New initiatives from the Cybersecurity Policy & Research Institute at the University of California, Irvine will help combat one of our greatest security challenges: vulnerabilities and attacks in cyberspace.
These efforts include research on cyberattack attribution and supply chain security, the development of law enforcement training, the launch of a cyber-victims defense clinic, and a curriculum development effort for high school students. They reflect CPRI’s critical mission to develop multidisciplinary solutions to cybersecurity challenges at the intersection of technology, law and policy.
“CPRI brings together the best and brightest cybersecurity experts from the private sector and UCI’s world-class faculty to find technological, legal and policy solutions to cyber threats, while protecting and enhancing individual privacy and civil liberties,” said Bryan Cunningham, CPRI’s founding executive director.
UCI notesthat participating in CPRI are experts from academia, critical infrastructure businesses, law enforcement and other government agencies and the privacy and civil liberties community. The institute is supported and advised by its Executive Committee, which includes former Rockwell Chairman Don Beall and leaders from Qualcomm, Rockwell Collins, Verizon, Cylance, The Irvine Company, the Los Angeles Police Department, Gigamon, First American Financial Corp., IBM, the law firms of Alston & Bird and Newmeyer & Dillion, Avast, the Center for Democracy and Technology, the University of San Francisco, and the Anaheim Union High School District. In addition to the support of its Executive Committee, CPRI is supported by Monster Energy and the law firm of Rutan & Tucker.
Leading the institute is Cunningham, a cybersecurity and privacy lawyer and former Deputy Legal Adviser to the White House National Security Council. CPRI is under the guidance of the deans of the six UCI founding schools — engineering, information & computer sciences, law, physical sciences, social sciences and social ecology — as well as a Faculty Advisory Council.
CPRI’s initiatives include:
— Cyber Attack Attribution Research Project: Under this project, CPRI will research the feasibility of a holistic approach to cyber-attack attribution with the goal of enhancing the ability of government and private sector actors to learn and prove the origin of such attacks, enabling better deterrence and justice for victims. CPRI’s Legal Subcommittee has undertaken a related project with a review of potential standards-of-proof for attributing cyberattacks. This review will cover attribution proof issues under international law, in criminal prosecutions, in civil litigation and in other contexts. The project will determine the extent, if at all, to which current law is clear and will propose model laws and standards of proof for the various levels of attribution.
— Supply-Chain Security Research Project: A significant percentage of cyber breaches involve supply-chain compromise. Supply-chain- based risks include counterfeit, malware-embedded or otherwise compromised hardware and software, whether used directly by a purchaser or embedded in other devices. CPRI has identified software and other supply-chain security as a high priority research issue. In particular, the project will explore the use of blockchain – a distributed virtual-ledger technology offering security, transparency, immutability and authenticity – to better secure software and other vital supply chains.
— Enhanced Cyber Threat Information Sharing: CPRI will work to improve sharing of private sector and government cyber threat information.
— Law Enforcement Training: CPRI is working with UCI’s Division of Continuing Education and premier Southern California law enforcement agencies to support cybersecurity and digital evidence handling training for police officers and, potentially, other participants in the criminal justice system.
— Cyber Victims Defense Clinic: Generously supported by the law firm of Gibson Dunn & Crutcher and the Orange County cybersecurity firm Cylance, the new Cyber Victims Defense Clinic will launch in the fall of 2017. Led by Gibson Dunn cybersecurity partner Joshua Jessen, the clinic will provide pro bono legal and technical assistance to victims of cyberattacks. Such attacks often target the elderly and other underserved populations as well as small businesses with limited resources. The clinic also will help prepare the next generation of cybersecurity-savvy lawyers.
— Curriculum Development to Boost Future Cyber Experts: CPRI is working with the Anaheim Union High School District, Santa Ana Unified School District, Cypress College and other experts, to help develop cybersecurity curricula for high school students. This will create expertise and inspire students to pursue this job-rich field at community and four-year colleges.
