Distilling Cyber Policy

In the latest Distilling Cyber Policy podcast, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Irfan Hamani, Deputy Director for UK Cybersecurity and Resilience Policy at the UK Department for Science, Innovation and Technology (DSIT).As cyber regulations continue to evolve around the world, organizations increasingly face the challenge of navigating a fragmented regulatory landscape. Irfan discusses the importance of international cyber regulatory alignment, the benefits of developing common cybersecurity standards and terminology, and the role collaboration plays in strengthening global cyber resilience. The conversation explores how governments, industry, and international organizations can work together to address emerging cyber risks. Irfan also shares insights into the UK's approach to cyber resilience, including cyber insurance, legal frameworks, and industry engagement, while highlighting the value of international forums such as Wilton Park and the OECD in fostering cooperation and advancing cybersecurity policy.News: U.S. Government Imposes Export Controls on Anthropic’s Fable 5, Citing National Security ConcernsAustralia’s Horizon 2 Action PlanNew Plans to Sharing, Taking, or Viewing Nude ImagesUK Kings Honours List NominationInterview:NIST Cybersecurity FrameworkUK Cyber Security and Resilience BillOECD Cybersecurity InitiativesETSI 303 645 - Cybersecurity Standard on Consumer IoT Devices

In the latest Distilling Cyber Policy podcast, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Bart Groothuis, Member of the European Parliament and a leading voice on EU cybersecurity policy. This episode features an in-depth discussion on AI security, cyber policy, and the evolving landscape of cybersecurity, featuring experts from the EU and industry leaders. Topics include Project Glasswing, EU cybersecurity legislation, quantum computing, and the dark economy of hacking.Interview:European Cybersecurity Act 2.0News:Anthropic’s Mythos UK Tracking Russian Submarines over its Subsea CablesCommunity Corner:US version: "Dark Screens: Hackers and Heroes in the Shadowy World of Ransomware"(release date 28 April)UK version: "We Know You Can Pay A Million: Inside the Dark Economy of Hacking and Ransomware" (release date 2nd April)

In this year-end episode of Distilling Cyber Policy, hosts Alex Botting and Jen Ellis are joined by three CCPL experts to try and predict the future of cyber policy in the coming year, while reflecting on some of their predictions from last year. Our experts include Caitlin Clarke, Jeremy Grant, and Heather West as well as thoughts from prior guests such as MEP Bart Groothius, Ifran Hemani, and Katharina Sommers.

In the latest Distilling Cyber Policy podcast, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by guests, Stacy O’Mara, Senior Director of Venable and Leonard Bailey, former Head of the Cybersecurity Unit in the Computer Crime and Intellectual Property Section (CCIPS) and Special Counsel for National Security in the DOJ’s Criminal Division.From shifting global norms to the rising pressure for stronger deterrence, our guests break down why offensive capabilities are back in the spotlight and what it means for national security. They dig into the debate over whether these operations should remain strictly government-run or if there’s ever a world where the private sector plays a significant role. They also break down the risks, the misconceptions, and the practical challenges that keep the “hack back” debate alive, including concerns about misattribution, escalation, and potential interference with intelligence or law enforcement operations.Interview:Pall Mall Process Industry Code of Practice (due Dec. 22)Computer Fraud and Abuse Act (CFAA)News:India Orders Smartphones Makers to Preload State-Owned Cyber Safety AppCISA, Australia, and Part and Partners Author Joint Guidance on Securely Integrating Artificial Intelligence in Operational TechnologyCommunity Corner:Carveout for Security Research in Portugal's NIS2

For our last Distilling Cyber Policy podcast episode of 2024, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by four CCPL experts to try and predict the future of cyber policy in the coming year, while reflecting on some of their predictions from last year. Our experts include Ari Schwartz, Jeremy Grant, Heather West, and Harley Geiger, as well as thoughts from prior guests such as Ambassador Brendan Dowling and Shehzad Charania. Instead of the news segment this week, Jen and Alex share details on the upcoming CyberNext DC conference, co-hosted by CCPL and the Cyber Threat Alliance, which is taking place this Dec. 12. You can register for virtual attendance here.

In the latest Distilling Cyber Policy podcast, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are re-joined by guests from earlier this season: Lee Licata, Deputy Section Chief for National Security Data Risk at the Department of Justice (DOJ), and Grant Dasher, the Acting Technical Deputy Director for Cybersecurity at the Cybersecurity and Infrastructure Agency (CISA).Both came on to discuss the then-recently released Executive Order 14117 and the associated Advanced Notice of Proposed Rulemaking (ANPRM). Since then, the DOJ issued a Notice of Proposed Rulemaking (NPRM), with written comments from the public due by November 29, 2024. Additionally, as directed by the EO, CISA has developed proposed security requirements to apply to classes of restricted transactions identified in the NPRM. In the episode, Lee and Grant dig into the proposed rule and security requirements, as well as the next steps in the rule making process.Interview:Executive Order 14117DOJ Notice of Proposed Rulemaking (NPRM)CISA Proposed Security Requirements  News: Streamlining Federal Cybersecurity Regulations Act (Senate); Streamlining Federal Cybersecurity Regulations Act (House) Pall Mall Process MeetingIST's 2nd Annual Cyber Policy Awards, open for submissions through December 6thCommunity Corner:Citizen Lab Report - Rivers of Phish, Sophisticated Phishing Targets Russia’s Perceived Enemies Around the Globe

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Anne Marie Schumann, the Department of the Navy’s Principal Cyber Advisor. In this role, she is responsible for advising the Secretary of the Navy, Chief of Naval Operations, and Commandant of the Marine Corps on all cyber matters. In the discussion, Anne Marie shares context on the Navy’s first-ever Department Cyber Strategy, which was released in November 2023. News:CISA's Call for Comment on Cyber Incident Reporting FormCommunity Corner:Paris Peace SummitAs always, if you would like to submit something for the Community Corner segment, or have topic ideas for upcoming episodes, please email [email protected]. 

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Hamish Hansford, the Deputy Secretary of Cyber and Infrastructure Security Group at the Australian Department of Home Affairs. The discussion begins with the fourth annual convening of the International Counter Ransomware Initiative (CRI), as well as several other cyber priorities for Australia.News:The Pall Mall Process The official adoption of the EU’s  Cyber Resilience Act (CRA)The publication of the EU’s Network and Information Security Directive (NIS 2) Implementing ActGhana’s New National Cybersecurity Policy and Strategy Community Corner:“Software Supply Chain Security: Securing the End-to-End Supply Chain for Software, Firmware, and Hardware” by Cassie Crossely As always, if you would like to join us for the community corner segment, or have topic ideas for upcoming episodes, please email [email protected]. 

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Paula Bogantes, the Costa Rican Minister of Science, Innovation, Technology and Telecommunications.News:Senate Confirms Michael Sulmeyer as DoD Cyber Policy ChiefDoD Establishes the Office of the Assistant Secretary of Defense for Cyber PolicyChile’s Public Consultation on Cybersecurity Framework Law RegulationsChile’s New Cybersecurity Framework LawEU Product Liability DirectiveInterview:Costa Rica's 2023-2027 Cybersecurity Strategy United States Announces $25M to Strengthen Costa Rica’s CybersecurityDigiAmericas LATAM CISO Summit 

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Grant Schneider, Senior Director of Cybersecurity Services at Venable LLP.  Grant’s discussion with Alex and Jen delves into the National Defense Authorization Act (NDAA) and its implications for cybersecurity policy. News:Chevron Pattern Disrupted: The Impact on Cybersecurity RegulationsPolish Parliament Investigation Into Spyware ProgressesPall Mall ProcessEuropean Commission Consultation on NIS2 Implementing Regulation Interview:National Defense Authorization Act Assessing an Independent Cyber ForceFISMA Amendment Community CornerPolicy @ DEF CON programming

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Despina Spanou, the Head of the Cabinet of the Vice-President of the European Commission. The discussion begins with the recent history and intentions of EU technology policy making, the EU’s legislative process, and the development of the Cyber Resilience Act (CRA). The conversation concludes with a look towards international cooperation on cybersecurity, including the recent announcement of the US-EU Joint Cybersafe Products Action Plan and the outcomes of the latest U.S-EU Trade and Technology Council meeting. News:ONCD Releases its Summary of the 2023 Cybersecurity Regulatory Harmonization RFIWhite House highlights voluntary commitments from Google, Microsoft to provide cyber services for health sectorInterview:Digital Covid CertificateNIS DirectiveCRAU.S.-EU Sign Joint Cybersafe Products Action PlanU.S.-EU Trade and Technology Council MeetingCommunity Corner:ICS VillageHack the Capitol

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by John Banghart, Senior Director at Venable LLP, and Kent Landfield, a founding member of the Common Vulnerabilities and Exposures (CVE) Program and bonafide cybersecurity industry veteran. Their discussion delves into the latest developments and ongoing debate around the National Vulnerability Database (NVD).News:International Cyberspace and Digital Policy StrategyCISA's Secure by Design PledgeUK's Product Security and Telecommunications Infrastructure (PSTI) ActUK Consultation for draft code of practice for software vendorsUK Consultation for draft code of practice for cybersecurity of AI  Interview:National Vulnerability DatabaseCommon Vulnerability ExposuresForum of Incident Response and Security Teams (FIRST)Community Corner:Inaugural Cyber Policy Awards

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Lee Licata, one of the Deputy Chiefs of the Foreign Investment Review Section in the National Security Division at the Department of Justice (DOJ), and Grant Dasher, the Cybersecurity Division Architecture Branch Chief at the Cybersecurity and Infrastructure Agency (CISA). The conversation delves into the recently released Executive Order (EO) 14117 on "Preventing Access to Americans' Bulk Sensitive Data and United States Government-Related Data by Countries of Concern." In addition, this week, Alex and Jen are joined by Michael Daniel, president and CEO of the Cyber Threat Alliance, to discuss the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). As always, if you would like to submit cyber policy trivia, or have topic ideas for upcoming episodes, please email [email protected]. News:Notice of Proposed Rule Making to Implement the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022 The Ransomware Task Force (RTF) celebrated its third anniversary with a one day event co-hosted by the Center for Cybersecurity Policy and Law, and you can watch the recording here. CR2’s Guarding Global Commerce Report Interview:EO 14117 on "Preventing Access to Americans' Bulk Sensitive Data and United States Government-Related Data by Countries of Concern"EO 14117 Advanced Notice of Proposed Rule MakingICT Supply Chain, Department of Commerce 

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Shehzad Charania MBE, Director of Legal Affairs and International Relations at the UK’s Government Communications Headquarters (GCHQ).The jam-packed discussion delves into the importance of workforce diversity, the notion of responsible cyber power, and the commercial proliferation of offensive cyber weapons like spyware. In addition, this week’s episode features cyber policy recommendations from the Cybersecurity Coalition’s EU Policy Roadmap 2024 - 2029. Our Mystery Trivia Master is the wonderful Liz Wharton (@lawyerliz), founder and CEO of Silver Key Strategies. News:Cybersecurity Coalition EU Policy Roadmap 2024 - 2029Interview:UK National Cyber Force Paper on Responsible Cyber PowerAustralian Cyber Policy with Ambassador Brendan DowlingUK's 2022 Cybersecurity StrategyAfrican Union Position on the Application of International Law in CyberspacePall Mall Process Declaration Summit for Democracy Joint StatementTrivia:Air-Control Hacker Faces Charges (Wired, 1998)

In our latest Distilling Cyber Policy podcast episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Mark Montgomery, Senior Director and Senior Fellow at the Foundation for the Defense of Democracies (FDD). At FDD, Mark leads CSC 2.0, an initiative that works to implement the recommendations of the congressionally mandated Cyberspace Solarium Commission, where he served as executive director. The discussion delves into the Commission and its March 2020 report and associated recommendations, as well as CSC 2.0's emerging priorities.News:NIST’s CSF 2.0UK Call for views on cyber security and economic growthUK Cyber Duty to Protect Survey

As 2023 comes to a close, host Alex Botting and Jen Ellis are joined by guests from Season 1 and experts from the Center for Cybersecurity Policy & Law to discuss their predictions for 2024. 🧠 What's next for AI?⚛ Will 2024 be the year of Quantum?🔑 Can we finally ditch Passwords? 🏷 Will Cyber Labels nudge consumers towards better security decisions?📜 Will Certifications and Self-Attestations raise the bar for enterprises?Episode Guest List:Brendan Dowling - Australian Ambassador for Cyber Affairs and Critical TechnologyIrfan Hemani - Deputy Director of Cyber Security Policy, UK Department for Science, Innovation and Technology‍Alison King - Vice President of Government Affairs, Forescout TechnologiesAri Schwartz - Managing Director of Cybersecurity Services, Venable LLP & Coordinator, Cybersecurity Coalition Jeremy Grant - Managing Director of Technology Business Strategy, Venable LLP & Coordinator, Better Identity CoalitionInés Jordan-Zoob - Program Manager, Cyber Security and Privacy, Venable LLPHeather West - Senior Director of Cybersecurity and Privacy Services, Venable LLP

In our latest episode, former U.S. National Cyber Director Kemba Walden joins Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law. The discussion includes Kemba’s reflections on her time at the Office of the National Cyber Director, and the multitude of major policy initiatives that she spearheaded - including the release of the updated U.S. National Cybersecurity Strategy, the associated Implementation Plan, the Cybersecurity Priorities for the Fiscal Year 2025 Budget, and the U.S. National Cyber Workforce and Education Strategy -  and all in just ten months of tenure. News:Australian Cyber Security Strategy ReleaseEU CRA Political Agreement ReachedInterview:Munich Security Conference 2023US National Cybersecurity Strategy US National Cybersecurity Strategy Implementation PlanBiden-Harris Administration’s Cybersecurity Priorities for the Fiscal Year 2025 BudgetUS National Cyber Workforce and Education Strategy Request for Information: Opportunities For and Obstacles To Harmonizing Cybersecurity RegulationsOffice of the National Cyber Director Requests Public Comment on Open-Source Software Security and Memory Safe Programming LanguagesRequest for Information on Open-Source Software Security: Areas of Long-Term Focus and PrioritizationLog4j Vulnerability Heartbleed BugTrivia:Belgian Whistleblower Law

In our latest episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by the Australian Ambassador for Cyber Affairs and Critical Technology, Brendan Dowling. In the conversation, Ambassador Dowling provides context on Australia’s numerous recent cyber policy developments, including the appointment of the inaugural Australian National Cyber Security Coordinator, the upcoming 2023-2030 Australian national cybersecurity strategy, and some of the lessons learned from the recent Medibank and Optus cyber incidents.  He also gives his optimistic perspective on where we are today and where we can get to in the coming years.News:UK’s AI Safety SummitBletchley DeclarationU.S. Executive Order on AI Heather West’s analysis of the AI EO International Counter Ransomware InitiativeRecent ransomware attack in GermanyInterview:Upcoming 2023-2030 Australian national cybersecurity strategy Appointment of the inaugural Australian National Cyber Security CoordinatorMedibank incidentOptus incident Trivia:Sarbanes-Oxley Act of 2002Chips and Science Act of 2022

In our latest episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Jason Gull, Senior Counsel in the Computer Crime and Intellectual Property Section (CCIPS) of the Justice Department’s Criminal Division. In the conversation, Jason sheds light on the evolution of the Digital Millennium Copyright Act, including the role of the Library of Congress in reviewing the law every three years. The 2024 review process is underway, and potential new or amended exemptions have been submitted. The Copyright Office is accepting comments and evidence, as detailed here.   In addition to the above, this week’s episode features Alex’s updates from Singapore International Cyber Week, and he also highlighted Singapore’s Cybersecurity Labeling Scheme for Medical Devices sandbox, which medical device manufacturers are invited to join. Jen covered some recent research from Lloyd’s on the potential cost and impact of a large scale cyber attack against payments systems. Our Mystery Trivia Master this week is the wonderful Megan Stifel, Chief Strategy Officer for the Institute for Security and Technology and Executive Director of the Ransomware Task Force. News Section:Singapore International Cyber Week 2023Singapore Cybersecurity Labeling Scheme for Medical Devices SandboxLloyd’s of London finds hypothetical cyberattack could cost world economy $3.5 trillionInterview Section:Computer Crime and Intellectual Property Section (CCIPS)Digital Millennium Copyright Act (DMCA)Ninth Triennial Section 1201 Proceeding, 2024 CycleCybercrime and the Law: Computer Fraud and Abuse Act (CFAA) and the 116th CongressComputer Fraud and Abuse Act (CFAA) Guidance from DOJNinth Triennial Section 1201 Proceeding, 2024 CycleTrivia Section:Comprehensive National Cybersecurity Initiative (CNSI)Archived White House Release of CNSI

In our latest episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Irfan Hemani, Deputy Director of Cyber Security Policy at the UK's Department for Science, Innovation, and Technology. In this role, Irfan is responsible for Cyber Resilience Policy for the UK's wider economy and society. The discussion focuses on how the UK currently approaches securing emerging technologies,  from both enterprise and consumer perspectivesNews Section:TSA Finalizing Cybersecurity Guidelines for Pipeline Operators and VendorsDeputy National Security Advisor provides details on ratings effort to determine security of pipeline, rail sectorsLATAM CISO Summit 2023Microsoft Digital Defense ReportInterview Section:Cyber Power IndexETSI EN 303 645 Cybersecurity Standard for Consumer IoT DevicesProduct Security and Telecommunications Infrastructure (PSTI) ActUK AI Safety SummitTrivia Section:Soviet Memorial Causes Rift between Estonia and RussiaThe Bronze Soldier Crisis of 2007: Revisiting an Early Case of Hybrid Conflict

In our latest episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by former U.S. Congressman Jim Langevin. Jim spent more than 22 years representing Rhode Island’s 2nd Congressional District in the U.S. House of Representatives. The discussion focuses on his enormous influence the development of U.S. congressional cyber policy.News Section:Clorox Cyberattack Brings Early Test of New SEC Cyber RulesAustralia to ‘Build Six Cyber Shields’International Criminal Court Will Now Prosecute Cyberwar CrimesInternational Criminal Court Hack Interview Section:Cyberspace Solarium Commission ReportLongtime Congressman James Langevin to serve as senior fellow at Brown’s Watson InstituteFormer Congressman James Langevin to serve as visiting scholar at URIElissa Slotkin to co-chair Congressional Cybersecurity Caucus ‘Cyber risk is business risk, and the SEC knows it’, Chris Inglis, Jim Langevin & Mark MontgomeryTrivia Section:NIST Cybersecurity FrameworkCR2 and NIST workshop: “A Cyber Framework Fit for Global Use: Cybersecurity Framework (CSF) 2.0”

In our latest episode, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are joined by Mieke Eoyang, the Deputy Assistant Secretary of Defense for Cyber Policy. As the highest ranking civilian at the U.S. Department of Defense (DoD), tasked with thinking exclusively about cyber policy, Ms. Eoyang was able to provide valuable insights around the recently released unclassified 2023 DoD Cyber Strategy summary. News Section:Microsoft’s post on the UN Cybercrime TreatyUK’s review of the Investigatory Powers ActCISA appoints MudgeCISA’s VDP Platform Report Interview Section:2023 DoD Cyber Strategy DASD Mieke Eoyang at DEF CONEmployment Opportunities at DoDThe Subversive Trilemma: Why Cyber Operations Fall Short of ExpectationsTrivia Section:ENISA’s Certification Schemes 

In this episode of Distilling Cyber Policy, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law sat down with Joshua Corman, co-founder of I Am The Cavalry, to learn more about the movement and its significant impact on the development of cybersecurity policy.  In addition to the above, this week’s episode features recent cyber policy developments from Japan, the U.K., and Bangladesh, as well as some tricky cryptography trivia. News Section:Chinese military hackers penetrated Japan’s most sensitive computer networksPolice Service of Northern Ireland (PSNI) BreachesNorfolk and Suffolk police: Victims and witnesses hit by data breachBangladesh proposes a new Cybersecurity LawInterview Section:I Am The Cavalry SiteOriginal Cavalry Launch video "The Cavalry Isn't Coming…10 Years Later Keynote "And together we crossed the river.. "Cavalry Track Day 1Cavalry Track Day 2Trivia Section:Skipjack

In this episode of Distilling Cyber Policy, hosts Alex Botting and Jen Ellis dive into the world of hacker conferences with guests Beau Woods and Harley Geiger. The discussion focuses on the importance of collaboration between the policy and security communities at these events, and the unique policy learning opportunities at the upcoming DEF CON, the world’s biggest hacker conference. News:Kenya Experiences Major Cyber AttackSEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public CompaniesDNI Haines Statement on the President’s Intent to Nominate Harry Coker Jr. as the National Cyber DirectorInterview:Beau WoodsHarley GeigerHacking Policy CouncilThe Hackers, the Lawyers, and the Defense Fund - Harley's Presentation at DEF CONPolicy @ DEF CONAI Village @ DEF CON 31Hacker Summer Camp Party ListTrivia: EFF Tech Trivia @ DEF CON 31Investigation Into Encrypted Phone Network Leads to 6,500 ArrestsIf you have a trivia question for Jen and Alex, email it to [email protected]!

In this episode of Distilling Cyber Policy, hosts Alex Botting and Jen Ellis engage in a riveting conversation with Kaja Ciglic, Senior Director of Digital Diplomacy at Microsoft. The discussion delves into the proposed UN Cybercrime Convention, including its origins and scope, as well as some of the treaty’s most contentious topics. The hosts and Kaja also touch on the role of industry and civil society in shaping cyber policy, emphasizing the importance of diverse voices in these critical conversations.News:National Cyber Strategy Issues Implementation Plan Acting National Cyber Director Withdraws NominationWhite House IoT Labeling ProgramEvaluation of the European Union Agency for Cybersecurity (ENISA) and the European Cybersecurity Certification FrameworkInterview Section:UN Cybercrime Convention DraftParis CallThe Budapest Convention on Cyber CrimeTrivia:Intelligence-Driven Incident Response, 2nd Edition by Rebekah Brown, Scott J. RobertsPPD-41

In this episode of Distilling Cyber Policy, hosts Alex Botting and Jen Ellis engage in a thought-provoking discussion with cybersecurity expert and Member of European Parliament, Bart Groothuis. The conversation centers around the Cyber Resilience Act (CRA), its implications for cybersecurity globally, and how to address untrustworthy vendors in European networks..MEP Groothuis, drawing from his experience as Parliament's cybersecurity rapporteur, sheds light on the extensive influence an individual can have in shaping legislation. He emphasizes the importance of understanding the subject matter and leveraging expertise to convince stakeholders, ultimately shaping the language and provisions of the CRA. This insightful perspective highlights the significant role of security professionals in driving meaningful change.The conversation then delves into the concept of software liability.  Groothuis explains how the legislation provides a framework for legal disputes arising from cybersecurity incidents. He emphasizes the need for clear legislation concerning risky vendors, particularly those associated with countries known for offensive espionage programs.  Groothuis advocates for de-risking practices and the incorporation of non-technical factors when evaluating software for critical infrastructure.Throughout the episode, Groothuis’ expertise and passion for cybersecurity legislation shine. His calls for stronger measures against risky vendors and his efforts to ensure the protection of critical infrastructure create a compelling narrative. Listeners gain valuable insights into the complex world of cybersecurity legislation and the vital role it plays in securing our digital landscape.Additional Resources:Europol press release on EncroChatAustralia’s New National Cyber CoordinatorGoogle Announces $20M for Cyber ClinicsCRA ProposalITRE Amendments:Amendments 124-404Amendments 405-546