Having had time to find my footing as a Managing Director at Beacon Global Strategies, it's time to bring back the Kitchen Sync -- with some modifications.

The Sync will now be a free weekly commentary on LinkedIn, where I’ll continue to discuss the intersection of national security, technology, and global business. The tone and content will be very familiar to you, but the primary aim will be to provide these insights in a concise brief that busy readers can quickly digest and use.

I’ll still be publishing longer commentary and analysis at The American Enterprise Institue and in other publications. You can also follow me on X (formally Twitter) for day-to-day insights and observations.

If this sounds like your cup of tea (and if you’re on LinkedIn), you can signup for free using the button below.

Subscribe on LinkedIn

This, of course, means I’ll be shutting down this Substack newsletter at the end of January but you’ll be able to sign up for the new free newsletter anytime.

I can’t wait to pick up our conversation!

Klon

Quick Facts:

• There will be some re-branding of the newsletter but it will still focus on national security and technology issues.

• The first edition of the new newsletter will be published next week on Thursday, March 3rd.

• There will be no Kitchen Sync newsletter this week as I am neck-deep in the transition.

• All paid subscribers to The Kitchen Sync will be given a 12-month paid subscription to The Dispatch, which includes nine newsletters (you choose which ones you want to receive), five podcasts, and tons of other content (a $100 value).

• All free subscribers will be automatically transitioned to The Dispatch’s free distribution list which also includes several newsletters and all of the podcasts.

• Any subscriber not wanting to make the transition to The Dispatch can click “unsubscribe” at the bottom of this email by Friday and will be removed from the distribution list, with paid subscribers also receiving a prorated refund (but I really hope you’ll come with me because we have some very exciting plans).

Why The Change?

It’s all about impact.

I write The Kitchen Sync because I believe technology is a decisive influence on our economic, social, and political lives and is especially important in matters of national security. And yet, many technologies and their policy implications can be highly-technical and confusing. The goal of this newsletter, therefore, is to raise public awareness of these issues while also making them more accessible.

That’s why this move makes sense.

By joining the excellent team at The Dispatch, I’ll be reaching tens of thousands of readers who want to be respected, told the truth, provided with expertise, and given an opportunity to join important conversations. In short: readers like you.

The Dispatch also has the experience and resources to ensure their offerings provide the best content in the most engaging mediums. Something I think you deserve.

Finally, I believe The Dispatch is doing something really important.

When Stephen Hayes and Jonah Goldberg started The Dispatch, they observed the following:

The internet puts an unimaginable amount of information at our fingertips, but it makes knowledge and wisdom harder to grasp. Social media connects people in meaningful ways but also manages to make it more difficult for us to understand each other. It is less a World Wide Web linking us all together than an accelerant, quickening trends long in the works. Our confidence in the institutions that once anchored us was declining even before the internet became a fixture in our lives, but its arrival has only made us feel even less fixed to a common landscape.

Nowhere is this more true than in the world of journalism. Not only do we have too much noise and not enough signal, but the signals we should be heeding are often discounted as noise and the noise is marketed as prophecy.

I think this is exactly right and I think technology and national security policy are too important to be lost in the noise.

I’m looking forward to this change and I can’t wait to share it with you!

With gratitude,

Klon

Tech Terms

End to End Encryption (E2EE) — End-to-end encryption secures data on the user's device and only ever decrypts it on the recipient's device. This means, the data can never be decrypted on the server nor in transit nor on the user's device.

**Heads Up **

First, I’m sorry there is no audio today. My mic decided to give up the ghost and the audio was just awful. I should be squared away soon.

If, however, you’re dying to hear the sultry sound of my voice, checkout the podcast below where I discuss cyber in Ukraine, the “New Right’s” old foreign policy, and flossing (the dance kind, not the dental kind).

The Dispatch Podcast

Ukraine Hit By Cyberattacks

Listen now (50 min) | Today on the podcast, Sarah and Steve are joined by Klon Kitchen, senior fellow at the American Enterprise Institute, to discuss the latest in Ukraine after the country was hit by cyberattacks. Plus, how much is the Republican Party’s foreign policy views changing? And what exactly can the Chinese government do with all that TikTok data…

Read more

4 years ago · 18 likes · 22 comments · Sarah Isgur and Steve Hayes

Drones & Crypto May Feature in Ukraine Conflict

What’s New: Ukraine is turning to armed drones and cryptocurrency as it prepares to repel a possible Russian invasion.

Why This Matters: Kyiv hopes armed drones will offset Moscow’s military advantages and Ukrainian resistance groups are crowd-funding their potential rebellion.

Key Points:

• Over the last year, Ukraine has employed armed drones — like the Turkish-made Bayraktar TB2 — to target Russian artillery and other forces, according to the Wall Street Journal.

• The weapons have been effective enough to make Russia complain that the provision of these systems by NATO countries is a threat to Russia’s security. (boo-hoo)

• The TB2 is popular around the world because it falls just short of American and other weapons export restrictions, but can still laser-designate targets from 12 miles away.

“Russian antiaircraft systems can’t see the TB2 at this distance,” said Yuriy Butusov, a Kyiv-based defense writer. “Ukraine has connected its camera to the battle management system and can observe at big distances with Russia being unable to take it down.”

• Separately, cryptocurrency donations to Ukrainian militias and hackers opposing Russia spiked last year, reports Wired.

• According to crypto tracing and blockchain analysis firm Elliptic, “Crowdfunded payments to those organizations in bitcoin, litecoin, ether, and other cryptocurrencies the company tracks reached a total value of around $550,000 last year, compared with just $6,000 or so in 2020.”

• One pro-Ukraine hacker collective — called the Ukrainian Cyber Alliance — has used more than $100K in crypto donations to conduct numerous hack-and-leak and web defacement ops.

What I’m Thinking:

• Drones won’t be decisive, but they’re good to have around. The TB2 isn’t that sophisticated and it certainly doesn’t offer Ukraine a military advantage over Russia’s larger, more modern, more lethal military. It can, however, be used to harass Putin’s army and to inject a little “friction” into its operations — and who knows what opportunities that might generate.

• Crypto crowdfunding will likely become normal from here on out. There are at least two reasons this trend is likely to continue: (1) global and social media are increasingly being used to raise awareness and support among populations far beyond the battlefield; (2) cryptocurrency payments aren’t necessarily illegal, are barely regulated, are easily transacted, and are increasingly easy to spend. It’s not hard to imagine freedom fighters and even terrorists groups (no, they are not the same) starting the equivalent of “go fund me” websites where supporters can make donations or even provide other material support, without ever needing to leave the couch.

Leave a comment

Tech Dances as Legislation Advances

What’s New: Senators have passed the EARN IT Act out of the Judiciary Committee, adding it to a growing list of tech-focused legislation that could upend the industry.

Why This Matters: While some of the largest tech companies have opposed the new measures, they have failed to address the grievances and concerns animating these bills and could soon be surprised by sweeping changes in how they do business.

Key Points:

• EARN IT, passed out of committee this week with no “no” votes, would constrain Section 230 protections for any company that fails to limit child exploitation materials.

• The committee also recently passed the Open App Markets Act — legislation that would force Apple and Google to fundamentally change their app business by allowing users to download apps outside of their stores and by giving app developers the freedom to use other in-app payment services.

• Finally, last month, the committee passed the American Innovation and Choice Online Act — a massive antitrust bill aimed squarely at breaking up and punishing “big tech” over their perceived political bias and “anti-competitive” behavior.

What I’m Thinking:

• I don’t like any of these bills, but that’s not really my point. I think EARN IT undermines encryption. I think Open Apps hurts cybersecurity. And I think Choice Online abandons principle and imperils national security. But all of that is for a different day. My main concern right now is how tech companies seem to be tuning their fiddles while lawmakers are gathering gasoline and matches.

• Many of these companies think they’re untouchable, but they’re wrong. For years, Apple, Google, and others have dared Congress to take meaningful action against them, betting that negative economic impacts and frustrated users in their states and districts would force lawmakers to fold. And they did — for a while. Those political dynamics, however, have changed and now there is broad, bipartisan consensus on doing something, anything, to take “big tech” down a few notches. This is why the steady march of anti-tech legislation is likely to continue and may even become law.

• Arrogance is gas on the fire. During debate on the Open App Markets Act, Apple and Google centered their arguments on the idea that, if forced to open devices to third-party app stores, they could no longer protect users’ data because they could no longer guarantee the cybersecurity practices of third-party app developers. This is actually a valid and compelling argument in my view. The problem, however, is that at the exact same time they were making these arguments, both companies were distributing China’s My2022 Olympics app — an app that cybersecurity researchers said was harvesting troves of data, exposing communications, and enabling spying by the Chinese government. Even after these concerns were raised, both app stores kept My2022 where it could be downloaded by Americans and millions of others. This decision, all by itself, decisively undermined these companies’ complaints about the Open App Markets Act and explains how this bill passed out of committee with nary a whisper. Now maybe executives console themselves by reasoning that laws like these have advanced out of committee before but never advanced to a full floor vote or to the President’s desk, and therefore, there’s nothing to worry about. I’m here to tell you, that’s no longer a safe bet.

Leave a comment

Iran Suspected in Red Cross Hack

What’s New: Last month, it was discovered that the personal information from more than 500K people was stolen from the International Committee for the Red Cross (ICRC), according to Krebs on Security.

Why This Matters: Forensic evidence suggest the hack was done by Iranian operatives and is tied to a large influence operation.

Key Points:

• The intrusion occurred last November and resulted in the loss of data associated with half a million people receiving aid from the non-profit organization.

• Part of the evidence tying the attack to Iran includes an email that was used to offer the stolen data to would-be buyers, that the FBI says is linked to an ongoing Iranian government influence effort.

• That same email was used to purchase and register several domains associated with the Liberty Front Press, a network of fake news sites assessed to be run out of Iran.

“Right now,” says an ICRC statement, “we do not have any conclusive evidence that this information from the data breach has been published or is being traded. Our cybersecurity team has looked into any reported allegation of data being available on the dark web.”

What I’m Thinking:

• Liberty Front Press is not new. In 2020, the U.S. Department of Justice took several actions against domains tied to Liberty Front Press and publicly accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of using these domains for “covert influence.” Later that year, the U.S. Treasury Department sanctioned five Iran-linked organizations for spreading fake news and other efforts to sow discord in the U.S.

• It’s not clear why, but this hack had purpose. A lot of the details are still emerging and there’s quite a bit of confusion about aspects of the attack. But, there are reasons to believe this attack was sophisticated and targeted. (1) The bad guys used a set of tools that are often used by advance persistent threat groups (APTs) and that are not broadly available. (2) They were very skilled at hiding their tracks. (3) It looks like these black hats also designed some code that was tailor made for use on ICRC servers. (4) The attackers were very good at moving and removing files in a way that did not trip ICRC anti-malware and other security tools. So bottom line: this wasn’t random but we’re also not sure what the specific objectives of this operation were — stay tuned.

Leave a comment

Let’s Get Visual

Nerd Humor

Quick Clicks

• New INTEL program has AI match texts to authors

• IRS drops facial recognition program

• Google plans privacy changes

• Alibaba, Tencent tagged by U.S. for counterfeit sales

• Indian tax authorities raid Huawei offices

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

Tech Terms

Sideload — The standard way to install an app on an iOS or Android device is to download it from Apple's App Store or Google's Play Store. Sideloading an app bypasses the app store, installing the app directly from a local device.

***Heads Up***

Yesterday, I responded to this essay in the New York Times. You can read it by clicking the “card” below.

Restraint advocates, and particularly those on the “new right,” speak eloquently of a United States awash in freedom and resources, but never explain how they intend to rid us of the inescapable foreign commitments and actions necessary to secure this domestic prosperity and tranquility.

The Dispatch

The Old—and Incoherent—Foreign Policy of the New Right

Last week, “national conservatives” Sohrab Ahmari, Patrick Deneen, and Gladden Pappin published a guest essay in the New York Times titled “Hawks Are Standing in the Way of a New Republican Party.” I have read this art…

Read more

4 years ago · 27 likes · 14 comments · Klon Kitchen

News Corp. Hit by Cyberattack

What’s New: The American media and publishing company, News Corp., disclosed that it has been breached by suspected China-based hackers, according to the Wall Street Journal.

Why This Matters: News Corp. is massive and its assets include Dow Jones & Company (publisher of the Wall Street Journal), News UK (publisher of The Sun and The Times), News Corp Australia, REA Group, Realtor.com, and HarperCollins.

Key Points:

• The breach was discovered on January 20th, but is now suspected to go back at least until February 2020.

• News Corp. says it immediately notified law enforcement and then hired the Mandiant Inc. cybersecurity firm.

“Mandiant assesses that those behind this activity have a China nexus, and we believe they are likely involved in espionage activities to collect intelligence to benefit China’s interests,” said David Wong, vice president of incident response at Mandiant.

• A spokesman for the Chinese Embassy, Liu Pengyu, said, “We hope that there can be a professional, responsible and evidence-based approach to identifying cyber-related incidents, rather than making allegations based on speculations.”

• While the scope of the breach is still being determined, The Wall Street Journal quotes people briefed on the matter as confirming that the attackers gained access to reporters’ draft articles, emails, and other data.

What I’m Thinking:

• Two years is a very long time. In cybersecurity, the time between when a breach occurs and when it is discovered is called the Breach Detection Gap (BDG) or dwell time. Over the last several years the average BDG has dropped significantly, with a current average of 146 days, according to FireEye, while the average cost of a data breach has risen to a 17-year-high of $4.2million. The fact that this breach extends to more than 700 days means we’re looking at an attack with very large implications — most of which aren’t even known yet. Also, once a sophisticated attacker gains access to a victim’s network, they move “laterally” through that network while also “escalating” their “privileges” (i.e., expanding their access to the network, often by stealing the credentials of users with broad permissions). Counterintuitively, as an attacker expands their presence on a network — if they’re careful — they can hide their activity better by understanding and avoiding security measures and by masking their activities to look more like normal network traffic. This is why, according to Trustwave, 81% of “reported intrusions are not detected by internal security processes but rather by news reports, law enforcement notifications, or external fraud monitoring.”

• News Corp. is a sweet target. One of the best ways to maximize limited intelligence gathering resources is to choose targets with the most “bang for the buck” — and boy, this media conglomerate offers a lot of bang. Think about it: by popping News Corp. you get access, not only to all of their published materials, but also all of their unpublished research on virtually every news-worthy topic you can imagine. You get reporters’ notes, sources, ideas, etc. You get their private communications from around the world as they report on world leaders, business tycoons, human rights advocates, and the foreign press. The attackers even get a detailed understanding of how a story is generated, reported, and published — giving them even more insight into how they can shape and manipulate this process for their own purposes. Now put this capability in the hands of the Chinese government’s hacking enterprise, an enterprise the FBI Director says is “bigger than those of every other major nation combined,” and you’ve got yourself a real problem.

• I’m concerned about a looming cyber shrug. This is just one of the many, many cybersecurity incidents that are reported every day. Even for me, the unrelenting drumbeat of just the truly huge data breaches threatens to recede into the background as a low-level “hum,” because no one can keep up with them all and no one should have to be on high alert all of the time. But, just because these attacks are familiar doesn’t mean they are no big deal. Our national cybersecurity has been a hot topic for policymakers for the last several months but I’m concerned that, in the face of what feels like an overwhelming challenge and no clear way forward strategically, political will and attention will ebb away. And then one day, our enemies will finally leverage the data, influence, and compromises they have amassed and we’ll have nothing left to do but pick up the pieces. This is why Congress needs a select committee on cybersecurity — to keep policymakers’ eyes on the ball and to drive executive accountability. The threat couldn’t be any more clear and we shouldn’t shrug it off.

Leave a comment

Pentagon Suppliers Struggling to Meet Cybersecurity Requirements

What’s New: Only one in four defense contractors are in compliance with the Department of Defense’s cybersecurity standards, according to the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).

Why This Matters: The standards were originally designed to protect critical weapons systems from foreign hackers, but the Biden administration is planning to expand them to more than 200K companies across the defense supply chain.

Key Points:

• The Cybersecurity Maturity Model Certification (CMMC) was first announced in 2019 and seeks to formalize the cybersecurity assessment and reporting of critical defense contractors.

• Before this, most defense industrial base cybersecurity assessments were based on a self-assessment and a report against NIST SP-800-171 standards.

• According to the DIBCAC Director Mr. John Ellis, however, three-quarters of the 220 contractors that have been assessed by the Pentagon have failed to meet these baselines and are now operating under “special agreements.”

“It is clear that a very large number of companies have a very great deal of work to do” to meet the CMMC standards, said Robert Metzger, an attorney and former member of the Defense Science Board Task Force on Cyber Supply Chain.

• Despite these failures, the White House continues to expand the rollout of these standards to the entire defense industrial base over the next few years.

What I’m Thinking:

• The CMMC is a good idea, but it was always going to be painful. Having a set of common, verifiable cybersecurity standards for the folks who build the stuff we need to fight and win wars is obviously important and not too much to ask from defense contractors. That said, suppliers are not wrong when they complain that some of the CMMC’s 110 requirements are unclear, expensive, and can even be unfair. Further, we’re talking about an industrial base of more than 200K companies worth more than $500 billion. This means the government is trying to wrangle and shape a massive challenge and it was never going to be easy.

• The best we can do is just keep at it. Implementing the CMMC is going to take time and patience — but it’s worth it. Expanding the CMMC will require even more time and patience — but this too will be worth it. Even if these efforts take decades (and they likely will), the nation will be better off than we were just a few years ago. So everyone needs to settle in, get comfortable, and get after it. Eventually, we’ll need to think about how to turn the screw on companies who aren’t coming into compliance quickly enough. But I suspect now is largely the time for carrots, not sticks.

Leave a comment

Skydio’s Win is a Good Sign

What’s New: The Army has chosen U.S. drone maker Skydio for its Short Range Reconnaissance (SRR) Program of Record, according to a company press release.

Why This Matters: The contract has a base year value of $20 million and could be worth nearly $100 million over five years — constituting one of the most significant DoD contracts with an agile, non-traditional defense contractor out of Silicon Valley.

Key Points:

• The Army teamed up with the Defense Innovation Unit to review more than 30 unmanned reconnaissance and surveillance proposals.

• Skydio’s X2D was selected based on “soldier feedback and design review packages intended to assess the overall product performance, quality, and production readiness.”

“With the SRR program, our soldiers will now have access to the most advanced capabilities in the world in this class," said Skydio CEO, Adam Bry. "Skydio drones deliver unparalleled situational awareness and ease of use in the most demanding situations thanks to Skydio Autonomy.”

Here’s a quick video of a Skydio drone in action:

What I’m Thinking:

• Full disclosure: I know and like these folks. I’ve had the opportunity to spend time with Adam and his team and they are really impressive.

• Their kit really works. There are lots of drone companies out there but Skydio is known for its autonomous AI, which allows their platforms to avoid objects, fly routes, map objects, and complete other tasks with minimal effort from a human pilot. They won this contract for a reason.

• I’m encouraged by what this could mean. I’ve long said that one of the key challenges to incorporating non-traditional defense contractors into Pentagon acquisitions is the infrequency with which DoD awards these companies with real programs of record. Typically, “start-ups” like Skydio will only get proof-of-concept or other limited funding that also comes with a lot strings that can make doing business with the military difficult or even impossible. Over the last several years, the government has evolved its authorities and processes to be more agile and, I hope, we’ll be seeing more of these contracts very soon.

Leave a comment

Let’s Get Visual: Using Planets to Visualize the Speed of Light

From The Visual Capitalist:

We often come across the term “light-year” in the context of space travel. But what does it actually mean?

A light-year is the distance light travels in one year. At a speed of 186,000 miles/sec (300,000km/sec), light travels 5.88 trillion miles (9.46 trillion km) in a year—a distance well beyond immediate comprehension.

Scientists created the term light-year to measure astronomical distances beyond the confines of the Earth. And in the vastness of space, light photons, which can go around the Earth 7.5 times in just one second, seem slow.

The above animation from planetary scientist Dr.James O’Donoghue helps put the speed of light into a broader perspective while highlighting the vast distances between celestial bodies.

Nerd Humor

Quick Clicks

• What is Starship? SpaceX builds its next-gen rocket

• Softbank sale of Arm chip group to Nvidia falls through

• Seoul is tracking the travel of its chip engineers

• Navy tests AI, unmanned systems in five sea, 60 nation exercise

• $4.4 million stolen in blockchain infrastructure attack

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

Tech Terms

Transformer — A transformer is a deep learning model that adopts the mechanism of self-attention, differentially weighting the significance of each part of the input data. It is used primarily in the field of natural language processing (NLP) and in computer vision (CV).

FBI Director is Trying to Make a Point

What’s New: FBI Director Christopher Wray gave a speech this week on “Countering Threats Posed by the Chinese Government Inside the U.S.”

Why This Matters: Wray gave a similarly pointed speech in 2020 and his other public comments since have had a consistent message — the United States has a China problem that it cannot ignore.

Key Points:

• On Monday, Wray spoke at the Ronald Reagan Presidential Library and Museum in Simi Valley, CA and was unambiguous in his analysis.

[The threat from China has] “reached a new level—more brazen, more damaging than ever before, and it’s vital—vital—that all of us focus on that threat together,” said Wray. “When we tally up what we see in our investigations—over 2,000 of which are focused on the Chinese government trying to steal our information and technology—there is just no country that presents a broader threat to our ideas, our innovation, and our economic security than China.”

• The Director makes clear that the challenge is broad in scope and complex in sophistication.

“What makes the Chinese government’s strategy so insidious is the way it exploits multiple avenues at once, often in seemingly innocuous ways … They unleash a massive, sophisticated hacking program that is bigger than those of every other major nation combined. Operating from pretty much every major city in China, with a lot of funding and sophisticated tools, and often joining forces with cyber criminals … At the same time, the Chinese government uses intelligence officers to target the same information, multiplying their efforts by working extensively through scores of so-called co-optees. Basically, people who aren’t technically Chinese government officials but who assist in their intelligence operations—spotting and assessing sources, providing cover, communications, and helping steal secrets in other ways. The Chinese government also makes investments and partnerships to position their proxies to take valuable technology.”

• But it’s about more than just hacking and IP theft.

“The Chinese government is increasingly targeting people inside the U.S. for personal and political retribution—undercutting the freedoms that our Constitution and laws promise … Over the past eight years, the Chinese government has hauled home more than 9,000 people worldwide, bringing them back to China, where they can be imprisoned or controlled … Currently, there are hundreds of people on U.S. soil who are on the Chinese government’s official Fox Hunt1 list and a whole lot more that are not on the official list. And most of the targets are green card holders, naturalized citizens—folks with important rights and protections under U.S. law.”

• Wray closes with an optimistic note and a promise.

“All of us in America—and across the free world—are in this together. And as President Reagan said in his inaugural address, “No arsenal or no weapon in the arsenals of the world is so formidable as the will and moral courage of free men and women.” And I have been heartened to see that recognition take hold, to watch and help our partners gird for the long, important fight now underway. And everyone involved in that fight can be certain that you will have no more committed partner than the FBI.”

What I’m Thinking:

• No need to beat a dead horse (but somebody hand me a stick). My views on the Chinese Communist Party are well known and I don’t need to belabor this story with repetitive commentary. That said, I want to underscore (again) the scale of this challenge because Wray’s speech has this squarely in view. The United States’ policy towards China continues to be convoluted and, at times, contradicting. If Chinese theft of data and IP is as big of a threat as Wray says — and it is — then we need a foreign policy that punishes Beijing for this theft and complementary domestic policies that actually protect against it. If the CCP hacking campaign is “bigger than those of every other major nation combined,” then we need to have a comprehensive national cybersecurity strategy that is actually being implemented and a coherent overarching policy for dealing with all Chinese companies in the U.S. market — every one of which is subject to CCP law and coercion. Finally, if there is “no country that presents a broader threat to our ideas, our innovation, and our economic security than China,” then we have to crack down on U.S. outbound investments that are enabling China’s technological rise and its ability to imperil our citizens and interests. The Biden administration needs to remember that China is a strategic opponent on the world stage — one with a defined and hostile ideology, with a comprehensive plan for leveraging its national power to constrain our own, and with real resources for implementing this plan. The discreet efforts of the FBI are laudable and necessary. But they’re not sufficient.

Leave a comment

A Hacker Hacks the Hermit Kingdom

What’s New: A lone hacker reportedly took down North Korea’s internet, according to Wired.

Why This Matters: The story illustrates how, even in a world of powerful state actors, individual actors can have outsized geopolitical influence.

Key Points:

• Recently, almost all of North Korea’s websites (only a few dozen) have experienced intermittent service problems — with at least one of the country’s central networks being completely incapable of connecting to the global internet.

• Some believed this was the work of the United States or another nation in response to Pyongyang’s recent missile tests.

• Wired reports, however, that the takedown is the work of P4x, an independent hacker who was himself hacked by North Korea just over one year ago.

“It felt like the right thing to do here. If they don’t see we have teeth, it’s just going to keep coming,” says the hacker. (P4x spoke to WIRED and shared screen recordings to verify his responsibility for the attacks but declined to use his real name for fear of prosecution or retaliation.) “I want them to understand that if you come at us, it means some of your infrastructure is going down for a while.”

• P4x says he disrupted the Hermit Kingdom’s internet by exploiting several unpatched vulnerabilities and launching a distributed denial of service (DDOS) attack — essentially flooding North Korean servers with more internet traffic than they could handle.

• The U.S.-based hacker also says he’s trying to get Washington’s attention because it has not, in his view, responded aggressively enough to North Korea’s targeting of foreign cybersecurity researchers: “If no one’s going to help me, I’m going to help myself.”

What I’m Thinking:

• This wasn’t a huge hit against North Korea. Very few North Koreans have internet access and many of the nation’s government-backed hackers are likely located in other countries — especially in China.

• But it wasn’t nothing. Any time one person takes down a significant portion of the internet it’s a reminder of how vulnerable some systems continue to be. P4x’s DDOS attack wasn’t particularly sophisticated, but it might still have significant implications.

• Beware of unintended consequences. It’s not hard to sympathize with P4x’s frustrations over a perceived lack of government help; but, his actions could have important consequences beyond him. For example, what if his actions disrupted ongoing Western intelligence efforts piggybacking on the networks he brought down? What if the DDOS attack had caused cascading failures of essential services, punishing innocent North Koreans who are already suffering under Kim Jong Un’s despotism? Finally, what if the North Koreans decide that they can’t have every disgruntled hacker shutting down the nation’s internet and so they take more aggressive, punitive actions that risk escalating tensions between Washington and Pyongyang? This is why I continue to oppose so-called “hack back” laws that would allow citizens to attack hackers online. There are too many tripwires for bad things and it is hard enough navigating the cyber domain without a bunch of cyber renegades running around shooting up the place.

Leave a comment

An AI is Matching Human Coders

What’s New: DeepMind has a new AI algorithm that writes computer programs at a competitive level.

Why This Matters: Writing programs requires a mix of critical thinking, logic, natural language understanding, coding, and algorithms. An AI that can do all of these things could transform how such programs are generated in the future.

Key Points:

• DeepMind is owned by Google parent company, Alphabet and has produced a number of bleeding-edge algorithms.

• The new algo, AlphaCode, “uses transformer-based language models to generate code at an unprecedented scale, and then smartly filters to a small set of promising programs,” according to DeepMind.

• In plain English this means the algo has learned how to throw a lot of code “spaghetti” against the wall and to identify which programs are most likely to solve the defined problem.

• The amazing part is that DeepMind validated AlphaCode by having it complete 10 different coding competitions where it performed at the level of a median human competitor — “marking the first time an AI code generation system has reached a competitive level of performance in programming competitions.”

“Solving competitive programming problems is a really hard thing to do, requiring both good coding skills and problem solving creativity in humans,” said Peter Mitrichev, a software engineer at Google and world-class competitive programmer. “I was very impressed that AlphaCode could make progress in this area, and excited to see how the model uses its statement understanding to produce code and guide its random exploration to create solutions.”

What I’m Thinking:

• What will we get when AI creates itself? While AlphaCode has a long way to go before it can write its own AI programming, the processing power of these programs often allow them to become exponentially more sophisticated in relatively short time frames. At the point where AIs are able to produce other working AIs, we’ll be entering a world where computer programming could simply be something we ask a digital personal assistant to do for us — “Hey Siri, I need an app that tracks my grocery spending and buys Pringles in bulk when they go on sale.”

• I mean, I guess there are applications beyond Pringles. This type of autonomous coding would not only make the “magic” of software development more accessible for everyone, the tendency of AIs to employ novel and counterintuitive approaches would likely also lead to new software development models, languages, and tools that humans are less likely to create — advancing and shaping our technological future in ways that are hard to even imagine right now.

Leave a comment

Let’s Get Visual

Nerd Humor

Quick Clicks

• U.S. sends official to help NATO brace for Russian cyberattacks

• Making the House’s “China Bill” worthwhile

• FAA announces progress expanding 5G

• Inside Trickbot, Russia’s notorious ransomware gang

• Taiwan can’t wait

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

What’s New: In yesterday’s Briefing I discussed security concerns with China’s My2022 Olympics app. In this story, I cited research done by Citizen Lab and Jonathan Scott — both of whom claim My2022 has serious flaws. Mr. Scott’s claims were particularly alarming, stating, “All Olympian audio is being collected, analyzed and saved on Chinese servers.”

This claim is getting serious criticism from the broader information security sector and — I must confess — it’s beyond my technical expertise to independently verify. While some of the critiques are petty, there is a growing number of experts that I trust calling Scott’s research into question.

Why This Matters: I want my readers to trust what they read in this newsletter and to know that I will always provide the most accurate information I can.

What I’m Thinking:

• I don’t think this really changes much. First, the Citizen Lab tear-down still stands. Second, even if the app were flawless, the developer and everyone attending the Games in China are subject to known Chinese cybersecurity and national security laws that give the CCP unfettered access. In other words, user data doesn’t have to “leak” from the app; it can simply be gathered directly from the servers and other infrastructure under the government’s control. A simple read of the app’s Terms of Service shows it is collecting tons of data and the use of software from known human rights violator, iFLYTEK, is also confirmed. So there’s still plenty wrong with My2022.

• App store rules need to change. Going forward, if companies really want to credibly host “secure” app stores and to protect their users, then they can no longer treat all developers the same. In light of everything we know, is it really sufficient to pretend that, if a Chinese-developed app doesn’t overtly leak like a sieve and if they promise they’re not misusing the information they collect, then everything must be ok? I understand wanting to treat all developers the same, but they’re not. Chinese developers operate under different rules, have different obligations to their home government, and are legally required to deny and hide those obligations. If tech leaders really believe “privacy is a human right,” then it seems obvious that the status quo is insufficient.

As a thank you for your understanding, here’s a photo of Bo telling me, “Dude, get off your laptop and get to scratchin’.”

Thanks for being a subscriber and I hope the rest of your weekend is awesome!

Klon

Tech Terms

Boot Sequence — The initial series of processes a computer runs when starting up.

China’s Olympics App is Pure Spyware

What’s New: Cybersecurity researchers say the My2022 mobile app — the official app of the Beijing Winter Olympics — has serious security vulnerabilities and that “all Olympian audio is being collected, analyzed and saved on Chinese servers.”

Why This Matters: The Chinese government is mandating all Olympic athletes, coaches, and attendees use the My2022 app and, as of Thursday morning, the app is still available in the Apple and Android U.S. app stores where Americans can download it too.

Key Points:

• The Chinese government says My2022 was developed by the Beijing Organizing Committee for the 2022 Olympics and records show that it is owned by the state-controlled Beijing Financial Holdings Group.

• The app’s public capabilities include COVID-19 health monitoring, GPS navigation, and numerous tourism recommendations.

• Citizen Lab researchers, however, demonstrate the app has a “devastating flaw where encryption protecting users’ voice audio and file transfers can be trivially sidestepped.”

• Jonathan Scott, a mobile and IoT security researcher specializing in malware, spyware, and forensics, has also done a complete breakdown of the app and is raising alarms.

• Of special concern is Scott’s discovery that My2022 is built using voice recognition and processing tech from iFLYTEK — a Chinese company that is blacklisted in the United States because of gross human rights violations.

• iFLYTEK’s capabilities allow the app, according to Jonathan Scott, to conduct “continuous” voice monitoring.

What I’m Thinking:

• No one should be surprised. Beijing has not been secretive about its desire to have and to use all data within its reach. For years, the Chinese government has enacted laws that ensure it has unfettered digital access and every Chinese company has been put on notice that anything less than full compliance with these government mandates will result in massive fines, executive imprisonment, and even being shut down completely. The only thing surprising here is that anyone believed the CCP would not want to strictly control the Winter Olympics and to seize the opportunity of hoovering up the deluge of data that will be created by the games.

• This could/should have been avoided. Both Apple and Google will tell you they have thousands of app submissions to their stores everyday and that it’s impossible to do a deep-dive on every one of them. But, My2022 isn’t just another app — it’s an app developed by a state-run company, for the Chinese government, and mandated for every single Olympic participant. It collects tons of personal data and it should have been prioritized and examined with a fine-tooth comb. Even after outside researchers raised concerns about the app, it has remained in both companies’ app stores where Americans can download it, potentially compromising them as well. And even after the Citizen Lab report and the research by Jonathan Scott, the Apple app store still claims that the only data My2022 can connect to users is their contact information.

• Capitulating to the Chinese invites U.S. regulations. The games in Beijing begin on February 4th. The day before, the U.S. Senate Judiciary Committee is scheduled to mark up the Open Apps Market Act — a bill that would require tech companies to relinquish control over how users add applications to their devices. I don’t like this bill and I’m on record explaining how laws like this would actually compromise our individual and corporate cybersecurity. But, failures like the My2022 app — especially if Apple and Google do not take decisive action before the games — completely undermine any assertion that these companies oppose opening up their app stores over security concerns. While I believe that capitulation to the CCP does not justify the United States cutting its own cybersecurity throat, there’s no denying that these companies are severely undermining their credibility. Apple and Google will need to explain themselves specifically, publicly, and convincingly if they want any hope of mitigating the justified frustrations of policy makers and the general public.

Leave a comment

Preparing for Cyber Spillover from Ukraine

What’s New: As the situation along the Russia-Ukraine border continues to evolve, government officials and private sector leaders are preparing for possible cyber “spillover.”

Why This Matters: Previous Russian cyber operations that began in Ukraine have caused billions of dollars in damages around the world and the prospect of escalating hostilities in the region raises the specter of even more trouble to come.

Key Points:

• The United States has responded in writing to Russia’s insane list of demands and, reportedly, Washington said, “Nah,” (though the U.S. letter has not been publicly released).

• Meanwhile, Russian troops continue their “exercises” along Ukraine’s border with Russia and Belarus and the Biden administration is ordering more than 8,500 troops on alert for a rapid deployment to Europe.

• Relatedly, the Department of Homeland Security issued a memo to law enforcement warning that Moscow may execute cyber attacks against the United States if things go sideways and CISA (DHS’s Cybersecurity and Infrastructure Security Agency) also warned American companies of these concerns.

• A growing list of companies are reviewing their ties in Ukraine and those of their key vendors, according to the Wall Street Journal, as they seek to bolster their resilience to Russian attacks online.

“The worst-case scenario, cybersecurity experts warn, would be escalating breaches that mimic the 2017 NotPetya attack on a Ukrainian accounting firm that allowed hackers to rampage across other corporate networks, eventually causing an estimated $10 billion in global damage.”

What I’m Thinking:

• This is getting serious. Last year’s Annual Threat Assessment by the ODNI states, “Russia continues to target critical infrastructure, including underwater cables and industrial control systems, in the United States and in allied and partner countries, as compromising such infrastructure improves—and in some cases can demonstrate—its ability to damage infrastructure during a crisis.” It also observes, “Russia almost certainly considers cyber attacks an acceptable option to deter adversaries, control escalation, and prosecute conflicts.” What does this mean? It means Moscow has the ability to execute devastating cyber attacks in the West and that we are entering a scenario where it might actually choose to do so. The actions of DHS/CISA and industry demonstrate such concerns are well-founded.

• Spillover happens. Like a biological virus, digital viruses and other malware can be hard to contain. Interconnected networks and broadly deployed core hardware and software can allow an attack to quickly spread beyond its intended target(s). That means Russia could conduct an attack aimed squarely at Ukraine but its consequences could go well beyond that country — possibly pulling other nations into a conflict and climbing up the escalation ladder. If such spillover occurs, it will be doubly important that all involved watch their steps.

Leave a comment

Synthetic Simulations of Tomorrow’s Realities

What’s New: Joe Robinson at Wired has an interesting article on how simulation tech can help predict the biggest threats.

Why This Matters: “Traditional analysis tools are poorly equipped to predict and respond to these blurred and intertwined threats,” says Robinson. “Instead, in 2022 governments and militaries will use sophisticated and credible real-life simulations, putting software at the heart of their decision-making and operating processes.”

Key Points:

• The article cites the Brits’ development of a “digital backbone” for their Ministry of Defense that integrates cloud computing, advanced analytics and a new capability called Single Synthetic Environments (SSE).

• SSEs leverage AI/Machine Learning, distributed systems, and cutting-edge modeling to make detailed simulations of the real world.

• The idea, then, is that military strategists and warfighters can use these synthetic environments to predict, understand, and plan for future challenges.

“National security officials will be able to use SSEs to identify threats early, understand them better, explore their response options, and analyze the likely consequences of different actions. They will even be able to use them to train, rehearse, and implement their plans. By running thousands of simulated futures, senior leaders will be able to grapple with complex questions, refining policies and complex plans in a virtual world before implementing them in the real one.”

What I’m Thinking:

• This stuff is real, but not quite ready for showtime. Robinson’s article is interesting and well worth the read. And, while SSEs and other advanced modeling capabilities continue to progress — I’m not as excited as the article suggests we should be. It’s true that these SSEs can be highly detailed and very useful generally; but to be an actual digital representation of the real world they require volumes of real-world data that we simply do not have. That’s not to say these tools have no utility or that they will never realize their full promise. As 5G and follow-on network upgrades enable a real internet-of-things, we’ll move closer to truly representative SSEs and that will be a massive improvement for everyone from military leaders to city planners. Until then, though, these models are still very much a work in progress.

Leave a comment

Let’s Get Visual: The Top 10 Biggest Companies in India

Nerd Humor

Quick Clicks

• SEC looks to bolster market’s cyber defenses

• An ingredient list for software could help prevent the next log4j

• Biden expanding NSA’s role in gov cybersecurity

• DARPA demonstrates drone swarms

• SpaceX signs deal to rocket military cargo around the world

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

As a paid subscriber to The Kitchen Sync, you have access to monthly Zoom calls with some of the most influential and interesting people working at the nexus of technology and national security.

On Monday, January 31st at 7pm, our conversation will be with Eric Sayers, one of the most influential “hidden hands” of American policy in Asia. I’m confi…

Read more

Tech Terms

Elastic Computing — The capability of cloud services to decrease or expand computer storage, memory, and processing to handle fluctuating demand.

Don’t be Fooled by Russia’s Ransomware Roundup

What’s New: The Russian government has arrested several members of the REvil ransomware syndicate, the group responsible for last year’s attacks against meat supplier JBS and customers of the IT company Kaseya.

Why This Matters: REvil has been under pressure since its high-profile attacks last year and President Biden has called on Russia to crack down on ransomware groups operating within its borders.

Key Points:

• Members of the Federal Security Service (FSB) raided and arrested 14 REvil members, seizing computers, luxury vehicles, and more than $5.5 million in cryptocurrency and rubles, according to Wired.

“The organized criminal community ceased to exist, the information infrastructure used for criminal purposes was neutralized,” a translated version of the FSB’s statement says.

• The FSB went on to say that the arrests were in direct response to Biden’s request for action.

What I’m Thinking:

• There’s no rest for the wicked. For a long time, ransomware groups were assured they could operate with near impunity inside of Russia so long as they didn’t cause the country too much trouble internationally and they complied with government requests for “technical assistance.” But that deal was always transactional and hackers inside of Putin’s paradise are now getting the message that they might be arrested or otherwise constrained if the country’s political interests require such actions. Don’t feel too bad for the REvil jerks, they’re not going to be deported and they’ll likely continue to be employed and handsomely rewarded by the FSB.

• The is the Devil rebuking sin. While Putin’s REvil roundup would appear to serve U.S. interests, it falls within the broader context of growing tensions along the Ukrainian border. Negotiations between the United States and Russia have failed to turn down the heat and Moscow is poised to cross the border any day. Even more so after the President’s disastrous press conference this week where he indicated NATO is divided and that America’s promise of crippling sanctions might not materialize if Putin only conducts a “minor incursion.” The arrests were almost certainly a political ploy aimed at signaling to the United States that Russia has the ability to take decisive action against ransomware groups if it wants or it can let them off the chain — and both possibilities should be considered as the United States charts its path on Ukraine.

Leave a comment

Alibaba’s Turn in the Dock

What’s New: The Biden administration is reviewing Alibaba’s U.S. cloud business over concerns that it might pose a threat to American national security, according to Reuters.

Why This Matters: The company is an e-commerce giant, bigger than Amazon, with extensive cloud service offerings that, until recently, appeared poised to expand rapidly in the United States.

Key Points:

• Alibaba Group Holding Limited is a China-based company offering a suite of businesses, including core commerce, cloud computing, and digital media and entertainment — generating more than $100 billion in revenue last year.

• Alibaba Cloud is China’s largest cloud provider and offers everything from database, storage, and network virtualization to elastic computing, data analytics, machine learning, and IoT services. But its U.S. business is relatively small at an estimated $50 million.

• The U.S. is reportedly concerned about how Alibaba stores, secures, and manages the data of its American clients and whether the Chinese government can access this information.

• The Commerce Department’s Office of Intelligence and Security (OIS) is reportedly leading the investigation; but, the agency declined to comment on the story.

• The OIS was created by the Trump administration as it rolled out new authorities for the Commerce Department to review and reject transactions between U.S. and foreign telecom and technology companies.

• Separate, but relatedly, France’s National Agency for the Security of Information Systems (ANSSI) is pushing back on a plan to have Alibaba as a provider of cloud services for the 2024 Olympic Games in Paris over data security concerns.

What I’m Thinking:

• These companies don’t have to be evil, just compliant. I’ve always liked Alibaba. Its founder, Jack Ma, is a charismatic and seemingly nice guy. He’s not really a tech guru but he built a massive tech company. He also appeared to have some significant differences with the Chinese Communist Party (CCP). And that’s when things went sideways for him and his company. Last year, just before Alibaba’s ANT financial company was about to have the largest public offering in history, Ma publicly criticized the CCP and the government responded by stopping the listing, placing Ma in a suspected house arrest, and hitting Alibaba (and other Chinese tech companies) with mounting regulations. You see, in China, the communist government is supreme and irresistible. If you want to do business as a Chinese company you have to play ball with the CCP — and this is the root of U.S. concerns about Alibaba’s cloud services. We know Chinese law gives the government access to all data and we know that companies who don’t comply with the government don’t stay in business very long. The OIS investigation should be completed with rigor but we already know what it should conclude: so long as the CCP is running China, Chinese technology providers cannot be trusted to operate safely or securely in the United States.

  Leave a comment

Distrust is our Default

What’s New: The 2022 Edelman Trust Barometer is out and its findings are not good.

Why This Matters: This annual report tracks and analyzes how trust is shaping the world economically, socially, and politically. While not a pure “tech” issue, I often find this report helpful in understanding many of the social dynamics shaping tech and national security.

Key Points:

• The Trust Barometer report is an annual survey conducted in 28 countries and engaging more than 36K respondents.

• This is the 22nd year of the survey and this year’s report is titled, “The Cycle of Distrust.” Here’s its bottom line:

“After a year of unprecedented disaster and turbulence—the Covid-19 pandemic and economic crisis, the global outcry over systemic racism and political instability—the 2022 Edelman Trust Barometer reveals an epidemic of misinformation and widespread mistrust of societal institutions and leaders around the world. Adding to this is a failing trust ecosystem unable to confront the rampant infodemic, leaving the four institutions—business, government, NGOs and media—in an environment of information bankruptcy and a mandate to rebuild trust and chart a new path forward.”

• Below is a quick summary of the report’s top 10 findings (click for larger view).

What I’m Thinking:

• Our fundamental problem is pre-political. I’m a Christian. As a Christian, I root my understanding of truth, ultimately, in the person and character of an eternal, unchanging, and good God as revealed in the Bible. His unchanging nature, specifically, provides a steady point of reference for my understanding of the truth because all moral judgements are relative to Him. This, in my view, is the most compelling explanation of the world theologically, intellectually, and experientially. While many disagree with this view, this has been the predominant worldview in most of the West — and certainly in the United States — for centuries. But this understanding of truth is eroding rapidly, even among my co-religionists. According to one study, 58% of surveyed Americans believe “moral truth is up to the individual to decide,” and 46% of Evangelicals1 “reject absolute moral truth.” Why do I bring this up? Because a society that rejects the idea of truth cannot trust, and a society that cannot trust, cannot long survive as a democracy.

• Our nation is a beautiful house of cards. American society is held up by institutions which are themselves braced by their legitimacy in the public’s mind. Remove legitimacy and the whole thing comes crashing down. Take our much-discussed electoral system as an example. For nearly two and half centuries, we have been able to peaceably transition political power because our citizens believed that electoral outcomes were determined by the will of the people and were, therefore, legitimate. Both political parties, however, are now systemically attacking this notion of legitimacy with the former president arguing his election loss was due to large-scale voter fraud and the current president saying rampant voter suppression is imposing a new reign of Bull Connor. Both assertions are categorically and demonstrably false; and yet, they are widely held. Unsurprisingly, this is leading to a hemorrhaging of legitimacy, with more than one-third of Americans saying they do not have confidence in the fairness of our last presidential election. If distrust of our elections continues to metastasize, it will eventually kill the legitimacy — and therefore the effectiveness — our entire political system.

• All of this has implications for tech and national security. Tech’s current fascination with virtual, augmented, and synthetic worlds will further loosen humanity’s grip on truth by making the real and the made up indistinguishable. Those without a metaphysical anchor are likely to be tossed about in a restless sea of bits and bytes. Many will simply let go of truth and allow the currents to sweep them away into a fathomless ocean of entertainment, ease, and moral relativity. These trends will further dwindle the number of people with the moral and intellectual capacity to navigate foreign policy and national security challenges. After all, how do you argue against China’s genocide against the Uyghurs if you ultimately believe the CCP is just a “strict parent?”2 Or, how can we possibly marshal the nation’s political will to fight and die for our cause, if our own people don’t trust the government that is calling them to service?

• All is not lost. While I suspect we will pay a higher cost than is required, I also expect that we will, over time, change many of these trends. Michelle Dean has said, “Crisis forces commonality of purpose on one another.” I think this is true and, as our current confusion leads to a growing sense of crisis, I trust that we will again form a commonality of purpose and return to our senses. We have done it before and, by God’s grace, we can do it again.

  Leave a comment

Let’s Get Visual

Nerd Humor

Quick Clicks

• China notifies firms of tougher investment rules for tech

• Israel says it is responsible for half of global cyber defense investment

• North Korean hackers stole almost $400 million in crypto last year

• Europol takes down VPNLab

• Astrophysicists release the biggest map of the universe ever created

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

Why This Matters: This bill would significantly change U.S. antitrust law and dramatically impact U.S. national security concerns.

Key Points:

• Senators Amy Klobuchar (D-MN) and Chuck Grassley (R-IA) introduced S.2992 and it’s currently being cosponsored by 11 others — Senators Durbin (D-IL), Graham (R-SC), Blumenthal (D-CT), Kennedy (R-LA), Booker (D-NJ), Lummis (R-WY), Hirono (D-HI), Warner (D-VA), Hawley (R-MO), and Daines (R-MT).

• A “mark up” is when the committee meets to debate, amend, and rewrite the legislation. Once completed, Senate Majority Leader Chuck Schumer (D-NY) can then bring the bill to the Senate floor debate and a vote.

• Currently, the bill has a narrow focus on a small number of “big tech” companies, with its rules applying only to those who (1) have 50 million monthly active users or 100,000 monthly active business users; (2) have sales or a market capitalization exceeding $550 billion; and (3) are a “critical trading partner for the sale or provision of any product or service offered on or directly related to the online platform.”

• Ostensibly, the legislation wants to prevent leading tech companies from leveraging their position to unfairly benefit their own products and services.

• A few of the major muscle movements from the text include (1) an explicit prohibition against privileging a platform’s own products and services; (2) mandates platforms be “interoperable” with one another; and (3) makes it illegal for tech companies to discriminate in the application or enforcement of their terms of service against competitors who use their platform.

What We’re Thinking:

• You can be angry and not be suicidal. Republican supporters are clear that they are at least partially motivated by concerns about “big tech” hurting conservatives online and enforcing “woke” orthodoxies on the general public. These views are broadly shared and, for the sake of argument, we’ll concede them without caveats. But, any effort to bring these companies to heel cannot do so at the expense of our national security — which this bill does and which we will explain further.

• "Preferencing” isn’t just about shelf space. Critics will often say it’s wrong for Amazon to preference its Amazon Basics brand over competitors who are using its platform to sell their products. While we could make an argument that this is no different than Costco placing its Kirkland brand merchandise on valuable eye-level shelves, the bill’s proposed remedy is confusing and could actually harm cybersecurity. For example, Google’s Threat Analysis Group (TAG) is reportedly tracking more than 270 government-backed bad guys that are operating in more than 50 countries. In just the last year, TAG has issued more than 50K warnings and uses this threat information to make products like Gmail safer. But, the bill’s opaque language makes it possible that this type of proactive cybersecurity would be seen as preferencing Google’s services over other cybersecurity offerings and therefore a violation of the law. That’s nuts.

• Interoperability and “sideloading” could hurt individual and national cybersecurity. Requirements that tech platforms build their products and services in such a way that they are interoperable with everyone else necessarily defaults to the lowest common denominator on cybersecurity standards and will lead to a rapid race-to-the-bottom. Similarly, the legislation’s requirement that companies like Apple allow users to download software and apps from sources outside of the company’s app store will also massively degrade user cybersecurity. Currently, if you want your app to be available for iPhones (only 14% of the global smartphone market, by the way), then you have to be in the Apple app store. But, you can only be in this app store if you meet the company’s stringent security requirements. S.2992 deems this practice “unfair” and illegal. Other app stores have much lower security requirements and other mobile operating systems allow this type of “sideloading” of apps. The result? There’s been a proliferation of fake programs in less secure app stores, include Chinese clones of WhatsApp, Telegram, and Signal — all of which have fooled users into downloading them and funneling their private data back to the Chinese Communist Party. Apple’s “walled garden” strategy, on the contrary, also constrains what data is collected by developers and how this data can be used — something most privacy-minded Republicans would seemingly support.

• China won’t play by these rules. Foreign tech companies will not be bound by these rules and so, if passed, S.2992 will hamstring American companies while leaving global competitors with greater agility. This bill is about more than a few U.S. tech companies being brought down a peg; it’s about us voluntarily ceding critical technological and economic advantage to countries like China at a time when leading in key technologies and tech markets is critical for our nation’s long-term thriving.

• We’re not thinking about the long-game. Large tech companies will be the chief suppliers of next-generation warfighting capabilities like artificial intelligence, robotics, and quantum computing. Last year, Alphabet, Amazon, Apple, Facebook, Intel and Microsoft alone spent a combined $140 billion on research and development (R&D), not including acquisitions. The Pentagon’s R&D budget for the same year was $109 billion. Why were six U.S. companies able to outspend and out-innovate the U.S. government? Because they are profitable. And they are profitable because they are big. Pushing the frontiers of science and pioneering game-changing technologies is expensive. The resources and talent to do these things are highly valuable and desperately scarce. It’s no coincidence, then, that the companies that have found ways to attract billions of customers — and the profits that come with them — are the ones at the center of these innovations. Do we really need to dismantle them in order to address our other concerns? We don’t think so.

• Economic security is national security. Going after our technology companies, particularly a targeted shot at certain big ones, sends the wrong message to startups and investors alike; it tells them that if you are innovative enough to be successful and grow significantly larger, you may be targeted for different treatment. That is simply not the approach we’ve taken as a nation to concerns about competition. Instead we’ve outlined the conduct we think is problematic or undermines competition and we’ve sought to prohibit this conduct. To now say that different rules apply if you get to a certain size simply punishes success without dealing with the actual problem. This undermines not only the companies that are likely to be investing in R&D over the next decade and generating some of the key innovations that will contribute to our national security, it also undermines a central proposition that has created a robust tech ecosystem in this country:  take risk, innovate, fail fast and often, and when you succeed, reap the rewards so long as you don’t exploit your position to gain unfair advantage. 

What Should Be Done:

• Ideally, we should build a tailored solution. As written, the bill is too broad, too opaque, and chock-full of unintended consequences. S.2992 could seriously damage American security and no amount of political revenge on “big tech” is worth that risk.

• At the very least, the Committee should delay the mark up and hold public hearings before proceeding further. The mark up on S.2992 was originally scheduled for next week. This was changed on Friday of last week and new bill text was dropped this morning. In addition to the points laid out above, there are dozens of other questions about this bill that need to be understood and answered. And it’s not just us who have these concerns — 12 national security leaders warned Congress in a letter that it needs to better understand the national security implications of antitrust bills currently under consideration. The authors include a former Secretary of Defense, former Director of National Intelligence, former CIA executives, and a former White House Homeland Security adviser. Unless we are willing to dismiss these individuals as techie shills, shouldn’t we at least consider their warnings via public hearings and testimonies? Isn’t that the way the process is supposed to work?

Heads Up

Bill Drexel and I have a new article arguing that the United States and Taiwan need unprecedented cooperation in order to secure the island from Chinese invasion and cyber attacks.

“In the domain of Sino-American tech rivalry, Taiwan is unique in two aspects: First, the Taiwan Semiconductor Manufacturing Corporation (TSMC) remains the world’s tightest bottleneck in the global high-tech ecosystem, with exclusive capabilities to construct the most valuable, sophisticated computer chips in existence. Second, military conflagration in Taiwan would represent a hitherto-unknown level of cyber-intensive military conflict, the seeds of which likely have already been planted. Both of these realities demand unprecedented cooperation between the United States and Taiwan—cooperation that requires significant trust and openness in Taipei and significant counter-espionage and national security assistance from Washington.”

The Kitchen Sync

Securing Taiwan Requires Immediate Unprecedented Cyber Action

The prospect of a Chinese invasion of Taiwan echoes some of the most disastrous 20th century instances of great power expansion—reminiscent, perhaps, of Nazi Germany’s Anschluss or even its subsequent invasion of Poland. Given that the latter ignited World War II, America’s strategic community has been rightly fixated on the vast military and political …

Read more

4 years ago · Klon Kitchen and Bill Drexel

Tech Terms

Secure Socket Layering (SSL) — SSL is a protocol that allows Internet users to send encrypted messages across the Internet. It is generally used when transmitting confidential information (e.g. personal data or credit card details). A web address that begins with "https" indicates that an SSL connection is in use.

Tech Policy as Coercive Diplomacy

What’s New: The United States is considering sanctions that would deny Russia access to key technologies as the two nations face off over Ukraine.

Why This Matters: As technology grows in economic, social, military, and political importance, so does its potential as a means of leverage in global affairs.

Key Points:

• The Biden administration is putting together a suite of actions, according to the New York Times, that would “target some of Mr. Putin’s favored industries — particularly aerospace and arms, which are major producers of revenue for the Russian government.”

“The focus would be on Russian-built fighter aircraft, antiaircraft systems, antisatellite systems, space systems and emerging technologies where Russia is hoping to make gains, like artificial intelligence and quantum computing,” says the New York Times story.

• The proposed sanctions would ban Russia from purchasing semiconductors that rely on American design, as well as machines that use these chips — everything from mobile phones, to personal computers, to dishwashers and refrigerators.

What I’m Thinking:

• This is a modernized version of a proven foreign policy tool. Coercive diplomacy is a long-practiced and formally-studied form of statecraft. The general idea, as explained by Alexander George in The General Theory of Coercive Diplomacy, is to “back one's demand to an adversary with a threat of punishment for noncompliance that he will consider credible and potent enough to persuade him to comply with the demand."1

• There are three general strategies of coercive diplomacy. First, you can issue an ultimatum — drawing a “redline” and giving a drop-dead date for compliance. Second, you can “try-and-see.” In this case, an ultimatum is issued but no deadline is given and the threatening party observes the behavior of its target and adjusts accordingly. Finally, third, you can “turn the screw,” where a target is told what behavior is expected and pressure or punishment are incrementally increased. The first strategy is the most aggressive while the second and third strategies allow for more agility. Right now, the United States appears to be employing the second strategy but may shift to the third approach after a Russian invasion.

• Tech sanctions are powerful and play to U.S. strengths, but they are no silver bullet. Even though the United States does not manufacture most of the world’s technology, it does play a decisive role in their design and in consumer demand. Leveraging this point of power has proven effective in the case of China and Huawei, for example. By working with foreign semiconductor manufacturers to deny access to advanced chipsets, the United States has crippled the telecommunications company’s ability to innovate or even meet current requirements — causing profits to fall nearly 30% last year. Even so, Russia’s consumers are not nearly as demanding for technological goods as are China’s, and if punishing sanctions are imposed, it is possible Russians would primarily blame the United States, and not the Kremlin, for the disruption. Beyond this, however, cutting off Moscow from key tech could dramatically constrain the nation’s military industry which is a key source of economic strength and is likely being considered very seriously by Putin — with Russian markets dropping 6% this week after the apparent breakdown of U.S. talks.

  Leave a comment

Crypto Mining Goes Down With Kazakhstan

What’s New: Once a crypto currency center of gravity, political unrest and other problems are killing Kazakhstan’s digital mining industry.

Why This Matters: The nation’s unstable political situation and unreliable power and other essential services are gutting its once-growing crypto mining economy — costing the nation millions and further inflaming domestic frustration.

Key Points:

• Miners compete to complete “blocks” of verified transactions, which are then added to the coin’s digital ledger, called the “blockchain.” (Here’s a simple infographic if you’d like to learn more)

• Mining “rigs” — groups of networked computers — either use application-specific integrated circuits (ASIC) or graphics processing units (GPU) to complete these calculations, both of which require substantial computational power and energy consumption.

• After China shut down crypto mining within its borders last year, Kazakhstan became an attractive alternative because of its relative proximity, permissive legal environment, and rich energy sources. As many as 87,849 machines relocated to Kazakhstan, accounting for more than 18% of the global Bitcoin mining as of last August.

• That’s all changing as fuel prices surge, Kazakhs protest, and Russian troops roam the country.

• Even as Kazakhstan’s President Kassym-Jomart Tokayev has restored some semblance of order — backed by the Russian military — internet and power outages continue and crypto mining declined by more than 12% last week.

• The recent protests began over fuel prices, but are also about longer-standing issues like economic weakness and income inequality — none of which are going away.

What I’m Thinking:

• It’s a short hop from crypto boom to bust. Kazakhstan is an example of how a nation can realize new opportunities with new technologies but also how those same technologies can strain a nation’s underlying capacity. It didn’t take long for crypto mining to push the country’s energy infrastructure to the brink, forcing the government to shut down a major mining farm in November. Throw in a healthy dose of political instability and you get yet another dynamic that geostrategists must now account for as they seek to understand and shape the international order.

Leave a comment

Commerce Considering Cybersecurity Labels

What’s New: The U.S. government is considering nutrition-like labels to help consumers assess cyber risk, according to the Washington Post.

Why This Matters: Similar labeling efforts have been considered and implemented in related contexts — for example, Apple uses simple labels to help app store customers understand what data apps collect.

Key Points:

• The National Institute of Standards and Technology (NIST) is running lead on a set of standards for the labels — intended to help consumers know which of their internet-connected devices is most vulnerable for hacking.

• Ideally, the standards will allow industry to voluntarily adopt a verification and labeling program that tells users how good (or bad) a device or service is when it comes to basic cybersecurity practices like patching and information security.

• The government hopes this will eventually work the same way energy efficiency labels work on U.S. appliances.

“Making security relatable to someone's daily life and how it can impact them is really critical for the success of this,” Julie Haney, an NIST computer scientist who’s working on the project.

What I’m Thinking:

• Growing consumer awareness is a good thing. As explained, the government is not rolling out new regulations. Instead, it’s issuing a set of standards that companies can voluntarily meet and reference so that customers can make more informed choices. In light of the fact that more than 64 billion internet-connected devices are expected to be online by 2025, this seems like a generally easy and non-intrusive effort at improving the nation’s cybersecurity.

Leave a comment

Let’s Get Visual

Nerd Humor

Quick Clicks

• Huawei turning to Chinese companies for vital semiconductors

• Intel continues to cower before China (pathetic)

• How to read your iOS 15 app privacy report

• Danish INTEL chief jailed after surveillance scandal

• Federal cybersecurity rules are out of date, lawmakers say

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

But Taiwan is not just the geopolitical fulcrum of the Indo-Pacific; it is also the nexus of a rapidly evolving Sino-American technological competition. And if 20th century great power competition is any guide, tech races are just as important to long-term competition as territorial military contests. The U.S. needs to act now to secure the technological dimensions of a looming Taiwan crisis, or risk losing far more than the island. 

In the domain of Sino-American tech rivalry, Taiwan is unique in two aspects: First, the Taiwan Semiconductor Manufacturing Corporation (TSMC) remains the world’s tightest bottleneck in the global high-tech ecosystem, with exclusive capabilities to construct the most valuable, sophisticated computer chips in existence. Second, military conflagration in Taiwan would represent a hitherto-unknown level of cyber-intensive military conflict, the seeds of which likely have already been planted. Both of these realities demand unprecedented cooperation between the United States and Taiwan—cooperation that requires significant trust and openness in Taipei and significant counter-espionage and national security assistance from Washington. 

The Silicon Brain Trust

It’s hard to overstate the importance of TSMC’s microscopic transistors: The company’s chips are the foundation of enormous sectors of national economic growth for both the U.S. and China. They are also the backbone of the massively consequential tech race between the two countries in security-essential sectors like artificial intelligence, quantum computing and advanced military capabilities. TSMC is estimated to have cornered as much as 90 percent market share of the world’s most advanced processors, and controls a majority of the global market for made-to-order chips. To stretch the historical analogy, it is as though a coterie of the world’s most accomplished nuclear physicists lived in a country that the Nazis aimed to annex in the 1930s, or like a collection of world-leading rocket scientists were on the verge of being absorbed into the Soviet bloc at the height of the Cold War. 

It’s no coincidence that the world’s most precious technological capabilities are nestled in the world’s hottest geopolitical fault line. Taiwan’s government has long cultivated a “silicon shield” over the island in hopes that unique dominance in a crucial—but delicate—industry would deter China from rash actions against the island. In terms of imports, China spends more on semiconductors than on anything else—including oil—and in 2020, China’s semiconductor trade deficit stood at a whopping $233 billion. By intertwining Beijing’s long-term economic and strategic interests with Taiwanese semiconductors, the thought went, the PRC would be unlikely to invade the island because it would invite devastating supply-chain disruptions.

But that calculus may be changing. Stricter export controls on American-designed chips have stymied China’s access to advanced semiconductors from TSMC and elsewhere. The U.S. sanctions that cut off vital TSMC chips to Huawei, crippling many of the company’s prospects, seem ominous to many Chinese strategists. If Beijing’s decision-makers come to believe that something like Huawei’s fate awaits the PRC more broadly, Taiwan’s “silicon shield” will crack: Beijing would have nothing to lose, technologically speaking, from an invasion. If China could seize and leverage the personnel and facilities of TSMC effectively—or at least ensure they don’t continue accelerating U.S. technologies—it could have everything to gain. 

Chinese efforts aside from an invasion have failed. Despite President Xi Jinping’s forceful statements on the immense value of semiconductor technologies for China’s security, little progress has been made in the mainland. China has already tried to recruit TSMC leaders to its own chip industry with limited success. Chinese hackers have been waging a chronic war on the company and have already stolen disturbingly large troves of information. But despite these efforts and the vast sums of money that China and other governments around the world are pouring into semiconductor alternatives, TSMC’s dominance in many of the most complex and competitive chip production techniques seems to only be growing. If China cannot buy, poach or steal TSMC’s talent, its next best option may be to conquer it—which is convenient enough, for a dictator who seems determined to reunify Taiwan with the PRC. 

Ultra-sophisticated chips are a prerequisite for vast sectors of economic growth and are the key to a massively consequential tech race between the U.S. and China. Given those factors, the U.S. cannot afford to gamble on the fate of the world’s most advanced chipmakers. In light of the shifting incentives of Beijing, any American contingency plan for a Chinese invasion that does not coordinate with Taipei now on quickly securing the TSMC “brain trust” and their families in the event of a crisis is woefully incomplete. In the event of a successful Chinese invasion, and with proper planning, TSMC engineers and scientists have the potential to fulfill a similar role to that of the German Jewish refugees who were so central to the success of the Manhattan Project in the 1940s—if the U.S. can ensure their safety. On the other hand, their loss could set back global technological development by years, or supercharge China’s edge in advanced technologies. 

Relatedly, U.S. counter-espionage efforts also need to focus on protecting the full design and production chain of advanced semiconductors around the world. Attempts to try to diversify TSMC’s geographic presence with new fabrication facilities (or “fabs”) in Arizona, Japan and possibly Germany are not without risks. Nor are the efforts to expand the capacity of alternative companies to compete with Taiwan’s dominance in the sector. Diversified expertise will ultimately mean more targets for one of the PRC’s most urgent intelligence objectives. Protecting such vital intellectual property will require similar procedures and approaches to those used in the construction of America’s most sensitive sites—like military bases, intelligence agency facilities and nuclear weapons depots. Outfitting new fabs with such precautions will be costly, but not nearly as costly as a major breach of techniques, designs or data to the PRC. 

Cyberwarfare

Chip manufacturing is not the only technologically unique feature of a looming Taiwan crisis. Warfare writ large is at an inflection point, as emerging technologies subvert and transform conventional conflict, particularly between highly networked societies. In the coming decades, tensions between technologically advanced states are likely to manifest increasingly—and perhaps predominantly—in the cyber domain. Taiwan is also at the forefront of this world-altering trend: Never before have such technologically sophisticated states, with such highly networked communications, infrastructure and weapons, risked all-out war. 

As the head of Taiwan’s Department of Cyber Security noted, Taiwan’s “critical infrastructure, such as gas, water and electricity are highly digitized,” meaning that the right cyberattack from China could prove catastrophic and leave the island in disarray. More than a few commentators have suggested that, in the event of an invasion, Beijing would very likely seek a fait accompli victory—a decisively rapid takeover of the island involving a debilitating cyberattack that would avoid a longer and more costly war with the U.S. Due to Taiwan’s level of networked sophistication and Beijing’s strategic imperatives, the unprecedented use of cyberwarfare in Taiwan is more likely than not. 

But emerging cyberwarfare tactics differ markedly from conventional dynamics, not least in the degree to which they are covert and preemptive. Networks can be infiltrated silently and exploited months later in an explosive instant. And while the estimated 200-400 cyberattacks that Taiwan endures from China each month don’t constitute acts of war, even one successful attempt to worm into Taiwan’s networks could prove more destructive than any bomb if a military conflict were to kick off. Put simply, cyberwarfare would commence well before formal conflict. 

Building on successful U.S.-Taiwan joint cyberwar exercises, the U.S. needs to work with Taipei to threat-hunt on Taiwanese networks as soon as possible. Cyberattacks do not necessarily constitute acts of war, so the U.S. aiding Taiwan’s defense in cyberspace most likely wouldn’t substantively risk upsetting today’s delicate political equilibrium in the Taiwan Strait, save perhaps further deterring Chinese aggression. It would, however, give the island-state a fighting chance against the legions of Chinese military hackers arrayed against it. 

That aid would require direct U.S. access to Taiwanese servers, an unusual arrangement between sovereign states. Certainly Taipei could be forgiven for any hesitation about allowing such broad access, but China is likely already in these networks and bringing U.S. muscle to Taiwan’s cyber defenses could be the difference between crumbling under a Chinese offensive and maintaining robust defensive capabilities. Aside from bolstering commitments to Taiwan, the U.S. would also gain indispensable experience in navigating the cyber conflicts of the future, particularly one in which its primary geostrategic rival is the aggressor. The only alternative, trying to hunt down network vulnerabilities at the onset of conflict, would be far too little too late.

Contemporary Taiwan may be unique in the history of great power competition in the degree to which both geopolitical conquest and a superpower tech race are at stake. Each requires different, but interrelated, preparations on distinct timescales. Any strategy that fails to weigh the two together is not a winning one. And while no part of a Chinese invasion on Taiwan will be easy, the U.S.’s urgent technological priorities are, at least, clear—and ripe for immediate action.

This article originally appeared on the Lawfare Blog.

In our conversation, we discuss his return to covering the White House, his latest reporting on U.S. negotiations with Russia over Ukraine and NATO, what China is thinking, and how cyber operations are now a core feature of every major military strategy.

It is a great conversation and I hope you enjoy it!

Klon

Heads Up

I sat down with AEI’s big boss, Robert Doar, to chat about tech, culture, & national security. He asks me about "big tech", fake media, and Chinese aggression. You can listen to our conversation here.

Tech Terms

Air Gap — The physical separation or isolation of a system from other systems or networks.

Anticipating Russia’s Use of Cyber in Ukraine

What’s New: Russian President Vladimir Putin is positioned for a military invasion of Ukraine and cyber capabilities are likely to feature heavily in any future conflict.

Why This Matters: Russia has been hitting Ukraine with cyber attacks for years but we should expect a dramatic escalation of these efforts before and during a military incursion.

Key Points:

• Dmitri Alperovitch — Co-Founder and former CTO of Crowdstrike and now Chairman of the Silverado Policy Accelerator — lays out one of the most compelling arguments I’ve seen on why Putin is likely to invade in the next few months. It’s worth reading the thread linked below.

• Ever since Putin’s initial “annexation” of Crimea, Russian hackers have conducted a full-scale cyber campaign against targets in Ukraine’s political, economic, media, finance, and energy sectors.

• On several occasions, hackers turned off electricity to hundreds of thousands of people for hours at a time.

• In one of the most destructive cyber attacks ever, Moscow-backed attackers targeted Ukraine with the NotPetya virus, but it quickly spread beyond Ukraine causing billions of dollars of damage around the world — including in Russia.

• Now the United States and Britain are helping Kyiv prepare for more cyber action by deploying various experts and defenses and, in the meantime, Moscow is turning up its online efforts — particularly digital disinformation.

What I’m Thinking:

• Russia has established a strong digital foothold over the last eight years. Crimea’s annexation occurred in 2014. Ever since then, Moscow has been burrowing into and exploiting Ukraine’s networks and critical infrastructure. These operations have had at least three primary objectives. First, destabilize Ukraine’s government and foment popular unrest. Second, conduct persistent digital surveillance and reconnaissance. And finally, third, lay the digital foundation for future military operations by, for example, sabotaging critical infrastructure, infiltrating military command and control networks, and compromising key military capabilities like air defense systems. Putin’s intentions have been clear and he’s had plenty of time and opportunity to achieve these ends.

• Everything starts in the “gray zone,” but will escalate quickly. As I’ve said, Russia has been cybering Ukraine for nearly a decade. Even so, if Putin decides to invade, all of these efforts will grow rapidly in both scale and severity. Propaganda will create a pretext for invasion. Critical infrastructure will be brought down. Digital denial and deception will be used to mask Russian operations and objectives. There may even be broader electronic warfare aimed at disabling Ukrainian access to communications, imagery, and GPS satellites. The bottom line is that all of this, and more, are within Russia’s capabilities and it is likely to be Russian decisions — not those of Kyiv — that set the conditions and scope of the coming conflict.

Leave a comment

Hackers-For-Hire Industry Is Too Big To Fail

What’s New: Facebook parent company, Meta, has a new report detailing how “cyber mercenaries” targeted more than 50,000 of the social media platform’s users.

Threat Report On The Surveillance For Hire Industry

494KB ∙ PDF file

Download

Download

Why This Matters: While this newsletter and other sources have detailed the recent woes of NSO Group, the reality is that hacking- and surveillance-for-hire companies are booming.

Key Points:

• If you don’t know about — or just want a quick refresher on — the drama around NSO, you can read my previous commentary here.

• The Meta report says that, while most of these companies sell their wares under the guise of only targeting terrorists and criminals, the reality is much different.

“Our months-long investigation concluded that targeting is in fact indiscriminate and includes journalists, dissidents, critics of authoritarian regimes, families of opposition members and human rights activists.”

• And Meta is naming names.

• In addition to removing more than 1,500 accounts linked to these surveillance-for-hire groups, Meta also alerted approximately 50,000 people who the company says were targeted by these groups worldwide.

• Interestingly, four out the seven groups identified by Meta — Cobwebs Technologies, Cognyte, Black Cube, and Bluehawk CI — are based in Israel.

What I’m Thinking:

• This is big business. The general cybersecurity market is predicted to reach $345.4 billion by 2026. Hidden within this market is the hacking- and surveillance-for-hire market. As a point of reference, in 2019 NSO Group reported nearly $300 million in revenue.

• Demand is only growing. Foreign governments are a key customer for cyber mercenaries. It’s a relatively cheap and fast way for smaller nations to gain access to world-class talent without all those pesky reporting and accountability challenges that come with official capabilities. But, global companies are also paying for these services. If you’re a U.S.-based, globally operating company, for example, you cannot conduct certain counter-hacking efforts or unilaterally retrieve stolen data and IP from an attacker’s networks. You depend on the U.S. government for justice and remediation. Or … you can pay foreign “cybersecurity consultants” to take “proactive measures” on your behalf. Certainly this brings its own risks, but it’s almost always faster and more efficient than waiting on Uncle Sam to defend your honor.

• The connection to Israel isn’t a coincidence. Like NSO Group, it’s reasonable to believe Israel-based hacking companies need tacit approval from their government to export their capabilities and services. And the Israeli government has some understandable reasons for allowing this. First, Israel is a legit cyber powerhouse and allowing this surveillance market to grow will likely generate even greater wealth, insight, and capabilities. Second, by allowing these companies to work with governments like Saudi Arabia and the United Arab Emirates, they become a powerful diplomatic tool for normalizing relations and influencing key leaders. Finally, third, Israel has never been shy about spying on everyone — even its friends — and anyone who thinks they’re blushing about any of this is sorely mistaken. For sure, Israel’s aggressive use of cyber has real risks; but, the United States has also benefited from this forward-leaning posture and challenges like those demonstrated in the Meta report may simply be an unavoidable consequence of having these capabilities active at the cutting-edge (where we need them).

Leave a comment

China Regulates Algorithms

What’s New: Beijing is cracking down on content management and recommendation algorithms.

Why This Matters: The Chinese Communist Party (CCP) wants to have decisive control over these society-shaping capabilities and these new rules will apply to Chinese companies everywhere and all foreign companies operating in China.

Key Points:

• The Cyberspace Administration of China issued its Internet Information Service Algorithm Recommendation Management Regulations on Tuesday, saying the rules will come into force on March 1st.

• The rules reportedly “standardize Internet information service algorithm recommendation activities, promote socialist core values, safeguard national security and social public interests, protect the legitimate rights and interests of citizens, legal persons and other organizations, and promote the healthy and orderly development of Internet information services.”1

• Among the many requirements, anyone employing content management and recommendation algorithms must “actively spread positive energy,” not “induce users to set up addicted, over-consumption and other violations of laws,” and “regulate the development of Internet news information collection, editing and publishing services, reprinting services and dissemination platform services.”

• The regulations’ lengthy “User Rights” section also demands service providers “provide users with options that are not specific to their personal characteristics, or provide users with convenient options to turn off algorithm recommendation services.”

• There’s also this bit concerning security: “Algorithm recommendation service providers shall keep network logs in accordance with the law, cooperate with network information departments and relevant departments such as telecommunications, public security, and market supervision to carry out security assessment and supervision and inspection work, and provide necessary technical and data support and assistance.”

What I’m Thinking:

• This is an authoritarian response to a universal challenge. The CCP is engaging powerful content management algorithms in a very totalitarian way. Specifically, the government is ensuring it holds the power and that “internet information services” are subservient to the state and know it. All of the bureaucratic requirements and labyrinthian language amount to a single outcome — any company using these algorithms must now do so only in a manner that the CCP finds acceptable and that facilitates government control over these algorithms and the data they utilize and generate.

• This bad response doesn’t delegitimize the issue itself. It’s undeniable that algorithms play a huge role in what news users see, what products they purchase, and how they participate in modern society. In many ways, algorithms play an important role in allowing people to sort through the deluge of online content in a manner that maximizes satisfaction, ease, and even safety. But, it is also true that these algorithms often reinforce many of our worst inclinations and encourage a growing political tribalization. It’s completely legitimate for Americans to be concerned about and to debate these issues.

• But China is no model for a free people. A number of the new Chinese provisions should sound familiar. Much of the language echoes proposals from draft legislation like the U.S. Filter Bubble Transparency Act, which, according to one of its sponsors, would require online platforms to offer their services “without being manipulated by secret algorithms driven by user-specific data.” While I can empathize with some of the underlying concerns, this approach — like that of the CCP — is misguided. I wrote at length on this topic for my friends over at the Dispatch (see the linked article below); but, the bottom line is that there is incontrovertible evidence that this approach leads to lower user satisfaction, higher volumes of extreme content, and more — not less — advertising revenue for the companies. The exact opposite outcomes proponents of such measures are looking for. While some will find Beijing’s “strong” response attractive, it proceeds from a theory of man and of government that is in direct contradiction with our most fundamental ideals and commitments. That’s not to say there’s nothing we can do about powerful algorithms; but, it is to say that there are a lot of things we shouldn’t do.

The Dispatch

Legislation Can’t Fix Social Media

It is perhaps apocryphal, but when reportedly commenting on Russia’s peasant soldiers deserting the tsar’s army during Russia’s Revolution between 1905-1906, Vladimir Illich Lenin—the founder and first head of government for Soviet Russia—quipped, “They voted with their feet…

Read more

4 years ago · 70 likes · 64 comments · Klon Kitchen

Leave a comment

Let’s Get Visual

Nerd Humor

Quick Clicks

• Verizon & AT&T agree to 5G delay

• China Mobile kicked out of China over security concerns

• Japan boosts military spending with Taiwan in mind

• Tesla opens showroom in China’s Xinjiang (Boo!)

• Army announces new machine learning tech for burn treatment

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

This is the last Friday Brief for 2021

We’ll be back in 2022 and it’s gonna be great! In the meantime, I’ll be pushing out one or two more podcasts and — don’t forget — you can always gift a subscription to this newsletter for that certain someone special!

Give a gift subscription

Enjoy the holidays and happy New Year.

Klon

Tech Terms

Firewall — Firewall software is used to block unauthorized access to a computer system. All incoming and outgoing network traffic is monitored through a firewall so that it can block suspicious activity that does not abide to a defined set of security rules.

Log4j: What You Need To Know

What’s New: A vulnerability in a popular open-source logging tool has had security researchers and response teams surging for more than a week.

Why This Matters: The Log4j “logger” is widely used and hackers all over the world are aggressively exploiting this vulnerability.

Key Points:

• Java is a programming language and computing platform that powers a huge portion of internet apps and services.

• Log4j is a Java-based “logger” — a program that records most of the activity when a service or app is running, allowing programmers to go back and to fix bugs and failures.

“Log4j is a very popular logging package for Java. It is very powerful and flexible and, even from my own experience, is used in almost every Java application that I have ever encountered ... The exploit is actually unbelievably simple — which makes it very, very scary at the same time," Bojan Zdrnja, senior instructor at SANS Institute, told Vice.

• To completely take over a vulnerable system, an attacker simply sends a short code string that is logged by Log4j. Then it’s owned.

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued this alert, as did Australia’s Computer Emergency Response Team (CERT).

• The Check Point cybersecurity group claims hackers from around the world are scanning the internet for vulnerable systems and have already conducted nearly 1 million attacks on companies since last Friday.

• Most of the attacks appear to be aimed at using compromised systems for cryptocurrency mining. Chinese state-backed groups, however, have also been observed using the exploit.

What I’m Thinking:

• This is gonna be tricky. The sheer scope of the problem makes this hard enough. Complicating things even further is the challenge of “intermingling.” A lot of companies build custom software that runs on top of base code like Log4j, which means a lot of companies will need to deploy custom patches that could fix one application while “breaking” another one. Even more, if something does go wrong a user could lose their logging ability precisely when they need it most to keep watch for bad guys who may have infiltrated their networks.

Share

The U.K.’s New Cyber Security Strategy

What’s New: Our cousins across the pond have a new Cyber Security Strategy out this week.

Why This Matters: The 2022 strategy picks up where the previous 2016 strategy left off, emphasizing the country’s need to remain “confident, capable and resilient in this fast-moving digital world; and that we continue to adapt, innovate and invest in order to protect and promote our interests in cyberspace.”

Key Points:

• The strategy begins by laying out the U.K. government’s view of the world:

“Exponential advances in technology combined with decreasing costs have made the world more connected than ever before, driving extraordinary opportunity, innovation and progress … The scale and speed of this change – often outpacing our social norms, laws, and democratic institutions – is also unleashing unprecedented complexity, instability and risk … The transnational nature of cyberspace means these challenges cannot be addressed without international collaboration, but it is also an increasingly important arena of systemic competition and the clash of competing interests, values and visions of our global future.”

• It then lays out a vision for how the government will use “cyber power in support of national goals.”

“Cyber power is the ability to protect and promote national interests in and through cyberspace. Countries that are best able to navigate the opportunities and challenges of the digital age will be more secure, more resilient and more prosperous in future … As we forge a new role for the UK in a more competitive age, strengthening our cyber power will enable us to lead the way for industry and other countries, get ahead of future changes in technology, mitigate threats and gain strategic advantage over our adversaries and competitors … Our vision is that the UK in 2030 will continue to be a leading responsible and democratic cyber power, able to protect and promote our interests in and through cyberspace in support of national goals.”

• These four overlapping goals for the U.K. are as follow:

“A more secure and resilient nation, better prepared for evolving threats and risks and using our cyber capabilities to protect citizens against crime, fraud and state threats;

An innovative, prosperous digital economy, with opportunity more evenly spread across the country and our diverse population;

A Science and Tech Superpower, securely harnessing transformative technologies in support of a greener, healthier society; and,

A more influential and valued partner on the global stage, shaping the future frontiers of an open and stable international order while maintaining our freedom of action in cyberspace”

• Finally, the strategy is built on five pillars: (1) Strengthening the U.K. cyber ecosystem; (2)Building a resilient and prosperous digital U.K.; (3) Taking the lead in technologies vital to cyber power; (4) Advancing U.K. global leadership and influence for a more secure, prosperous and open international order; and (5) Detecting, disrupting and deterring our adversaries to enhance U.K. security in and through cyberspace.

National Cyber Strategy Final Version

10.6MB ∙ PDF file

Download

Download

What I’m Thinking:

• I think the Brits get it. There has been a marked evolution in the U.K.’s cyber posture over the last several years. They’ve become more serious and clear in their rhetoric which suggests the same evolution is occurring in their thinking, planning, and doctrine. Initiatives like their new National Cyber Security Center (NCSC) and National Cyber Force (NCF) also give reason for optimism. One thing that got my attention is just how frankly the U.K. government talks about the NCF, unapologetically stating in the strategy that the Center will be used to “influence individuals and groups, disrupt online and communications systems and degrade the operations of physical systems.” I’m reminded of what A.P. Herbert once said: "The Englishman never enjoys himself except for a noble purpose.” Well, I might dare say the British appear to be enjoying themselves as they get about the noble work of securing their nation and countrymen in cyberspace. Bully for them!

Share

Chinese Tech Companies In The Crosshairs

What’s New: The Biden administration is placing eight Chinese tech companies on the “Chinese Military-Industrial Complex Companies” list, and has listed dozens more on the U.S. Entities List.

Why This Matters: The new listings are part of a broader U.S. effort to reduce U.S. outbound investments that directly facilitate Beijing’s military capabilities or its violation of human rights.

Key Points:

• The new listings formally identify the companies as having Chinese military links and bars Americans from trading in their securities.

• According to research by Georgetown’s CSET (discussed last month), Goldman Sachs and Sequoia Capital are among those who are funding companies like 4Paradigm — a company who is directly providing AI-enabled battlefield command software to the Chinese military.

• Shenzhen-based DJI — the global leader in commercial unmanned systems with more than 70% of the global market — is among those being culled for their “biometric surveillance and tracking” of Uyghers.

• In light of the tightening environment in the United States and because of domestic politics in China, a growing number of Chinese tech giants listed on Wall Street are also listing in Hong Kong — including Alibaba, Baidu, NetEase, and Weibo — in an effort to minimize the impact of possibly being removed from U.S. trading.

“I think for a lot of Chinese companies listed in U.S. markets, it’s essentially game over,” David Loevinger, managing director for emerging markets sovereign research at TCW Group, told CNBC Wednesday. “This is an issue that’s been hanging out there for 20 years — we haven’t been able to solve it.”

What I’m Thinking:

• The new listings are a good development. More please. Every one of these companies deserves the scrutiny they’re getting. There are dozens of others worthy of the same treatment. Beyond limiting U.S. investment in these companies, companies like DJI should be prevented from doing business in the United States at all. There’s simply no way to trust Chinese-made drones and the software that runs them. Their ability to collect and transmit huge volumes of data makes our continued allowance of them in our domestic skies one of the most truly foolish mistakes in this new tech confrontation with China. Also, while Tuya isn’t yet on this list, it deserves to be and I hope readers in a position to do something about it will take them on next.

• Outbound investment is a key priority. The investments by Goldman Sachs and Sequoia Capital were not illegal. They were immoral. 4Paradigm’s relationship with the Chinese military was easily knowable and it strains belief that this relationship was not uncovered during pre-investment investigations. This suggests a certain comfort within the U.S. investment community when it comes to supporting companies that are working in direct contradiction to U.S. security and interests. That’s unfortunate; but, as Loevinger said in the story above, “it’s essentially game over” for this type of unethical behavior and I’m happy for this screw to be turned tight.

Share

Let’s Get Visual

Nerd Humor

Quick Clicks

• DARPA announces new SMOKE program

• DIA expected to lead military use of open-source data

• DeepMind AI tackles one of chemistry’s most valuable techniques

• Loss of secret data puts navy’s handling of devices under investigation — again

• Is MIT’s research helping the Chinese military?

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

Dr. Levin and scholars in the Social, Cultural, and Constitutional Studies research division study the foundations of self-government and the future of law, regulation, and constitutionalism. They also explore the state of American social, political, and civic life, while focusing on the preconditions necessary for family, community, and country to flourish.

Dr. Levin served as a member of the White House domestic policy staff under President George W. Bush. He was also executive director of the President’s Council on Bioethics and a congressional staffer at the member, committee, and leadership levels.

He joined me recently for a fascinating chat about technology, society, and our nation’s future.

I hope you enjoy the conversation!

Klon

Tech Terms

Cryptomining — the process of validating a cryptocurrency transaction.

What I saw in California

What’s New: I spent the last four days in Los Angeles and San Francisco, CA meeting with engineers, founders/executives, and venture capitalists to get their perspectives on all things tech and foreign policy.

Why This Matters: I’m encouraged by the growing consensus concerning China, national defense, and the need for deliberate efforts to ensure American prosperity and security.

Key Points:

• Pre-COVID, I would visit “The Valley” about once a quarter. It provides a way for me to stay current on what’s happening in the tech and start-up world and to tend relationships.

• This is my first trip back in almost two years and it didn’t take long for me to realize why these trips are so valuable.

What I’m Thinking:

• There are two camps on China and one is much bigger than the other. Long-gone are the days when techies view China as a bottomless money bag or consequence-free source of human capital. Virtually everyone I met with understands that tensions between Washington and Beijing are deep and persistent. While a few were exasperated by what they see as Americans’ pollyannish persnicketiness on things like human rights and the rule-of-law, the vast majority expressed support for resisting Chinese aggression and coercive economics. Even those inclined to be more accommodating of Beijing, recognized that it’s actually the Chinese Communist Party who is provoking most of the challenges for business in China and that there’s little reason to believe better days are ahead in the near-term.

• There are a LOT of smart, capable people working these issues. Perhaps more than any previous visit, the last few days illustrated just how powerful the American system really is. Meeting after meeting I sat with people who are leaders in their respective fields and who have the time and means to do pretty much whatever they want. And you know what they’re thinking about? The same stuff I am and they are bringing some real horsepower to the challenge. Because China policy is inseparable from broader economic, social, and political realities, there are titans within each of these spheres who are gathering resources, shaping events, and moving the needle in very real ways. It’s another example of how powerful the U.S. private sector is and why it is such a key partner in the defense of democracy.

• The new defense industrial base is taking shape. Companies like Anduril, Rebellion Defense, Skydio, and others are winning contracts and building amazing capabilities. Secretary of Defense Lloyd Austin recently explained the Pentagon’s plans to out-innovate the nation’s rivals — including more government/industry R&D partnerships, expanded Small Business Innovation Research (SBIR), and the development of regional “tech hubs” around the nation — and certainly there is a growing ecosystem of lean, agile, and creative companies to work with. I’m pumped.

Share

Three things I hope we’re doing now

What’s New: A number of ongoing projects are causing me to think more concretely about a possible conflict over Taiwan.

Why This Matters: There are three specific things I hope we’re already doing as we plan for this contingency. And if we’re not, I hope some of the readers of this newsletter will take these ideas and implement them.

What I’m Thinking:

• We should be threat-hunting on Taiwanese networks. At the point where China is prepared to take action against Taiwan, you can be assured that it will have spent considerable effort in penetrating Taipei’s critical infrastructure, military nodes, and other networks and in laying the groundwork to disable or otherwise compromise these same assets. Even before the start of hostile actions, Beijing is likely already engaged in intelligence gathering, preparation of the battlefield, and pre-positioning other cyber capabilities. If we have not already, the U.S. should work out an agreement with Taiwan whereby we assist them now in discovering, removing, and mitigating malign Chinese cyber actors and activities on Taiwanese networks. This would likely require unprecedented formal access to these networks; however, it will be too late for such threat-hunting once the shooting starts.

• We should be identifying and securing TSMC’s “brain trust.” It takes more than money and equipment to design and manufacture cutting-edge integrated chips. You must also have the intellectual capital and practical experience that comes with being the world’s most important semiconductor company. In the event of a Chinese invasion or other hostile action against Taiwan, it will not be enough for the U.S. to have alternative factories in the United States and elsewhere. The world will also need the “brain trust” that is currently the beating heart of the Taiwan Semiconductor Manufacturing Company. The United States should be working with Taipei to identify these critical personnel and to develop scenarios for ensuring their safety if/when things go sideways.

• We should be securing the full integrated chip (IC) chain. Securing the design and manufacturing of advanced integrated circuits consists of thousands of individual steps. Each of them needs to be freed from Chinese influence if we are to have real security. Even more, as new fabrication facilities (“fabs”) in the United States and elsewhere are constructed, robust counterintelligence and industrial espionage measures must be taken. In the same way that the Russians famously bugged the U.S. embassy during the Cold War, it should be assumed that Beijing will take any measure it can to compromise new semiconductor facilities. This will require using similar procedures and approaches as those used in the construction of the nation’s most sensitive sites — like military bases, intelligence agency facilities, and nuclear weapons depots. It will do us no good to build these new fabs only to discover they’ve been compromised and must be razed to the ground.

Share

Google & Microsoft get offensive

What’s New: Google and Microsoft announced this week that they had taken separate actions against two groups of hackers.

Why This Matters: Private companies are assuming a larger role in cybersecurity and will feature more prominently going forward.

Key Points:

• On Tuesday, Google said it had disrupted a group who hijacked more than 1 million devices, using them to steal private data and to mine cryptocurrency.

“Today, we took action to disrupt Glupteba, a sophisticated botnet which targets Windows machines and protects itself using blockchain technology … After a thorough investigation, we determined that the Glupteba botnet currently involves approximately one million compromised Windows devices worldwide, and at times, grows at a rate of thousands of new devices per day. Glupteba is notorious for stealing users’ credentials and data, mining cryptocurrencies on infected hosts, and setting up proxies to funnel other people’s internet traffic through infected machines and routers.”

• Just one day prior, Microsoft said it disrupted a Chinese syndicate dubbed “Nickel,” who it said was targeting human rights groups, think tanks, and government agencies in the United States and more than 28 other nations.

“The Microsoft Threat Intelligence Center (MSTIC) has been tracking Nickel since 2016 and analyzing this specific activity since 2019 … There is often a correlation between Nickel’s targets and China’s geopolitical interests.”

What I’m Thinking:

• These two companies have serious cybersecurity firepower. Google’s Threat Analysis Group (TAG) is reportedly tracking more than 270 government-backed bad guys that are operating in more than 50 countries. In just the last year, TAG has issued more than 50K warnings, a 33% increase from 2020. Microsoft’s Digital Crimes Unit (DCU) is another powerhouse, consisting of an international team of business, legal, and technical experts tasked with “meaningfully disrupting the operational infrastructure used by cybercriminals, through civil legal actions or technical measures.”

• Even more capabilities are on the way. In August, these same two companies committed to spending more than $30 billion on cybersecurity. The folks in Redmond are putting $20 billion into “advanced security solutions” over the next five years and the search giant will cough up $10 billion for “expanding zero-trust programs, helping secure the software supply chain and enhancing open-source security.”

• Cybersecurity is a team sport (and we’ve got a strong team). Most of the public dialogue about “big tech” is overwhelmingly characterized by perceived slights and political grievances. This means that really important developments like those in this story are often missed. But it’s worth noting that one of the reasons that our nation enjoys any level of cybersecurity is due to the actions of these same companies. They obviously have self-interested reasons for these actions, but so do we and I’m thankful that we have such capable, well-resourced teams working to secure our data, our networks, and our nation.

Share

Let’s Get Visual

Nerd Humor

Quick Clicks

• SpaceX will provide more astronaut rides

• AI is finding new patterns in “pure mathematics”

• CYBERCOM admits actions against ransomware groups

• Pentagon creates new overseer for innovation: chief digital and artificial intelligence officer

• DeepMind says its new language model can beat others 25 times its size

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

Tech Terms

Web 3.0 — It’s complicated; but, you’re going to be hearing more about this and so here’s the best concise introduction I could find (5min 18sec).

Heads Up

This week I published an essay with The Hoover Institution/Lawfare Blog — The Business of Knowing: Private Market Data and Contemporary Intelligence (see the attached PDF below).

Bottom Line: Many U.S. federal agencies are purchasing private market data. This paper argues that U.S. government access to at least some private market data — and the limiting of foreign access to this same information — is essential for national security. It also argues, however, for a refined awareness that acknowledges the privacy we have already lost and that implements greater government oversight and accountability.

“The American people and their government leaders cannot avoid these realities. Instead, they must adapt to them by refining our institutions and the critical balance between liberty and security. These changes necessarily require uncomfortable choices that bring with them no ironclad assurances of safety. But while an evolution as discussed in this paper does not guarantee success, a lack of adaptation will guarantee failure.”

The Business Of Knowing: Private Market Data and Contemporary Intelligence

506KB ∙ PDF file

Download

Download

Space Is Heating Up

What’s New: Josh Rogin has an interesting editorial in the Washington Post, arguing the United States is already battling its adversaries in space every day.

Why This Matters: “While Washington officials and experts warn of the risks of an arms race in space, the United States’ adversaries are constantly conducting operations against U.S. satellites that skirt the line between intelligence operations and acts of war.”

Key Points:

• Rogin cites a conversation with Gen. David Thompson, Space Force’s vice chief of space operations, who warned that China could soon become the dominant power in the dark domain.

“The threats are really growing and expanding every single day. And it’s really an evolution of activity that’s been happening for a long time,” says Thompson. “We’re really at a point now where there’s a whole host of ways that our space systems can be threatened … [the Chinese are] fielding operational systems at an incredible rate.”

• Both Russia and China regularly target American satellites with cyber attacks, jammers, and even lasers.

Rogin reports, “In 2019, Russia deployed a small satellite into an orbit so close to a U.S. “national security satellite” that the U.S. government didn’t know whether it was attacking or not, Thompson said. Then, the Russian satellite backed away and conducted a weapons test. It released a small target and then shot it with a projectile.”

• This summer, the RAND Corporation issued a study on how to deter China in space that included the following findings:

  • “Because of China's ambitions in space, deterring them requires the imposition of significant costs for aggressive action in space. Imposing political costs on China for aggressive action can be bolstered through strategic coordination between the United States and its allies.”

  • “China's view of space as a critical U.S. vulnerability makes U.S. space capabilities attractive targets for attack. Highlighting China's own reliance on space-based capabilities should be a part of a tailored deterrence strategy.”

Tailoring Deterrence for China in Space

597KB ∙ PDF file

Download

Download

What I’m Thinking:

• Space security is only growing in importance. The national security equities in space are clear — without our off-planet assets, virtually none of our military capabilities, from submarines to fighter jets, will know who, when, where, or how to operate. But space is equally important economically, as commercial applications come online and proliferate. In 2019, one report said global space activity was more than $414.8 billion, with commercial space constituting 79% of total activity. This means space is yet another domain where government and industry interests are intermingled and will require strong cooperation to secure.

Share

Cyber Spillover Between Iran and Israel

What’s New: Online hostilities between Iran and Israel are expanding into civilian targets.

Why This Matters: As the two nations square off in cyberspace, the threat of escalation and unintended consequences is rising.

Key Points:

• Jerusalem and Tehran have been in “persistent cyber engagement” for years, but recent developments are bringing this shadow war into the light.

• Last week, Fars News — a media outlet run by Iran’s Islamic Revolutionary Guard Corps (IRCG) — published the name, image, birthdate, email, social media handles, phone number, and home address of an Israeli security expert they accused of specializing in anti-Iran hacking operations.

• This doxing1 was proceeded by an attack carried out last month by the Iranian hacking group, Black Shadow, who shut down a number of Israeli websites and stole user data from the Israeli LGBT dating site, “Atraf.”

• Also last month, Tehran accused Israel of conducting a cyberattack that shut down most of Iran’s gas stations for nearly two weeks.

• Separate, but relatedly, U.S. authorities are warning that Iran continues to target U.S. critical infrastructure, including hospitals.

What I’m Thinking:

• It’s all fun and games until somebody gets hurt. Most of this activity is pretty standard. That is not to say, though, that it isn’t important or risky. Cyber is an attractive means of attack because it has the veneer of deniability and because it offers the ability to inflict coercive pain on a target typically without the death and destruction that accompanies “kinetic” options. However, things can always go sideways and the current engagement tempo between these two nations could easily get out of hand, with implications well beyond their respective borders. I’m all for playing hardball, but it’s better for everyone if we keep the game between the lines.

Share

“C” Speaks

What’s New: Richard Moore, Britain’s new Chief of the Secret Intelligence Service (MI6), recently spoke about human intelligence in the digital age.

Why This Matters: This is Moore’s first public speech as Chief of MI6, or “C,” and it is telling how much this speech focuses on technological disruption and China.

Key Points:

• “…We live in a world transformed by digital connectivity, and stand on the cusp of revolutionary advances in technology which will affect the manner in which we live and work in ways we cannot fully foresee.”

• “Others would speak to you about the benefits associated with these new discoveries… and they are myriad. But I am paid to look at the threat side of the ledger. MI6 deals with the world as it is, not as we would like it to be. And the ‘digital attack surface’ that criminals, terrorists and hostile states seek to exploit against us is growing exponentially.”

• “According to some assessments, we may experience more technological progress in the next ten years than in the last century, with a disruptive impact equal to the industrial revolution. As a society, we have yet to fully internalise (sic) this stark fact and its potential impact on global geopolitics. But it is a white-hot focus for MI6.”

• “The tectonic plates are shifting as China’s power, and its willingness to assert it, grows … The Chinese Intelligence Services are highly capable and continue to conduct large scale espionage operations against the UK and our allies. This includes targeting those working in government, industries, or on research of particular interest to the Chinese state.”

• “Adapting to a world affected by the rise of China is the single greatest priority for MI6. We are deepening our understanding of China across the UK intelligence community, and widening the options available to the government in managing the systemic challenges that it poses.”

• “Our adversaries are pouring money and ambition into mastering artificial intelligence, quantum computing and synthetic biology, because they know that mastering these technologies will give them leverage. An intelligence service needs to be at the vanguard of what is technologically possible.”

• “We can not match the scale and resources of the global tech industry, so we shouldn’t try. Instead we should seek their help … I cannot stress enough what a sea-change this is in MI6’s culture, ethos and way of working … We must become more open, to stay secret.”

What I’m Thinking:

• Moore is right. Glad to see these views taking hold in places where it really matters.

Share

Let’s Get Visual

Nerd Humor

Quick Clicks

• Samsung will build $17B chip plant in Texas

• Dorsey’s departure hints at “big tech” restlessness

• SIM hackers sentenced

• Pentagon may reorganize AI and data offices

• China closing foreign funding loophole for tech companies

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

Among my many blessings, is you! Thank you for your support and for making The Kitchen Sync such a success. I hope you’re having a very happy Thanksgiving holiday.

Tech Terms

Payment Card Industry Data Security Standard (PCI DSS) — A set of security standards that are designed to ensure that all organizations that accept, process, store, or transmit credit card information maintain a secure environment. Failure to comply with PCI requirements can lead to steep fines and penalties, revocation of credit card payment services, or even suspension of accounts.

To Secure Peace, Prepare for War

What’s New: There is mounting evidence that China has already achieved significant military capacity and may enjoy technical superiority in a number of critical capabilities.

Why This Matters: War with China — though far from inevitable — would be so consequential and deadly that it must be prepared for more seriously and systematically than current efforts suggest we are doing.

Key Points:

• Chinese military spending — when properly accounting for differences in reporting structure, purchasing power, and labor costs — is approaching 90% of U.S. military spending.

“The Chinese People’s Liberation Army (PLA) remains one of the world’s largest militaries, but its days of largely obsolescent equipment are in the past,” argues the Heritage Foundation’s 2022 Military Index. “Nearly two decades of officially acknowledged double-digit growth in the Chinese defense budget have resulted in a comprehensive modernization program that has benefited every part of the PLA.”

• Similarly, this year’s Annual Threat Assessment (ATA) says, “The PLA Navy and PLA Air Force are the largest in the region and continue to field advanced long-range platforms that improve China’s ability to project power. The PLA Rocket Force’s highly accurate short-, medium-, and intermediate-range conventional systems are capable of holding U.S. and allied bases in the region at risk.”

• More novel capabilities were most recently demonstrated by the Chinese launch of an earth-orbiting, nuclear-capable hypersonic missile that also discharged some sort of projectile during its terminal glide phase — a capability that some American observers say “defies physics.”

• Regarding cyber, the ATA again makes the challenge very clear:

“We assess that China presents a prolific and effective cyber-espionage threat, possesses substantial cyber-attack capabilities, and presents a growing influence threat … We continue to assess that China can launch cyber attacks that, at a minimum, can cause localized, temporary disruptions to critical infrastructure within the United States.”

• Summarizing these trends, Robert O. Work and Greg Grant say the following:

“China is keenly focused on blunting the U.S. military’s technological superiority, even as it strives to achieve technological parity, and eventually technological dominance … After considering what the Chinese military has accomplished technologically in little more than two decades and what they plan to do in the decades to come, any objective assessment must at least consider the possibility that the U.S. Joint Force is close to becoming the victim of a deliberate, patient, and robustly resourced military-technical offset strategy.”

What I’m Thinking:

• Nothing is inevitable and dispassionate analysis is key. No one knows the future and history is not a math problem to be “solved.” War with China is not an inescapable fate, but the likelihood of such a conflict is growing and the U.S. does not exercise unilateral influence over the matter. Many consider the devastation that would undoubtedly occur in a war between the U.S. and China and simply dismiss the possibility as “insane” or “too awful to consider.” While understandable, this approach is immoral for those tasked with securing the nation and its people. Washington and Beijing are already in a state of confrontation. We must acknowledge and accept that a progression to conflict and possibly even war is possible — but always with an commitment to defend our way of life and a determined willingness to avoid war if we can do so responsibly.

• There is good reason to believe we have a false understanding of Chinese capability. First, the closed nature of Chinese society makes it a difficult intelligence target. Second, the U.S. intelligence posture on China has been devastated for years and is slow in its recovery. Third, the fused relationship between the CCP and the nation’s industry make it difficult to identify the source and status of critical innovations and to limit them. For example, as discussed last week, of the 273 known Chinese suppliers of AI to the PLA, just 22 (8%) are limited by U.S. sanctions or other prohibitions. Finally, fourth, China’s hypersonic missile launch is only the latest technological feat to surprise Western analysts. There is broad concern that Beijing also enjoys parity or superiority in AI, quantum computing, and other emerging technologies. Despite all of this, U.S. policymakers and warplanners are dragging their feet by insufficiently funding our own military, failing to pass even these meager budgets, and refusing to prioritize this issue as it deserves. When asked about the recent hypersonic launch being seen as a “Sputnik moment,” Air Force General John Hyten, vice chairman of the Joint Chiefs of Staff, said, “From a technology perspective, it’s pretty impressive … But Sputnik created a sense of urgency in the United States ... The test on July 27 did not create that sense of urgency.  I think it probably should create a sense of urgency."

• We should, therefore, plan for the worst. We should, I believe, begin by asking the question, “What would we do now if we knew with absolute certainty that the U.S. would be at war with China in the next 10 years?” While every contingency cannot be approached this way, the likelihood of this scenario is now sufficiently possible that it should at least form the boundaries of contemporary policy, planning, and strategy. This is made even more advisable by the fact that military strength and preparations provide both a specific deterrence to growing Chinese aggression as well as a general check on broader geopolitical risk. History is replete with examples of nations failing to recognize and to prepare for a war that — in hindsight — appears obvious. History also teaches that these failures are typically rooted, not in an inability to read the relevant signs at the time, but in a willful apathy fueled by delusional hopes and false assumptions. These are nation-killers.

• Three specific actions that can be taken. First, the Biden administration needs to prepare a serious, detailed national security strategy for China. This strategy should not be a blurry-eyed impression of a world we long for, but a clear-eyed articulation of interests and the steps we will take to secure them. Second, Congress should form a bi-partisan special committee on China, made up of members from the House and Senate. This committee should be tasked with holding hearings and generating a report on the current state of U.S.-China policy, the actions necessary for ensuring U.S. national security in the context of U.S.-China policy, and recommending specific executive and legislative action in this regard. Finally, the Defense Advanced Research Projects Agency (DARPA) should be tasked with a specific program of developing innovative strategies and capabilities specifically aimed at countering China. DARPA’s founding mission is “creating strategic surprise for adversaries and preventing strategic surprise to the US.” The agency is about to have its budget doubled by the U.S. Innovation and Competition Act — this seems like a worthy expenditure of these resources.

Share

U.S. Pays Victims $56 Million In Stolen Crypto

What’s New: The Department of Justice (DOJ) seized $56 million in cryptocurrency when it arrested a self-described “number one promoter” of the BitConnect fraud scheme, according to a DOJ statement.

Why This Matters: BitConnect is the largest cryptocurrency fraud scheme ever criminally charged, and the U.S. government intends to sell the coins and use the proceeds to compensate victims.

Key Points:

• This week, Glenn Arcaro pleaded guilty to the massive conspiracy to defraud BitConnect investors, in which they invested more than $2 billion.

• Arcaro is scheduled to be sentenced in early 2022 and faces up to 20 years of prison time.

• The seized funds are primarily in the form of Bitcoin, but will be converted to fiat currency and used to compensate victims in U.S. dollars.

• Separate, but relatedly, the IRS has seized $3.5 billion in cryptocurrency this year, accounting for 93% of criminal investigation seizures.

What I’m Thinking:

• Throw the book at this guy and give him the full 20. The scale of the BitConnect scheme and of the IRS’s seizures illustrate how bad guys have fully embraced digital cash and how we need to get a hold on this problem now.

Share

North Korean’s Snooping on Chinese Hackers

What’s New: Hackers backed by Pyongyang are targeting Chinese cybersecurity researchers and stealing their tools and techniques, according to The Daily Beast.

Why This Matters: North Korean hackers are under immense pressure to help the regime overcome crippling sanctions, so they’re always on the lookout for new cyber capabilities.

Key Points:

• The CrowdStrike cybersecurity firm says Kim Jong Un’s minions lured Chinese researchers with malware-laden files, labeled “Securitystatuscheck.zip” and “_signed.pdf.”

• China’s Ministry of Public Security and the National Information Security Standardization Technical Committee were among the groups who were targeted.

• The Lazarus Group (aka Stardust Chollima) appears to be behind the operation.

“For vulnerability research in particular that would be interesting—it in effect allows you to collect and steal weapons that you can use for other operations. It could also give them insight into new techniques that they’re not aware of and how research is being conducted,” said CrowdStrike’s VP of Intelligence Adam Meyers. “It also lets you know what the security posture looks like in other countries.”

What I’m Thinking:

• There’s no honor among thieves. North Korea is a tier-one cybersecurity threat and they’re highly motivated because these types of operations are critical for the nation’s primary means of supporting itself: cybercrime. While going after China always has some inherent risk, Beijing also understands this is all part of the game. That doesn’t mean that Xi Jinping won’t turn a few screws if and when he feels the need to do so. But, I don’t think this is a huge deal in the context of the broader North Korea-China relationship.

Share

Let’s Get Visual

Nerd Humor

Quick Clicks

• How Iran tried to undermine the 2020 election

• Strike on U.S. base was Iranian response to Israel

• Space Force wants to clean up space junk

• Ford, GM step into chip business

• Australia is beefing up its tech prowess after AUKUS

That’s it for this Friday Brief. Thanks for reading, and if you think someone else would like this newsletter, please share it with your friends and followers. Have a great weekend!

Read more