Search the archive.

a. The Integrity of Supply Chains and Critical Infrastructures.

When counterfeit computer and networking devices enter the supply chain, for example, they directly “undermine the reliability of our communications and transportation networks and create national security vulnerabilities. In addition, nation states target U.S. civilian industries for trade secret theft to obtain information that can be used to advance their domestic industries and military capabilities.”126

A state that eschewed cyber operations of any kind against an opponent’s nuclear forces or C3I systems might still launch such operations against adversary military networks involved exclusively in non-nuclear operations. If, because of design flaws, imperfect intelligence, or mistakes in execution, the malware used in such attacks spread and infected networks that were involved in nuclear operations, the target might conclude that its nuclear forces or C3I systems were under deliberate cyberattack or cyber surveillance.

There could be collateral effects even if a state’s networks for nuclear operations were entirely isolated; air-gapping (physically isolating one particular network from others) is, after all, not a cyber security panacea.30 Moreover, achieving perfect isolation could prove difficult in practice.31 To give but one reason, every nuclear-armed state, apart from the United Kingdom, has dual-use delivery systems, which can be used to deliver nuclear or non-nuclear weapons. Such delivery systems represent a potential point of contact between the C3I systems supporting nuclear operations and those supporting non-nuclear operations.

Claim: According to Jim, a cyber catastrophe captures our imagination, but as analysis, it remains entirely imaginary and is of dubious value as a basis for policy making. There has never been a catastrophic cyberattack.

My response: The Maroochyshire wastewater cyber-attack in 2000 dumped more than 750,000 liters of sewage. In 2010, Stuxnet damaged more than 1,000 centrifuges and may have delayed a shooting war. The Russian Triton cyber attack against a petrochemical plant in Saudi Arabia was not successful but not because of the lack of trying. This attack was meant to blow the plant up and kill people. The two Russian take-downs of portions of the Ukrainian distribution grids in December 2015 and 2016 demonstrate catastrophe-capable cyberattacks on critical infrastructures.

Claim: They are harder to damage through cyberattack than they look, given the growing (albeit incomplete) attention to cybersecurity; and experience shows that people compensate for damage and quickly repair or rebuild.

My response: This is true when there is no equipment damage such as occurred with the 2003 Northeast Outage. However, this is not true when long-lead equipment such as transformers, generators, or large motors are damaged or destroyed. I also question whether there actually is growing concern about control system (not OT network) cyber security as can been from the responses to the DOE Request for Information with respect to the Presidential Executive Order 13920.

Fears about cyber-enabled damage limitation may be particularly pernicious because of the potential difficulty of detecting a cyberattack. A sophisticated cyberattack on nuclear forces or C3I systems could conceivably occur without being detected. In the extreme case, a state might only find out that it had been attacked when it attempted to launch nuclear weapons and discovered that its ability to do so had been impeded in some way. If a state believed that it would be unlikely to detect an ongoing cyberattack, then it could rationally conclude that it might be under attack even in the absence of attack indicators. The simple belief that an opponent had highly sophisticated cyber capabilities could, therefore, precipitate a false positive–the incorrect assessment that an attack was underway–by itself. By contrast, if a state’s nuclear forces were under assault from kinetic strikes, the target would likely be aware. To be sure, it is still not entirely impossible that a state could wrongly come to believe it was under kinetic attack. Early-warning systems, for example, have produced false warnings of incoming ballistic missile strikes.27 But mistakes of this kind could be identified once the incoming weapons ceased to exist (though the window of time before they disappeared could be particularly dangerous).

To make matters worse, a state that was concerned about its nuclear forces and C3I systems coming under cyberattack might be inclined, especially in a crisis or conflict, to interpret ambiguous indicators in the worst possible light. For example, if one of its nuclear C3I systems malfunctioned because of, say, bad design or aging components, it might wrongly attribute the failure to a cyberattack (in fact, the temptation among operators to do so might be particularly strong if they would otherwise be held responsible for an internal failure). Regardless of precisely how it arose, however, a false positive that occurred in a crisis or conflict could generate significant escalation pressures.

The advent of cyber warfare exacerbates the risk of inadvertent nuclear escalation in a conventional conflict. In theory, cyber espionage and cyberattacks could enhance one state’s ability to undermine another’s nuclear deterrent. Regardless of how effective such operations might prove in practice, fear of them could generate escalatory “use-’em-before-you-lose-’em” pressures. Additionally, cyber threats could create three qualitatively new mechanisms by which a nuclear-armed state might incorrectly conclude that its nuclear deterrent was under attack. First, cyber espionage could be mistaken for a cyberattack. Second, malware could accidentally spread from systems that supported non-nuclear operations to nuclear-related systems. Third, an operation carried out by a third party could be misattributed by one state in a bilateral confrontation to its opponent. Two approaches to risk reduction are potentially viable in the short term: unilateral restraint in conducting potentially escalatory cyber operations, and bilateral or multilateral behavioral norms.

The United States’ experience is the norm. All nuclear-armed states have felt, and continue to feel, similar concerns. Indeed, the last few decades have seen the emergence of new potential vulnerabilities–this time in cyberspace–as nuclear weapons and C3I systems have come to rely increasingly on digital technology. To be sure, the networks involved in nuclear operations are almost certainly among the most secure anywhere. Yet there is broad agreement among technical experts that perfect network security is “impossible.”3 As a result, the possibility of cyber interference with nuclear forces and C3I systems is real.

The vulnerability of nuclear forces and C3I systems creates the risk of inadvertent escalation: that is, escalation resulting from military operations or threats that are not intended to be escalatory. So-called crisis instability, for example, could arise if a state were afraid of being disarmed more or less completely in a preemptive strike by an adversary, whether or not such fears were well founded.4 In the most extreme case, “use-’em-or-lose-’em” pressures could lead the state to employ nuclear weapons, conceivably in its own preemptive attempt to disarm its adversary, but more likely in a limited way to try to terrify the opponent into backing down. In less extreme scenarios, a state afraid of being disarmed might take steps–issuing nuclear threats, for example, or dispersing mobile nuclear forcesthat raised the likelihood of nuclear use later.

An attacker who hacks an adversary’s nuclear command and control apparatus, or the weapons themselves, will gain an advantage in war-fighting that the attacker cannot reveal, while the adversary will continue to believe it wields a deterrent that may no longer exist. The dangers of escalation are greatest in brinksmanship situations where actors are willing to use secret offensive cyber operations—which cannot be revealed in advance—to limit the damage of a nuclear exchange. The same strategic logic that leads us to view cyber warfare as a limited political instrument in most situations, as discussed in Chapter 5, also leads us to view it as incredibly destabilizing in rare situations. While cyberwar is not itself a weapon of mass destruction, the use of offensive cyber operations targeting actual weapons of mass destruction will tend to undermine crisis stability.

In this paper, we suggest that the foremost threat of cyberattacks is not necessarily their first-order consequences—such as the degradation of physical systems, data theft, or loss of access. While these outcomes remain a cause for concern, the fixation on direct effects obscures the more insidious consequences of long-term psychological harm and societal damage. This perspective acknowledges the human dimension of cyberattacks that target individual well-being, morale, and vulnerability. For many cyber perpetrators, ranging from terrorists to state-sponsored hackers and criminal organizations, the primary objective of attacks is to evoke anxiety and terror, and disseminate misinformation among the public. In other words, these are nonphysical aims whose efficacy cannot be simply measured by weighing rubble, counting bodies, or tallying lost funds. Viewing a ransomware attack on a hospital network as minor or unsuccessful, simply because it caused minimal physical destruction and failed to attain a ransom, ignores the extensive psychological and societal damage it can leave in its wake (Shandler and Gomez 2022). Through this lens, the severity of cyber-threats can and should also be measured by the level of psychological distress. We remove from the definition of distress transient or minor emotional responses such as unease or discomfort, and focus our attention on acute psychological distress, including visceral anxiety, enduring anger, and heightened threat perception (Canetti 2017; Byrne et al. 2022).

Currently, there is no consensus whether cyberattacks cause sufficient individual-level harm to constitute a grave threat. Some argue that the bulk of cyberattacks constitute only minor irritants (Lindsay 2013; Gartzke and Lindsay 2015), while other researchers insist that even low-level cyberattacks can levy severe psychological and political consequences (Gross, Canetti, and Vashdi 2016; Canetti et al. 2017). Addressing this dilemma, this paper employs an internal meta-analysis that reviews a series of experimental studies simulating exposure to cyberattacks. An internal meta-analysis is a powerful analytical tool that aggregates and analyzes a pooled collection of experiments conducted by a single researcher or group of researchers. This technique allows us to exploit heightened statistical power to provide precise statistical estimates of treatment effects, and incorporate studies conducted with different population groups at different points of time. We analyze the full gamut of studies conducted by the authors—including null and unpublished findings—to provide accurate, transparent, and conclusive evidence about the individual-level consequences of exposure to cyberattacks. In all, we aggregate and meta-analyze findings from eighteen experimental studies conducted between 2015 and 2021. Over the course of these studies, we exposed 6,020 unique respondents in three countries to simulated cyberattacks and conventional attacks, before measuring the psychological distress that ensued. All studies mimicked how people are exposed to real-world cyberattacks, while maintaining strict ethical standards to ensure participants’ well-being.

In 2023, the world might not get so lucky. There will almost certainly be a major cyberattack. It could shut down Taiwan’s airports and trains, paralyze British military computers, or swing a US election. This is terrifying, because each time this happens, there is a small risk that the aggrieved side will respond aggressively, maybe at the wrong party, and (worst of all) even if it carries the risk of nuclear escalation.

This is because cyber weapons are different from conventional ones. They are cheaper to design and wield. That means great powers, middle powers, and pariah states can all develop and use them.

Nowadays, ‘cyberattack’ is a term used on a daily basis. Bendovschi notes that in the literature can be found various definitions of the this and other similar terms, but all of cyberattacks should be seen as aimed at compromising the data confidentiality, integrity and availability [4, p. 25]. A cyberattack may generally be seen as intentionally stealing, exposing, altering, disabling, or destroying some data, applications or other assets using a network or a given digital device without having the necessary access to do that [5]. According to some scholars, a cyber incident is defined as a system’s security policy breach which affects the integrity or availability of a system in line with the 1990 Computer Misuse Act. This may also include gaining an unauthorised access or at least an attempt to gain such access [6].

Cyberattacks are not concentrated in a single sector. In fact, they can affect any activity in a society – government institutions, individual companies and even entire industries. Due to their nature and importance, critical infrastructure objects require special attention in terms of ensuring their security. For example, cyberattacks on nuclear power plants and facilities that store nuclear or other radioactive materials, as well as nuclear weapons, can have existential consequences. Although states are making great efforts to achieve the highest possible level of nuclear security, there is no such thing as absolute security. Because of this even the slightest possibility of the potential use of nuclear weapons should not be underestimated, including being misled due to misjudgment. The latter is especially important nowadays, when the world relies more and more on technology, which also raises a number of questions about the risks resulting from it. Historically, at least ten similar cases can be listed since the end of World War II [7, pp. 7-23].

//DH

The lead paragraph from Reuters was originally correct: “Most, if not all, U.S. nuclear power plants contain counterfeit or fraudulent parts, potentially increasing the risk of a safety failure…”

As IoT devices become more integrated into the power grid, the risk of cyberattacks increases. A coordinated attack could manipulate energy flows, cause cascading failures, disrupt power to critical infrastructure, and damage the grid infrastructure. This highlights the need for increased security measures to ensure the safety and stability of the power grid.

One major vulnerability is weak authentication and encryption. Insufficient authentication mechanisms and encryption protocols can leave IoT devices and communication channels vulnerable to unauthorized access. According to an article from CSO online, more than “90 percent of data transactions on IoT devices are unencrypted.”

//DH

Though an opponent’s power infrastructure is an alluring target for any combatant looking for an edge in a conflict, attacks on electricity supplies carry a particular appeal for domestic extremists. Intelligence bulletins indicate that many of these groups identify the power grid as ripe for such sabotage, and recent attacks across the United States only vindicate those assessments. As these nongovernmental threats continue their decades-long ascent up the ladder of national security risks and with a contentious election looming in 2024, the severity of the threat is likely to grow.

the University of Maryland Carey School of Law “Debugging the Trademark Laws: The Lanham Act and Counterfeit

Microelectronics,” 31 TEX. INTELL. PROP. L.J. 211 (2023). Hein Online. Accessed via University of Michigan //DH

As described earlier, a supply chain is a system of systems. The majority of these systems rely on Commercial Off-The-Shelf (COTS) components, which brings numerous advantages such as the reduction of cost and time to market. Moreover, the use of common components increases the interoperability between the different systems and enhances the adoption of the different related standards, if compared to the use of its own proprietary hardware and software [36]. However, the use of COTS in supply chain can lead to severe security issues. One of the main issues is the use of counterfeit components/products. According to the Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS Agreement) the counterfeit trademark goods are those with similar trademarks as the valid ones which makes it difficult to differentiate them from the genuine products [33]. Indeed, COTS components/devices that are supplied via an unauthorized channel, are not authentic, and would fail a sufficiently rigorous validation. Because of financial gain motivations, counterfeiters buy counterfeit components/devices and supply them as genuine products [36]. Therefore, their negative impacts on each of the supply chain links are often an unintended consequence (e.g., system failure). However, attackers can also use them as an entry point to their target. Indeed, by inserting counterfeit components (hardware or software) during system design and development and across the supply chain, adversaries can gain various advantages such as system control for later remote exploitation or the deployment of malware that will degrade or alter the system’s performance, either through presetting or event-triggering [37, 38].

According to the European Organization for Economic Cooperation and Development (OECD) [34], the risk of a consumer purchasing counterfeit goods in the United States or the EU is roughly one in 20 and it increases each year. Indeed, according to [39] the amount of total counterfeiting globally reached $1.2 Trillion in 2017 and is expected to double in coming years. To put that in perspective, it represents almost 2% of everything sold worldwide [34].

The counterfeiting problem is growing as the supply chain widens, and it’s bigger than most manufacturers suspect. “When it comes to consumer goods like watches or designer clothing, buying the products in odd places at cheap prices may suggest these products are fakes,” said Konrad Bechler, security consultant brand protection and anti-counterfeit at Infineon Technologies. “Buyers of semiconductors very often don’t realize this is also true for semiconductor components. When treating this as a marginal topic, counterfeit semiconductors might turn into a serious problem, which means the components do not meet the expectations or specifications of the manufacturer. There is always a life-threatening aspect to counterfeits. Just think of an airbag not deploying properly during a crash, or medical equipment like an automated electric defibrillator not working in a life-threatening situation. These are only two use cases. Since semiconductors are an integral part of our daily lives, counterfeits pose a serious threat and will eventually lead to deaths if they don’t meet the specs.”

Heterogeneous integration and chiplets increase the threat. “If somebody is going to put an embedded memory chip onto a die so that a 3nm processor can have some embedded memory without going off chip, that embedded memory chiplet is built in a trailing-edge node,” said Scott Best, technical director, anti-counterfeiting products at Rambus. “It’s not built in 3nm. It’s built in something that has been optimized for embedded memory, and not for high-performance compute. So you isolate the specialization of the chiplets. This seems to be a good idea, and then the CPU vendor will work with a memory vendor. But how do you know that other chip hasn’t been cloned, copied, and something malicious hasn’t been slipped into the supply chain? That’s terrifying. And yes, it’s a solvable problem, but it turns away from being an electronic security problem and it becomes a supply-chain security problem.”

The unique circumstances surrounding counterfeits on Online Marketplaces make online counterfeiting more likely.73 The Department of Homeland Security identified four factors that increase the likelihood of counterfeiters going online: (1) “Lower Startup and Production Costs,” (2) “Lower Marketing Costs,” (3) “Lower Distribution Costs,” and (4) “Consumer Attitudes and Perceptions.”74 Online counterfeiters have lower startup costs because online storefronts are much easier and cheaper to create than traditional brick and mortar stores, especially given the Online Marketplaces’ incentives to increase the accessibility to new sellers.75 Lower startup costs also make it harder to eliminate counterfeiters because of the ease of creating alternative stores or accounts.76 Online counterfeiters reap much of the benefit of lower production costs—increasing profit margins and the ability to undercut legitimate options— that most counterfeiters achieve.77

Online counterfeiters are also able to leverage lower marketing costs through stealing online promotional materials and by using the algorithms of Online Marketplaces and social media to funnel traffic to their fraudulent goods.78 The anonymity given to online sellers also makes it easier for them to use the same stolen promotional materials in other accounts, further driving down marketing costs.79 This ability to use cheap promotional materials across accounts also makes it easier for online counterfeiters to run multiple counterfeiting accounts simultaneously.80

Finally, while INFORM Consumers should give consumers and intellectual property rights holders some transparency regarding seller self-reported identification and location, numerous other critical details remain missing. These include details on systems for vetting products by platforms, how consumers and intellectual property rights owners are contacted upon a discovery of a counterfeit and how many counterfeit products were actually sold, process for removal of listings, where counterfeits go after being reported or taken down if they have been warehoused or returned, how repeat sellers of counterfeit are removed, how warehousing might work and other details that are important for both the intellectual property rights owner, law enforcement, and consumers, as they have not been required by law.

Last year, Congress took the first step to tighten our anti-counterfeit defenses and protect consumers by passing the INFORM Consumers Act, which requires third party platforms to disclose more information to consumers about large volume sellers on their sites. We celebrated that measure as it helps take away the ability of criminals to sell counterfeits by unmasking them.15 But it was only a first step in what is now needed to help bring our anti-counterfeit tools into the age of ecommerce. We now need proactive measures to make sure the counterfeits don’t get on to these third-party marketplaces in the first place.

SHOP SAFE will do just that, holding third-party online platforms accountable so they will be incentivized to make the necessary changes. They will need to meet the same requirements, and face the same accountability, as brick-and-mortar retailers, your mom-and-pop store down the street, when it comes to stopping the sale of counterfeit or illicit products. If they take commonsense, easily achievable steps like asking sellers for key pieces of needed information, implementing proactive measures for screening listings before displaying the goods to the public, and denying their platform to repeat infringers they will clean up their own sites and achieve safe harbor from the legislation’s tough liability provisions. And if they don’t, they expose themselves to liabilities that will make hosting counterfeits more than just a cost of doing business.