healthcarereimagined

MARCH 3, 2022 |BY DAVID VERGUN, DOD NEWS

The Defense Department’s industrial base is huge, encompassing some 220,000 companies. With criminals and nefarious state actors intent on stealing intellectual property or taking down networks, cybersecurity is a huge concern for the department, the companies and national security. 

As a result, the department is bolstering defense industrial base cybersecurity by sharing threat information, offering easy-to-implement ways the industrial base can shore up its own cyber defenses, and looking for ways to make further improvements as the threat continues to evolve, according to a DOD panel that spoke during a recent town hall. 

“I think we’ve thwarted a good number of attacks by our intelligence sharing and your sharing of information about things going on in your network,” said David McKeown, DOD’s chief information security officer and deputy chief information officer for cybersecurity. 

Spotlight: Science & Tech

In addition to intelligence sharing, the department requires industrial base companies to achieve Cybersecurity Maturity Model Certification, which sets the minimum cybersecurity requirements for companies, he said, noting that the department has been working to streamline those requirements to make it easier for companies to comply. 

He also said the department wants companies to review the National Institute of Standards and Technology’s special publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.”‘

A third requirement, he said, is that if there’s a major cybersecurity breech, it must be reported within 72 hours to the DOD Cyber Crime Center. The center’s hotline is 410-981-0104 or 877-838-2174, and the website is https://dibnet.dod.mil.  

“We would love to see you go beyond those requirements,” McKeown said. 

An excellent place to start is by visiting https://dibnet.dod.mil, which is DOD’s gateway for defense contractor reporting and voluntary participation in DOD’s Defense Industrial Base Cybersecurity Program, he said. 

On that site, companies can report a cyber incident, as well as become a DOD voluntary public-private cybersecurity partner, he said. The site also has points of contact for anyone having questions or needing additional information. 

DOD Partnerships 

The defense industrial base is one of 16 critical infrastructure sectors, identified in the presidential policy directive “Critical Infrastructure Security and Resilience”, said Kristi Hunt in the office of the undersecretary of defense for policy. 

That document spells out the policy for how the federal government will work to build trust with those sectors, how those sectors will work with other sectors, and how the whole effort for public-private partnership will advance national unity of effort to strengthen and maintain secure functioning and resilient critical infrastructure, she said. 

Hunt said her agency works closely with the Department of Homeland Security and the Office of the Director of National Intelligence, sharing mitigation strategies, threat indicators, critical incidents and best practices. 

Kristina Walter, chief of defense industrial base cyber defense at the National Security Agency, said, “NSA has great insight into foreign actors targeting DOD Information on DOD networks, national security system as well as defense industrial base networks.” 

However, the NSA must rely on industry partners to mitigate cybersecurity threats, she said. 

“You are experts in your networks. We understand what foreign actors are doing, and when we work together, we can understand more rapidly what’s happening and address the issue,” she said. 

The NSA, in partnership with the FBI, has set up a collaboration channel to get out as much information before an incident occurs, she said. More information can be found at https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/.

Krystal Covey, director of DOD’s Defense Industrial Base Collaborative Information Sharing Environment, said the Defense Cybercrime Center hosts cybersecurity conferences and performs malware analysis, publishes cyber threat analyses, and shares actionable cybersecurity incidents. 

Covey said that although only cleared defense contractors are covered by Code of Federal Regulations, Title 32, Part 236, there is work within the department to incorporate other companies into this program.

Article link: https://www.defense.gov/News/News-Stories/Article/Article/2953204/dod-working-to-improve-cybersecurity-for-its-industrial-base/

For More Information 

DOD Focused on Protecting the Defense Industrial Base From Cyber Threats 

Link to Town Hall video on DVIDS 

Link to DOD CIO slides on DOD CIO library

FORT MEADE, Md. — The National Security Agency (NSA) released the “Network Infrastructure Security Guidance” Cybersecurity Technical Report today. The report captures best practices based on the depth and breadth of experience in supporting customers and responding to threats.

Network environments are dynamic and evolve as new technologies, exploits, and defenses affect them. While compromise occurs and is a risk to all networks, network administrators can greatly reduce the risk of incidents as well as reduce the potential impact in the event of a compromise. This guidance focuses on the design and configurations that protect against common vulnerabilities and weaknesses on existing networks.

Recommendations include perimeter and internal network defenses to improve monitoring and access controls throughout the network.

Existing networks likely have some or most of the recommended configurations and devices noted, so administrators can use the report to help prioritize next steps in continuing to harden their network against cyber threats.

Read the full technical report here.

Visit our full library for more cybersecurity information and technical guidance.

Related Press Advisories

NSA Publishes Best Practices for Selecting Cisco Password Types

NSA, FBI, CISA Release Advisory on Protecting Cleared Defense Contractor Networks Against Years-Long Activity by Russian State-Sponsored Actors

CISA, FBI, NSA and International Partners Issue Advisory on Ransomware Trends from 2021 

cybersecurity Cybersecurity GuidanceCybersecurity Technical Reportnetwork infrastructure architecture security wired network securityendpoint security

Article link: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2949885/nsa-details-network-infrastructure-best-practices/

March 4, 2022 | By Greg Hadley

The Defense Department needs to upgrade its IT, add more software specialists, and empower certain programs to be more innovative—especially when it comes to artificial intelligence, the former CEO of Google said March 3.

Eric Schmidt, who led Google and its parent company Alphabet from 2001 to 2015 and chaired the Defense Innovation Advisory Board, delivered a keynote address at the AFA Warfare Symposium in Orlando, Fla., offering what he called several “blunt” criticisms and recommendations for the Pentagon.

“In the tradition of the military, I will be direct and I hope that’s OK,” Schmidt told an audience of Airmen, Guardians, and industry leaders. “If I look at the totality of what you’re doing, you’re doing a very good job of making things that you currently have better, over and over and over again. But I’m an innovator. And I would criticize, if I could say right up front, that the current structure, which is an interlock between the White House, the Congress, the Secretary of Defense’s , the various military contractors, the various services, and so forth, is a bureaucracy in and of its own. And it’s doing a good job at what it has been asked to do, but it hasn’t been asked to do some new things.”

Schmidt did note one exception to that criticism—the B-21 Raider program. Praising the Rapid Capabilities Office, Schmidt said the Air Force developed the new stealth bomber in a “new and innovative” way. 

The challenge now is to take that approach and apply it to programs across the DOD, Schmidt said, especially to non-hardware platforms.

“Every time you try to do something in software, one of these strange scavenging groups within the administration takes your money away. It’s insane,” Schmidt said. “The core issue here in the military is you don’t have enough software people. And by software people, I mean people who think the way I do. You come out of a different background, and you just don’t have enough of these people. 

“These are hard people to manage. They’re often very obnoxious—sorry, welcome to my field. They’re difficult. They’re sort of full of things, but they can change the world, and a small team can increase your productivity of whatever you’re doing.”

This issue is particularly glaring when it comes to artificial intelligence (AI), Schmidt said. And not only does the military lack the necessary personnel, the defense industrial base does too. Touring the symposium’s exhibition hall, Schmidt said he only saw “like two AI companies, … and by the way, they’re the little ones in the corner.”

Just like the B-21 program has been innovative, there are some examples of good software development, Schmidt said, pointing to Project Maven, a DOD AI project that ignitedcontroversy among Google employees, but which Schmidt said has had “very successful classified use in the right ways.”

But Project Maven was just one project, and “to be very blunt, you don’t have enough people, you don’t have the right contractors, and you don’t have the right strategy to fill in this,” Schmidt said of the Pentagon’s work in AI. “We need 20, 30, 40 such groups—more, more, more. And as that transformation happens, the people who work for you, the incredibly courageous people, will have so much more powerful tools.”

Schmidt’s intense enthusiasm for artificial intelligence is born out of his belief that “AI is a force multiplier like you’ve never seen before,” he said. “It sees patterns that no human can see. And all interesting future military decisions will have as part of that an AI assistant.”

Schmidt is hardly alone in predicting AI will have a seismic impact on warfare. But advocates say they’ve also encountered resistance and inertia within the Pentagon.

Such doubts are preventing the U.S. military from fully embracing AI’s possibilities and forcing service members to “spend all day looking at screens doing something that a computer should do.”

Potential uses include precision weapons targeting, precision analysis, and autonomous systems, Schmidt said. But to get there, there’s something the Pentagon has to do first.

“The real problem you have is that you don’t have enough bandwidth, … which no one ever tells you this,” Schmidt said. “Your networks, excuse the term, suck. You’ve got to get the networks upgraded. You just have to, because all of these things depend on that kind of connectivity, right?”

Schmidt’s comments were met with applause from his audience—the issue of poor network connectivity and IT systems is a constant source of frustration among Airmen and Guardians.

Yet despite all this, perhaps the biggest issue facing the Air Force’s software and AI efforts isn’t really about software.

“We love to talk about strategy, and we need more money over here, and by the way we do, and we need more partnerships over here, and yes we do, and we need more of this over here, and every state has to have its money and all of that’s fine,” Schmidt said. “But what we don’t have and we need a lot more of is the kind of talent to drive this world.”

To attract and retain talent, Schmidt said, the military needs to empower innovators instead of holding them back, granting them a certain level of autonomy to make decisions and take risks. In that regard, his comments echo ones made by Chief of Staff Gen. Charles Q. Brown Jr., who has made empowering Airmen one of the key themes and goals of his tenure.

Article link: https://www.airforcemag.com/former-google-ceo-ai-force-multiplier-pentagon/

MARCH 3, 2022 |BY C. TODD LOPEZ, DOD NEWS

Earlier this year, the Defense Department’s chief technology officer, Heidi Shyu, released a list of 14 technology areas deemed most critical for investment, including biotechnology, advanced materials, trusted artificial intelligence and microelectronics.

A handful of products related to those focus areas — such as hypersonics and directed energy weapons — are almost exclusively military-related, but the majority are already being developed for the commercial market by private companies that may not have done business with the federal government. Those innovations include next-generation wireless communications, microelectronics, and human-machine interfaces. 

For DOD to have its needs addressed by the private sector with or without DOD involvement, the department will need to do a better job of engaging with those companies. 

Spotlight: Engineering in the DOD

DOD’s Defense Innovation Unit is one segment of the government already on board with locating companies involved in the development of critical technologies and helping them become suppliers. 

“We’re really trying to look at what all of the innovative companies are doing around the country … because most of what we need to do to modernize the Defense Department is led by industry now; it’s commercial technologies,” Mike Brown, director of the DIU, said during a discussion Wednesday at George Mason University’s Center for Government Contracting in Northern Virginia. 

“We have to be harnessing what the private industry is doing if we’re going to be giving our warfighters the capability that they need,” Brown said. 

DIU, Brown said, has been working to accelerate adoption of commercial technology using “other transaction authority,” which is different from classic procurement contracts and is instead used for things like research or prototyping. 

The approach DIU uses is called “commercial solutions open,” and Brown said this includes things like agile work statements, modular contracts and working at commercial speeds. 

“We don’t start with requirements, which often dictates how the department might start to bring in a new capability — a process that’s well-honed if you’re going to build a new aircraft or tank,” Brown said. “If you’re going to look at commercial technology, you don’t need to start with requirements. The commercial market has already built that.” 

When DIU was looking at counterdrone technologies, Brown said, it didn’t need to specify requirements because the commercial market had already developed things DOD could use. 

With modular contracts, he said, comes the flexibility to bring in different vendors and have them work together and go from a successful prototyping effort directly into production. 

Finally, modular contracts can limit the challenging requirements for intellectual property that might delay the transition of a capability from the private sector into warfighter hands, he said. 

“We’re trying to get companies on contract in 60 to 90 days, in commercial terms — that means no onerous IP [intellectual property] requirements for companies that we work with,” Brown said. 

Budgeting is also an issue, Brown said. Traditional budgeting requires planning as much as two years in advance before dollars can be spent. 

“That’s not the agile process we need to compete with China in technology,” he said. “We need to be able to move not the whole $750 billion defense budget, but we need some flexibility at the edges to respond to emerging threats and plug in new commercial technology solutions that address those threats. 

The Commission on Planning, Programming, Budgeting, and Execution Reform, as directed in the 2022 National Defense Authorization Act, is looking now at better solutions to budgeting so that the department can be more agile in the technology it procures. That’s something Brown said he’s glad to see.

Article link: https://www.defense.gov/News/News-Stories/Article/Article/2953893/addressing-dods-tech-focus-areas-requires-new-approaches/

March 02, 2022

Contributor: David Furlonger and Christophe Uzureau

Blockchain is already building trusted digital environments, and one day, it will underpin Web3 and the Metaverse. Don’t get left behind.

In short: 

• Blockchain enables two or more people, businesses or computers that may or may not know each other to exchange value in digital environments — in a monetary transaction, information or other exchange of assets — without an intermediary.
• Blockchains are a form of distributed (digital) ledger. Complete blockchains combine five design elements to authenticate users, validate transactions and record information to the ledger in a way that can’t be corrupted or changed later. It thus eliminates the need for a central administrator.
• Blockchain solutions today are continuing to mature, e.g. in terms of scalability, but will ultimately underpin new social and economic models.

Have you bought a house lately? Imagine if you could have transacted with the seller directly, even though you had never met, confident that the deal would be recorded in a way that neither of you could change or rescind later. You wouldn’t have to reconcile rafts of personal information with a real-estate agent, mortgage broker, insurance agent, property inspector and title company. Enter blockchain: A way to directly and securely connect and record value chain interactions.

Albeit this is just a scenario for records management inspired by blockchain. Once further developed, however, blockchain technology will be able to layer on the intelligent decision-making ability of artificial intelligence (AI) and the sensory powers of the Internet of Things (IoT) to create whole new social and economic constructs in the peer-to-peer age of Web3 and the Metaverse. 

But let’s not get ahead of ourselves.

Read book excerpt: The Real Business of Blockchain

What is blockchain?

Blockchain combines existing technologies and techniques including distributed digital ledgers, encryption, immutable records management, asset tokenization and decentralized governance to capture and record information that participants in a network need to interact and transact. There are no intermediaries, like banks, validating and protecting the transactions.

While the recorded event could be a monetary transaction, it could also be an exchange of information, such as metadata attached to records like medical history, personal identity and supply chain logistics. In a blockchain-enabled future, your government ID won’t be floating around dozens of databases without your knowledge. 

Its component technologies enable the blockchain to:

• Confirm the pseudonymous identity of the participants 
• Validate that the participants own the information/assets they want to exchange 
• Authenticate and approve that the transaction can occur
• Record the transaction information to the ledger, a copy of which is independently updated and held by each node on the network. 

In this digital environment, records are unalterable, time-stamped, encrypted and linked to each other in blocks, where each block is a cluster for Bitcoin of roughly 1,500 transaction records (other ledgers vary in block size). The ledger grows as participants transact, and roughly seven transactions are processed every second (for Bitcoin; other ledgers vary in throughput scale). 

The business potential of blockchain 

The potential impact of blockchain on business is massive. Imagine all the deals your firm won’t or can’t do today because you don’t know who is on the other end of the transaction and can’t be certain they own the assets they want to trade. 

For millions of potential trading partners, asset types and transactions, that uncertainty will cease to matter. The blockchain will identify participants, ensure all elements of a transaction are valid, enforce the ecosystem rules and guarantee everyone holds to them. 

Gone will be the slow, expensive, analog-based methods we have relied on to establish identity and legal status in commercial transactions since the 19th century.

Equally important is blockchain’s ability to enable faster and more diverse transactions — in both type and size — than is possible with traditional centralized systems.

For generations, businesses have relied on centralized infrastructures, such as payment systems, insurance, delivery and logistics services, and governments, to execute commercial transactions and manage risk. But these systems weren’t designed to handle the complexity, size and scale of the machine-to-machine transactions made possible by digital platforms. 

Single units of data, digital business assets such as cryptocurrency, reward points or pieces of an asset are (or soon will be) tradable over digital networks as part of the programmable economy. Units worth less than $0.01 can be traded by the millions or trillions. Current payment systems can’t cost-effectively and securely process transactions below a certain value nor can they handle the volume possible today.

Businesses need a different way to deal with new digital assets and interactions without involving an intermediary that collects data on every party and takes a cut of the value. Blockchain promises a solution.

How blockchain works

Blockchains are a specific type of create, write and read-only distributed ledger. Not all distributed ledgers are blockchains, but all blockchains are distributed ledgers. 

Complete blockchains combine five design elements to authenticate users, validate transactions and record that information in a way that can’t be corrupted by a single participant or changed after the fact. They also enable the adoption of decentralized ecosystem governance and deployment of programmable capabilities, including the creation and use of digital business assets or new forms of money.

While complete blockchain solutions do exist, many of today’s enterprise initiatives only include some of the elements — distribution, encryption and immutability. Often missing are tokenization to exchange value, and decentralization to enable consensus-driven governance. 

These incomplete or “blockchain inspired” solutions can still add value by digitalizing manual processes, such as real-estate purchases, or by enabling more efficient information exchange in multiparty transactions, such as insurance claims. But without all five elements, their value is limited in terms of new revenue growth. 

Five key elements of blockchain

A complete blockchain incorporates all five elements:

• Distribution. Blockchain participants, connected on a distributed network, operate nodes (computers) that run a program to enforce the business rules of the blockchain. Nodes also keep a full copy of the ledger, which updates independently when new transactions occur.
• Encryption. Blockchain uses technologies such as public and private keys to record data securely and semi-anonymously. During the process of creating a Bitcoin wallet, for example, the blockchain generates an address for the participant that is visible to all network participants but provides pseudonymity.
• Immutability. Completed transactions are cryptographically signed, time-stamped and sequentially added to the ledger. Records can’t be changed unless all participants agree to do so. Such an agreement is known as a fork. 
• Tokenization. Value is exchanged in the form of tokens, which can represent a wide variety of asset types, including monetary assets, units of data or user identities. Token use can be programmed via smart contracts. Tokenization, or the creation of tokens, is the way a blockchain represents and enables trade via digital business assets.
• Decentralization. No single entity controls a majority of the nodes or dictates the rules. A consensus mechanism verifies and approves transactions, eliminating the need for a central intermediary to govern the network. Decentralization — and its inverse, centralization — comprises three core elements: technology, economics and decision making. Each can be adjusted to vary the manner in which governance is applied to the ecosystem.

Executives: Don’t ignore blockchain

Blockchain has already started to revolutionize ways of doing business, but even CIOs aren’t totally on board, let alone the rest of the executive leadership team. Gartner research shows that from 2016 to 2021, on average, 45% of CIOs said their organization had no interest in blockchain. 

Startups and leading digital enterprises are nevertheless deploying blockchain to solve problems and create value that conventional, centralized technologies and processes can’t. The cryptocurrency market is now worth around $2 trillion, and nation states and public and private companies own nearly $30 billion of Bitcoin alone.

Large companies in fashion, sports, consumer packaged goods, music and gaming are using nonfungible tokens (NFTs) to bridge online and offline worlds, especially in the Metaverse as a way to enhance their brands and engage more effectively with digital customers. In the supply chain space, FoodTrust now has over 300 members. In shipping, TradeLens is processing over 700 million events and 6 million documents per year. In financial services, the Depository Trust & Clearing Corporation (DTCC) plans to launch its Project ION stock settlement solution in 1Q 2022.

Blockchain is clearly heading out of the Gartner Hype Cycle’s Trough of Disillusionment, and now is the time to act. CIOs should alert and educate their board of directors, CEO and fellow business leaders about the fact that enterprises must accelerate blockchain initiatives as part of the enterprise digital transformation, or risk falling so far behind that they permanently lose a competitive edge.

Article link: https://www.gartner.com/en/articles/what-is-blockchain?

By Jerry McGinn

Mar 2, 09:35 AM

Under Secretary of Defense for Research and Engineering Heidi Shyu recently outlined the Pentagon’s critical technology areas. Not surprisingly, 11 of the 14 are heavily commercial areas such as biotechnology, artificial intelligence, quantum science and advanced materials.

The Department of Defense’s increased engagement with commercial companies in recent years clearly demonstrates the critical role these and other technologies will play in future military systems. Unfortunately, DoD has struggled to adopt commercial technology at scale, in large part due to its industrial-age acquisition practices.

Defense Secretary Lloyd Austin acknowledged this in his remarks at December’s Reagan National Defense Forum when he noted the department “has to do better” at helping innovative companies cross the valley of death from “inception to prototype to adoption.”

Indeed, DoD must do better. To ensure strategic advantage against adversaries like Russia and China, the Pentagon needs an acquisition system that innovates, iterates and scales to develop and field effective military capabilities. This is true for commercial or dual-use technologies, but it’s also critical for the major defense programs that use software and advanced technologies to create the next generation of ships, vehicles and aircraft.

Getting to this objective end state requires first and foremost a change in mindset, a paradigm shift. At the Center for Government Contracting, we call this mindset Acquisition Next.

Defense acquisition today is optimized for the assembly lines of the industrial age, developing programs to build platforms and acquire services based on precisely designed military-specific requirements. Meanwhile, the broader economic system has entered the digital age.

Modern engineering and business practices have dramatically accelerated the product development cycle. Commodity production has been replaced by software, data and product design — intangible capital that requires knowledge labor. For example, in 1970, most of the value of a newspaper was in the paper, ink and printing equipment. By the 1990s, the news moved online, but firms still had to own servers. By the 2010s, almost the entire tech stack was virtualized. The largest and most innovative firms today are software natives.

For the Department of Defense to keep pace, it needs to adopt approaches based on modularity and iteration as opposed to linearity and prediction. We looked for this approach in a year-long study of real-world programs. Interviews with more than 75 government and industry professionals from a variety of backgrounds offered evidence that a paradigm shift is already underway.

Importantly, we focused on practices that can be undertaken today and do not require any changes in authority and regulations. Congress has given DoD numerous new and expanded authorities in recent years and DoD has been actively pursuing innovative approaches through initiatives such as the Adaptive Acquisition Framework. Moreover, there is actually a tremendous amount of flexibility in the much-maligned Federal Acquisition Regulation.

Our final report suggests a way to implement the Acquisition Next mindset through a series of “plays” or leading practices in defense acquisition programs. The first three apply at the total program level:

• Requirements. Focus on short statements of outcomes to increase flexibility in solution design and create a stakeholder process for requirements iteration over time.
• Market research. Develop an organizational capability for continuously engaging with industry to identify technologies and vendors that can increase program value.
• Master the baseline. Determine which system elements are technically separable and pursue traditional contracting approaches for technologies with slower cycle times while faster moving applications receive modular contracts.

These practices enable the second group of three plays, which are suited to contracts with software intensive content:

• Agile work statements. Separate technical direction from contract requirements and use a living roadmap adjusted to the product backlog and user feedback.
• Modular Contracts. Start with broad and flexible solicitations, then transition to multiple-award contract vehicles with recurring task orders and streamlined procedures.
• ·Intellectual Property. Rather than focus on specific standards, influence a microservices architecture with rights to interfaces and operational data.

Taking an Acquisition Next approach can help government programs become leaders in innovation again.

Many of these practices are being used in programs today, but widespread adoption will help drive culture change across the acquisition community. All that’s required is top cover from leadership and support up and down the chain of command.

While there is a need for structural reform in defense budgeting, our playbook demonstrates the flexibility in today’s authorities and regulations. To accelerate the next generation of military capabilities, we need to adopt an Acquisition Next mindset focused on modularity, speed, iteration, competition. Let’s get rolling.

Article link: https://www.defensenews.com/opinion/commentary/2022/03/02/you-dont-need-to-rewrite-acquisition-regulations-to-improve-dod-buying/

Jerry McGinn is executive director of the Center for Government Contracting in George Mason’s School of Business and a former senior DoD acquisition official.

Three key ways artificial intelligence is changing what it means to compute.

by Will Douglas Heaven

October 22, 2021

Fall 2021: the season of pumpkins, pecan pies, and peachy new phones. Every year, right on cue, Apple, Samsung, Google, and others drop their latest releases. These fixtures in the consumer tech calendar no longer inspire the surprise and wonder of those heady early days. But behind all the marketing glitz, there’s something remarkable going on. 

Google’s latest offering, the Pixel 6, is the first phone to have a separate chip dedicated to AI that sits alongside its standard processor. And the chip that runs the iPhone has for the last couple of years contained what Apple calls a “neural engine,” also dedicated to AI. Both chips are better suited to the types of computations involved in training and running machine-learning models on our devices, such as the AI that powers your camera. Almost without our noticing, AI has become part of our day-to-day lives. And it’s changing how we think about computing.

What does that mean? Well, computers haven’t changed much in 40 or 50 years. They’re smaller and faster, but they’re still boxes with processors that run instructions from humans. AI changes that on at least three fronts: how computers are made, how they’re programmed, and how they’re used. Ultimately, it will change what they are for. 

“The core of computing is changing from number-crunching to decision-making,” says Pradeep Dubey, director of the parallel computing lab at Intel. Or, as MIT CSAIL director Daniela Rus puts it, AI is freeing computers from their boxes. 

More haste, less speed

The first change concerns how computers—and the chips that control them—are made. Traditional computing gains came as machines got faster at carrying out one calculation after another. For decades the world benefited from chip speed-ups that came with metronomic regularity as chipmakers kept up with Moore’s Law. 

But the deep-learning models that make current AI applications work require a different approach: they need vast numbers of less precise calculations to be carried out all at the same time. That means a new type of chip is required: one that can move data around as quickly as possible, making sure it’s available when and where it’s needed. When deep learning exploded onto the scene a decade or so ago, there were already specialty computer chips available that were pretty good at this: graphics processing units, or GPUs, which were designed to display an entire screenful of pixels dozens of times a second. 

Anything can become a computer. Indeed, most household objects, from toothbrushes to light switches to doorbells, already come in a smart version.

Now chipmakers like Intel and Arm and Nvidia, which supplied many of the first GPUs, are pivoting to make hardware tailored specifically for AI. Google and Facebook are also forcing their way into this industry for the first time, in a race to find an AI edge through hardware. 

For example, the chip inside the Pixel 6 is a new mobile version of Google’s tensor processing unit, or TPU. Unlike traditional chips, which are geared toward ultrafast, precise calculations, TPUs are designed for the high-volume but low-precision calculations required by neural networks. Google has used these chips in-house since 2015: they process people’s photos and natural-language search queries. Google’s sister company DeepMind uses them to train its AIs. 

In the last couple of years, Google has made TPUs available to other companies, and these chips—as well as similar ones being developed by others—are becoming the default inside the world’s data centers.

AI is even helping to design its own computing infrastructure. In 2020, Google used a reinforcement-learning algorithm—a type of AI that learns how to solve a task through trial and error—to design the layout of a new TPU. The AI eventually came up with strange new designs that no human would think of—but they worked. This kind of AI could one day develop better, more efficient chips. 

Show, don’t tell

The second change concerns how computers are told what to do. For the past 40 years we have been programming computers; for the next 40 we will be training them, says Chris Bishop, head of Microsoft Research in the UK. 

Traditionally, to get a computer to do something like recognize speech or identify objects in an image, programmers first had to come up with rules for the computer.

With machine learning, programmers no longer write rules. Instead, they create a neural network that learns those rules for itself. It’s a fundamentally different way of thinking. 

Examples of this are already commonplace: speech recognition and image identification are now standard features on smartphones. Other examples made headlines, as when AlphaZero taught itself to play Go better than humans. Similarly, AlphaFold cracked open a biology problem—working out how proteins fold—that people had struggled with for decades. 

For Bishop, the next big breakthroughs are going to come in molecular simulation: training computers to manipulate the properties of matter, potentially making world-changing leaps in energy usage, food production, manufacturing, and medicine. 

Breathless promises like this are made often. It is also true that deep learning has a track record of surprising us. Two of the biggest leaps of this kind so far—getting computers to behave as if they understand language and to recognize what is in an image—are already changing how we use them.

Computer knows best

For decades, getting a computer to do something meant typing in a command, or at least clicking a button.

Machines no longer need a keyboard or screen for humans to interact with. Anything can become a computer. Indeed, most household objects, from toothbrushes to light switches to doorbells, already come in a smart version. But as they proliferate, we are going to want to spend less time telling them what to do. They should be able to work out what we need without being told.

This is the shift from number-crunching to decision-making that Dubey sees as defining the new era of computing.  

Rus wants us to embrace the cognitive and physical support on offer. She imagines computers that tell us things we need to know when we need to know them and intervene when we need a hand. “When I was a kid, one of my favorite movie [scenes] in the whole world was ‘The Sorcerer’s Apprentice,’” says Rus. “You know how Mickey summons the broom to help him tidy up? We won’t need magic to make that happen.”

We know how that scene ends. Mickey loses control of the broom and makes a big mess. Now that machines are interacting with people and integrating into the chaos of the wider world, everything becomes more uncertain. The computers are out of their boxes.

Article link: https://www-technologyreview-com.cdn.ampproject.org/c/s/www.technologyreview.com/2021/10/22/1037179/ai-reinventing-computers/amp/

Our Next Cyber Talk is on operations and intelligence analysis methods involving searches and analytics performed on external datasets can be very revealing. This exposure includes not only attribution (who is performing it), but also the content of the operation itself (what is being searched for), which may include sensitive information that would be extremely damaging to national security if exposed. Recent advances in an increasingly visible technology category known as Privacy Enhancing Technologies (PETs) are changing the paradigm of secure data usage by allowing sensitive indicators to be securely processed while remaining in the untrusted domain, extending the boundaries of trusted compute.
PETs are transformative because the mission-enabling capabilities they deliver are not making something better; they are making something entirely new possible. Users can encrypt the content of their search, analytic, or machine learning model, ensuring their interests and intents remain secure and private throughout the processing lifecycle. This allows U.S. Government organizations to leverage publicly available, open-source, and/or low-side, government-curated data sources in ways that were never before possible.

Event link: https://www.linkedin.com/events/https-www-zoomgov-com-j-16124336904437132174467072/

Kyle Atwell and Daphne McCurdy | 12.04.22

What role do private military companies (PMCs) such as Russia’s Wagner Group play on the modern battlefield? How should US policymakers and US and allied troops in conflict zones manage threats from armed groups when Russia denies their existence? Is war by private armies a rising trend in modern conflict?

Our two guests argue that the Wagner Group plays an important role in Russian military strategy. Russia’s use of PMCs has implications both operationally for US troops on the ground, as well as for US foreign policy more broadly. We discuss at length a February 2018 incident in which the Wagner Group and Syrian partner forces engaged in a multi-hour firefight with US special operations forces in Syria, allegedly resulting in hundreds killed on the Russian/Syrian side.

The conversation concludes with recommendations for both policymakers and practitioners on how to address Russia’s use of plausible deniability and PMCs. The answer is made more pressing by the expanded use of PMCs in combat arms and kinetic roles not just by Russia but other countries, in places such as Nagorno-Karabakh, Libya, and beyond.

Dr. Robert Hamilton is an associate professor of Eurasian studies at the US Army War College and a Black Sea fellow at the Foreign Policy Research Institute. In a thirty-year career in the US Army, spent primarily as a Eurasian foreign area officer, he served overseas in Saudi Arabia, Iraq, Germany, Belarus, Qatar, Afghanistan, the Republic of Georgia, Pakistan, and Kuwait. He is a graduate of the German Armed Forces Staff College and the US Army War College and holds a bachelor of science degree from the United States Military Academy, and a master’s degree in contemporary Russian studies and PhD in political science, both from the University of Virginia. In 2017 he led the US cell for ground deconfliction with Russia in Syria.

Candace Rondeaux is a professor of practice at the School of Politics and Global Studies and a senior fellow with the Center on the Future of War at Arizona State University. She has served as a strategic advisor to the US special inspector general for Afghanistan reconstruction and senior program officer at US Institute of Peace where she launched the RESOLVE Network, a global research consortium on violent extremism. She spent five years living and working in South Asia where she served as South Asia bureau chief for the Washington Post and as senior analyst on Afghanistan for the International Crisis Group. A graduate of Sarah Lawrence College, she holds a bachelor’s degree in Russian area studies, a master’s degree in journalism from New York University, and a master’s degree in public policy from the Woodrow Wilson School of Public and International Affairs at Princeton University. She is the author of the report “Decoding the Wagner Group: Analyzing the Role of Private Military Security Contractors in Russian Proxy Warfare.”

The Irregular Warfare Podcast is a collaboration between the Modern War Institute and Princeton University’s Empirical Studies of Conflict Project. You can listen to the full episode below, and you can find it and subscribe on Apple Podcasts, Stitcher, Spotify, TuneIn, or your favorite podcast app. And be sure to follow the podcast on Twitter!

Article link: https://mwi.usma.edu/russias-wagner-group-and-the-rise-of-mercenary-warfare/

A decade-long quest to become a cyber superpower is paying off for China.

By Patrick Howell O’Neill

February 28, 2022

The “most advanced piece of malware” that China-linked hackers have ever been known to use was revealed today. Dubbed Daxin, the stealthy back door was used in espionage operations against governments around the world for a decade before it was caught.

But the newly discovered malware is no one-off. It’s yet another sign that a decade-long quest to become a cyber superpower is paying off for China. While Beijing’s hackers were once known for simple smash-and-grab operations, the country is now among the best in the world thanks to a strategy of tightened control, big spending, and an infrastructure for feeding hacking tools to the government that is unlike anything else in the world.

This change has been going on for years, driven right from the very top. Soon after he ascended to power, President Xi Jinping began a reorganization of China’s military and intelligence agency, which prioritized cyberwarfare and initiated a “fusion” of military and civilian organizations geared toward boosting the nation’s cyber capabilities

The results are new tools and tactics that have rapidly become more sophisticated and ambitious over the past decade. For example, Chinese government hackers have exploited more powerful zero-day vulnerabilities—previously undiscovered weaknesses in technology for which there is no known defense—than any other nation, according to congressional testimony from Kelli Vanderlee, an intelligence analyst at the cybersecurity firm Mandiant. Researchshows that Beijing exploited six times as many such powerful vulnerabilities in 2021 as in 2020.

China’s offensive cyber capabilities “rival or exceed” those of the United States, said Winnona DeSombre, a research fellow at the Harvard Belfer Center, in congressional testimony on China’s cyber capabilities on February 17. “And its cyber defensive capabilities are able to detect many US operations—in some cases turning our own tools against us.”

Powerful tools

Daxin is just the latest powerful tool linked to China over the past year. It works by hijacking legitimate connections to hide its communications in normal network traffic. The result provides stealth and, on highly secure networks where direct internet connectivity is impossible, allows hackers to communicate across infected computers. The researchers who discovered it, from the cybersecurity firm Symantec, compare it to advanced malware they’ve seen that’s been linked to Western intelligence operations. It’s been in use at least as recently as November 2021.   

And in February of last year,  a massive hacking spree against Microsoft Exchange servers by multiple Chinese groups, beginning with zero-day exploits known as ProxyLogon vulnerabilities, showcased Beijing’s ability to coordinate an offensive so large in scale it seemed chaotic and reckless to outside observers. The onslaught effectively left a door wide open on tens of thousands of vulnerable email servers for any hacker to step through.

A quieter campaign uncovered in May saw multiple Chinese hacking groups use another zero-day vulnerability to successfully hack military, government, and tech industry targets across the United States and Europe.

People at the highest levels of power in China appreciate the importance of cyber capabilities. The CEO of Qihoo 360, the country’s biggest cybersecurity company, famously criticized Chinese researchers doing work outside the country and implored them to “stay in China” to realize the “strategic value” of powerful software vulnerabilities used in cyber-espionage campaigns. Within months, his company was linked to a hacking campaign against the country’s Uyghur minority. 

A wave of stricter regulations followed, tightening the government’s control of the cybersecurity sector and prioritizing the state’s security and intelligence agencies over all else—including the companies whose software is insecure. 

“The Chinese have a unique system reflecting the party-state’s authoritarian model,” says Dakota Cary, an analyst at Georgetown’s Center for Security and Emerging Technology. 

Chinese cyber researchers are effectively banned from attending international hacking events and competitions, tournaments they once dominated. A hacking contest pits some of the world’s best security researchers against one another in a race to find and exploit powerful vulnerabilities in the world’s most popular tech, like iPhones, Teslas, or even the kind of human-machine interfaces that help run modern factories. Prizes worth hundreds of thousands of dollars incentivize people to identify security flaws so that they can be fixed.  

Now, however, if Chinese researchers  want to go to international competitions, they require approval, which is rarely granted. And they must submit everything to government authorities beforehand—including any knowledge of software vulnerabilities they might be planning to exploit. No one other country  exerts such tight control over such a vast and talented class of security researchers. 

This mandate was expanded with regulation requiring all software security vulnerabilities to be reported to the government first, giving Chinese officials unparalleled early knowledge that can be used for defensive or offensive hacking operations.

“All of the vulnerability research goes through an equities process where the Chinese government gets right of first refusal,” says Adam Meyers, senior vice president of intelligence at the cybersecurity company CrowdStrike. “They get to choose what they’ll do with this, really increasing the visibility they have into the research being conducted and their ability to find utility in all of it.”

We’ve seen one exception to this rule: an employee of the Chinese cloud computing giant Alibaba reported the famous Log4j vulnerability to developers at Apache instead of first delivering it to Chinese government authorities. The result was a public punishment of Alibaba and implicit warning for anyone else thinking of making a similar move.

China’s stricter policies have an impact well outside the country itself.

Over the last decade, the “bug bounty” model has provided millions of dollars to build a global ecosystem of researchers who find software security vulnerabilities and are paid to report them. Multiple American companies host marketplaces where any tech firm can put its own products up for close examination in exchange for bounties to the researchers. 

By any measurement, China ranks at or near the top in alerting American firms to vulnerabilities in their software. In his congressional testimony last week, Cary said an unnamed large American firm had disclosed to him that Chinese researchers received $4 million in 2021. The American companies benefit from the participation of these Chinese researchers. When the researchers report a bug, the companies can fix it. That’s been the status quo since the bounty programs began booming in popularity a decade ago.

However, as the Chinese government tightens control, this multimillion-dollar ecosystem is now delivering a steady stream of software vulnerabilities to Chinese authorities—effectively funded by the companies and at no cost to Beijing.

“China’s policy that researchers must submit vulnerabilities to the Ministry of Industry and Information Technology creates an incredibly valuable pipeline of software capabilities for the state,” says Cary. “The policy effectively bought at least $4 million worth of research for free.”

Robot Hacking Games

In 2016, a powerful machine called Mayhem won the Cyber Grand Challenge, a cybersecurity competition held by the US Defense Advanced Research Projects Agency.

Mayhem, which belongs to a Pittsburgh company called ForAllSecure, won by automatically detecting, patching, and exploiting software security vulnerabilities. The Pentagon is now using the technology in all military branches. Both the defensive and offensive possibilities were immediately obvious to everyone watching—including Chinese officials.

DARPA hasn’t run a similar program since 2016. China, on the other hand, has put on at least seven “Robot Hacking Games” competitions since 2017, according to Cary’s research. Chinese academic, military, and private-sector teams have all been drawn to competitions overseen by the Chinese military. Official documents tie automated discovery of software vulnerabilities directly to China’s national goals.

As the Robot Hacking Games were beginning, the CEO of Qihoo 360 said automated vulnerability discovery tools were an “assassin’s mace” for China.

“Whoever masters the automatic vulnerability mining technology will have the first opportunity to attack and defend the network,” he said. Claiming that his own company had developed “a fully autonomous automatic vulnerability mining system,” he argued that the technology is the “‘killer’ of network security.”

The Robot Hacking Games are one example of the way Chinese officials at the highest level have been able to see an American success and then smartly make it their own.

“Time and again, China has studied the US system, copied its best attributes, and in many cases expanded the scope and reach,” says Cary.

As the US-China rivalry continues to function as the defining geopolitical relationship of the 21st century, cyber will play an outsize role in what China’s leaders rightfully call a “new era.” It touches everything from commercial competition to technological advancement and even warfare. 

In that new era, Xi’s stated goal is to make China a “cyber superpower.” By any measure, he’s done it.

Article link: https://www.technologyreview.com/2022/02/28/1046575/how-china-built-a-one-of-a-kind-cyber-espionage-behemoth-to-last/