黑料正能量

On Wednesday, April 20, 2022, the Office of 黑料正能量鈥檚 President Celeste M. Schenck hosted the ninth and penultimate event in its Presidential Lecture Series: a lecture by David Wright, Director of Trilateral Research. The Presidential Lecture Series, titled 鈥淭echnology and the Human Future,鈥� invites speakers to participate in live online events, so they might engage with both theory and practice in responding to the question of how technology will continue affecting our lives beyond the Covid-19 pandemic. Wright presented on the topic of 鈥淭he Ethics of Technological Self-Defence.鈥澛�

David Wright founded Trilateral Research in 2004. The company provides research, data protection and platform services to a wide range of clients, from law enforcement authorities to universities, museums, hospitals and government agencies. Trilateral has taken part in more than 70 EU-funded projects, including the ongoing CC-DRIVER project on the human and technical drivers of cybercrime, which Wright coordinates. One aspect of this project was a socioeconomic impact assessment of cybercrime, which suggested that the costs of cybercrime are rising by around 15% a year.聽聽

Wright began his lecture by exploring the reasons for this increase. He noted that the 鈥渁ttack surface鈥� of cybercrime is increasing due to the advent of the Internet of Things. 鈥淥ne would not normally think of one鈥檚 refrigerator or television as an attack instrument, but such is the case,鈥� he explained. He also noted that cyberattacks are remaining undetected for longer, and that the chances of a cybercriminal being prosecuted are extremely low. 鈥淚t鈥檚 a crime that can be committed virtually without punishment,鈥� noted Wright.聽聽

Next, he explored how AI systems may lead to further cyberattacks, both by advancing current threats and by generating new technologies like deepfakes. AI systems themselves are also vulnerable to attack through methods such as model inversion and training data manipulation. AI-era malware may make it harder for individuals to protect their financial information or patterns of daily life, increasing opportunities for blackmail. Law enforcement authorities are unable to deal with the level of attacks currently being experienced by companies around the world, as they lack the relationships with private sector actors necessary to promote what Wright calls 鈥渁ctive defence.鈥澛�

Wright defined active defence as a 鈥渟et of measures aimed at repelling attacks,鈥� which could either disrupt adversaries or enable network defenders to detect and respond to malicious activities. However, he noted that such methods are a 鈥済rey zone鈥� that raise several ethical considerations. Active defence measures range from basic cybersecurity protocols and naming and shaming offenders to online bounties, asset recovery and pre-emptive hacking strikes. Companies don鈥檛 always have the legal right to engage in such measures outside of their own networks. 鈥淎 business cannot legally retrieve its own data from the computer of the thief who took it without court-ordered authorization,鈥� noted Wright.聽聽

Wright argued that, ideally, cyberattack responses should serve as deterrents and be proportional, legal and ethical. Responses should also have the blessing of governments and should not harm innocent third parties or violate the EU charter on fundamental rights. He noted, however, that the right to privacy posed problems for active defence, as enforcing transparency in this sector would run the risk of exposing governments鈥� offensive cyber capabilities. Conversely, companies do not always have confidence in governments to protect them from cyberattacks without a two-way flow of information. He argued for greater collaboration between governments and private sector entities when implementing active defence in order to develop an EU-wide framework that indicates which active defence measures can be used in each circumstance and by whom.聽

After the lecture, Wright took questions from the audience. You can see the whole presentation and Q&A in the video below.聽