E-DEFENSE MUST BE ORGANIZED THE SOONEST AT EU/EC-DG-ICT AT R&D LEVEL,SO THAT CITIZENS TO FEEL SECURE.
CIVIL SOCIETY,UNIVERSITIES,PRIVATE COMPANIES (CLUSTERS,SME),REGIONS ,NATIONAL STATES AND OTHER IMPORTANT STAKEHOLDERS SHOULD GATHER AND BEGIN DISCUSSIONS FOR THE IMPLEMENTATION OF SUCH AN AMBITIOUS TARGET ON BEHALF OF EUROPEAN UNION AND ITS PARTNERS.
THANKS
A.C.
Who controls the internet?
Squared-jawed, with four stars decorating each shoulder, General Keith Alexander looks like a character straight out of an old American war movie. But his old-fashioned appearance belies the fact that the general has a new job that is so 21st-century it could have been dreamed up by a computer games designer. Alexander is the first boss of USCybercom, the United States Cyber Command, in charge of the Pentagon’s sprawling cyber networks and tasked with battling unknown enemies in a virtual world.
Last year, US Defense Secretary Robert Gates declared cyberspace to be the “fifth domain” of military operations, alongside land, sea, air and space. It is the first man-made military domain, requiring an entirely new Pentagon command. That went fully operational a week ago, marking a new chapter in the history of both warfare and the world wide web.
In his confirmation hearing, General Alexander sounded the alarm, declaring that the Pentagon’s computer systems “are probed 250,000 times an hour, up to six million per day”, and that among those attempting to break in were “more than 140 foreign spy organisations trying to infiltrate US networks”. Congress was left with a dark prophecy ringing in its ears: “It’s only a small step from disrupting to destroying parts of the network.”
In three short decades, the internet has grown from the realm of geeks and academics into a vast engine that regulates and influences global commercial, political, social and now military interaction. Neuroscientists tell us that it is changing the development of our cerebral wiring in childhood and adolescence. Social scientists and civil libertarians warn that our privacy is being eroded, as ever more of our life is mediated by the web. It should probably come as no surprise that governments believe control of this epoch-making technology is far too important to be left in the hands of idiots like you and me.
If states start monitoring the internet, what does it means for the average user? President Obama has stated that his administration’s pursuit of cybersecurity “will not include – I repeat, will not include – monitoring private sector networks or internet traffic”. But not everyone is so sanguine. Richard Clarke, adviser to four presidents and the author of Cyber War, supports US plans to beef up its cyber defences but even he is worried about USCybercom. “We created a new military command,” he wrote, “to conduct a new kind of high-tech war, without public debate, media discussion, serious congressional oversight, academic analysis or international dialogue.”
Very few people understand cybersecurity. It is technologically complex and the network environment in which it operates changes at lightning speed. So governments are granting themselves new powers to intervene in computer networks without anyone, including themselves, fully appreciating what their implications are.
The establishment of USCybercom is just one element in an eye-popping expansion of security, which includes beefing up the cyber capacity of the Department of Homeland Security to deal with threats to the US’s domestic cyber networks. These moves will lead to a much deeper apparatus of control and monitoring of internet activity by the US.
Some specialists argue that the gargantuan security systems involved simply will not work, and that bureaucrats and corporations are encouraging a new round of profligacy to line their pockets. Civil liberty advocates worry that General Alexander’s new cyber command could dodge privacy laws to monitor our e-mails and social networking activities. And despite Obama’s reassurances about such an Orwellian scenario, so much of Alexander’s written testimony to Congress has been labelled classified that nobody outside the Pentagon and the White House quite knows what the military cyber strategy involves.
The US is not alone in trying to muscle in on the web: across the world, states are trying to assert their authority over the communications of individuals and private companies.
The United Arab Emirates has been in dispute with Research in Motion, the Canadian manufacturer of the BlackBerry, for the past six months. The government in Abu Dhabi demanded that the company either lift the e-mail encryption on BlackBerries or establish a local server so the authorities could monitor the traffic going into, out of and across the country. Otherwise, Abu Dhabi warned, all BlackBerry communication in the country would be stopped. RIM had refused to budge (despite the fact that it had already agreed to allow China, India and Saudi Arabia access to unencrypted messages). The UAE government announced yesterday (Oct 8) that the threat to suspend BlackBerry services had been lifted as the provider now complied with the Gulf state’s regulatory framework.
Some security experts believe that the UAE’s real concern may be more complex than who says what on their BlackBerries. Tony Yustein, an IT security consultant who has advised the FBI, comments: “More important is the knowledge that the data is not 100 per cent secure in Canada, and that the US can access this data. So the US can monitor communications inside the Emirates.”
BlackBerry is just the opening shot. India said last month it intends to ask Google and Skype to set up servers inside its borders so that it can monitor traffic over Gmail and Skype’s internet telephone system. Other countries seem set to follow.
Iran appears to be in two minds about whether to embrace or stymie technological progress. On the one hand, Twitter accounts helped the opposition mobilise demonstrations in the wake of last year’s contested presidential election and so the authorities blocked the service sporadically. On the other hand, by monitoring Twitter traffic, Tehran was able to identify who was organising the protests.
Taken together, these incidents demonstrate how states are building walls around the internet to regulate what information circulates in their country. The internet is being separated into a series of national intranets that reflect cultural, political and security concerns. “As cyber security and national security become ever more entwined, an increasing number of countries may impose censorship,” says Rex Hughes, a Cambridge academic who heads Chatham House’s project on Britain’s cyber defences. “A number of countries have already gone down this route.”
Try accessing YouTube in Turkey, for example, and you get a message saying that it is banned. In China, the BBC website is often offline – especially when there is a big Chinese story in the news. Nor is the US immune to censorship, having forced the removal of .com websites advertising travel to Cuba from Europe.
Russia has a slightly different approach. It has built up a monumental Big Brother appartus that goes under the acronym SORM-2. A copy of every little byte that goes in, out or across Russia is copied to a central storage computer in Moscow under the control of the FSB, the KGB’s successor. Should the organisation ever need the co-operation of a fellow citizen, then the information stored on the FSB’s computers can provide useful leverage to overcome any reluctance.
It is easy to understand why the paranoid elites of Iran, Burma and Belarus might be monitoring the internet as closely as they do. But why are the military and security services in the west starting to divert so much of their resources into what is known soothingly as “information assurance”?
A series of events has shaken America’s cyber confidence. One of the most dramatic occurred in 2008 when a US soldier based in the Middle East unwittingly plugged an infected memory stick into one of the Pentagon’s laptops. A malicious computer code, explained US Deputy Secretary of Defense William Lynn III, “spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead, from which data could be transferred to servers under foreign control”. It was, he said, their “worst fear: a rogue program operating silently, poised to deliver operational plans into the hands of an unknown adversary”.
The incident led directly to the establishment of USCybercom and it explains why General Alexander insists that his primary job will be “defensive”, ensuring that the Pentagon’s seven million computers, grouped into 15,000 networks that provide the backbone for 4,000 military installations worldwide, can withstand the avalanche of daily probes and attacks. But the general has also said that the US needs to guarantee its “superiority” in cyberspace – although he emphasised that this is not the same as “supremacy” or “dominance”.
This reflects a real fear on the part of the US that the internet is slipping from its control. Until now, the country’s dynamic technological base, alongside the immense power of companies such as Google and Microsoft, have ensured its influence over the world wide web. Maintaining that influence appears to have become a central goal of the Obama administration. The day after Google announced that it and several other companies had fallen victim to a systematic cyber attack by China in December last year, Hillary Clinton, secretary of state gave a speech attacking countries seeking to restrict freedom on the internet.
The message to the Chinese was clear: “The US government considers Google and its ilk to be part of the country’s strategic infrastructure and we will march in step with them around the world.” Under the stewardship of Eric Schmidt, Google’s presence in Washington has become so ubiquitous that a jealous Microsoft manager quipped to me recently: “the US government, fronted by Obama, powered by Google”.
US military and law enforcement agencies such as the FBI enjoy privileged access to data stored by American.com companies, including Google and Facebook, the world’s two largest depositories of personal data. If the Feds are hunting a Russian cyber criminal who has a Facebook account, they can be in there with a judge’s warrant within a day. If a German police officer asked for a similar favour from Facebook, the process could take months.
But there are areas where American control over the administration of the web is slipping. Under pressure from foreign governments, notably China, Icann, the US-based independent body that stipulates how the addresses of websites can be formulated, announced that from now on it will allow the use of most major language scripts – Cyrillic, Chinese and Arabic, among them.
US defence hawks regard this as a disaster. Writing in the Harvard Security Journal, Dan Geer, whose company has advised the CIA on computer security, called it “the single most criminogenic act ever taken in or around the digital world”. He argues that it will be even easier for cyber warriors to launch an attack while disguising their location.
For the moment though, the US appears to enjoy the most advanced “offensive” military capability on the internet. But countries such as China, India, France and Israel are catching up and you don’t need much to be a player in this game. As the security industry repeatedly stresses, all it takes is one smart guy and a laptop to cause trouble.
And there’s plenty of trouble out there. Western governments cite three central threats that justify the increased presence of military, intelligence and law enforcement agencies in cyberspace: crime, commercial espionage and warfare.
Many ordinary people can testify to the sheer audacity of web criminals. In September, Roger Mildenhall, an Australian living in South Africa, got a phone call telling him that one of his two Perth properties had been sold and that contracts were about to be exchanged on the other. Mildenhall thought the call was a joke, for he had no intention of selling either property. It emerged that Nigerian cyber criminals had seized his digital identity and obtained copies of the title deeds to his two houses. The proceeds, nearly A$500,000 (£300,000), were transferred to a bank in China, from where the funds were laundered.
Criminal threats such as this, new security measures and the global growth of web censorship are already changing how we use the internet. We will find ever larger areas of the net difficult to access and we will have to sacrifice some convenience as institutions force us to assume greater responsibility for our own security. Already some banks, such as HSBC, insist that customers install proper security software on their PCs, otherwise they will not reimburse them if they fall victim to cyber crime.
Undeniably, banks lose most money from cyber attacks because of the sloppiness of their customers. But the banks, too, need to clean up their act. “Financial institutions must invest more in next-generation internet banking technologies and consumers must take a more informed attitude towards the types of e-commerce sites they visit,” says Rex Hughes of Chatham House. “Today, organised crime clearly has the upper hand in online banking but better engineering, regulation and user education can help to restore order in financial cyberspace.”
Last week’s bust of an east European gang, which made at least $70m using the notorious malware known as Zeus, proved the point. The hackers targeted small businesses and institutions, knowing that they would have a weak cyber defence in place.
China has argued that the next generation of computer users will need to pass the equivalent of a driving test before its members are allowed to surf parts of the web essential for day-to-day life. The idea has triggered a huge backlash among civil libertarians worldwide who warn that such a move would undermine completely the very freedoms that the internet was designed to promote.
According to a Data Breach report published by US telecom company Verizon, commercial espionage accounts for a third of illegal activity on the web. When criminals break into a company’s computer system to steal information, it’s mainly employees’ lax working practices that allow them to do so – people using virus-infected memory sticks that they have received as a gift, for example. Although industrial spying is rife, targeted companies like to keep it quiet. Telling the world that your company is vulnerable to cyber attacks does not inspire investor and customer confidence.
Where the military is responsible for cyber defence and cyber warfare, law enforcement agencies such as the FBI and Britain’s Serious Organised Crime Agency hunt down cyber criminals. The large security companies such as McAfee and Symantec look after private clients threatened by industrial spies. But no act of cyber crime, espionage or warfare can be mounted without the involvement at some point of skilled hackers – often ones who deploy their skills across the board.
Opposing them are the world’s intelligence services. Spook central in Britain is the Government Communications Headquarters, housed in “the Donut”, a purpose-built circular structure on the outskirts of Cheltenham. Almost 5,000 spies and geeks sift huge amounts of data gathered globally from the internet and mobile communications devices to assess cyber threats facing Britain and its allies. The atmosphere inside is curiously relaxed, with a lot of young people using break-out areas and hot-desking, rather like a successful dotcom start-up. Yet this is one of the most secure facilities in the country, and one that gives Britain a huge advantage in defending itself against modern crime, terror and war. “If you look at cyber capacity of individual countries,” Tony Yustein, the security consultant, told me, “I would say Israel – I mean of course Mossad – are the best; the United States is second not because of the CIA but because of the National Security Agency; and then Britain, MI5, MI6 and GCHQ, is a strong third.” Drawing on this pedigree, GCHQ’s primary aim is to spot and stop the 20 per cent of nasty stuff on the web that sensible ordinary measures such as anti-virus programs cannot prevent.
Washington is overflowing with doomsayers. In February, Mike McConnell, a retired vice-admiral and George W. Bush’s intelligence chief, informed Congress that if America became involved in a cyber war now, “we would lose”. He added that “a major cyber attack could shut down our nation’s most critical infrastructure – our power grid, telecommunications, financial services”. There is a danger with such rhetoric of crying wolf. According to Amrit Williams, a specialist with IBM and one of cyber security’s most astute observers: “There is no question that we have a very serious problem; the increased reliance on technology, the ubiquitous nature of broadband connectivity and more digital commerce all create an environment that will breed increasingly sophisticated crime.” But he warns that deploying the so-called “Fear, uncertainty and doubt (FUD) strategy of rhetoric doesn’t work – it drives up hysteria”.
Nonetheless, following the emergence of Stuxnet this summer, there can no longer be any ambiguity about whether military cyber security is an issue for governments. This complex virus directly targets Siemens-designed software in industrial systems, allowing the malware to take control of power plants. Although it has been found across the world, many believe the virus’s primary target was Iran’s Bushehr nuclear reactor. The infection of employees’ laptops has led to cries of western sabotage from Iranian government officials.
As investigations continue, even the most sober voices are agreed: Stuxnet has stepped up the cyber arms race by two or three notches. “This virus could only have been developed by a team of sophisticated security professionals with time and money at their disposal,” explains Mikko Hyppönen, chief research officer for F-Secure, the Finnish-based computer security company. He believes Stuxnet’s sponsor was a state, not a group of random hackers. “We have known about it for several months and still haven’t managed to decode it fully.” What this means, he says, “is that we now have proof that states are investing serious resources into the development of next-generation viruses. It is without question the most significant virus we have seen in a decade.” It is also our most significant indication to date that the struggle for control of the internet is just beginning.
Misha Glenny’s ‘McMafia: Seriously Organised Crime’ is published by Vintage
SOURCE FINANCIAL TIMES OCTOBER 2010
Labels: policy
Link
posted by The visioner @ 12:42 PM
0 Comments:
Post a Comment
<< Home