New analysis out on the new UN forum on cybersecurity and how diplomats can tweak it for the better ⬇️ bindinghook.com/how-cyber-di...

Hörtipp, allerdings shameless self-promotion: @danielvoe.bsky.social und ich haben mit Nana Brink für den SWp-Podcast über Europas Abhängigkeiten im Tech-Bereich gesprochen und welche Handlungsmöglichkeiten bestehen.

New @veracode.bsky.social report on the security risks of software written by LLMs: "Across all models and all tasks, ... in 45% of the tasks, the model introduces a known security flaw into the code. Security performance has been largely unchanged over time, /1

Die Ausgangsvoraussetzungen sind nicht ideal, aber Deutschland hat mehrere Möglichkeiten, den globalen Cybersicherheitsdialog der Vereinten Nationen auf Erfolgskurs zu bringen, schreibt @alexandrapaulus.bsky.social im Tagesspiegel Background (Paywall): background.tagesspiegel.de/it-und-cyber...

Neuer Gastbeitrag📝Cyberdiplomatie bei den Vereinten Nationen: Was Deutschland jetzt tun sollte Die #UNcyberOEWG hat beschlossen, den 1. permanenten VN-Cybersicherheitsdialog zu etablieren. tl;dr: Die Modalitäten sind not great, aber die deutsche Diplomatie kann an einigen Stellschrauben drehen./1

1/ China’s cyber capabilities didn’t start top-down, they started with raw hacking talent. The new CSS/ETH report "Before Vegas" traces how informal talent shaped China’s cyber ecosystem, moving from online forums to industry leaders (link in thread).

United Nations Open-Ended Working Group on Cybersecurity (#UNcyberOEWG) adopts final report, establishing - for the first time - a permanent mechanism on cybersecurity at the United Nations. The content of the report and the modalities of the permanent mechanism are far from perfect, /1

🚨 NEW PAPER on the 0day Supply Chain 🚨: I gathered open source data & interviewed Gov employees, VR and china researchers to figure out what the zero day marketplace looks like in the U.S. and how it compares to China. key findings below ⬇️- 0/🧵 
www.atlanticcouncil.org/in-depth-res...

This is one of my go-to reading lists every year! Looking forward to catching some new recommendations

Thanks for the reminder @janemunday.bsky.social. Every summer, I repost this article DROWNING DOES NOT LOOK LIKE DROWNING. To date, I know of FOUR kids who were saved after someone who'd clicked on the link learnt how to spot actual drowning. Take time to read and pass on. slate.com/technology/2...

Oh... www.wired.com/story/cfpb-q...

Das Wildschwein von Kleinmachnow ist zurück! www.faz.net/aktuell/gese...

What is common knowledge in your field but shocks outsiders? The vast majority of software products contain known vulnerabilities, waiting for threat actors to exploit them. Also: almost all proprietary software depends on open-source components (many of which people maintain as a hobby).

In times when good news is scarce, a reason to be cheerful for fans of the War on the Rocks Bombshell pod: The crew is back! Now branding as Sirens, three fabulous women discuss all things natsec. So looking forward to this.

Yesterday, the EU published an International Digital Strategy [1]. It outlines 3 key objectives: 1. Boost the EU’s tech competitiveness through economic and business cooperation, 2. Promote a high level of security for the EU and its partners, and /1

In 2024, the British and French governments launched the Pall Mall Process to bring together states and non-state actors to tackle the proliferation of commercial cyber intrusion capabilities. @alexandrapaulus.bsky.social ‪looks at what it has achieved so far and what more needs to be done.

How can states tackle the proliferation of cyber intrusion capabilities, from #spyware to exploit marketplaces and hackers for hire? If this issue keeps you up at night, take a look at my analysis of the #PallMallProcess, just published by @lawfaremedia.org.🧵⬇️/1 www.lawfaremedia.org/article/tack...

This is gonna be my go to answer now when ppl ask me how my research is going

For the first time, France publishes a cyber attribution statement, pointing the finger at Russia for several operations over the past years. www.reuters.com/world/europe... This is a policy shift as France previously never attributed publicly: www.lawfaremedia.org/article/fran...

🇷🇺💻🇳🇱 Russian state-sponsored hackers attempted to sabotage Dutch critical infrastructure in attacks this year and last, according to the Dutch Military Intelligence annual public report, published Tuesday.

“Under pressure from the Elon Musk-led Department of Government Efficiency, nearly all the staff of the Defense Digital Service — the Pentagon’s fast-track tech development arm — are resigning over the coming month” www.politico.com/news/2025/04...

"minutes after DOGE accessed the [National Labor Relations Board]'s systems, someone with an IP address in Russia started trying to log in... Whoever was attempting to log in was using one of the newly created DOGE accounts — and ... had the correct username and password" www.npr.org/2025/04/15/n...

Another example of how Europe (and the world) depend on (things funded by) the US government for the current cybersecurity ecosystem. Here: The CVE database, so far sponsored by DHS's CISA. Without it (or a comparable platform), tracking vulnerabilities would be much harder. Not ideal.

1. LLM-generated code tries to run code from online software packages. Which is normal but 2. The packages don’t exist. Which would normally cause an error but 3. Nefarious people have made malware under the package names that LLMs make up most often. So 4. Now the LLM code points to malware.

The US is reportedly signing on to the Pall Mall Process Code of Practice for States: therecord.media/us-to-sign-p...

Write-up on last week's Pall Mall Process conference in Paris by @alexmartin.bsky.social, with a few comments by yours truly ⬇️

If the iPhone can add details to existing contacts without intervention from the user as is suggested in this article, it poses pretty extraordinary risks to journalists, lawyers, activists and others. Not to mention national security advisers.

📨 Service post: New SWP think tank digest on cybersecurity, emerging tech + digital policy now available! 📨 📚 Struggling to keep up with all the fascinating think tank publications in the field? Well, so were we. 🧵/1

On my way to Paris for the Pall Mall Process Conference to discuss how states can understand and shape the market for commercial cyber intrusion capabilities. Looking forward to discussing how to move this process forward and build on the Code of Practice, which will be endorsed at the conference.

CfP for the The Hague Conference on International Cyber Security is out! Traditionally a strong conference for cyber diplomacy issues, plus early career scholars are welcome and travel funding is available for all accepted paper-givers ⬇️

Very much looking forward to today's discussion on "Ransomware as a national security threat"! I will discuss threat landscape, policy responses and ways forward with @maxwsmeets.bsky.social (@ethzurich.bsky.social) Jiro Minier (DCSO) Dr. Katja Papenkort (@bmi.bund.de) Nils Steinhoff (@diplo.de)

Ich freue mich, heute bei der Sitzung des Arbeitskreises Sicherheitspolitik des Bitkom einige Überlegungen zu Cybersicherheitspolitik-To Dos für die nächste Bundesregierung teilen zu können, besonders mit Blick auf das Thema Umgang mit Software-Lieferketten-Risiken.

Come work with me! Wir suchen ab Juli eine studentische Hilfskraft, die uns im Forschungscluster Cybersicherheit und Digitalpolitik bei Forschung und Veranstaltungsorganisation unterstützt. /1

Come work with me! Wir suchen ab Juli eine studentische Hilfskraft, die uns im Forschungscluster Cybersicherheit und Digitalpolitik bei Forschung und Veranstaltungsorganisation unterstützt. /1

Very much enjoyed today's workshop on neurotechnology from a foreign and security policy perspective organized by @jhensing.bsky.social, featuring a presentation of this report by the Centre for Future Generations on the governance challenges of neurotechnology. Worth a read. cfg.eu/towards-incl...

Sean Plankey picked by Trump to be CISA director cyberscoop.com/sean-plankey...

The Ukrainian military depends on continued software updates by the US military. Without them, after some time, jammer hardware aboard F-16 fighter jets becomes useless, putting troops and hardware at risk and thus significantly reducing Ukraine's ability to defend itself. /1

Re: US cyber posture towards Russia: As per Kim Zetter's reporting, "Cyber Command has been ordered to temporarily halt current offensive cyber operations against Russia, but that planning these operations and preparing for them continues."

Four thoughts on the news that US Defense Secretary Hegseth ordered Cyber Command to stand down all planning of cyber operations against Russia [1]. 1. It is unclear what exactly the scope of the order is [1] - only plans for offensive cyber operations targeting Russia? What about military

Cybersecurity job with the Sovereign Tech Agency (formerly Sovereign Tech Fund) ⬇️

Good summary of today's Executive Order by Biden on cybersecurity - many interesting elements, incl. on software supply chain security ⬇️ The question will be whether Trump will continue the tradition of non-partisan cyber EOs that were not rescinded by subsequent presidents.

News from the #PallMallProcess: France and the UK launched this initiative last year to tackle the proliferation and malicious use of commercial cyber intrusion capabilities (fro details see our analysis www.lawfaremedia.org/article/the-...). Last week, they published a report that collects /1

World Economic Forum, Global Cybersecurity Outlook 2025: "Supply chain vulnerabilities are emerging as the top ecosystem cyber risk" www.weforum.org/publications... "Of large organizations, 54% identified supply chain challenges as the biggest barrier to achieving cyber resilience. /1

Cannot recommend this fellowship highly enough for people in the cybersecurity and tech policy space! If you have questions about the application process or program and identify as a woman or member of an underrepresented group, feel free to reach out.

I had such a great time contributing to this roundup - many thanks to @alexandrapaulus.bsky.social for the idea and invite and to my fellow contributors for their incredible recs! Looking forward to some wonderful winter reading 🤓❄️

I asked eight cybersecurity and technology experts for their favorite tech-related novels and compiled them in this holiday reading list, adding 2 of my recent favorites. I would love to hear your recommendations as well!

Need a good read for the holidays? Thanks to @alexandrapaulus.bsky.social I had the pleasure to compile a Binding Hook reading list with wonderful colleagues and to pitch my all time favorite 'Cryptonomicon' from Neal Stephenson. Enjoy our recommendations! bindinghook.com/articles-boo...

I asked eight cybersecurity and technology experts for their favorite tech-related novels and compiled them in this holiday reading list, adding 2 of my recent favorites. I would love to hear your recommendations as well!

The U.S. Naval War College’s Cyber & Innovation Policy Institute (CIPI) is pleased to invite applications for its annual Summer Workshop, taking place 28-30 May 2025. nwcevents.wufoo.com/forms/kq25g2... (Via the @virtualroutes.bsky.social newsletter) "Relevant questions for this workshop include