Strife

The Academic Blog of the Department of War Studies, King's College London

You are here: Home / Archives for Cyber Security

Cyber Security

Why the Terminator might turn out to be Chinese: China’s bid for an AI-empowered military

by

By Clément Briens

A mock robot used part of the ‘Campaign to Stop Killer Robots’, aiming at banning any autonomous AI systems (Credit Image: Getty)

Science fiction’s portrayal of Artificial Intelligence (AI) has very often been centered on the fear of “killer robots” almost always often manufactured by the United States (US) government. The malevolent Skynet AI in the Terminator franchise, for instance, is developed by Cyberdyne Systems, a US military contractor. The AI in I, Robot was also manufactured by a fictional US government contractor- the aptly named US Robots and Mechanical Men Inc. However, reality has strayed from these popular conceptions, as they approach almost half a century of age. The reality is that AI will have many military applications other than “killer robots” as we picture them- and if we ever do see the rise of a Terminator in our lifetimes, they will not be built with Arnold Schwarzenegger’s iconic Austrian accent. Rather, the Terminator will most likely speak Mandarin Chinese.

 

China’s march towards AI

In June 2017, China’s State council released its AI Development Plan- which shows Beijing’s clear intent in boosting its efforts in developing its own AI capabilities. The document reveals China’s ambition to become “the world’s premier AI innovation centre” by 2030- which will likely increase its competitiveness in the economic and military-industrial sectors, a worrying thought for US policymakers. Even more worrying for US leaders is the fact that China will most likely piggyback on US innovation to achieve this, either through industrial espionage, (which China has long history of resorting to); or by legitimately investing in American AI startups (which has already has begun).

Beijing’s dual strategy to fulfil its ambitions is clear. First, it will seek to acquire some of these technologies by investing in the US. While some of these investments may seem like normal Foreign Direct Investments (FDIs) at first glance, the risk remains that AI is a dual-use technology. That is, it “can be used for both civilian and military applications”, such as nuclear power or GPS. Furthermore, dual-use technologies are notoriously hard to control, as demonstrated by the difficulty of the JCPOA negotiations with Iran in 2015. Compliance through inspectors and safeguard mechanisms is difficult, as demonstrated by the alleged construction of underground nuclear enrichment facilities, although its actual existence remains inconclusive. Similar measures to marshal AI research could be just as problematic.

Second, Beijing will not only seek to exploit investments in sensitive US technology firms, it will also look to stimulate its own local start-up community. A report by Eurasia group and Sinnovation Ventures states that “China’s startup scene has transformed dramatically over the past 10 years, from copycat versions of existing applications to true leapfrog innovation”, in part due to “supportive government policies”. This seems to be far from the reality of Washington’s policies with regard to AI, as Donald Trump’s 2019 budget proposal supposedly “wants to cut US public funding of “intelligent systems” by 11 per cent, and overall federal research and development spending by almost a fifth.” Indeed, the Trump presidency lays out a stark future for US development of AI and any hopes of catching up with China.

Terminator or J.A.R.V.I.S.?

With recent news on China’s advances in AI, it is important to clarify what the security implications of AI may refer to, and to debunk the “killer robot” myth. The public’s main perception of AI is one of “killer robots”, fuelled by the sci-fi portrayals cited above. Boston Dynamics recently published a series of viral videos showing their advances in developing dog-like SpotMini robots mounted with robotic arms. In this video, the robots were capable of taking a beating from a nearby engineer and opening doors. Internet users reacted to these videos with mixed feelings:

Screenshot of comments on Boston Dynamics’ viral “Testing Robustness” video showing off their SpotMini robot (Credit YouTube)

 

Some of these reactions have been much stronger than others. For instance, an open letter by 116 scientists sparked discussions at the United Nations (UN) of a ban on autonomous “AI-empowered” weapons systems. Additionally, campaigns to ban “killer robots” have sparked worldwide.

But while the public fear for Terminator-type killer robots is understandable, as AI-controlled weapons systems cross innumerable ethical and moral lines, other fearful applications of AI exist. The potential for AI-empowered cyber weapons, for example, seems more likely than killer robots, and can have destructive effects that would endanger Western liberal democracy. A report titled “The Malicious Use of Artificial Intelligence” outlines the risks that AI poses in helping with the automation of cyber-attacks. Although AI is already being employed as a form of cyber defence, the report outlines how AI can be used to empower “spear phishing”, a technique where hackers target individuals through social engineering in order to obtain passwords and sensitive data.

One can imagine how AI can also be employed in spreading disinformation on a much larger scale and more efficiently than “dumb” botnets. The Internet Research Agency in St. Petersburg, Russia, allegedly had a hand in interfering in the 2016 US Presidential elections. Such troll factories will be a thing of the past as AI will become able to autonomously mimic online profiles by feeding off of huge amounts of data on Twitter and Facebook to automatically formulate opinions, spread political messages and retweet/share disinformation. While the US Department of Justice was able to attribute, identify and indict thirteen of these so-called trolls, attribution of AI-controlled social media accounts will be even harder. Thus, AI-empowered disinformation may have far-reaching consequences on our electoral processes.

 

How the US can stay ahead

Many are skeptical of the ability of the UN to actually ban autonomous weapon platforms, and the fact that Russia and China would probably not abide by such a ban makes the proposed ban much less endearing to US policymakers.

How then can the US stay on par with China’s rising economic power and its fine-tuned strategy?

Firstly, to remain competitive, the US needs to limit the spread of dual-use AI technology originating from its Silicon Valley laboratories. An unreleased Pentagon report obtained by Reuters highlights the need for the curbing of these risky Chinese investments, which most likely gain access to AI advances without triggering CFIUS (Committee on Foreign Investment in the United States) review. In fact, implementing these proposed reforms from the Pentagon would be a welcome first step for US lawmakers.

Secondly, the US needs to bank on foreign nationals by investing in and retaining top talents. A comprehensive report by Elsa B. Kania for the Center for a New American Security argues that it is “critical to sustain and build upon the current U.S. competitive advantage in human capital through formulating policies to educate and attract top talent”. Modifying immigration laws for top Chinese students in AI and other high-tech domains to allow them to stay after their studies could be a solution to mitigate the “brain-drain” effect that Silicon Valley is currently enduring, and a way to gain an edge on Beijing.

Lastly, the US should also rely on its private sector, in which most of the world’s cutting-edge AI research is taking place. According to a CB Insights report, 39 out of the top 50 AI companies are based in the US. However, the most well-funded of them remains a Chinese firm, ByteDance, which has raised $3.1bn according to the report. The US has a flourishing industry which needs backing from its leaders. With industry leaders such as Google’s DeepMind venture or even Tesla investing billions into AI research, competing with Chinese firms is more than achievable. MIT’s compiled list of the world’s 13 “Smartest” AI ventures lists five US companies as their top 5 picks: NVidia, SpaceX, Amazon, 23andMe, and Alphabet, Google’s parent company.

While the US is still ahead of China in terms of AI research, its rival’s intent and strategy and the lack thereof from the current US administration seems to give it the edge in the next decade of AI research. US allies such as the United Arab Emirates (UAE) and France have both unveiled AI-oriented national strategies. The Trump administration seems to be lagging behind in presenting an American equivalent of similar scale, despite desperate calls from academics and cybersecurity professionals.

 

Clément Briens is a second year War Studies & History Bachelor’s degree student. His main interests lie in cyber security, counterinsurgency theory, and nuclear proliferation. You can follow him on Twitter @ClementBriens

Image Source

Banner: https://blogs.spectator.co.uk/2017/08/we-should-regulate-not-ban-killer-robots/

Image 1: https://www.youtube.com/watch?v=aFuA50H9uek

 

The Cyber Espionage Predominant Purpose Test

by

By Jessica “Zhanna” Malekos Smith

 

Credit Image: Wikimedia Commons (picture modified by the author)

While ‘spying’ may strike some as indecorous state behaviour, it is essentially akin to a bodily function, like sneezing, that is necessary to sustaining the health of the body politic.

But can international law meaningfully distinguish between cyberespionage for national security purposes and economic espionage? According to former U.S. Treasury Secretary, Henry M. Paulson, Jr. in Dealing with China, “the distinction between cyberespionage and cybertheft from a company for commercial use can become fuzzy.” This article proposes a new approach – a Cyber Espionage Predominant Purpose (CEPP) Test – to resolve international disputes concerning cyberespionage operations that involve mixed elements of national security espionage and commercial espionage.

 

But first, what exactly is the value of the CEPP Test?

In 2013 the U.S. National Intelligence Estimate announced that “France, alongside Russia and Israel, to be in a distant but respectable second place behind China in using cyberespionage for economic gain.” In comparison, according to Dr. Catherine Lotrionte, the Director of the CyberProject at Georgetown University, the U.S. does not conduct commercially motivated cyber espionage. In fact, the Obama Administration averred that a distinction exists between economic intelligence – a subset of national security espionage – and commercially motivated economic espionage.

For Drake University Law Professor Peter Yu, however, this distinction is nebulous at best: “Not only do most countries—democratic or otherwise—fail to recognize it, this line is also not always drawn in situations involving U.S. intelligence and surveillance efforts.” Yu highlights that for countries like China, the U.S.’ definitional distinction imparts little clarity here, “given the perceived “overlap between security and economic concerns” among Chinese policymakers and the continued domination of state-owned enterprises in the local business environment.”

Thus, given the distinct cultural norms embedded in distinguishing between permissible and impermissible intelligence collection, a dispute resolution framework that accounts for these disparities, as well as the complexities of attribution, is needed. The value of this test is that rather than argue for one country’s particular definition here, it enables the The International Court of Justice to holistically evaluate both parties’ views in reaching a settlement. Moreover, a bright line rule that prohibits gathering intelligence on all state-industrial entities would not be viable in China according to Yu, because it “overlook[s] the historical fact that trade secrets originated in China as a form of state secret.”

 

What is a ‘predominant purpose’ test?

In disputes over the mixed subject matter of a contract, the approach taken by U.S. courts is to analyze the overall ‘predominant purpose’ of the contract (e.g., a contract for the sale of goods or services) and apply the most fitting legal regime. The CEPP Test operates under the same principle. Here, it would require the International Court of Justice (ICJ) to evaluate the overall ‘predominant purpose’ of the alleged act of cyberespionage.

 

Wait… when and how would the ICJ apply the CEPP Test?

Pursuant to U.N. Charter Article 33: “The parties to any dispute, the continuance of which is likely to endanger the maintenance of international peace and security, shall, first of all, seek a solution by negotiation, enquiry, mediation, conciliation, arbitration, judicial settlement, resort to regional agencies or arrangements, or other peaceful means of their own choice.”

Drawing on this judicial settlement framework, the aggrieved state could petition the ICJ for redress and the court would examine the following three factors to determine the predominant purpose of the act of cyberespionage:

(1) The intrinsic nature of the economic information in dispute; (2) the means of acquisition and predominant application by the entity, and (3) the overall intent of the collecting entity.

If the ICJ found by a preponderance of the evidence that the act of cyberespionage was ultimately committed to confer a commercial advantage to the other state’s home industry, then an appropriate remedy would be granted to the aggrieved state.

 

Does this solve the attribution problem?

No. However, as a counter balance to the attribution problem, the test utilizes a lower evidentiary standard from civil law, a preponderance of the evidence (i.e., a showing of more than 50%), to allow the aggrieved state the opportunity to seek legal recourse from the ICJ.

The benefit of applying a lower standard of proof here, versus a heightened “beyond a reasonable doubt” standard typically applied in criminal proceedings, is that it operates as a stronger deterrent. The reason being, faced with the looming spectre of litigation and its associated costs, states that routinely engage in cyber economic espionage would face a greater cost disincentive.

But if a state believes they can remain anonymous in conducting cyber economic espionage and leverage non-attribution here, can international accords prohibiting the cyber theft of intellectual property hold any measurable deterrent effect? Indeed, a major critique of the Obama-Xi Cyber Pact of September 2015, as vocalized by the Wall Street Journal, was that it represented “a digital arms deal that is full of promises but no enforcement.”

As a result, should international law be completely jettisoned in cyberspace? To former U.S. Secretary of State, Madeleine K. Albright, who described herself as an “optimist who worries a lot” at Wellesley College’s Albright Institute Symposium in January 2016, the answer would most likely be a resounding no. In Secretary Albright’s book, The Mighty and The Almighty, she reasons that while countries often do take action outside of the charter’s guidelines, “[d]espite such violations, the standards in the charter remain relevant, just as laws against murder remain relevant even though murders are still committed.”

 

Will the Trump administration reaffirm the ‘no-hack-pact’ with China?

In October 2017 the Trump administration’s Department of Justice reaffirmed the 2015 ‘no-hack-pact’ with Chinese officials.

Building off of that momentum, a pledge to uphold the “The First U.S.-China Law Enforcement and Cybersecurity Dialogue” was publicly released by the US Department of Homeland Security. Following the announcement of this pledge, however, Politico reported that the “Trump administration has not made strong public statements either way regarding the U.S.-China cyber pact despite jointly pledging with China in October to continue implementing the deal.” That aside, the cyber pact is still in effect between the two countries and has been largely positively viewed by cyber security leaders as a milestone in cyber international relations. According Dmitri Alperovitch of CrowdStrike and Christopher Porter of FireEye, this pact has been effective in reducing the amount of cyber economic espionage incidents. For Porter, ‘[i]t shows that diplomacy can be used to reduce the cyber threat to Americans” and that norm-building in cyberspace is feasible.

Building and Rebuilding International Norms in Cyberspace

Admittedly, international norms do not blossom into fully-grown gardens overnight, but diplomatic initiatives like the 2015 U.S.-China cyber pact, can help foster growth here. Thus, what the CEPP Test offers the international community is a proverbial seed, which if properly cultivated could take root in the international legal system. Ultimately, because no state is an island in cyberspace, a model that is both attentive to the attribution problem and the mixed nature of espionage operations can help promote the economic security of all.

 

This article has been updated and republished on Strife Blog with the author’s permission. It was originally published on Small Wars Journal.

Jessica “Zhanna” Malekos Smith is a M.A. candidate with King’s College London, Department of War Studies. Previously, she was a Postdoctoral Fellow with the Belfer Center for Science and International Affairs at the Harvard Kennedy School. She holds a B.A. from Wellesley College, where she was a Fellow of the Madeleine Korbel Albright Institute for Global Affairs, and a J.D. from the University of California, Davis School of Law.

Image Source: https://upload.wikimedia.org/wikipedia/commons/9/9e/Party_game_with_cards.png (Wikimedia Commons)

 

 

The Cyber Hangover: British cyber strategy before and after WannaCry

by

By Clément Briens

This article is a follow-up to my previous blog entry, that examined French national cyber strategy, and which can be found here.

The UK Prime Minister, Theresa May (Photo Credit: AFP)

More fear than harm

The WannaCry ransomware that plagued the National Health Service (NHS) in May 2017 served as a wake-up call for many, as it demonstrated the vulnerability of the UK’s critical infrastructure. Public dialogue concerning the state of the British cyber policy and security has ensued following this attack, with the USA pointing fingers at North Korea for the aggression and many British news outlets questioning the government’s cyber defence capabilities. While WannaCry was relatively harmless, and it is still unclear if it was an intentional attack on the UK or simply a viral malware, one can imagine the potentially disastrous consequences of future cyber-attacks on other parts of the UK’s national infrastructure.

Fortunately, UK policymakers have heeded this warning, and have allocated an extra £21 million “to increase the cyber resilience of major trauma sites as an immediate priority”. This response is a first real-world application of the UK’s 2016–2021 National Cyber Security Strategy paper, and the first successful application of its principles. This article will argue that such a strategy paper is a leading example of how to deploy a national cyber strategy, although it is not perfect.

The strategy’s main strengths are that it seeks to build up resilience rather than just blindly upping the offensive ante; to raise public awareness and initiate a public dialogue; and to invest in the country’s youth to find the solutions to future problems. The first part of this article will be spent examining how these aims have successfully been translated into practice. However, the second part of the paper will observe how the UK is failing to secure its election infrastructure, which is a major shortcoming in its national strategy.

Reaffirming resilience

As mentioned above, government responses have sprung relatively quickly following the WannaCry intrusion of the NHS to give it the tools it needs to fend off future attacks and malware. This rapid cure to the national security hangover demonstrates one of the tenets the application of the main principles outlined in the paper, the “3-D” strategy: defend, deter, and develop.

Excerpts from the National Cyber Security Strategy paper

Developing resilience is an objective that involves all three aspects of this 3-D strategy. Indeed, UK businesses should collaborate with public actors to develop security solutions for both sectors in order to help defend companies and public organisations more effectively, which hopefully will deter future attacks.

This strategy has been taken very seriously by Chancellor Phillip Hammond, who in 2016 had pledged £1.9 billion in support of these cyber initiatives. Such an effort provides resources for the main UK actors such as the National Cyber Security Centre (NCSC) and Government Communication Headquarters (GCHQ); and it also supports the creation of the Cyber Security Research Institute (CSRI).

 

Policy Parley

Another crucial aspect of the 2016–2021 National Cyber Security Strategy paper is public engagement and training. To this extent, a plethora of government initiatives have been enforced, with the objectives to raise awareness and construct dialogue with the individuals, companies and academics. Two of these campaigns are known as Cyber Aware and Cyber Streetwise, the former of these being explicitly aimed towards small businesses:

The Cyber Streetwise campaign

Furthermore, efforts have been made to keep academics in the loop. The NCSC’s Cyber Security Body of Knowledge initiative, dubbed CyBOK, has united an academic consortium including professors from Oxford, Imperial, UCL and others, with their aim being “to codify the cyber security knowledge which underpins the profession”.

Screenshot from the Cyber Accelerator website

Meanwhile, the NCSC is debuting its “Cyber security academic startups programme”, which aims to provide academic startups with grants up to £16,000, GCHQ are also holding their Cyber Accelerator programme to challenge the cyber-security startup community to “ develop new tools and prototypes that enhance or enable security on existing devices”.

 

Training Teens

Another of the key points of the National Strategy is to tap into the vast potential of young adults and others that have benefited from the democratisation of cyber tools and refine this raw talent into a key asset. Efforts have been made to recruit imaginative youths with coding skills: the development of interactive websites such as the Cyber Discovery website acts as an assessment tool for the Cyber Schools programme, which aims to recruit teenagers from ages 14–18.

Screenshot from the Cyber Discovery website

The Catch

The conclusion of the first part of this article is that the UK is excelling in building resilience and investing in cyber security, two edges of the same cyber-sword that provides protection to the country.

Campaigners hold placards for ‘Britain Stronger in Europe’, the official ‘Remain’ campaign group seeking to avoid a Brexit, ahead of the forthcoming EU referendum, in London on June 20, 2016 (Photo credit: JUSTIN TALLIS/AFP/Getty Images)

However, there is a significant flaw in the National Cyber Security Strategy: the absence of a classification of voting technology and the electoral process at large as part of the country’s Critical National Infrastructure (CNI). This prevents voting technology from benefitting from CNI-grade cyber security. The WannaCry blunder has demonstrated how actors can easily paralyze the UK’s health system, which is why Britain urgently needs to secure other aspects of its critical infrastructure, such as its democratic institutions.

Cyber-crime poses a major threat to Western democracies, as official reports are accusing foreign groups of interference in the recent American, French, German, Spanish, and British elections via cyberspace. The risk for upcoming elections in Italy in March and the EU Parliament next year is genuine. Theresa May has already expressed her concerns with the meddling in the Brexit referendum in particular.

However, in practice, not much has been done to bolster cyber security in regards to voting technologies. For example, a May 2017 Parliamentary Office of Security and Technology (POST) report analyses foreign involvement in British CNI. However it only identifies such involvement in two sectors: supply chain involvement (Chinese hardware being used by various critical sectors) and foreign investment and direction.

Furthermore, a US Senate Committee of Foreign Relations report published January 10th examining the impact of Russian interference on Western democracies holds a particular statement concerning the UK:

“British officials stated after the poll that there was ‘‘no successful Russian cyber intervention’’ into the election process seen and asserted that systems were in place to protect against electoral fraud at all levels, though it is unclear the extent to which the lack of meddling may have also been due to a shift in the Kremlin’s approach.”

Over-confidence in capabilities has never been a good sign in military history; cyber security is no exception. Projects of introducing online voting by 2020 will only exacerbate the risk that foreign governments or independent actors will seek to influence the outcome of British democratic processes. Voter identity theft is now a frightening possibility, as hackers can purchase massive datasets of voter information on the dark web in order to usurp voter identities online and alter votes. The modification of voter locations, hence making their votes void, is also a concern. While the rise of blockchain technology may be the solution for both transparency and security in online election processes, a reverse trend can be found in other European countries such as the Netherlands and France that are in fact abandoning online voting.

 

Curbing the Hubris

Introducing online voting would be a step in the wrong direction towards safeguarding British democracy, as it would expose voting to the same risks as other CNI sectors that are now controlled though the internet, without putting it under security standards that CNI benefits from. Placing British election infrastructure under CNI security standards would be the better option in this matter.

Another broad conclusion that we can make is that this 2016 paper may already be outdated. Five-year plans in the age of cyber security may not be the best answer, as the boundaries of cyber criminality and foreign interference are being pushed every day. Regular updates must be publicly and periodically published to address recent developments such as the WannaCry attack, the alleged Russian interference in US elections, and how the British government plans on dealing with these developments.

 

Clément Briens is a second year War Studies & History Bachelor’s degree student. His main interests lie in cyber security, counterinsurgency theory, and nuclear proliferation. You can follow him on Twitter @ClementBriens

Image Credits

Banner: https://www.welt.de/politik/ausland/article170410006/Was-die-Regierung-derzeit-macht-ist-ein-einziges-Chaos.html

Image 1: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/567242/national_cyber_security_strategy_2016.pdf

Image 2: http://arenaillustration.com/blog/steve-may-cyber-streetwise-website-billboards/

Image 3: https://wayra.co.uk/gchq/

Image 4: https://joincyberdiscovery.com/

Image 5: https://www.politico.eu/article/why-we-lost-the-brexit-vote-former-uk-prime-minister-david-cameron/

France Must Address its Threats in Cyberspace or Face the Consequences

by

By Clément Briens

Florence Parly, the new French Minister of the Armed Forces, now has the challenge of leading national strategy- where does cyber security situate in her administration’s vision of French security? (Credit: Wikimedia Commons)

 

On the 13th of October, the French Ministry of Defense, led by Florence Parly, Minister of the Armed Forces, published a white paper, the “Strategic Review of Defence and National Security”. It was the Ministry’s first major publication since the 2013 white paper, which quickly had been outdated following recent developments such as the wave of jihadist terrorist attacks on French soil; and the rise of attacks in French cyberspace. While the former is a byproduct of a complex geopolitical issue that existed at the time of the previous white paper, the latter is a relatively new development in French security, e.g. the hack of the pro-presidential party En Marche! ‘s campaign as a prime example.
This article will argue that, while the paper is comprehensive in its evaluation of the underlying nature of cyber warfare and properly provides the essential principles for a national cyber-doctrine, it fails to address current threats to France’s cyber infrastructures and democratic institutions.

Cyberspace as an equalizer

The review acknowledges how cyberspace has become a tool for asymmetrical warfare. It outlines that on one hand, while the proliferation of cyber weapons has spread, nation states have become increasingly vulnerable to the use of such weapons. This dual dynamic effectively levels the playing field between militarily advanced states such as France and sub-state groups.

Furthermore, the white paper establishes that a variety of cyber tools have become widely accessible and distributed in various channels of the dark web. For instance, the proliferation of botnets has given a significant advantage to groups that lack the processing power to conduct large-scale operations. Botnets can be defined as networks of infected computers that contribute processing power to the hacker that infected it.[1] These were used as early as April 2007 by - allegedly Russian - hackers against Estonian infrastructure. They managed to effectively down Estonia’s credit and mobile systems as well as blocking access to government websites.[2]

The paper also acknowledges that France and moreover the EU have become increasingly vulnerable to the use of these cyber weapons. System integration and connection to the Internet has accelerated; energy, healthcare, and transport systems now all rely on vulnerable centralized systems that become targets for foreign hackers.

The problem of attribution

Another issue highlighted by the review is the accessibility to tools that provide anonymity to online users, making attacks extremely hard to trace and subsequently there is a genuine issue as to attributing attacks to specific states or groups. A Virtual Private Network (VPN) and other anonymity tools such as the The Onion Router (TOR) are now freely distributed on the internet, giving users access to military-grade technology for dissimulation of their online identities, as it was originally developed to protect intelligence communications. [3]

This makes nuclear-era principles such as deterrence much harder to implement, as it is now fairly easy for states to mask their attacks by originating them from neighboring countries, or routing their attacks from countries from other parts of the world. While we are now instantly able to detect missile launches from anywhere and determine their trajectory, cyber-attacks are now nearly instantaneous and anonymous.

The equivalence principle

The review puts forward the principle of cyber-physical equivalence, a key principle to the establishment of a national cyber doctrine. The principle states destructive cyber-attacks will be met with an equally destructive response, not necessarily only by cyber means but also by conventional physical means. The review cites Article 51 of the UN Charter on legitimate self-defense to justify this doctrine. [4] This principle can be considered a tool to theoretically deter sub-state actors from attacking France and its allies with impunity, who will now face the threat of law enforcement. However, one may question the ability to democratic states that abide by such international norms to effectively deter authoritarian states such as Russia, China, Iran and North Korea, who supposedly, in Clausewitzian terms, have more powerful means and less political reserve to conduct such operations.

A failure to assess the current threats: what can go wrong?

Hence France’s Ministry of Defense has effectively addressed the main challenges and characteristics of cyber warfare. However the main drawback to this theoretical exercise is the failure to address current threats to France and its Allies. The main identified threat to French cyberspace is foreign interference in its democratic processes, as demonstrated by recent reports concerning possible Russian involvement in the recent American and French elections, or the EU referendum in the UK.[5] [6] [7]

The interference is twofold: the penetration of websites and databases relating to the elections as well as propaganda campaigns on social media.

This interference is especially problematic considering foreign activity targeting President Emmanuel Macron’s own party, En Marche! during his campaign, where hacker groups released thousands of documents from the party on the internet days before the second round of the French elections.

Existence of claimed interference in the French elections has not only manifested itself through the leak that had the clear aim of damaging Macron’s party, but also through a propaganda campaign waged on social media with bot-controlled Twitter accounts to support the leaks. Some of these bots were shown to be retweeting #Macrongate leak-related tweets several thousand times a day. [8] This is a similar method as what was observed on social media during the Brexit referendum.[9]

Despite the challenge of attribution outlined above, Taiwanese cyber security firm Trend Micro claims the attacks originated from APT 28, a group thought to be linked to Russia’s military intelligence unit, the GRU, whereas the French cyber security agency ANSSI acknowledged the attacks but failed to comment on the authors’ identity.[10]

Trend Micro’s report has serious implications for French cyber security. APT 28 had already been linked to attacks on the French-owned TV5 channel in 2015. [11] Nonetheless this time around it seems that the group has vastly escalated in its methods employed and in its ambition to challenge French cybersecurity; hence one may wonder why the review ignores this very real and recurring threat. The degree of direct involvement of the Kremlin in the “hacking” of Western elections through the use of groups such as APT 28 remains unclear, which makes the task of cyber policy formulation understandably even harder.

However, one can refer to Richard C. Clarke’s theory of national cyberspace accountability and obligation to assist, two corollaries of the cyber equivalency principle outlined in the white paper. [12] National cyberspace accountability applied in this case means that France should hold the Russian state accountable for the actions of its citizens, which helps circumvent the problem of exact attribution. Furthermore, a refusal from Moscow to assist French authorities in targeting and shutting down groups such as APT28 would result in increasing suspicion about the Kremlin’s support of such groups. Using these two components to the cyber equivalency principle would have been useful in the context of the review, and would have allowed for more transparency in dealing with the problem of attribution pertaining to the hacking of Western elections.

Conclusion

In any case, this article recommends that public dialogue be initiated concerning the state of cybersecurity in France and that the French Ministry of Defense address the foreign involvement publicly. Without resorting to alarmism, public dialogue is an integral part of a country’s cyber policy, much how it was crucial in the development of a nuclear policy in the US in the 1950’s. This dialogue has been initiated in the US in light of the alleged Russian interference in the latest presidential elections, with wide media coverage and even legal action being made public.[13] The Strategic Review of Defense and National Security was the opportunity for Florence Parly to do so, but the Ministry have fallen short of assessing the threat, informing the public, and formulating coherent policy to counter this threat.

Must foreign groups be allowed to meddle with Western democratic processes with impunity?
And should the French government deal with these issues in secret, or rather initiate broad public dialogue on a national level, and hold states accountable to international norms as they would for kinetic attacks?

 

Clément Briens is a second year War Studies & History Bachelor’s degree student. His main interests lie in cyber security, counterinsurgency theory, and nuclear proliferation.

Notes:

[1] Casserly, Martyn. 2017. “What Is A Botnet? How To Protect Your Devices From The Reaper Malware Threat”. Tech Advisor. http://www.techadvisor.co.uk/feature/security/what-is-botnet-reaper-3666159/.

[2] Davis, Joshua. 2017. “Hackers Take Down The Most Wired Country In Europe”. WIRED. https://www.wired.com/2007/08/ff-estonia/.

[3] Matthews, Lee. 2017. “What Tor Is, And Why You Should Use It To Protect Your Privacy”. Forbes.Com. https://www.forbes.com/sites/leemathews/2017/01/27/what-is-tor-and-why-do-people-use-it/.

[4] “Chapter VII”. 2017. Un.Org. http://www.un.org/en/sections/un-charter/chapter-vii/index.html.

[5] Smith, David, and Jon Swaine. 2017. “Russian Agents Hacked US Voting System Manufacturer Before US Election – Report”. The Guardian. https://www.theguardian.com/technology/2017/jun/05/russia-us-election-hack-voting-system-nsa-report.

[6] Greenberg, Andy, Andrew Selbst, Brian Barrett, Andy Greenberg, Issie Lapowsky, and Garrett Graff. 2017. “NSA Director Confirms That Russia Really Did Hack The French Election”. WIRED. https://www.wired.com/2017/05/nsa-director-confirms-russia-hacked-french-election-infrastructure/.

[7] “Brexit Referendum Website Might Have Been Hacked: UK Lawmakers”. 2017. U.K.. https://uk.reuters.com/article/us-britain-eu-website/brexit-referendum-website-might-have-been-hacked-uk-lawmakers-idUKKBN17E0NS.

[8] Glaser, April. 2017. “Twitter Bots Are Being Weaponized To Spread Information On The French Presidential Campaign Hack”. Recode. https://www.recode.net/2017/5/6/15568582/twitter-bots-macron-french-presidential-candidates-hacked-emails.

[9] Burgess, Matt. 2017. “Here’s The First Evidence Russia Used Twitter To Influence Brexit”. Wired.Co.Uk. http://www.wired.co.uk/article/brexit-russia-influence-twitter-bots-internet-research-agency.

[10] “Macron Campaign Was Target Of Cyber Attacks By Spy-Linked Group”. 2017. U.S.. https://www.reuters.com/article/us-france-election-macron-cyber/macron-campaign-was-target-of-cyber-attacks-by-spy-linked-group-idUSKBN17Q200.

[11] “How France’s TV5 Was Almost Destroyed”. 2017. BBC News. http://www.bbc.co.uk/news/technology-37590375.

[12] Clarke, Richard A., and Robert K. Knake. n.d. Cyber War. Harper Collins p.178

[13] Feldman, Brian. 2017. “DNI Report: High Confidence Russia Interfered With U.S. Election”. Select All. http://nymag.com/selectall/2017/01/report-high-confidence-russia-interfered-with-u-s-election.html.

 

Image Source:

https://upload.wikimedia.org/wikipedia/commons/0/0c/Informal_meeting_of_defence_ministers_%28FAC%29._Arrivals_Florence_Parly_%2836937726031%29.jpg

 

Cyber risks to governance, Part II – The Attribution Game: the challenges and opportunities of cyber attribution in policymaking

by

By Yuji Develle and Jackson Webster:

Hacker

In an era of Snowden, Wikileaks, Dark Web and data breaches there have never been so many cyber risks associated with governance. This article is the second of a 3-part Strife series which examines three diverse aspects of cyber risks to governance. Last week Andreas Haggman began by looking at the online market place Silk Road and its transformation of the online market place. This week, Yuji Develle and Jackson Webster will examine cyber attribution in policymaking, and finally Strife Editor Christy Quinn will examine on the implications of hyper-connectivity.

‘Human lives and the security of the state may depend on ascribing agency to an agent. In the context of computer network intrusions, attribution is commonly seen as one of the most intractable technical problems… as dependent mainly on available forensic evidence.’ ‘Attributing Cyber Attacks’, Prof. Thomas Rid & Ben Buchanan

The question of “Who-done-it?” dominates all efforts from the crime scene to the court of law; a case can only be considered solved when the culprit of the crime has been identified and convicted. In the era of DNA identification and video monitoring, this strict guilty-versus-innocent divide poses little issue in the physical realm where an excellent standard of criminal investigations can be observed in most developed countries.

This vision is nevertheless out of touch with the reality of the attribution process in cyberspace. While forensic evidence can be acquired – ‘Indicators of Compromise’ (IP addresses, domain names, etc.) and unique attack signatures (patterns of behaviours, malware utilised, etc.) – it is extremely difficult for experts to identify any one set of culprits without significant risk. High potential cyber attacks are typically designed to cloak the identities of their designers and are often founded on the basis of deceiving the target from realizing the true extent of the damage incurred until it is too late, often resulting in infection of IT networks without visible effect for months after the network intrusions were made. This lag allows for infections to assimilate themselves into the crowd of Internet traffic before the attack by displaying regularly innocent patterns of behaviour. For example, cyber security firm Fireye’s investigation of Operation Poisoned Hurricane in 2014 detailed how malware trying to infiltrate the networks of several Asia-based internet service providers and other private businesses by disguising itself as routine internet traffic with genuine digital certificates. As the extent of damage of cyber-attacks are unknown, hidden or unforeseen, ‘digital crime scenes’ cannot be investigated in the same vacuum that forensic experts enjoy in the tangible sphere.

The issues of attribution are both what makes cyber such an enticing realm for would-be attackers and such a problematic issue for statesmen. Extending the issues previously detailed into the context of International Relations, it’s easy to see how incorrect attribution can cause a cascade of undue escalation and insult by the accusing party. Tracing a given attack to a server or network of servers within a state does not clearly implicate that state’s government itself as a perpetrator nor does it assume that state is passively complicit or even aware of the attacks being launched. Individuals and small groups are perfectly capable of launching major cyber attacks, as the computer is the ultimate force multiplier, and IP addresses can be easily ‘spoofed’, or bounced endlessly around the globe through proxies to confuse solid attribution.

Many policymakers may be willing to make logical jumps in the attribution process due to its inherent lack of clarity. The lack of certainty surrounding cyber attack attribution allows statesmen to blame geopolitical adversaries for the attacks. No one is standing in the room pointing a smoking gun at the targeted computer. Furthermore, ‘militant’ cyber actors are not necessarily associated with a state, and governments can easily distance themselves from inconveniently uncovered hacking groups they covertly support. For example, were an attack akin to the Shamoon Attacks perpetrated by the Shia-affiliated ‘Cutting Sword of Justice’ on the Saudi state oil firm Aramco in 2012 to happen again, Iran would inevitably be blamed for tacit complicity if not direct involvement, regardless of its actual agency in the attacks themselves. Attribution in this circumstance is not concerned with technical evidence of guilt, but rather with the Saudi government’s foreign policy narrative that Iran is behind all seditious actions in the region, from chemical weapons in Syria to Shi’ite militia atrocities in Iraq, to the Houthi movement in the Yemen.

On the other hand, intentional misattribution -in the form of scapegoating to non-state actors- presents a convenient tool for statesmen in some circumstances. Offence is at a massive advantage in cyber. When securing a network from attack, one must ensure the constant safety of every single system on the defended network. When an attacker attempts to access a target network, only one server or device must be compromised to gain access to a network. The logical threshold for the use of force in cyberspace is thus low. This incentive towards offensive action is amplified by the fact that statesmen can easily pass off responsibility and liability onto non-state actors, such as so-called ‘hacktivists’, from which they can disassociate state intelligence agencies and militaries. ‘Hacktivists’ represent both an easy scapegoat for aggressor states and a convenient culprit for victim states because, as pointed out in a WIRED article pointed out last year, ‘[hacktivists”] geopolitical interests and motives often jibe with a state’s interests.’ Cyber is not simply a revolutionary gimmick to be dealt with by niche experts and private corporations. Just as the airplane quickly went from being invented to being a crucial part of national defence, commerce, and transportation, states are already realising the political utility the Internet provides is now central to the execution of policy. Cyber is both damaging and useful to states’ national interests, but it cannot be ignored, as its uses and effects are clearly set to increase, not decrease.

The unconvincing inaccuracy of cyber attribution has also led to a growing mistrust of the public sector. Some corporate actors have even sought help from private contractors which hire ex-hackers to conduct retaliatory attacks on behalf of those companies. The lack of confidence in the state’s ability to perform its most basic security duties is a threat to the very raison d’être of law enforcement. This phenomenon reduces the state’s ability to control its response in the face of potentially politically damaging cyber attacks. Furthermore, as Thomas Rid coins it, when it comes to conducting investigations as they, unlike private companies, often have the mandate to collect from a wider scope of information, covertly or otherwise. The outsourcing of cyber-security dulls down the credibility and efficiency of a state’s response to cyber-attacks.

Ultimately, attribution is what the actor makes of it. Avoiding ‘attribution fixation’, the obsession of ascribing agency to an actor, will be essential in how successfully governments and companies can use the cyberspace as a means to their ends. It can be a tool for geo-political advancement, a technical obstacle to overcome, or a damaging libel risk for states with active domestic hacking communities. Cyberspace cannot be viewed as a problem, nor as a solution. It is an operational space like any other, though currently popularly misunderstood and lacking the regulations and norms of kinetic battle spaces.

Yuji Develle, is a French and Japanese student reading a B.A. (Hons) War Studies with a strong interest in Cybersecurity and a Russia & CIS regional specialisation.

Jackson Webster, a native of Manhattan Beach, California, is currently studying at the King’s College London Department of War Studies reading a degree in International Relations with a specialisation in the politics of the Middle East and a strong interest in multilateral security practices.