Creating and Implementing a Liability Regime for Software Vendors
Insecure software is a national security risk, costs the U.S. billions of dollars annually, and exposes users’ information to malicious actors. Software developers (vendors) who fail to securely develop their products currently face few legal repercussions, even if they engage in industry-agreed bad practices. Without a current legal framework holding vendors accountable for their products, users assume most (if not all) the risk when cyberattacks occur. Therefore, to ensure the responsibility for secure software is appropriately vested in the entities creating, maintaining, and profiting from its use, a federal torts-based software liability regime should be implemented, and the Department of Justice (DOJ) should collaborate with state attorneys general (AGs) to initiate lawsuits under state laws.
Gotta Track’em All: Data Privacy and Saudi Arabia’s Pokémon Go Acquisition
In a given month, more than 100 million people open Pokémon Go—the app that allows users to superimpose the world’s most profitable media franchise onto reality using only their smartphone. Using their phone camera and a flick of the wrist, they captured tiny digital monsters at the park, at the office, sometimes in active minefields, and, yes, in the bathroom.
Who else was watching?
Pokémon Go, initially developed by Niantic in 2016, uses augmented reality (AR) to blend the virtual world of Pokémon with the physical world around players. By accessing a smartphone’s camera, GPS, and motion sensors, the game overlays digital Pokémon onto real-world environments, requiring players to physically move to specific locations to 'catch' them. The game’s seamless blending of the digital and physical world made it an immediate smash hit (its ties to Pokémon probably didn’t hurt, either). But underneath that immersive experience are important privacy concerns about how much personal information is being collected, who controls it, and how it’s being used.
Primer on the Costs of Cyber Espionage
Cyber espionage is the use of cyber tools and techniques to gather intelligence or steal sensitive information from targeted entities. This form of espionage poses significant risks to national security, economic stability and corporate integrity. Given the complex and often hidden nature of cyber espionage activities, accurately measuring their costs presents a significant challenge. Traditional accounting methods and mental models of espionage may fall short in capturing the full impact of cyber espionage and recovery from these incidents, particularly those costs related to intangible assets such as brand reputation and competitive advantage. Measurement methodologies today may not be effective in capturing the full range of costs in years to come as actors adapt and tactics like supply chain attacks post costs to an ever-wider range of third parties as part of cyber espionage targeting a particular organization. Accurately measuring the costs associated with cyber espionage is thus an evolving problem space with direct implications for policy.
Mythical Beasts and Where to Find Them
Despite its contribution to human rights harms and national security risks, the proliferation of spyware remains rife. A significant channel for this proliferation is sale through a global market, of which most public information is known about only a handful of vendors. While some of these entities have achieved infamy, like NSO Group and the Intellexa Consortium, most others have largely flown under the radar.
The Mythical Beasts project addresses this meaningful gap in contemporary public analysis on spyware proliferation, pulling back the curtain on the connections between 435 entities across forty-two countries in the global spyware market. These vendors exist in a web of relationships with investors, holding companies, partners, and individuals often domiciled in different jurisdictions.
Markets Matter - A Glance into the Spyware Industry
The Intellexa Consortium, a complex web of holding companies and vendors for spyware and related services, have been the subject of recent, extensive sanctions by the US Department of the Treasury and the focus of reporting by the European Investigative Collaborations among others. The Consortium represents a compelling example of spyware vendors in the context of the market in which they operate—one which helps facilitate the commercial sale of software driving both human rights and national security risk. This paper addresses an international policy effort among US partners and allies, led by the French and British governments, as well as a surge of US policy attention to address the proliferation of this spyware.