security Pros Say Risks Higher in Cloud Than On Premise," SecurityWeek, September 29, 2022, https://www.securityweek.com/more-half-security-pros-say-risks-higher-cloud-premise/; Dan Geer and Wade Baker, "Is the Cloud Less Secure than On-Prem?," Usenix (;login:), Fall 2019, https://www.usenix.org/system/files/login/articles/login_fall19_12_geer.pdf.). This paper instead seeks to illustrate that the risks posed by the widespread adoption of cloud computing are meaningfully different from the risks arising from the myriad of independent organization-specific computing systems. Moreover, it is a call to attention on the ways in which existing policy is not yet well-equipped to oversee and manage this novel risk landscape. In fact, it is precisely because cloud computing is so valuable that it is well worth attempting to grapple with these new risks rather than simply fleeing back to on-premises data systems.

From a policy perspective, one of the most challenging aspects of attempting to understand the cloud's role in CI is a lack of consistent visibility into the exact nature and depth of cloud adoption by individual organizations. There is great variety in how an organization might use cloud services-public, private, community, or hybrid clouds-as well as in the breadth of services and organization-specific usages of each service model, from software as a service (SaaS) to platform as a service (PaaS) and infrastructure as a service (IaaS). Different organizations have adopted the cloud at different rates and differ too in the degree to which they host operation-critical data and workloads in the cloud, versus merely using the cloud to host auxiliary data not necessary for their core operations.

Cloud Computing and Cloud Risks

The average internet user depends on cloud computing to edit documents on Google Drive, talk over a Zoom video call, or access their favorite retail or social media websites. Companies and organizations accelerated their adoption of enterprise cloud computing during the COVID-19 pandemic, as employees could use the Internet to interact with cloud-hosted organizational resources, regardless of their physical location. Cloud computing is an increasingly dominant component of the entire information technology (IT) ecosystem, even if its presence is functionally invisible to most end users.

The increasing reliance of many organizations on a few CSPs creates increasingly concentrated forms of systemic risk. When a CSP's distributed computing functions fail, the interruptions to service availability can cascade across the firm's services and clients. Most CSPs build their infrastructure from common, modular architectures.James Hamilton, "Architecture for Modular Data Centers," Cornell University, arXiv platform, December 21, 2006, https://doi.org/10.48550/arXiv.cs/0612110 "Seven Principles of Cloud-Native Architecture," Alibaba Cloud Community, January 5, 2022, Alex Hern, "Google Suffers Global Outage with Gmail, YouTube and Majority of Services Affected," The Guardian, December 14, 2020, "Google Cloud Infrastructure Components Incident #20013," Google Cloud, accessed April 27, 2023, ,https://www.alibabacloud.com/blog/seven-principles-of-cloud-native-architecture_598431. The basic hardware and software packages that make up the cloud often share significant similarities-or are wholly identical-meaning one flaw can be present in many diverse locations. For instance, on December 14, 2020, Google Cloud suffered a widespread outage that made Gmail, Google Drive, YouTube, and many other Google services inaccessible globally for about 45 minutes. https://www.theguardian.com/technology/2020/dec/14/google-suffers-worldwide-outage-with-gmail-youtube-and-other-services-down. The outage occurred because of an error in allocating storage resources for a User ID Service, which authenticates users before they can interact with Google services. https://status.cloud.google.com/incident/zall/20013. Because many different Google products rely on the same authentication service, this error brought down several major cloud applications worldwide. Even Google Nest smart home devices, like speakers and thermostats, also forcibly went offline, triggering a fail-safe mode where users could not access the device settings.Hern, "Google Suffers Global Outage. The number of systems and actors affected in this outage, stemming from a singular source, demonstrates the interconnectedness of cloud computing infrastructure.

Cloud incidents do not result only from internal software failures. Physical incidents such as a flood or storm can take out a cloud data center. For example, a severe storm near Washington DC cut power leading to an AWS data center in 2012, resulting in multi-hour downtimes of sites such as Instagram and Heroku.Rich Miller, "Amazon Data Center Loses Power During Storm," Data Center Knowledge (Informa), June 30, 2012, Nati Shalom, "Lessons From The Heroku Amazon Outage," Cloudify, June 18, 2012, Sebastian Moss, "Major DDoS Attack on Dyn Disrupts AWS, Twitter, Spotify and More," DCD Media Center, October 21, 2016, https://www.datacenterknowledge.com/archives/2012/06/30/amazon-data-center-loses-power-during-storm. The failure of Heroku, itself a hosting service provider, caused further cascading failures for the websites built on its platform. https://cloudify.co/blog/lessons-from-heroku-amazon-outage/. While many CSPs have protocols for rerouting traffic to other data centers in the event of an outage, called "failover," this event demonstrated that failing over safely and seamlessly is a significant challenge: the outage impacted Netflix even though it explicitly pays to spread traffic across multiple data centers to avoid just such a failure-because, per Netflix's Director of Architecture, AWS traffic routing "was broken across all zones" during the incident.Miller, "Amazon Data Center Loses Power During Storm. Additionally, because cloud services rely on the internet to connect customers to computing resources, attacks against underlying internet infrastructure can have ripple effects impacting the availability of cloud services. For example, a 2016 distributed denial of service (DDoS) attack against Dyn, a domain name service provider, caused outages at cloud services such as AWS. https://www.datacenterdynamics.com/en/news/major-ddos-attack-on-dyn-disrupts-aws-twitter-spotify-and-more/.

Cloud platforms can also suffer from unique cybersecurity risks. Because cloud services are generally multitenant environments-that is, a single instance of the software or infrastructure serves multiple, unrelated organizations at the same time-a malicious actor who can escape the bounds of tenant isolation can access the data and resources of other customers. Security researchers who identified multiple bugs that them to access other tenants' data called out a "problematic pattern" in which CSPs are often non-standardized and non-transparent about their tenant-isolation practices, making risk management more challenging for customers.Amitai Cohen, "Introducing PEACH, a Tenant Isolation Framework for Cloud Applications," WIZ (blog), December 14, 2022, https://www.wiz.io/blog/introducing-peach-a-tenant-isolation-framework-for-cloud-applications. And, because a single CSP typically serves many customers, cloud platforms are appealing targets for hackers seeking to compromise many different organizations, including through software supply chain attacks. These attacks involve implanting and/or exploiting vulnerabilities in a less secure software that the target software depends on. During the Solar Winds/Sunburst campaign, discovered in 2020, Russian groups managed to access Microsoft Azure's identity and access management (IAM) service, Azure AD. Critical applications, such as Office 365, Workday, AWS Single Sign-On, and Salesforce, are commonly integrated with Azure AD. As one of several techniques, the actors abused this access to move throughout different Office 365 user accounts to access highly confidential documents, emails, and calendars.Handler, "Broken Trust".

Cloud computing risks have different characteristics than those of on-premises computing. Increasing adoption of cloud services by CI operators, therefore, necessitates more active involvement from the policy community to adapt to this new risk landscape. Accordingly, this report brings attention to five CI sectors that are in the process of forming deep dependencies on the cloud and provides guidance for how policymakers can create visibility into the cloud ecosystem to begin adapting policy to address the compounded dependence and delegated control and visibility prevalent within cloud infrastructure.

Critical Sectors Using the Cloud

This section examines cloud computing's proliferation across five critical sectors: healthcare, transportation and logistics, energy, defense, and financial services. It highlights how cloud computing already supports the maintenance of everything from patient data to home energy supplies. The sensitivity of data and services stored in the cloud varies among these sectors, yet, within each, the cloud is already or soon will be critical to US economic, national security, and general societal interests.

Healthcare Sector

The healthcare sector has quickly recognized cloud computing's benefits.US Cybersecurity and Infrastructure Security Agency (CISA), "Healthcare and Public Health Sector," CISA, accessed April 27, 2023, Jessica Kim Cohen, "Report: Healthcare Industry Leads in Cloud Adoption," Health IT: Becker's Hospital Review, April 9, 2018, Research and Markets, "Global Healthcare Cloud Computing Market (2020 to 2025) - Emergence of the Telecloud Presents Opportunities," GlobeNewsWire, October 2, 2020, https://www.cisa.gov/healthcare-and-public-health-sector; Vinati Kamani, "5 Ways Cloud Computing Is Impacting Healthcare," Health IT Outcomes, October 2, 2019, https://www.beckershospitalreview.com/healthcare-information-technology/report-healthcare-industry-leads-in-cloud-adoption.html. In 2020, companies spent $28.1 billion on healthcare cloud computing, with the number projected to increase to $64.7 billion by 2025. https://www.globenewswire.com/news-release/2020/10/02/2102876/0/en/Global-Healthcare-Cloud-Computing-Market-2020-to-2025-Emergence-of-the-Telecloud-Presents-Opportunities.html. https://www.healthitoutcomes.com/doc/ways-cloud-computing-is-impacting-healthcare-0001. One industry survey, for instance, reported that 35 percent of healthcare organization respondents already store more than half their data and infrastructure in the cloud.

The healthcare sector generates enormous amounts of sensitive data, much of which it stores in the cloud. Electronic health records (EHRs), which contain data such as a patient's medical history, diagnoses, and medications, are increasingly common in healthcare for their efficiency and interoperability, as are medical sensors and monitors that generate large amounts of data. CSPs have created healthcare-specific tools for the cloud storage of EHR data, such as Microsoft Azure's "Fast Healthcare Interoperability Resources" (FHIR), a standard for transmitting EHRs and protected health information (PHI),Gregory J. Moore, "Reimagining Healthcare: Partnering for a Better Future," Microsoft, December 2, 2019, Henner Dierks and Angus McAllister, "Using Open Source FHIR APIs with FHIR Works on AWS," Amazon Web Services (blog), August 28, 2020, John DeGaspari, "Cloud-Based EHRs Popularity Grows among Small Practices," Fierce Healthcare," June 3, 2015, Heather Landi, "Oracle, Cerner Plan to Build National Medical Records Database as Larry Ellison Pitches Bold Vision for Healthcare," Fierce Healthcare, June 10, 2022, https://cloudblogs.microsoft.com/industry-blog/health/2019/12/02/reimagining-healthcare-partnering-for-a-better-future/. which has since integrated into AWS and Google Cloud. https://aws.amazon.com/blogs/opensource/using-open-source-fhir-apis-with-fhir-works-on-aws/; "Cloud Health API: FHIR," Google Cloud, accessed April 27, 2023, https://www.fiercehealthcare.com/ehr/cloud-based-ehrs-popularity-grows-among-small-practices. (often because they were cheaper than on-premises systems). Moreover, these findings show major existing EHR software providers have begun making deals to move client EHR systems to the cloud or even acquire them wholesale by CSPs, such as Oracle's recent acquisition of Cerner for $28.3 billion for its Millennium EHR platform to build a US national cloud database of EHRs. https://www.fiercehealthcare.com/health-tech/oracle-cerner-plan-build-national-medical-records-database-ellison-pitches-bold-vision; Heather Landi, "Google, Epic Ink Deal to Migrate EHRs to the Cloud," Fierce Healthcare, November 16, 2022, https://www.fiercehealthcare.com/health-tech/google-epic-ink-deal-migrate-hospital-ehrs-cloud-ramp-use-ai-analytics; "A Cloud-Infrastructure Platform: Reimagining Remote Hosting Services," Veradigm (formerly Allscripts), accessed April 27, 2023, https://www.allscripts.com/service/allscripts-cloud/; "The CareVue EHR," Medsphere, accessed April 27, 2023, https://www.medsphere.com/resources/carevue-ehr-overview/. https://cloud.google.com/healthcare-api/docs/concepts/fhir. A 2015 survey of small healthcare providers found that 82 percent of respondents in urban areas used a cloud-based EHR system

The cloud offers real benefits, especially for small providers: cost savings, ease of standing-up functionality without an in-house IT team, and (potentially) increased security over on-premises deployments. There is a reason why the various federal cloud strategies and policies, as well as the new National Cybersecurity Strategy, emphasize encouraging cloud adoption: Adoption must match more fulsome, fine-grained, and effective scrutiny of CSPs and their infrastructure. Healthcare's cloud transition will continue, so examining potential outage impacts and the degree of systemic vulnerability to a few points of failure are urgent priorities.

Transportation and Logistics Section

Several transportation and logistics firms are transferring their data to the cloud for easier management and future needs, though these are not generally "whole-of-business" shifts. The United Parcel Service (UPS) started its cloud transition in 2019 with Google Cloud, and it recently inked a deal to expand its cloud data storage.Isabelle Bousquette, "UPS Expands Deal with Google Cloud to Prepare for Surge in Data," Wall Street Journal, March 29, 2022, "UPS Extends Use of Google Cloud Data Analytics Technology," United Parcel Service, March, 25, 2022, "FedEx Uses Java on Azure to Modernize Route Planning for Pickup and Delivery Operations," Microsoft for Java Developers (YouTube video), 2022, https://www.wsj.com/articles/ups-expands-deal-with-google-cloud-to-prepare-for-surge-in-data-11648551600. UPS uses cloud services to "see and control how packages move through [its] network," https://about.ups.com/us/en/our-stories/innovation-driven/ups-and-google-cloud. which it cites as particularly critical functionality for high-volume periods such as the holidays and the COVID-19 pandemic, during which UPS needed to deliver more than a billion vaccine doses.United Parcel Service, "UPS Extends Use of Google Cloud. FedEx uses the cloud to plan its pickup and delivery routes worldwide. https://www.youtube.com/watch?v=fJ_OUNdFXHs. While these functions are important, without more information it is challenging to predict whether a significant cloud outage or compromise would be catastrophic or merely burdensome and inefficient for the ongoing operation of these entities.

In sum, the transportation and logistics sector appears to currently use the cloud more for planning systems than real-time operational decisions, where failure could have devastating effects. However, even short-lived delays in shipping and transportation can have costly economic effects. Moreover, industry projections and cloud-feature development suggest that the cloud will become more critical to the sector's safe functioning in the future.

Energy Sector

The energy sector, as Presidential Policy Directive 21 (PPD-21) puts it, is "uniquely critical because it provides an 'enabling function' across all CI sectors."President Barack Obama, "Presidential Policy Directive 21 - Critical Infrastructure Security and Resilience," The White House, February 12, 2013, Vince Dawkins, "How the Energy Industry Is Embracing Cloud Computing: Three Key Areas of Success," Cloud Tech, August 7, 2019, https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil. Increasingly, energy has moved away from manual systems to automated ones reliant on the cloud for managing and making use of data. https://cloudcomputing-news.net/news/2019/aug/07/how-energy-industry-embracing-cloud-computing-three-key-areas-success/. The energy sector looks to the cloud to update aging interfaces and increase data-transmission efficiency.Dawkins, "How the Energy Industry Is Embracing Cloud".

ENGIE, one of the largest power utilities in France, moved to cloud-based storage to improve business and power-delivery efficiency, forming a company-wide data storage system using cloud services to ingest and store energy consumption data and inputs from a range of small physical sectors."ENGIE Builds the Common Data Hub on AWS, Accelerates Zero-Carbon Transition," Amazon Web Services, 2021, "PGE Migrates to AWS, Significantly Improves Energy Loss Detection Performance," Amazon Web Services, 2021, Michael Matz, "The Grid is Moving to the Cloud," EPRI Journal, May 24, 2021, https://aws.amazon.com/solutions/case-studies/engie-aws-analytics-case-study/. While these functions factor into ENGIE's day-to-day activities, the data stored on the cloud does not appear critical for the actual power delivery. PGE and ENGIE depend on the cloud's elasticity to manage crises. During unprecedented wildfires and catastrophic wind events, PGE relied on the cloud's ability to scale, helping the company mitigate widespread power outages. https://aws.amazon.com/solutions/case-studies/portland-general-electric/. During a mass service disruption, PGE's communications channels remained online thanks to its cloud infrastructure. ENGIE's growing wind-turbine data collection relies on ever-increasing cloud storage, though, unlike the elasticity use-case for PGE, such data may not be necessary for core operations. The Electric Power Research Institute (EPRI) reported in 2020 that out of the twenty-two US utilities surveyed, half said that they expect to adopt "cloud-hosted transmission and distribution planning applications" within the next five years. https://eprijournal.com/the-grid-is-moving-to-the-cloud/.

The cloud plays a role not only in energy delivery but also in upstream processes like oil and gas extraction. Some of the largest US and European Union (EU) oil-and-gas firms use the cloud for data storage and processing. ExxonMobil, the largest US publicly traded oil-and-gas company, uses Microsoft Azure to collect and store sensor data from their Permian Basin extraction.Reuters Staff, "Exxon, Microsoft Strike Cloud Computing Agreement for U.S. Shale," Reuters, February 22, 2019, "Total powers Digital Transformation across Energy Production with Nutanix," Nutanix (case study), accessed April 27, 2023, Computer Business Review (CBR) Staff, "'You've Got to Have Courage!' BP on Going 'All-In' on the Cloud," TechMonitor, June 29, 2022, "Helping Marathon Oil Create a Next-Generation Cloud Native Data Platform," EPAM Systems (case study), accessed April 27, 2023, Mary Branscombe, "How Microsoft Is Extending Its Cloud to Chevron's Oil Fields," Data Center Knowledge, November 21, 2017, https://www.reuters.com/article/ctech-us-exxon-mobil-microsoft-cloud-idCAKCN1QB1N8-OCATC. Total Energies, a French multinational oil company and the world's fifth largest, works with Nutanix to host and secure large databases in cloud services provided by SAP HANA and Oracle and has said it will move all IT functionality to the cloud eventually. https://www.nutanix.com/company/customers/total. British Petroleum (BP) has gone "all in" on cloud data storage and availability by shutting down two of its largest on-premises data centers in London's Canary Wharf in favor of a package of Amazon services as well as a SAP product to host the oil company's AVEVA Unified Supply Chain decision-making software. https://techmonitor.ai/technology/cloud/bp-cloud-migration-interview; "BP Goes All-in on AWS for Its European Mega Data Centers," British Petroleum (news release), December 4, 2019, https://www.epam.com/services/client-work/helping-marathon-oil-create-a-next-gen-cloud-native-data-platform; "Marathon Oil Reduces Intelligent Alert Creation Time from Months to Hours Using AWS Partner Seeq," Amazon Web Services (case study), March 2023, http://www.datacenterknowledge.com/microsoft/how-microsoft-extending-its-cloud-chevron-s-oil-fields. These companies store immense qualities of data in the cloud, and by increasingly shuttering on-premises data centers, will have to spend even more to turn back. Depending on the specific functions for which each relies on the cloud, a cloud outage could have impacts ranging from simply delaying data reporting to shutting down operational facilities or stunning supply chains. https://aws.amazon.com/partners/success/marathon-oil-seeq/. while Chevron developed a cloud-based tool for oil-well data management. https://www.bp.com/en/global/corporate/news-and-insights/press-releases/bp-goes-all-in-on-aws-for-its-european-mega-data-centers.html. Marathon Oil centralized much of its data collection onto the cloud,

Defense Sector

For large defense contractors, cloud deployments have mainly augmented existing on-premises infrastructure-the cloud provides additional computing resources but generally operates alongside on-premises infrastructure rather than as a wholesale replacement. Boeing, in a momentous 2022 decision, decided to use cloud services from multiple CSPs, while in the interim maintaining a mostly on-premises infrastructure.Sebastian Moss, "Boeing Announces Cloud Partnerships with Microsoft, Google, and AWS," Data Center Dynamics, April 6, 2022, Jay Greene and Jon Ostrower, "Boeing Shifts to Microsoft's Azure Cloud Platform," Wall Street Journal, July 18, 2016, Jeff Morin and Dan Zotter, "Lockheed Martin's Journey to the Cloud," ASUG Annual Conference, May 7, 2019, https://www.datacenterdynamics.com/en/news/boeing-announces-cloud-partnerships-with-microsoft-and-google/; Aaron Raj, "Boeing Takes to the Cloud with AWS, Google, and Microsoft," TechWire Asia, April 8, 2022, https://www.wsj.com/articles/boeing-shifts-to-microsofts-azure-cloud-platform-1468861541. Lockheed Martin has recently begun to use cloud's computing capability to help their on-premises capacity for sensitive workloads. https://blog.asug.com/hubfs/2019%20AC%20Slide%20Decks%20Thursday/ASUG82404%20-%20Lockheed%20Martin's%20Journey%20to%20the%20Cloud.pdf. https://techwireasia.com/2022/04/boeing-expands-cloud-services-with-aws-google-and-microsoft/. One reason behind Boeing's decision is the cloud's ability to easily scale test environments and store the immense datasets a jet's sensors generate each flight. The company cited a Boeing 787's need to download up to 500 gigabytes (GB) of data per flight, with Raytheon making similar arguments on scalability.

Financial Services Industry

Select financial institutions have more rapidly embraced the cloud as their primary infrastructure for core digital workloads. Capital One, among the largest banks in the United States, announced in 2022 that it had closed all eight of its private data centers and now runs major services entirely in the cloud, including applications working with client data and backup services, an unprecedented move for a financial institution.Lananh Nguyen, "Banks Tiptoe Toward Their Cloud Based Future," New York Times, January 3, 2022, Emily Flitter and Karen Weise, "Capital One Data Breach Compromises Data of Over 100 Million," New York Times, July 29, 2019, https://www.nytimes.com/2022/01/03/business/wall-street-cloud-computing.html. A catastrophic cloud event leading to the temporary or permanent unavailability of this data would undoubtedly disrupt functionality at Capital One and prove difficult to recover from without cloud-based tools. A massive data breach in 2019 exposed one of the recurring challenges in cloud computing-the trust boundary between a cloud-consuming organization and its CSP. An attacker compromised the firm's AWS-hosted data stores and gained access to personal data for more than 100 million people, in an incident later attributed to a misconfiguration by Capital One that left it vulnerable to a common attack against cloud services. https://www.nytimes.com/2019/07/29/business/capital-one-data-breach-hacked.html; Brian Krebs, "What We Can Learn from the Capital One Hack," Krebs on Security, August 5, 2019, https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/.

Nasdaq, the world's largest securities exchange, responsible for matching buyers and sellers across billions of orders, cancellations, and trades each day, moved from on-premises data centers to the cloud in 2014.Nguyen, "Banks Tiptoe"; "Nasdaq Uses AWS to Pioneer Stock Exchange Data Storage in the Cloud," Amazon Web Services, 2020, https://aws.amazon.com/solutions/case-studies/nasdaq-case-study/; "Trading and Matching Technology," Nasdaq, accessed April 27, 2023, https://www.nasdaq.com/solutions/trading-and-matching-technology. The stock market's unpredictable trade volume created a need for elasticity best provided by cloud services. Nasdaq's cloud transition proved timely during the COVID-19 pandemic, when the number of transaction records surged to 113 billion a day in March 2020. Since starting up enough on-premises infrastructure for such quantities of data would be virtually impossible in the short-term, losing this capability risk undermining core market functions.Nguyen, "Banks Tiptoe"; Amazon Web Services, "Nasdaq Uses AWS to Pioneer"; Nasdaq, "Trading and Matching" A major cloud compromise or disruption could impact the exchange's ability to accurately store the day's transactions, bill customers, and comply with regulatory requirements.

Other major financial institutions have increasingly moved sensitive data to the cloud, though few at the same pace as Capital One or Nasdaq, including Goldman Sachs and the Deutsche Börse Group, which runs the Frankfurt Stock Exchange using a cloud-based tool to analyze investor behavior to offer guidance on better trading strategies rather than any core functions of the exchange."Goldman Sachs and AWS Collaborate to Create New Data Management and Analytics Solutions for Financial Services Organizations," Goldman Sachs, November 30, 2021, https://www.goldmansachs.com/media-relations/press-releases/2021/goldman-sachs-aws-announcement-30-nov-2021.html; "Deutsche Borse Group Launches Data Analytics Platform in Rapid Time using AWS," Amazon Web Services, 2022, https://aws.amazon.com/solutions/case-studies/deutsche-boerse-case-study1/.

Other core and critical applications of the financial sector have moved to the cloud, too with Wells Fargo reportedly using Microsoft Azure as the foundation of its "strategic business workloads" and Capital One shifting its disaster-recovery and business-continuity functionality to the cloud."Wells Fargo Announces New Digital Infrastructure Strategy and Strategic Partnerships with Microsoft, Google Cloud," Wells Fargo (business wire), September 15, 2021, Jeff Dowds, "AWS re:Invent 2019 - Jeff Dowds of Vanguard Talks About the Journey to the AWS Cloud," Amazon Web Services (YouTube video), December 12, 2019, https://newsroom.wf.com/English/news-releases/news-release-details/2021/Wells-Fargo-Announces-New-Digital-Infrastructure-Strategy-and-Strategic-Partnerships-With-Microsoft-Google-Cloud/default.aspx, Wells Fargo, "Wells Fargo Announces New Digital Infrastructure Strategy. Vanguard, a leading American investment advisor, relies on a similar suite of cloud services as Capital One, reporting near-total adoption of the cloud across more than 850 production software applications in 2021. https://www.youtube.com/watch?v=8kzOj9cStGo; "Vanguard Increases Investor Value Using Amazon ECS and AWS Fargate," Amazon Web Services, 2021, https://aws.amazon.com/solutions/case-studies/vanguard-ecs-fargate-case-study/.

Treasury's 2023 report, The Financial Services Sector's Adoption of Cloud Services, was a welcome step forward in attempting to map out the complex landscape of cloud service models, noting, "a lack of aggregated data to assess concentration is a key impediment to understanding the potential impact of a severe, but plausible operational incident at a CSP on the financial sector.US Department of the Treasury, Financial Services Sector's Adoption of Cloud Services, 57 The report identified as key barriers "(i) the lack of common definitions or identification approaches for critical or material cloud services used by financial institutions, (ii) the lack of a common and reliable method to measure concentration, (iii) different data collection authorities and mandates across FBIIC-member agencies."US Department of the Treasury, Financial Services Sector's Adoption of Cloud Services, 57-58. To the reader, FBIIC is the acronym for the Financial and Banking Information Infrastructure Committee It further noted the increased difficulties in assessing risk due to "'nth party' dependencies...[as] CSPs provide services to many other third-party service providers that a financial institution may rely on, and also use many sub-contractors, creating indirect dependencies for financial institutions that are more difficult to assess."US Department of the Treasury, Financial Services Sector's Adoption of Cloud Services, 50

The difficulties faced even by the Treasury Department, an experienced sector risk management agency, in assessing the systemic vulnerabilities of the financial sector to cloud incidents are an example of broader measurement challenges common to CI sector regulators attempting to understand the impacts of cloud technology on sector risk.

Cloud as Critical Infrastructure

The goal of this report is not to evaluate the cloud as a new CI sector. Instead, it addresses the nature of the cloud's criticality on its own merits and to other sectors, in service of specific policy activities which could better handle and govern that criticality. As illustrated above, CI sectors increasingly look to cloud computing to host important workloads. The narrative of the cloud's economic, operational, and security advantages appears uniformly persuasive, even if the rate at which adoption occurs, as well as the operational criticality of the workloads moved to the cloud, varies greatly among sectors. As cloud adoption ramps up, so too will the potential harms to CI from any significant outages, compromises, or cascading failures. Does this mean the cloud services industry, itself, ought to be considered CI?

PPD-21's CI definition is subjective-no quantitative threshold determines criticality to national and economic security, either directly or transitively. Regulatory authorities rely on common knowledge and intuition to make that classification, often focusing on physical, tangible sectors. The majority of the sixteen CI sectors are those with which citizens interact daily (either directly or transitively), such as water, transportation, financial services, and food. Absent a strict methodology, one way to determine criticality is to hypothesize the consequences of an infrastructure's sudden unavailability. The CI sectors of healthcare, transportation and logistics, energy, defense, and financial services increasingly rely on cloud technology for critical workloads. As such, a sudden loss of cloud availability could have cascading consequences of the kind that policymakers sought to avoid by originally designating these sectors as CI. Therefore, the cloud ought itself to be considered as CI, if for no other reason than that it is ever more critical to the operation of already designated CI sectors. The intent of this acknowledgment is not to argue for the addition of cloud as another CI sector-indeed, IT is already a CI sector-but instead to highlight the need for increased scrutiny of cloud computing from existing CI sector regulators and policymakers, given its increasing role as a critical dependency for CI.

Mainstream discussion often glorifies cloud computing as "next-generation" technology, citing cost efficiency, speed, and scalability. Press releases by major CSPs contain myriad references to "transforming" industries,"AWS and Atos Strengthen Collaboration with New Strategic Partnership to Transform the Infrastructure Outsourcing Industry," Amazon Press Center, November 30, 2022, "Wallbox Goes All-In on AWS," Amazon Press Center, November 30, 2022, "AWS and NVIDIA Collaborate on Next-Generation Infrastructure for Training Large Machine Learning Models and Building Generative AI Applications," Amazon Press Center, March 21, 2023, Vivek Kundra, "Federal Cloud Computing Strategy", The White House, February 8, 2011, https://press.aboutamazon.com/2022/11/aws-and-atos-strengthen-collaboration-with-new-strategic-partnership-to-transform-the-infrastructure-outsourcing-industry; "The University of California, Riverside Enters Into First-of-Its-Kind Subscription-Based Service with Google Cloud to Transform Research and IT," Google Cloud (news release), March 9, 2023, https://press.aboutamazon.com/2022/11/wallbox-goes-all-in-on-aws; "AGL Transforms 200+ Applications, Goes All in on Cloud, and Sets up for Sustained Success," Microsoft News Center, June 9, 2020, https://press.aboutamazon.com/2023/3/aws-and-nvidia-collaborate-on-next-generation-infrastructure-for-training-large-machine-learning-models-and-building-generative-ai-applications; "Mercedes-Benz and Google Join Forces to Create Next-Generation Navigation Experience," Google Cloud (news release), February 22, 2023, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/federal-cloud-computing-strategy.pdf; "Strategic Plan to Advance Cloud Computing in the Intelligence Community," Office of the Director of National Intelligence, June 26, 2019, https://www.dni.gov/files/documents/CIO/Cloud_Computing_Strategy.pdf These benefits are real. This report does not seek to dissuade cloud adoption but instead argues that the real benefits of cloud adoption must also carry measured consideration of the unique risk landscape widespread cloud dependence creates, not just in single cloud services but also in the common infrastructure and architectures that power them. https://www.googlecloudpresscorner.com/2023-02-22-Mercedes-Benz-and-Google-Join-Forces-to-Create-Next-Generation-Navigation-Experience; "Empowering the Future of Financial Markets with London Stock Exchange Group," Official Microsoft Blog, December 12, 2022, https://blogs.microsoft.com/blog/2022/12/11/empowering-the-future-of-financial-markets-with-london-stock-exchange-group/. Much policy has sought to speed and streamline government cloud adoption to harness the potential efficiency and cost benefits accordingly. https://news.microsoft.com/en-au/features/agl-transforms-200-applications-goes-all-in-on-cloud-and-sets-up-for-sustained-success/. and building next-generation technology. https://www.googlecloudpresscorner.com/2023-03-09-The-University-of-California,-Riverside-Enters-Into-First-of-its-kind-Subscription-based-Service-with-Google-Cloud-to-Transform-Research-and-IT. going "all-in" on the cloud,

Risk in the Cloud

Cloud computing systems display two properties that create unique risk characteristics: compounded dependence and delegated control and visibility. These properties are the driving cause behind this report, and they arise from cloud architecture and the behavior of cloud infrastructure far more than the security properties of any single cloud service.

Much of the mismatch between risk and policy here is driven by the fact that the cloud, writ large, is a system of systems: ever-growing compute, storage, networking, and management capabilities wired together through the Internet over vast distances and among many jurisdictions, with data, workloads, and capacity in constant flux. Vendors can rip and replace whole generations of infrastructure without notice to customers, so long as they adhere to "uptime" standards. Much of government policy toward cloud risk to date is driven by prescriptive approaches, crafted through the lens of product acquisition and full-system transparency. There are hard limits on the ability of this approach to shape the behavior of these systems, due in equal parts to the complexity and novelty of the cloud writ large and an underdeveloped policymaking toolkit. One might compare the situation to trying to manage an entire economy with policies built for a single commodity or marketplace.

The intuitive approach for cloud risk management is for a single all-seeing entity to observe every system, carefully chart the interdependencies and assigned responsibilities, identify points of failure, and deploy redundancies and fixes to remediate. Besides the obvious technical infeasibility, cloud vendors already build systems beyond the scope of unassisted human management. And unfortunately, current policy is still far from an information environment and regulatory structure where such an approach would be possible.

This information gap is undeniably due in part to internal CSP dynamics-be it a reluctance to share their dependency graphs, algorithms, and infrastructure frameworks or even a lack of internal visibility of the same. Transparency can be perceived as a source of regulatory risk, and there are aforementioned cost advantages of being able to engineer cloud infrastructure to suit CSP needs and cost demands, without prescriptive customer input., Some CSPs may even argue such information constitutes core trade secrets.Paul Teich, "How To Make Public Clouds Transparent," Forbes, October 1, 2019, https://www.forbes.com/sites/paulteich/2019/10/01/how-to-make-public-clouds-transparent/?sh=19f763325746. However, it is worth noting that this relative opacity provides another potential benefit to CSPs: it might allow them to deliver promised services with less accountability and potential legal exposure for the details of-or changes in-how they do so. In the Treasury's cloud report, for example, some financial institutions conveyed that they did not have transparency about how many data centers they were relying on at a CSP until an operational incident occurred.US Department of the Treasury, Financial Services Sector's Adoption of Cloud Services, 58

Policy must evolve to match the risk management needs of this system of systems, where many benefits driving adoption also radically transform the relationship between resulting CI customers and their regulators. Compounded dependence enables an incredible dynamism to match rapidly shifting cloud workloads while stacking risk on top of key linchpin technologies and common but opaque architectures. Compounded dependence leads to cloud users relying on a few key technologies and designs. Cloud's delegated control and visibility means that CI sectors both benefit from the engineering prowess of premiere IT firms and struggle to retain full control of and visibility into their systems-an issue magnified by the complexity of the cloud writ large and the corresponding difficulty in fulling understanding the many, constantly shifting dependencies within the cloud. This frustrates the very visibility and capacity for intervention key to managing those dependencies. Cloud systems do not necessarily carry more risk than their on-premises counterparts-they may very well be safer in many respects-but they also create risks not present in on-premises systems and which current policy is ill-equipped to confront.

Compounded Dependence

Hypervisors are a clear example, sitting at the heart of cloud computing. To provide scalable, economical computing services, CSPs often use one physical server to provide computing resources to multiple customers simultaneously. A hypervisor enables this by partitioning a physical server into several virtual machines, creating a "multi-tenant" environment.To the reader, orchestrators play a similar role in deployments using a container-style deployment. See: Handler, "Dude, Where's My Cloud? To the user, the server appears as a single computer. An attack on a hypervisor could allow a malicious actor to access sensitive data and execute commands in other customers' virtual machines. Multiple CSPs sometimes use the same hypervisor, such as Xen, for both AWS and IBM, further increasing the potential blast radius of a vulnerability."Xen Vulnerability Allows Hackers to Escape OS VM and Own the Host," Virtalica, accessed April 28, 2023, https://virtalica.com/2016/08/26/xen-vulnerability-allows-hackers-escape-os-vm-host-amazon-aws-rackspace-ibm-affected/.

While every CSP has solved a set of common computing and networking challenges in different ways, they often share a reliance on common or similar technologies and techniques, even at the physical level. The MELTDOWN and SPECTRE vulnerabilities-discovered in Intel processors (most commonly used) and, to a lesser extent AMD processors-illustrate this compounded dependence well. The vulnerabilities posed serious threats to cloud security by enabling attackers to break through the digital walls of multi-tenant environments.Jann Horn, "Project Zero: Reading Privileged Memory with a Side-Channel," Project Zero (blog), January 3, 2018, Daniel Firestone et al., "Azure Accelerated Networking: SmartNICs in the Public Cloud," Usenix, accessed April 28, 2023, https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html; Birgit Baustädter, "Following on from Meltdown and Spectre: TU Graz Researchers Discover New Security Flaws," Tu Graz News, May 14, 2019, https://www.usenix.org/conference/nsdi18/presentation/firestone; Paul McLellan, "HOT CHIPS: The AWS Nitro Project," Cadence, October 2, 2019, https://community.cadence.com/cadence_blogs_8/b/breakfast-bytes/posts/the-aws-nitro-project; Tim Anderson, "Managing the Linux Kernel at AWS: 'A Large Team of Security Experts' Dealing with Fallout from Spectre, Meltdown Flaws," The Register, December 10, 2019, https://www.theregister.com/2019/12/10/linux_kernel_aws/. Here, risk blossomed because of the common adoption of similar processors from just two vendors across most CSPs to meet a niche and demanding workload. https://www.tugraz.at/en/tu-graz/services/news-stories/tu-graz-news/singleview/article/nach-meltdown-und-spectre-tu-graz-forscher-entdecken-neue-sicherheitsluecken0/. Major CSPs made fundamental changes to their infrastructure, in the wake of these vulnerabilities, far beyond patching the affected software.

Even though on-premises deployments are often more vulnerable individually (and subject to some of the same common-component risks as seen in MELTDOWN and SPECTRE, though eased by avoiding risks specific to multi-tenancy), their diversity and lack of interconnectivity put hard limits on the reach of potential attacks. Malicious actors must conduct reconnaissance and formulate an attack plan for each deployment, slowing their work. In the cloud, however, an adversary could potentially compromise many organizations at once. For example, one disgruntled AWS employee allegedly used a scanner to look for AWS S3 data storage buckets with common misconfiguration patterns, ultimately finding and accessing data belonging to more than thirty organizations (including facilitating the compromise of Capitol One).Michael W. Heiligenstein, "Amazon Web Services (AWS) Data Breaches: Full Timeline Through 2022," Firewall Times, April 6, 2023, https://firewalltimes.com/amazon-web-services-data-breach-timeline/; Tara Seals, "Capital One Attacker Exploited Misconfigured AWS Databases," DarkReading, June 20, 2022, https://www.darkreading.com/attacks-breaches/capital-one-attacker-exploited-misconfigured-aws-databases. Uniform solutions can boost the security baseline by bringing cloud customers to a universally higher standard. However, they can also grow the blast radius and magnitude of vulnerabilities and compromises.

On the surface, these examples illustrate the complex webbing of cloud systems and networks. Traditional computing networks have similar functions like logging, job assignment, and data analytics. Yet systems, such as activity logging, which tend to be auxiliary in traditional, on-premises deployments, are essential to cloud functioning for workload coordination across thousands of customers and hundreds of data centers. "Smaller" services have a much bigger and more vital role in the cloud because they are critical dependencies of data systems for hundreds of thousands of cloud customers at once. Leveraging a handful of technologies in this way certainly has benefits-it creates efficiencies by re-using the best available solutions and gives CSPs the ability to deploy many resources on securing specific, key dependencies. However, all software, no matter how well-maintained, can have vulnerabilities, outages, or downtime. The cloud is unique in how deeply it concentrates risk for hundreds and thousands of entities by stacking that risk on a few specific technology nodes.

Delegated control and visibility

One of the most appealing selling points of cloud systems is delegation-no longer does a CI operator need to shoulder the entire burden of managing the operational and security complexity of managing an entire IT system. Instead, by relying on a cloud offering, they can share that work with a CSP, usually an entity with vast resources, expertise, and experience. This shared handling has been enshrined with respect to security in ideas like the "shared responsibility model," which articulates the components of cloud security for which a CSP is responsible versus those responsibilities which fall on the cloud customer.

Many cloud breaches have originated in breakdowns of the shared responsibility model.Drew Wright, "The State of Cloud Security 2020 Report: Understanding Misconfiguration Risk," Cloud Security Alliance (blog), May 5, 2020, https://cloudsecurityalliance.org/blog/2020/05/05/the-state-of-cloud-security-2020-report-understanding-misconfiguration-risk/; Tod Beardsley and Kwan Lin, "Cloud Misconfigurations Report," Rapid 7, April 2022, https://www.rapid7.com/thank-you/2022-cloud-misconfigurations-report/. While CSPs typically provide security tools such as access controls, customers must know how to configure and use them correctly, which can pose a challenge for an organization migrating to the cloud for the first time. Often, the issue arises from the cloud user, who might fail to correctly configure restrictions on sensitive resources, or use combinations of permissions with unwanted effects, including paths to improper escalation. Policymakers, especially in CI sectors, must examine the shared responsibility model carefully to ensure that it is also a shared accountability model: CSPs must provide secure-by-default configuration options and adequate support for their customers to ensure that their deployments are configured securely to "shift the burden" for better security onto CSPs,Biden White House, "National Cybersecurity Strategy". rather than their less-well-resourced customers.

The shared responsibility model does not apply to security alone: users delegate control over the architecture of the computing and storage and networking resources they use to the CSP. This delegated control and visibility model presents challenges because it impairs visibility and control for CI customers and regulators. CI customers often lack data or access that enables them to partake in risk management, instead requiring trust in the CSP, and regulators often lack direct supervisory or audit access to the entities operating the IT systems that underpin their sector's function.

Though not necessarily common practice, with on-premises data centers, it is theoretically possible for an organization to audit its data system, understand the end-to-end model of where and how their data moved within the system, and identify potential nodes of risk or operationally critical data system components. In contrast, under the delegated control model, contractual negotiations, rather than direct oversight, are often the only opportunities organizations have to understand qualities such as requirements for how much downtime a service may have."Can You Recovering Losses Sustained during a Cloud Outage," InformationWeek, August 4, 2022, https://www.informationweek.com/strategic-cio/can-you-recover-losses-sustained-during-a-cloud-outage-; Kharmela Mindanao, "Cloud Downtime Explained (& What You Can Do About It)," Intelligent Technical Solutions (blog), accessed April 28, 2023, https://www.itsasap.com/blog/cloud-downtime-explained; Tobias Mann, "Oracle NetSuite Datacenter Plunges Offline for a Day, Customers Warned of Data Loss," The Register, February 15, 2023, https://www.theregister.com/2023/02/15/oracle_netsuite_down/. Treasury, in its report, found that "some financial institutions conveyed that there were gaps in their ability to assess the resilience of their configuration of a cloud service." The report goes on to identify critical challenges in making these assessments, including:

"(i) difficulty in understanding their responsibilities or effectiveness of their choices for configuring the cloud services for the appropriate level of resilience;

(ii) the lack of specific recovery time objectives in some contracts with CSPs;

(iii) the lack of specific incident notification and response procedures in some contracts with CSPs; and

(iv) the lack of detail in cloud service documentation regarding resilience dependencies, such as a CSP's reliance on other suppliers of IT services or internal CSP resources (such as other CSP operating regions)."US Department of the Treasury, Financial Services Sector's Adoption of Cloud Services, 53.

Cloud platforms have their own complex webs of operational dependencies on other services and resources-from both those provided by the CSPs themselves and some provided by external entities-that add another layer of complexity, particularly when those relationships are opaque to CSP customers. Service-level agreements generally allow a CSP to subcontract systems, creating a multi-layered supply chain. Subcontracting and outsourcing cloud software and hardware occur at virtually every service level, from IaaS to SaaS. For instance, one SaaS provider might be a client of another IaaS provider. The customer would only interact directly with (e.g., pass data to) the SaaS provider, not knowing whether and how their data passes through to a third-party storage service. With every instance of subcontracting and layering, users lose some control, often invisibly.

The delegated control and visibility model makes a full assessment or understanding of the risks involved with cloud use difficult for both cloud customers and regulators by obfuscating the possible modes of operational failure and obscuring risks that arise from choices CSPs make in building and operating their infrastructure. CSPs' opacity here protects their ability to make business and technology decisions without user input, a practice that may be hard to change without considerable incentive. Indeed, this arrangement is somewhat necessary, as cloud users lack the resourcing and capacity to manage CSP systems, and in fact, part of the price tag of cloud products is the very offloading of that work from user to provider. It might arise too from the simple fact that CSPs themselves have an incomplete picture of their own technology stack. Whatever the cause, it means that CSPs are the sole entity currently empowered and asked to manage systemic cloud risks, with relatively little oversight of how they choose to do so and how successful their efforts have been. Like security, risk management should be a shared responsibility-among users, regulators, and CSPs rather than entirely the latter. Regulators must ensure CSPs collect the information needed to appraise and manage cloud risks and share it with customers and regulators that also hold deep equities in ensuring cloud security and resilience.

The End Result

Taken together, compounded dependence and delegated control and visibility create new forms of risk that are both systemic and relatively opaque. To serve large numbers of customers and execute complex, dizzying workloads, CSPs lean on a handful of core technologies, increasing the risks and blast radius of incidents in them. At the same time, while the effective risk management of such an arrangement hinges on visibility into shared infrastructure and linchpin services, the widespread delegation of control from user to CSP diminishes the respecting user-entity capacity. The end result is users-sometimes the majority of entire sectors, including some CI sectors-relying on a few core technologies with little insight into or influence over those technical arrangements.

More and more CI sectors are coming to rely on this complex system of systems, arranged and managed by just a few firms and built around key technical bottlenecks under a shroud of opacity. Many cloud customers currently rely solely on the CSP to effectively govern these risks, both in deployed infrastructure and the architecture of how different systems map to and depend on each other. Users have few ways to hold CSPs accountable to ensure this governance takes place-and policymakers have no means to specify or measure-if this governance is effective. Yet cloud adoption continues to grow swiftly, all while essential aspects of the public interest in the security and safety of widely used technology systems remain missing in action. The United States needs to act quickly to improve clarity on this system of systems so crucially depended upon by many of the nation's CI sectors.

The first task for each newly created CMO should be a survey of cloud usage within the respective sector to understand the degree of dependence that sector actors have on the cloud for critical functionality and the barriers to their current ability to understand and manage associated risks. Second, the CMO should leverage this information to assess existing sector risk reporting and management requirements and determine adequacies for capturing and gauging cloud risk, as well as use this information to outline sector-specific best practices in cloud migration and adoption based on successful case studies and identified best practices. Where gaps exist that impact regulator visibility into cloud-associated risks-such as a lack of requirements to report on which CSPs are used, or the specifics of CSP contracts-the CMO should recommend updates or new reporting requirements to address such gaps.

Throughout, Jen Easterly, "Written Statement: [as] Nominee for Director of the Cybersecurity and Infrastructure Security Agency Before the U.S. Senate Committee on Homeland Security and Governmental Affairs," June 10, 2021, CISA, in its capacity as the "quarterback" for federal cyber risk management, https://www.hsgac.senate.gov/wp-content/uploads/imo/media/doc/Prepared%20Statement-Easterly-2021-06-10.pdf. should play a facilitating role. CISA can offer resources such as reports or frameworks to assist CMOs in surveying cloud usage. It might also work with SRMAs as they construct sector-specific reporting requirements for CSPs to harmonize reporting requirements across sectors and minimize burdens on CSPs while ensuring each SRMA has the information it needs to manage risk.

Separate from creating these CMOs to manage CI-sector cloud oversight, need for a new entity or new authorities might surface to more directly oversee the cloud sector itself, focusing on cross-sector risks to cloud stability and security. Such an entity could center efforts on strengthening transparency, resilience, and security at major CSPs, benefitting whole-of-system integrity while avoiding possible duplicative or incomplete efforts from the sole reliance on CI sector-specific lenses on the cloud. Such a new structure will need sufficient authorities to obtain data to enable visibility into cloud software stacks and associated risks, as well as effective tools to translate its insights into policy interventions.

This report recommends, therefore, makes three interconnected policy recommendations.

1. Systematically evaluate cloud computing use in critical sectors: CMOs should conduct formal surveys with key actors in their critical sectors to determine:

1. The overall dependence on the cloud by that sector, with special attention to features and functions that are essential to ongoing operations;

2. The presence and adequacy of fallback systems for workloads essential to ongoing operations;

3. An overview of models of hybrid cloud adoption, including the distribution of workloads, the interaction between on-cloud and on-premises data systems, and any risks specific to hybrid cloud deployments;

4. The potential impacts of different cloud incidents on the sector and follow-on effects;

5. The distribution of CSPs and cloud services used;

6. The distribution of contractual terms with CSPs pertaining to sector-specific requirements such as continuous availability or data security; and

7. Lessons learned from existing examples of sector cloud migrations and configurations, including sector-specific best practices.

2. Survey and update cloud policies and resources: CMOs should survey existing reporting requirements for data systems and evaluate how well they capture cloud-related risk factors. Where required, CMOs should make policy recommendations to extend regulations to ensure their SRMA has adequate information to manage sector risk. Additionally, CMOs should evaluate whether they have provided adequate resources such as best practice guides and runbooks for sector participants migrating to the cloud and seek to create and provide such resources based on their survey of sector cloud use where appropriate.To the reader, the term "runbook" refers to a set of standard written procedures for completing repetitive IT steps or processes.

3. Develop a structure for cross-sector cloud risk oversight: Congress should identify a policy structure for an entity to oversee and manage systemic, cross-sector cloud risk.

#1: Systematically Evaluate Cloud Computing Use in Critical Sectors

There is little information available for regulators to assess cloud adoption within CI sectors, and often even less available for them to assess the degree to which critical workloads depend on the cloud and how operationally resilient these cloud workloads are. General market surveys on cloud adoption tend to miss the distinction between the migration of mission-critical versus auxiliary workloads and data. They lack granular information such as particular CSPs, contractual terms, and configuration options essential for regulators to appraise sector risk. The lack of transparency has made determining whether a critical sector-or at least some of its major players-relies on cloud computing for daily operations difficult, making risk management by regulators challenging in turn.

To achieve appropriate operational awareness, each CMO should survey its critical sector to determine its degree of cloud dependence and maturity. CMOs should conduct surveys to capture information most essential to assessing the sector's cloud dependence and its degree of systemic cloud-related risk, including: which workloads have transitioned to the cloud and how necessary those workloads are for core operations; the presence or availability of non-cloud data systems and whether such systems can substitute for the cloud in the event of an outage; which CSPs the sector entities use; relevant contract terms such as uptime expectations and responsibilities allotted under the shared responsibility model; and any barriers reported by sector regarding their ability to use the cloud in a risk-aware way, such as inability to obtain desired contractual terms or CSP unwillingness to disclose information about its software supply chain or stack. To assess cloud maturity, CMOs should also seek to understand whether the subject organization has plans and processes in place for management of cloud incidents-including cybersecurity incidents and continuity outages-and to understand other challenges the organization has faced in their adoption of cloud computing.

Such a survey will not immediately reduce cloud adoption risks, but it will provide a critical window into the nature of sector cloud dependence to aid in developing subsequent coordination, guidance, and possibly regulation. The survey will help regulators understand variance in the types of shared responsibility models adopted throughout the sector, as well as the degree of control and insight sector actors typically have into cloud management and risks. Survey results could be public with sufficient aggregation and anonymization. Much like Treasury's report on the cloud in the financial sector, access to the results helps policymakers and decision-makers better understand the emerging cloud risk landscape.

#2: Survey and Update Cloud Policies and Resources

CMOs can later synthesize the policy survey results with those from the cloud-usage survey to inform potential policy recommendations. Such policy recommendations might include updating existing sector reporting requirements to capture essential data on risks associated with cloud computing, granting regulators the ability to directly examine or interact with CSPs, or requiring sector participants to obtain contractual security and resilience guarantees from their CSP and prescribing means by which sector participants must verify such properties.

Regulations will need sufficiently nuanced updates to account for the wide variance in cloud usage and should reserve stringent requirements for the most critical operational systems. For example, it may not be worth the oversight burden to ask sector participants to compile reports on their use of the cloud for auxiliary data storage or on their use of common enterprise SaaS tools, such as Microsoft Outlook. The table below illustrates some examples of labeling particular cloud services relative to their criticality, but SRMA CMOs should adapt workloads and reporting timelines to match the relative criticality of different functions within their sector.

Additionally, CMOs can provide helpful resources beyond regulation to drive down risk, including best-practices guides and cloud-migration runbooks adapted for their sector's specific needs. Such documents should reflect their experience talking to sector participants about their cloud migration experiences, as well as potentially through interviews with CSPs and other stakeholders. In this process, CMOs might consider collaborating with other CMOs to identify cross-sector best practices for cloud migration and to leverage insights or guidance from cloud-mature sectors and organizations.

#3: Develop a Structure for Cross-sector Cloud Risk Oversight

Regulators need better data to understand complex webs of interdependencies that create risks in the cloud environment. As this report indicates, many other CI sectors rely on the cloud, meaning that the potential impacts of cloud risks span across sectors, and improvements to the security or resilience of cloud offerings can have multi-sector benefits. Examples of cloud failures and outages from the sections above illustrate that particular components, such as identity and access management or resource allocation services, can be failure points for the function of a CSP's entire system. Understanding and mapping system risk is a necessary first step to determine which systemically important cloud components might need greater scrutiny, testing, and support. This report, therefore, recommends Congress consider potential designs for an oversight entity to collect data related to cloud and cloud risks and suggest interventions to strengthen cloud security and resilience to benefit the multiple other CI sectors that rely on the cloud. The key will be creating reporting structures that capture dependencies and relationships to inform regulators about vital potential failure points, while becoming standardized enough to facilitate easy reporting and analysis.

Open questions remain about the structure, information requirements, and required authorities for a centralized cloud risk oversight agency. Congress could take the first steps towards its creation by convening a task force or other intragovernmental body to inform its design and implementation. Like the Cyberspace Solarium Commission (CSC), such a task force could include membership from bipartisan, Congressional cloud leaders, heads of stakeholder agencies-in this case, SRMAs and other cloud regulators such as the Federal Trade Commission-alongside operational experts in cloud security, resilience, and risk from outside of government. Like the CSC, such a task force could issue recommendations for the creation of a cloud oversight entity and other legislative measures to improve cloud resilience and then work with Congress to implement those recommendations in the form of legislation.

The structure of the cloud risk oversight entity must contend with at least four basic questions.

1. Where in government should a cross-sector cloud risk oversight entity reside?

2. What data will it need from CSPs to allow mapping complex webs of risk and software dependence?

1. What information needs to be included in the reported data, and in what format?

2. Which CSPs must report?

1. At what point does a CSP become systemically important enough to merit reporting requirements of this kind?

2. Should reporting requirements apply only to "hyperscaler" IaaS providers, or to key SaaS providers as well?

3. How frequently does data need to be reported?

3. How can such an entity obtain the data it needs?

4. What should the entity do with the information it obtains about cloud risk?

1. How can it propagate information to SRMA CMOs and other organizations tasked with managing sector-specific cloud risks?

2. How can it share useful risk-related information back to the CSPs themselves?

In its report, the Treasury Department acknowledged the need for interagency coordination to manage cloud risks, for which it created a new Cloud Services Steering Group to "promote coordination and collaboration among US financial regulators on these challenges."US Department of the Treasury, Financial Services Sector's Adoption of Cloud Services, 8 This is an essential first step towards much-needed collaboration between sector regulators to manage cloud risks, but the Treasury Department alone cannot create a body that reaches beyond the financial sector to collaborate with other critical sectors facing the same questions and challenges. An intragovernmental task force could jumpstart such a process.

3.1: Where in government?

This recommendation intends to lead to the creation of a new entity or the identification of an existing, capable one to task with studying and managing cloud risks. An obvious home for such an entity would be within CISA, given the agency's existing mandates around coordination for CI risk management and the Department of Homeland Security's status as the SRMA for the IT CI sector. Given CI risk management is an exercise in managing the behavior of diverse private sector actors, CISA, with its emphasis on private-public partnership, is a more fitting home than agencies focused on standards for government cloud use such as the General Services Administration. This effort would have more in common with CISA's existing work around strengthening private sector adoption of secure by design and default practices than with programs such as the Federal Risk and Authorization Management Program (FedRAMP) that focus on individual cloud product security.

A task force designing the structure of such an entity might consider whether CISA already has the authorities required to establish such an office or initiative, or whether legislative action must assign CISA the appropriate coordinating authority with respect to the cloud. Potential redistribution of responsibilities under a PPD-21 update could also alter considerations about where and how to create such an entity. Additionally, the task force might consider whether CISA requires additional funding or hiring authorities to ensure that such an effort is appropriately supported to pursue an ambitious, cross-sector cloud risk-management mission.

3.2: What data is needed?

Policymakers should consider whether third parties that provide services critical to cloud functionality are necessary reporting requirements to better understand potential chains of transitive dependence. The task force should also address the frequency of reporting parameters, balancing the need for up-to-date risk analyses with the administrative burdens on both CSPs and the receiving entity of each data update cycle.

3.3: How can this data be obtained?

Another open question is how a centralized oversight entity could obtain the data needed from CSPs. Understanding the intricacies of cloud systems requires access to details of a CSP's software stack and supply chain, which it would likely guard as a business secret. A structure for systemic cloud-risk oversight will need to avoid requiring cloud customers themselves to attempt to map cloud dependencies, which would likely lead to mistakes and delays. Instead, any structure would need to shift the responsibility onto those best equipped to share information through the creation of SBOMs and similar artifacts: the CSPs themselves.

In lieu of new authorities, sector regulators could also require that regulated CI entities obtain information such as SBOMs directly from CSPs as part of their contractual agreement and then aggregate them up to a central oversight authority. However, this system has downsides in that the presence of an intermediary (the sector cloud customer) might increase CSP fears about revealing proprietary business information through such a process, in addition to the overhead created through the need to cross-reference and aggregate distinct system architecture diagrams to gain a whole-of-cloud perspective.

A third potential approach could involve using legislation to grant authority to a centralized entity to directly obtain SBOMs and other information from major cloud services to aid risk monitoring. This approach would help provide the centralized entity with a holistic overview of the cloud risk and reduce regulatory reporting burdens on CSPs, but it would be difficult to implement without legislative action.

3.4 How should data be used to reduce cloud risk?

An important advantage of designating an entity for cloud risk oversight is its increased ability to review and strengthen critical dependencies and shared points of failure across industries. Such a structure also avoids the laborious duplication and potential piecemeal effects of making each SRMA CMO solely responsible for functionally managing risks associated with the cloud through the lens of its own industry. However, SRMA CMOs will still be the best-positioned to measure and manage the specific impacts of cloud risks on their sector and, therefore, will need robust and open channels of communication with any centralized entity to request and receive information about risk-related findings that may be relevant to their own sector risk management.

With data in hand, a centralized oversight entity would have several potential options for interventions to reduce risk. Potentially, it could work directly with CSPs to identify systemically important components and dependencies for testing, auditing, and hardening. It could develop a certification scheme for cloud resilience commensurate with CI needs, which CSPs could obtain to foster trust with CI customers. While the task force need not delineate every possible way an oversight entity would use cloud data to reduce risk, identifying broad categories of viable functions will be helpful for shaping considerations of what data is needed, as well as suggesting how the body will achieve longer-term objectives. The task force should also consider guidelines around the reporting and use of CSP-provided data to protect its confidentiality.

Conclusion

Cloud computing morphs and shifts through countless configurations and designs while retaining certain core characteristics and risks. This flexibility, coupled with seemingly endless elasticity, has enticed governments and firms to make obsolete many on-premises data centers. Among an ever-larger user base for cloud services, one can find a growing number of CI owners and operators. Companies from the healthcare, transportation and logistics, energy, defense, and financial services sectors are moving some of their core functions to the cloud. Cloud services come with considerable benefits but obscure much of their complexity from users and concomitantly imperil the "shared responsibility" model putatively at the heart of secure cloud adoption.

This report seeks to bring attention to the increasing reliance of CI on cloud services and to the unique dynamics of cloud risk that policymakers must grapple with in thinking through managing the new forms of risk created by this transition. As more entities adopt the cloud, and as more of the core infrastructure of systems like the Internet come to rely on it, this dependence and the systemic nature of its attendant risks will only compound. Risk management must have visibility. The thrust, therefore, of this report's recommendations is towards increased fact-finding and awareness as a key first step for policy.

It is time to address the fact that the cloud may have already become critical by the metrics policymakers use when considering whether a system needs oversight to ensure its resilience. Thankfully, it is not too late for judicious policymaking to earnestly engage with cloud risks to create a more robust regulatory framework suited for the cloud's present and increasing role as a linchpin of critical national functions.

Authors and Acknowledgments

Tianjiu Zuo is a research associate at the Atlantic Council's Cyber Statecraft Initiative. He primarily focuses on the risks and implications of cloud computing and examines cyber-related national security issues. He is recent graduate of Duke University with a BS in economics and a BA in public policy.

Justin Sherman is a nonresident fellow at the Atlantic Council's Cyber Statecraft Initiative, where his work focuses on internet geopolitics, governance, and security as well as Russian and Indian technology policy and strategy. He is also the founder and CEO of Global Cyber Strategies, a Washington, DC-based research and advisory firm; and a senior fellow at Duke University's Sanford School of Public Policy, where he leads its data brokerage research project and lectures on cybersecurity, privacy, and technology policy.

Maia Hamin is an associate director with the Atlantic Council's Cyber Statecraft Initiative under the Digital Forensic Research Lab (DFRLab). She works on the Initiative's Systems Security portfolio, which focuses on policy for open-source software, cloud, and other technologies with important systemic security effects.

Stewart Scott is an associate director with the Atlantic Council's Cyber Statecraft Initiative under the Digital Forensic Research Lab (DFRLab). He works on the Initiative's systems security portfolio, which focuses on software supply chain risk management and open source software security policy.

The authors would like to thank Trey Herr, Josephine Wolff, Rich Mogull, Marc Rogers, Scott Piper, Jim Higgins, and Frank Reyes for feedback on various versions of this document. The authors would also like to thank the numerous individuals who spoke with them on background for this report, as well as the participants, who shall remain anonymous, in three workshops on cloud security. Finally, the authors would like to thank Trey Herr, Simon Handler, and Lily Liu for their intellectual support on cloud issues.

# data[].attributes.attachment_link.title
Critical Infrastructure and the Cloud: Policy for Emerging Risk

# data[].attributes.attachment_link.description
Critical infrastructure increasingly depends on cloud computing. Cloud risk is different from previous paradigms', and policy must adapt.

# data[].attributes.headline
Businesses are ignoring third-party security risks

# data[].attributes.subject
Businesses are ignoring third-party security risks

# data[].attributes.body
In the dynamic business landscape where third-party relationships assume a critical role, organizations confront various risks that can profoundly affect their security and compliance requirements, according to Panorays.

Even amidst tough economic times, the crucial nature of these risks necessitates proactive management. This report unveils statistics and trends that shed light on the pressing challenges and emerging strategies in third-party risk management.

# data[].attributes.body
This article is based on research by Marcelo Rivero, Malwarebytes' ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, "known attacks" are those where the victim did not pay a ransom. This provides the best overall picture of ransomware activity, but the true number of attacks is far higher.

Following a three-month lull of activity, Cl0p returned with a vengeance in June and beat out LockBit as the month’s most active ransomware gang. The group's 91 attacks come not long after their extensive GoAnywhere campaign in March, when they hit over 100 organizations using a nasty zero-day.

June also witnessed a staggering increase in attacks from relatively new gangs such as Akira (26) and 8Base (41), enough to propel both of them into the top five—a designation usually reserved for more familiar names like ALPHV, who was conspicuously silent in June. https://www.malwarebytes.com/blog/threat-intelligence/2023/07/ransomware-review-july-2023

Other big stories in June include a suspected LockBit affiliate arrest, the Royal ransomware gang toying with a new encryptor, and a notable increase in attacks on the Manufacturing sector.

# data[].attributes.attachment_link.readable_text
This article is based on research by Marcelo Rivero, Malwarebytes' ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, "known attacks" are those where the victim did not pay a ransom. This provides the best overall picture of ransomware activity, but the true number of attacks is far higher.
Following a three-month lull of activity, Cl0p returned with a vengeance in June and beat out LockBit as the month's most active ransomware gang. The group's 91 attacks come not long after their extensive GoAnywhere campaign in March, when they hit over 100 organizations using a nasty zero-day.

June also witnessed a staggering increase in attacks from relatively new gangs such as Akira (26) and 8Base (41), enough to propel both of them into the top five-a designation usually reserved for more familiar names like ALPHV, who was conspicuously silent in June.

Other big stories in June include a suspected LockBit affiliate arrest, the Royal ransomware gang toying with a new encryptor, and a notable increase in attacks on the Manufacturing sector.

Known ransomware attacks by gang, June 2023

Comparing June to the earlier months of the year, we notice several shifts in ransomware activity. There was a massive decrease in the activity from Royal, for example, which normally dominates the monthly rankings-often cracking into the top five-with an average of roughly 30 attacks a month in that period. But last month, they posted just two victims.

While a sudden dip in attacks isn't too unusual for top ransomware gangs, it's worth mentioning that in last month's review we speculated that Royal might be going through a rebrand. That's because a new ransomware called BlackSuit had appeared which shared 98 percent of its code with the infamous Royal ransomware.

Considering that both Royal and BlackSuit were active last month, however, a rebrand probably isn't happening any time soon. Instead, it's likely that Royal is simply testing a new encryptor-especially considering that BlackSuit was used in just two attacks last month-and that this lull can be explained as more or less of a research period for them.

Other interesting anomalies in June include 47 attacks on the Manufacturing industry (which usually averages around 20 attacks a month) and notable increases in attacks on Switzerland (14) and Brazil (13), both of which are normally attacked only two or three times a month. Part of this can be explained by the fact that 8BASE disproportionately attacked Brazil with 11 attacks last month, while PLAY focused on Switzerland (5).

Known ransomware attacks by country, June 2023

Known ransomware attacks by industry sector, June 2023

Cl0p's precipitous rise to the top of the charts this month, on the other hand, can be explained by their exploitation of a zero-day in MOVEit Transfer, a widely used file transfer software.

The vulnerability, which could allow attackers to gain escalated privileges and unauthorized access to an environment, was first disclosed on May 31st in a security bulletin released by Progress. But while it was clear earlier on that attackers were actively exploiting CVE-2023-34362, it was only a few days later that it became clear that Cl0p was behind the attacks. A Cl0p representative confirmed that they had been testing the vulnerability since July 2021 and that they had decided to deploy it over the Memorial Day weekend. What's more, two other vulnerabilities i n MOVEit were found while new victims were still coming forward.

In terms of the fallout, it's tough to overstate the havoc Cl0p was able to wreck thanks to the zero-day.

The MOVEit data breaches had widespread impacts, affecting everything from the Oregon DMV and Louisiana OMV (Office of Motor Vehicles)-including the leak of nearly 10 million drivers' licenses-to the University of Rochester and multiple corporations. PBI Research Services also reported a data breach that exposed information for 4.75 million people. The government even offered a reward of up to $10 million for information on Cl0p after several federal agencies in the US fell victim to the gang.

LockBit

LockBit reportedly squeezed about $91 million out of US organizations with around 1,700 attacks since 2020, according to a June report by CISA. As confirmed by our own research data, CISA also found LockBit took the top spot as the biggest global ransomware threat in 2022.

As for who was hit the hardest, around 16 percent of ransomware incidents affecting State, Local, Tribal, and Tribunal (SLTT) governments were from LockBit, says the MS-ISAC.

In other news, a suspected LockBit affiliate named Ruslan Magomedovich Astamirov, a 20-year-old from the Chechen Republic, was arrested in Arizona last month. The US Justice Department thinks he's been deploying LockBit ransomware on victim networks both in the States and overseas, with the investigation having run from August 2020 through March 2023.

Astamirov is now facing charges of wire fraud and of intentionally damaging protected computers, plus he's accused of making ransom demands through deploying ransomware. The arrest makes him the third LockBit affiliate charged in the US since November.

Newcomers

NoEscape

NoEscape is a new ransomware which been doing the rounds in underground forums since May 2023. Developed in-house using C++, the NoEscape ransomware uses a hybrid approach to encryption, combining ChaCha20 and RSA encryption algorithms for file encryption and key protection.

Last month, NoEscape posted 7 victims on their leak site.

Darkrace

DarkRace is a new ransomware group first discovered by researcher S!Ri. Darkrace specifically targets Windows operating systems and has several similarities to LockBit.

The gang attacked 10 victims last month, the majority of them being from the Information and Communications Technology (ICT) sectors. Geographically, most victims are located in Europe, specifically Italy.

Rhysida

Rhysida, a new ransomware gang claiming to be a "cybersecurity team," has been in operation since May 17, 2023, making headlines for their high-profile attack against the Chilean Army.

The gang published a whopping eighteen victims on their leak site in June, making it one of the most prolific newcomers in our month reviews to-date.

# data[].attributes.attachment_link.description
Following a three-month lull of activity, Cl0p returned with a vengeance in June and beat out LockBit as the month's most active ransomware gang.

# data[].attributes.headline
Enquête : 98 % des grandes entreprises françaises victimes de fuites sur le web

# data[].attributes.subject
Enquête : 98 % des grandes entreprises françaises victimes de fuites sur le web

# data[].attributes.body
La quasi-totalité des grandes entreprises françaises ont des données stratégiques accessibles sur le dark web. Dans 90 % des cas, ce sont leurs prestataires qui ont été attaqués.

Dans le dark web, nous avons retrouvé des notes d’avocats, des factures, des plans d’usines, des données bancaires, des dossiers de comités d’entreprises, des dossiers de consultants extérieurs, des dossiers juridiques en cours de jugement… Et tout cela uniquement sur lesserveurs de LockBit, le groupe criminel le plus actif au monde.

# data[].attributes.attachment_link.title
Enquête. EXCLUSIF. 98 % des grandes entreprises françaises victimes de fuites sur le web

# data[].attributes.attachment_link.description
La quasi-totalité des grandes entreprises françaises ont des données stratégiques accessibles sur le dark web. Dans 90 % des cas, ce sont leurs prestataires qui ont été attaqués.

# data[].attributes.body
This is the first analysis conducted by the European Union Agency for Cybersecurity (ENISA) of the cyber threat landscape of the health sector in the EU. The report aims to bring new insights into the reality of the health sector by mapping and studying cyber incidents from January 2021 to March 2023. It identifies prime threats, actors, impacts and trends based on the analysis of cyberattacks targeting health organisations over a period of more than 2 years.

# data[].attributes.attachment_link.readable_text
This is the first analysis conducted by the European Union Agency for Cybersecurity (ENISA) of the cyber threat landscape of the health sector in the EU. The report aims to bring new insights into the reality of the health sector by mapping and studying cyber incidents from January 2021 to March 2023. It identifies prime threats, actors, impacts and trends based on the analysis of cyberattacks targeting health organisations over a period of more than 2 years.

# data[].attributes.attachment_link.description
This is the first analysis conducted by the European Union Agency for Cybersecurity (ENISA) of the cyber threat landscape of the health sector in the EU. The report aims to bring new insights into the reality of the health sector by mapping and studying cyber incidents from January 2021 to March 2023.

# data[].attributes.headline
Cyberattacks on critical infrastructure a major concern

# data[].attributes.subject
Cyberattacks on critical infrastructure a major concern

# data[].attributes.body
Cyberattacks on critical infrastructure are increasing especially with the growing tech adoption in these facilities. Some of the most commonly targeted critical infrastructure include gas pipelines, energy grids, transportation systems, oil refineries and healthcare facilities.

The Cybersecurity and Infrastructure Security Agency categorizes critical infrastructure into sixteen sectors. They include:

Chemical sector

Commercial Facilities sector

Communications sector

Critical Manufacturing sector

Dams sector

Defense Industrial Base sector

Emergency Services sector

Energy sector

Financial Services sector

Food and Agriculture sector

Government Facilities sector

Healthcare and Public Health sector

Information Technology sector

Nuclear Reactors, Materials and Waste sector

Transportation Systems sector

Waster and Wastewater systems

# data[].attributes.attachment_link.readable_text
Cyberattacks on critical infrastructure are increasing especially with the growing tech adoption in these facilities. Some of the most commonly targeted critical infrastructure include gas pipelines, energy grids, transportation systems, oil refineries and healthcare facilities.

The Cybersecurity and Infrastructure Security Agency categorizes critical infrastructure into sixteen sectors. They include:

Chemical sector

Commercial Facilities sector

Communications sector

Critical Manufacturing sector

Dams sector

Defense Industrial Base sector

Emergency Services sector

Energy sector

Financial Services sector

Food and Agriculture sector

Government Facilities sector

Healthcare and Public Health sector

Information Technology sector

Nuclear Reactors, Materials and Waste sector

Transportation Systems sector

Waster and Wastewater systems

Most countries around the world also have named similar sectors as critical infrastructure. Any damage to this infrastructure, be it via natural disasters, terrorism or cyberattacks could lead to serious consequences for a country, especially on its economy and the wellbeing of the citizens.

Cybercriminals are aware of this and have continued to launch cyberattacks on these sectors. Some of the biggest critical infrastructure attacks include the ransomware cyberattack on Colonial Pipeline and JBS meat company. Both attacks disrupted the supply chain of products in affected countries.

A more concerning cyberattack was on a water treatment plant in Florida in 2021. A cybercriminal had hacked the controls of the facility and adjusted the levels of sodium hydroxide in the water, which could end up poisoning thousands of users. An employee noticed the intrusion and was able to stop the attack.

The UK government's intelligence and security arm also issued an alert on Russian state-aligned threat actors aiming to conduct disruptive and destructive attacks against critical infrastructure in Western countries several weeks ago. More recently, critical infrastructure cyberattacks are also occurring in Asia. Several weeks ago, a tank storage facility in Malaysia fell victim to a ransomware attack.

Cybercriminals target Japan's largest port

In Japan, the country's largest port suffered a ransomware attack that disrupted port services. According to a report by Nikkei Asia, the port of Nagoya, which is also responsible for handling some of Toyota Motor's car exports, suffered a crippling system glitch, which the port operator suspects to be a cyberattack.

The port operator also received a ransom demand in exchange for the recovery of the port's loading system. The system was used to load and unload containers from trailers. An employee noticed the system failure when he could not start a computer.

Fortunately, the disruption lasted less than 48 hours as the port planned to resume operations. A Reuters report stated that the computer system had fully been recovered, but that was later than expected and the resumption of terminal operations has been pushed back by half a day.

Media reports also indicated that LockBit 3.0, a Russian hacking group based in Russia was responsible for the cyberattack on the critical infrastructure. Japanese authorities are still investigating the cyberattack and ransom demand.

Russian hacker groups continue to target critical infrastructures around the world. Britain's National Cyber Security Center (NCSC) has warned of emerging threats to Western critical infrastructure by hackers that are sympathetic to Russia and its war on Ukraine. The agency mentioned that Russia-aligned "hacktivists" have carried out largely harmless online campaigns that have defaced prominent public websites or knocked them offline. However, some of those groups have been actively plotting ways to do more real-world damage.

Apart from Russian hacker groups, Chinese hacker groups have also been planning cyberattacks in the US. According to a report by Reuters, the US State Department has warned that China was capable of launching cyberattacks against critical infrastructure, including oil and gas pipelines and rail systems, after researchers discovered a Chinese hacking group had been spying on such networks.

In a multi-nation alert issued, the agency revealed the Chinese cyber-espionage campaign had been aimed at military and government targets in the United States. The Chinese government has rejected assertions that its spies are going after Western targets, calling the warning issued by the United States and its allies a "collective disinformation campaign."

Securing critical infrastructure

Securing critical infrastructure is of paramount importance for organizations to protect essential systems and services from cyber threats and physical attacks. Organizations need to conduct a comprehensive risk assessment to identify vulnerabilities, threats, and potential consequences. They also need to understand the potential impact of an attack on critical systems and prioritize security measures accordingly.

For cybersecurity, apart from implementing strong access controls, organizations need to consider network segmentation. This divides the critical infrastructure into separate segments to contain potential breaches and prevent the lateral movement of attackers. Other considerations include having firewalls and deploying intrusion detection/prevention systems (IDS/IPS). These technologies help monitor and filter network traffic, detect anomalies, and prevent unauthorized access.

More importantly, all software and firmware need to be kept up to date to address known vulnerabilities and exploits. Organizations should also utilize strong encryption methods to protect sensitive data at rest and in transit. Implement robust security monitoring systems that actively detect and respond to security incidents in real time. Lastly, organizations should conduct regular cybersecurity awareness training for employees to educate them about best practices, social engineering threats, and how to handle suspicious emails or attachments.

# data[].attributes.attachment_link.title
Cyberattacks on critical infrastructure a major concern

# data[].attributes.attachment_link.description
Japan's largest port, which is a critical infrastructure suffered a ransomware attack that disrupted port services.

# data[].attributes.headline
Google DeepMind CEO Demis Hassabis Says Its Next Algorithm Will Eclipse ChatGPT

# data[].attributes.subject
Google DeepMind CEO Demis Hassabis Says Its Next Algorithm Will Eclipse ChatGPT

# data[].attributes.body
IN 2016, AN artificial intelligence program called AlphaGo from Google’s DeepMind AI lab made history by defeating a champion player of the board game Go. Now Demis Hassabis, DeepMind’s cofounder and CEO, says his engineers are using techniques from AlphaGo to make an AI system dubbed Gemini that will be more capable than that behind OpenAI’s ChatGPT.

# data[].attributes.attachment_link.readable_text
In 2014, DeepMind was acquired by Google after demonstrating striking results from software that used reinforcement learning to master simple video games. Over the next several years, DeepMind showed how the technique does things that once seemed uniquely human-often with superhuman skill. When AlphaGo beat Go champion Lee Sedol in 2016, many AI experts were stunned, because they had believed it would be decades before machines would become proficient at a game of such complexity.

Training a large language model like OpenAI's GPT-4 involves feeding vast amounts of curated text from books, webpages, and other sources into machine learning software known as a transformer. It uses the patterns in that training data to become proficient at predicting the letters and words that should follow a piece of text, a simple mechanism that proves strikingly powerful at answering questions and generating text or code.

An important additional step in making ChatGPT and similarly capable language models is using reinforcement learning based on feedback from humans on an AI model's answers to finesse its performance. DeepMind's deep experience with reinforcement learning could allow its researchers to give Gemini novel capabilities.

Hassabis and his team might also try to enhance large language model technology with ideas from other areas of AI. DeepMind researchers work in areas ranging from robotics to neuroscience, and earlier this week the company demonstrated an algorithm capable of learning to perform manipulation tasks with a wide range of different robot arms.

Learning from physical experience of the world, as humans and animals do, is widely expected to be important to making AI more capable. The fact that language models learn about the world indirectly, through text, is seen by some AI experts as a major limitation.

Hassabis is tasked with accelerating Google's AI efforts while also managing unknown and potentially grave risks. The recent, rapid advancements in language models have made many AI experts-including some building the algorithms-worried about whether the technology will be put to malevolent uses or become difficult to control. Some tech insiders have even called for a pause on the development of more powerful algorithms to avoid creating something dangerous.

Hassabis says the extraordinary potential benefits of AI-such as for scientific discovery in areas like health or climate-make it imperative that humanity does not stop developing the technology. He also believes that mandating a pause is impractical, as it would be near impossible to enforce. "If done correctly, it will be the most beneficial technology for humanity ever," he says of AI. "We've got to boldly and bravely go after those things."

That doesn't mean Hassabis advocates AI development proceeds in a headlong rush. DeepMind has been exploring the potential risks of AI since before ChatGPT appeared, and Shane Legg, one of the company's cofounders, has led an "AI safety" group within the company for years. Hassabis joined other high-profile AI figures last month in signing a statement warning that AI might someday pose a risk comparable to nuclear war or a pandemic.

One of the biggest challenges right now, Hassabis says, is to determine what the risks of more capable AI are likely to be. "I think more research by the field needs to be done-very urgently-on things like evaluation tests," he says, to determine how capable and controllable new AI models are. To that end, he says, DeepMind may make its systems more accessible to outside scientists. "I would love to see academia have early access to these frontier models," he says-a sentiment that if followed through could help address concerns that experts outside big companies are becoming shut out of the newest AI research.

How worried should you be? Hassabis says that no one really knows for sure that AI will become a major danger. But he is certain that if progress continues at its current pace, there isn't much time to develop safeguards. "I can see the kinds of things we're building into the Gemini series right, and we have no reason to believe that they won't work," he says.

# data[].attributes.attachment_link.title
Google DeepMind CEO Demis Hassabis Says Its Next Algorithm Will Eclipse ChatGPT

# data[].attributes.attachment_link.description
The company is working on a system called Gemini that will draw on techniques that powered AlphaGo to a historic victory over a Go champion in 2016.

# data[].attributes.headline
AI Agents With ‘Multiple Selves’ Learn to Adapt Quickly in a Changing World

# data[].attributes.subject
AI Agents With ‘Multiple Selves’ Learn to Adapt Quickly in a Changing World

# data[].attributes.body
In a new study published in PNAS, the team took a page from cognitive neuroscience and built a modular AI agent.

The idea is seemingly simple. Rather than a monolithic AI—a single network that encompasses the entire “self”—the team constructed a modular agent, each part with its own “motivation” and goals but commanding a single “body.” Like a democratic society, the AI system argues within itself to decide on the best response, where the action most likely to yield the largest winning outcome guides its next step.

In several simulations, the modular AI outperformed its classic monolithic peer. Its adaptability especially shined when the researchers artificially increased the number of goals that it had to simultaneously maintain. The Lego-esque AI rapidly adapted, whereas its monolithic counterpart struggled to catch up.

# data[].attributes.attachment_link.title
AI Agents With ‘Multiple Selves’ Learn to Adapt Quickly in a Changing World

# data[].attributes.attachment_link.description
The AI argues with itself to decide on the best response, where the action most likely to yield a winning outcome guides its next step.

# data[].attributes.headline
Generative AI's secret sauce - data scraping- comes under attack

# data[].attributes.subject
Generative AI's secret sauce - data scraping- comes under attack

# data[].attributes.body
Web scraping for massive amounts of data can arguably be described as the secret sauce of generative AI. After all, AI chatbots like ChatGPT, Claude, Bard and LLaMA can spit out coherent text because they were trained on massive corpora of data, mostly scraped from the internet. And as the size of today’s LLMs like GPT-4 have ballooned to hundreds of billions of tokens, so has the hunger for data.

Data scraping practices in the name of training AI have come under attack over the past week on several fronts. OpenAI was hit with two lawsuits. One, filed in federal court in San Francisco, alleges that OpenAI unlawfully copied book text by not getting consent from copyright holders or offering them credit and compensation. The other claims OpenAI’s ChatGPT and DALL·E collect people’s personal data from across the internet in violation of privacy laws.

# data[].attributes.attachment_link.readable_text
Web scraping for massive amounts of data can arguably be described as the secret sauce of generative AI. After all, AI chatbots like ChatGPT, Claude, Bard and LLaMA can spit out coherent text because they were trained on massive corpora of data, mostly scraped from the internet. And as the size of today's LLMs like GPT-4 have ballooned to hundreds of billions of tokens, so has the hunger for data.

Data scraping practices in the name of training AI have come under attack over the past week on several fronts. OpenAI was hit with two lawsuits. One, filed in federal court in San Francisco, alleges that OpenAI unlawfully copied book text by not getting consent from copyright holders or offering them credit and compensation. The other claims OpenAI's ChatGPT and DALL·E collect people's personal data from across the internet in violation of privacy laws.

Twitter also made news around data scraping, but this time it sought to protect its data by limiting access to it. In an effort to curb the effects of AI data scraping, Twitter temporarily prevented individuals who were not logged in from viewing tweets on the social media platform and also set rate limits for how many tweets can be viewed.
>>Follow VentureBeat's ongoing generative AI coverage<<
Event

VB Transform 2023 On-Demand

Register Now

For its part, Google doubled down to confirm that it scrapes data for AI training. Last weekend, it quietly updated its privacy policy to include Bard and Cloud AI alongside Google Translate in the list of services where collected data may be used.

A leap in public understanding of generative AI models

All of this news around scraping the web for AI training is not a coincidence, Margaret Mitchell, researcher and chief ethics scientist at Hugging Face, told VentureBeat by email.

"I think it's a pendulum swing," she said, adding that she had previously predicted that by the end of the year, OpenAI may be forced to delete at least one model because of these data issues. The recent news, she said, made it clear that a path to that future is visible - so she admits that "it is optimistic to think something like that would happen while OpenAI is cozying up to regulators so much."

But she says the public is learning more about generative AI models, so the pendulum has swung from rapt fascination with ChatGPT to wondering where the data for these models comes from.

"The public first had to learn that ChatGPT is based on a machine learning model," Mitchell explained, and that there are similar models everywhere and that these models "learn" from training data. "All of that is a massive leap forward in public understanding over just the past year," she emphasized.

Renewed debate around data scraping has "been percolating," agreed Gregory Leighton, a privacy law specialist at law firm Polsinelli. The OpenAI lawsuits alone, he said, are enough of a flashpoint to make other pushback inevitable. "We're not even a year into the large language model era - it was going to happen at some point," he said. "And [companies like] Google and Twitter are bringing some of these things to a head in their own contexts."

For companies, the competitive moat is the data

Katie Gardner, a partner at international law firm Gunderson Dettmer, told VentureBeat by email that for companies like Twitter and Reddit, the "competitive moat is in the data" - so they don't want anyone scraping it for free.

"It will be unsurprising if companies continue to take more actions to find ways to restrict access, maximize use rights and retain monetization opportunities for themselves," she said. "Companies with significant amounts of user-generated content who may have traditionally relied on advertising revenue could benefit significantly by finding new ways to monetize their user data for AI model training," whether for their own proprietary models or by licensing data to third parties.

Polsinelli's Leighton agreed, saying that organizations need to shift their thinking about data. "I've been saying to my clients for some time now that we shouldn't be thinking about ownership about data anymore, but about access to data and data usage," he said. "I think Reddit and Twitter are saying, well, we're going to put technical controls in place, and you're going have to pay us for access - which I do think puts them in a slightly better position than other [companies]."

Different privacy issues around data scraping for AI training

While data scraping has been flagged for privacy issues in other contexts, including digital advertising, Gardner said the use of personal data in AI models presents unique privacy issues as compared to general collection and use of personal data by companies.

One, she said, is the lack of transparency. "It's very difficult to know if personal data was used, and if so, how it is being used and what the potential harms are from that use - whether those harms are to an individual or society in general," she said, adding that the second issue is that once a model is trained on data, it may be impossible to "untrain it" or delete or remove data. "This factor is contrary to many of the themes of recent privacy regulations which vest more rights in individuals to be able request access to and deletion of their personal data," she explained.

Mitchell agreed, adding that with generative AI systems there is a risk of private information being re-produced and re-generated by the system. "That information [risks] being further amplified and proliferated, including to bad actors who otherwise would not have had access or known about it," she said.

Is this a moot point where models that are already trained are concerned? Could a company like OpenAI be off the hook for GPT-3 and GPT-4, for example? According to Gardner, the answer is no: "Companies who have previously trained models will not be exempt from future judicial decisions and regulation."

That said, how companies will comply with stringent requirements is an open issue. "Absent technical solutions, I suspect at least some companies may need to completely retrain their models - which could be an enormously expensive endeavor," Gardner said. "Courts and governments will need to balance the practical harms and risks in their decision-making against those costs and the benefits this technology can provide society. We are seeing a lot of lobbying and discussions on all sides to facilitate sufficiently informed rule-making."

'Fair use' of scraped data continues to drive discussion

For creators, much of the discussion around data scraping for AI training revolves around whether or not copyrighted works can be determined to be "fair use" according to U.S. copyright law - which " permits limited use of copyrighted material without having to first acquire permission from the copyright holder" - as many companies like OpenAI claim.

But Gardner points out that fair use is "a defense to copyright infringement and not a legal right." In addition, it can also be very difficult to predict how courts will come out in any given fair use case, she said: "There is a score of precedent where two cases with seemingly similar facts were decided differently."

But she emphasized that there is Supreme Court precedent that leads many to infer that use of copyrighted materials to train AI can be fair use based on the transformative nature of such use - i.e. it doesn't transplant the market for the original work.

"However, there are scenarios where it may not be fair use - including, for example, if the output of the AI model is similar to the copyrighted work," she said. "It will be interesting to see how this plays out in the courts and legislative process - especially because we've already seen many cases where user prompting can generate output that very plainly appears to be a derivative of a copyrighted work, and thus infringing."

Scraped data in today's proprietary models remains unknown

The problem is, however, that no one knows what is in the datasets included in today's sophisticated proprietary generative AI models like OpenAI's GPT-4 and Anthropic's Claude.

In a recent Washington report, researchers at the Allen Institute for AI helped analyze one large dataset to show "what types of proprietary, personal, and often offensive websites ... go into an AI's training data." But while the dataset, Google's C4, included sites known for pirated e-books, content from artist websites like Kickstarter and Patreon, and a trove of personal blogs, it's just one example of a massive dataset; a large language model may use several. The recently released open-source RedPajama, which replicated the LLaMA dataset to build open-source, state-of-the-art LLMs, includes slices of datasets that include data from Common Crawl, arxiv, Github, Wikipedia and a corpus of open books.

But OpenAI's 98-page technical report released in March about the development of GPT-4 was notable mostly for what it did not include. In a section called "Scope and Limitations of this Technical Report," it says: "Given both the competitive landscape and the safety implications of large-scale models like GPT-4, this report contains no further details about the architecture (including model size), hardware, training compute, dataset construction, training method, or similar."

Data scraping discussion is a 'good sign' for generative AI ethics

Debates around datasets and AI have been going on for years, Mitchell pointed out. In a 2018 paper, " Datasheets for Datasets," AI researcher Timnit Gebru wrote that "currently there is no standard way to identify how a dataset was created, and what characteristics, motivations, and potential skews it represents."

The paper proposed the concept of a datasheet for datasets, a short document to accompany public datasets, commercial APIs and pretrained models. "The goal of this proposal is to enable better communication between dataset creators and users, and help the AI community move toward greater transparency and accountability."

While this may currently seem unlikely given the current trend towards proprietary "black box" models, Mitchell said she considered the fact that data scraping is under discussion right now to be a "good sign that AI ethics discourse is further enriching public understanding."

"This kind of thing is old news to people who have AI ethics careers, and something many of us have discussed for years," she added. "But it's starting to have a public breakthrough moment - similar to fairness/bias a few years ago - so that's heartening to see."

VentureBeat's mission is to be a digital town square for technical decision-makers to gain knowledge about transformative enterprise technology and transact. Discover our Briefings.

# data[].attributes.attachment_link.title
Generative AI's secret sauce - data scraping- comes under attack

# data[].attributes.attachment_link.description
Data scraping of the internet for massive amounts of data could be described as generative AI's secret sauce. Experts say the current blowback is unsurprising.

# data[].attributes.headline
GPT-3 informiert und fehlinformiert uns besser

# data[].attributes.subject
GPT-3 informiert und fehlinformiert uns besser

# data[].attributes.body
Eine neue Studie von Forschenden der Universität Zürich untersuchte die Fähigkeiten von KI-Modellen, insbesondere GPT-3 von OpenAI, im Hinblick auf potenzielle Risiken und Vorteile bei der Erzeugung und Verbreitung von (Des-)Information. Unter der Leitung der Postdoktoranden Giovanni Spitale und Federico Germani, gemeinsam mit Nikola Biller-Andorno, Direktorin des Instituts für Biomedizinische Ethik und Geschichte der Medizin (IBME) der Universität Zürich, wurde in der Studie untersucht, ob Personen zwischen Desinformation und korrekten Informationen in Form von Tweets unterscheiden können. Darüber hinaus wollten die Forschenden herausfinden, ob die 697 Teilnehmenden der Studie erkennen, ob ein Tweet von einem realen Twitter-Nutzer verfasst oder von GPT-3, einem fortschrittlichen KI-Sprachmodell, generiert wurde. Die Themenfelder der Tweets beinhalteten unter anderem den Klimawandel, die Sicherheit von Impfstoffen, die COVID-19-Pandemie, die Theorie, die Erde sei eine Scheibe, und homöopathische Behandlungen für Krebs.

# data[].attributes.headline
Counter-terrorism 'rhetoric' used to justify rise of surveillance technology: human rights expert

# data[].attributes.subject
Counter-terrorism 'rhetoric' used to justify rise of surveillance technology: human rights expert

# data[].attributes.body
In a report to the latest session of the Human Rights Council, the UN Special Rapporteur on the promotion and protection of human rights while countering terrorism, Fionnuala Ní Aoláin, warned of an alarming increase in the use of “intrusive and high-risk technologies”, according to a press release issued by the UN human rights office (OHCHR).

This includes drones, biometrics, artificial intelligence (AI) and spyware, which is being ramped up in the ongoing fight against terrorism, without due regard for the rule of law, governance and human rights, she said.

# data[].attributes.attachment_link.readable_text
In a report to the latest session of the Human Rights Council, the UN Special Rapporteur on the promotion and protection of human rights while countering terrorism, Fionnuala Ní Aoláin, warned of an alarming increase in the use of "intrusive and high-risk technologies", according to a press release issued by the UN human rights office ( OHCHR).

This includes drones, biometrics, artificial intelligence (AI) and spyware, which is being ramped up in the ongoing fight against terrorism, without due regard for the rule of law, governance and human rights, she said.

Exception becoming the norm

"Exceptional justifications for the use of surveillance technologies in human rights 'lite' counter-terrorism often turn into mundane regular use," said Ms. Ní Aoláin, pointing to the impact on fundamental rights such as freedom of movement, freedom of expression, freedom of peaceful assembly and the right to privacy.

" There must be a pause in the use of intrusive high-risk technologies until adequate safeguards are in place," she said.

The Human Rights Council-appointed independent expert expressed concern about the growing domestication of the use of drones in several countries, the widespread misuse of spyware technology against civil society groups, dissidents and journalists, and the increasing adoption of biometric data collection.

'Unregulated transfers' must end

"The unregulated transfer of high-risk technologies to States engaging in systematic human rights violations must end," the Special Rapporteur said. She urged authorities to more effectively regulate companies involved in the transfer of surveillance technologies abroad.

"In the absence of regulation, the cost to human rights can only increase with no end in sight," Ms. Ní Aoláin said.

Global ban on 'killer robots'

She joined the call for a global ban on lethal autonomous weapons systems and highlighted the specific obligations of the various UN counter-terrorism bodies to ensure that any guidance and advice provided on new technologies is fully consistent with the UN Charter, and international law.

Instead, she presented to the Council in her new report a new and innovative approach to regulating spyware, which would focus on ensuring that "minimum human rights standards" are applied, by both governments and companies, in the development, use and transfer of high-risk surveillance technologies.

# data[].attributes.attachment_link.title
Counter-terrorism 'rhetoric' used to justify rise of surveillance technology: human rights expert

# data[].attributes.attachment_link.description
Some countries and private companies are using "counter-terrorism and security rhetoric" to justify a major increase in the deployment and use of cutting-edge surveillance technology, with no regulation, and at an "enormous cost" to human rights, said an independent UN expert on Tuesday.

# data[].attributes.headline
BLACKOUT : Diego Kuonen - Analyste des données Cyber - Université de Genève

# data[].attributes.subject
BLACKOUT : Diego Kuonen - Analyste des données Cyber - Université de Genève

# data[].attributes.attachment_link.title
BLACKOUT : Diego Kuonen - Analyste des données Cyber - Université de Genève

# data[].attributes.headline
Here’s how AI is being used in elections: expert

# data[].attributes.subject
Here’s how AI is being used in elections: expert

# data[].attributes.attachment_link.description
Listen to Der Ausfall - Deutschland ohne Strom on Spotify. Zehn Studierende der Hochschule Ansbach in Bayern haben für Sie die Gefahr von europaweiten Stromausfällen - sogenannten Blackouts - recherchiert. In der Podcastreihe "Der Ausfall - Deutschland ohne Strom" erfahren Sie, wie ein solcher Blackout entstehen kann.

# data[].attributes.body
The video showcases the development of Boston Dynamics' robot named Atlas from 1983 to the present day. The company, founded by MIT professor Marc Raibert, who idealized and brought agile and dynamic robots into everyday life, has created iconic robots like BigDog, Atlas, and Spot, pushing boundaries in robot mobility and dexterity. In 2020, the company was acquired by Hyundai Motor Group.