Governance

Intelligence agencies have struggled to define how open source intelligence fits into its broader work, but the wide breadth of publicly available information about the Ukraine conflict, combined with proactive disclosures of classified information, are providing some clarity about OSINT’s role. Lauren Zabierek and Maria Robson Morrow spoke with the Federal News Network on how the public and private sectors are leveraging open source intelligence, including challenges and opportunities.

With the looming threat of increased conflict in Ukraine, businesses around the world should be preparing now, write Paul R. Kolbe, Maria Robson Morrow, and Lauren Zabierek. Corporate security and intelligence teams have said they’re seeing an increase in cyber probes, and the U.S. Cybersecurity and Infrastructure Security Agency and the European Central Bank have both issued warnings about potential Russian cyberattacks. At this point, companies should be taking the following steps: 1) Review business continuity plans; 2) Closely examine supply chains; 3) Actively engage peer networks, vendors, and law enforcement around cyber intrusions; 4) Instill a security mindset in employees; and 5) Make sure corporate intelligence and IT teams are working closely together on solutions.

Joseph Nye argues that prudence results from the fear of creating unintended consequences in unpredictable systems and can develop into a norm of nonuse or limited use of certain weapons or a norm of limiting targets. Something like this happened with nuclear weapons when the superpowers came close to the brink of nuclear war in 1962, during the Cuban missile crisis. The Limited Test Ban Treaty followed a year later.

Joseph Nye writes that although the United States has long commanded the technological cutting edge, China is mounting a credible challenge in key areas. But, ultimately, the balance of power will be decided not by technological development but by diplomacy and strategic choices, both at home and abroad.

The powerful effects of artificial intelligence are already being felt in business, politics, medicine, war, and almost every other domain of twenty-first century life. For all of its positive potential, the technology presents significant risks that are best addressed sooner rather than later.

Tarah Wheeler and Ciaran Martin write that banning ransomware payments may be seen as as unwarranted state interference in private commerce, but they believe that a coordinated country level response would rectify the glaring deficiency in the current reality: the near-total privatization of national security risk. 

Even if formal cybersecurity treaties are unworkable, it may still be possible to set limits on certain types of civilian targets, and to negotiate rough rules of the road. Whether U.S. President Joe Biden succeeded in launching such a process at his meeting last month with Russian President Vladimir Putin may become clear soon.

Bruce Schneier and Nicholas Weaver recommend disrupting cryptocurrency markets, as opposed to banning cryptocurrencies outright,  to combat ransomware attacks.

Bruce Schneier warns that AIs are becoming hackers. They're able to find exploitable vulnerabilities in software code. They're still not very good at it, but they'll get better. It's the kind of problem that lends itself to modern machine learning techniques: an enormous amount of input data, pattern matching, and goals that permit reinforcement. We have every reason to believe that AIs will continue to get better at this task and will soon surpass humans. They'll even come up with hacks that we humans would judge creative.

Despite a technically successful election with a record-breaking voter turnout,  U.S. institutions and procedures have not created the kinds of shared public consensus over the results of the 2020 election that they were supposed to. The authors write that the United States needs a dynamic stability, one that incorporates new forces into American democracy rather than trying to deny or quash them. This report is their attempt to explain what this might mean in practice