Cyber Project

Belfer Center experts on security, intelligence, and cybersecurity issues were interviewed on the recent leak of classified military intelligence documents allegedly by Airman Jack Teixeira.

Thanks to large language models, a single scammer can run hundreds or thousands of cons in parallel, night and day, in every language under the sun.

When is it time to start worrying about artificial intelligence interfering in our democracy? asks Bruce Schneier. "Maybe when an AI writes a letter to The New York Times opposing the regulation of its own technology. That happened last month. And because the letter was responding to an essay we wrote, we're starting to get worried. And while the technology can be regulated, the real solution lies in recognizing that the problem is human actors—and those we can do something about."

In an interview with Lou Covey of Cyber Protection magazine, Bruce Schneier spoke about the need to craft policy to mitigate the harms of blockchain technologies, a "disaster" that is "not going away."

In February 2012, the first significant attempt to set mandatory cybersecurity requirements and response plans for critical infrastructure was introduced in Congress. Unfortunately, it was watered down to voluntary standards and failed in the Senate. Opponents of the bill cited fears of overburdening regulations on companies and warnings of over-simplistic box-checking and minimum compliance. Business groups championed the narrative of big government to ensure the bill’s demise — and that narrative persists to this day.

The Belfer Center's Cyber Project and the R Street Institute's Cybersecurity and Emerging Threats Team have been working together to identify roadblocks to a federal data security and privacy law, drawing upon research and engagement with stakeholders to identify and recommend appropriate courses of action to find compromise on federal legislation. Ongoing research also includes topics like civil rights in privacy, arbitration and covered entities and data.

The FTC already enforces some privacy legislation and seeks to expand on its role in data privacy. As federal data and privacy bills are considered, it is therefore critical that we understand the role the FTC might play in overseeing and enforcing such legislation as well as the important role that lawmakers will have in setting parameters for the FTC.

Congress’s decision regarding who they choose to empower—be it individuals, state attorneys general, one or more federal agencies, or a combination thereof—will dictate the true shape of the law, once passed. If individuals are empowered with an enforcement role—that is, if a private right of action (PRA) is established—it is important to outline the structure, procedures and limits to craft a fair and functional law.

This one-pager is an overview and precursor to a series of policy recommendations for a federal data privacy and security law, which answer and expand on the concepts of preemption, private right of action, and the role of the FTC.

Know the Adversaries. Bolster the defense. Mitigate the disaster.