Course Syllabus

Jump to Today

Course Assignments:

Access to reading materials: All materials assigned for the course syllabus are available through the Tufts library system. Please see note regarding the Book Review assignment.

Group discussion preparation: Except for April 7 when you will all be doing presentations, beginning on January 27, each class will include 20-25 minute breakout sessions. The discussion groups will be small; size will depend on course enrollment, but is likely to be around 6 students. Each group will have two students in charge of leading the discussion (this is a rotating responsibility that will change weekly). That week's group leaders will meet with me prior to class—most likely on Mondays—having prepared a set of questions and discussion points for the group discussion. After each group has cycled through its group leaders, I'll create a new set of groups so that you'll have a chance to mix with multiple students during the term.

Written material by the group leaders will be due Sunday night at midnight before the group discussion on Wednesday. Grading will be based partially on the written materials and partially on the response of the group to the quality of discussion. Preparation for and running the group discussion will count 20% of the grade.

Briefing memo: On December 14, 2020, the EU announced its Cyberstrategy for the Digital Decade. Pick one of the strategic initiatives outlined in 3 of the FAQ and write a 1000-word briefing document for the chair of the Senate Foreign Intelligence Committee explaining what the initiative is about, its likelihood of success, and, if applicable, why it is being addressed now. This is due February 12 and is worth 10% of the grade.

Two-part "not-quite-a-simulation" exercise:

Part 1: country analysis: You will write a short—2000-word—briefing paper on the cyber threats facing a particular nation. I am in the process of preparing that list, but it will be one of the nations that we have not studied in class (the list will be available by beginning of term). The analysis will need to take into account historical and current enemies, the nation's dependence on cyber, the level of sophistication of its cyber defense, and the level of sophistication of its adversaries. The discussion must be fact based, logical, and analytical. More details will be forthcoming. The analysis will be due March 14 and is worth 25% of the grade.

Part 2: response and presentation: This is a group project; you will be divided into groups by the nations you've picked for Part 1 (I'll limit how many of you can pick a particular country). On March 17th I will provide each nation with a scenario; your job will be to develop a response. You will prepare a group written response (1500 words) and a presentation for the April 14 class. The length of the presentation is not yet determined (it depends partially on enrollment). The group briefing document and presentation will count 15% of the grade.

Book review:  There are many popular books on cyber threats, many written by journalists. These can be useful in beginning the education of someone who is new to the field. I have chosen some of the most important recent ones (one will be published this spring).  The final assignment will be a two-part book review from the following list or a book of your choice (the latter choice must be approved in advance by me).

The first part of the assignment is a 1500-word review of the text with an assessment as to accuracy, where accuracy includes whether the author has focused on the most important cybersecurity issues. The second is a 300-word briefing to the newly appointed chair of the Senate Intelligence Committee, whose previous experience in cyber is minimal, as to why they should—or should not—read this book and what issues the policymaker should expect to learn from the text. One constant in cyber, and especially cyber conflict, is change; your review and briefing should take these into account (albeit in different ways). This assignment is due April 30 and is worth 20% of the course grade.

Andy Greenberg, Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers, Doubleday, 2019.

Shane Harris, @War: The Rise of the Military-Internet Complex, First Mariner Books, 2014.

Nicole Perlroth, This is How They Tell Me The World Ends, Bloomsbury Publishing, 2021.

David Sanger, The Perfect Weapon, B\D\W\Y Broadway Books, 2018.

Adam Segal, The Hacked World Order, Public Affairs, 2016.

P. W. Singer and Allan Friedman, Cybersecurity and Cyberwar: What Everyone Needs to Know, Oxford University Press, 2014.

Kim Zetter, Countdown to Zero Day: Stuxnet and the Launch of the World's First Cyberweapon, Crown Publishing, 2015.

Important Note regarding the Book Review: All of the proposed books are available through the Tufts library, but only Cybersecurity and Cyberwar allows unlimited users at a time. I recommend that early in the term, you chose a book and ensure that you will have access to it, either by obtaining a copy or by reading it early if it is not one of  with unlimited access.

Class participation: Participating in discussions is an important aspect of this class despite its remote nature, and we'll have weekly breakout sessions to facilitate discussion. There may be an occasional single paragraph response to the readings due before class. The two will combine to be 10% of the grade.

 

Syllabus:

Please note: I may add some additional material to the reading list; assignments and order of classes are fixed.

 

January 20: Introduction to the Conundrum: Why is it that thirty-five years after the first cyber exploit, cyber incidents are growing more serious? More pointedly, what are the causes for the failure to reach international agreements on securing aspects of our digital infrastructure? Today's class will provide an overview of the technical, political, and economic reasons behind the world's growing cyber conflict.

 

January 27: History of Attacks, Part I: What is the nature of cyberconflict? What did "attacks" look like during the initial period (1986-2010) of cyberconflict? What were nation-state responses? Were they appropriate? Why or why not?

Readings:

 

February 3: History of Attacks, Part II (including disinformation): In what ways did international international cyberconflict change over the 2010s? What caused these changes? What does that bode for the future?

Readings:

 

February 10: The Technical Side of Cyberweapons:  How do cyberweapons work? What role do vulnerabilities play? How is their use controlled? Is the use of vulnerabilities really controlled?  How did we end up here?

 

February 17: Cyber Conflict: US and European Perspectives: What is current US cyber strategy? Is this strategy likely to be successful?—and what does success actually mean?  How is US cyber strategy different from that of its close allies?

Readings:

 

February 24: Cyber Conflict: Perspectives from Russia and China: Russia and China both focus on "information security" rather than "cyber security." What's the distinction and why is it important? Both Russia and China entered the cyber domain significantly later than the United States, yet seem to have succeeded in "attacking" to the U.S. Does that mean US policy "failed"?

Readings:

 

March 3: Perspectives from smaller players—and the role of non-state actors: What do North Korea, Iran, and Israel hope to accomplish in cyber? What level of capabilities do they need to do so? What type of roles do non-state actors play? How does one determine if these are proxies or independent actors? What impact do they have on state actions in cyber? How capable are states of controlling such adversaries?

Readings:

 

March 10:  Deterrence and Attribution: Can deterrence theory apply within the cyber domain? What is the "attribution problem"? Is it a serious problem, and if so, in what ways?

Readings:

 

March 17: The Role Laws and Norms Play in Limiting Cyberattacks: Why have law and norms failed to provide protection against cyber exploits and attacks? is the flaw in policy? Is the failure a result of the technology? Or something else?

Readings:

 

March 24: No class (Fletcher spring break)

 

March 31: The Role of Policy and Ethics in Cyber Conflict: Cyber is a mixed battlefield. Stuxnet leaked out of Natanz. While it didn't destroy equipment elsewhere, its capabilities were duly noted—and the cyber arms race escalated. NotPetya destroyed infrastructure not just in Ukraine but around the world. A civil-sector company, Solar Wind, was used as a vector to exfiltrate and perhaps prepare a battlefield against the U.S. What are a nation's obligations as it develops cyber weapons and attacks? Is a "Digital Geneva Convention" possible?

Readings:

 

April 7: Cyber Conflict "Off the Battlefield": With its peculiar mix of private and public sector control, international cyber conflict plays out in multiple domains, including heavily in the private sector. How important to national security are the conflicts over Internet governance, Internet standards, and privacy?

Readings:

 

April 14: Class presentations

 

April 16:  On April 16-17, the Cyber Security and Policy Program will be hosting our third annual Student Symposium in Cybersecurity Policy, which is largely devoted to high-level and insightful discussions of student research papers; papers in previous years have subsequently appeared in law journals, been discussed in Lawfare, and elsewhere. You're urged to attend (12:45-4:30). Dr. Ian Levy, Technical Director of the UK's National Cyber Security Centre, will be giving the keynote on April 16. Sign up with joshua.anderson@tufts.edu.

 

 

April 21: What Might the Future Bring?

Readings:

 

 

Course Summary:

Date Details Due