May 30, 2015: Strategy Page

Tiny Estonia (population 1.3 million) has formed a Cyber War militia because Russia keeps threatening another major Cyber War offensive. Despite its small size Estonia is the most technically advanced (on a per-capita basis) nation in East Europe and was able to recruit several hundred skilled volunteers who are hard at work pooling their knowledge and skills to better handle more Cyber War aggression from Russia.

Estonia borders Russia and is a member of NATO. That last bit makes Russia reluctant to come in with tanks to take over like they did twice in the 1940s. Russia made a major effort to crush Estonia via major Internet based attacks in 2007. Estonia survived that “invasion” but admitted that this sort of Russian aggression caused great financial harm to Estonia. In the wake of these Russian Cyber War attacks Estonia demanded that the UN and NATO declare this sort of thing terrorism and dealt with accordingly. NATO tried to be helpful, but that wasn’t enough. The UN was even less helpful as the UN has a hard time getting anything done when Russia is involved because Russia is one of the handful of founding members that has a veto.

NATO did make an effort and in 2008 established a Cyber Defense Center in Estonia. This was the most tangible NATO response to Estonian calls for NATO to declare Cyber War on Russia. NATO agreed to discuss the issue but never took any action against Russia. The Cyber Defense Center was a consolation prize and studies Cyber War techniques and incidents and attempts to coordinate efforts by other NATO members to create Cyber War defenses and offensive weapons. NATO say that this appears to have deterred Russia from making another Cyber War attack. The Estonians are not so sure as Russia went ahead and invaded Georgia (a nation of four million in the Caucasus) in 2008 and Ukraine in 2014 and still makes very public threats against Estonia.

  Cyber Wars have actually been going on since the late 1990s and they are getting worse. It started in the 1990s as individuals attacked the web sites in other nations because of diplomatic disputes. This was usually stirred up by some international incident. India and Pakistan went at it several times, and Arabs and Israelis have been trashing each other’s web sites for years. The Arabs backed off at first, mainly because the Israeli hackers are much more effective. But in the last few years the Arabs have acquired more skills and are back at it. Chinese and Taiwanese hackers go at each other periodically, and in 2001, Chinese and American hackers clashed because of a collision off the Chinese coast between an American reconnaissance aircraft and a Chinese fighter. That was just the beginning for China, which now regularly makes major hacking attacks on the U.S. and other NATO members.

Since 2005 these Cyber Wars have escalated from web site defacing and shutting down sites with massive amounts of junk traffic (DDOS attacks), to elaborate espionage efforts against American military networks. The attackers are believed to be Chinese, and some American military commanders are calling for a more active defense (namely, a counterattack) to deal with the matter.

The Russian attacks against Estonia were the result of Estonia moving a statue, honoring Russian World War II soldiers, from the center of the capital, to a military cemetery in the countryside. The Estonians always saw the statue as a reminder of half a century of Russian occupation and oppression. Russia saw the statue move as an insult to the efforts of Russian soldiers to liberate Estonia and enable the Russians to occupy the place for half a century. The basic problem here is that most Russians don't see their Soviet era ancestors as evil people, despite the millions of Russians and non-Russians killed by the Soviet secret police. The Russians are very proud of their defeat of Nazi Germany in World War II, ignoring the fact that the Soviet government was just biding its time before it launched its own invasion of Germany and Europe in general.

While many Russians would have backed a military attack on Estonia to retaliate for the insult by an ungrateful neighbor, this approach was seen as imprudent. Estonia is part of NATO and an attack on one NATO member is considered an attack on all. It's because of this Russian threat that Estonia was so eager to get into NATO. The Russians, however, believe that massive Cyber War attacks will not trigger a NATO response. They were so sure of this, that some of the early DDOS attacks were easily traced back to computers owned by the Russian government. When that got out, the attacks stopped for a few days, and then resumed from what appear to be illegal botnets. Maybe some legal botnets as well. Russian language message boards were full of useful information on how to join the holy war against evil Estonia. There's no indication that any Russians are afraid of a visit from the Russian cyber-police for any damage they might do to Estonia. And the damage has been significant, amounting to millions of dollars. While no one has been injured, Estonia is insisting that this attack, by Russia, should trigger the mutual defense provisions of the NATO treaty. It didn't, but it was a reminder to all that Cyber War is very real except when it comes time to fight back.

11 February 2015 by ISS

Recent years have seen an important shift in how security is prioritised, with an emphasis on threats in cyberspace. Last year, the Sony Corporation hack drew attention worldwide, challenging perceptions of state governance and security in cyberspace.

The estimated financial cost of cybercrime worldwide exceeds US$445 billion annually. For individuals, the loss of private and sensitive information is particularly concerning, and a recent poll in the United States (US) shows that Americans fear breaches in cyber security more than any other ‘traditional’ crimes.

Africa has not been immune to increased cybercrime either, with countries such as Nigeria, Kenya and South Africa fast becoming hubs of cybercrime activity.

Read more

13 October 2014 By Jessica Woodall – Pacific Sentinel

 

Cybersecurity can help Australia take its existing engagement with Vietnam to the next level.

Historically, Vietnam’s relationship with China has been complex. Stretching from 111 BC and early Chinese cultural domination of Vietnam, to the 1979 border conflict and more recent disputes over competing claims in the South China Sea, the relationship’s had its challenges.

Earlier this year hostility flared when the Chinese government deployed an oil rig within Vietnam’s Economic Exclusion Zone. That led to public protests and targeted violence towards Chinese nationals in 22 of Vietnam’s 63 provinces.

Tip-toeing around the edges of that tension are several countries—including the U.S., Japan, Russia and India—seeking to step up their engagement with Hanoi. All seek a stronger relationship with a partner in a geographically important location and a warmer friendship with ASEAN’s main players—and some probably hope to counter China’s expanding sphere of influence.

Tangible engagement has, for the most part, centred on arms and natural-resource sales. Vietnam took delivery of the second of six Kilo-class submarines from Russia in March. And India’s said to be close to concluding a deal to sell BrahMos supersonic cruise missiles to the Vietnamese, further boosting their defense capabilities. Earlier this month, the U.S. also partially lifted its 30-year-old embargo on sales of lethal arms to Vietnam, which will facilitate the sale of weapons for maritime purposes for the first time.

Australia should also seek to expand its engagement with Vietnam: it’s too politically and geographically important to ignore. But we need to be careful not to ruffle Beijing’s feathers while doing so. So we must be subtle in our cooperation with Hanoi, proceeding with a softly-softly approach.

Non-traditional security issues such as cybersecurity provide an opportunity to take our existing engagement, which primarily revolves around transnational crime, to the next level. 

Read the full story at The Diplomat

21/11/2013 Marc Watin-Augouard Général d'armée (2S) - Fondateur du Forum International de la Cybersécurité et Directeur du centre de recherche de de l'EOGN

LE CERCLE. Cette convergence entre le public et le privé ne peut s’envisager sans une politique industrielle qui fasse émerger des "géants", si possible français, aux moins européens, car la seule question de la souveraineté est essentielle, sauf à accepter une domination américaine ou chinoise.

Seul espace entièrement créé par l’homme, le cyberspace est, comme tous les autres, porteur de liberté, de richesses, de croissance, mais il est aussi l’objet de convoitise de la part des prédateurs. Ces derniers, délinquants, terroristes, mercenaires, guerriers, ont compris que le rapport risques/profits leur est plus que jamais favorable. Nul besoin d’être puissant pour faire du fort un faible et du faible un fort.

Dans ce contexte, notre société, désormais modelée par le "tout numérique", ne peut laisser le champ libre aux pirates, aux bandits "des grands chemins de l’internet". La prise de conscience a été lente : nous avons progressé à tous petits pas à partir des années quatre-vingt-dix. Le Livre Blanc de 2008 marque le passage au trot. Désormais, il faut adopter le grand galop, s’il le faut avec l’aide d’éperons et de cravaches ! Nous n’avons pas le choix ! Soyons-en conscients : nous ne vivons pas une évolution, ni une révolution, mais une métamorphose de notre société. La chrysalide devient papillon.

Nous ne pouvons avoir recours aux modèles, organisations, modes d’action, qui ont prouvé leur efficacité dans le passé. Si nous ne sommes pas au rendez-vous, nous serons une "colonie du numérique", pour reprendre le titre d’un récent rapport sénatorial. Pire, nous serons les "esclaves du numérique". Cet impératif résulte du constat contemporain, mais il doit tenir compte de ce que nous réserve un avenir proche avec notamment l’interconnexion des objets, l’inscription de chaque individu dans une "bulle informationnelle" qui agrège l’ensemble des données à caractère personnel. Tout cela sera possible, car le nombre d’adresses IP permettant les connexions va passer de 4,3 milliards à 340 milliards de milliards de milliards de milliards. Chaque grain de sable du désert pourrait ainsi avoir une adresse…

Le récent Livre Blanc donne un sérieux coup d’accélérateur, notamment dans le domaine de la cyberdéfense, avec sa consécration législative inscrite dans la loi de programmation militaire. Pour la première fois, il reconnaît qu’une cyberattaque peut être un acte de guerre et ainsi justifier une riposte au titre de la légitime défense. La structuration de la cyberdéfense constitue une avancée au regard de la sécurité des systèmes mis en œuvre par les opérateurs des infrastructures critiques civiles et militaires.

Mais la cybersécurité ne se cantonne pas à la cyberdéfense et cette dernière n’est pas seulement la cybersécurité du ministère de la Défense. La cybersécurité concerne aussi tous les autres acteurs : administrations, collectivités territoriales, entreprises, particuliers, etc. qui doivent prendre une "cyberposture", car la chaine est souvent trahie par son maillon le plus faible. Il importe donc d’opérer une mobilisation générale, car chacun est un acteur de la cybersécurité, ne serait-ce qu’en adoptant des règles "d’hygiène informatique", selon l’excellente expression de Patrick Pailloux, directeur de l’Agence nationale de la sécurité des systèmes d’information (ANSSI).

La cybersécurité repose sur un tryptique : la sécurité des systèmes d’information (intégrité, disponibilité, confidentialité), les mesures à la charge des utilisateurs (administrations, entreprises) la lutte contre la cybercriminalité et la cyberdéfense. Le continuum défense-sécurité est particulièrement affirmé dans le cyberespace. En effet, contrairement à ce que certains affirment, une cyberattaque relevant de la cyberdéfense relève du droit pénal tant que le droit des conflits armés n’est pas mis en œuvre. Il n’y a pas de distinction entre le "champ de bataille" et les "quartiers sensibles". Les prédateurs empruntent les mêmes voies, utilisent les mêmes armes.

Par exemple, une attaque par déni de services peut être le fait de délinquants qui cherchent un profit en opérant un chantage sur un opérateur de vente en ligne, de terroristes qui veulent désorganiser les secours simultanément à un attentat, ou le fait d’agresseurs qui veulent atteindre un État. Ce qui permet de qualifier une attaque, c’est son intention, sa complexité, la nature de la cible, le mobile poursuivi. Le continuum exige donc une coopération étroite entre les différents acteurs régaliens, civils ou militaires.

Ainsi, l’ANSSI, la composante cyberdéfense de l’état major des armées, les services de police et les unités de gendarmerie, les services de renseignement, etc. ont l’obligation de coopérer, car la complexité des atteintes au cyberespace nécessite la mobilisation de toutes les compétences, une plus grande transversalité.

La coopération ne se limite pas aux acteurs régaliens. La cybersécurité repose aussi sur des acteurs privés, opérateurs, intégrateurs, prestataires de services, etc. Il existe un secteur privé de la cybersécurité qu’il conviendrait de reconnaître au travers de la loi de 1983 relative aux activités privées de sécurité. Ces acteurs sont, dans une certaine mesure, des collaborateurs du service public. Dans le domaine de la cybersécurité, il faut s’attendre à ce que la part régalienne de l’offre de sécurité devienne minoritaire.

Cette convergence entre le public et le privé ne peut s’envisager sans une politique industrielle qui fasse émerger des "géants", si possible français, aux moins européens, car la seule question de la souveraineté est essentielle, sauf à accepter une domination américaine ou chinoise. Cette souveraineté est tributaire d’une capacité de recherche et développement qui garantisse une meilleure indépendance au regard des innovations technologiques. Elle repose également sur un effort en matière de formation, car les acteurs publics comme les acteurs privés sont aujourd’hui confrontés à une pénurie en matière de ressources humaines dans les domaines liés aux technologies numériques.

La gendarmerie a compris très tôt quels étaient les enjeux du cyberespace, ne serait-ce que parce que son maillage ressemble fortement à la "toile du net". L’architecture du réseau Rubis, conçu dans les années quatre-vingt, a pris le pari du numérique et de la convergence voix-image-texte. La prise en compte de la cybercriminalité remonte à la même époque, alors que le Parlement votait la loi Godfrain, relative aux atteintes aux systèmes de traitement automatisé de données.

Aujourd’hui, la communauté N’TECH s’appuie sur plus de mille gendarmes, renforcés par des réservistes opérationnels et citoyens (dont certains appartiennent au réseau des réservistes cyberdéfense). Le pôle "police judiciaire" développé notamment autour de l’Institut de recherche criminelle (IRCGN) et du Service technique de recherches judiciaires et de documentation (STRJD) témoigne de la volonté d’adapter l’organisation. La nomination récente d’un conseiller "cybersécurité" auprès du directeur général reflète la prise en compte du caractère stratégique de l’action qui se développe.

Mais il faut aller encore beaucoup plus loin ! En effet, la cybercriminalité est la criminalité du XXIe siècle. À l’origine, lorsque seul dominait le secteur primaire agricole, les prédateurs s’en prenaient aux personnes : Cain tuait Abel… Meurtres, assassinats, agressions, enlèvements, esclavages constituaient l’essentiel des transgressions. L’apparition du secteur secondaire, avec les produits manufacturés, a entrainé un glissement vers les atteintes aux biens. Voler, détruire, receler offre un meilleur rapport profit/risque pénal.

Puis, le secteur tertiaire, lié aux services a ouvert le champ de la délinquance intelligente en "col blanc". Escroqueries, blanchiment, fraudes, faux, etc., sont des infractions complexes plus difficiles à combattre par les enquêteurs et la justice. Un nouveau glissement a été observé au travers de l’émergence de la délinquance économique et financière.

Aujourd’hui, le "tout numérique" délimite un secteur quaternaire, celui de l’immatériel. Là encore, un transfert s’observe, car, dans le cyberespace, la victime n’a jamais été aussi près de son agresseur, ce dernier n’ayant jamais été aussi éloigné de son juge. La cybercriminalité est un domaine où le "chiffre noir" est très important. Les victimes ignorent souvent qu’elles ont été attaquées.

La lutte est à armes inégales, car, faute d’un droit international universel, le droit national n’est pas adapté à des phénomènes par nature transfrontaliers. La vitesse et l’adaptation permanente du cybercrime heurtent la lenteur de la procédure et de l’entraide judiciaire. Si les institutions, dont la gendarmerie, ne prennent pas immédiatement le virage, le dérapage est assuré avec un risque majeur d’incapacité de l’état à assurer la première des fonctions régaliennes.

C’est pourquoi la lutte contre la cybercriminalité ne peut être exclue du champ de sécurité nationale, ne serait-ce que dans le haut du spectre. La gendarmerie doit donc poursuivre ses efforts dans un contexte budgétairement difficile. Cela passe notamment par une formation accrue de tous les militaires, officiers et sous-officiers, un recrutement plus important de scientifiques et une démarche prospective anticipant les conséquences positives et négatives de nouvelles technologies sur les pratiques professionnelles.

7/2/2013 Ref: EU13-049EN

Summary: 7 February 2013, Brussels - A free and open Internet is at the heart of the new Cyber Security Strategy by the European Union High Representative Catherine Ashton and the European Commission. The new Communication is the first comprehensive policy document that the European Union has produced in this area. It comprises internal market, justice and home affairs and the foreign policy aspects of cyberspace issues.

The Strategy is accompanied by a legislative proposal (a Directive) from the European Commission to strengthen the security of information systems in the EU. This would encourage economic growth as people's confidence in buying goods online and using the Internet would be strengthened.

• Freedom and openness: The Strategy outlines the vision and principles on applying the EU core values and fundamental rights in cyberspace. Human Rights should also apply online and we will promote cyberspace as an area of freedom and fundamental rights. Expanding access to the Internet should promote democratic reform worldwide. The EU believes that increased global connectivity should not be accompanied by censorship or mass surveillance.
• The laws, norms and EU core values apply as much in the cyberspace as in the physical world: The responsibility for a more secure cyberspace lies with all players of the global information society, from citizens to governments.
  Developing cyber security capacity building: The EU will engage with international partners and organisations, the private sector and civil society to support global capacity building in third countries. It will include improving access to information and to an open Internet and preventing cyber threats.
• Fostering international cooperation in cyberspace issues: To preserve open, free and secure cyberspace is a global challenge, which the EU will address together with the relevant international partners and organisations, the private sector and civil society.

How can the core values be ensured in the worldwide web?

One example is human rights, which should also apply online as the European Union will promote cyberspace as an area of freedom and fundamental rights. Expanding access to the Internet should advance democratic reform worldwide. The EU believes that increased global connectivity should not be accompanied by censorship or mass surveillance.

What EU norms and laws should be used in cyberspace?

The responsibility for a more secure cyberspace lies with all players of the global information society, from people to governments. The EU supports the efforts to define norms of behaviour in cyberspace that all stakeholders should adhere to. Just as the EU expects citizens to respect civic duties, social responsibilities and laws online, so should states abide by norms and existing laws. An important pre-condition for free and open Internet that brings political and economic benefits to societies worldwide, is to maintain a multi-stakeholder governance model of the Internet.

Will there be new laws to address cyber threats?

No, the EU believes we have many international law instruments already that should be applied in cyberspace. However, some governments have proposed new treaties and conventions in cyber issues that the EU cannot support. We fear that the argument of cyber security will be used as a pretext to justify limiting the freedom of expression and access to information. For instance, the Budapest Convention includes all the important elements to assist in investigation, prosecution, and international cooperation to address cybercrime.

At present 49 countries have signed the Convention and many countries outside Europe have introduced its principles into their legislation. The EU has assisted the Council of Europe in disseminating the principles of this Convention worldwide, and we are currently financing new programs to promote the Budapest Convention and increase the rule of law in this area.

What does the EU intend to do on capacity building?

The EU will engage with international partners and organisations, the private sector and civil society to support global capacity-building in third countries. It will include improving access to information and to an open Internet and preventing cyber threats. The EU will also actively participate in developing donor coordination for helping capacity-building efforts. These actions will focus on enhancing criminal justice capabilities in training prosecutors and judges, and introducing the Budapest Convention (Cybercrime Convention) principles in recipient countries' legal framework, building law enforcement capacity to advance cybercrime investigations and assisting countries to address cyber incidents.

How does the Strategy contribute to international cooperation in cyberspace?

To preserve an open, free and secure cyberspace is a global challenge, which the EU should address together with the relevant international partners and organisations, the private sector and civil society. The EU will place a renewed emphasis on dialogue with third countries and international organisations, with a special focus on like-minded partners that share EU values. At bilateral level, cooperation with the United States is particularly important and will be further developed.

What the EU is doing on cyber defence issues?

Within the Common Security and Defence Policy, the European Defence Agency (EDA) is developing cyber defence capabilities and technologies, improving cyber defence training & exercises. Given that threats are multifaceted, synergies between civilian and military approaches in protecting critical cyber assets should be enhanced. These efforts should be supported by research and development, and closer cooperation between governments, the private sector and academia in the EU.

The EU is also promoting early involvement of industry and academia in developing solutions and in strengthening Europe's defence industrial base and associated R&D innovations in both civilian and military organisations. The EDA will promote civil-military dialogue and contribute to the coordination between all actors at EU level - with particular emphasis on the exchange of good practices, information exchange and early warning, incident response, risk assessment and establishing a cyber-security culture.

Why does the Strategy address civilian and military issues?

Given that threats are multifaceted, synergies between civilian and military approaches in protecting critical cyber assets should be enhanced. These efforts should be supported by research and development, and closer cooperation between governments, the private sector and academia in the EU. To avoid duplication, the Union will explore possibilities on how the EU and NATO can complement their efforts to heighten the resilience of critical governmental, defence and other information infrastructures on which the members of both organisations depend.

Are the EU and NATO cooperating in cyber security?

There is a regular cooperation going on between the experts. After the Strategy is adopted, we intend to intensify cooperation with NATO in cyber security. Dialogue with NATO should ensure effective defence capabilities, identify areas for cooperation and avoid duplication of efforts.

The Directive must pass through the Council of Ministers and the European Parliament before adoption whilst the Cyber Security Strategy will remain as it is as it is not legislation.

DG Connect

http://ec.europa.eu/digital-agenda/cyber-security

EU Justice and Home Affairs

http://ec.europa.eu/justice/index_en.htm