Cyber Project

Reactions to the Leak of Classified Military Intelligence Documents

Belfer Center — Apr 19, 2023

Apr 19, 2023

Belfer Center experts on security, intelligence, and cybersecurity issues were interviewed on the recent leak of classified military intelligence documents allegedly by Airman Jack Teixeira.

Brace Yourself for a Tidal Wave of ChatGPT Email Scams

Belfer Center — Apr 4, 2023

Apr 4, 2023

Thanks to large language models, a single scammer can run hundreds or thousands of cons in parallel, night and day, in every language under the sun.

We Don’t Need to Reinvent our Democracy to Save it from AI

Belfer Center — Feb 9, 2023

Feb 9, 2023

When is it time to start worrying about artificial intelligence interfering in our democracy? asks Bruce Schneier. "Maybe when an AI writes a letter to The New York Times opposing the regulation of its own technology. That happened last month. And because the letter was responding to an essay we wrote, we're starting to get worried. And while the technology can be regulated, the real solution lies in recognizing that the problem is human actors—and those we can do something about."

Lauren Zabierek Named Senior Policy Advisor for U.S. Cybersecurity Agency

Belfer Center — Feb 1, 2023

Feb 1, 2023

Lauren Zabierek, former Executive Director of the Cyber Project at Harvard Kennedy School’s Belfer Center for Science and International Affairs, has been appointed Senior Policy Advisor with the Cybersecurity & Infrastructure Security Agency (CISA).

Advancing Cyber Norms Unilaterally: How the U.S. Can Meet its Paris Call Commitments

Belfer Center — Jan 17, 2023

Jan 17, 2023

Establishing norms for state behavior in cyberspace is critical to building a more stable, secure, and safe cyberspace. Norms are defined as “a collective expectation for the proper behavior of actors with a given identity,” and declare what behavior is considered appropriate and when lines have been crossed. Cyberspace is in dire need of such collective expectations. However, despite efforts by the international community and individual states to set boundaries and craft agreements, clear and established cyber norms for state behavior remain elusive. As early as 2005, the UN Group of Governmental Experts (GGE) and UN Open-Ended Working Group (OEWG) both aimed to create shared “rules of the road,” but fundamental disagreements between states and a lack of accountability and enforcement mechanisms have prevented these initiatives from substantively implementing cyber norms. As a result, the international community and individual states are left with no accountability mechanisms or safeguards to protect civilians and critical infrastructure from bad actors in cyberspace.

Buying What Works: An Acquisitions Strategy for the Reality of Dual-Use Technologies

Belfer Center — Oct 20, 2022

Oct 20, 2022

In this student research paper, Harvard Kennedy School student Coen Williams finds that The Department of Defense should implement an “effects-driven” acquisitions system rather than “capabilities-based” to effectively acquire and utilize commercially developed capabilities. An effects-driven acquisitions system will increase the diversity of solutions, and by appropriating money to effects-driven portfolios, Congress can still maintain control of the purse while the Department of Defense can more effectively allocate its appropriated funds.

National Cyber Power Index 2022

Belfer Center — Sep 27, 2022

Sep 27, 2022

In his Note to Readers of the 2022 National Cyber Power Index, Eric Rosenbach, Belfer Center Co-Director and former Chief of Staff and Assistant Secretary for the U.S. Department of Defense, writes: “With the challenges in the cyber domain only increasing, it is critical for analytical tools to also be available, presenting the full range of cyber power, and informing critical public debates today. The framework that the NCPI provides is one that allows policymakers to consider a fuller range of challenges and threats from other state actors. The incorporation of both qualitative and quantitative models, with more than 1000 existing sources of data and with 29 indicators to measure a state’s capability, is more comprehensive than any other current measure of cyber power.”

Never Breaking the Chain: The Economics and Politics of Creating an Effective National Supply Chain Strategy

Belfer Center — Aug 31, 2022

Aug 31, 2022

The creation of a national supply chain strategy is crucial to responding to the challenge and merits specific attention from both policy and business leaders. This paper proposes specific government and business policy steps that would progress the US’s position on a more unified, strategic supply chain approach.

Continuous Compliance: Enhancing Cybersecurity for Critical Infrastructure by Strengthening Regulation, Oversight, and Monitoring

Belfer Center — Aug 31, 2022

Aug 31, 2022

In this student research paper, Harvard Kennedy School student Julian Baker finds that transition from a point-in-time framework to a method of continuous compliance would raise the level of cybersecurity for critical infrastructure, making these essential services more reliable for the people relying on them.

The New Frontier of Democratic Self-Defense

Belfer Center — Aug 22, 2022

Aug 22, 2022

The United States nor its allies alone cannot counter adversarial and criminal cyber activity in the digital domain-–the reach, scale, stealth, and danger are simply too great for any one country to bear. As such, calls for international operational collaboration in cybersecurity and emerging technologies are increasing. Former U.S. State Department Cyber Diplomat Chris Painter noted in a December 2020 Foreign Policy article that there must be more leadership and partnership on global cyber cooperation. What follows represents a thinking-through of what this ought to entail.

Bruce Schneier on the Crypto/Blockchain Disaster

Belfer Center — Aug 11, 2022

Aug 11, 2022

In an interview with Lou Covey of Cyber Protection magazine, Bruce Schneier spoke about the need to craft policy to mitigate the harms of blockchain technologies, a "disaster" that is "not going away."

How to Stand Up a Major Cyber Incident Investigations Board

Belfer Center — Jul 18, 2022

Jul 18, 2022

This guide will help independent organizations and state and local governments develop a sustainable mechanism for investigating and drawing lessons from cyber Incidents - both in the immediate aftermath and long-term.

Reframing the Debate on Cybersecurity Regulations

Belfer Center — Jul 17, 2022

Jul 17, 2022

In February 2012, the first significant attempt to set mandatory cybersecurity requirements and response plans for critical infrastructure was introduced in Congress. Unfortunately, it was watered down to voluntary standards and failed in the Senate. Opponents of the bill cited fears of overburdening regulations on companies and warnings of over-simplistic box-checking and minimum compliance. Business groups championed the narrative of big government to ensure the bill’s demise — and that narrative persists to this day.

The Geopolitics of Digital Standards

Belfer Center — Jul 1, 2022

Jul 1, 2022

This brief outlines what digital standards are and how the United States, European Union, and China approach standards development. It examines the implications of China’s efforts to advance a new model of cyber sovereignty through its “New IP” proposal to illustrate that overhauls of existing infrastructure-level standards are unlikely, but foreshadow the changing nature of standards from a historically apolitical domain to one of geopolitical importance. Finally, it offers considerations for the development of a long-term strategy that focuses on technology areas of strategic interest to the U.S. at the application layer through targeted regulations that promote a free, open, and democratic internet while maintaining a clear and technically informed understanding of what is likely to change (and what is not) at the infrastructure level.

Soberanía y localización de datos

Belfer Center — Jun 23, 2022

Jun 23, 2022

Spanish translation (2022) of original English version of "Sovereignty and Data Localization" paper by Emily Wu.

Las políticas sobre localización de datos les imponen a las empresas la obligación de almacenar y procesar los datos de manera local, en lugar de utilizar servidores ubicados fuera del país. La adopción de leyes sobre localización de datos ha venido aumentando, impulsada por el temor a que la soberanía de los países se vea amenazada debido a su incapacidad para ejercer pleno control sobre la información que almacenan fuera de sus fronteras. Este es un tema particularmente relevante para los Estados Unidos, si tenemos en cuenta su dominio en múltiples áreas del ecosistema digital, entre otras, la inteligencia artificial (IA) y la computación en la nube.

Preemption in Federal Data Security and Privacy Legislation

Belfer Center — Jun 14, 2022

Jun 14, 2022

The Belfer Center's Cyber Project and the R Street Institute's Cybersecurity and Emerging Threats Team have been working together to identify roadblocks to a federal data security and privacy law, drawing upon research and engagement with stakeholders to identify and recommend appropriate courses of action to find compromise on federal legislation. Ongoing research also includes topics like civil rights in privacy, arbitration and covered entities and data.

The Role of the Federal Trade Commission in Federal Data Security and Privacy Legislation

Belfer Center — Jun 14, 2022

Jun 14, 2022

The FTC already enforces some privacy legislation and seeks to expand on its role in data privacy. As federal data and privacy bills are considered, it is therefore critical that we understand the role the FTC might play in overseeing and enforcing such legislation as well as the important role that lawmakers will have in setting parameters for the FTC.

Limiting a Private Right of Action in Federal Data Security and Privacy Legislation

Belfer Center — Jun 14, 2022

Jun 14, 2022

Congress’s decision regarding who they choose to empower—be it individuals, state attorneys general, one or more federal agencies, or a combination thereof—will dictate the true shape of the law, once passed. If individuals are empowered with an enforcement role—that is, if a private right of action (PRA) is established—it is important to outline the structure, procedures and limits to craft a fair and functional law.

Answers to Tough Questions: the Framework of a Federal Data Security & Privacy Law

Belfer Center — Jun 14, 2022

Jun 14, 2022

This one-pager is an overview and precursor to a series of policy recommendations for a federal data privacy and security law, which answer and expand on the concepts of preemption, private right of action, and the role of the FTC.

Clear, Actionable Ways to Enhance Cybersecurity in the Water Sector

Belfer Center — Jun 7, 2022

Jun 7, 2022

Know the Adversaries. Bolster the defense. Mitigate the disaster.