The TechnologIST | We operate with a “bias towards action.” What does this mean in practice?

Welcome back to The TechnologIST!?As an organization, IST operates on a unique model. We take on challenges facing individuals, society, and our world from start to finish–helping us derive and ultimately implement?tangible, action-oriented solutions. Our NC3 and nuclear risk reduction project is a case in point. In this month’s edition of The TechnologIST, I walk you through our work on this project and introduce you to the team driving our efforts.?

The following is a preview of our latest newsletter. To subscribe and make sure you don't miss the full story, click the link below:

We operate with a “bias towards action.” What does this mean in practice??

IST’s NC3 and nuclear risk reduction efforts: A case study

Nuclear command, control, and communications (NC3) systems determine how, when, and in what way a state deploys its nuclear weapons. Critically, new applications of technologies–like social media, quantum computing, cyber capabilities, hypersonic weapons, or artificial intelligence–have the potential to transform the way NC3 systems?operate and disrupt the status quo. Faced with this reality and on a mission to find a viable path forward, IST in 2019 embarked on deep research to build our understanding of modern-day NC3 systems and the vulnerabilities they face.?

Following the research phase, we took our work to the next level. IST, together with the Nautilus Institute for Security and Sustainability and the Preventive Defense Project at Stanford University, convened a group of over 50 experts from across industries and sectors, including those who wouldn’t normally engage in discussions of NC3 systems. Participants from across law, politics, technology, history, engineering, computer science, security, and more came together to discuss the problems with NC3 systems and propose potential solutions. The convening tackled issues of new risks introduced by the integration of emerging and disruptive technologies (EDTs) and the dangers of complexity in NC3 systems. The workshop underscored?the need for information sharing amongst governments and the technical communities and the importance of a global, integrated approach to make NC3 secure and resilient.?

IST didn’t stop there: we published a series of 36 papers written by the convening participants, including?The AES Project: Any Lessons for NC3?, Hardware that is Less Trusted: Open-Source Down to the Silicon, and?Emerging Technologies, Emerging Challenges – The Potential Employment of New Technologies in Future PLA NC3;?launched The Fourth Leg?podcast?with 24 episodes to learn from experts, policymakers, and academics on NC3;?and ultimately initiated our efforts to support the CATALINK initiative, based on a concept introduced in the 2019 convening.?This project is the perfect example of IST’s bias towards action—we’re not just interested in research and writing about the problem, but actively are involved in finding solutions and applying them in real time. CATALINK is a crisis communications capability, intended to be additive to existing NC3 systems. It is an open source, dedicated, secure,?multilateral technology for use by leaders of nuclear-armed?states. The CATALINK concept would enable leaders to communicate in the lead-up to a crisis, during a crisis, and in worst cases, post-nuclear exchange.?Often these critical communications capabilities are internally focused only,?without concern for secure capabilities for de-escalation. The NC3 work IST has done showed this as a glaring gap in how to reduce the risk of nuclear war.

Now, IST is?socializing the CATALINK concept with governments worldwide, conducting deep research on political barriers preventing the implementation of CATALINK and?other risk reduction measures while leading a new Crisis Communications Resilience Working Group (WG), comprised of scholars, academics, practitioners, and technical experts from across Europe, Asia, and North America.

In this month’s edition of The TechnologIST, I talk with Deputy Director of Nuclear Policy Sylvia Mishra and Technology Policy Analyst Christian S. to unpack what they’re working on and what’s next.??

How do you think IST’s unique problem-solving model has helped to advance the CATALINK concept and nuclear risk reduction efforts?

Sylvia Mishra: "IST has been involved at each stage of the problem-solving process, from deep research and expert convenings to solution ideation and implementation. Over the course of the last few years, we have achieved unprecedented impact to spotlight an urgent issue which is vastly under-appreciated and under-researched.

• Over the course of this project, the team has briefed more than 20 national representatives from diverse nuclear-armed and non-nuclear weapons countries on the CATALINK concept in order to drive stakeholder engagement and ultimately increase governments’ willingness to utilize CATALINK as an additive concept.
• The project has secured political and financial support from the Swiss Federal Department of Foreign Affairs and the German Federal Foreign Office.
• While promoting understanding of the CATALINK concept, the team, with the leadership of talented technical experts such as Eric Grosse, Subrata Banik, Ron Minnich, Srikrishna Devabhaktuni, Rajeev Krishnamoorthy, and many others, have designed and developed a prototype using open source code which drives the messaging and blueprint for the CATALINK system.
• The international team has published a number of reports and analytical pieces focused on understanding how existing crisis communication systems among nuclear-armed states are inadequate. To bolster nuclear risk reduction efforts, the team's publications include an atlas of crisis communications between nuclear states, a database of known instances of hoax calls between leaders, an analysis of nuclear risk reduction implementation pathways, and an assessment of failure points for crisis communications systems.
• The CATALINK team has attended conferences and continues to engage in roundtable discussions and workshops across global capitals to discuss the importance of crisis communication and other nuclear risk reduction measures. By doing so, we socialized and introduced members of industry and government to the concept and technical details supporting the CATALINK initiative."

Tell me about the research you’ve been conducting on nuclear risk reduction. What has been most interesting to you?

Christian Steins: "I've been focusing on two key aspects of nuclear risk reduction in my research.?

1. Technical vulnerabilities threatening crisis communications.?

CATALINK and?other crisis communications are intended for use in the lead-up to, during, or even post-nuclear detonation. When considering any kind of communication system designed for use in the event of such a detonation, it is essential also to consider how that detonation might impact communication devices, infrastructure, and networks. This month, IST’s Katherine Schmidt published a primer detailing how an electromagnetic pulse (EMP) generated by a nuclear detonation could affect the electric grid, electronics, satellites, radio and cellular, and wired communications. In my research, I am investigating the ways in which world leaders are responding to these technical vulnerabilities–how politics play a role, what we can learn from existing crisis communications technical constraints, and which potential risk reduction solutions are feasible and worth exploring."

2. The U.S.-Japan-South Korea trilateral hotline.

As we look to socialize CATALINK with world governments and convince leaders of the necessity of crisis communications, I researched a recently-established trilateral hotline to explore how it could be done and to help build the case for why hotlines remain important risk reduction measures. I took the October 2023 U.S.-Japan-South Korea hotline as a case study, investigating the circumstances under which it came about, the commitments that accompanied its creation, and the regional context under which it was created."

IST launched the Crisis Communications Resilience Working Group in October 2023. What has the group been working on so far? And what’s next?

Sylvia Mishra: "It's been an incredibly productive last few months. Together with an esteemed group of experts from across the nuclear risk reduction space, we are working to understand in clear terms the political barriers to institutionalizing effective and resilient crisis communications amongst the nine?nuclear-armed states. We have also been looking at the potential use-cases of multilateral crisis communications and how emerging and disruptive technologies could present risks or opportunities to existing crisis communications. Experts in the Working Group are also collaborating?to find creative ways to politically advance secure and resilient nuclear hotlines.?

In the coming months, we’ll publish a compendium of essays and interviews from Working Group members assessing the status of crisis communications systems and use-cases of multilateral crisis communications in specific nuclear-armed states. This compendium will look at the current operating environments and political and technical barriers to cooperation.?Additionally,?the CATALINK team will release a report assessing instances of abuse or misuse of crisis communications, both diplomatic and technical, and mitigation strategies to offset these cases of misuse.”

Elsewhere at IST

IST’s Applied Trust and Safety Initiative identifies key themes

In 2023, IST’s Applied Trust & Safety Initiative conducted a cross-industry listening tour of T&S practitioners, researchers, and academics. In summarizing their findings, Steven M. Kelly, CISSP and Nile Johnson identified 6 key themes from those conversations, including closing the gap between T&S practice and public policymaking; addressing the crisis of legitimacy; adopting a global lens for T&S issues; and adapting approaches in light of AI, among others.?

IST launches Generative Identity Initiative with support of Omidyar Network

With the generous support of Omidyar Network , IST's new Generative Identity Initiative aims to address the complex questions around generative AI's impact on social identities, norms, and belonging.?Building off the work of the Digital Cognition and Democracy Initiative, IST will convene a multi-stakeholder working group to better understand how tech impacts cognition, interpret the influence of AI on these dynamics and shape potential policy responses.

IST in the News

Megan Stifel weighs in on?ostensible ransomware?payment bans

New Zealand-based security software company Emisoft has called for a ban on ransomware payments, reporting 2,207 US hospitals, schools, and government organizations in 2023. Speaking with The Register , Megan S. argued against a ban, for now. “I think we can eventually get to a ban, but at this point in time it is not a silver bullet and will result in more harm than good," she said.??

IST joins Common Good Cyber

IST is excited to announce our participation in Common Good Cyber , an?effort coordinated by the Global Cyber Alliance that brings together governments, private sector, academia, and civil society to collectively address immediate and long-term factors affecting the?availability and security of the Internet. The first workshop will take place on February?26-27 at the National Press Club in Washington, D.C. RVSP here.

What We're Reading

Want more tech and security content? Check out some of the ISTeam's favorite pieces from the past month:?

• If an AI system learns a deceptive strategy, could it be detected and removed using current safety training techniques? A group of researchers constructed proof-of-concept examples of deceptive behavior in large language models and concluded: probably not.?
• California’s State Senate is considering a bill that would regulate the state government’s use of artificial intelligence. The AI Accountability Act, introduced by Sen. Bill Dodd, would require state agencies to notify users when they are interacting with AI and push for better standards in the private sector.?
• The U.S. Department of Commerce released a request for comment on a proposed rule that would require U.S. Infrastructure as a Service (IaaS) providers to verify the identity of their foreign customers with certain exceptions, and authorizes special measures to deter foreign malicious cyber actors' use of U.S. IaaS products.?
• The Federal Trade Commission has launched an inquiry into the millions of dollars invested in OpenAI and Anthropic by Microsoft, Amazon, and Google. “Our study will shed light on whether investments and partnerships pursued by dominant companies risk distorting innovation and undermining fair competition,” FTC chair Lina Khan said.
• The Biden administration plans to put forward an executive order that would attempt to prevent foreign actors from accessing highly sensitive personal data about Americans and people connected to the U.S. government, according to documents obtained by Bloomberg.?
• The Cybersecurity and Infrastructure Security Agency’s pre-ransomware notification initiative, launched in March, alerted more than 1,200 schools, healthcare organizations, emergency services and state and local governments to potential pre-ransomware instructions in 2023.?
• Bitcoin mining uses huge amounts of electricity, and is largely considered to be damaging to the environment. A study led by Cornell researchers examined renewable energy projects across the United States, calculating their potential to profit from bitcoin mining during the development phase. Some projects could recoup millions to support future renewable energy development, they found.?
• The?info-tech company Hewlett Packard Enterprise announced it had been hacked by a suspected Russian intelligence team, just days after Microsoft reported the same. In both hacks, emails were stolen from cybersecurity employees, senior executives, and others.
• Center for a New American Security’s Executive Vice President Paul Scharre and researcher Michael Depp examined the potential risks and benefits of integrating AI into nuclear command and control systems. “Improperly used, AI in nuclear operations could have world-ending effects,” they write.

The Institute for Security and Technology designs and advances solutions to the world’s toughest emerging security threats. It is a nonpartisan, nonprofit network based in the San Francisco Bay Area dedicated to solving critical international security challenges through better technology and policy. Donate today to support our mission.

Thanks for reading The TechnologIST!?To be sure you don't miss the next edition, subscribe here.