Microsoft, Hewlett Foundation preparing to launch nonprofit that calls out cyberattacks

Microsoft and the Hewlett Foundation are preparing to launch a nonprofit organization dedicated to exposing the details of harmful cyberattacks and providing assistance to victims in an effort to highlight their costs, CyberScoop has learned.

Known to its organizers as the “Cyber Peace Institute,” the nonprofit is expected to debut in the coming weeks, according to multiple sources who have discussed it with the organizers.

The institute aims to investigate and provide analytical information on large-scale attacks against civilian targets, assess the costs of these attacks and give security tools to both individuals and organizations that will help them become more resilient, according to a description of the nonprofit provided during a session at the 2019 B-Sides Las Vegas cybersecurity conference.

“We have a shared global responsibility to prevent the Internet from becoming ‘weaponized’ by increasing attacks by criminal groups and state actors alike,” the description reads. “We already have global organizations to tackle physical emergencies and now we need new ones to help with their counterparts in cyberspace.”

Besides Microsoft and the Hewlett Foundation, supporters include Facebook, Mastercard and the Ford Foundation.

The idea for the Cyber Peace Institute appears to be similar to previous ideas publicly presented by Microsoft President Brad Smith. Smith has previously called for a “Digital Geneva Convention,” where governments would form an independent organization that would “investigate and share publicly the evidence that attributes nation-state attacks to specific countries,” according to a blog post he wrote in 2017.

Microsoft has also been involved with the Paris Call for Trust and Security in Cyberspace with the French government, for instance, as well as the Cybersecurity Tech Accord, which many big tech companies have signed in order to protect innocent citizens online. Other projects have included the “Digital Peace Now” campaign and the Defending Democracy Program, intended to protect campaigns from hacking.

But the institute has been keen to appear independent from any one company involved in funding the venture, a source familiar with Smith’s thinking told CyberScoop.

“From the very beginning they had this idea of an international organization along the lines of the [International Atomic Energy Agency], a model of an independent, third party that would be beholden to no government,” the source familiar with Smith’s thinking said. “They wanted to be depoliticized and somehow factual … If it ended up looking and feeling and being perceived as a Microsoft objective, it won’t achieve its objectives.”

The Hewlett Foundation has pledged $5 million over the course of five years to the institute, a source familiar with the decision told CyberScoop. Facebook has pledged $250,000 to the cause, according to a source familiar with funding conversations. Microsoft, Mastercard, and the Ford Foundation have also pledged an unknown amount of money.

Although the broad goals of the nonprofit are clear, the institute is still working out details of its operations, according to multiple sources who have been in conversations with the organizers. It’s still unclear where the institute will obtain the data it will use for analysis, how it will assist victims and how many people it can actually help.

The funders and organizers of the nonprofit, through a spokesperson, declined to provide comment for this story.