National Security Agency Research Articles

Understanding the Challenge of Cybersecurity in Critical Infrastructure Sectors

Abstract The cybersecurity of critical infrastructures is an essential topic within national and international security as 16 critical infrastructure sectors touch various aspects of American society. Because the failure to provide adequate cybersecurity controls within the critical infrastructure sectors renders the country open to an attack that could have a debilitating effect on security, national public health, safety, and economic security, this matter is so vital that there is the Presidential Policy Directive (PPD) 21 Critical Infrastructure Security and Resilience advances a national policy to strengthen and maintain secure, functioning and resilient critical infrastructure. An organization identified as the Cybersecurity and Infrastructure Security Agency (CISA) at the Department of Homeland Security (DHS) has the mission to be the risk advisor for the United States (US). Other organizations, such as the National Security Agency (NSA), have approved a specific Knowledge Unit (KU) to address cybersecurity for critical infrastructures associated with doctoral-level granting programs. To address this challenge, it is necessary to identify threats better and defend against them while mitigating risks to an acceptable level. Only then can a nation build a more secure and resilient infrastructure for the future while defending against present-day bad actors as cyberwarfare, cyber espionage, and cybersecurity attacks are the modern-day threats that need to be addressed in planning, designing, implementation, and maintenance. Therefore, the researchers developed a case study reviewing threats against different sectors defined in the PPD.

Robustness Test of SIMON-32, SPECK-32, and SIMECK-32 Algorithms Using Fixed-Point Attacks

SIMON-32 and SPECK-32 are a family of lightweight block ciphers publicly released by the National Security Agency (NSA) in June 2013. Meanwhile, SIMECK-32 is a lightweight block cipher based on the combination of good design components from SIMON- 32 and SPECK-32 block ciphers. In this paper, we tested the robustness of the SIMON-32, SPECK-32, and SIMECK-32 algorithms against fixed-point attacks. Block cipher fixed-points may facilitate fixed-point attacks if an adversary can control the block cipher key input. The results of fixed-point attacks on the SIMON-32, SPECK-32, and SIMECK-32 algorithms show that all three variants of the algorithm have fixed-points.

Analysis on the Construction of Knowledge Graph of Mass Events Based on Ontology

Mass incidents pose a serious threat to public order and national security, building a knowledge base in the field of mass incidents, visualizing the relationship between entities from incidents, and scientifically reasoning about key information about incidents have become key links in effectively responding to mass violence crimes. In view of the lack of existing mass incident knowledge graph analysis methods and strong subjective reasoning methods, based on the BiLSTM-CRF model, this paper analyzes event elements and entity associations by extracting entities from the text data of mass events, the protege software is used to construct the mass event ontology model, and the visualization of the mass event knowledge graph is realized based on the neo4j graph database. The research results show that the knowledge graph established in this paper can better reflect the correlation between the elements in the mass incident, and is of great significance to the national security department to improve the emergency decision-making ability.

Investigating the chemical impurity profiles of fentanyl preparations and precursors to identify chemical attribution signatures for synthetic method attribution

From an analytical chemistry standpoint, determining the chemical attribution signatures (CAS) of synthetic reaction mixtures is an impurity profiling exercise. Identifying and understanding the impurity profile and CAS of these chemical agents would allow them to be exploited for chemical forensic information, such as how a particular chemical agent was synthesised. Being able to determine the synthetic route used to make a chemical agent allows for the possibility of batches of the agent, and individual incidents using that agent, to be forensically linked. This information is of particular benefit to agencies investigating the nefarious and illicit use of chemical agents. One such chemical agent of interest to law enforcement and national security agencies is fentanyl. In this study two acylation methods for the final step of fentanyl production, herein termed the Janssen and Siegfried methods, were investigated by liquid chromatography- high resolution mass spectrometry (LC-HRMS) and multivariate statistical analysis (MVA). From these data, fifty-five chemical impurities were identified. Of these, ten were specific CAS for the Janssen method, and five for the Siegfried method. Additionally, analytical data from four different literature methods for production of the fentanyl precursor 4-anilino-N-phenethylpiperidine (ANPP), were compared to the results obtained from the method of production (Valdez) used in this study. Comparison of the LC-HRMS data for these five methods allowed for four Valdez specific impurities to be identified. These may be useful CAS for the Valdez method of ANPP production.

NSA honors two Cryptologia board members

The Cryptologic Hall of Honor is an important part of the National Security Agency’s heritage program and pays tribute to those who have made extraordinarily important contributions to America’s na...

Questions of Professional Practice and Reporting on State Secrets: Glenn Greenwald and the NSA Leaks

In 2013, journalist Glenn Greenwald met with Edward Snowden, who leaked the most documents in the history of the U.S. National Security Agency (NSA). Greenwald reported on these documents and proved that the NSA spied on millions of American citizens. However, he also provided commentary about the state of journalism and argued that journalists are often complicit in the keeping of state secrets. Using a rhetorical analysis of Greenwald's writings in The Guardian and his later book, this essay argues that journalists function as a technical audience that debates professional standards for leaking secrets. In Greenwald's case, journalists were involved in the "re-secreting" of NSA behavior as they focused their coverage on Greenwald. This essay finds that secrets are communicatively revealed and concealed using different rhetorical appeals. In an age of political hostility toward journalists, the success of leak journalism in starting public discussion has significance for democratic deliberation.

The Dynamics of the Largest Cybersecurity Industrial Clusters: San Francisco Bay Area, Washington D.C. And Israel

This report offers a multi-disciplinary perspective on the cybersecurity industry. Conceptualizing cybersecurity industry clusters as ecosystems, we focus on three distinct mega-clusters: the San Francisco Bay Area, metropolitan Washington, D.C., and Israel. Benefits of clustering include: access to a pool of specialized labor, knowledge spillover, access to capital, and inter-organizational linkages. Research suggests that clusters’ economics should be linked to their social dimensions and the configuration of the built environment. In addition, based on the empirical analysis, we suggest using a nuanced taxonomy of cybersecurity clusters using a spectrum of intensities: mega-, mesa- and micro-clusters, sub-clusters, and hot zones. The Big3 clusters were catalyzed during the 1990s cybersecurity genesis – even before cybersecurity was recognizable as a distinct sub-industry within high-tech – and certainly well before the term “cybersecurity” was coined. All three cybersecurity clusters emerged as specialized clusters embedded within a larger high-tech ecosystem. At the same time, government was a key actor in facilitating the high-tech and defense ecosystems in each of these three regions. Cluster concentration remains high: the Big3 mega-clusters, hegemonic since their founding, together serve as headquarters for 53% of the largest and most influential global cybersecurity firms. Cybersecurity industry dynamics. The industry can be viewed as a manifestation of two far-reaching relationship interplays: industry clustering processes and place (meaning, the industry’s socio-spatial context). Regarding the first: there is some evidence of rapid industry consolidation — especially within the Big3 clusters (393 firms merged or acquired through 2018). However, the industry still remains quite fragmented because of the continued entry of new players and the breakup of some giant firms (e.g., Symantec). The second interplay is between place and social context, human capital, and institutions. Via comprehensive mapping, we show that cybersecurity clusters are situated in large, diverse urban regions, within complex, multi-modal transportation networks, with proximate universities, and layered on household income sectors.Lessons for smaller clusters globally. Cybersecurity clusters (and sub-clusters) grow where one of two conditions exists: an anchor organization (such as the National Security Agency outside Washington) and/or where there is already a strong high-tech culture (as in Silicon Valley). Nurturing a new cybersecurity cluster is a long-term strategy, one that requires many years of patience (as in the Be’er Sheva sub-cluster in Israel). Local governments have been nurturing cybersecurity clusters specifically for about a decade with tax benefits, partnerships, and advocacy programs. However, these policies do not take place in a vacuum; rather, they are part of the ongoing competition between regions and cities. Thus, purposeful cluster growth requires more than a bundle of policies; it needs a cohesive strategic plan that structures a set of policies for nurturing the industrial ecosystem. Only with a holistic vision, which considers the social, economic and spatial context, can a cybersecurity cluster evolve and grow. Finally, we identify three cybersecurity industry/cluster challenges for the future. First is the persistent cybersecurity workforce shortage—apparent in both countries covered in this report. The second challenge is the resiliency of these high-tech clusters as the hegemony of global cities is expected to diminish post-COVID-19, with the workforce migrating out of expensive and unhealthy urban areas. The third challenge is the durability of the cybersecurity industry itself. Are there too many cybersecurity firms? Will a new generation of technologies reconfigure these firms? In sum, cyber industry cannot be understood in isolation, but only as part of a larger context. Although this industry has some unique features, cybersecurity clusters are not autonomous, and their emergence is connected to a wider technological infrastructure, and to a particular political urban and regional context.

A bridge too far? An academic-national security practitioner dialogue on research collaboration across the divide

ABSTRACT In a well-known article, Marc Sageman (2014, The stagnation in terrorism research. Terrorism and Political Violence, 26(4)) foregrounds what he calls the ‘unbridgeable gaps’ between national security agencies and academics on the question of accessing and analysing the empirical data upon which innovative terrorism research depends. Yet while the divide between academic research and national security policy and practice can be pronounced, it is also mediated by the existence of common territory. This includes ideas about what constitutes ‘the public good’, despite bringing varied institutional, personal and philosophical approaches to how that good is understood and enacted. At their best, where these collaborations are embraced and nurtured, they can become unparalleled opportunities for expanded learning, constructive provocation and informed debate, bringing different forms of expertise to bear on understanding and reducing the risks and impacts of terrorism. At their worst, they can be minefields of compromised independence, ethical and reputational wounds, censorship, exploitation, and hollow research and policy agendas. We take up these issues through an edited collaborative dialogue between an academic and a national security practitioner, drawing on both the scholarly literature and our own experience as collaborators to explore the benefits, conflicts and risks of academic-national security collaboration.

A Framework for Fine-Grained Nonlinearity Optimization of Boolean and Vectorial Boolean Functions

Boolean functions and vectorial Boolean functions (S-boxes) are widely used cryptographic primitives for achieving cryptanalytic resistance of modern block or stream ciphers. In the aspect of information security, one of the most desirable characteristics a given S-box should possess is a high nonlinearity. In this paper, we project the nonlinearity optimization problem to the domain of binary integer programming. Then, we demonstrate how this interconnection could be successfully exploited by SAT solvers. The provided toolbox could serve in cases, where the designer’s goal is to increase (or intentionally decrease) the nonlinearity of a given S-box by applying as minimum changes as possible. For example, we demonstrate how the Skipjack S-box, developed by the U.S. National Security Agency (NSA), and the Kuznyechik S-box, developed by the Russian Federation’s standardization agency, could be optimized to a higher nonlinearity by tweaking, respectively, just 4 and 12 bits (out of 2048). In the end, we show that bijective (8,8) S-boxes, the eight coordinates of which possess the currently known optimal nonlinearity value of 116, do exist.

THEORETICAL AND APPLIED ASPECTS OF PUBLIC ADMINISTRATION IN THE FIELD OF NATIONAL SECURITY OF UKRAINE: RETROSPECTIVE ANALYSIS

The article is assigned to the researcheses of problems of public administration in the national security from the point of view of retrospective analysis. The emphasis is on respect for the fact that the state policy in the spheres of national security and defense is focused on the defense of the most important rights, legal interests and guarantees, in particular, man and citizen - their life and dignity, constitutional rights and freedoms, safe living conditions; society - its democratic values, prosperity and conditions for sustainable development; the state - its constitutional order, sovereignty, territorial integrity and inviolability; territory, environment - from emergencies. The outlined postulates occupy a prominent place in domestic legislation and become a fundamental basis for the implementation of various programs and concepts aimed at their practical implementation in public life. At the same time, in order to achieve the outlined aspects, the question of the theoretical foundations of public administration of national security in the context of retrospective analysis shall be important. Based on the results of doctrinal and comprehensive research, it is concluded that the theoretical and methodological difficulties of the retrospective concept of "national security" also allow us to conclude that it is expedient to consider not only the concept of "security" but also the concepts of "nation" and "nationalism" to find out what meaning is embedded in the concepts of "national interests" and "national values". Therefore, an important step that to some extent allows us to reach a consensus on the concept of "national security" is to consider the concept of "nation" and the phenomenon of the phenomenon called "nationalism". At the same time, the isolation of certain factors in the context of national security should be considered a temporary aspect, as it is only possible to assert the priority of certain national interests in these areas in a historical period of society and state, and hence the corresponding priority ensuring their implementation. Moreover, the long-term preference of one or another area under certain conditions may even be a threat to national security. Ignoring national interests in other areas ultimately leads first to a reduction in the potential of the state, and then to an integrated level of national security. The advantage that can be given to one or another sphere of national security is justified only under certain extraordinary conditions.

A mesterséges intelligencia belügyi és biztonsági célú alkalmazása

Összefoglalás. A tanulmány célja a mesterséges intelligencia (MI) belügyi és biztonsági célú alkalmazásának bemutatása, különös figyelemmel az arcfelismerő rendszerek és egyéb MI alapú megoldások rendvédelmi, nemzetbiztonsági, valamint önkormányzati és vízgazdálkodási területen való alkalmazásának lehetőségeire, adatvédelmi és kibervédelmi szempontjaira. A tanulmány ennek kapcsán mind az irányadó magyar és európai uniós előírásokat és célkitűzéseket, mind az MI-re irányadó hatósági gyakorlatot számba veszi és ismerteti, valamint ezek tanulságait összefoglalja és kiértékeli az egyes MI alapú megoldások sajátosságainak figyelembevételével. Summary. The purpose of the study is to take a closer look on the application of artificial intelligence (AI) concerning internal affairs and for security purposes, with a key focus on facial recognition systems and other solutions used by law enforcement and national security agencies to answer new challenges posed by cybercrime and criminal networks spreading through the cyberspace. In the light of the above, the study further takes into account the risks associated with the usage of AI solutions concerning internal affairs and for security purposes and tries to find possible measures to minimize them. Bearing this in mind, the study highlights the key relevant Hungarian and European Union requirements and goals, including the approach of the European Union concerning biometric identification and the Hungarian AI Strategy’s vision on the usage of AI based solutions for administrative, law enforcement, defense and military national security purposes. The study further analyzes the practical aspects of the usage of AI solutions by law enforcement agencies and the key aspects of facial recognition systems and other similar solutions. This includes the territory affected by the system, the period of monitoring, the human revision of the results presented by the algorithms, as well as data security minimum requirements and the rights of data subjects affected by AI solutions (e.g. sufficient information provided on the processing of their data in accordance with the national and public interests related to the usage of AI solutions). In addition to the above, the study further discusses the use of AI solutions by national security agencies, including the aspects of monitoring dark web activities conducted by criminal and terrorist organizations and ways for national agencies to intercept messages and gather evidence by new solutions in line with data protection and constitutional requirements. Finally, the study helps us understand, how AI based solutions can be used for facilitating everyday work of local governments (with a key focus on chatbot services and self-service opportunities) and for solving water management related tasks more efficiently, thus creating a more modern administration, where citizens can easily interact with administrative bodies and technical or simpler tasks are undertaken by algorithms. All in all, the study outlines how AI is currently used concerning internal affairs and for security purposes and how it can be used to help law enforcement and national security agencies fight new forms of crime empowered by technology or to further modernize local governments and water management systems and apply AI based solutions in accordance with data protection requirements and procedural laws.

Interagency Coordination on Labor Regulation

After 9/11, Congress, federal agencies, and scholars exposed the devastating results of the national security agencies’ failure to coordinate. The financial crisis has been linked to similar coordination failures in the context of interagency banking regulation, with jurisdictional gaps and blind spots resulting in failure to prevent a global recession. But despite Gilded Age-levels of inequality, little attention has focused on the failures of interagency coordination to secure Americans’ access to economic opportunity through work — whether through securing higher wages and higher union density, coordinating government enforcement to achieve redistributive goals and combat consolidation of employer buyer power, or overcoming systemic abuses in employers’ wage theft, discrimination, and worker mistreatment. The crippling spread of the coronavirus (COVID-19) pandemic demands that now, more than ever, agencies coordinate in their regulation of labor markets to accomplish micro- and macroeconomic policy goals.This Essay is a component of a larger project that seeks to document federal agencies’ selective coordination along six core policy vectors that impact work- or income-based avenues towards equality — macroeconomic, microeconomic, institution-building, industry-specific, anti-subordination, and democratic/expressive policy. It presents the results of a novel data set collecting and systematizing existing Memoranda of Understanding (MOUs) authorized by the core agencies involved in labor market regulation: the Department of Labor (DOL), its sub-agencies, the National Labor Relations Board (NLRB), the Equal Employment Opportunity Commission (EEOC), the Department of Justice-Antitrust Division, and the Federal Trade Commission. By hand-coding and analyzing the 112 discoverable MOUs from the 1950s to the present, the Essay presents a novel history of interagency coordination on labor regulation, highlighting which labor agencies coordinate most and least, what such coordination facilitates as a substantive and administrative matter, and the broad scope and areas of labor market regulation on which coordination has not yet occurred. It concludes by arguing that the federal government lacks a coherent, aligned vision on labor market regulation and economic mobility through work, and proposes next steps for improving agency coordination.

Contributions of Religious Actors to Peace and Security

AbstractThe past decade has seen a shift of rhetoric, where religious actors are presented not just as aberrations in the secular and democratic order, but also as significant players in the development of peaceful and diversified societies. However, experiences of extremist religious groups raise questions about the legitimacy of involving religious actors in these kinds of processes, in particular in relation to security, which according to a classical perspective is a matter of national and international security agencies. This paper analyzes the challenges relating to the inclusion of religious actors in security situations in East Africa, particularly those involving confrontations between religious actors, in which the concept of the “religious other” has a specific reference. The main finding is that religious actors have a contribution to make in relation to security and conflict involving religion and faith, given that security is understood in a broader sense than the classical.

Home Ice Advantage: Securing Data Sovereignty for Canadians on Social Media

More than three in four Canadians use social media platforms to connect with others here at and around the world, often sharing life’s most intimate moments through public posts and private messages. In doing so, Canadians entrust these companies to secure and protect their personal data, which can include a wide range of sensitive information, such as their political opinions, or details on their sex life, personal finances and health. These companies are also entrusted to secure the sensitive data that they track and store, such as users’ location, search histories and biometric information such as facial features. But that trust is waning. Our surveys of Canadians indicate that social media platforms are the least trusted organizations in Canada to keep personal data secure and to act in the best interests of the public. As legal battles swirl between Europe, the U.S. and China over how to protect Facebook and TikTok data travelling across borders, there remain inadequate protections over how Canadians’ personal data are transferred and stored. This threatens Canadian sovereignty, and the digital security and privacy of millions of Canadians. Personal data can be accessed by national security and law enforcement agencies without sufficient legal protection under Canadian law in countries around the world. Technology companies can experience buy-outs, mergers and bankruptcy that can change where personal data are stored and the privacy protection they receive. Malicious hackers can also take advantage of data stored in locations where the data are subject to weak data protection safeguards. Social media platforms store the personal data of their Canadian users around the world, and provide little to no transparency as to where their data are stored or transferred to third parties. Canadian privacy law does not require users to consent to personal data transfer outside of Canada. Our research shows that many popular platforms transfer data to a variety of jurisdictions, and none specifically cite Canada as a country of storage. Nor are there meaningfully enforced limits on the transfer of personal data to jurisdictions with insufficient protection against surveillance or unauthorized access. In the two decades since the enactment of Canada’s current privacy law, there has not been a single fine or enforced remedy against companies transferring personal data outside of Canada with insufficient protection. Jurisdictions around the world are introducing a range of new approaches to address these challenges and ensure data protection laws extend to data moved outside its borders, including outright bans on cross-border transfer, new requirements for informed consent, and rigorous evaluations of other jurisdictions’ data protection regimes. While these notions can challenge the idea of a free and open Internet, Canadians are looking for answers — our recent survey finds that 86% of Canadians support requirements to keep Canadians’ data within Canada. This discussion paper lays out public policy options for how Canadian privacy law should protect the security and privacy of personal data stored outside of Canada. Advancing these protections for Canadians should complement ongoing efforts to advance international cooperation and governance of digital privacy and security, for example through bi- and multilateral agreements. The global fight over data is likely only to intensify in the coming years, and a key test for Canada’s sovereignty will be how it is positioned among its international peers. Canada must define its position internationally, with the U.S., China, and the European Union all showing very different models of governance. This paper is meant to advance public engagement and policy development in Canada going forward to maintain our home ice advantage.

A Study in Complexity: Unintended Consequences of Multiple Stakeholders in the U.S. Presidential Election Process

ABSTRACT In 2023, 3 years after the 2020 U.S. Presidential election, a select group of senior intelligence analysts from the National Security Agency (NSA), Department of Homeland Security (DHS), and the Office of National Intelligence met for a reunion at an undisclosed location in Virginia to recall their all-day meeting with the National Security Council (NSC) at the White House in May 2020, and to recount the watershed international events that lead to the election of President Joseph R. Biden, Jr.

Speck-R: An ultra light-weight cryptographic scheme for Internet of Things

Lightweight cryptography (LWC) is an interesting research area in the field of information security. Some limitations like: increased components usage, time consumption, power consumption and memory requirement mandate the need for lightweight cryptography. One of the proposed algorithms in this field is Speck which was designed by the National Security Agency (NSA) in June 2013. In this paper, we propose a new ultra-lightweight cryptographic algorithm based on Speck known as Speck-R. Speck-R is a hybrid cipher, combining ARX architecture with a dynamic substitution layer. The novelty in this paper resides in adding a key-dynamic substitution layer that changes according to a dynamic key. With this modification, the number of rounds can be reduced from 26 (in Speck) to 7 (in Speck-R). Thus, the main contribution of this paper consists in reducing the execution time of Speck by at least 18% on limited devices to reach a reduction of 77% while keeping a high level of security. To backbone Speck-R’s security, different security and statistical tests are exerted on Speck-R. In addition, a real hardware implementation on three different famous IoT devices is also presented where Speck-R outperformed Speck in terms of execution times. Finally, extensive tests show that Speck-R possesses the necessary criteria to be considered as a good cipher scheme that is suitable for lightweight devices.

Chilling effects and the stock market response to the Snowden revelations

This study analyzes the changes in individuals’ Internet search behavior and economic variables following Edward Snowden’s revelation of National Security Agency (NSA) surveillance activities of global Internet communications. We refer to the abrupt changes in individual search behavior beginning in June 2013 following Snowden’s revelations as the “Snowden effect.” The “Snowden effect” is a form of chilling effect. Using data from a unique search engine, DuckDuckGo, we show that chilling effects indeed exist. However, further analysis including the stock prices of the largest cybersecurity companies demonstrate a muted market response to the revelations, while cybersecurity spending data suggest resulting economic harm in the form of increased opportunity costs of buyers of cybersecurity services.

¡Abajo el secreto, viva la privacidad! Dilemas mediáticos en el asunto Snowden

Este artículo es un análisis de tres relatos periodísticos de la filtración de documentos de la Agencia Nacional de Seguridad (NSA) de Estados Unidos, llevada a cabo por Edward Snowden: un libro, una película y una entrevista. El objetivo es sacar a la luz algunos dilemas éticos y políticos que subyacen al caso. Primero, una tensión paradójica entre la exigencia de transparencia frente al secreto estatal y la necesidad del secreto personal para el derecho a la privacidad, que refleja en nuestros tiempos la dialéctica publicidad / secreto en la modernidad temprana. Segundo, la ética hack-activista enfrenta los conflictos entre anonimato y visibilidad. Tercero, los periodistas en que Snowden confía afrontan el dilema entre los deberes de la información y la protección de la confidencialidad de las fuentes. El asunto Snowden es, pues, una oportunidad para extraer algunas lecciones sobre la ética de la comunicación en la era digital.

‘Everyone Has Secrets’: Revealing the Whistleblower in Hollwood Film in the Examples of <em>Snowden</em> and <em>The Fifth Estate</em>

‘Everyone Has Secrets’: Revealing the Whistleblower in Hollwood Film in the Examples of <em>Snowden</em> and <em>The Fifth Estate</em>

Warning issued over critical infrastructure

The US National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued an urgent warning to operators of critical national infrastructure (CNI) that they may be under attack.