UNITED STATES. DEPARTMENT OF HOMELAND SECURITY. OFFICE OF INTELLIGENCE AND ANALYSIS; UNITED STATES. FEDERAL BUREAU OF INVESTIGATION; CANADIAN CENTRE FOR CYBER SECURITY; ESTONIAN NATIONAL CYBER SECURITY CENTRE; JAPAN COMPUTER EMERGENCY RESPONSE TEAM COORDINATION CENTER; NATIONAL CENTER OF INCIDENT READINESS AND STRATEGY FOR CYBERSECURITY JAPAN; FINLAND. NATIONAL CYBER SECURITY CENTRE; JAPAN. NATIONAL POLICE AGENCY; UNITED KINGDOM. NATIONAL CYBER SECURITY CENTRE

From the document: "Civil society--nonprofit, advocacy, cultural, faith-based, academic, think tanks, journalist, dissident, and diaspora organizations, communities, and individuals involved in defending human rights and advancing democracy--are considered high-risk communities. Often, these organizations and their employees are targeted by state-sponsored threat actors who seek to undermine democratic values and interests. Regularly conducted as a type of transnational repression (also referred to as digital transnational repression), state-sponsored actors compromise organizational or personal devices and networks to intimidate, silence, coerce, harass, or harm civil society organizations and individuals. According to industry reporting, state-sponsored targeting of high-risk communities predominantly emanates from the governments of Russia, China, Iran, and North Korea. Actors typically perform extensive pre-operational research to learn about potential victims, gather information to support social engineering, or obtain login credentials. Actors target organization networks or personal accounts (e.g., email) and devices of individuals for surveillance and monitoring, often via spyware applications--malicious software that collects data from affected devices. This guide provides recommendations for civil society organizations and individuals to mitigate the threat of state-sponsored cyber operations based on observed malicious behavior. The guide also provides recommendations for software manufacturers to improve the security posture of their customers."

UNITED STATES. CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY. 14 MAY, 2024. 19p.

UNITED STATES. SPACE FORCE

From the document: "The threats the United States faces from its strategic competitors have grown substantially. At the same time, the environment is being shaped by a rapidly growing commercial space sector, which is cultivating an ecosystem of innovation and reducing barriers to entry to deliver new, operationally relevant capabilities. This has extraordinary implications for global security and stability. The United States Space Force (USSF) will be more resilient and capable if it combines organic capabilities with the capabilities from other providers. Therefore, the USSF will integrate a mix of organic, allied, and commercial space solutions into hybrid architectures where the nation's space capabilities truly are greater than the sum of the parts. The USSF will leverage the commercial sector's innovative capabilities, scalable production, and rapid technology refresh rates to enhance the resilience of national security space architectures, strengthen deterrence, and support Combatant Commander objectives in times of peace, competition, crisis, conflict, and post-conflict."

UNITED STATES. DEPARTMENT OF THE AIR FORCE. 8 APR, 2024. 19p.

UNITED STATES. EXECUTIVE OFFICE OF THE PRESIDENT; UNITED STATES. OFFICE OF THE NATIONAL CYBER DIRECTOR

From the document: "The '2024 Report on the Cybersecurity Posture of the United States' assesses the cybersecurity posture of the United States, the effectiveness of national cyber policy and strategy, and the status of the implementation of national cyber policy and strategy by Federal departments and agencies. Additionally, this report highlights cybersecurity threats and issues facing the United States, including new or emerging technologies that may affect national security, economic prosperity, and the rule of law. This is the first edition of the report and covers calendar year 2023, with additional consideration of developments in 2024 preceding the publication of this report. Over the past year, U.S. national cybersecurity posture improved, driven by steady progress towards the 2023 National Cybersecurity Strategy's (NCS) vision of a defensible, resilient, and values-aligned digital ecosystem achieved through fundamental shifts in the underlying dynamics that shape cyberspace. The Administration has successfully begun implementation of the NCS Implementation Plan, which coordinates actions by departments and agencies across the Federal Government to make the President's affirmative vision a reality. These initial implementation actions set the foundation for further investment and sustained commitment by stakeholders across the digital ecosystem."

United States. Executive Office of the President. United States. Office of the National Cyber Director. 2024. 37p.

MAY CONTAIN MARKUP

Edited by Paul Ekblom

In the realm of product design, the concept of crime-proofing everyday products has emerged as a vital consideration. With the objective of enhancing safety and security in mind, designers are exploring innovative ways to deter criminal activities through the very objects we interact with on a daily basis. By integrating elements such as tamper-proof features, anti-theft mechanisms, and user-friendly security measures, these products aim to provide users with a heightened sense of protection and peace of mind. Design Against Crime represents a proactive approach towards creating a more secure environment, where intelligent design serves as the first line of defense against potential threats.

Lynne Rienner Publishers, 2012 , 293 pages

MAY CONTAIN MARKUP

By Dennis R. Dalton

The attacks on the World Trade Center and the Pentagon on September 11, 2001 changed the way the world thinks about security. Everyday citizens learned how national security, international politics, and the economy are inextricably linked to business continuity and corporate security. Corporate leaders were reminded that the security of business, intellectual, and human assets has a tremendous impact on an organization's long-term viability.

In Rethinking Corporate Security, Fortune 500 consultant Dennis Dalton helps security directors, CEOs, and business managers understand the fundamental role of security in today's business environment and outlines the steps to protect against corporate loss. He draws on the insights of such leaders as Jack Welch, Bill Gates, Charles Schwab, and Tom Peters in this unique review of security's evolving role and the development of a new management paradigm.

* If you truly wish to improve your own skills, and the effectiveness of your Corporation's security focus, you need to read this book
* Presents connections of theory to real-world case examples in historical and contemporary assessment of security management principles
* Applies classic business and management strategies to the corporate security management function

NY. BUTTERWORTH/HEINEMANN. 2003. 346p.

United States. Department Of Defense. Office Of The Inspector General

From the document: "This special report provides insight into the common cybersecurity weaknesses identified in DoD Office of Inspector General (OIG) audit reports and through our support to the Defense Criminal Investigative Service and the Department of Justice on Civil Cyber-Fraud Initiative investigations related to DoD contractor compliance with Federal cybersecurity requirements for protecting controlled unclassified information (CUI). CUI is not classified information but is information created or possessed by the Government that requires safeguarding or dissemination controls according to applicable laws, regulations, and Government-wide policies as defined in Executive Order 13526, 'Classified National Security Information,' December 29, 2009. From 2018 through 2023, the DoD OIG issued five audit reports focusing on DoD contractors' inconsistent implementation of Federal cybersecurity requirements for protecting CUI that are contained in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. Since 2022, the DoD OIG has provided support for five investigations under the Civil Cyber Fraud Initiative, which targets government contractors and grant recipients suspected of fraudulently attesting their compliance with the NIST SP 800-171 cybersecurity requirements. The common cybersecurity weaknesses identified in this special report provide DoD contracting officers with potential focus areas when assessing contractor performance and DoD contractors and grant recipients with potential focus areas before attesting to their compliance with NIST SP 800-171."

Department of Defense, Office of Inspector General, Report No. DODIG-'2024-'031. 24p.

By Cleaveland, Ann; Cohn, Alan, 1964-; Nagamine, Matthew; Thomas, Dawn H.; Rimsky Vernon, Alison

From the document: "This report presents findings from Cybersecurity Futures 2030, a global research initiative focused on exploring how digital security could evolve over the next five to seven years. The goal of this project is to help shape a future-focused research and policy agenda that is widely applicable across countries and sectors. The findings are based on discussions held at a series of in-person workshops conducted throughout 2023 in Dubai (United Arab Emirates), Washington DC (USA), Kigali (Rwanda), New Delhi (India) and Singapore, as well as a virtual workshop with participants from multiple European countries and the United Kingdom. The workshops centred on discussion of four scenarios that portray diverse 'cybersecurity futures' that are fictional (but plausible) depictions of the world roughly in the year 2030. UC [University of California] Berkeley Center for Long-Term Cybersecurity (CLTC) independently designed the scenarios to explore trade-offs in goals and values that decision-makers will have to contend with in the near future."

World Economic Forum . 2023. 16p.

Chatham House

From the webpage: "Cyberspace is now established as an important domain of national and international security. Until recently, informed and open discussion on the responsible use of offensive cyber capabilities has been constrained by high levels of secrecy around national strategies for their use. Insights as to how individual states view the utility of offensive cyber, and how they perceive and manage associated risks of escalation and conflict, have been hard to access. A lack of open debate around the limitations of cyber operations has also led to inaccurate portrayals of cyber capabilities as versatile 'silver bullet' solutions which can address a widening variety of security challenges. This paper offers an in-depth exploration of new or revised national cyber strategies, authorization mechanisms and legislation in nine NATO states, and draws on interviews with national cyber experts. As well as aiming to promote more informed debate on the key issues, it presents important policy recommendations to support the responsible use of offensive cyber and to contribute to the achievement of a secure cyberspace for all."

Royal Institute Of International Affairs Skingsley, Charlotte . 2023. 37p.

By UNITED STATES. CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY

From the document: "Our nation is at a moment of opportunity. The '2023 U.S. National Cybersecurity Strategy' outlines a new vision for cybersecurity, a vision grounded in collaboration, in innovation, and in accountability. Now is the moment where our country has a choice: to invest in a future where collaboration is a default rather than an exception; where innovation in defense and resilience dramatically outpaces that of those seeking to do us harm; and where the burden of cybersecurity is allocated toward those who are most able to bear it. We must be clear-eyed about the future we seek, one in which damaging cyber intrusions are a shocking anomaly, in which organizations are secure and resilient, in which technology products are safe and secure by design and default. This is a shared journey and a shared challenge, and CISA [Cybersecurity and Infrastructure Security Agency], as America's cyber defense agency, is privileged to serve a foundational role in the global cybersecurity community as we achieve measurable progress to our shared end state. [...] We must change how we design and develop technology products, such that exploitable conditions are uncommon and secure controls are enabled before products reach the market. We must quickly detect adversaries, incidents, and vulnerabilities, and enable timely mitigation before harm occurs. We must help organizations, particularly those that are 'target rich, resource poor,' take the fewest possible steps to drive the most security impact."

United States. Cybersecurity & Infrastructure Security Agency. 2023. 36p.

By Kayla A. Wanamaker

Cybercrime – crimes where the Internet and information technology (IT) are used, such as hacking, virus dissemination, and organized crime – is a growing concern for governments, organizations, individuals and businesses worldwide. Research conducted in the United States, United Kingdom and Canada has concluded that cybercrime and cyber security incidents are underreported to law enforcement. The reasons why this is the case, however, are not well known, especially within a Canadian context. As such, the goal of the current study was to examine the phenomenon of underreporting of cyber security incidents to police services using data from the 2017 Canadian Survey of Cyber Security and Cybercrime that was administered to Canadian businesses. Results indicated that while just over 20% of businesses experienced cyber-related incidents, only about 10% are reporting these incidents to the police. Businesses did not report incidents because they were resolved internally or through an IT consultant, or were thought to be too minor to report to police. Risk management, formal training, and sharing best practices were found to be related to businesses’ likelihood of reporting incidents to police. Larger businesses were more likely to report cybercrime to police when they implemented less security measures, whereas scores on security measures were not related to police reporting for small businesses. Results suggest a need to increase awareness of the frequency of cybercrime, as well as the availability of formal training options on cyber-related issues. They also underscore the importance of having enhanced cyber security protocols in place.

Ottawa: Public Safety Canada, 2019. 16p.

By The White House

President Biden has made clear that all Americans deserve the full benefits and potential of our digital future. The Biden-Harris Administration’s recently released National Cybersecurity Strategy calls for two fundamental shifts in how the United States allocates roles, responsibilities, and resources in cyberspace:

1. Ensuring that the biggest, most capable, and best-positioned entities – in the public and private sectors – assume a greater share of the burden for mitigating cyber risk

2. Increasing incentives to favor long-term investments into cybersecurity

Today, the Administration is announcing a roadmap to realize this bold, affirmative vision. It is taking the novel step of publishing the National Cybersecurity Strategy Implementation Plan (NCSIP) to ensure transparency and a continued path for coordination. This plan details more than 65 high-impact Federal initiatives, from protecting American jobs by combatting cybercrimes to building a skilled cyber workforce equipped to excel in our increasingly digital economy. The NCSIP, along with the Bipartisan Infrastructure Law, CHIPS and Science Act, Inflation Reduction Act, and other major Administration initiatives, will protect our investments in rebuilding America’s infrastructure, developing our clean energy sector, and re-shoring America’s technology and manufacturing base.

Washington, DC: White House, 2023. 57p.

By The White House (U.S.)

Digital technologies today touch nearly every aspect of American life. The openness and connection enabled by access to the Internet are game-changers for communities everywhere, as we have all experienced throughout the COVID-19 pandemic. That’s why, thanks to the Bipartisan Infrastructure Law, my Administration is investing $65 billion to make sure every American has access to reliable, high-speed Internet. And when we pick up our smart phones to keep in touch with loved ones, log on to social media to share our ideas with one another, or connect to the Internet to run a business or take care of any of our basic needs, we need to be able to trust that the underlying digital ecosystem is safe, reliable, and secure. This National Cybersecurity Strategy details the comprehensive approach my Administration is taking to better secure cyberspace and ensure the United States is in the strongest possible position to realize all the benefits and potential of our digital future. Cybersecurity is essential to the basic functioning of our economy, the operation of our critical infrastructure, the strength of our democracy and democratic institutions, the privacy of our data and communications, and our national defense. From the very beginning of my Administration, we have moved decisively to strengthen cybersecurity. I appointed senior cybersecurity officials at the White House and issued an Executive Order on Improving the Nation’s Cybersecurity. Working in close cooperation with the private sector, my Administration has taken steps to protect the American people from hackers, hold bad actors and cybercriminals accountable, and defend against the increasingly malicious cyber campaigns targeting our security and privacy. And we’ve worked with our allies and partners around the world to improve our capacity to collectively defend against and respond to cyber threats from authoritarian states that go against our national interests. This strategy recognizes that robust collaboration, particularly between the public and private sectors, is essential to securing cyberspace. It also takes on the systemic challenge that too much of the responsibility for cybersecurity has fallen on individual users and small organizations. By working in partnership with industry; civil society; and State, local, Tribal, and territorial governments, we will rebalance the responsibility for cybersecurity to be more effective and more equitable. We will realign incentives to favor long-term investments in security, resilience, and promising new technologies. We will collaborate with our allies and partners to strengthen norms of responsible state behavior, hold countries accountable for irresponsible behavior in cyberspace, and disrupt the networks of criminals behind dangerous cyberattacks around the globe. And we will work with the Congress to provide the resources and tools necessary to ensure effective cybersecurity practices are implemented across our most critical infrastructure.

Washington, DC: White House, 2023. 39p.

By Sugarman, Eli; Daniel, Michael; François, Camille; Chowdhury, A. K. M. Azam; Chowdhury, Rumman; Willner, Dave; Roth, Yoel

From the document: "Digital technologies continue to evolve at breakneck speed, unleashing a dizzying array of society-wide impacts in their wake. In the last quarter of 2022 alone: Meta, Accenture, and Microsoft announced a massive partnership to establish immersive spaces for enterprise environments; Elon Musk took over Twitter; the third-largest cryptocurrency exchange in the world collapsed overnight; the European Union's landmark Digital Services Act came into force; and generative artificial intelligence ('GAI') tools were released to the public for the first time. Within a fifty-day span, the outline of a new internet age came into sharper focus. In December 2022, the Atlantic Council's Digital Forensic Research Lab began to assemble a diverse array of experts who could generate an action-oriented agenda for future online spaces that can better protect users' rights, support innovation, and incorporate trust and safety principles--and do so quickly. [...] The task force specifically considered the emerging field of 'trust and safety' (T&S) and how it can be leveraged moving forward. That field provides deep insights into the complex dynamics that have underpinned building, maintaining, and growing online spaces to date. Moreover, the work of T&S practitioners, in concert with civil society and other counterparts, now rests at the heart of transformative new regulatory models that will help define how technology is developed in the twenty-first century. 'This executive report captures the task force's key findings and provides a short overview of the truths, trends, risks, and opportunities that task force members believe will influence the building of online spaces in the immediate, near, and medium term. It also summarizes the task force's recommendations for specific, actionable interventions that could help to overcome systems gaps the task force identified.'"

Atlantic Council Of The United States. Digital Forensic Research Lab. 2023. 150p.

By John Kleinig • Peter Mameli • Seumas Miller • Douglas Salane Adina Schwartz

This study is principally concerned with the ethical dimensions of identity management technology – electronic surveillance, the mining of personal data, and profiling – in the context of transnational crime and global terrorism. The ethical challenge at the heart of this study is to establish an acceptable and sustainable equilibrium between two central moral values in contemporary liberal democracies, namely, security and privacy. Both values are essential to individual liberty, but they come into conflict in times when civil order is threatened, as has been the case from late in the twentieth century, with the advent of global terrorism and trans-national crime. We seek to articulate legally sustainable, politically possible, and technologically feasible, global ethical standards for identity management technology and policies in liberal democracies in the contemporary global security context. Although the standards in question are to be understood as global ethical standards potentially to be adopted not only by the United States, but also by the European Union, India, Australasia, and other contemporary liberal democratic states, we take as our primary focus the tensions that have arisen between the United States and the European Union.

Canberra: ANU Press, 2011. 304p.

By Rashida Richardson, Jason M. Schultz, and Kate Crawford

Law enforcement agencies are increasingly using predictive policing systems to forecast criminal activity and allocate police resources. Yet in numerous jurisdictions, these systems are built on data produced during documented periods of flawed, racially biased, and sometimes unlawful practices and policies (“dirty policing”). These policing practices and policies shape the environment and the methodology by which data is created, which raises the risk of creating inaccurate, skewed, or systematically biased data (“dirty data”). If predictive policing systems are informed by such data, they cannot escape the legacies of the unlawful or biased policing practices that they are built on. Nor do current claims by predictive policing vendors provide sufficient assurances that their systems adequately mitigate or segregate this data.

In our research, we analyze thirteen jurisdictions that have used or developed predictive policing tools while under government commission investigations or federal court monitored settlements, consent decrees, or memoranda of agreement stemming from corrupt, racially biased, or otherwise illegal policing practices. In particular, we examine the link between unlawful and biased police practices and the data available to train or implement these systems. We highlight three case studies: (1) Chicago, an example of where dirty data was ingested directly into the city’s predictive system; (2) New Orleans, an example where the extensive evidence of dirty policing practices and recent litigation suggests an extremely high risk that dirty data was or could be used in predictive policing; and (3) Maricopa County, where despite extensive evidence of dirty policing practices, a lack of public transparency about the details of various predictive policing systems restricts a proper assessment of the risks. The implications of these findings have widespread ramifications for predictive policing writ large. Deploying predictive policing systems in jurisdictions with extensive histories of unlawful police practices presents elevated risks that dirty data will lead to flawed or unlawful predictions, which in turn risk perpetuating additional harm via feedback loops throughout the criminal justice system. The use of predictive policing must be treated with high levels of caution and mechanisms for the public to know, assess, and reject such systems are imperative.

94 N.Y.U. L. REV. ONLINE 192 (2019), Available at SSRN: https://ssrn.com/abstract=3333423

By Ranae Jabri

  Predictive policing algorithms are increasingly used by law enforcement agencies in the United States. These algorithms use past crime data to generate predictive policing boxes, specifically the highest crime risk areas where law enforcement is instructed to patrol every shift. I collect a novel dataset on predictive policing box locations, crime incidents, and arrests from a major urban jurisdiction where predictive policing is used. Using institutional features of the predictive policing policy, I isolate quasi-experimental variation to examine the causal impacts of algorithm-induced police presence. I find that algorithm-induced police presence decreases serious property and violent crime. At the same time, I also find disproportionate racial impacts on arrests for serious violent crimes as well as arrests in traffic incidents i.e. lower-level offenses where police have discretion. These results highlight that using predictive policing to target neighborhoods can generate a tradeoff between crime prevention and equity.

 Unpublished paper, 2021. 44p.  

By Romanoff, Tom; Farshchi, Jamil; Neschke, Sabine; Lord, Ben; Draper, Danielle; Douglas, Ahmad

From the document: "The Bipartisan Policy Center (BPC) convened a working group of leaders to strengthen America's cybersecurity. The group's approach was to identify the nation's top cybersecurity risks to raise awareness so policymakers and businesses can take pragmatic action and invest in countermeasures. In assembling the working group, the co-chairs sought broad inclusivity from strategically important industries, government, and civil society. Every sector with a stake in cybersecurity was included--banking, communications, digital platforms, health, energy, and more. The working group drew from a wide range of important perspectives, including stakeholders representing privacy concerns and digital identities. [...] Identifying cybersecurity risks is the first step in managing them. This report--unlike other, more technical sources that identify cyber risks--frames them for the strategic audience of business and government decision-makers. We intentionally focused on identifying risks, not solutions, because various stakeholders may need to take different approaches. There are no one-size-fits-all fixes. Rather, these top risks must be considered individually by companies and collectively by the nation. Many will require a multifaceted response, across business and government, who will need to work various levers including policy, organizational culture, technology, and processes."

Bipartisan Policy Center 2023. 28p.

By Internet Society

From the introduction:

In 2023, we will:

• Engage in at least 900 advocacy activities

• Urge government officials to make pro-

  encryption statements at least 10 times

• Encourage governments or press to reference Internet Society encryption-focused documents or statements at least 30 times

Internet Society.2023. 21p.

By by Bob Harrison, James Dimarogonas, Jarrett Catlin, Richard H. Donohue, Thomas Goughnour, John S. Hollywood, Jason Mastbaum, Kristin Van Abel, Jay Balagna

In 2018, law enforcement agencies gained access to a federally funded and managed, interoperable first responder broadband communications network, the Nationwide Public Safety Broadband Network (NPSBN), known as FirstNet. FirstNet was supposed to result in simple solutions for agencies seeking interoperability. For various reasons, this has not happened. Every law enforcement and first responder agency has legacy systems and equipment for mobile broadband uses and is faced with a complex set of decisions about its broadband communications infrastructure. Several competitors to FirstNet have emerged and are competing for a share of the public safety broadband market, causing confusion for end users. In addition, to make decisions regarding broadband communications systems, many agencies need assistance to understand the technical differences between various options.

RAND Corporation, Santa Monica, Calif. 2022. 110p.

Edited by Myriam Dunn Cavelty and Andreas Wenger.

Socio-Technological Transformations and Political Fragmentation. This book examines new and challenging political aspects of cyber security and presents it as an issue defined by socio-technological uncertainty and political fragmentation. Structured along two broad themes and providing empirical examples for how socio-technical changes and political responses interact, the first part of the book looks at the current use of cyber space in conflictual settings, while the second focuses on political responses by state and non-state actors in an environment defined by uncertainties. Within this, it highlights four key debates that encapsulate the complexities and paradoxes of cyber security politics from a Western perspective – how much political influence states can achieve via cyber operations and what context factors condition the (limited) strategic utility of such operations; the role of emerging digital technologies and how the dynamics of the tech innovation process reinforce the fragmentation of the governance space; how states attempt to uphold stability in cyberspace and, more generally, in their strategic relations; and how the shared responsibility of state, economy, and society for cyber security continues to be re-negotiated in an increasingly trans-sectoral and transnational governance space. This book will be of much interest to students of cyber security, global governance, technology studies, and international relations.

Abingdon, Oxon, UK; New York: Routledge, 2022. 2187p.