Search

Begin New Search Topic Cybersecurity Political Geography Global Focus Content Type Working Paper Publication Year within 5 Years

1. Why Does the Global Spyware Industry Continue to Thrive? Trends, Explanations, and Responses

Author:
Steven Feldstein and Brian (Chun Hey) Kot
Publication Date:
03-2023
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
The global spyware and digital forensics industry continues to grow despite public backlash following an array of surveillance scandals, many linked to NSO Group’s Pegasus program. This paper explores the resilience of the commercial spyware market and offers ideas about how to limit the spread of invasive cyber surveillance tools. It highlights several factors driving the industry, including elevated demand for intrusion technology from government clients and private customers, as well as inconsistent political will from democratic governments to crack down on these technologies.
Topic:
Science and Technology, Cybersecurity, Democracy, Surveillance, Industry, Forensic Science, and Autocracy
Political Geography:
Global Focus

2. AI Startups and the Fight Against Mis/Disinformation Online: An Update

Author:
Anya Schiffrin, Hiba Beg, Pablo Eyzaguirre, Zachey Kliger, Tianyu Mao, Aditi Rukhaiyar, Kristen Saldarini, and Ojani Walthrust
Publication Date:
07-2022
Content Type:
Working Paper
Institution:
German Marshall Fund of the United States (GMFUS)
Abstract:
The events following Russia’s invasion of Ukraine have shown again the power of online mis/disinformation. As it continues to grow and spread, there are new and continuing attempts to address this problem. These include supply-side and demand-side fixes (including media-literacy programs, fact-checking and, in Europe, new regulations) but few of these have scaled. This paper looks at one kind of supply-side attempt to tackle the prevalence of online mis/disinformation: the market for tech-based solutions that use some form of artificial intelligence (AI) machine/deep learning for content moderation, media integrity, and verification. This paper presents the findings of interviews of 20 niche firms that use AI to identify online mis/disinformation, many of which were previously surveyed for a 2019 paper on the role of AI startups in the fight against disinformation. These companies did not release their revenue figures but it seems that the market for their services is smaller than many entrepreneurs had originally hoped, and that Google and Facebook are not relying on such firms for help in identifying online mis/disinformation. The cost of the services provided by these startups and the desire to keep things in-house and protect their activities from outside scrutiny are part of why the tech giants do not rely on small startups for help with screening online mis/disinformation. This may be why funding for these startups does not seem to have grown significantly and so more than half of them are now focusing on the business-to-business market, selling mis/disinformation mitigation services to, for example, insurance companies, large public entities, and governments, among others. There also appears to be a limited market for business-to-consumer solutions for detecting mis/disinformation. However, continuing advances in AI as well as forthcoming regulation by the European Union and the United Kingdom will continue to spur innovation, which may stimulate demand. University initiatives, academics, journalism organizations, and cybersecurity experts are all also trying to come up with ways to identify and control the spread of mis/disinformation. Ultimately, despite its advances, technology alone will not solve the online mis/disinformation problem. Giant social media platforms have few financial incentives to crack down on this—quite the opposite, in fact. To push social media platforms to act against online mis/disinformation and illegal speech, regulation must deftly address the issue while preserving freedom of expression. There is a further problem in the form of the political polarization that has intensified in the United States and other parts of the world. Fixing this is likely to be well beyond the role of business and technologists.
Topic:
Science and Technology, Cybersecurity, Democracy, Artificial Intelligence, Disinformation, Misinformation, and Startup
Political Geography:
Global Focus

3. AI Audit-Washing and Accountability

Author:
Ellen P. Goodman
Publication Date:
11-2022
Content Type:
Working Paper
Institution:
German Marshall Fund of the United States (GMFUS)
Abstract:
We are still some distance from a worldwide robot takeover, but artificial intelligence (AI)—the training of computer systems with large data sets to make decisions and solve problems—is revolutionizing the way governments and societies function. AI has enormous potential: accelerating innovation, unlocking new value from data, and increasing productivity by freeing us from mundane tasks. AI can draw new inferences from health data to foster breakthroughs in cancer screening or improve climate modeling and early-warning systems for extreme weather or emergency situations. As we seek solutions to today’s vexing problems—climate disruption, social inequality, health crises—AI will be central. Its centrality requires that stakeholders exercise greater governance over AI and hold AI systems accountable for their potential harms, including discriminatory impact, opacity, error, insecurity, privacy violations, and disempowerment. In this context, calls for audits to assess the impact of algorithmic decision-making systems and expose and mitigate related harms are proliferating1 , accompanied by the rise of an algorithmic auditing industry and legal codification. These are welcome developments. Audits can provide a flexible co-regulatory solution, allowing necessary innovation in AI while increasing transparency and accountability. AI is a crucial element of the growing tech competition between authoritarian and democratic states—and ensuring that AI is accountable and trusted is a key part of ensuring democratic advantage. Clear standards for trustworthy AI will help the United States remain a center of innovation and shape technology to democratic values. The “algorithmic audit” nevertheless remains ill-defined and inexact, whether concerning social media platforms or AI systems generally. The risk is significant that inadequate audits will obscure problems with algorithmic systems and create a permission structure around poorly designed or implemented AI. A poorly designed or executed audit is at best meaningless and at worst even excuses harms that the audits claim to mitigate. Inadequate audits or those without clear standards provide false assurance of compliance with norms and laws, “audit-washing” problematic or illegal practices. Like green-washing and ethics-washing before, the audited entity can claim credit without doing the work. To address these risks, this paper identifies the core questions that need answering to make algorithmic audits a reliable AI accountability mechanism. The “who” of audits includes the person or organization conducting the audit, with clearly defined qualifications, conditions for data access, and guardrails for internal audits. The “what” includes the type and scope of audit, including its position within a larger sociotechnical system. The “why” covers audit objectives, whether narrow legal standards or broader ethical goals, essential for audit comparison. Finally, the “how” includes a clear articulation of audit standards, an important baseline for the development of audit certification mechanisms and to guard against audit-washing. Algorithmic audits have the potential to transform the way technology works in the 21st century, much as financial audits transformed the way businesses operated in the 20th century. They will take different forms, either within a sector or across sectors, especially for systems which pose the highest risk. But as algorithmic audits are encoded into law or adopted voluntarily as part of corporate social responsibility, the audit industry must arrive at shared understandings and expectations of audit goals and procedures. This paper provides such an outline so that truly meaningful algorithmic audits can take their deserved place in AI governance frameworks.
Topic:
Science and Technology, Cybersecurity, Democracy, Regulation, Accountability, and Artificial Intelligence
Political Geography:
Global Focus

4. Countering global oil theft: responses and solutions

Author:
Etienne Romsom
Publication Date:
03-2022
Content Type:
Working Paper
Institution:
United Nations University
Abstract:
This second of two papers on global oil theft discusses ways to reduce oil theft, misappropriation, and fraud. At US$133 billion per year, oil is the largest stolen natural resource globally, while fuel is the most smuggled natural resource. Oil theft equates to 5–7 per cent of the global market for crude oil and petroleum fuels. It is so engrained in the energy supply chain that thefts are priced in by traders and tolerated by many shipping companies as petty theft. Oil theft and related insecurity have substantial negative economic effects on developing countries, whether they produce oil or not. In 2012, non-oil-producing Benin saw a 28 per cent drop in taxable income after a spate of oil tanker hijacking incidents in the Gulf of Guinea in 2011. In Nigeria, the oil capacity shut-in and amount of oil deferred is more than twice the amount estimated as stolen, with a US$20 billion annual loss in petroleum profit tax—63 per cent of total government tax revenue in 2019. Organized oil crime syndicates are often transnational and conduct theft and fraud professionally, exploiting gaps in jurisdiction and adapting their practices when law enforcement becomes more effective. They evolve from ship piracy to stealing tanker cargoes to kidnapping tanker crews; from physical ransom of assets to digital hijacking via ransomware. The proceeds of oil theft often finance other organized crime, and it triggers violence against the community and in crime-on-crime activities. Twelve commonalities in oil theft and fraud have been identified that can direct international solutions, in three target areas: stolen oil volumes, stolen oil transport, and stolen oil money. Prosecution for acts of bribery offers opportunities for action: transport of or payment for illegal oil could constitute a bribe under the US Foreign Corrupt Practice Act if government officials were involved in the transaction or shipment. Bribe charges could be raised for paid ‘services’ that facilitate oil theft (through action or non-action).
Topic:
Corruption, Oil, Piracy, Cybersecurity, Fossil Fuels, Tax Evasion, and Theft
Political Geography:
Global Focus

5. Cyberspace and Geopolitics: Assessing Global Cybersecurity Norm Processes at a Crossroads

Author:
Christian Ruhl, Duncan Hollis, Wyatt Hoffman, and Tim Maurer
Publication Date:
02-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
As cyber insecurity has become a growing problem worldwide, states and other stakeholders have sought to increase stability for cyberspace. As a result, a new ecosystem of “cyber norm” processes has emerged in diverse fora and formats. Today, United Nations (UN) groups (for example, the Group of Governmental Experts [GGE] and the Open-Ended Working Group [OEWG]), expert commissions (for example, the Global Commission on the Stability of Cyberspace), industry coalitions (for example, the Tech Accord, the Charter of Trust), and multistakeholder collectives (for example, the Paris Call for Trust and Security in Cyberspace) all purport to identify or operationalize various normative standards of behavior for states and/or other stakeholders in cyberspace. As some of these processes wind down (for example, the Global Commission) and others wind up (for example, the OEWG), cyber norms are at a crossroads where each process’s potential (and problems) looms large.
Topic:
Security, Science and Technology, Cybersecurity, Geopolitics, and Norms
Political Geography:
Global Focus

6. Cyber-incident Management: Identifying and Dealing with the Risk of Escalation

Author:
Fei Su, Dr Vincent Boulanin, and Johan Turell
Publication Date:
09-2020
Content Type:
Working Paper
Institution:
Stockholm International Peace Research Institute
Abstract:
The ever-increasing dependence on information and communication technologies (ICTs) in all aspects of society raises many challenges for national crisis management agencies. These agencies need to prepare not only for new cyberthreats and cyber vulnerabilities, but also for the fact that the aftermath of a cyber incident affecting critical infrastructure has its own challenges. On the one hand, the practical disruptions caused by an isolated incident can be hard to predict and control and, on the other hand, the consequences and perceptions of an incident whose cause is not yet determined can be equally hard to manage. Uncertainty around the cause of the incident and remedial actions being taken often lead to public speculation and political pressure to respond in ways that could create political tensions, and possibly conflict, between countries. This policy paper is the result of a nine-month research project that was jointly conducted by SIPRI and the Swedish Civil Contingencies Agency (MSB) on cyber-incident management. It explores what national crisis management authorities can do to improve their cyber-incident prevention, detection and response strategies and also how they can do better to deal with the larger societal and potentially political aftermath. It investigates why and how cyber incidents may lead to escalatory scenarios and how these scenarios can be avoided and contained using various de-escalatory approaches. It comprises an introduction providing background and the inspiration of this report (section I); four sections that explore the dynamics of escalation and de-escalation from conceptual (section II), analytical (sections III–IV) and empirical (section V) standpoints; and two sections that present the main findings and recommendations (sections VI–VII).
Topic:
Security, Science and Technology, Military Affairs, and Cybersecurity
Political Geography:
Sweden and Global Focus

7. Pugwash Document on Cyber Security and Warfare

Author:
Gian Piero Siroli, Gotz Neuneck, and Paolo Cotta-Ramusino
Publication Date:
11-2020
Content Type:
Working Paper
Institution:
Pugwash Conferences on Science and World Affairs
Abstract:
Since its foundation, the Pugwash Conferences on Science and World Affairs (Pugwash) has continued to bring together, from around the world, influential scientists, scholars, experts and public figures concerned with reducing the dangers of armed conflict, especially regarding nuclear weapons and other weapons of mass destruction, and with understanding the new threats related to new technologies, while seeking cooperative solutions. Pugwash held three workshops on the topic of cyber security and warfare between December 2018 and January 2020, gathering a total of about 60 experts and practitioners from Europe, North and South America, and Asia, focusing on a broad set of specific themes. The first workshop (Geneva, Switzerland, December 2018, hosted by the GCSP) discussed battlefield digitalization and offensive cyber capabilities, weapon-system vulnerabilities, and the implications of Artificial Intelligence (AI). The second workshop (Bariloche, Argentina, October 2019, supported by INVAP, Global Security Foundation and KPMG) focused on “Cybersecurity in Latin America”. The third workshop (Geneva, Switzerland, January 2020, sponsored by the Mission of Brazil to the UN Office in Geneva) focused on “Cyber Security and Warfare,” and included discussions on international cooperation, the multi-stakeholder approach, and implications of AI and autonomous weapons systems. Reports are available on the Pugwash website1. The participants, who came from many countries, carried out an analysis and reflection on various aspects of the cyber ecosystem in the context of international stability and security, and reviewed current initiatives included within the international agenda. Better definitions, a common nomenclature, and reliable communication between responsible stakeholders—based on the principles of International Humanitarian Law and the experiences of arms control for risk reduction, self-restraint and crisis management--might be useful or necessary. Sound technical analysis and forensics are a precondition to understanding the different threats and vulnerabilities of the cyber-sphere. Detailed proposals for discussion and implementation were elaborated during the workshops.
Topic:
Security, War, Cybersecurity, Conflict, and Artificial Intelligence
Political Geography:
Global Focus

8. The Use of Cyberspace in the Context of Hybrid Warfare. Means, Challenges and Trends

Author:
Cholpon Abdyraeva
Publication Date:
07-2020
Content Type:
Working Paper
Institution:
Austrian Institute for International Affairs (OIIP)
Abstract:
This paper aims to introduce the state of art on hybrid warfare and seeks to address the conceptual confusion regarding an ever-expanding concept of hybrid warfare. By doing so, this paper simultaneously attempts to assess the growing significance of cyber and information domains within the hybrid warfare, which can be clearly illustrated by the example of the Russian hybrid warfare strategy. The Russian approach to hybrid warfare has considerably broadened the scope of hybrid warfare and changed the focus of debates from military to non-military components of hybrid warfare. Therefore, the purpose of this paper is: 1) to produce a deeper insight into hybrid warfare, including related trends, and 2) to assess the role and impact of cyber and information warfare with a particular focus on Russia. This paper can serve as an introduction that guides policy makers with expert opinions, and as such, intends to motivate further investigation in this field.
Topic:
Science and Technology, Cybersecurity, Internet, Conflict, and Hybrid Warfare
Political Geography:
Russia and Global Focus

9. Modern Conflict and Artificial Intelligence

Author:
Aaron Shull, Daniel Araya, Samantha Bradshaw, Amandeep Singh Gill, Michael Horowitz, Meg King, Robert Mazzolin, Maya Medeiros, Rodrigo Nieto-Gomez, and Liis Vihul
Publication Date:
11-2020
Content Type:
Working Paper
Institution:
Centre for International Governance Innovation
Abstract:
Autonomous systems are revolutionizing our lives, but they present clear international security concerns. Despite the risks, emerging technologies are increasingly applied as tools for cybersecurity and, in some cases, cyberwarfare. In this essay series, first published online, experts explore digital threats to democracy and security, and the geopolitical tensions they create.
Topic:
Cybersecurity, Conflict, Artificial Intelligence, and Emerging Technology
Political Geography:
Global Focus

10. War, Terrorism, and Catastrophe in Cyber Insurance: Understanding and Reforming Exclusions

Author:
Jon Bateman
Publication Date:
10-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Cyber insurance is a promising way to contain the havoc cyber attacks wreak, but endless lawsuits hamper its effectiveness. Reforms and new solutions are sorely needed. Insurance is one of the most promising tools for addressing pervasive cyber insecurity. A robust market for insuring cyber incidents could, among other things, financially incentivize organizations to adopt better cyber hygiene—thereby reducing cyber risk for society as a whole. But cyber insurance is not yet mature enough to fulfill its potential, partly due to uncertainty about what kinds of cyber risks are, or can be, insured. Uncertainties in cyber insurance came to a head in 2017, when the Russian government conducted a cyber attack of unprecedented scale. Data-destroying malware called NotPetya infected hundreds of organizations in dozens of countries, including major multinational companies, causing an estimated $10 billion in losses.1 NotPetya showed that cyber risk was greater than previously recognized, with higher potential for “aggregation”—the accumulation of losses across many insurance policies from a single incident or several correlated events. NotPetya also exposed a serious ambiguity in how insurance policies treat state-sponsored cyber incidents. Some property and casualty insurers declined to pay NotPetya-related claims, instead invoking their war exclusions—long-standing clauses that deny coverage for “hostile or warlike action in time of peace and war” perpetrated by states or their agents.2 War exclusions date back to the 1700s, but they had never before been applied to cyber incidents. This novel use of the war exclusion, still being litigated, has raised doubts about whether adequate or reliable coverage exists for state-sponsored cyber incidents. Some observers have asked whether such incidents are insurable at all, given the potential for aggregated cyber losses even more catastrophic than those of NotPetya.3 And while the war exclusion has attracted the most attention, another exclusion—for terrorism—presents similar challenges to cyber claims.
Topic:
Terrorism, War, Cybersecurity, and Non-Traditional Threats
Political Geography:
Global Focus