healthcarereimagined

“Without a common understanding of risk, civilian and military leaders are unable to make informed and consistent decisions about open-source data, leading to strategic missteps and tactical knee-jerk reactions.”

From fitness trackers to aircraft monitoring apps, open-source information is everywhere. The Army needs to account for it as it develops its concept of information advantage.

Maggie Smith and Nick Starck | 05.24.22

Editor’s note: This article is part of the series “Compete and Win: Envisioning a Competitive Strategy for the Twenty-First Century.” The series endeavors to present expert commentary on diverse issues surrounding US competitive strategy and irregular warfare with peer and near-peer competitors in the physical, cyber, and information spaces. The series is part of the Competition in Cyberspace Project (C2P), a joint initiative by the Army Cyber Institute and the Modern War Institute. Read all articles in the series here.

Special thanks to series editors Capt. Maggie Smith, PhD, C2P director, and Dr. Barnett S. Koven.

---

Three months ago, as Russia invaded Ukraine, the world watched as Twitter exploded with real-time data, reporting, and analysis of the unfolding conflict. It quickly became clear that the war presented analysts with an unprecedented amount of rich, open-source data on military movements, troop location, shelling damage, weapon types, and more. Ukraine has been quick to capitalize on Russia’s poor data protection and President Volodymyr Zelenskyy has become Ukraine’s most potent weapon because of his ability to use data and information and Russia’s inability to protect it.

For the US Army, a key takeaway from the Ukrainian conflict so far should be the extent to which our modern-day habits are trackable, traceable, and predictable. Open-source data presents modern militaries, especially wealthy high-tech ones, with a very uncomfortable truth: militaries are exposed because their troops are connected. Currently, the US legal and regulatory systems do not, and cannot, protect the average citizen—and therefore, the average US service member—from risks associated with the ubiquitous open-source data produced by our surveillance economy. From a national security perspective, the accumulation of open-source data on people—their habits, their likes and dislikes, their exercise routines, and more—and its potential to impact the military’s ability to fulfill its man, train, and equip mandate from Congress is deeply concerning. Also alarming is the amount of information our adversaries can glean about US strategic interests from tracking US military activity on any number of apps, like Flightradar24, which includes US military reconnaissance platforms such as the unmanned RQ-4 Global Hawk, the RC-135V Rivet Joint, and others among the aircraft it tracks, and Strava, the fitness tracking app. Ultimately, you can intuit quite a bit about where our forces may be heading, where military planners are focusing their efforts, and where the next conflict is likely to occur if you simply track where Rivet Joints are conducting sorties and service members are working out. And for the Army specifically, the existing and emerging doctrine fails to account for the surveillance economy and its open-source data, leaving a gaping hole in our competitive strategy.

Information Advantage: What Is It?

Presently, the Army is developing its doctrine for its newest term of operational art: information advantage. Information drives friendly, neutral, and adversary actors at all levels and across all domains of warfare. Information advantage is a condition of relative advantage that enables a more complete operational picture and leads to decision dominance—the sensing, understanding, deciding, and acting faster and more effectively than the adversary. Gaining the initiative and maintaining a position of relative advantage over the information environment—regardless of where we find ourselves on the conflict continuum—largely depends on a commander’s ability to achieve an information advantage over a defined target audience or adversarial decision maker in a specific context or timeframe. Complementary to information advantage is the employment of information and other capabilities as weapons, designed to shape friendly, neutral, and adversarial perceptions, attitudes, and behaviors. Ultimately, the ability to shape perception and achieve victory in modern conflict and competition is heavily dependent on trust—trust in data, among team and unit members, in leaders, in doctrine, in equipment, and in capabilities.

To achieve information advantage, the Army conceives of five, interrelated core tasks— what have been described as “information advantage activities.” Commanders must: 1) enable decision making; 2) protect friendly information; 3) inform and educate domestic audiences (a task conducted in accordance with laws and focused on public affairs office activities); 4) inform and influence international audiences; and 5) conduct information warfare. In theory, information advantage activities are synchronized through the operations process, integrated across the Army’s six warfighting functions—command and control, intelligence, protection, movement and maneuver, fires, and sustainment—and employed using all available military capabilities. After distilling the Army’s rhetoric, information advantage requires commanders to prioritize persistent sensing, ongoing analysis, cyclical assessments, and a willingness to continuously update assumptions to ensure they maintain a dynamic situational awareness of the environment—in competition and conflict. Ultimately, the Army anticipates that victory in future warfare, and in the current era of persistent engagement, will come down to who can gain the most by effectively employing information to their advantage.

The National Security Risk

Instead of gunfire or artillery explosions, some of the first signs that Russia was invading Ukraine on February 24, 2022, came from Twitter. For example, Dr. Jeffrey Lewis, an expert in arms control and nonproliferation, compiled open-source data from the traffic layer of Google Maps and shared the Russian troop movements he identified, essentially in real time, on Twitter. According to Google Maps, he Tweeted, “there is a ‘traffic jam’ at 3:15 in the morning on the road from Belgorod, Russia to the Ukrainian border”—exactly the spot where vehicles, equipment. and manpower had massed the previous day. “Someone’s on the move,” Dr. Lewis concluded, and he was right. As the Ukrainian conflict escalated, individual researchers and organizations continued to collectand analyze open-source data—also defined as publicly available information by DoD—from social media platforms, commercial satellites, and public databases. Their analysis and reporting have emerged as a critical resource on the conflict, providing combatants and observers with incredible insight and minute-by-minute assessments of what is happening on the ground.

However, the ability to track ongoing military operations through open-source data is not new—in 2016 Bellingcat released a report that used open source data to document the full scale of the Russian artillery attacks against Ukraine in the summer of 2014. In fact, using open-source data is the new normal. And various US government agencies, including the Department of Defense, rely on open-source data for intelligence and procure data through contracts with data brokers. In response, civil society and privacy watchdogs around the world have voiced concern, highlighting the risks to personal privacy associated with government-led data collection, aggregation, and use. The likely result is new legislation, like the proposed Fourth Amendment is Not For Sale Act and others.

However, the use of open-source data and large scale, legal data collection efforts frequently pose less obvious national security risks. China, for example, aggressively collects data—legally and illegally—to support its domestic and international goals. A major threat to US citizen data is China’s Beijing Genomics Institute(BGI), which has grown into one the world’s largest genomic companies after working on the Human Genome Project. BGI developed a prenatal genetic test, in collaboration with the Chinese military, that is sold and used globally. However, in addition to providing prospective parents with important genetic information, the DNA specimens are also amassed into a vast bank of genomic data that China is using to conduct large-scale studies of population traits. More than eight million women have taken BGI’s prenatal tests globally, and China has their DNA and location data stored locally in mainland China. BGI also developed a COVID-19 test and offered to set up testing laboratories in several US states at the start of the pandemic. Mike Orlando, head of the National Counterintelligence and Security Center, identified the BGI offers as a national security risk, “citing concerns about how China might use personal data collected on Americans.” Even when done legally, DNA collection by Chinese companies should be understood as part of China’s comprehensive effort to collect records and data.

On the other hand, data also creates risk for the governments that aggressively pursue it. Experts are increasingly identifying the ways that open-source data can be used to expose government activity (e.g., military maneuvers, resource allocation, travel, or policy activity) and how the ever-growing pools of open-source data generated by modern societies pose a national security risk. But we lack precision in how we describe the sources, mechanisms, and outcomes of open-source data risks, preventing the development of a coherent mitigation strategy tailored to the national security context. Without a common understanding of risk, civilian and military leaders are unable to make informed and consistent decisions about open-source data, leading to strategic missteps and tactical knee-jerk reactions—like embedding code in the Free Application for Student Aid website that sends user information back to Facebook (the code has since been removed) or banning service members from using geolocation features on devices in deployed areas (e.g., fitness trackers).

What Is Information Advantage Missing?

The piece missing from the Army’s information advantage framework is an awareness of how the persistent aggregation of open-source data in the surveillance economy impacts the Army’s ability to achieve information advantage. Because the American public is subject to the surveillance economy, US service members are, too. George Washington famously emphasized that “when we assumed the Soldier, we did not lay aside the Citizen” as a cautious reminder that soldiers are citizens first. Since service members live alongside and among the general population, service members and veterans are not only susceptible to the same targeted marketing the average citizen experiences, but are actually the target of additional foreign manipulation and surveillance efforts. Soldiers, sailors, airmen, and Marines access social media platforms and online services just as civilians do. They also purchase items online, apply for credit cards online, do their taxes with online tax preparation tools, and surf the web just like their civilian counterparts. But unlike the civilian neighbors they barbeque with, they also fight the nations’ wars. Open-source data is produced continuously by all service members as they go about their digitally connected lives alongside their civilian counterparts, making the surveillance economy an integral part of the information environment that commanders need to consider as they conduct information advantage activities.

The military is beginning to understand the potential risks presented by open-source data, particularly in combat situations, partly because examples of how open-source data can expose military information abound—from troop location tracking on Tinder to tracking stolen AirPods to SIM cards revealing Russian troop locations in Ukraine. Of course, these known cases fit neatly within traditional operational security risks and are scenarios that senior military leaders can relate to—especially when open-source data is directly contributing to deaths on the battlefield or to the identification of war criminals. However, having a tactical appreciation of the open-source data risks during periods of declared conflict is not enough to achieve information advantage—the risks to military operations are present well before any decision to go to war is made, and persist after conventional conflict ends. In fact, the risks are a constant factor in the current competition environment, making any ex post facto restrictions, regulations, or rules placed on deployment behavior inadequate and misguided. Changes need to happen at home, well before the deployment cycle begins. Failing to consider garrison operations and the ways that soldiers interact with the surveillance economy as part of the information environment that commanders need to consider for information advantage is a failure to understand when and where the vulnerabilities and threats to the force begin and a failure to account for our modern, digitally connected, human behavior.

The “So What” of Open-Source Data

For multi-domain operations, the Army frames the operating environment as including human, physical, and informational aspects. To be effective across the competition continuum, the Army proposes positioning formations and capabilities forward, so that information advantage activities are integrated into security cooperation efforts and crisis action planning on behalf of theater commanders. To coordinate information advantage activities in an area of conflict, the Army identifies that preparation must begin in competition, or when forces develop the intelligence to identify specific vulnerabilities and then gain or prepare to request the required authorities, and train to use national-level capabilities. The overall goal is operational convergence with formations postured to degrade, disrupt, or destroy adversary capabilities, while defending those of friendly forces. However, what this framework does not consider is the intersection of the human, physical, and informational aspects, or the risks to day-to-day garrison operations from open-source data.

Ultimately, the risks of open-source data are not an individual’s problem, but an Army problem. For example, fake accounts on Facebook for US Army general officers are numerous, and in some cases, fail to violate Facebook’s terms of service and can therefore, remain active. Even LinkedIn is rife with fake profilesattempting to make connections with users in targeted marketing campaigns. Additionally, fake social media accounts managed by Russia have already mobilized the American public in connection with divisive issues, making fake accounts for authoritative figures, like US Army generals, especially concerning. From a national security perspective, open-source data enables foreign manipulation efforts that target the US military and veteran populations through the use of “misleading and divisive questions about the U.S. government’s military and veteran policies to further amplify and exploit the existing frustrations.” The relative ease with which anyone can purchase open-source data means that soldier data is already being used to target service members for products, media, or other services and presently, there is nothing preventing our adversaries from using open-source data to target them as well.

To achieve information advantage, the Army needs to give commanders the tools necessary to assess the operational risks of open-source data, social media, and related information technologies. The Army has longstanding doctrine for assessing operational risks; however, the traditional risk management framework is intentionally broad, leaving commanders without clear guidance or terminology for identifying, assessing, and making risk decisions in the information environment. As the Army develops its information advantage doctrine, it should simultaneously develop a dedicated data risk management framework to enable modern commanders to achieve information advantage. In its current form, information advantage perpetuates an antiquated notion that operating environments are (or can be) geographically bound—as the conflict in Ukraine has highlighted, kinetic actions may be limited to a geographic area, but informational risks are global. A dedicated data risk management framework would be a guide for commanders to continually and methodically assess the evolving information environment, to identify and address conceptual gaps, and to achieve their informational and operational goals. As the information environment emerges as the main effort in competition and conflict, the Army must adapt and provide its commanders with the right concepts, doctrine, and resources to succeed in a world characterized by the ubiquity of open-source data.

Article link: https://mwi.usma.edu/open-source-data-is-everywhere-except-the-armys-concept-of-information-advantage/

Captain Maggie Smith, PhD, is a US Army cyber officer currently assigned to the Army Cyber Institute at the United States Military Academy where she is a scientific researcher, an assistant professor in the Department of Social Sciences, and an affiliated faculty of the Modern War Institute. She is also the coeditor of this series and director of the Competition in Cyberspace Project.

Captain Nick Starck is a US Army cyber officer currently assigned as a research scientist at the Army Cyber Institute. His research focuses on information warfare and data privacy.

The views expressed are those of the authors and do not reflect the official position of the United States Military Academy, Department of the Army, or Department of Defense.

Image credit: Sgt. Dustin D. Biven, US Army

By Colin Demarest Wednesday, May 18

WASHINGTON — Two NATO agencies recently kicked off an artificial intelligence initiative to better understand the technology and its potential warfare applications.

More than 80 AI experts, researchers and academics from the U.S. and other member countries are involved with the venture, known as a strategic “horizon scanning,” put together by the NATO Science and Technology Organization and the NATO Communications and Information Agency.

An inaugural meeting and workshop was held this month in The Hague, Netherlands, where the NCI Agency’s data science and AI facilities are located.

“AI is one of the key emerging and disruptive technologies identified by NATO as vital for the maintenance of its technological edge,” NATO Chief Scientist Bryan Wells said in a statement. “By working together, the STO and the NCI Agency are able to bring together global experts to ensure the very best scientific expertise is available to advise NATO and its allies and partners on the latest scientific trends in this area.”

The NATO guarantee of a collective defense and the advantage of numbers, both on the battlefield and in the lab, has been much discussed amid Russia’s latest invasion of Ukraine and the subsequent membership applications made by Finland and Sweden.

NATO ministers in October adopted the alliance’s first-ever AI strategy, which describes the capability as “changing the global defense and security environment” and offering “an unprecedented opportunity to strengthen our technological edge but will also escalate the speed of the threats we face.”

The strategy emphasizes responsible use of AI for defense across six tenets: lawfulness; responsibility and accountability; explainability and traceability; reliability; governability; and bias mitigation.

AI frameworks and other guidance drafted by the U.S. and its defense community take a similar approach.

NATO allies in 2019 agreed to focus on seven emerging and disruptive technologies, data, computing and AI among them. Making sure there are shared standards, and that systems will work with systems, will be critical to success, officials said.

“One of the big challenges when we go into this new phase of disruptive technologies is how do you keep all allies on the same hymn sheet when it comes down to communicating with each other, using the same technology, being interoperable,” David van Weel, NATO assistant secretary general for emerging security challenges, told Defense News in March 2021. “So that’s a big part [of the strategy] and a big role for NATO to play.”

Article link: https://www.c4isrnet.com/artificial-intelligence/2022/05/18/nato-launches-ai-initiative-to-ensure-tech-advantage/

About Colin Demarest

Colin Demarest is a reporter at C4ISRNET, where he covers military networks, cyber and IT. Colin previously covered the Department of Energy and its NNSA — namely Cold War cleanup and nuclear weapons development — for a daily newspaper in South Carolina. Colin is also an award-winning photographer.

https://www.rand.org/pubs/research_reports/RRA1190-1.html?

Research Questions

1. What responses has the United States considered in the past to cyber compromises of U.S. government systems?
2. Has the United States been able to materially affect adversary behavior through its past responses?
3. How should the United States respond to similar cyber incidents in the future?
4. Should the United States expect those responses to achieve its objectives in the future in light of prior responses?

Cyber-enabled espionage against the United States has been a challenge for more than 20 years and is likely to remain so in the future. In the aftermath of the 2020 SolarWinds cyber incident that affected U.S. government networks, policymakers, lawmakers, and the public asked: “Why does this keep happening, and what can the United States do to prevent it from reoccurring?” It is these questions that motivate this effort. Specifically, this report summarizes three cases of Russian cyber-enabled espionage and two cases of Chinese cyber-enabled espionage dating back to the compromise of multiple government agencies in the late 1990s up to the 2015 compromise of the Office of Personnel Management. The purpose of this inquiry is to address whether U.S. responses have changed over time, whether they led to changes in adversary behavior, and what the United States can learn from these cases to inform future policymaking. The authors show that policymakers typically consider a narrow set of response options, and they often conclude that not much can be done beyond trying to improve network defenses, because the United States “does it too.” The authors suggest that the U.S. government could broaden its policy response options by increasing focus on diplomatic engagement, including working with partners and allies to call out malicious cyber behavior; expanding the use of active defense measures to root out adversaries; and employing more-sophisticated counterintelligence techniques, such as deception, to decrease the benefits that adversaries derive from cyber espionage.

Key Findings

Available response options are not limited to the cyber domain, and no one should expect them to be

• The response options that U.S. policymakers consider for cyber espionage cases do not appear to have changed much over the past two decades — and, in some respects, they may be even more constrained today.

The benefits of cyber-enabled espionage continue to outweigh any perceived repercussions for such countries as Russia and China

• The historical record suggests that the United States has felt constrained in its ability to respond vigorously against Russia or China because of the notion that cyber espionage is a standard and accepted practice by nations.
• The record also suggests that the United States would not want to take steps to constrain its own ability to engage in similar intelligence activities in cyberspace.
• U.S. policymakers have assessed that breaches of confidentiality, although damaging in the long term, did not rise to the same level of acute damage to national security that another, more destructive form of cyber operation might entail.
• The United States has proved especially vulnerable to cyber incidents, and a lack of response appears to have emboldened the Russians and Chinese to continue and expand their cyber espionage activities over the years.
• Improving the U.S. ability to deter by denial — by strengthening the cybersecurity of the U.S. government — remains an elusive but vital priority.

Recommendations

• The United States should pursue expanded diplomatic efforts, including with its partners and allies, to call out indiscriminate cyber espionage and establish guardrails for acceptable cyber espionage.
• The United States should also expand its use of active defense measures on U.S. government networks to hunt for adversary activity and offer similar support to partners and allies.
• The United States should make better use of counterintelligence, particularly deception operations, to reduce the benefits that countries might derive from cyber espionage.
• The role of diplomacy should not be diminished, and more-recent multilateral efforts to call out malicious cyber behavior have the potential to lay a foundation for shaping international norms.

Table of Contents

• Chapter OneIntroduction
• Chapter TwoCyber Espionage, Deterrence, and Response
• Chapter ThreeRussia Case Studies
• Chapter FourChina Case Studies
• Chapter FiveConclusion and Recommendations

Check out this video comparing public vs. private #5G networks. #DOD and National Telecommunications and Information Administration (NTIA) have teamed up to create a video series explaining the telecommunications technologies that impact the #5GChallenge. The United States Department of Defense and NTIA launched the challenge to advance 5G interoperability toward true 5G plug-and-play operation. https://lnkd.in/ggGm_8J8

By VINCENT BERKMAY 23, 2022 09:00 AM ET

Lessons from Germany’s World War II code machine, Enigma, show that even “unbreakable” encryption can be cracked eventually.

The previous two years have proven the importance of proactively working to secure our data, especially as organizations underwent digital transformations and suffered increased cyberattacks as a result. For those organizations that have been breached, but their data hasn’t yet been exploited and released to the wild, it may already be too late. 

Organizations that have already experienced a data breach may become victims of “harvest today, decrypt tomorrow” or capture-now-decrypt-later attacks. These attacks, also referred to as “harvesting” for short, capitalize on known vulnerabilities to steal data that may not even be truly accessible using today’s decryption technologies. 

These attacks require long-term planning and projections on the advancement of quantum-computing technologies. While these technologies may still be years away from being commercially available and widely used, organizations should look to protect against these threats now to prevent themselves from becoming a future casualty.

Before getting into more detail on the future threat posed by quantum computing, we should look to a historic example to inform our present decision-making. 

Lessons from the Enigma

In 1919 a Dutchman invented an encoding machine that was universally adopted by the German army, called “the Enigma.” Unbeknownst to Germany, the Allied powers managed to break the coding scheme, and were able to decode some messages as early as 1939, when the first German boots set foot in Poland. For years, however, the German army believed the Enigma codes were unbreakable and was communicating in confidence, never realizing their messages were out in the open. 

History may already be repeating itself. I can’t help but think that most organizations today also believe that their encrypted data is safe, but someone else may be close to, or already, reading their “secure” mail without them even knowing. 

Today’s modern cryptography is often deemed unbreakable, but a big, shiny black building in Maryland suggests that governments may be better at this than is widely believed. Although a lot of credit goes to the magical and elusive quantum computer, the reality is different: poor implementations of crypto suites are the primary vector for breaking encryption of captured traffic. So are certificates captured through other means, brute-forced passwords and even brute-forced crypto, because insufficient entropy is used to generate random numbers.  

All these techniques are part of the arsenal of any nation who wants to strategically collect information on the happenings of other international players—whether government or private companies. These techniques also require higher levels of coordination and financial backing to be a successful part of an intelligence strategy. As I continue to see, when the value of the captured information is high enough, the investment is worth it.  Consider then the vast data centers being built by many governments: they are full of spinning disks of memory storage just in case current approaches don’t yield access. Data storage has become an investment in the future of intelligence gathering. 

Looking towards the future

Harvesting attacks does not just work as a strategy for quantum computers. We will likely have more powerful processors for brute-forcing in the future.  Additionally, other types of stochastic computation machines, such as spintronics, are showing promise and even the de-quantification of popular algorithms may one day see a binary computer version of Peter Shor’s algorithm. The latter helps us explain how quantum computing may help to make quick work of current encryption techniques. This will allow breaking of Diffie-Hellman key exchanges or RSA on a conventional computer in smaller time frames.

So how do we shield ourselves?  It is hard to imagine armoring oneself against any possible threat to encryption. Just like it is difficult to predict exactly which stocks will do well, and which ones won’t.  There are too many factors and too much chaos. One is left with only the option of diversification: using an out-of-band key distributing strategy that allows multiple paths for key and data to flow, and a range of algorithms and keys to be used. By diversifying our cryptographic approaches we are also able to minimize the damage in case a particular strategy fails us. Monocultures are at risk of pandemics, let’s not fall victim to encryption monoculture as we move into the future.

It is past time to take steps now that will protect organizations from future threats. This includes developing actionable standards. Both federal agencies and the private sector need to embrace quantum-safe encryption. Additionally, they should look to develop next-generation, standards-based systems that will address current encryption method shortcomings and poor key management practices. This will help to ensure not only quantum-safe protection from future threats, but also stronger security from contemporary threats. 

Organizations face a dizzying array of threats and need to constantly remain vigilant to thwart attacks. While looking to protect against current threats is certainly important, organizations should begin projecting future threats, including the threat posed by quantum computing. As technology continues to advance each day, one should remember that past encryption, like the Enigma machine, didn’t remain an enigma for long and was broken in time. The advent of quantum computing may soon make our “unbreakable” codes go the way of the dinosaur. Prepare accordingly.

Article link: https://www.nextgov.com/ideas/2022/05/back-future-protecting-against-quantum-computing/367231/

Some worry that the chatter around these tools is doing the whole field a disservice.

By Melissa Heikkiläarchive page May 23, 2022

Earlier this month, DeepMind presented a new “generalist” AI model called Gato. The model can play the video game Atari, caption images, chat, and stack blocks with a real robot arm, the Alphabet-owned AI lab announced. All in all, Gato can do 604 different tasks. 

But while Gato is undeniably fascinating, in the week since its release some researchers have gotten a bit carried away.

One of DeepMind’s top researchers and a coauthor of the Gato paper, Nando de Freitas, couldn’t contain his excitement. “The game is over!” he tweeted, suggesting that there is now a clear path from Gato to artificial general intelligence, or ‘AGI’, a vague concept of human or superhuman-level AI. The way to build AGI, he claimed, is mostly a question of scale: making models such as Gato bigger and better. 

Unsurprisingly, de Freitas’s announcement triggered breathless press coverage that Deepmind is “on the verge” of human-level artificial intelligence. This is not the first time hype has outstripped reality. Other exciting new AI models, such as OpenAI’s text generator GPT-3 and image generator DALL-E, have generated a similar amount of grand claims. For many in the field, this kind of feverish discourse overshadows other important research areas in AI. 

That’s a shame because Gato is an interesting step in AI. Some models have started to mix different skills, like DALL-E, which generates images from text descriptions. Others use a single training technique to learn to recognise pictures and sentences. And DeepMind’s AlphaZero learned to play Go, chess and shogi. 

But here’s the crucial difference: AlphaZero could only learn one task at a time. After learning to play Go, it had to forget everything before learning to play chess, and so on. It could not learn to play both games at once. This is what Gato does: learns multiple different tasks at the same time, which means it can switch between them without having to forget one skill before learning another. It’s a small step but a significant one.

But Gato performs tasks worse than models that can only do one thing. Robots still need to learn “common sense knowledge” about how the world works from text, says Jacob Andreas, an assistant professor at MIT who specializes in artificial intelligence and natural language and speech processing.   

This could come in handy in robots that could help people around the house, for example. “When you drop [a robot] into a kitchen and ask them to make a cup of tea for the first time, they know what steps are involved in making a cup of tea and in which cabinet tea bags are likely to be located in,” says Andreas. 

Some external researchers were explicitly dismissive of de Freitas’ claim. “This is far from being ‘intelligent’,” says Gary Marcus, an AI researcher who has been critical of deep learning. The hype around Gato demonstrated that the field of AI is blighted by an unhelpful “triumphalist culture,” he says.

He argues that the deep learning models that often generate the most excitement about the potential to reach human-level intelligence make mistakes that “if a human made these errors, you’d be like, something’s wrong with this person,” Marcus says.

“Nature is trying to tell us something here, which is, this doesn’t really work, but the field is so believing its own press clippings, that it just can’t see that,” he adds. 

Even de Freitas’s DeepMind colleagues, Jackie Kay and Scott Reed, who worked with him on Gato, were more circumspect when I asked them directly about his claims. When asked about whether Gato was heading towards AGI, they wouldn’t be drawn. “I don’t actually think it’s really feasible to make predictions with these kinds of things. I try to avoid that. It’s like predicting the stock market,” said Kay.

Reed said the question was a difficult one. “I think most machine learning people will studiously avoid answering. Very hard to predict, but, you know, hopefully we get there someday.”

In a way, the fact that DeepMind called Gato a “generalist” might have made it a victim of the AI sector’s excessive hype around AGI. The AI systems of today are called “narrow” AI, meaning they can only do a specific, restricted set of tasks such as generate text.

Some technologists, including at Deepmind, think that one day humans will develop “broader” AI systems that will be able to function as well or even better than humans. Some call this artificial “general” intelligence. Others say it is like “belief in magic.“ Many top researchers, such as Meta’s chief AI scientist Yann LeCun questionwhether it is even possible at all.

Gato is a “generalist” in the sense that it can do many different things at the same time. But that is a world apart from a “general” AI that can meaningfully adapt to new tasks that are different from what the model was trained on, says MIT’s Andreas. “We’re still quite far from being able to do that.”

Making models bigger will also not address the issue that models don’t have “lifelong learning”, meaning they can be taught things once and they will understand all of the implications and use it to inform all of the other decisions that they are going to make, he says.

The hype around tools like Gato is harmful for the general development of AI, argues Emmanuel Kahembwe, an AI/robotics researcher and part of the Black in AI organization co-founded by Timnit Gebru. “There are many interesting topics that are left to the side, that are underfunded, that deserve more attention, but that’s not what the big tech companies and the bulk of researchers in such tech companies are interested in,” he says.

Tech companies ought to take a step back and take stock of why they are building what they are building, says Vilas Dhar, president of the Patrick J. McGovern Foundation, a charity that funds AI projects “for good.” 

“AGI speaks to something deeply human—the idea that we can become more than we are, by building tools that propel us to greatness,” he says. “And that’s really nice, except it also is a way to distract us from the fact that we have real problems that face us today that we should be trying to address using AI.”

Article link: https://www.technologyreview.com/2022/05/23/1052627/deepmind-gato-ai-model-hype/

By FRANK KONKELMAY 20, 2022

Federal cybersecurity has been on the Government Accountability Office’s High Risk list since 1997.

Defense Department IT systems were not fully compliant in any of four major cybersecurity requirement areas for controlled unclassified information systems as of January 2022, according to an audit released May 19 by the Government Accountability Office.

Controlled unclassified information, or CUI, is less sensitive than secret or top-secret classified information, but still contains data—like personally identifiable information or business practices—that could be detrimental if disclosed publicly. DOD mandates full cybersecurity requirement implementation for components, but implementation rates generally ranged from 70% to 90%.  DOD operates approximately 2,900 CUI systems across its enterprise.

“We analyzed DOD’s data and found that while the DOD components have taken actions to implement cybersecurity requirements for CUI systems, none of the components were fully compliant,” the audit states. “DOD requires 100% compliance.”

The audit examined implementation rates across four DOD CUI requirement areas. Implementation ranged from 70-79% for DOD’s Cybersecurity Maturity Model Certification program established in 2020, from 80-89% for categorizing DOD CUI systems accurately; from 80-89% for implementing 266 controls for moderate confidential impact systems, and 90% or more in authorizing systems to operate on DOD networks.

Auditors noted the DOD Office of the Chief Information Officer, the official responsible for department-wide cybersecurity of CUI systems, has taken action to address these areas. In October 2021, DOD OCIO issued a memo reiterating requirements CUI systems must meet, and included new requirements on supply chain security controls. The DOD OCIO issued a follow-up memorandum in March 2022 reminding officials to implement those controls.

Article link: https://www.nextgov.com/cybersecurity/2022/05/gao-defense-department-isnt-doing-enough-protect-sensitive-information/367220/

Elizabeth Montalbano

May 20, 2022 7:11 am

More than 380,000 of the 450,000-plus servers hosting the open-source container-orchestration engine for managing cloud deployments allow some form of access.

More than 380,000 Kubernetes API servers allow some kind of access to the public internet, making the popular open-source container-orchestration engine for managing cloud deployments an easy target and broad attack surface for threat actors, researchers have found.

The Shadowserver Foundation discovered the access when it scanned the internet for Kubernetes API servers, of which there are more than 450,000, according to a blog post published this week.

“ShadowServer is conducting daily scans of the IPv4 space on ports 443 and 6443, looking for IP addresses that respond with an ‘HTTP 200 OK status,’ which indicates that the request has succeeded,” according to the post.

Of the more than 450,000 Kubernetes API instances identified by Shadowserver, 381,645 responded with “200 OK,” researchers said. In all, Shadowserver found 454,729 Kubernetes API servers. The “open” API instances thus constitute nearly 84 percent of all instances that that Shadowserver scanned.

Moreover, most of the accessible Kubernetes servers—201,348, or nearly 53 percent–were found in the United States, according to the post.

While this response to the scan does not mean these servers are fully open or vulnerable to attacks, it does create a scenario in which the servers have an “unnecessarily exposed attack surface,” according to the post.

“This level of access was likely not intended,” researchers observed. The exposure also allows for information leakage on version and builds, they added.

Cloud Under Attack

The findings are troubling given that attackers already increasingly have been targeting Kubernetes cloud clusters as well as using them to launch other attacks against cloud services. Indeed, the cloud historically has suffered from rampant misconfiguration that continues to plague deployments, with Kubernetes being no exception.

In fact, Erfan Shadabi, cybersecurity expert with data-security firm comforte AG, said in an email to Threatpost that he was not surprised that the Shadowserver scan turned up so many Kubernetes servers exposed to the public internet.

“White [Kubernetes] provides massive benefits to enterprises for agile app delivery, there are a few characteristics that make it an ideal attack target for exploitation,” he said. “For instance, as a result of having many containers, Kubernetes has a large attack surface that could be exploited if not pre-emptively secured.”

Open-Source Security Exposed

The findings also raise the perennial issue of how to build security into open-source systems that become ubiquitous as part of modern internet and cloud-based infrastructure, making an attack on them an attack on the myriad systems to which they are connected.

This issue was highlighted all-too-unfortunately in the case of the Log4Shell vulnerability in the ubiquitous Java logging library Apache Log4j that was discovered last December.

The flaw, which is easily exploitable and can allow unauthenticated remote code execution (RCE) and complete server takeover–continues to be targeted by attackers. In fact,  a recent report finding millions of Java applications still vulnerable despite a patch being available for Log4Shell.

An Achilles heel in particular of Kubernetes is that the data-security capabilities built into the platform are only at a “bare minimum”–protecting data at rest and data in motion, Shadabi said. In a cloud environment, this is a dangerous prospect.

“There’s no persistent protection of data itself, for example using industry accepted techniques like field-level tokenization,” he observed. “So if an ecosystem is compromised, it’s only a matter of time before the sensitive data being processed by it succumbs to a more insidious attack.”

Shadabi’s advice to organizations that use containers and Kubernetes in their production environments is to take securing Kubernetes as seriously as they do all aspects of their IT infrastructure, he said.

For its part, Shadowserver recommended that if administrators find that a Kubernetes instance in their environment is accessible to the internet, they should consider implementing authorization for access or block at the firewall level to reduce the exposed attack surface.

Article link: https://threatpost.com/380k-kubernetes-api-servers-exposed-to-public-internet/179679/

The top U.S. military officer is challenging the next generation of Army soldiers to prepare America’s military to fight future wars that may look little like the wars of today

By

LOLITA C. BALDOR Associated Press May 21, 2022,

WASHINGTON — The top U.S. military officer challenged the next generation of Army soldiers on Saturday to prepare America’s military to fight future wars that may look little like the wars of today.

Army Gen. Mark Milley, chairman of the Joint Chiefs of Staff, painted a grim picture of a world that is becoming more unstable, with great powers intent on changing the global order. He told graduating cadets at the U.S. Military Academy at West Point that they will bear the responsibility to make sure America is ready.

“The world you are being commissioned into has the potential for significant international conflict between great powers. And that potential is increasing, not decreasing,” Milley told the cadets. “Whatever overmatch we, the United States, enjoyed militarily for the last 70 years is closing quickly, and the United States will be, in fact, we already are challenged in every domain of warfare, space, cyber, maritime, air, and of course land.”

America, he said, is no longer the unchallenged global power. Instead, it is being tested in Europe by Russian aggression, in Asia by China’s dramatic economic and military growth as well as North Korea’s nuclear and missile threats, and in the Middle East and Africa by instability from terrorists.

Drawing a parallel with what military officials are seeing in Russia’s war on Ukraine, Milley said future warfare will be highly complex, with elusive enemies and urban warfare that requires long-range precision weapons, and new advanced technologies.

The U.S. has already been rushing new, high-tech drones and other weapons to the Ukrainian military — in some cases equipment that was just in the early prototype phases. Weapons such as the shoulder-launched kamikaze Switchblade drones are being used against the Russians, even as they are still evolving.

And as the war in Ukraine has shifted — from Russia’s unsuccessful battle to take Kyiv to a gritty urban battle for towns in the eastern Donbas region — so has the need for different types of weapons. Early weeks focused on long-range precision weapons such as Stinger and Javelin missiles, but now the emphasis is on artillery, and increased shipments of howitzers.

And over the next 25 to 30 years, the fundamental character of war and its weapons will continue to change.

The U.S. military, Milley said, can’t cling to concepts and weapons of old, but must urgently modernize and develop the force and equipment that can deter or, if needed, win in a global conflict. And the graduating officers, he said, will have to change the way U.S. forces think, train and fight.

As the Army’s leaders of tomorrow, Milley said, the newly minted 2nd lieutenants will be fighting with robotic tanks, ships and airplanes, and relying on artificial intelligence, synthetic fuels, 3-D manufacturing and human engineering.https://d-12636358614034929289.ampproject.net/2205051832000/frame.html

“It will be your generation that will carry the burden and shoulder the responsibility to maintain the peace, to contain and to prevent the outbreak of great power war,” he said.

In stark terms, Milley described what failing to prevent wars between great powers looks like.

“Consider for a moment that 26,000 — 26,000 — soldiers and Marines were killed in only six weeks from October to November of 1918 in the Battle of the Meuse-Argonne in World War I,” Milley said. “Consider also that 26,000 U.S. troops were killed in the eight weeks in the summer of 1944 from the beaches of Normandy to the liberation of Paris.”

Recalling the 58,000 Americans killed in just the summer of 1944 as World War II raged, he added, “That is the human cost of great-power war. The butcher’s bill.”

Thinking back to his own graduation, Milley paraphrased a popular Bob Dylan song from the time: “we can feel the light breeze in the air. And right now as we sit here on the plain at West Point, we can see the storm flags fluttering in the wind. We can hear in the distance the loud clap of thunder. The hard rain is about to fall.”

Article link: https://abcnews-go-com.cdn.ampproject.org/c/s/abcnews.go.com/amp/Politics/wireStory/milley-west-point-cadets-ready-robot-drone-led-84879006

The Defense Department released guidance for using AI responsibly last year.

LAUREN C. WILLIAMS | MAY 18, 2022

The Defense Department is still finalizing an implementation plan for its artificial intelligence ethical principles, according to Jane Pinelis, the chief of AI assurance for the Defense Department’s Joint Artificial Intelligence Center, said at an event on Tuesday. 

“So we are the first military to adopt the ethical principles for AI. Since then, multiple other nations have done so, and where we stand now with [chief digital and artificial intelligence office] is we’re trying to move into implementation,” Pinelis said during a panel discussion at the Atlantic Council on May 17.  

“So we have the five ethical principles at this point. We have [gotten] direction from the deputy secretary to advance them across six different tenets. But now we’re moving into … implementation.”

The Defense Department releasedguidance for using AI responsibly in May 2021 after announcing a set of ethical principles the year before.  

Pinelis said the implementation plan, which is awaiting the deputy defense secretary’s signature, would be a “formal pathway forward” that tasks “various organizations in the Department of Defense with very specific actions as far as actually putting these principles into practice.”

Many of those tasks, she continued, overlap with testing and evaluation but there are many pieces that require everyone across DOD to take some responsibility.

“Responsible AI is, kind of, everybody’s job in the department,” Pinelis said. “And so there are pieces of it that have to do with international allies. There are pieces of it that have to do with responsibly acquiring these systems and responsibly developing these systems, and kind of again, crafting all of those arguments and evidence that go into responsible AI.”

Michael Horowitz, the Defense Department’s director of emerging capabilities policy, said faster implementation of artificial intelligence and autonomous technology solutions requires budget support and centralized leadership – both of which the Pentagon is working to address with the standing up of its chief digital and artificial intelligence office. 

“If data is the fuel that makes AI go essentially – what is an algorithm without the data that you would use to train it in one way or another – then bringing those together under the [chief digital and artificial intelligence office] construct, I think will be reflected in what a new strategy will likely look like as well,” Horowitz said during a keynote panel at the event. “What’s necessary now is to turn those thoughts into reality and to do it faster.” 

Horowitz, who has been in the brand new role for about a month, said he was “pretty optimistic” about the Pentagon’s direction and emphasis on AI and autonomy thanks to the creation of the emerging capabilities policy office, the CDAO, and innovation steering group that the undersecretary of defense for research and engineering. 

“I think all of those things make me optimistic that, as we enter the sort of FY ’24 budget cycle, that we’re going to start seeing that payoff as the department becomes — it’s not a question of just more, but smarter at thinking about AI and autonomous systems and investments in a way that really pays off for the joint force.”

Article link: https://www.defenseone.com/policy/2022/05/pentagon-closing-ethical-ai-implementation/367120/