Cyber Statecraft Initiative
@cyberstatecraft.bsky.social
The Cyber Statecraft Initiative works at the nexus of geopolitics and cybersecurity to craft strategies to help shape the conduct of statecraft and to better inform and secure users of technology.
US policy actions like sanctions, visa bans, and executive orders have not prevented US capital from sustaining spyware firms. The contradiction is stark and needs to be addressed: www.atlanticcouncil.org/in-depth-res...
Mythical Beasts: Diving into the depths of the global spyware market
The second edition of the Mythical Beasts project assess how the global spyware market has developed and changed over the past year.
atlanticcouncil.org
Market centralization is a cybersecurity issue! Having every internet user dependent on certain shared browser technologies creates risk. Learn more in “Homogeneity and Concentration in the Browser.” www.atlanticcouncil.org/content-seri...
Homogeneity and concentration in the browser
Web browsers are the gateway to the internet. As browser developers replicate design features and concentrate around shared underlying technologies, they create cybersecurity risks with the potential…
atlanticcouncil.org
How can cyber capabilities support crisis & contingency operations? Not just through independent operation during a crisis "but through continuous campaigning in day-to-day strategic competition." Read the full Michael Fischerkeller piece here: www.atlanticcouncil.org/in-depth-res...
What do we know about cyber operations during militarized crises?
Policymakers must critically examine assumptions and claims that cyber operations can serve as de-escalatory crisis offramps.
atlanticcouncil.org
There's no doubt non-state actors play a big role in cybersecurity. But how should policy reflect that? Hear from Simon Handler, Emma Schroeder, and Trey Herr on lessons for cyber policy from counter-terrorism. warontherocks.com/2021/05/cybe...
Cyber Security as Counter-Terrorism: Seeking a Better Debate
Earlier this month, a senior Justice Department official referred to ransomware as a potential “cyber weapon of mass destruction.” When hackers
warontherocks.com
🌐 Spyware isn't just a tech issue; it's also a human rights and national security concern. Jen Roberts, Trey Herr, and Nitansha Bansal’s report highlights how repressive states use spyware to harm their own citizens and other states. www.atlanticcouncil.org/in-depth-res...
Mythical Beasts and where to find them: Mapping the global spyware market and its threats to national security and human rights
The Mythical Beasts project pulls back the curtain on the connections between 435 entities across forty-two countries in the global spyware market.
atlanticcouncil.org
Cyberscam operations emanating from Myanmar create symbiotic benefit for criminal and armed groups, the operations themselves are intensely parasitic to the global cyber domain, the broader Southeast Asian region, and the population of Myanmar. www.atlanticcouncil.org/in-depth-res...
This job post will get you kidnapped: A deadly cycle of crime, cyberscams, and civil war in Myanmar
In Myanmar, cybercrime has become an effective vehicle through which nonstate actors can fund and perpetuate conflict.
atlanticcouncil.org
Spyware vendors were behind 75% of zero-day vulnerabilities found in Google products in 2023. This report exposes the alarming influence of these vendors on tech security. www.atlanticcouncil.org/in-depth-res...
Mythical Beasts and where to find them: Mapping the global spyware market and its threats to national security and human rights
The Mythical Beasts project pulls back the curtain on the connections between 435 entities across forty-two countries in the global spyware market.
atlanticcouncil.org
What is an open standard anyway? "Open standards are typically defined as standards developed through open, collaborative processes that can be readily implemented by any member of the public once they are finalized." If you like standards, you'll love: www.atlanticcouncil.org/in-depth-res...
User in the middle: An interoperability and security guide for policymakers
When technologies work together, it benefits users and the digital ecosystem. Policymakers can advance interoperability and security in tandem by understanding how each impacts the other.
atlanticcouncil.org
“...where good engineering practices are intersecting with good cybersecurity policy”– is that where the secret to securing the cyber supply chain lies? Read more from Anjana Rajan in CSI’s Kink in the Chain article to find out: www.atlanticcouncil.org/content-seri...
Kink in the chain: Eight perspectives on software supply chain risk management
Software supply chain attacks are popular, impactful, and are used to great effect by malicious actors. To dive deeper on this topic, we asked eight experts about these threats and how policymakers…
atlanticcouncil.org
"Avoiding the Success Trap" offers tangible policy for the US & EU to support OSS as infrastructure and points policymakers toward existing vehicles governments can modify & adapt to better support and engage with the OSS ecosystem. Check it out here: www.atlanticcouncil.org/in-depth-res...
Avoiding the success trap: Toward policy for open-source software as infrastructure
Open-source software (OSS) sits at the center of almost every digital technology moving the world since the early 1980s—laptops, cellphones, widespread internet connectivity, cloud computing, social…
atlanticcouncil.org
Internet protocols like Border Gateway Protocol and Domain Name System are critical to the Internet. They’re also very vulnerable to disruptions, hijacks, and geopolitical influence. Learn more about “The Politics of Internet Security” here: www.atlanticcouncil.org/in-depth-res...
The politics of internet security: Private industry and the future of the web
The private sector plays a crucial role in defining the changing shape of the Internet, especially its security. This report examines two protocols as examples of private sector influence over…
atlanticcouncil.org
Ship bad code? YOU could be liable! That is, if we ever figure out what legal liability for insecure software should look like.... Check out the state of the debate here: www.atlanticcouncil.org/in-depth-res...
Design questions in the software liability debate
Software liability—resurgent in the policy debate since its mention in the 2023 US National Cybersecurity Strategy—describes varied potential structures to create legal accountability for vendors of…
atlanticcouncil.org
Generative AI in hacking -- hype or reality? We examined dozens of case studies and experiments to help answer the question, finding areas of real risk and others of... exaggeration. Read more here: www.atlanticcouncil.org/in-depth-res...
Hacking with AI
Can generative AI help hackers? By deconstructing the question into attack phases and actor profiles, this report analyzes the risks, the realities, and their implications for policy.
atlanticcouncil.org
Back down from a challenge? Not Kathi Hiyane-Brown, and not when there are over 500,000 cyber jobs to be filled! The National #CyberWorkforce and Education Strategy provides a framework to tackle these tough challenges. Learn more here: www.atlanticcouncil.org/event/unleas...
The National Cyber Workforce and Education Strategy: Unleashing America’s cyber talent
An in-depth discussion on the opportunities, goals, and anticipated challenges with the National Cyber Workforce and Education Strategy
atlanticcouncil.org
What does the spyware market look like in 2024? Dive into our report “Markets Matter: A Glance into the Spyware Industry” to learn more about all the actors in this space: www.atlanticcouncil.org/in-depth-res...
Markets matter: A glance into the spyware industry
The Intellexa Consortium is a complex web of holding companies and vendors for spyware and related services. The Consortium represents a compelling example of spyware vendors in the context of the…
atlanticcouncil.org
“...I honed valuable skills—briefing principals, outlining courses of action, and making specific recommendations based on your expertise — that I exercise daily in my career now.” Read Frances Schroeder's experience in #Cyber912 in this 5x5:
The 5×5—Alumni perspectives on Cyber 9/12 Strategy Challenge
Alumni of Cyber 9/12 Strategy Challenge share their experiences, and discuss the impact of such simulated exercises to prepare for real life cyber attacks.
atlanticcouncil.org
Was discovering the XZ backdoor the OSS model working? “Clearly, open source saved the day here. Had XZ Utils been proprietary, the engineer... would never have been able to carry out his investigation,” writes Tobie Langel in this 5x5. Read more here: www.atlanticcouncil.org/content-seri...
The 5x5—The XZ backdoor: Trust and open source software
Open source software security experts share their insights into the XZ backdoor, and what it means for open source software security.
atlanticcouncil.org
Ever wondered if an OSS project having multiple funders correlates with better security practices? Check out this table from our O$$ report ⬇️
🌍 Is your #cybersecurity team ready for international expansion? Learn how global CISOs manage competing demands of data sovereignty and cross-border compliance in this 5x5: www.atlanticcouncil.org/content-seri...
The 5×5—The evolving role of CISOs and senior cybersecurity executives
For this Cybersecurity Awareness Month, senior cybersecurity executives share their insights into the evolution of their roles.
atlanticcouncil.org
Access-as-a-Service companies sell offensive cyber capabilities to states worldwide. Who sets the rules for their operation? Our report analyses this industry to develop actionable policies for the US & allies: www.atlanticcouncil.org/in-depth-res...
Countering cyber proliferation: Zeroing in on Access-as-a-Service
It is imperative that governments reevaluate their approach to countering the proliferation of offensive cyber capabilities.
atlanticcouncil.org
Hey USG, do you know what's in the cloud? Here's a hint: more and more of the data of critical infrastructure operators! Here are some ideas for what to do now that cloud security = national security. www.atlanticcouncil.org/in-depth-res...
Critical infrastructure and the cloud: Policy for emerging risk
Critical infrastructure increasingly depends upon cloud computing. Policy must adapt its approach to risk management accordingly.
atlanticcouncil.org
A while back, we held a public discussion on the lethal outcomes of cyber, lessons from the Ukraine war, and issues in building integrated military options for future wars. You can find the recording here: www.atlanticcouncil.org/event/on-bre...
On Breaking Things: Melding Cyber and Kinetic in Conflict
This panel features a discussion on lethal outcomes of cyber operations, coordination between cyber and kinetic forces, and integration of cyber options in future warfare within the context of larger…
atlanticcouncil.org
In Russia’s cyber ecosystem, even FSB officers aren’t untouchable. CSI fellow Justin Sherman dives into the sentencing of an officer who took bribes from hackers but failed to deliver protection. It’s about more than corruption—it’s a warning to others.
Take the bribe but watch your back: Why Russia imprisoned a security officer for taking cybercriminal payoffs
Russia imprisoned a security service officer for taking bribes from cybercriminals—showing not a willingness to crack down on cybercrime, but instead just how much the Kremlin wants to maintain its…
atlanticcouncil.org
Counter-proliferation needs to account for all aspects of offensive cyber capabilities: vulnerability research, malware development, technical command and control, operational management, and training and support. Check out our recommendations in: www.atlanticcouncil.org/in-depth-res...
The FTC’s enforcement actions in consumer cybersecurity hold key lessons for policymakers interested in designing or refining legal cybersecurity regimes. What lessons, you ask? Check out this paper by Isabella Wright and Maia Hamin: ️ www.atlanticcouncil.org/in-depth-res...
“Reasonable” cybersecurity in forty-seven cases: The Federal Trade Commission’s enforcement actions against unfair and deceptive cyber Practices
The FTC has brought 47 cases against companies for unfair or deceptive cybersecurity practices. What can we learn from them?
atlanticcouncil.org
"The future of real governance over this market is dependent on governments, technology companies, & civil society partners enacting scalable and transparent policies for both vendors and clients"-Jen Roberts. Check out our blog post on OCC proliferation here www.atlanticcouncil.org/content-seri...
Makings of the Market: Seven perspectives on offensive cyber capability proliferation
The marketplace for offensive cyber capabilities continues to grow globally. Their proliferation poses an expanding set of risks to national security and human rights, these capabilities also have…
atlanticcouncil.org
Cyber-physical systems are sophisticated, interdependent, and vital to society, but aren’t viewed through a policy lens that reflects this. Find out more here: www.atlanticcouncil.org/in-depth-res...
OT cyber policy: The Titanic or the iceberg
Current policy does not address the issue of cyber-physical security with a systemic approach, instead focusing with tunnel vision on specific events. This analysis uses the iceberg model for systems…
atlanticcouncil.org
How might we respond in a crisis after a criminal group has targeted a rural hospital system? At the 14th annual #Cyber912, teams tackled this scenario head-on. Read the takeaways of competitors and judges here: www.atlanticcouncil.org/content-seri...
Cyber policy in action: A glimpse into the 2025 DC Cyber 9/12 Strategy Challenge
Competitors and judges from the 2025 Washington, DC Cyber 9/12 Strategy Challenge share their perspectives on the competition's role in cyber workforce development.
atlanticcouncil.org
Cloud myth #3: Only authoritarian states distort the public cloud. Fact: Moves by democratic states to require data localization and isolated government clouds can also distort the public cloud. ⬇ www.atlanticcouncil.org/in-depth-res...
Four myths about the cloud: The geopolitics of cloud computing
In competition and cooperation, cloud computing is the canvas on which states conduct significant political, security, and economic activity.
atlanticcouncil.org
Sunburst’s move to the cloud took it from a messy supply-chain compromise to a significant intelligence-gathering coup. Read our Broken Trust report to learn more about the cloud’s critical dimension in the campaign. www.atlanticcouncil.org/programs/cyb...
Breaking Trust
The Breaking Trust project seeks to catalog software supply chain intrusions and identify major trends and implications from their execution.
atlanticcouncil.org