<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoPlainText">May be of interest.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: CNI-ANNOUNCE -- News from the Coalition for Networked Information <CNI-ANNOUNCE@cni.org> On Behalf Of Cliff Lynch<br>
Sent: Saturday, March 9, 2024 1:01 PM<br>
To: CNI-ANNOUNCE -- News from the Coalition for Networked Information <CNI-ANNOUNCE@cni.org><br>
Subject: [External] [CNI-ANNOUNCE] British Library Report on Cyberattack</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Use caution with links and attachments.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">After a long period of quiet, the British Library has just issued a very thoughtful and helpful report on the extremely disruptive and damaging cyberattack that took place in October 2023 and that they are still recovering from. This
deserves wide review by leadership of organizations concerned with both information delivery and stewardship of cultural and intellectual heritage.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">There's a blog post that provides context at <a href="https://blogs.bl.uk/living-knowledge/2024/03/learning-lessons-from-the-cyber-attack.html">
https://blogs.bl.uk/living-knowledge/2024/03/learning-lessons-from-the-cyber-attack.html</a><o:p></o:p></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText">and a longer report (about 18 pages) at <a href="https://www.bl.uk/home/british-library-cyber-incident-review-8-march-2024.pdf">
https://www.bl.uk/home/british-library-cyber-incident-review-8-march-2024.pdf</a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">There are much broader systemic issues that aren't directly addressed in the BL report (which very much takes an institutional view). To what extent are information delivery and cultural memory and stewardship activities genuinely critical
infrastructure that demand to be treated as such? Where does the responsibility lie, when it must be clearly above the level of individual institutions if these are genuinely critical functions? How do we deliberately introduce and manage redundancy in the
interests of gaining resilience? As a society, what do we hope to accomplish for information delivery and stewardship of the cultural record in an environment of intensive cyber-attacks, whether motivated by criminal elements, geopolitics, or (increasingly)
some hybrid of the two? What are the risks and the vulnerabilities?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I'm very eager to engage these questions, which I've worried about for two decades now, and perhaps this report (and other events, including other attacks on libraries and cultural memory institutions, and the recent spate of attacks
on biomedical facilities) will lend some new urgency to these discussions. Perhaps, in the US, the growing focus on risks to critical infrastructure of various kinds and the federal government efforts to begin to address these risks will begin to consider
these vulnerabilities.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Clifford Lynch<o:p></o:p></p>
<p class="MsoPlainText">Director, CNI<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>