Is Cyber a new warfare? Debate (catch all)

[Brett Patron]

Gents: we need some intellectual honesty and parameters in this debate.

Are we talking about this topic in broad and academic terms, unconstrained by actual policy? Clearly two correspondents here are not focused on the processes by which the DOD funds it's operations, and therefore how DOD can posture itself to operate in this new realm.

It is cute and smarmy to rail against "concrete thinkers" when the subject of doctrine is raised. And, if correspondents are not actually responsible for implementing policy, it is easy to claim to have the answers.

Want to know why the non-DOD interagency is handcuffed? They don't have anything akin to "doctrine" and therefore no way to justify the capabilities it requires to operate in the cyberspace domain. Consequently, they are unfunded or woefully underfunded.

Private concerns or other Nation-States may not use the term "doctrine" but they have something like it that helps them establish parameters for what they want to be able to do, how they want to operate in cyberspace, how they will defend and, if such is in their interest, how to conduct offensive operations.

[selil]

Originally Posted by Brett Patron

It is cute and smarmy to rail against "concrete thinkers" when the subject of doctrine is raised.

Cute and smarmy in the same sentence? Put a fork in me I'm done.

[anonamatic]

Originally Posted by ganulv

Maybe an office suite in Guangzhou, maybe a hotel in Odessa, maybe an apartment in Lagos. There is ultimately a physicality to be reckoned with. The EMS is in the physical world; where is “the” cyberspace?

I can put myself any of those places, and all of them if I want to. In fact being lost in some digital rats nest is something of an advantage to anyone doing it.

[Sergeant T]

I wonder if the Pentagon's formal cyber strategy will articulate a threshold for when attacks on private sector resources become a national security issue. The recent attack on RSA SecurID tokens is going to come with one hell of a price tag when all is said and done. But aside from the cost the impressive thing is the sheer reach. Multiple industries, tens of millions of employees and customers, and the daunting physical reality of possibly having to replace 30 to 40 million SecurID tokens. Even replacing 5% of the tokens in circulation will take some time. Money quote from the end of the article:

"Ullrich said the attack “was definitely state-sponsored” espionage because the scheme was so sophisticated."

[AdamG]

This ought to be interesting -

WASHINGTON — The International Monetary Fund, still struggling to find a new leader after the arrest of its managing director last month in New York, was hit recently by what computer experts describe as a large and sophisticated cyberattack whose dimensions are still unknown.

The fund, which manages financial crises around the world and is the repository of highly confidential information about the fiscal condition of many nations, told its staff and its board of directors about the attack on Wednesday. But it did not make a public announcement.

http://www.nytimes.com/2011/06/12/world/12imf.html?_r=1

[Armchairguy]

It seems unlikely with the technology I am aware of that combat will come about as a result of a cyber attack. It is just too easy to cover your tracks. For some time I expect serious attention will be payed to making tracing of attackers a surer thing. Until that time good old fashion spy work and a lot of our own hacking will be the way to find perpetrators and barring that leaving tasty little poison pills around to go after the perpetrators information and infrastructure seems likely. The only problem with that is that the bad guys eventually have your poison pill codes and can use it against you on less defended portions of your information structure. We need computers and networks designed from the ground up with security in mind and independent networks that are not connected to the internet for critical infrastructure.

Perhaps there is already technology that can catch the perpetrators of cyber warfare with their hand in the cookie jar. The fact that we are considering this an act of war may suggest it already exists.

[AdamG]

Did I make Dr. Evil finger-quotey motions when I said "interesting"?

Hackers who broke into the International Monetary Fund's computer system may have been backed by a nation state, according to security experts.

They point to the sophisticated nature of the attack and the resources needed to develop it.

Malicious software, designed to steal confidential files, was installed on at least one IMF computer.

http://www.bbc.co.uk/news/technology-13748488

[AdamG]

Derp.

US officials said they have ordered a security review after hackers managed to break into the Senate website at the weekend.

An official said the incident had been "inconvenient", but had not compromised the security of the staff.

The confirmation came after Lulz Security, a loosely aligned group of hackers, said it had carried out the attack for fun and posted files online.

Lulz has previously targeted Sony, Nintendo and Fox News.

http://www.bbc.co.uk/news/world-us-canada-13758361

[AdamG]

If there is widespread Chinese hacking of sensitive U.S. networks and critical infrastructure, what has the administration said about it to the Chinese government? Specifically, did President Obama raise concerns about these attacks with Chinese President Hu Jintao at the White House this spring?

Since defensive measures such as antivirus software and firewalls appear unable to stop the Chinese penetrations, does the administration have any plan to address these cyberattacks?

In private, U.S. officials admit that the government has no strategy to stop the Chinese cyberassault. Rather than defending American companies, the Pentagon seems focused on "active defense," by which it means offense. That cyberoffense might be employed if China were ever to launch a massive cyberwar on the U.S. But in the daily guerrilla cyberwar with China, our government is engaged in defending only its own networks. It is failing in its responsibility to protect the rest of America from Chinese cyberattack.

http://online.wsj.com/article/SB1000...googlenews_wsj

[AdamG]

WASHINGTON (AP) - President Barack Obama has signed executive orders that lay out how far military commanders around the globe can go in using cyberattacks and other computer-based operations against enemies and as part of routine espionage in other countries.

The orders detail when the military must seek presidential approval for a specific cyber assault on an enemy and weave cyber capabilities into U.S. war fighting strategy, defense officials and cyber security experts told The Associated Press.

Signed more than a month ago, the orders cap a two-year Pentagon effort to draft U.S. rules of the road for cyber warfare, and come as the U.S. begins to work with allies on global ground rules.

The guidelines are much like those that govern the use of other weapons of war, from nuclear bombs to missiles to secret surveillance, the officials said.

http://apnews.myway.com/article/20110622/D9O0SERG0.html

[AdamG]

Should We Fire the First Shot in a Cyberwar?
Defending against an attack is so hard that some think a stronger offense is required.
http://m.technologyreview.com/web/39315/

[Brett Patron]

Originally Posted by AdamG

Should We Fire the First Shot in a Cyberwar?
Defending against an attack is so hard that some think a stronger offense is required.
http://m.technologyreview.com/web/39315/

Defense and Offense are different and simultaneous. Parallel, but interlocked efforts. That is probably what makes this a unique warfighting domain.

[AdamG]

China-Based Hacking of 760 Companies Shows Cyber Cold War

Google Inc. (GOOG) and Intel Corp. (INTC) were logical targets for China-based hackers, given the solid-gold intellectual property data stored in their computers. An attack by cyber spies on iBahn, a provider of Internet services to hotels, takes some explaining.

http://mobile.bloomberg.com/news/201...obal-cyber-war

[selil]

Like any of the other domains cyber has different roles that inherently suggest capabilities and also responsibilities. If you accept cyber as a defacto domain.

Computer Network Attack, Defense, and Operations are elements of nation state capability to wage war and control communications and control mechanisms.

Information (assurance) and security is about users, corporations, and non-military governmental entities protecting their information assets.

This is not an equivocation, but a realization that not all attacks rise to the level of war, and that not all capabilities are about making war. We have police forces for taking care of crime, but militaries for taking care of similar actions/behaviors that carry quite different consequences. Not all nations separate these powers, but almost all nations realize the difference when talking about terrestrial or the sea.

So hacking, low level noise, and other inelegant descriptions of the noise in a borderless cyber world is not necessarily war. No matter what people call it. It may be criminal, it may be inconvenient, but it is not war. Similarly defense by a military entity is not the same as defense by a non-military entity. Further, the element of defense in hostile operations environments will be significantly different the element of defense in normal operations.

Unfortunately such subtleties aren't in vogue or considered by the main stream media.

[Backwards Observer]

Chinese hackers deface Bloomberg 'capitalist roader' editorial section, produce non-alarmist article; cyberpocalypse slouches closer:

View: Corporate America Must Fight, and Live With, China Hackers

Chinese hackers have redefined the concept of room service: In one recent attack, they infiltrated an Internet service provider to some of the world’s leading hotels, potentially gaining access to millions of confidential messages of traveling executives, as well as to the victims’ corporate networks.

[...]

Of course, industrial espionage has been a fixture of the economic landscape for centuries. Americans have a rich history of pilfering ideas from abroad, beginning with the theft of spinning and weaving technology from the British. So one proper response to today’s techno-thieves -- be they Chinese, Russian, French, German or Israeli -- is for American companies to embrace the threat as a fact of life and step up their own vigilance, especially when their executives travel overseas.

[...]

Finally, we need to treat the threat of Chinese cyber- espionage, real as it is, in a sober, nuanced manner. Sometimes, U.S. cyber warriors talk of China in language that sounds like it comes from an old Fu Manchu movie. China isn’t a monolith: the Ministry of Foreign Affairs, the Ministry of State Security and the People’s Liberation Army -- not to mention an army of rogue hackers -- all behave very differently.

Many Chinese recognize that China and the U.S. share a common interest in ensuring the protection of intellectual property, that foreign companies will not continue to invest in a country that is stealing their crown jewels, and that China stands to lose from undermining an economy in which it has invested hundreds of billions of dollars.

View: Corporate America Must Fight, and Live With, China Hackers - Bloomberg - Dec 16, 2011.
...

Also hacked; Council of Foreign Relations (paper tiger dept.) becomes 'PLA mouthpiece', cybergeddon looms:

Can You Hear Me Now? The U.S. Sends China a Message on Cyber Espionage

[...]

Whatever happens next, we are clearly only at the beginning. Claiming specific individuals and groups are behind the attacks is an important step forward, but where this all ends will ultimately depend on politics—how important cyber threats are compared to all the other issues in the U.S.-Sino relationship.

Can You Hear Me Now? The U.S. Sends China a Message on Cyber Espionage - Asia Unbound (CFR blog) - Dec 13, 2011.
...

Fah Lo Suee

[AdamG]

The United States Chamber of Commerce has confirmed Chinese hackers last year broke into internal networks.

The breach is, in some ways, a twist of fate for the Chamber. It has been one of the more vocal critics of cybersecurity legislation. In an internal draft document circulated earlier this year, the Chamber criticized the White House’s legislative proposals on cybersecurity as “regulatory overreach” and cautioned that “layering new regulations on critical infrastructure will harm public-private partnerships.”

http://bits.blogs.nytimes.com/2011/1...rsecurity-law/

[Backwards Observer]

Adam G, I was beginning to think you'd hit the snooze button.

China Hackers Hit U.S. Chamber
Attacks Breached Computer System of Business-Lobbying Group; Emails Stolen

A group of hackers in China breached the computer defenses of America's top business-lobbying group and gained access to everything stored on its systems, including information about its three million members, according to several people familiar with the matter.

Paranormal activity:

The Chamber continues to see suspicious activity, they say. A thermostat at a town house the Chamber owns on Capitol Hill at one point was communicating with an Internet address in China, they say, and, in March, a printer used by Chamber executives spontaneously started printing pages with Chinese characters.

Ends on a hopeful note:

"It's the new normal. I expect this to continue for the foreseeable future. I expect to be surprised again."

It's funny cos' it's Fu! (reader observation from WSJ article comment thread, p.10):

To be more succinct the Chinese are already at war with the free world and America just haven't accepted that these are really xenophobic nasty people who need to be quarantined from the civilized world.

China Hackers Hit U.S. Chamber - WSJ - Dec 21, 2011.

[Backwards Observer]

We are the Priests of the Temple of Syrinx:

Defending intellectual property in an internet age

SpaceX is in a race for its life with the Chinese. The US venture says it has $3bn in orders under its belt, making it one of the early leaders in the commercial space industry. But founder Elon Musk is under no illusions about the existential risk to his business: the Chinese path to success in the commercial space industry, he says, runs over his company’s dead body.

What should a company, or an entire industry, that finds itself in Chinese cross-hairs do? One response at SpaceX, Mr Musk says, has been to avoid seeking patent protection for the company’s most important technology.

[...]

That starts with a clear-eyed assessment of what technology is most the most vital. If businesses like SpaceX are not going to patent their best ideas, then they must go to great lengths to defend it. It should be stored on systems that are not connected to the internet, says Mr Anderson, with strict limits on who has access.

Greater accountability is also essential, both inside and outside. Protection of IP should be a clear senior executive responsibility. And shareholders and regulators have a part to play. More disclosure of hacking attacks is needed. Shareholders would also be reassured by explicit certification that their company’s crown jewels are secure.

Defending intellectual property in an internet age - Financial Times - 21.12.11

2112

Merry Christmas, Peace on Earth, Goodwill to All Humans (MC:PoEGaH)

[tequila]

I'm a bit confused. How come normal espionage is just espionage, but cyber-espionage (against private entities!) somehow equals war?

[selil]

I've been working on answering "WHY it's so easy to hack targets" It's way outside the lane of Small Wars but here is some link bait http://selil.com/archives/2880 of what I'm working on. Don't worry about all the other stuff the only thing that really matters is there are a whole lot of vulnerabilities with associated exploits (that will be zero days) that aren't even disclosed on any one day and that window moves through time. Only silly people say that Stuxnet had an unprecedented 4 zero days. On average 12 zero days are created every day.

Summary: Pishaw