Distilling Cyber Policy

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Despina Spanou, the Head of the Cabinet of the Vice-President of the European Commission. The discussion begins with the recent history and intentions of EU technology policy making, the EU’s legislative process, and the development of the Cyber Resilience Act (CRA). The conversation concludes with a look towards international cooperation on cybersecurity, including the recent announcement of the US-EU Joint Cybersafe Products Action Plan and the outcomes of the latest U.S-EU Trade and Technology Council meeting. 

News:

• ONCD Releases its Summary of the 2023 Cybersecurity Regulatory Harmonization RFI
• White House highlights voluntary commitments from Google, Microsoft to provide cyber services for health sector

Interview:

• Digital Covid Certificate
• NIS Directive
• CRA
• U.S.-EU Sign Joint Cybersafe Products Action Plan
• U.S.-EU Trade and Technology Council Meeting

Community Corner:

• ICS Village
• Hack the Capitol

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by John Banghart, Senior Director at Venable LLP, and Kent Landfield, a founding member of the Common Vulnerabilities and Exposures (CVE) Program and bonafide cybersecurity industry veteran. Their discussion delves into the latest developments and ongoing debate around the National Vulnerability Database (NVD).

News:

• International Cyberspace and Digital Policy Strategy
• CISA's Secure by Design Pledge
• UK's Product Security and Telecommunications Infrastructure (PSTI) Act
• UK Consultation for draft code of practice for software vendors
• UK Consultation for draft code of practice for cybersecurity of AI  

Interview:

• National Vulnerability Database
• Common Vulnerability Exposures
• Forum of Incident Response and Security Teams (FIRST)

Community Corner:

• Inaugural Cyber Policy Awards

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Lee Licata, one of the Deputy Chiefs of the Foreign Investment Review Section in the National Security Division at the Department of Justice (DOJ), and Grant Dasher, the Cybersecurity Division Architecture Branch Chief at the Cybersecurity and Infrastructure Agency (CISA). The conversation delves into the recently released Executive Order (EO) 14117 on "Preventing Access to Americans' Bulk Sensitive Data and United States Government-Related Data by Countries of Concern." 

In addition, this week, Alex and Jen are joined by Michael Daniel, president and CEO of the Cyber Threat Alliance, to discuss the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). As always, if you would like to submit cyber policy trivia, or have topic ideas for upcoming episodes, please email [email protected].

News:

• Notice of Proposed Rule Making to Implement the Cyber Incident 
• Reporting for Critical Infrastructure Act (CIRCIA) of 2022 
• The Ransomware Task Force (RTF) celebrated its third anniversary with a one day event co-hosted by the Center for Cybersecurity Policy and Law, and you can watch the recording here. 
• CR2’s Guarding Global Commerce Report 

Interview:

• EO 14117 on "Preventing Access to Americans' Bulk Sensitive Data and United States Government-Related Data by Countries of Concern"
• EO 14117 Advanced Notice of Proposed Rule Making
• ICT Supply Chain, Department of Commerce 

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Shehzad Charania MBE, Director of Legal Affairs and International Relations at the UK’s Government Communications Headquarters (GCHQ).

The jam-packed discussion delves into the importance of workforce diversity, the notion of responsible cyber power, and the commercial proliferation of offensive cyber weapons like spyware. In addition, this week’s episode features cyber policy recommendations from the Cybersecurity Coalition’s EU Policy Roadmap 2024 - 2029. Our Mystery Trivia Master is the wonderful Liz Wharton (@lawyerliz), founder and CEO of Silver Key Strategies. 

News:

• Cybersecurity Coalition EU Policy Roadmap 2024 - 2029

Interview:

• UK National Cyber Force Paper on Responsible Cyber Power
• Australian Cyber Policy with Ambassador Brendan Dowling
• UK's 2022 Cybersecurity Strategy
• African Union Position on the Application of International Law in Cyberspace
• Pall Mall Process Declaration 
• Summit for Democracy Joint Statement

Trivia:

• Air-Control Hacker Faces Charges (Wired, 1998)

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Mark Montgomery, Senior Director and Senior Fellow at the Foundation for the Defense of Democracies (FDD). At FDD, Mark leads CSC 2.0, an initiative that works to implement the recommendations of the congressionally mandated Cyberspace Solarium Commission, where he served as executive director. The discussion delves into the Commission and its March 2020 report and associated recommendations, as well as CSC 2.0's emerging priorities.

News:

• NIST’s CSF 2.0
• UK Call for views on cyber security and economic growth
• UK Cyber Duty to Protect Survey

As 2023 comes to a close, host Alex Botting and Jen Ellis are joined by guests from Season 1 and experts from the Center for Cybersecurity Policy & Law to discuss their predictions for 2024. 

🧠 What's next for AI?

⚛ Will 2024 be the year of Quantum?

🔑 Can we finally ditch Passwords? 

🏷 Will Cyber Labels nudge consumers towards better security decisions?

📜 Will Certifications and Self-Attestations raise the bar for enterprises?

Episode Guest List:

Brendan Dowling - Australian Ambassador for Cyber Affairs and Critical Technology

Irfan Hemani - Deputy Director of Cyber Security Policy, UK Department for Science, Innovation and Technology‍

Alison King - Vice President of Government Affairs, Forescout Technologies

Ari Schwartz - Managing Director of Cybersecurity Services, Venable LLP & Coordinator, Cybersecurity Coalition 

Jeremy Grant - Managing Director of Technology Business Strategy, Venable LLP & Coordinator, Better Identity Coalition

Inés Jordan-Zoob - Program Manager, Cyber Security and Privacy, Venable LLP

Heather West - Senior Director of Cybersecurity and Privacy Services, Venable LLP

In our latest episode, former U.S. National Cyber Director Kemba Walden joins Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law. The discussion includes Kemba’s reflections on her time at the Office of the National Cyber Director, and the multitude of major policy initiatives that she spearheaded - including the release of the updated U.S. National Cybersecurity Strategy, the associated Implementation Plan, the Cybersecurity Priorities for the Fiscal Year 2025 Budget, and the U.S. National Cyber Workforce and Education Strategy -  and all in just ten months of tenure. 

News:

• Australian Cyber Security Strategy Release
• EU CRA Political Agreement Reached

Interview:

• Munich Security Conference 2023
• US National Cybersecurity Strategy 
• US National Cybersecurity Strategy Implementation Plan
• Biden-Harris Administration’s Cybersecurity Priorities for the Fiscal Year 2025 Budget
• US National Cyber Workforce and Education Strategy 
• Request for Information: Opportunities For and Obstacles To Harmonizing Cybersecurity Regulations
• Office of the National Cyber Director Requests Public Comment on Open-Source Software Security and Memory Safe Programming Languages
• Request for Information on Open-Source Software Security: Areas of Long-Term Focus and Prioritization
• Log4j Vulnerability 
• Heartbleed Bug

Trivia:

• Belgian Whistleblower Law

In our latest episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by the Australian Ambassador for Cyber Affairs and Critical Technology, Brendan Dowling. In the conversation, Ambassador Dowling provides context on Australia’s numerous recent cyber policy developments, including the appointment of the inaugural Australian National Cyber Security Coordinator, the upcoming 2023-2030 Australian national cybersecurity strategy, and some of the lessons learned from the recent Medibank and Optus cyber incidents.  He also gives his optimistic perspective on where we are today and where we can get to in the coming years.

News:

• UK’s AI Safety Summit
• Bletchley Declaration
• U.S. Executive Order on AI 
• Heather West’s analysis of the AI EO 
• International Counter Ransomware Initiative
• Recent ransomware attack in Germany

Interview:

• Upcoming 2023-2030 Australian national cybersecurity strategy 
• Appointment of the inaugural Australian National Cyber Security Coordinator
• Medibank incident
• Optus incident 

Trivia:

• Sarbanes-Oxley Act of 2002
• Chips and Science Act of 2022

In our latest episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Jason Gull, Senior Counsel in the Computer Crime and Intellectual Property Section (CCIPS) of the Justice Department’s Criminal Division. In the conversation, Jason sheds light on the evolution of the Digital Millennium Copyright Act, including the role of the Library of Congress in reviewing the law every three years. The 2024 review process is underway, and potential new or amended exemptions have been submitted. The Copyright Office is accepting comments and evidence, as detailed here.   

In addition to the above, this week’s episode features Alex’s updates from Singapore International Cyber Week, and he also highlighted Singapore’s Cybersecurity Labeling Scheme for Medical Devices sandbox, which medical device manufacturers are invited to join. Jen covered some recent research from Lloyd’s on the potential cost and impact of a large scale cyber attack against payments systems. 

Our Mystery Trivia Master this week is the wonderful Megan Stifel, Chief Strategy Officer for the Institute for Security and Technology and Executive Director of the Ransomware Task Force.

News Section:

• Singapore International Cyber Week 2023
• Singapore Cybersecurity Labeling Scheme for Medical Devices Sandbox
• Lloyd’s of London finds hypothetical cyberattack could cost world economy $3.5 trillion

Interview Section:

• Computer Crime and Intellectual Property Section (CCIPS)
• Digital Millennium Copyright Act (DMCA)
• Ninth Triennial Section 1201 Proceeding, 2024 Cycle
• Cybercrime and the Law: Computer Fraud and Abuse Act (CFAA) and the 116th Congress
• Computer Fraud and Abuse Act (CFAA) Guidance from DOJ
• Ninth Triennial Section 1201 Proceeding, 2024 Cycle

Trivia Section:

• Comprehensive National Cybersecurity Initiative (CNSI)
• Archived White House Release of CNSI

In our latest episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Irfan Hemani, Deputy Director of Cyber Security Policy at the UK's Department for Science, Innovation, and Technology. In this role, Irfan is responsible for Cyber Resilience Policy for the UK's wider economy and society. The discussion focuses on how the UK currently approaches securing emerging technologies,  from both enterprise and consumer perspectives

News Section:

• TSA Finalizing Cybersecurity Guidelines for Pipeline Operators and Vendors
• Deputy National Security Advisor provides details on ratings effort to determine security of pipeline, rail sectors
• LATAM CISO Summit 2023
• Microsoft Digital Defense Report

Interview Section:

• Cyber Power Index
• ETSI EN 303 645 Cybersecurity Standard for Consumer IoT Devices
• Product Security and Telecommunications Infrastructure (PSTI) Act
• UK AI Safety Summit

Trivia Section:

• Soviet Memorial Causes Rift between Estonia and Russia
• The Bronze Soldier Crisis of 2007: Revisiting an Early Case of Hybrid Conflict