Digital Press Briefing with Anne Neuberger, Deputy National Security Advisor for Cyber and Emerging Technologies

MODERATOR:  Greetings from the U.S. Department of State’s Asia Pacific Media Hub.  I would like to welcome journalists to today’s on-the-record briefing with Anne Neuberger, Deputy Assistant to the President and Deputy National Security Advisor for Cyber and Emerging Technologies on the National Security Council.  Ms. Neuberger will discuss international cooperation on countering threats to the Indo-Pacific region posed by cyber hackers and disinformation, as well as the promise and peril of new technologies such as artificial intelligence, AI.

With that, let’s get started.  Ms. Neuberger, I’d like to turn it over to you for your opening remarks.

MS NEUBERGER:  Thank you so much, Natalie.  Hello, everyone.  It is terrific to be here in Singapore for Singapore International Cyber Week, really recognizing both Singapore’s technical leadership and convening so many talented executives and cybersecurity professionals from the Indo-Pacific region.  It’s terrific to walk the floors, hear the discussion, and see the energy and enthusiasm for cybersecurity, for artificial intelligence, and the digital economy.

So we’re here, really, representing the U.S.’s commitment to the region and commitment to the digitalization and the opportunity it offers for citizens, for economic growth in the region, and also to ensure that as the digital economy grows, it grows securely, and to address cybersecurity arm in arm with allies and partners.  Because we not only want to ensure our citizens can have the benefit of digitalization, but also the benefit of secure, open, and interoperable technologies.

Recently visited Philippines, Vietnam to discuss deepening cybersecurity cooperation, which truly shows how much the United States values ASEAN’s centrality.

In addition to the threats from nation-states, cybercrime is a real focus that the United States is looking forward to partnering in the region.  Cybercrime is a disruptive force.  We see companies, hospitals, and schools’ not only data stolen, but their operations disrupted for days and weeks, impacting the services that citizens rely on.  We see the threats to businesses.  Businesses – it’s a dollars and cents issue; it’s a cost to businesses.  And certainly, the impact to everyday people – grandmothers, grandfathers who are losing money to cybercrime.  So we are committed to addressing cybercrime.

The United States launched the International Counter Ransomware Initiative two years ago.  It’s grown to 50 countries, which we will be hosting in Washington, D.C., October 31st to November 1st, for intensive discussions, planning, and joint work together to disrupt the ransomware, the cybercrime infrastructure, to discuss how we disrupt the illicit use of crypto that’s financing cybercrime, to talk about how we build resilience quickly, building on the exercises we have done together and the commitments the U.S. has made.  And we particularly are excited about the diversity of the members and the role of Indo-Pacific – of the Indo-Pacific region and leadership.

Singapore was a founding member of the International Counter Ransomware Initiative and plays a leading role, co-chairing the policy panel which thinks about the policies our governments need to put in place to fight cybercrime.

So in closing, the United States is committed to the digital economy in the Indo-Pacific region and to the cybersecurity of that economy to ensure that our citizens, our services, and our governments can not only be online, but be safe and secure online.

And with that, I very much look forward to your questions.

MODERATOR:  Thank you.  We will now turn it to the question-and-answer portion of today’s briefing.

Our first question goes to Francesca Regalado from Nikkei Asia, based in Bangkok, Thailand.  “How will emerging cyber threats in the region be included or addressed in the Indo-Pacific Economic Framework, particularly with regard to digital economy and supply chain security?”

MS NEUBERGER:  There are a couple of ways we’re looking at, including digital and a digital track in IPEF and certainly in the upcoming APEC as well.  And that is in the area, first of all, of securing digital infrastructure, working to secure undersea cables and the rollout of advanced telecommunications, 4G and 5G, in the region.

Certainly the second piece of that is as we expect cybercrime to skyrocket in the coming years, we have statistics, for example, that cyber intrusions and attacks have resulted in over $189 billion in costs for the ASEAN southeast region; as we see that continue to grow, a commitment to help deploy cybersecurity and secure digital infrastructure in the region as well.

MODERATOR:  The next question goes to Vincent Choi from the South China Morning Post, who put his question in the Q&A.  First part of two questions, actually.  First, “In July there was a report that U.S. Secretary of Commerce Gina Raimondo was hacked by Chinese hackers right before her visit to China.  Were there any critical contents affected from this incident and how do you assess its impact on U.S.-China relations?”

There’s a second part to the question, if you would like me to pose that now or would you like to address the first part?

MS NEUBERGER:  Sure, please do.

MODERATOR:  Okay.  Secondly, “Yesterday there was a new U.S. ban to further expand export controls of U.S. chipmaking equipment.  What are the – what is the background of this new restriction and how does the U.S. Government assess China’s semiconductor capabilities and their military applications?  How do you foresee its impact on U.S.-China relations and whether the new rule could jeopardize positive momentum in recent interaction between Chinese and U.S. officials and the expected summit between President Biden and Xi in San Francisco?”

MS NEUBERGER:  Thank you for the questions.  I’ll address the first.  So first, there was a report that cloud infrastructure in the United States was attacked and impacted government officials.  First, that highlights the need that as we build out digital infrastructure in our countries, that faces significant threats and we must ensure that infrastructure is built securely.

With regard to particular incidents, those are addressed between our governments, and I won’t expand on that further here.

With regard to the second question, with regard to the new U.S. ban to further expand export controls, as Secretary Raimondo mentioned during her recent visit, the United States is committed to positive interactions between Chinese and U.S. officials, and also the need to address where there are national security risks from technologies, and the need to ensure that technologies that represent national security risks are controlled.  That’s the background of the new restriction, and because of the concern that advanced semiconductor capabilities has military applications, has applications that represent a security risk.  So within the competition in the technology space, that is the foundation for these expanded export controls.

MODERATOR:  Okay.  And I see Eunjung Cho from VOA has their hand raised.  If you could please unmute and ask your question, please do so now.  Okay.  I see also – okay, go ahead.

QUESTION:  Hi.  Thank you, Ms. Neuberger, for doing this.  How is North Korea’s cyber attacks and cryptocurrency theft funding the country’s WMD program?  And do you see an increase in North Korea’s illicit cyber activities this year?  What concerns you the most in North Korean pattern of activities?  Thank you.

MS NEUBERGER:  Thank you.  We certainly believe that North Korean hacking of cryptocurrency around infrastructure, around the world – including in Singapore, Vietnam, and Hong Kong – is a major source of revenue for the regime that’s used to finance the advancing of the missile program and the far greater number of launches we have seen in the last year.  As a result, addressing North Korean hacking has been a priority of the United States.  We formed a trilateral with Japan and South Korea to bring our governments together to tackle that together.

That includes a number of things.  You have seen the U.S. Government sanction crypto exchanges that the North Koreans use to launder stolen funds from crypto infrastructure.  You have seen the United States note the role of mixers as entities of concern regarding their role in laundering North Korean stolen funds, including the designation of several mixers, as well as information U.S. Government has been sharing with virtual asset service providers in countries around the world regarding the need to implement know your customer rules.  Because while the blockchain is public, the entities doing the transaction is not.  So we call upon virtual asset service providers, exchanges, in the region to really implement the Financial Action Task Force rules regarding know your customer to combat the role that crypto infrastructure is playing in laundering the funds that the DPRK has been hacking from infrastructure around the world.

So to be clear, this is a priority for the U.S., it’s a priority for our partnerships in the region, and we will be working ever more closely to tackle this problem together.

MODERATOR:  Thank you.  Our next question goes to Betty Hou from Bloomberg.  If you would like to ask your question, now is the time to unmute.  Please ask your question, Betty Hou.

QUESTION:  Hi, I’m Betty from Bloomberg News.  And my question is that I’d like to know what are the places or countries in the Indo-Pacific regions that are suffering the most from cybercrime.  And exactly what is the concern and risks of those crimes in the national security aspect?  And also the second part of the question is, what is the U.S. doing or what has the U.S. committed to do in terms of – in order to address those concerns?  Thank you.

MS NEUBERGER:  Thank you, Betty.  So here at Singapore International Cyber Week, I’ve had the opportunity to talk one-on-one with many important partners in the Asian Indo-Pacific region.  And in each of those conversations, cybercrime comes up.  So it sounds like it is significantly impacting citizens, companies, and infrastructure – like hospitals and schools in many, many countries in the region.   And certainly that has a national security aspect in terms of the disruption, in terms of the cost.  And as I mentioned, as we continue to bring our digital economies online, we owe an obligation to ensure that is a secure digital economy.

So the U.S. Government has made addressing cybercrime a real priority.  First, from a law enforcement perspective, shifting from investigating to actually disrupting.  You may have seen disruptions like the one against the Hive cybercrime network, which impacted and raised large sums of money, and the successful takedown the U.S. did with key partner governments around the world.  The establishment of the International Counter Ransomware regime, which is the largest cyber partnership in the world; it crosses policy, operations, and disruption in terms of bringing law enforcement together with Interpol, who’s also a member, to tackle cybercrime.

I mentioned the hosting of a two-day conference at the end of the month bringing 50 countries’ large delegations in to continue to work on this problem, including the U.S. making a commitment to share wallets – bad wallets – which have moved illicit crypto, working to continue to build capacity around how to do blockchain analysis, to continue to do resilience exercises to help countries improve their cybersecurity to really invest in capacity building in the region as well, as well as to establish common policies so that governments can more effectively tackle the cybercrime threat.

MODERATOR:  Our next question is one that was submitted in advance by Nhu Nguyen of OEC, based in Danang, Vietnam:  “The Asia Pacific’s governments were urged to employ AI-assisted technology by Russian firm Kaspersky, which held a conference in Bali, Indonesia last month.  According to the company, the region faces 400,000 harmful attacks every day.  Given your background at the NSA and your current role, how would you advise the President to increase the likelihood that American-made solutions will be accepted by governments in the Indo-Pacific region in order to support them in identifying the best defenses against AI-assisted attacks in the future while also upholding U.S. interests?”

MS NEUBERGER:  AI, as was noted, offers significant promise and some peril in the area of cybersecurity.  We believe that AI can help us, for example, build more secure code, find vulnerabilities and patch them more quickly, and identify anomalies in large amounts of traffic on a network.  So AI can be helpful to us.  It can also potentially accelerate development of malicious software and conducting of cyber attacks.  So we must be one step ahead in AI-driven cyber defense.  That’s the reason the United States launched the DARPA AI Cyber Challenge, offering significant funds to incentivize defensive hackers from around the world to use AI to help us build more effective cybersecurity.  And that’s an exciting project which the U.S. Government announced to promote AI-driven defenses one step ahead of AI-driven offenses.

American tech and innovation, American cybersecurity companies are the leading companies around the world in terms of the sophistication of their ability to find and block cyber attacks.  But in this fight, everyone has something to contribute.  And indeed, as I walked around the floor at Singapore International Cyber Week, it was exciting to see companies from across the region, American companies and others, and the many solutions that are available.  So we come to the region in partnership to find the best tech, to help deploy that from a capacity-building perspective, to ensure the region can benefit from the best cybersecurity available to it for our digital economies.

MODERATOR:  Okay, I think we have time for just a couple more questions.  We’re going to go to Martin Koelling from Handelsblatt, based in Yokohama, Japan.  Martin, I see your hand is raised.  Please unmute and ask your question.

QUESTION:  Yes, hello.  It’s Martin Koelling from Yokohama.  One question:  You already talked about North Korea and the crypto activity – crypto crime activities from North Korea.  What activities in AI do you observe in North Korea?  How active are they?  How might AI increase the threat from North Korea?

MS NEUBERGER:  Thank you.  So we have observed some North Korean and other nation-state and criminal actors try to use AI models to help accelerate writing malicious software and finding systems to exploit.  As I mentioned earlier, the way we’re focused on tackling that is first things like the DARPA AI Cyber Challenge to incentivize and jumpstart defensive hackers using AI to build cybersecurity defenses.  The second way is the capacity building we’re committed to do in the region both through partnerships, through cybersecurity training – both government training, private sector training – to help ensure that AI defense stays one step ahead of AI on the offense.  There’s a lot of work to be done together.

MODERATOR:  Okay, we have time for one more question, and it’ll go to Phil Heijmans from Bloomberg News.  Please unmute and ask your question.

QUESTION:  Hi.  Thanks so much for doing this.  Phil Heijmans from Bloomberg.  China appears to have taken a leading role cracking down on transnational cybercrime networks based in Southeast Asia.  This includes the repatriation of alleged scammers back across the Myanmar border.  Does the U.S. view this as an effective strategy?  Also, how is the U.S. specifically addressing the Southeast Asia cyber scam networks, and what ways can it work with the nations hosting them to eliminate them?  Thanks.

MS NEUBERGER:  Thank you for the question.  Cybercrime is a real challenge in the region, and we need every country partnering to tackle it.  Cybercrime has no passport.  You have individuals in one set of countries using infrastructure in another set of countries targeting victims in others.  So we commend all countries in this fight.

We are concerned about the role of illicit crypto networks, some of which use banks in the region in particular countries to cash out their crypto.  And we call upon countries, including China, to implement know your customer rules and to really track the roles of their banks in laundering crypto funds.

With regard to the U.S. specifically addressing the Southeast Asian cyber scam networks, as I mentioned, via the International Counter Ransomware Initiative partnership, which has a large number of Asian countries – and indeed, during this trip we discussed with each partner we met, inviting them to join the International Counter Ransomware Initiative so that we can do regional-focused initiatives on specific regional problems.

And our approach with regard to nations hosting them to eliminate them is first to ensure that we have effective information sharing across the counter-cybercrime partnership.  We – during the summit at the end of the month, we will be launching an information-sharing platform which countries who are members will be using to actively and rapidly share information regarding the actors and the infrastructure driving the cybercrime.  And our goal is to get a picture and consolidate for significant incidents that countries flag: who are the actors, what is the infrastructure, who are the nations hosting them so we can then engage those nations with this data together as 50 countries working to tackle cybercrime and both incentivize their partnership, require their partnership in tackling this together.

MODERATOR:  And now, Ms. Neuberger, if you have any closing remarks, I’ll turn it back over to you.

MS NEUBERGER:  Thank you.  Thank you so much for the discussion.  Really thoughtful and insightful questions.  Clearly there’s a lot of knowledge regarding the importance of cybersecurity, the need to focus and address cybercrime.

As I mentioned at the beginning, we – from the data we see, according to FBI and IMF data, the average annual cost of cybercrime worldwide is expected to soar from $8.4 trillion in 2022 to more than 23 trillion in 2027.  The United States is committed to partnering with countries in the region to tackle this, and has already made major steps in the last couple of years.  In the area of cybercrime, launching the International Counter Ransomware Initiative, which has grown to 50 countries during this visit to the region, inviting more countries to join, so we can tackle this together; our investments in capacity building in the region, both in regard to information sharing regarding attacks, regarding techniques that are used, regarding things like blockchain analysis to identify how we trace the crypto that is driving cybercrime.

In addition, I talked about the partnerships we’ve built in the region, particularly with South Korea and Japan, to tackle the DPRK’s use of hacking of crypto infrastructure to fund their missile program; the innovative ways the U.S. has been sanctioning crypto infrastructure that serves to launder DPRK funds; as well as our efforts, as I noted, to build resilience.

We look forward to building upon the discussions we’ve had here in Singapore, and with thanks to Singapore for its leadership role in the International Counter Ransomware Initiative, to double down on that partnership, to double down on that capacity building, to ensure that as we invest in digital infrastructure in the region in formats like IPEF, we are part of ensuring that digital infrastructure is secure and resilient for the people and the governments of the Indo-Pacific region.

Thank you, and best wishes.

MODERATOR:  That brings us to the end of our time for today.  Thank you for your questions, and thank you to Deputy National Security Advisor Neuberger for joining us.  We will provide a transcript of this briefing to participating journalists as soon as it is available.  We’d love to hear your feedback, and you can contact us at any time at AsiaPacMedia@state.gov.  Thank you again for your participation, and we hope you can join us for another briefing soon.