Technology Advisory Committee Meeting – March 22, 2023

TAC Sponsor

Commissioner Christy Goldsmith Romero
Opening Remarks

Commissioner

Christy Goldsmith Romero

Commissioner 

Kristin N. Johnson

Chairman

Rostin Behnam

Commissioner

Summer K. Mersinger

Commissioner

Caroline D. Pham
Global Markets Advisory Committee

Topic 1: Exploring Issues in Decentralized Finance
CONFIDENTIAL

Decentralization

March 22, 2023

Prepared for:
CONFIDENTIAL 5

Decentralization is not new

Significance

● Decentralization has existed in history in so many forms, e.g. democracy, tax 

authorities, state-nations

● The least decentralized environment has historically been finance

● Today modern technology (cryptography, consensus mechanisms) eliminates all 

obstacles towards a “decentralized computer” for DeFi and Dapps

● Bringing decentralization to finance requires a true understanding of the means 

and goals of DeFi
CONFIDENTIAL 6

Decentralization has many aspects

Definition

● Definition: “Decentralization refers to the transfer of control and decision-making 

from a centralized entity (individual, organization, or group thereof) to a 

distributed network.”

● Protocol decentralization has commonly included the following dimensions:

- Open Source (development of technology)

- Network / Nodes (operations)

- Custody (variety of options/wallets)

- Dapps / DeFi (application logic)

- Decision Making & Economy (governance & token economics)

● Ecosystem decentralization varies across its components

- Multiple L2s, bridges, exchanges, oracles, etc. are part of the ecosystem
CONFIDENTIAL 7

Benefits from “decentralization”

Benefits

● Increases transparency and accountability

○ Could we have prevented “SVB problem” with decentralization?

● Enhances security

○ Could New Zealand Bank, Robinhood data breaches have been 

prevented through decentralization?

● Enables greater autonomy and control
CONFIDENTIAL 8

Some key challenges to overcome

Challenges

● Bootstrapping

○ Threshold levels needed

● Technological Maturity

○ Scalability

○ Interoperability

● Governance

○ “Tragedy of the Commons”

● Lack of risk management tools by traditional 

finance
CONFIDENTIAL 9

Conclusion

Conclusion

● The benefits of decentralization far outweigh the challenges

● Some challenges will self-resolve as a function of time and 

technology progress

● New tools and practices for governance and risk management 

need to be applied to DeFi to allow broader adoption

DeFi Challenges and Opportunities

March 22, 2023

TRMLABS.COM 2022 © All Rights Reserved. TRM Labs.

CFTC Technology Advisory Committee
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Lending & 

Liquidity 

DeFi Enables 

Asset 

management

Tokenization

Lending 

DeFi Stable 

coins 

P2P/

AMMs 

Bridges
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

DeFi Overview

Why Do We 

Care?

https://defillama.com/

The total value locked (TVL) in DeFi has exploded in the past two years, 

from about $10 billion in October 2020 to $47 billion in February 2023. DeFi 

has been stress tested and did not fail.
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Decentralized Finance 

What are the 

vulnerabilities we 

need to address?

External 

Market Manipulation 

● Flash Loans 

● Oracle manipulation

Money Laundering 

● Cross chain hops 

● Decentralized 

exchanges

Internal

Technology Risks (hacks) 

● Code exploits 

● Infrastructure attacks 

● Protocol attacks

Frauds and scams

Sanctions 
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Decentralized Finance 

What are the 

vulnerabilities we 

need to address?

External 

Market Manipulation 

● Flash Loans 

● Oracle manipulation

Money Laundering 

● Cross chain hops 

● Decentralized 

exchanges

Internal

Technology Risks (hacks)

● Code exploits 

● Infrastructure attacks 

● Protocol attacks

Frauds and scams

Sanctions 
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

● 2022 was record year for 

hacks

● $3.7 billion in stolen funds.

● 80% against DeFi

Technology Risks
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Decentralized Finance 

What are the 

vulnerabilities we 

need to address?

External 

Market Manipulation 

● Flash Loans 

● Oracle manipulation

Money Laundering 

● Cross chain hops 

● Decentralized 

exchanges

Internal

Technology Risks (hacks) 

● Code exploits 

● Infrastructure attacks 

● Protocol attacks

Frauds and scams

Sanctions 
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

11 “mega” investment 

fraud schemes received 

>$100m in 2022s

How do we mitigate the 

risk of frauds and scams 

in the DeFi ecosystem?

Between January and October 

2022, TRM identified 11 “mega” 

fraud schemes, which each 

received more than $100M and 

together accounted for about 74% 

of the total amount.
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Decentralized Finance 

What are the 

vulnerabilities we 

need to address?

External 

Market Manipulation 

● Flash Loans 

● Oracle manipulation

Money Laundering 

● Cross chain hops 

● Decentralized 

exchanges

Internal

Technology Risks (hacks) 

● Code exploits 

● Infrastructure attacks 

● Protocol attacks

Frauds and scams

Sanctions 
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

20

How should we do 

sanctions compliance in 

the DeFi ecosystem?

Sanctions Risk
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Decentralized Finance 

What are the 

vulnerabilities we 

need to address?

External 

Market Manipulation

● Flash Loans 

● Oracle manipulation

Money Laundering

● Cross chain hops 

● Decentralized 

exchanges

Internal

Technology Risks (hacks) 

● Code exploits 

● Infrastructure attacks 

● Protocol attacks

Frauds and scams

Sanctions 
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

22

Market Manipulation

• Mango Markets

• DeFi services

• Oracle Manipulation

• Deposit funds

• Long and short position

• Not illegal today . . .
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Decentralized Finance 

What are the 

vulnerabilities we 

need to address?

External 

Market Manipulation 

● Flash Loans 

● Oracle manipulation

Money Laundering 

● Cross chain hops 

● Decentralized 

exchanges

Internal

Technology Risks (hacks) 

● Code exploits 

● Infrastructure attacks 

● Protocol attacks

Frauds and scams

Sanctions 
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Public

The promise of blockchain technology
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Permanent

The promise of blockchain technology
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Private

The promise of blockchain technology

Privacy-Enhancing Technologies (PETs) like zeroknowledge proofs are being deployed at the protocol, 

middleware, and application layers to advance data 

protection and privacy goals. PETs can be used to make 

information on blockchains private, such as transaction 

details or data on blockchain-based computer programs.
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Decentralized Finance 

While there are 

vulnerabilities, the technology 

can mitigate the risks. 

External 

Market Manipulation 

● Flash Loans 

● Oracle manipulation

Money Laundering 

● Cross chain hops 

● Decentralized 

exchanges

Internal

Hacks 

● Code exploits 

● Infrastructure attacks 

● Protocol attacks

Frauds and scams

Sanctions 

Centralized VASPs remain critical to the off ramping of illicit funds - “All 

Roads Lead to VASPs.”
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Regulatory/Policy 

Landscape Today

TODAY’S MODEL
PROPRIETARY & CONFIDENTIAL www.trmlabs.com

Blockchains can 

change the face of 

regulation

FUTURE
DIGITAL IDENTITY, PRIVACY, UNHOSTED

WALLETS: WHAT’S ON THE HORIZON?

JILL GUNTER

CAROLE HOUSE

COMMODITY FUTURES TRADING COMMISSION (CFTC) TECHNOLOGY ADVISORY COMMITTEE (TAC)

MARCH 2023

30
IDENTITY OVERVIEW - A COMPLEX ECOSYSTEM

31

What is Identity?

A unique representation of a person in a 

specific context

Ex.:

 Official: taxpayer, veteran

 Social: social media, gamer profile, 

reputation

 Financial: accountholder, credit 

applicant, ultimate beneficial owner

Attributes

Physical or behavioral characteristics by 

which an individual is uniquely 

recognizable

Ex.: Name, address, DOB, email, IP 

address, credit or gaming history

Evidence

Document or information provided to 

support the claimed identity

Ex.: driver’s license, utility bill, selfie

Sources: NIST 800-63 series, FATF Digital Identity Guidance, March 

2020

Identity in Finance –

“Knowing Your Customer” (KYC)

Generally a term referring to a variety of 

measures (some rules-based, some riskbased) to inhibit money laundering and fraud 

as well as to understand the risk profile of 

one’s customer

Example elements:

 Establish identity, form a reasonable belief 

that it is real and belongs to customer

 Due diligence for high-risk customers

 Transaction and risk monitoring

Components of Identity 

Assurance 

Categories for degree of confidence that 

the claimed identity is the person’s real 

identity

 Identity Proofing and Enrollment

 Ex. exploitation: identity fraud

 Ex. strengthening: more/stronger 

evidence

 Authentication

 Ex. exploitation: account 

takeovers

 Ex. strengthening: multi-factor 

authentication (MFA)

 Federation and Assertions

 Ex. exploitation: assertion 

modification or redirect

 Ex. strengthening: trust 

agreement, injection protection

Considerations: Security, Equity, Privacy, 

Usability
DEFI IDENTITY LANDSCAPE

Sybil Resistance Reputation

Compliance + KYC/AML UBI Standards

32
EXAMPLE IDENTITY PRODUCT - ENS

 With Ethereum Name Service, users can self-identify and publicly affiliate with an Ethereum 

wallet address

 This allows users to prove their on-chain activity, including participating in open source 

governance processes; usage of products and protocols; ownership of art and collectibles; and 

more

33
PRIVACY LANDSCAPE

Private Payments –compliance emphasis Private Payments – full privacy emphasis

Private Smart Contracts Configurable Privacy Private DeFi

34
EXAMPLE PRIVACY PRODUCT - CAPE

 With CAPE, asset creators can create 

versions of their assets that have 

customized privacy guarantees, to meet 

their risk requirements

 For example, a stablecoin provider can 

offer users a version of their stablecoin

which is private to the general public, but 

the stablecoin organization can retain 

insight into the full transaction graph 

(addresses, amounts, etc.)

35
SELF-CUSTODY LANDSCAPE (UNHOSTEDWALLETS)

Multi-Party Computation Wallets Mobile Wallets

Hardware Wallets Browser-Based Wallets

36
EXAMPLE WALLET PRODUCT - METAMASK

 Metamask offers a gateway to 

decentralized applications, right in the 

browser

 Metamask pops up as a plug in, acting as 

a universal log-in to be able to use and 

access decentralized finance, social, and 

media applications

 Shown here with decentralized blog / 

media application Mirror.xyz

37
IDENTITY, PRIVACY, AND UNHOSTEDWALLETS – ISSUES AND IN THE 

NEWS

38
DRIVING TOWARDS STANDARDS & CLARITY

 Identity:

 Define key features – What features of a digital identity system do we want to see (and not want to 

see): portability, privacy, verifiability, equity and equality of access, recoverability, etc?

 Establish use cases – What use cases do we care about (KYC/AML, "Sybil resistance", proof-ofhumanity, etc)?

 Traditional identity fixes needed for defi – What issues exist in traditional identity systems that 

have to be fixed to prevent decentralization of the same identity problems in “tradfi” (e.g., identity 

verification, prevalence of verifiable credentials, KYC/reliance, etc.)?

 Ensure responsibility in the ecosystem – What does responsibility and accountability for a 

decentralized identity system look like?

39
DRIVING TOWARDS STANDARDS & CLARITY

 Privacy:

 Incentivizing development for data protection and appropriate discoverability – How to encourage or enable builders to 

protect user privacy, without sacrificing the ability of government and industry to detect, prevent, and disrupt criminal use and 

national security threats?

 Prioritizing and promoting tech with protections – How to engage, protect, and encourage builders and innovators without 

condoning products that abet threatening actors?

 Unhosted wallets:

 Calibrating role, treatment, freedom, and responsibility of builders – How to avoid creating undue burden on builders of open 

source wallet software?

 Examining how risk, accountability, and discoverability should work in evolving systems – What kind of identity system 

enables proper discoverability of certain information (to which counterparties/authorities?) related to unhosted wallets in a 

system........

a) that largely relies on central parties and cashout points?

b) that relies largely on decentralized networks and less need for cashout points?

c) where the unhosted wallet holds financial assets and non-financial assets? 40
QUESTIONS?

41
CFTC Technical Advisory Committee | March ǽǽ, ǽǻǽǾ

Understanding Crypto Markets Security

Dan Guido - CEO, Trail of Bits
CFTC Technical Advisory Committee | March ǽǽ, ǽǻǽǾ

Trail of Bits

Background

● We help solve the hardest challenges in software security 

● Unmatched expertise: Ǽǿǻ research engineers w/ ǽǻ in blockchain security

● Worked with DARPA, DoD, tech, and entire blockchain industry

● Have secured internal operations and blockchain code

● CEO: Product of a CISA/SFS grant, dedicated to getting software right
CFTC Technical Advisory Committee | March ǽǽ, ǽǻǽǾ

Things are not what they seem

Perception

● Everyone is getting hacked and 

losing millions

● The industry is awash in scams 

and schemes 

● Security is mostly an afterthought

Reality

● Very difficult for orgs to keep up

● Industry is dominated by awful 

marketing

● Some of our clients are the most 

mature and security-conscious 

companies we work with

State of the blockchain industry
CFTC Technical Advisory Committee | March ǽǽ, ǽǻǽǾ

The field moves fast

Insights

● A firm six months behind the curve on 

security is already woefully behind, we 

ourselves can barely keep up

● Standards in other industries - NIST CSF, 

SOC-ǽ, PCI - don’t and won't work here

● Today looks nothing like ICOs of ǽǻǼȂ: 

bridges, Lǽs, DeFi, composability

● Criminals have also become more 

resourceful and sophisticated: 

composability bugs, flash loans, price 

oracle manipulation

The problems we’re solving 

today didn’t exist 5 years ago

Before ~2020 After ~2020

● Arithmetic 

overflow

● Lack of access 

controls

● Reentrancy

● Price Oracle 

Manipulation

● Slippage 

● Cross contract 

reentrancy

● Third party 

integrations
CFTC Technical Advisory Committee | March ǽǽ, ǽǻǽǾ

● Breaches on public on social media 

before orgs can react; Twitter, 

Discord, Telegram will know 

instantly

● Opportunity to learn – you can 

walk-through blockchain attacks 

step-by-step

● Inverted view on what is ‘secret’ - all 

contracts and transactions are 

inspectable by anyone, by design

Information is public and platforms are shared

Insights
CFTC Technical Advisory Committee | March ǽǽ, ǽǻǽǾ

The bar is higher for blockchain

Insights

● We’re building blockchain with stone tools

● Every code change is critical – safe today 

doesn’t mean safe tomorrow. 

● Blockchain code requires rocket-level safety 

assurances 

● AI isn’t going to save blockchain security; 

need a scalpel, not a paintbrush

● Existing best practices are necessary but 

insufficient: we need more research
CFTC Technical Advisory Committee | March ǽǽ, ǽǻǽǾ

Key Takeaways

Summary

● Blockchain companies are motivated to fix security issues and many are very 

security-conscious.

● Blockchain’s security foundation shifts incredibly fast and requires holistic 

understanding of financial and technological concepts

● Public nature of blockchain presents enormous learning opportunity

● Improved tooling and continuous testing is deeply needed; motivation and 

desire is not enough

... So how do we have a conversation about improving controls?
CFTC Technical Advisory Committee | March ǽǽ, ǽǻǽǾ

Does your protocol pass The Rekt Test?

Our checklist allows protocols to examine their own procedures and create best practices.

❏ Do you use the best automated tools for 

discovering security issues in your code?

❏ Have you defined key invariants for your 

system and do you test them on every 

commit?

❏ Have you received an external audit and do 

you run a vulnerability disclosure or bug 

bounty program?

❏ Have you documented all the external 

services, contracts, and oracles you rely on?

❏ Have you documented the best ways to attack 

your own system?

❏ Have you considered and mitigated avenues 

for abusing users of your system?

❏ Have you documented all actors, their 

roles, and their privileges?

❏ Does your key management system require 

multiple humans and physical steps?

❏ Do you have a written and tested incident 

response plan?

❏ Have all employees undergone positive 

identification and background checks?

❏ Does someone on your team have security 

defined in their role?

❏ Does access to production systems require 

hardware security keys?
CFTC Technical Advisory Committee | March ǽǽ, ǽǻǽǾ

Resources

The Rekt Test Are blockchains 

decentralized?

2ǿȁ findings 

from audits

Contact 

@dguido

dan@trailofbits.com

trailofbits.com

ȁȀ open source 

tools

Smart contract best 

practices
Brief Overview of Real 

World Crypto Hacks

For CFTC TAC 3/2023
1,800+

customers

$4T+

transactions secured

A platform that enables financial institutions to work 

with digital assets in secure and simple way

TRUSTED BY INDUSTRY LEADERS

90M+

wallets 

Fireblocks

Michael Shaulov

CEO & CO-FOUNDER

Head of Mobile & Cloud,

Check Point

grew to 2000+ customers

CEO & Co-founder, 

LACOON

acquired by Check Point

Treasury Management Institutional Custody Digital Asset Trading

Tokenization of Real 

World Assets

Fireblocks Solutions for Financial Institutions
Agenda

We will review the following hacks:

1. Key management: Ronin

2. Man-in-the-Middle: Badger 

3. Smart Contract: Euler
The Ronin Bridge

▶ Sky Mavis created Axie Infinity - an NFT Play-to-Earn game

▶ Used their own high-performance chain for gaming UX

▶ Ronin Bridge connecting the side-chain to Ethereum

▶ Controlled by a 5/9 multisig; Sky Mavis had 4 private keys

Ronin Bridge

Validator

Validator

Validator

Validator

Validator

Validator

Validator

Validator

Validator

Validator

Validator
The Ronin Breach

Validator

Validator

Validator

Validator

Validator

Validator

Validator

Validator

Validator

Validator

Validator

▶ March 23rd 2022

▶ Targeting Sky Mavis engineers

▶ LinkedIn reachout & interviews

▶ Dream Job offering .pdf.exe

▶ Lateral movement to keys

▶ Axie DAO collab - auto signing

▶ Transfer funds $650mm

◼ 173K ETH 

◼ 25.5M USDC

▶ Attack identified 5 days later
BadgerDAO - Background

▶ Badger dApp - usage

▶ Using Cloudflare for managing dApp’s front-end
BadgerDAO - Hacked

▶ Vulnerability with Cloudflare, allowing to get access to API keys

▶ Attacker gained access to Badger’s front-end, injecting a malicious script

▶ Approve farming starting Nov. 20th for two weeks

◼ Would ask users to approve attacker’s control of their tokens

▶ Trying to stay hidden - filtering out addresses belonging to Badger’s admins

▶ December 2nd, 2021 - attacker cashed out all approvals

Inject malicious 

Javascript code

Trader

Deposit, Allow, etc.

Withdraw

Attacker

Malicious code prompting for ERC20 Approve

Approve
Euler Finance - The Protocol

▶ Trading/lending protocol

▶ Users can enter a debt, trade x10 of their collateral

▶ *eToken - collateral token, dToken - debt token.
Euler Finance - What Went Wrong?

▶ Tuesday March 14th 2023

▶ donateToReserves lacked liquidity checks

◼ Attacker created negative eTokens:dTokens ratio in their first contract

▶ By deploying a flash-loan and depositing tokens in Euler platform, loaning 

other tokens and donating some of the eTokens* to the reserves using 

donateToReserves, the attacker was able to use their second contract to 

liquidate the first -> making profit

Total funds stolen ~ $200MM

(in DAI, WETH, WBTC, USDC, wstETH, and stETH)
Thank you

FOR MORE INFORMATION

FIREBLOCKS.COM
Global Markets Advisory Committee

Topic 2: Ensuring Cyber Resilience in Financial Markets
Treasury/OCCIP Efforts

To Support Sector 

Resilience

CFTC

Technology Advisory Committee

March 22, 2023 TLP:GREEN
TLP:GREEN

Presentation Overview

54

Topics

OCCIP Introduction

Treasury Cloud Report

Cyber Incident Communications Playbook

ION Markets Incident
TLP:GREEN

OCCIP Purpose & Goals

55

Purpose

• Improve the security and resilience of the financial services sector by serving as 

the central node for information related to all hazards threats, building resilience 

through exercises, and responding to incidents when they do occur.

Goal

• Ensure the U.S. maintains the world’s most secure and resilient financial system 

by spearheading whole-of-government efforts to increase the cybersecurity and 

resilience of the American financial system.
TLP:GREEN

Cloud Report Background

56

Coordination with FBIIC

• Last year, Treasury started working on a report on cloud services and potential implications

for operational resilience, in coordination with members of the Financial and Banking

Information Infrastructure Committee, or FBIIC.

Stakeholder and Expert Consultation

• The report was developed with the assistance of subject matter experts at the U.S. financial

regulators. It also reflects input from experts at the Cybersecurity and Infrastructure

Security Agency, National Institute of Standards and Technology, the Office of the National

Cyber Director, and the National Security Council, as well as nearly 50 interviews with

private sector stakeholders, trade associations, and think-tanks.
TLP:GREEN

Primary Findings on Cloud Adoption

57

Range of Maturity in Terms of Cloud Adoption 

• Cloud services is no longer an emerging technology and is widely used for email and 

video conferencing, and now financial institutions are starting to use it for core 

operations. 

Cloud Adoption Expected to Persist

• Some firms, particularly some smaller firms, do not see cloud adoption as a choice, 

since other third-party vendors are discontinuing their on-premises solutions in favor 

of cloud-based solutions.
TLP:GREEN

Benefits of Adoption

58

Potential Benefits 

When configured correctly, Cloud Services can provide significant benefits in terms of 

redundancy, scalability, and security.

1. Redundancy: Cloud services offer physical redundancy with the potential to operate 

from multiple “availability zones,” which are physically or logically isolated data centers 

that host cloud services.

2. Scalability: Cloud services can be procured and deployed much more rapidly than 

traditional private networks. 

3. Security: The security capabilities for public cloud services could generally match or 

exceed their on-premises capabilities.
TLP:GREEN

Challenges with Adoption

59

Treasury noted six main challenges to greater cloud adoption by FIs:

1. Transparency. Financial Institutions lack some information necessary to conduct due diligence and 

monitoring of CSPs, and CSPs note obstacles to providing such information at scale. 

2. Gaps in Expertise and Tools. The shared responsibility model calls upon FIs to have necessary 

expertise, tools, and information. 

3. Exposure to Potential Operational Incidents, Including from Incidents Originating at a CSP: 

Cloud services are still vulnerable to operational incidents like any technology utilized by financial 

institutions. 

4. Potential Impact of Market Concentration on the Sector’s Resilience: Because cloud adoption 

is concentrated, a large system failure or data breach at one of these CSPs could impact the sector.

5. Dynamics in Contract Negotiations: Treasury discovered asymmetry in bargaining power in favor 

of CSPs, especially among small institutions. 

6. International Landscape and Regulatory Fragmentation. FIs report that consistent adoption of 

cloud across jurisdictions is hindered by data localization requirements and inconsistent regulatory 

frameworks. Foreign regulators will start to oversee CSPs, which could result in negative impacts to 

all customers.
TLP:GREEN

Next Steps – Strategic Vision

60

The next steps taken by Treasury will be guided by its Strategic Vision for Supporting 

the Resilience of the Financial Sector’s Use of Cloud Services. 

This articulation of Treasury’s long-term objectives includes: 

 A Preamble that focuses on common interests shared by all stakeholders and announces 

principles for collaborating with such stakeholders on addressing issues that could impact 

the operational resilience of the sector.

 Principles in terms of risk assessment and mitigation. 

 Priorities in terms of sector-wide concentration. 

 Objectives in terms of domestic and international collaboration and coordination.
TLP:GREEN

Next Steps – Cloud Services Steering Group

61

Treasury will set up an interagency Cloud Services Steering Group to coordinate on issues 

raised in this report. Reporting to both FSOC and FBIIC.

We anticipate this will be a multi-year effort. Key objectives include:

 Develop common definitions and terms;

 Enhancement of interagency information sharing and risk management pertaining to 

enhancement of both the financial services sector and cloud service providers;

 Incident response involving cloud services, such as updating processes to expand 

communication channels between U.S. financial regulators, CSPs, and financial 

institutions; and 

 Sector-wide measurement of the concentration of critical uses of cloud services and 

similar third-party services.
TLP:GREEN

Next Steps – Stakeholder Engagement

62

Treasury will pursue continued engagement with the private sector on various issues raised in 

the report, including issues related to risk management practices and contracting.

• Treasury will lead ongoing engagement with the Financial Services Sector 

Coordinating Council (FSSCC), which will set up a working group to tackle cloud 

issues from the industry perspective.

• Initial deliverables will be Cloud Adoption Framework (Cyber Risk Institute) and Cloud 

Contracts Best Practices (SIFMA).

• Treasury will promote cooperation between CSPs and the financial sector, including 

through the development of best practices and a framework for cloud adoption. 

A key objective in the near and medium term is for the public sector and the financial 

sector to provide more actionable feedback for individual CSPs.
TLP:GREEN

Background and Context

63

 Following the stand-up of the Unified Coordination Group (UCG) by DHS on February 22, 

2022, US Treasury engaged with financial sector organizations to develop a joint playbook for 

how the USG and industry may communicate and engage during incident response and 

recovery in the current period of heightened geopolitical tensions.

 Developed for use in response to the heightened vigilance and activity generated by the 

Russia-Ukraine conflict, this description will be primarily utilized to coordinate communication 

related to specific incidents/events observed in the financial services sector and other critical 

sectors that have systemic impact on financial services.

 The playbook leverages the Cyber Incident Severity Schema developed by the U.S. 

Government and aligns potential USG actions and industry needs with each of the five levels 

within the schema. For incidents at each level of the schema, the description includes an 

outline of expected government coordination and communications actions, examples of 

anticipated business impacts for such an incident, and a representative list of extraordinary 

requests that the financial services sector may issue to USG partners.
TLP:GREEN

Escalatory Phase Charts

64

 The UCG created an escalatory phase

chart (phase 0 to 3b) contemplating

specific escalatory phases specific to the

Russia cyber threat

 The UCG phases were overlayed onto

the FBIIC Cyber Incident Severity level

schema to provide extra context for firms’

cyber threat level analysis for each UCG

threat phase.
TLP:GREEN

Summary - Industry Asks of Government in Response to Various Cyber Scenarios

65

 Maintain clear, direct channels of communication between USG and firms

 Coordinate public messaging at market speed, especially to maintain public confidence in the financial system and to 

minimize false presumption of market instability

 Protect critical cyber ops resources from disruption by coordinating and minimizing the duplication of regulatory and 

government inquiry; firms will engage regulators as part of their response planning

 Coordination, working with existing market solutions, of changes to normal market hours or operation _ emergency 

planning for banking services/markets/trading/settlement disruption

 Share intelligence and early warning wherever possible (including exchange directly among analysts to provide 

context)

 Prioritize Section 9 firms in the restoration/reconnection plans for critical infrastructure (FedWire, CHIPS, DTC, etc.) 

and cross sector dependencies (ISP, Telecom, Electricity)

 Extend hours for critical infrastructure processing – i.e., FedWire, CHIPS, DTC, etc.

 Provide temporary regulatory relief/forbearance – capital/liquidity/reporting/cyber regulation/resolution triggering

 Authorize firms to bypass pre-payment sanctions screening to avoid systemic disruptions in payments markets

 Implement flexible emergency lending capacity and other solutions for injecting liquidity into financial system

 Notify firms of SIFMU disruption or impact
TLP:GREEN

ION Markets Incident: Beginning

66

Overnight January 30-31, 2023

• ION Markets division of ION Group struck by Lockbit ransomware 

• Lockbit ransomware disabled hosted services used to clear trades among derivatives, fixed income, and 

foreign exchange traders.

• At outset it was believed that all of ION Markets’ services had been disrupted

January 31, 2023

• Disruption of ION’s trade-clearing services results in growing backlog of trades 

• Futures Industry Association (FIA) begins coordination calls among members

• By end of day, there are also delays in reports from exchanges to their regulatory agencies.

Concerns 

Sector Risks

• Possible liquidity crunch, if a sufficient number and size of firms are forced to default 

Sub-Sector Risks

• Increased market fragility for next several weeks or months 

• Degradation of trading speed

• Failure to comply with regulatory reporting obligations
TLP:GREEN

ION Markets Incident: Assessing Impact from OCCIP’s Perspective

67

Unknowns, as of the morning of February 1 

• UNK number and type of ION’s services disrupted

• UNK number and size of impacted Financial Institutions

• UNK size of outstanding debt held by impacted traders and size of creditors

Knowns, as of the morning of February 1

• Disruption caused “National-level” impact among dispersed group of traders

• “Significant” impact to sector business critical services

• Active, financially-motivated cyberattack

Assessment

• Based on known information and likely estimates, OCCIP assessed the ION Incident as a Level 2, 

Medium severity incident (morning of February 1, 2023).
TLP:GREEN

OCCIP and USG Response

68

February 1, 2023

OCCIP participates in series of calls with private and public sector stakeholders

Findings

• Calls reveal that 42 firms have been impacted

• Firms are of the small-to-medium category

• Open communication among traders, exchanges, and regulators

• Strong compensatory measures have been enacted by traders

• Mutual aid among traders, exchanges, and lenders

• Regulatory scrutiny and flexibility is present

• Treasury issues press statements to calm public/markets

Conclusion

• Based on these findings, OCCIP determined that there is no longer a “systemic risk” posed by this 

incident.

• Severity downgraded to Level 1, Low (close of business, February 1, 2023).
TLP:GREEN

U.S. Treasury OCCIP Contacts

69

Todd Conklin

Deputy Assistant Secretary

Cybersecurity and Critical Infrastructure 

Protection

Todd.Conklin@treasury.gov

Tim McCabe

Deputy Director

Sector Resilience

Timothy.McCabe@treasury.gov

Incident Mailbox

Occip-coord@treasury.gov
TLP:GREEN

THANK YOU...

70
Managing Cybersecurity Risks

CFTC TAC

Kevin Stine, NIST

March 22, 2023
Managing Risks to the Enterprise
Cybersecurity Framework

• Common and accessible language

• It’s risk- and outcome-based

• It’s meant to be paired

• It’s a living document

• It’s adaptable to many technologies, 

lifecycle phases, sectors and uses

• Guided by many perspectives – private 

sector, academia, public sector

Helping Organizations Better Understand, Communicate, Manage, 

and Reduce Cybersecurity Risks
CSF 2.0: Potential Changes

Among other improvements, CSF 2.0 will:

• emphasize the importance of cybersecurity governance 

• emphasize the importance of cybersecurity supply chain risk management (C-SCRM)

• advance understanding of cybersecurity measurement and assessment 

June 2022

Workshop #1

April 2022

130+ RFI Comments

received

COMMUNITY ENGAGEMENT

February 2023

Workshop #2

February 2023

Working Sessions

Fall 2023

Workshop #3

Comments Comments

September 2022

Workshop

Analysis

February 2022

NIST Cybersecurity

RFI

June 2022

RFI

Analysis

January 2023 

Concept Paper

Summer 2023

Draft

Winter 2024

CSF 2.0

2022 2024

4,000 attendees

100 countries
Resources of Interest

• Cybersecurity Framework –

https://www.nist.gov/cyberframework

• CSF 2.0 Update Process 

• Quick Start Guide 

• Resources

• Cybersecurity Supply Chain –

https://csrc.nist.gov/Projects/cyber-supply-chain-riskmanagement

• Cybersecurity SCRM Practices 

• Key Practices in Cyber SCRM: Observations from Industry

Cultivating Trust in Technology - https://www.nist.gov/cybersecurity
Thank You

NIST.gov/cybersecurity

Cybersecurity-Privacy@nist.gov

@NISTcyber
Global Markets Advisory Committee

Topic 3: Responsible Artificial Intelligence (AI)
Alan Mislove

Assistant Director for Data and Democracy

White House Office of Science and Technology Policy

BLUEPRINT FOR AN AI BILL OF RIGHTS

Making Automated Systems Work for the American People
7979

Blueprint for an AI Bill of Rights

Safe and Effective Systems

You should be protected from unsafe or ineffective systems.

https://www.whitehouse.gov/ostp/ai-bill-of-rights
8080

Blueprint for an AI Bill of Rights

Safe and Effective Systems

You should be protected from unsafe or ineffective systems.

Algorithmic Discrimination Protections

You should not face discrimination by algorithms and systems should be used and designed in an

equitable way.

https://www.whitehouse.gov/ostp/ai-bill-of-rights
8181

Blueprint for an AI Bill of Rights

Safe and Effective Systems

You should be protected from unsafe or ineffective systems.

Algorithmic Discrimination Protections

You should not face discrimination by algorithms and systems should be used and designed in an

equitable way.

Data Privacy

You should be protected from abusive data practices via built-in protections and you should have

agency over how data about you is used.

https://www.whitehouse.gov/ostp/ai-bill-of-rights
8282

Blueprint for an AI Bill of Rights

Safe and Effective Systems

You should be protected from unsafe or ineffective systems.

Algorithmic Discrimination Protections

You should not face discrimination by algorithms and systems should be used and designed in an

equitable way.

Data Privacy

You should be protected from abusive data practices via built-in protections and you should have

agency over how data about you is used.

Notice and Explanation

You should know when an automated system is being used and understand how and why it

contributes to outcomes that impact you.

https://www.whitehouse.gov/ostp/ai-bill-of-rights
8383

Blueprint for an AI Bill of Rights

Safe and Effective Systems

You should be protected from unsafe or ineffective systems.

Algorithmic Discrimination Protections

You should not face discrimination by algorithms and systems should be used and designed in an

equitable way.

Data Privacy

You should be protected from abusive data practices via built-in protections and you should have

agency over how data about you is used.

Notice and Explanation

You should know when an automated system is being used and understand how and why it

contributes to outcomes that impact you.

Human Alternatives, Consideration, and Fallback

You should be able to opt out, where appropriate, and have access to a person who can quickly

consider and remedy problems you encounter.

https://www.whitehouse.gov/ostp/ai-bill-of-rights
8484

Listening to the American People

58 meetings 

with industry 

and civil society

150+ emails to 

public email 

address

30+ federal 

departments, 

agencies, and 

components

Adobe

American Civil Liberties Union (ACLU)

The Aspen Commission on Information 

Disorder

The Awood Center

The Australian Human Rights 

Commission

Biometrics Institute

The Brookings Institute

BSA | The Software Alliance

Cantellus Group

Center for American Progress

Center for Democracy and Technology

Center on Privacy and Technology at 

Georgetown Law

Christiana Care

Color of Change

Coworker

Data Robot

Data Trust Alliance

Data and Society Research Institute

Deepmind

EdSAFE AI Alliance

Electronic Privacy Information Center 

(EPIC)

Encode Justice

Equal AI

Institute of Electrical and Electronics 

Engineers (IEEE)

Intuit

Lawyers Committee for Civil Rights 

Under Law

Legal Aid Society

The Leadership Conference on Civil and 

Human Rights

Meta

Microsoft

The MIT AI Policy Forum

Movement Alliance Project

The National Association of Criminal 

Defense Lawyers

O’Neil Risk Consulting & Algorithmic 

Auditing

The Partnership on AI

Pinterest

The Plaintext Group

pymetrics

SAP

The Security Industry Association

Software and Information Industry 

Association (SIIA)

Special Competitive Studies Project

Thorn

United for Respect

Center

Unfinished/Project Liberty

Upturn

US Chamber of Commerce

US Chamber of Commerce Technology 

Engagement Center A.I. Working Group

Vibrent Health

Warehouse Worker Resource Center

Waymap

https://www.whitehouse.gov/ostp/ai-bill-of-rights
FROM PRINCIPLES TO PRACTICE

A Technical Companion to the Blueprint for an AI Bill of Rights
8686

Applying the Blueprint for an AI Bill of Rights

T HIS FRAMEWORK DESCRIBES PROTECTIONS THAT SHOULD B E

APPLIED WITH RESPECT T O ALL AUTOMATED SYSTEMS THAT

HAVE THE POTENTIAL T O MEANINGFULLY IMPACT INDIVIDUALS ’ 

O R COMMUNITIES ’ EXERCISE O F :

RIGHTS, OPPORTUNITIES, OR ACCESS

Civil rights, civil liberties, and privacy, including freedom of speech, voting, and

protections from discrimination, excessive punishment, unlawful surveillance, and

violations of privacy and other freedoms in both public and private sector contexts;

Equal opportunities, including equitable access to education, housing, credit,

employment, and other programs; or,

Access to critical resources or services, such as healthcare, financial services, safety,

social services, non-deceptive information about goods and services, and government

benefits.

https://www.whitehouse.gov/ostp/ai-bill-of-rights
8787

A Technical Companion

to the Blueprint for an AI Bill of Rights

https://www.whitehouse.gov/ostp/ai-bill-of-rights
8888

BLUEPRINT FOR AN AI BILL OF RIGHTS

SAFE AND EFFECTIVE SYSTEMS

You should be protected from unsafe or ineffective systems.

Automated systems should be developed with consultation from diverse communities, stakeholders, and domain experts to identify

concerns, risks, and potential impacts of the system. Systems should undergo pre-deployment testing, risk identification and mitigation,

and ongoing monitoring that demonstrate they are safe and effective based on their intended use, mitigation of unsafe outcomes

including those beyond the intended use, and adherence to domain-specific standards. Outcomes of these protective measures should

include the possibility of not deploying the system or removing a system from use. Automated systems should not be designed with an

intent or reasonably foreseeable possibility of endangering your safety or the safety of your community. They should be designed to

proactively protect you from harms stemming from unintended, yet foreseeable, uses or impacts of automated systems. You should be

protected from inappropriate or irrelevant data use in the design, development, and deployment of automated systems, and from the

compounded harm of its reuse. Independent evaluation and reporting that confirms that the system is safe and effective, including

reporting of steps taken to mitigate potential harms, should be performed and the results made public whenever possible.

https://www.whitehouse.gov/ostp/ai-bill-of-rights
8989

WHY THIS PRINCIPLE IS IMPORTANT

SAFE AND EFFECTIVE

SYSTEMS

● A proprietary model was developed to predict the likelihood of sepsis in hospitalized patients and was 

implemented at hundreds of hospitals around the country. An independent study showed that the model 

predictions underperformed relative to the designer’s claims while also causing ‘alert fatigue’ 

by falsely alerting likelihood of sepsis.

● A device originally developed to help people track and find lost items has been used as a tool by 

stalkers to track victims’ locations in violation of their privacy and safety. The device 

manufacturer took steps after release to protect people from unwanted tracking by alerting people on 

their phones when a device is found to be moving with them over time and also by having the device make 

an occasional noise, but not all phones are able to receive the notification and the devices remain a safety 

concern due to their misuse.

● An algorithm used to deploy police was found to repeatedly send police to neighborhoods they regularly 

visit, even if those neighborhoods were not the ones with the highest crime rates. These incorrect crime 

predictions were the result of a feedback loop generated from the reuse of data from previous 

arrests and algorithm predictions.

https://www.whitehouse.gov/ostp/ai-bill-of-rights
9090

WHAT SHOULD BE EXPECTED OF

AUTOMATED SYSTEMS

SAFE AND EFFECTIVE

SYSTEMS

Protect the public from harm in a proactive and ongoing manner

 Consultation.

 Testing.

 Risk identification and mitigation.

 Ongoing monitoring. 

 Clear organizational oversight.

Avoid inappropriate, low-quality, or irrelevant data use and the compounded 

harm of its reuse

 Relevant and high-quality data.

 Derived data sources tracked and reviewed carefully.

 Sensitive domains data reuse limits. 

Demonstrate the safety and effectiveness of the system

 Independent evaluation.

 Reporting. 

https://www.whitehouse.gov/ostp/ai-bill-of-rights
9191

HOW THESE PRINCIPLES CAN MOVE

INTO PRACTICE

SAFE AND EFFECTIVE

SYSTEMS

● From large companies to start-ups, industry is providing innovative solutions that allow 

organizations to mitigate risks to the safety and efficacy of AI systems, both before 

deployment and through monitoring over time. These innovative solutions include risk 

assessments, auditing mechanisms, assessment of organizational procedures, dashboards to allow for 

ongoing monitoring, documentation procedures specific to model assessments, and many other strategies 

that aim to mitigate risks posed by the use of AI to companies’ reputation, legal responsibilities, and other 

product safety and effectiveness concerns.

● The National Institute of Standards and Technology (NIST) developed a risk management 

framework to better manage risks posed to individuals, organizations, and society by AI.

The NIST AI Risk Management Framework, as mandated by Congress, is intended for voluntary use to 

help incorporate trustworthiness considerations into the design, development, use, and evaluation of AI 

products, services, and systems. The NIST framework was developed through a consensus driven, open, 

transparent, and collaborative process that included workshops and other opportunities to provide input.

https://www.whitehouse.gov/ostp/ai-bill-of-rights
9292

Extra Protections for Data Related to Sensitive Domains

https://www.whitehouse.gov/ostp/ai-bill-of-rights

● Some domains, including health, employment, education, criminal justice, and personal 

finance, have long been singled out as sensitive domains deserving of enhanced data 

protections. This is due to the intimate nature of these domains as well as the inability of individuals to 

opt out of these domains in any meaningful way, and the historical discrimination that has often 

accompanied data knowledge. Domains understood by the public to be sensitive also change over time, 

including because of technological developments. Tracking and monitoring technologies, personal 

tracking devices, and our extensive data footprints are used and misused more than ever before; as such, 

the protections afforded by current legal guidelines may be inadequate. The American public deserves 

assurances that data related to such sensitive domains is protected and used appropriately and only in 

narrowly defined contexts with clear benefits to the individual and/or society.

● To this end, automated systems that collect, use, share, or store data related to these 

sensitive domains should meet additional expectations. Data and metadata are sensitive if they 

pertain to an individual in a sensitive domain (defined below); are generated by technologies used in a 

sensitive domain; can be used to infer data from a sensitive domain or sensitive data about an individual; 

or have the reasonable potential to be used in ways that are likely to expose individuals to meaningful 

harm, such as a loss of privacy or financial harm due to identity theft.
www.whitehouse.gov/ostp/ai-bill-of-rights
The Responsible Development, 

Deployment, and Use of Artificial 

Intelligence

Francesca Rossi

IBM AI Ethics Global Leader

CFTC TAC meeting, March 22nd, 2023
MACHINE LEARNING

DEEP LEARNING

A brief history of AI

1956 1980s ~2010 ~2020

GENERATIVE AI

Generates text, images, 

videos

SYMBOLIC ARTIFICIAL INTELLIGENCE

Intelligent algorithms defined 

and coded by people into 

machines

Ability to learn from data, 

without being explicitly 

programmed

Learning based on Deep Neural 

Networks

CFTC TAC meeting, March 22nd, 2023
High-stakes decision-making applications

Credit Employment Admission Healthcare Enterprise 

Workflows

CFTC TAC meeting, March 22nd, 2023
AI Ethics issues -1

Data privacy and 

governance

AI needs data and can generate data

Fairness AI can make or recommend decisions, and these should not be discriminatory

Inclusion Use of AI should not increase the social gaps

Explainability AI is often opaque

Transparency More informed use of AI

Accountability AI is based on statistics and has always a small percentage of error

Social impact Fast transformation of jobs and society CFTC TAC meeting, March 22nd, 2023
AI Ethics issues -2

Human and 

moral agency

AI can profile people and manipulate their preferences

Misinformation AI can generate plausible but false content

Value 

alignment

AI can generate harmful content

Environmental 

impact

Generative AI (foundation models) need huge amounts of energy for 

training and deployment

Power 

imbalance

Centralization of data and power

CFTC TAC meeting, March 22nd, 2023
AI Ethics

Multidisciplinary field of study

Main goal: how to optimize AI’s 

beneficial impact while reducing risks 

and adverse outcomes 

Tech solutions: How to design and build 

AI systems that are aware of the values 

and principles to be followed in the 

deployment scenarios

Socio-tech approach: To identify, study, 

and propose technical and nontechnical 

solutions for ethics issues arising from 

the pervasive use of AI in life and society

CFTC TAC meeting, March 22nd, 2023
AI Ethics 3.0

2015–2016

Awareness

• Mostly in academia, multidisciplinary

2017–2018

Principles

• Corporations, governments, 

academia, civil society, multistakeholder organizations

2019-ongoing

Practice

• Regulations, standards, corporate 

directives, processes, auditing, 

certifications

As AI evolves, AI ethics must evolve as well.

CFTC TAC meeting, March 22nd, 2023
Tools Policies

Education Diversity

Multi-stakeholder 

consultation

Socio-technical issues 

need 

socio-technical solutions

CFTC TAC meeting, March 22nd, 2023
AI Ethics: Every societal actor is involved

Standard bodies

• IEEE P7000 series:

• IEEE 7000TM-2021 – Model Process for Addressing Ethical Concerns During System Design

• IEEE P7001TM – Transparency of Autonomous Systems

• IEEE P7002TM – Data Privacy Process

• IEEE P7003TM – Algorithmic Bias Considerations

• IEEE P7004TM – Standard on Child and Student Data 

Governance

• IEEE P7005TM – Standard on Employer Data Governance

• IEEE P7007TM – Ontological Standard for Ethically driven Robotics and Automation Systems

• IEEE P7008TM – Standard for Ethically Driven Nudging for Robotic, Intelligent and Autonomous 

Systems

• IEEE P7009TM – Standard for Fail-Safe Design of Autonomous and Semi-Autonomous Systems

• IEEE 7010TM-2021 – Wellbeing Metrics Standard for Ethical Artificial Intelligence and Autonomous 

Systems

• IEEE P7011TM – Standard for the Process of 

Identifying & Rating the Trust-worthiness of News 

Sources

• IEEE P7012TM – Standard for Machine Readable 

Personal Privacy Terms

• IEEE P7014TM – Standard for Ethical considerations 

in Emulated Empathy in Autonomous and 

Intelligent Systems

Research

• Fairness

• Explainability

• Interpretability

• Robustness

• Privacy

• Value alignment

Educational 

institutions

Nerd for Tech, 2021

AI companies

• Governance

• Internal processes

• Tools

• Risk assessment

• Training

Governments

AI Bill of Rights (US)

AI Act (EU)

AIDA (Canada)

... many others

Together with: civil society organizations, media, activists, society at large CFTC TAC meeting, March 22nd, 2023
Why should 

organizations that 

build or use AI care 

about ethics?

CFTC TAC meeting, March 22nd, 2023

Company values

Company reputation

Social justice and equity

Client & investor inquiries

Clients’ trust

Business opportunities

Existing or expected regulations
IBM Principles 

for Trust and 

Transparency

The purpose of AI is 

to augment — not 

replace — human 

intelligence

Data and insights 

belong to their 

creator

New technology, 

including AI 

systems, must be 

transparent and 

explainable

1 2 3

CFTC TAC meeting, March 22nd, 2023
IBM Pillars of 

Trustworthy AI

Explainability

—

An AI system’s ability 

to provide a humaninterpretable 

explanation for its 

predictions and 

insights

Fairness

—

Equitable treatment of 

individuals or groups 

by an AI system

Depends on the 

context in which the AI 

system is used

CFTC TAC meeting, March 22nd, 2023

Robustness

—

An AI system’s ability to 

effectively handle 

exceptional conditions, 

such as abnormalities in 

input

Transparency

—

An AI system’s ability to 

include and share 

information on how it 

has been designed and 

developed

Privacy

—

An AI system’s ability to 

prioritize and safeguard 

consumers’ privacy and 

data rights
IBM trustworthy AI 

toolkits

CFTC TAC meeting, March 22nd, 2023

AI Explainability 360

Comprehensive open-source toolkit for explaining ML models & data.

AI Fairness 360

Comprehensive open-source toolkit for detecting & mitigating bias in 

ML models.

Adversarial Robustness 360

Comprehensive open-source toolkit for defending AI from attacks.

AI Factsheets 360

Extensive website describing research efforts to foster trust in AI by 

increasing transparency and enabling governance.

AI Privacy 360

Toolbox to support the assessment of privacy risks of AI-based 

solutions, and to help them adhere to any relevant privacy 

requirements.

Uncertainty Quantification 360

Comprehensive open-source toolkit for computing and communicating 

meaningful limitations of ML predictions.

Causal Inference 360

Extensible open-source toolkit for estimating, communicating, and 

using uncertainty in ML model predictions.
Governance structure

CFTC TAC meeting, March 22nd, 2023

PAC

Privacy Advisory 

Committee

AI Ethics Board

Co-Chairs:

Chief Privacy Officer

AI Ethics Global Leader

IBM Business Units

AI Ethics Focal Points

Business Unit Privacy Leads (BPLs)

Tech Ethics Advocacy Network

Compliance teams

Global Chief 

Data Office

Enterprise & 

Technology Security

Government & 

Regulatory Affairs

Legal

The AI Ethics board is central, crossdisciplinary body to instill a culture 

of ethical and responsible 

technology throughout IBM.

The Board’s mission is to support a 

centralized governance, review, and 

decision-making process for IBM 

ethics policies, practices, 

communications, research, products 

and services. 
CFTC TAC meeting, March 22nd, 2023

Tech Ethics by Design 

• Integrating AI ethics in the 

technology development 

pipeline

Use case reviews

• Assessing alignment with Ai 

ethics principles

Regulation readiness Education

Amplification and 

benchmarking

Foundation models Neurotech Augmenting Human Intelligence

AI ethics board focus areas
CFTC TAC meeting, March 22nd, 2023

Multi-stakeholder collaborations

U.S. National AI Advisory 

Committed (NAIAC)

—

Chief Privacy Officer Christina 

Montgomery named to NAIAC and 

U.S. Chamber of Commerce 

Commission on Competition, 

Inclusion and Innovation

World Economic Forum’s 

Global AI Action Alliance

—

Guides the responsible 

development of AI

Co-chaired by Arvind Krishna, IBM 

Chairman and CEO

MIT-IBM Watson AI Lab

—

Research focused on healthcare, 

security and finance using the 

IBM Cloud, AI platform, 

blockchain and quantum 

European Commission Expert 

Group on AI

—

Defined the ethics guidelines for 

trustworthy AI

IEEE Global Initiative on AI 

Ethics

—

Ensures that AI is developed in a 

way that prioritizes ethical 

considerations

ITU AI for Good Global Summit

—

Global and inclusive United 

Nations platform on using AI to 

achieve the UN Sustainable 

Development Goals

Data & Trust Alliance

—

Develops new practices and 

tools to advance the responsible 

use of data and AI across 

industries and disciplines

Partnership on AI

—

Brings together diverse global voices 

to define best practices for 

beneficial AI

IBM is a founding member
Lessons learnt in operationalizing AI ethics principles 

Company-wide approach, not just a team

A governance body, with the power to make decisions for the company

Full operationalization of the principles

Beyond technical tools: also processes, education, risk assessment, and governance

Regulations: beyond compliance

Multi-stakeholder partnerships: to learn and to bring experiences/challenges

Aa AI evolves, AI ethics must evolve as well

CFTC TAC meeting, March 22nd, 2023
Thanks!

IBM’s approach to AI Ethics

CFTC TAC meeting, March 22nd, 2023
Emerging Threat: 

AI Enabled 

Cyber Attacks

Timothy Gallagher, Managing Director Kroll Cyber Risk

March 22, 2023
113

Kroll Cyber Risk

PREFERRED VENDOR FOR 

60+ 

CYBER INSURANCE CARRIERS

3,000+

IR ENGAGEMENTS / YEAR

650+

EXPERTS 

ACROSS 19

COUNTRIES

UNIQUE EXPERIENCE

550k+

ACTIVELY 

MONITORED 

ENDPOINTS

A SECRET GIANT TRUSTED EXPERTS INDUSTRY RECOGNITION

90+%

CUSTOMER RETENTION 

RATE

NAMED CHAMPION IN 

2023 MDR RESEARCH

RECOGNIZED AS 

REPRESENTATIVE VENDOR 

FOR 

MDR & DFIR

53,000+

HOURS OF ASSESSMENT & TESTING / YEAR

100+

INDUSTRY CERTIFICATIONS
114

Timothy Gallagher

- Managing Director in the Kroll Cyber Risk practice, based in Washington, DC

- Previously held a Senior Executive role in the FBI Cyber Division and served as Chief of the 

FBI Financial Crimes Section

- My practice focus is on where Cyber meets Fraud and Governmental Relations

Managing Director 

Cyber Risk
115

- Simulation of human intelligence in machines to think like humans and mimic their 

actions

- Using a computer to do things that traditionally require human Intelligence

- Anything a computer can do that was formerly a job for a human
116

ChatGPT went from 1 million users to 100 million users in six weeks

FBI Issues alert on use of AI for criminal cyber and foreign influence operations

FBI Internet Crime Report: Online Scams cost $10 billion in 2022

Partnerships – law enforcement can provide intel, but mitigation is your task

Why are we here? 

Explosion in the Availability of Artificial Intelligence
117

Malicious Code 

Development

Threat to Markets

Business Email 

Compromise 

(BEC)/Phishing 

Attacks

Public Private 

Partnerships

AI Enabled Cyber Attacks Topics for Discussion
Thank You

11

8
Questions?
For more information, please contact:

About Kroll

Kroll provides proprietary data, technology and insights to help our clients stay ahead of complex demands related to risk, governance and growth. Our solutions deliver a powerful competitive advantage, enabling faster, smarter and more sustainable decisions. With 

5,000 experts around the world, we create value and impact for our clients and communities. To learn more, visit www.kroll.com.

M&A advisory, capital raising and secondary market advisory services in the United States are provided by Kroll Securities, LLC (member FINRA/SIPC). M&A advisory, capital raising and secondary market advisory services in the United Kingdom are provided by Kroll 

Securities Ltd., which is authorized and regulated by the Financial Conduct Authority (FCA). Valuation Advisory Services in India are provided by Duff & Phelps India Private Limited under a category 1 merchant banker license issued by the Securities and Exchange Board of 

India.

© 2022 Kroll, LLC. All rights reserved.

Timothy.Gallagher@kroll.com

Visit kroll.com/cyber
Global Markets Advisory Committee

Closing Remarks