Welcome back to your weekly fix of cyber news, analysis and research.

The New York Times reported ^[1] last Saturday that, back in 2013, President Barack Obama ordered cyber sabotage operations against Pyongyang’s nuclear weapons program. The persistently high failure ^[2] rate of the US’s kinetic antimissile weapons, despite significant investment, reportedly prompted Obama to consider a cyber supplement. The project to pre-emptively undermine missiles in their development stages, known as a ‘left of launch ^[3]’ strategy, receives dedicated resources at the Pentagon and is now President Trump’s to play with. However, experts are concerned that this kind of cyber offensive approach sets a dangerous precedent ^[4] for Beijing and Moscow, particularly if they believe that US cyber operations could successfully undermine their nuclear deterrence capability.

Staying stateside, the future of the NSA’s spying powers are under scrutiny ^[5] this week as elements of the Foreign Intelligence Surveillance Act (FISA) approach sunset. Section 702 ^[6] of the Act forms the basis for the NSA’s monitoring of foreign nationals’ communications around the globe in the interests of national security. It was under this FISA authority that the US’s infamous “big brother” program PRISM—revealed ^[7] in the Snowden disclosures of 2013—was established.

While the legislation is designed for foreign targets, there have long been concerns it could be used to surveil US citizens through their contact with foreigners. Human rights advocates such as the American Civil Liberties Union are protesting ^[8] the renewal of this legislation in defence of international privacy. The issue also has the trans-Atlantic data-sharing agreement on thin ice, especially given that EU Justice Commissioner Vera Jourova has made it clear that she ‘will not hesitate ^[9]’ to suspend the painstakingly crafted arrangement should the US fail to uphold its stringent privacy requirements.

That task may be even more difficult after WikiLeaks’ overnight release of a dossier, dubbed ‘Vault 7’ ^[10], detailing the CIA’s cyber espionage tools and techniques. WikiLeaks released over 8,000 documents ^[10] it claims were taken from a CIA computer network in the agency’s Center for Cyber Intelligence. The documents detail the agency’s expansive and sophisticated ^[11] cyber espionage capability, including compromising the security common devices and apps including Apple iPhones, Google’s Android software and Samsung televisions to collect intelligence.

China’s Foreign Ministry and the Cyberspace Administration of China this week launched ^[12] the country’s first International Strategy of Cooperation on Cyberspace. The Strategy outlines China’s basic principles for cyber diplomacy and its strategic goals in cyberspace. Encouragingly, the Foreign Ministry’s Coordinator for Cyberspace Affairs Long Zhao stated ^[13] that ‘enhancing deterrence, pursuing absolute security and engaging in a cyber arms race…is a road to nowhere’. Unsurprisingly, the Strategy offers strong support for the concept of cyber sovereignty, stating that ‘countries should respect each other’s right to choose their own path of cyber development’, and emphasises the importance of avoiding cyberspace becoming ‘a new battlefield’. You can read a full English language version of the Strategy here ^[14].

The revelation ^[15] that the Australian Signals Directorate (ASD) was temporarily forced to rely on diesel generators during last month’s heat wave has prompted the government to significantly upgrade to the agency’s infrastructure. The Minister Assisting the Prime Minister for Cyber Security told Parliament on Wednesday that it was recommended by ActewAGL and the NSW Department of Environment that ASD switch to back up power on 10 February as part of state-wide load shedding to protect power supplies. The new $75 million project, funded by the Defence Integrated Investment Program, is intended to bolster the intelligence agency’s resilience.

Several cyber incidents have kept the internet on its toes this week. The Amazon Simple Storage Service cloud hosting service went down last week, knocking hundreds of thousands ^[16] of popular websites and apps offline. The disruptive incident, originally described by the company as ‘increased error rates ^[17]’, was actually not the result ^[18] of cyber criminals or hacktivists, but that of an employee’s fat fingers entering a command incorrectly—whoops! Yahoo is in the doghouse (again) with the awkward announcement in its annual report ^[19] to the Security and Exchange Commission that 32 million customer accounts are thought to have been compromised through forged cookies. This isn’t to be confused with the entirely separate ^[20] and very embarrassing loss of 1 billion accounts in a 2013 breach, which recently cost the company $350 million in its acquisition deal with Verizon ^[21] and CEO Marissa Mayer her annual cash bonus ^[22]. And if you’ve been tracking the #cloudbleed ^[23] saga, catch up with some post-mortems here ^[24], here ^[25] and here ^[26].

Finally we’ve got you covered for your weekly cyber research reads. A new Intel report, written by the Centre for Strategic and International Studies, examines the discrepancies in cyberspace that put defenders at a disadvantage. Titled Tilting the Playing Field: How Misaligned Incentives Work Against Cybersecurity ^[27], the report reveals the gaps between attackers vs. defenders, strategy vs. implementation and executives vs. implementers, offering recommendations to overcome such obstacles. And get your fix of statistics from PwC’s annual Digital IQ ^[28] assessment based on a survey of more than 2,000 executives from across the world. The research reveals that only 52% of companies consider their corporate Digital IQ to be ‘strong,’ a considerable drop from 67% last year.