By Elijah Asdourian, James Lee, Lorae Stojanovic, David Wessel

What’s the latest thinking in fiscal and monetary policy? The Hutchins Roundup keeps you informed of the latest research, charts, and speeches. Want to receive the Hutchins Roundup as an email? Sign up here to get it in your inbox every Thursday.

Nonprofessional investors pay attention to news on inflation

Nonprofessional investors pay attention to news on inflation, and they do so asymmetrically and sluggishly, according to Stefan Nagel of the University of Chicago and Zhen Yan of Arrowstreet Capital. When five-year market-based inflation expectations increase, as measured by inflation swap rates, individual investors increase allocations toward Treasury Inflation-Protected Securities (TIPS) exchange-traded funds (ETFs) and withdraw money from nominal Treasury ETFs. Investors allocate more money to TIPS ETFs when five-year market inflation expectations rise, but do not make withdrawals when expectations fall. These responses occur with a lag; after market-based expectations increase, flows to TIPS ETFs increase over the subsequent four months. Prominent events that could have implications for the future outlook, such as major political events or, to a certain extent, Federal Reserve policy announcements, also affect household investing behavior.

Tax penalties discourage firms from laying off workers during downturns

Employers pay higher unemployment insurance taxes when they lay off more employees. Examining differences among states, Mark Duggan of Stanford, Audrey Guo of Santa Clara University, and Andrew Johnston of the University of California, Merced, find that this “experience rating” system leads firms to lay off fewer employees during economic downturns than they otherwise would. While industries with a lot of seasonal employment, like construction and transportation, were undeterred from layoffs during economic contractions, tax penalties in “low risk” industries like education and health care substantially mitigated layoffs. On average, firms pay $89 extra in taxes per employee when they lay off 10% of their workforce. This penalty reduces employers’ downsizing by 9%, which the authors estimate saved nearly a million jobs during the Great Recession. Lastly, they find no effect on the number of workers firms hire during economic expansions. As a result, tax penalties increase total employment over the business cycle, reducing unemployment during negative economic shocks while leaving hiring unchanged during periods of growth.

Chinese credit policies have sizable spillovers on global growth

Chinese government policies that boost or contract credit supply through levers such as bank loans, shadow credit, and local government bond issuance have large effects on global economic activity, find William L. Barcelona, Danilo Cascaldi-Garcia, Jasper J. Hoek, and Eva Van Leemput of the Federal Reserve. Previous research on the Chinese economy has been hindered by implausibly smooth official GDP statistics. To work around this, the authors construct an alternative measure of Chinese GDP using data sources such as property markets, auto sales, reported exports to China from other countries, satellite nighttime lights, and pollution. While China’s financial markets are relatively isolated from the rest of the world, the economic impulse caused by credit expansion induced by Chinese authorities increases domestic demand, thereby raising global growth prospects, decreasing aggregate risk aversion, and expanding global asset prices and credit. A policy-initiated increase in China’s credit availability equivalent to 1% of GDP increases global GDP outside of China by 0.3% and raises global trade excluding China by 1%, with lagged responses peaking 18 months after the central bank’s credit supply expansion.

At near $85 per barrel, crude oil approaches year-to-date lows

Chart courtesy of MarketWatch

Quote of the week:

“Monetary policy affects the economy and inflation with uncertain lags, and the full effects of our rapid tightening so far are yet to be felt. Thus, it makes sense to moderate the pace of our rate increases as we approach the level of restraint that will be sufficient to bring inflation down. The time for moderating the pace of rate increases may come as soon as the December meeting,” says Jerome Powell, Chair of the Federal Reserve.

“Given our progress in tightening policy, the timing of that moderation is far less significant than the questions of how much further we will need to raise rates to control inflation, and the length of time it will be necessary to hold policy at a restrictive level. It is likely that restoring price stability will require holding policy at a restrictive level for some time. History cautions strongly against prematurely loosening policy. We will stay the course until the job is done.”

The Brookings Institution is financed through the support of a diverse array of foundations, corporations, governments, individuals, as well as an endowment. A list of donors can be found in our annual reports published online here. The findings, interpretations, and conclusions in this report are solely those of its author(s) and are not influenced by any donation.

      

(JTA) – At one point in John Boyne’s new novel “All The Broken Places,” a 91-year-old German woman recalls, for the first time, her encounter with a young Jewish boy in the Auschwitz death camp 80 years prior.

“I found him in the warehouse one day. Where they kept all the striped pajamas,” she says.

The woman, Gretel, quickly realizes her mistake: that “this was a phrase peculiar to my brother and me.” She clarifies that she is referring to “the uniforms. … You know the ones I mean.”

Boyne’s readers are, in fact, likely to know what Gretel means, as “All The Broken Places” is a sequel to Boyne’s 2006 international bestseller “The Boy in the Striped Pajamas.” At a time when other Holocaust books intended for young readers have been challenged or removed from some American schools, the enduring popularity of “Striped Pajamas” has conjured up love and loathing in equal measure for its depiction of Nazi and Jewish youths during the Holocaust. It has sold 11 million copies, appeared in 58 languages and in major motion picture form, and been the only assigned reading about Jews or the Holocaust for countless schoolchildren, mostly in Britain. Yet Holocaust scholars have warned against it, panning it as inaccurate and trafficking in dangerous stereotypes about Jewish weakness.

Speaking to the Jewish Telegraphic Agency from his Dublin home on Tuesday, the day “All the Broken Places” hit U.S. shelves, Boyne said he hoped readers would take his new book on its own terms — as a more sophisticated meditation on guilt, culpability and evil, for an adult audience rather than children this time. But he also wants to defend the original work that made him famous.

“I do feel it’s a positive contribution to the world and to Holocaust studies,” said Boyne, who estimates that he has personally spoken to between 500 and 600 schools about “Striped Pajamas.”

Not everyone agrees. A 2016 study published by the Centre for Holocaust Education, a British organization housed at University College London, found that 35% of British teachers used his book in their Holocaust lesson plans, and that 85% of students who had consumed any kind of media related to the Holocaust had either read the book or seen its movie adaptation.

That level of widespread familiarity with the book led many students to inaccurate conclusions about the Holocaust, such as that the Nazis were “victims too” and that most Germans were unaware of the horrors being visited upon the Jewish people, the study found.

A promotional image from the 2008 film adaptation of “The Boy in the Striped Pajamas.” (Miramax) Image by

As overall awareness of the Holocaust has decreased among young people especially, Boyne’s novel has become a casualty of its own success. Holocaust scholars in the United Kingdom and United States have decried the book, with historian David Cesarani calling it “a travesty of facts” and “a distortion of history,” and the Holocaust Exhibition and Learning Centre in London publishing a long takedown of the book’s inaccuracies and “stereotypes.”

“With the rise in antisemitism, such as it is in this country, and that so often manifests through trivialisation, distortion and denial of the Holocaust, this book could potentially do more harm than good,” Centre for Holocaust Education researcher Ruth-Anne Lenga concluded at the end of her 2016 study.

Boyne came to the Holocaust as subject matter purely on his own, having never been taught about the history growing up in Ireland. (He attended a Catholic school, where, as he has recounted publicly, he was physically and sexually abused by his teachers.) Reading Elie Wiesel’s “Night” as a teenager, Boyne said, “made me want to understand more.”

He would read many more Holocaust books during his twenties, from Primo Levi to Anne Frank to “Sophie’s Choice,” fascinated by the sheer recency of the atrocity. “How could something that seems like it should have happened, say, 1,000 years ago — because the death count is so enormous and so horrifying — how could that happen so close to the time that I’m alive in?” he thought. “And if it could, then what’s to stop it happening again?”

That fascination led to the publication, when Boyne was 33, of “Striped Pajamas,” which he’d always conceived of as a children’s story. In the book, Bruno, the 9-year-old son of a Nazi commandant, befriends Shmuel, a Jewish concentration-camp prisoner of the same age; it ends with Bruno donning the “striped pajamas” and following his friend into the gas chambers. Further driving home the fable conceit, an initial draft included a framing device of Boyne as a character reading the story to an audience of children, before an editor advised him to cut it.

During his writing process, Boyne said he was concerned with “the emotional truth of the novel” as opposed to holding to historical accuracy, and defended much of the book’s ahistorical details — such as moving the Auschwitz guards’ living quarters to outside the camp, and putting no armed guards or electric fences between Bruno and Shmuel — as creative license. A common critique of the book, that the climax encourages the reader to mourn the death of Bruno over that of Shmuel and the other Jews in the camps, makes no sense to Boyne: “I struggle to understand somebody who would reach the end of that book and only feel sympathy for Bruno. I think then if somebody does, I think that says more, frankly, about their antisemitism than anything else.”

He also justified his decisions by reasoning that a novel like his shouldn’t be the basis for Holocaust instruction.

“I don’t think that it’s my responsibility, as a novelist who didn’t write a school book, to justify its use in education when I never asked for that to happen,” he said. “If [teachers] make the choice to use a novel in their classrooms, it’s their responsibility to make sure the children know that there is a difference between what happens in this novel and what happened in real life.”

Boyne added that he was “appalled” by a recent JTA report about a Tennessee school district removing Art Spiegelman’s graphic Holocaust memoir “Maus” from its curriculum. If teachers are choosing between teaching the two books, he said, “‘Maus’ is better, no question about that. And a much more important book.” (Earlier this year, Spiegelman himself took a swipe at “Striped Pajamas” by telling a Tennessee audience that no schools should read Boyne’s novel because “that guy didn’t do any research whatsoever.”)

“The Boy in the Striped Pajamas,” John Boyne’s 2006 bestseller, has been critiqued for the way it presented the Holocaust to children. (Illustration by Grace Yagel) Image by

For the first decade of his book’s release, Boyne would frequently receive invites to speak at Jewish community centers and Holocaust museums. He met with survivors who shared their stories with him.

Over the years, more research has been published about the book’s popularity in the classroom, which has led to more scrutiny of its factual inaccuracies. Other authors, Holocaust researchers and some educators have come out forcefully against the book’s use in the classroom. At the same time, Boyne said, his invitations to Jewish venues dried up.

The author has also been known to exacerbate the issue by sparring with his critics, even when they are respected institutions. Most infamously, in 2020, Boyne got into a Twitter feud with the Auschwitz-Birkenau Memorial and Museum, which said his Auschwitz-set book “should be avoided by anyone who studies or teaches about the history of the Holocaust.”

The back-and-forth was provoked after Boyne criticized what he saw as the crassness of more recent Holocaust novels, such as “The Tattooist of Auschwitz” by Heather Morris. Reflecting on the spat, Boyne said of the Auschwitz memorial, “I hope that they do understand that, whether my book is a masterpiece or a travesty, that I came at it with the very best intentions.”

Boyne conceived of the sequel shortly after finishing “Striped Pajamas.” It follows Bruno’s older sister Gretel as she lives in hiding after the war and successfully conceals her Nazi upbringing all the way into the present day. A preteen during the Holocaust, Gretel becomes gradually more aware of its horrors after seeing newspaper articles and documentaries and encountering former Resistance members and Jewish descendants of survivors (including one, David, who becomes her lover without knowing her true background).

Unlike “Striped Pajamas,” “All the Broken Places” is intended for adults. It’s filled with sex, violence, suicide attempts and bad language — and also some of the details of the Holocaust that were omitted from the first book. It mentions the Sobibor death camp by name, for example, and also takes the time to correct Bruno’s childish assumptions about the death camps being a “farm.”

But it tells the story from the perspective of a German who was directly implicated in the Holocaust. Throughout, Gretel reflects on her complicity in the Nazi regime, and her self-interest in hiding from authorities in the following years rather than trying to bring people like her father to justice. Missing from the book is any serious discussion of antisemitism as an ideology, and to what extent Gretel ascribes to it — though there is plenty of hand-wringing over postwar anti-German sentiment. In one shocking moment, a former S.S. lieutenant in hiding presents Gretel with a pair of Hitler’s eyeglasses and urges her to try them on; she is terrified to discover that this excites her.

The book’s reception has been mixed. While praised by publications including Kirkus Reviews (“a complex, thoughtful character study”) and the Guardian (“a defense of literature’s need to shine a light on the darkest aspects of human nature”), the New Statesman took Boyne to task for writing an “immoral” and “shameless sequel” that further erodes the “Jewishness” of the Holocaust.

At the behest of his publisher, Boyne has included an author’s note with “All The Broken Places” alluding to criticisms of “Striped Pajamas.” “Writing about the Holocaust is a fraught business and any novelist approaching it takes on an enormous burden of responsibility,” he tells the reader. “The story of every person who died in the Holocaust is one that is worth telling. I believe that Gretel’s story is also worth telling.”

Still, “Striped Pajamas” has its Jewish defenders. One, the 24-year-old composer Noah Max, is behind a new opera adaptation of the book, to be titled “The Child in the Striped Pyjamas.” It will debut in London in January; a recent story by the U.K. Jewish Chronicle helped convince the film’s rights holder Miramax to waive a $1 million licensing fee for the project.

A great-grandson of Jews who fled Vienna when the Nazis arrived, Max told JTA he’d initially read the book “years before I was capable of absorbing testimony,” and that it inspired him to seek out actual survivor testimonies and to begin composing the opera at the age of 19. He compared its message to Rabbi Jonathan Sacks’ writings on moral relativism.

“Ultimately, the book motivated me to write an opera about the Shoah and integrate Holocaust education into my music,” Max said. “Any book capable of that is worthy of attention.”

Composer Noah Max (center) rehearses for his upcoming opera adaptation of “The Boy in the Striped Pajamas,” to premiere in January 2023. (Courtesy of Noah Max) Image by

Max’s passion for “Striped Pajamas” inspired at least one Holocaust group to change its mind about its educational merits. The Holocaust Educational Trust, a London-based group that advocates British educators on how to teach the Holocaust, had as recently as 2020 declared that “we advise against using” the book in the classroom.

But following what Max described as “richly fulfilling conversations” about “the story’s symbolic and artistic worth,” the trust fully endorsed the opera and, he said, has begun to rethink its view of the book. (The group did not respond to a JTA request for comment.)

Even with 16 years of hindsight and the chance to rethink his bestseller, Boyne said he wouldn’t change anything. Reflecting on his youthful audience, he said, “If they weren’t reading ‘Striped Pajamas,’ it’s more likely they would be reading something that has no relevance to this subject at all.”

This article originally appeared on JTA.org.

The post The sequel to the Holocaust novel ‘Boy in the Striped Pajamas’ is here. Its author has no regrets. appeared first on The Forward.

Plagues periodically exact a heavy toll on human life–and much more. They devastate economies, exacerbate social disorder, shock governance systems, provide fodder for political violence, and interact in surprising ways with terrorism.

In this conversation, David Priess and longtime RAND Corporation terrorism expert Brian Michael Jenkins talk about the long nature of pandemics, the history of public resistance to efforts to protect public health, links between plagues and social unrest, how the concept of comorbidity applies to the effects of pandemics, the relationship between plagues and political violence, the challenges of rumors and rapid communication, the threat of biological terrorism, and pragmatic ways to counter domestic political violence.

Among the works mentioned in this episode:

The book Plagues and Their Aftermath by Brian Michael Jenkins

The short story “The Stolen Bacillus” by H.G. Wells

Brian Michael Jenkins’s article, “Elements of a Pragmatic Strategy to Counter Domestic Political Violence,” in the CTC Sentinel (October 2022)

The book The True Believer by Eric Hoffer

The book The Man Who Was Thursday by G.K. Chesterton

I already offered my account of the strengths and weaknesses of the evidence in the Oath Keepers seditious conspiracy prosecution on Monday morning. For their part, the daily media have by now aptly explored the key takeaways from the jury’s Tuesday evening verdicts in that case.

For readers’ assistance, here is a useful chart of the jury’s verdicts on each of the 10 counts as they relate to each of the five defendants. In addition to the guilty/not guilty binary, I have a few stray, in-the-weeds thoughts on the verdicts that I’d like to share after live-tweeting all but about two hours of the 29-day trial from the courthouse media room. I’ll do so here in listicle form—a format woefully underutilized by Lawfare: 

1. While the U.S. Department of Justice and many observers are understandably celebrating the department’s smashing victory, there is also a footnote worth mentioning here. It doesn’t undercut the government’s win, which is real and plain: The jury convicted the two top defendants, Elmer Stewart Rhodes III and Kelly Meggs, of the rare and grave seditious conspiracy charge, while also convicting every defendant of at least two felonies carrying maximum 20-year sentences.

But here’s the asterisk. Remarkably, yesterday’s verdicts also represented the first time to date that a jury has acquitted any Jan. 6 defendant on any count—and the jury did so Tuesday evening 11 times out of 28 total opportunities.  

By my tally—and I welcome crowd-sourced fact-checkers to correct me—prior to yesterday, jurors had convicted Jan. 6 defendants on 65 of the 67 total counts presented to them. They were hung on the other two counts—both in the recent trial of Riley June Williams, an acolyte of now-famed white supremacist and Mar-a-Lago patron Nick Fuentes. (In bench trials, prosecutors have won convictions on 60 of 70 counts in Jan. 6 cases, with all 10 acquittals coming in cases tried before U.S. District Judge Trevor N. McFadden.)

2. So, does Listicle Point #1 mean that Tuesday’s verdicts were an under-sung setback for the Justice Department—or even a rebuke? No. Historically, prosecutors have struggled to win seditious conspiracy convictions. Their last attempt, involving the weird “Hutaree” group of rural Michigan in 2012, led to catastrophic directed verdicts of acquittal for all defendants, while a 2009 prosecution—in the case of would-be bombers of, inter alia, the Sears Tower in Chicago—led to conviction of only one of six defendants on the seditious conspiracy count.

In fact, the jury’s split verdict Tuesday may be a blessing in disguise for prosecutors. It may help redeem District of Columbia juries from charges of bias leveled against them by defense lawyers attempting to move their clients’ trials to other venues. (See Escape from D.C.) Similarly, it may help the convictions obtained yesterday withstand appeal, by suggesting that the jury parsed the case carefully and was not caught up in emotion or political partiality.

3. By and large, the Oath Keepers jury’s choices seem to make sense. It acquitted on the three weakest charges—I explain why they were weakest in my earlier post—those accusing Meggs, Kenneth Harrelson, and Jessica Watkins of destruction of federal property. My earlier piece also highlighted serious challenges to proving the conspiracy counts, and, sure enough, the jury had trouble with those. It convicted on only seven of the 15 conspiracy counts before them.

4. How did the jury make distinctions between all those conspiracy counts? Sensibly, I think. This is speculative, of course, but here’s what it looks like they did. First, remember that the seditious conspiracy charge was broader than the others, and prosecutors alleged that it began earlier, in November—before anyone even began focusing on Jan. 6 as an important date. In contrast, the other two conspiracies were alleged to have begun in mid-December and to have focused more narrowly on obstructing or disrupting the Jan. 6 certification. 

So it appears that the jury found Rhodes and Meggs—and only them—guilty of this charge because of their discussions with other Oath Keepers about actual civil war and revolution. In fact, according to the special interrogatories on the jury verdict form, the jury convicted both Rhodes and Meggs on the broader clause of the statute charged—conspiracy to oppose by force the authority of the United States—not its narrower prong of conspiring to use force to “prevent, hinder, or delay the execution” of any U.S. law. So the jury may have been focused on Rhodes’s frequent calls to wage “civil war” or “bloody revolution”—blunter tactics than merely “delaying” by force, say, the Jan. 6 joint session. The jury may have also been impressed with evidence suggesting that Rhodes and Meggs continued to resist the transfer of presidential power even after Jan. 6. Such proof included Rhodes’s post-insurrection purchases of firearms-related equipment, his continuing seditious diatribes to his troops (including this one on Jan. 14, 2021, for instance), and Meggs’s own belligerent post-insurrection Signal chat messages.

What about the two other conspiracy charges? The jury appears to have decided that anyone who actually ascended the East Capitol steps in “stack formation” (each with his or her right hand on the right shoulder of the cadre in front of him or her) and entered the Capitol—defendants Meggs and Watkins—were guilty of the two other conspiracies: conspiracy to obstruct an official proceeding and conspiracy to prevent members of Congress from discharging their duties. That makes sense, too. Surely by the time they joined the stack and started marching up those stairs, they had reached a “meeting of the minds” with the approximately 10 other Oath Keepers in that stack about obstructing the certification. Defendants Rhodes and Thomas Caldwell weren’t in the stack, however, so they were acquitted of these conspiracies.

That leaves defendant Harrelson. He was not in the stack climbing the steps, but he did enter the Capitol. He and Oath Keeper Jason Dolan had been on a personal security detail nearby, remember, and had actually scaled the steps before any other Oath Keepers did. Harrelson only joined the rest of the stack at the very last minute, in front of the East Rotunda doors, and then entered with them. So it looks like the jurors reached a compromise verdict as to Harrelson. They acquitted him of conspiring to obstruct an official proceeding, but convicted him of conspiring to prevent Congress members from discharging their duties. 

5. Still, I was surprised by some aspects of Tuesday’s verdicts. For one thing, the jury convicted all five defendants of the substantive count of corrupt obstruction of an official proceeding, including the two Oath Keepers who never entered the building—Rhodes and Thomas Caldwell. In Rhodes’s case, such a verdict is easily defensible. Rhodes could have been guilty of that charge by aiding and abetting its commission, because there was evidence that he may have given orders, directly or indirectly, for Meggs, Harrelson, Watkins, and, indeed, about 17 other Oath Keepers to storm the Capitol.

With Caldwell, though, the situation is different. Caldwell was on the inaugural scaffolding on the Capitol’s west front at the time the other Oath Keepers were storming the building’s east front, and there was no evidence that Caldwell had communicated with any Oath Keeper that day since the morning. More important, the jury acquitted Caldwell of all conspiracy charges, including conspiring to obstruct an official proceeding. His involvement in that last conspiracy had been, I believe, the government’s primary theory for holding him liable for the substantive count. Apart from the conspiracy evidence, Caldwell’s actual behavior on the inaugural scaffolding on Jan. 6—nonviolent egging on of other rioters without either assaulting or impeding officers or entering the building—was very tepid compared to other Jan. 6 criminal defendants. To my knowledge, conduct like Caldwell’s—once the conspiracy-related accusations are subtracted from the picture—has resulted in even misdemeanor charges only a handful of times. Of the more than 290 defendants charged with corrupt obstruction of an official proceeding to date, I know of no one accused of that offense based on transgressive conduct as marginal as Caldwell’s—again, once the conspiracy allegations are factored out. So I’ll be interested to see how Judge Amit Mehta responds to Caldwell’s nearly inevitable motion for a directed verdict of acquittal on that count. And you can be sure I’ll share my thoughts here on Lawfare. 

In a Lawfare debut, we are posting this national security-related crossword puzzle by Brad Weigmann for our readers’ bewilderment. After solving the puzzle, try your hand at finding a bonus answer, which should be a breeze for at least a portion of the intelligence community. The puzzle solution and bonus answer will be posted in one week, on Dec. 8. If you think you’ve solved the puzzle and identified the correct bonus answer, send your bonus answer to lawfarepuzzle[at]gmail.com before Dec. 8.  We will have a lottery drawing of the correct responders, and one lucky cruciverbalist will win some free Lawfare swag!

Just hours before the first group of Russian tanks crossed into Ukraine in February 2022, Microsoft’s Threat Intelligence Center discovered a new piece of “wiper” malware known as Foxblade “aimed at the country’s government ministries and financial institutions” and capable of wiping data from their computers. 

As the New York Times reported, Microsoft quickly updated its virus detection systems to block the malicious code, and it contacted Anne Neuberger, the U.S. deputy national security adviser for cyber and emerging technology. 

Neuberger facilitated Microsoft’s sharing of information about the malicious code with other countries in order to prevent it from spreading and potentially “crippling the military alliance or hitting West European banks.” This early intervention was perhaps the first public indicator of how integral the private sector would become in both cyber defense and resilience during the course of Russia’s unlawful war of aggression against Ukraine. 

As Susan Landau has observed, the interaction between Microsoft and Neuberger “represents an important change in the cooperation between the U.S. government and the tech industry”—the kind of cooperation that may not have seemed possible just a decade ago in the wake of the Edward Snowden disclosures. 

Only five years ago, Brad Smith, president and vice chairman of Microsoft, was openly critical of the U.S. government for its failure to privilege the disclosure of zero day vulnerabilities over their retention for use in the U.S. government’s own offensive cyber operations, putting private-sector companies and their customers at risk of harms that could flow from the failure to patch significant software vulnerabilities. Without knowledge of zero day vulnerabilities, the private sector cannot develop and deploy protective patches.

Now, some nine months into the Russia-Ukraine armed conflict, more information about the private sector’s role in cyber defense and resilience is becoming available, much of it through reports that Microsoft is publishing about its own observations and defense efforts.

The role of Russian offensive cyber operations and the defenses taken against them, which involves “Western governmental, military, and commercial actors,” will be studied for years to come. Analysis and debate over the significance and impact—or lack thereof—of these operations is already ongoing. What should not get lost in this conversation, however, is a discussion about the implications of having the private sector so inextricably intertwined in cyber defense and resilience during an armed conflict, including when private companies assume the role of a “reliable reporter” with respect to how Russia is engaging in cyber warfare (and the successful defense efforts against Russia’s offensive cyber operations they claim to be waging). The private sector brings immense resources and critical knowledge to cyber defense during times of both peace and armed conflict, but there are pitfalls that must be avoided. 

An Integral Role for Big Tech in Cyber Defense During Armed Conflict

In March 2020, Gen. Paul Nakasone, the dual-hatted commander of U.S. Cyber Command and director of the National Security Agency, testified before Congress about some of the challenges the military is facing from foreign adversaries engaging in malicious offensive cyber operations outside of traditional armed conflict:

A decade ago, we trained and postured our cyber forces like any other military force: to prevail in future conflict. A central challenge today is that our adversaries compete below the threshold of armed conflict, without triggering the hostilities for which [the Defense Department] has traditionally prepared. That short-of-war competition features cyber and information operations employed by nations that by-pass America’s conventional military strengths. 

To adapt to this environment, the military has adopted a “persistent engagement” strategy that involves, among other things, the ability to “maneuve[r] seamlessly between defense and offense,” to operate “globally, as close as possible to adversaries and their operations,” and to engage “continuously,” thereby “shaping the battlespace,” all with the goal of creating an “operational advantage” for the United States “while denying the same to our adversaries.”

Even as the U.S. military is taking a more active role in defending against offensive foreign cyber operations occurring outside of traditional armed conflict, however, does that imply a correspondingly active role for the private sector during warfare? When the New York Times described Microsoft’s efforts to protect systems from Foxblade, it made an analogy to how the Ford Motor Company “converted automobile production lines to make Sherman Tanks” in World War II. That the private sector supplies the military with equipment for war, even when it’s not in line with normal business operations, is not new. But since the start of the Russia-Ukraine armed conflict, the role of the private sector in assisting with Ukrainian cyber defense represents a step beyond producing and providing material and equipment to a country at war. Based on Microsoft’s own reporting and additional analysis of broader cyber defense efforts, private-sector companies have emerged as integral, necessary players in rapid defense against Russian cyber operations. 

Nick Beecroft interviewed representatives from several different companies, including Microsoft, Google, Cloudflare, and BAE Systems Digital Intelligence, along with Oleksandr Polti from the State Service of Special Communications and Information Protection of Ukraine, in an effort to evaluate the international support to Ukrainian cyber defense. With the caveats that whatever success has been achieved thus far will not necessarily endure, and that none of the entities involved has a full and complete picture of Russian cyber operations being perpetrated against Ukraine, especially with respect to intelligence-gathering operations, Beecroft suggests that the private-sector role in the cyber defense of Ukraine has been instrumental: 

It became quickly apparent that the ability to deliver operational effect in cyberspace rested not only with the government and military agencies but also on the close integration of commercial technologies and cybersecurity companies. While official Western agencies could draw on existing relationships with Ukrainian partners and possessed powerful tools and unique capabilities, delivering cyber defense at scale could only be achieved by private sector entities that owned, operated, and understood the most widely-used digital services. Early decisions by the leadership of some of the world’s major technology and cybersecurity companies to take proactive roles in defending Ukraine were pivotal.

Beecroft also notes that:

A further defining feature of the defensive effort has been the integration of large American technology providers, particularly Amazon, Cloudflare, Google, and Microsoft. These companies’ ability to migrate Ukrainian government data and services to distributed cloud servers; provide automated protection of massive networks, coupled with dedicated protection of high-risk users; as well as continually update threat intelligence drawn from global telemetry has added defensive depth and resilience far beyond that which Ukraine could have achieved independently.

What Beecroft suggests with respect to the direct involvement and support of the private sector in Ukraine’s network defense and resilience is bolstered by statements from Georgii Dubynskyi, deputy minister of digital transformation of Ukraine. He has indicated that Ukrainian collaboration and partnership with a number of private-sector companies has been a critical aspect of cyber defense and resilience. 

Microsoft’s Perspective on Defending Ukraine: Early Lessons From the Cyber War

Microsoft—one of the tech companies integral to the Ukrainian cyber defense effort—published a report in June 2022 about the kinds of cyber operations at play in the conflict. In a presentation about the report, Smith indicated that Microsoft had been “closely involved in a way I would not have imagined—on the front lines—when I started at Microsoft many years ago.” 

In conjunction with a report Microsoft issued in April 2022, the June report represents the most complete public inventory of Russian cyber operations both immediately preceding and during the course of the armed conflict. One of the reasons that Microsoft published the June report was “a feeling” inside the company that offensive cyber operations and attacks were being “vastly under reported.” Moreover, through its own analysis, Microsoft characterizes the attacks as more “sophisticated” and “widespread” than previously acknowledged. 

One of the key insights that Microsoft communicates is a need for most countries to have the “ability to disburse and distribute digital operations and data assets across borders and into other countries” when defending against a military invasion. Prior to Russia’s 2022 invasion of Ukraine, data protection law in Ukraine prevented the government from storing and processing data in a public cloud. This prohibition left public-sector digital infrastructure, then stored locally on servers located inside government buildings in Ukraine, vulnerable to physical attacks from missiles or other munitions. To address this vulnerability, just days before the invasion, Ukraine amended its data protection law to allow government authorities to move data into a public cloud. Microsoft, along with other tech companies, assisted Ukraine’s Ministry of Digital Transformation and some 90 chief digital transformation officers across government with the transfer of “the central government’s most important digital operations and data.” 

The movement of Ukrainian governmental operations and data into a public cloud environment proved instrumental in limiting the operational impact of both kinetic and cyber wiper attacks. This evacuation operation, according to Microsoft, “highlights a critical difference between protecting public-sector data in a time of war instead of peace.” 

Another key part of the report is Microsoft’s discussion of different facets of the destructive cyberattacks that Russia has deployed against Ukraine and the overall ability of cyber defenses to defeat those attacks. Microsoft, for example, has detected targeted phishing attempts to penetrate computer networks, which it characterizes as consistent with the “determination, sophistication, and persistence long observed across the cyber activities of Russia’s intelligence community and military.” 

Moreover, as previously noted, Microsoft’s Threat Intelligence Center detected Foxblade wiper software that Russia launched against 19 government and critical infrastructure entities in Ukraine. Microsoft has attributed this malware to the same Russian military intelligence group—known at Microsoft as Iridium and elsewhere as Sandworm—that was responsible for the NotPetya attack against Ukraine in 2017, which caused more than $10 billion in global damage. Since the discovery of Foxblade wiper software, the Microsoft Threat Intelligence Center has “detected multiple attempts to use eight distinct malware programs—some wipers and some other forms of destructive malware—against 48 different Ukrainian agencies and enterprises.” But unlike the 2017 NotPetya attack, which readily crossed international borders due to the “wormable” nature of the malware, the destructive malware observed to date has been designed to stay within Ukraine. 

As a coalition of countries has come together in support of Ukraine, Microsoft has, however, detected Russian network intrusions constituting cyber espionage in 128 different organizations in 48 countries around the world. Moreover, Microsoft believes that Russian cyber actors have achieved successful intrusions 29 percent of the time, with a quarter of the “successful intrusions” involving “exfiltration of an organization’s data.”

While there has been some surprise that Russian cyberattacks have not been more destructive both within and outside of Ukraine, especially given the type of damage caused by NotPetya, Microsoft attributes the more limited damage, at least in part, to a range of factors and innovations. For example, since the NotPetya attack, cyber threat intelligence has improved. Microsoft now has greater visibility into the threat environment based on some “24 trillion signals” it receives on a daily basis from “devices and cloud services across a global ecosystem.” Moreover, advances in artificial intelligence (AI)-based detection capabilities deployed across cloud networks are strengthening cybersecurity efforts: Malware can be blocked at “first sight” without human intervention. Another set of innovations deployed by Microsoft has made it possible to distribute protective software signature code through the internet and back to devices to “identify and disable destructive malware.” On a number of occasions, Microsoft has “been able to develop new signatures in just a few hours and distribute them back to devices across Ukraine and more globally.” 

Additional “wartime measures and innovations” have come from the use of technology Microsoft acquired from RiskIQ that “identifies and maps organizational attack surfaces,” such as devices that remain “unpatched against known vulnerabilities,” making them particularly “susceptible to attack.” Microsoft has also worked with the Ukrainian government, which enacted special legal measures, to allow Microsoft to turn off a feature in a Microsoft security application proactively and remotely, thereby mitigating the spread of malware. Prior to this new arrangement, Ukrainian information technology administrators would have needed direct access to the relevant devices to accomplish this task, which could be difficult and possibly dangerous during an ongoing war. 

Some Thoughts About the Integral Role the Private Sector Is Playing in Cyber Defense During an Armed Conflict

In many respects, no one should be surprised that the private sector is integral to cyber defense and resilience during an armed conflict. The private sector owns and operates much of cyberspace—and that doesn’t change when a country becomes embroiled in an armed conflict. As the Microsoft June report revealed, defending networks and digital services during armed conflict has proved to be an intense endeavor—one in which rapid innovation is essential—hence it is a process that inevitably flows from ownership and operation of significant data and communications infrastructure and services. This, according to Microsoft, makes the current armed conflict different from past wars. Moreover, Microsoft believes that modern warfare “imposes a heightened responsibility on tech companies to use the best technology available,” in addition to taking “extraordinary measures to help defend a country from attack.” Going forward, Microsoft attributes “a high responsibility” to the tech sector “to keep investing in ongoing innovation to ensure that defensive protection not only keeps pace with but exceeds innovations in the offensive cyber-attack tactics and capabilities.”

What Microsoft is acknowledging, both for itself and for other big tech companies, is that the integral role of Big Tech in cyber defense is an inescapable reality that imposes affirmative obligations to continue to innovate in the cyber defense area. That said, Smith is also careful to note that Microsoft is “a company and not a government or a country.” Smith realizes that successful cyber defense will happen only in “constant and close coordination” with governments and international institutions—Ukraine, the United States, European nations, NATO, the United Nations, and so on.

As Landau observes, such cooperation, illustrated by the information sharing surrounding the Foxblade wiper malware, is part of a broader strategy the Biden administration is pursuing, and one that National Cyber Director Chris Inglis, in particular, believes is critical to strong cybersecurity and cyber defense. During a fireside chat at Blackhat Asia in May 2022, Inglis discussed the important kind of knowledge to be gained by close cooperation between public and private sectors: 

We often overestimate what a government would know, underestimate what the private sector knows, and ignore at our peril what we could know together. … We’re looking for a degree of professional intimacy such that we can discover things together that no one of us could discover alone.

Inglis expands on this vision in a co-authored article in Foreign Affairs:

Building resilience to potentially catastrophic cyber-incidents will require an unprecedented level of planning, information sharing, and operational intimacy across once-isolated fields. Existing efforts to place government and industry experts side-by-side—including in sector-specific Information Sharing and Analysis Centers—are a good way to start. The U.S. government has quickly realized that these partnerships can identify and address threats far more effectively than a single organization operating alone.

To make this kind of partnership sustainable for the long haul, however, there are pitfalls that must be avoided. As Landau notes, companies should not be put in the position of “undermin[ing] their primary effort of protecting their customers”—that is, the government should not seek to “co-op[t] private customer data for other purposes.” In addition, the government must not be seen either as failing to share critical cyber threat intelligence across relevant government agencies, leaving that burden to the private sector, or as working against private-sector cyber defense efforts. Just over a year ago, Smith raised concerns about “too tightly controlled silos of information” pertaining to cyberattacks across various government agencies. Apparently, on more than one occasion, Microsoft has been asked by federal employees about relevant information in other parts of the government because it was easier to get the information from Microsoft than from other federal agencies. According to Smith, “[i]t’s impossible to avoid the grave conclusion that the sharing of cybersecurity threat intelligence today is even more challenged than it was for terrorist threats before 9/11.” 

As previously referenced, Smith has long had concerns that the U.S. government too frequently privileges the retention of zero day vulnerabilities for offensive cyber operations of its own, rather than disclosing them and allowing the private sector to patch the vulnerabilities. At least from Microsoft’s perspective, it seems that too many decisions to retain rather than disclose these vulnerabilities would undermine the kind of trust necessary to sustain the type of public-private partnership that Inglis believes is critical to cyber defense efforts.

There is another notable aspect to Microsoft’s integral role in Ukraine’s cyber defense. Microsoft has become a key reporter, if not the primary one, on the kinds and frequency of offensive cyber operations employed by Russia, as detailed in the April and June reports. While Microsoft does not claim to have vision into all of Russia’s offensive cyber operations, it has enough vision and analytical capabilities to assert its belief that, prior to its own effort to report them, offensive cyber operations and attacks were being vastly underreported. 

But the style of the language used in the June report and some conclusions drawn in it by Microsoft have raised concerns with experts who study cyber conflict. Suzanne Smalley, a reporter at Cyberscoop, interviewed a dozen experts, all of whom criticized Microsoft for publishing a report that “didn’t contain either the technical underpinning or evidence to back up its points [and] … didn’t meet basic standards of academic research.”

Thomas Rid was quoted in the Cyberscoop article as saying, “[I]f you publish this kind of information, you have to do it in a way that is sober, in a way that is fact driven, and in a way that uses professional estimated language.” Rid, along with other experts, was particularly critical of the report’s assertion that Russia combined a cyber operation with a physical assault on a nuclear power plant in Ukraine. The report says that “the Russian military combined cyber and conventional weapons in assaulting a nuclear power plant in early March,” indicating that on March 2, the Microsoft Threat Intelligence Center “identified a Russian group moving laterally on the nuclear power company’s computer network.” The report notes that, the next day, Russia’s military “attacked and occupied the plant.” According to Rid, “while Microsoft initially implied the Russians used cyber to collect intelligence from the nuclear power plant, in the following sentence the report appears to hedge, saying the highly regarded Microsoft Threat Intelligence Center (MSTIC) identified a Russian group moving laterally on the nuclear power company’s computer network.” Rid notes that the report’s statement “is full of assumptions,” that the change in focus from the plant to the company is “misleading,” and that “[t]he first sentence is not backed up by the second.”

No one, as the article explains, disputes the fact that Microsoft, as one of the largest, most significant global technology companies working directly with key governments, has “unique insights” into the cyberattacks being perpetrated against Ukraine. But more attention must be paid when asserting that Russia is coordinating cyber and physical attacks. Moreover, to trust the validity of Microsoft’s claims, researchers want, for example, to see data to support the report’s assertions that phishing, data theft, and wiper attacks can be attributed to different Russian intelligence agencies. Given its unique access and willingness to share what it sees, Microsoft has become one of the best sources of knowledge for understanding how Russia is using offensive cyber operations to prosecute its war on Ukraine. Insofar as Microsoft has willingly assumed this “reliable reporter” role—one that it may not have initially intended or wanted to play—it needs to impart knowledge through sober and precise language.

An employee at the Walmart in Chesapeake, Virginia, where a supervisor shot six co-workers dead last week may struggle to prevail in a $50-million lawsuit she filed accusing the retailer of failing to protect its workers, legal experts say.

A system meant to help workers get compensated for workplace injuries could make it difficult for the lawsuit to succeed.

The United States averages two mass shootings, — defined as an incident killing or injuring four or more people — a day, according to Gun Violence Archive, a non-profit research group. But while many of those shootings occur in the workplace, employers are rarely held responsible.

That is in part because nearly all U.S. states, including Virginia, require employers to buy workers compensation insurance to pay workers for medical expenses and lost wages stemming from workplace injuries. In return, the employers are shielded from most lawsuits workers could otherwise bring.

“As a general matter, employees cannot sue their employers for injuries that they suffer on the job due to negligence by the employer,” said Timothy Lytton, a professor at Georgia State University College of Law.

But, some states, including Virginia, do make an exception for cases of gross negligence by an employer.

Donya Prioleau, the Virginia employee suing Walmart, claims exactly that, saying that the shooter, Andre Bing, had a history of “bizarre and threatening” behavior and that she and other employees had warned Walmart management about him.

The 31-year-old Bing, who worked as a supervisor for an overnight shift, opened fire on fellow employees in a break room on Nov. 22 before turning his gun on himself, according to witnesses.

The lawsuit says Bing had “known propensities” for violence and threatening behavior. Prioleau said he had asked her if she liked guns, questioned other employees whether they had received active shooter training and saying he would retaliate if he were fired.

She said she made a formal complaint about Bing after he harassed her and called her a “bitch,” and that other employees complained about him as well, though the lawsuit does not give details about those complaints.

A Walmart spokesperson said the company is reviewing the complaint and will respond in court.

The question before the Chesapeake Circuit Court in Virginia, where the lawsuit was filed Tuesday, will be whether the company was negligent to the extent that it is not shielded by workers’ compensation.

Workers’ compensation is “a tough defense to overcome,” said Jeffrey Harris, a Georgia-based plaintiffs’ attorney who has handled numerous workplace injury cases. “It is usually construed very broadly to protect the employer.”

Prioleau’s case may depend on what, exactly, Walmart management was told about Bing, and whether it amounted to a concrete threat. She will have to prove that the company was told that its employees faced a specific danger, and that it did not care – a “conscious disregard” for their safety, Lytton said.

Some past cases illustrate the challenge.

Last month, an Indiana federal judge dismissed a lawsuit accusing FedEx of negligence after a former employee killed 8 workers in 2021 at an Indianapolis facility. UPS escaped lawsuits by dozens of workers and victims’ relatives after one of its employees shot and killed three coworkers at a San Francisco facility in 2017. In both cases, courts said workers’ compensation was the only available remedy because there were no allegations that the employers were warned of a threat.

On the other hand, in 2016, a federal judge in Washington, D.C., allowed negligence lawsuits to proceed against government contractors that employed an IT worker who killed 12 people at a U.S. Navy facility. The judge said the companies were aware of the shooter’s history of violent and paranoid behavior, including gun-related arrests, and that other employees had said they feared he might hurt others. The cases later settled for undisclosed amounts.

Prioleau’s allegations seem to fall somewhere in between.

Kevin Morrison, a lawyer who represented the plaintiffs in the UPS case, said Bing’s history might be enough to support a finding of gross negligence.

“If the evidence shows Walmart was made aware of Bing’s threats or the fact that he was a gun nut and Walmart turned a blind eye then there is an avenue for recovery for these folks,” he said.

Still, according to Morrison, the threat would have to have been specific.

“It can’t just be water cooler chat,” he said.

Related Galleries:

Wall Street gave up gains made earlier on Thursday as a contraction in manufacturing activity last month clouded data showing a mild easing in inflation and solid consumer spending, while a fall in Salesforce shares dragged the Dow lower.

U.S. manufacturing activity shrank for the first time in 2-1/2 years in November as higher borrowing costs weighed on demand for goods, and proved to be a trigger for investors to book profits following a rally in the previous session.

“Yesterday’s move was so crazy large, this is probably just some natural profit taking,” Rusty Vanneman, chief investment strategist at Orion Advisor Solutions, said.

Federal Reserve Chair Jerome Powell said on Wednesday it was time to slow down coming interest rate hikes, while also signaling a protracted economic adjustment amid high borrowing costs, pushing the S&P 500 index (.SPX) above its 200-day moving average for the first time since April.

Markets were boosted earlier in the day by a reading from the Commerce Department, which showed consumer spending, that accounts for more than two-thirds of U.S. economic activity, rose 0.8% after an unrevised 0.6% increase in September.

The core personal consumption expenditure (PCE) index, excluding volatile items, eased to 0.2%, against expectations of 0.3%.

“Obviously the (manufacturing) sector is in recession and this basically upholds the fact that we’re headed for a recession,” said Peter Cardillo, chief market economist at Spartan Capital Securities.

Traders still see an 89% chance that the Fed will increase its key benchmark rate by 50 basis points in December, with the terminal rate expected to be under 5% in May 2023. FEDWATCH

Weighing the most on the Dow Jones Industrial Average (.DJI) was Salesforce Inc (CRM.N), which tumbled 10.8% after the software maker said Bret Taylor would step down as co-chief executive officer in January.

Dollar General Corp (DG.N) fell 9.3% after the discount retailer cut its annual profit forecast, while Costco Wholesale Corp (COST.O) shed 7.0% after the membership-only retail chain reported slower sales growth in November.

Investors now await nonfarm payrolls data on Friday, with the ADP report on Wednesday suggesting cooling demand for labor.

Separately, a report from the Labor Department on Thursday showed initial claims for state unemployment benefits dropped 16,000 to a seasonally adjusted 225,000 for the week ended Nov. 26.

At 10:33 a.m. ET, the Dow Jones Industrial Average (.DJI) was down 439.25 points, or 1.27%, at 34,150.52, the S&P 500 (.SPX) was down 26.13 points, or 0.64%, at 4,053.98, and the Nasdaq Composite (.IXIC) was down 69.40 points, or 0.61%, at 11,398.60.

Most megacap growth stocks such as Alphabet Inc (GOOGL.O), Apple Inc (AAPL.O), Microsoft Corp (MSFT.O) and Tesla Inc (TSLA.O) fell between 0.3% and 1.5% as Treasury yields edged higher following an initial dip.

Advancing issues outnumbered decliners for a 1.23-to-1 ratio on the NYSE. Declining issues outnumbered advancers for a 1.14-to-1 ratio on the Nasdaq.

The S&P index recorded 29 new 52-week highs and no new low, while the Nasdaq recorded 68 new highs and 37 new lows.