Highlighted content

All in-depth research & reports

Issue Brief

Jul 24, 2024

OT cyber policy: The Titanic or the iceberg

By Danielle Jablanski

Current policy does not address the issue of cyber-physical security with a systemic approach, instead focusing with tunnel vision on specific events. This analysis uses the iceberg model for systems thinking to address policy gaps in the OT ecosystem, detailing recommendations for the Cybersecurity and Infrastructure Security Agency (CISA).

Cybersecurity

Issue Brief

Jul 1, 2024

The impact of corruption on cybersecurity: Rethinking national strategies across the Global South  

By Robert Peacock

As the Global South prepares for the next stage in ICT development, governments must prioritize policies that reduce corruption in critical network software procurement to protect those countries’ developing cyberspace.

Corruption Cybersecurity

Report

Jun 24, 2024

User in the middle: An interoperability and security guide for policymakers

By Maia Hamin, Alphaeus Hanson

When technologies work together, it benefits users and the digital ecosystem. Policymakers can advance interoperability and security in tandem by understanding how each impacts the other.

Report

Jun 12, 2024

“Reasonable” cybersecurity in forty-seven cases: The Federal Trade Commission’s enforcement actions against unfair and deceptive cyber Practices

By Isabella Wright and Maia Hamin

The FTC has brought 47 cases against companies for unfair or deceptive cybersecurity practices. What can we learn from them?

Cybersecurity

Report

Apr 22, 2024

Markets matter: A glance into the spyware industry

By Jen Roberts, Trey Herr, Emma Taylor, Nitansha Bansal

The Intellexa Consortium is a complex web of holding companies and vendors for spyware and related services. The Consortium represents a compelling example of spyware vendors in the context of the market in which they operate—one which helps facilitate the commercial sale of software driving both human rights and national security risk.

Civil Society Cybersecurity

Issue Brief

Apr 18, 2024

O$$ security: Does more money for open source software mean better security? A proof of concept

By Sara Ann Brackett, John Speed Meyers, Stewart Scott

A proof-of-concept study looking for correlation between open source software project funding and security practices at scale.

Cybersecurity

Report

Feb 15, 2024

Hacking with AI

By Maia Hamin, Stewart Scott

Can generative AI help hackers? By deconstructing the question into attack phases and actor profiles, this report analyzes the risks, the realities, and their implications for policy.

Artificial Intelligence Cybersecurity

Issue Brief

Feb 8, 2024

Future-proofing the Cyber Safety Review Board

By Maia Hamin, Trey Herr, Stewart Scott, Alphaeus Hanson

The Cyber Safety Review Board seeks to examine and learn from complex failures in cyberspace. As Congress considers how to design its next iteration, there are ways to make it more effective and adaptable for the increasing challenges to come.

Cybersecurity

Report

Jan 16, 2024

Design questions in the software liability debate

By Maia Hamin, Sara Ann Brackett, and Trey Herr, with Andy Kotz

Software liability—resurgent in the policy debate since its mention in the 2023 US National Cybersecurity Strategy—describes varied potential structures to create legal accountability for vendors of insecure software. This report identifies key design questions for such regimes and tracks their discussion through the decades-long history of the debate.

Cybersecurity

Report

Nov 13, 2023

This job post will get you kidnapped: A deadly cycle of crime, cyberscams, and civil war in Myanmar

By Emily Ferguson and Emma Schroeder

In Myanmar, cybercrime has become an effective vehicle through which nonstate actors can fund and perpetuate conflict.

Cybersecurity Indo-Pacific

The Atlantic Council’s Cyber Statecraft Initiative, part of the Atlantic Council Technology Programs, works at the nexus of geopolitics and cybersecurity to craft strategies to help shape the conduct of statecraft and to better inform and secure users of technology.