Don’t say stupid things online

It’s been a big week for advocates of online OPSEC. On Monday, a Google employee suffered a high-profile firing after he circulated a ‘manifesto’ railing against Google’s institutional ‘political bias’ against conservatives and the need to have an ‘honest discussion’. Google’s leaders—current and former—have universally taken issue with how consistently incorrect the manifesto is in its core argument (about how women aren’t biologically suited for tech jobs) and how damaging it has been to the company’s reputation and to the team. The fired employee is reportedly seeking any and all ‘legal remedies’; power to you, guy.

The Google anti-diversity memo is a great example of what the Australian Public Service Commission (APSC) was trying to protect against when it provided more detailed guidelines about what the APS Code of Conduct requires when it comes to making public comments, including on social media. Ironically, the APSC’s own communication about not staying stupid things online has become the latest example of poor online communication, and what was intended as guidance has been interpreted as a heavy-handed (and unconstitutional) gag order. Whether the confusion’s due to miscommunication or misrepresentation from the media isn’t clear, but it’s a reminder that confusion quickly escalates to fever pitch well before even the most eager 9-to-5 public servant has had their first coffee. And if it’s that hard to communicate guidelines on social media use, it might be impossible to raise cyber hygiene awareness (PDF) and practices.

Stop worrying and love AI

Two Tencent chatbots have been taken offline for revision after they provided politically inflammatory responses to queries about the Communist Party, insulting the party as ‘corrupt and useless’. The shutdown comes shortly after an (overblown) wave of concern about Facebook chatbots ‘inventing their own language’. The two stories seem to be being picked up as the ‘patient zero’ case studies for FUD (fear, uncertainty and doubt) about impending AI doom.

New South Wales is pushing ahead with autonomous vehicles anyway, greenlighting a program for a two-year trial program at Sydney Olympic Park. The trial will be going at a snail’s pace, though—the vehicles won’t be allowed to exceed 10 kilometres an hour along a closed-off road. Fingers crossed it all doesn’t go the way Tesla went at this year’s DEF CON.

The US Army has taken a far more cautious (but seriously belated) approach to semi-autonomous vehicles, issuing a memo mandating that all service members cease use of DJI drones, software applications, and other equipment.

Sharing is caring

The Australian Signals Directorate will be sharing threat intelligence with telcos and internet service providers, to help them provide, in turn, cost-effective cyber-security services for small to medium enterprises. This directly addresses the vulnerability to hacking of small and medium enterprises, which have been identified by both the government and the opposition as being sorely in need of protection, but without necessarily having the resources or expertise to protect themselves. Weirdly, however, this initiative ignores anti-virus and security software vendors—the companies that are perhaps best placed to immediately use this data to protect customers.

In similar research, Telstra has launched the Australian Digital Inclusion Index 2017, which has surveyed digital access disparities between socioeconomic classes and found that Australia’s getting better at digital inclusion, which could translate into better cyber-security outcomes for Australia. (For the final word on that, keep your eyes peeled for the latest edition of ASPI’s cyber maturity report later this year.)

The federal government has announced that it’ll be building a single ‘super logon’ to consolidate across the dog’s breakfast of government accounts, which currently saddles users with managing 10 to 30 accounts. It’s not clear from that exclusive interview whether the initiative is the same one as the ‘GovPass’ and ‘Tell Us Once’ initiatives announced in the 2017 budget. It’d be ironic if there were two separate programs under development to consolidate logins and accounts.

Regardless, work on GovPass continues unabated, and Airtasker, Travelex, Credit Union Australia and the Queensland Police Service have signed up for AusPost’s Digital ID service, which is currently serving as a pilot program for later reconciliation with the wider GovPass program. Gavin Slater, the CEO of the Digital Transformation Agency, which is managing the GovPass program, has announced that he’s been working to repair relationships with government agencies, after the then Digital Transformation Office became too ‘disruptive’ for the APS’s tastes.

The Australian Digital Health Agency published Australia’s National Digital Health Strategy (PDF) and outlined an action plan to make sure all Australians have a My Health record by 2018. The aim is to improve the protection of healthcare data and interoperability between healthcare organisations. However, privacy activists are concerned that the consolidated health data will present an increased privacy risk, which is why it’s a good thing that the agency will be establishing a Digital Health Cyber Security Centre to make sure Australia’s health data security is at the cutting edge of international best practice.

Open data dashboards tied up with strings

Open data dashboards have been popping up like daisies this week. The Alliance for Securing Democracy has launched a new online dashboard, Hamilton 68, tracking bot networks and troll accounts linked (after three years of observing) with Russian influence operations on Twitter. The top hashtag used by these accounts was MAGA, or Make America Great Again, the campaign slogan of US President Donald Trump. As with most social media analysis projects, the transparency of the methodology has been criticised.

Black hats, white hats, and cyber diplomats

US ‘cyber-diplomat’ Christopher Painter has signed off, writing a parting note on Medium about the continuing importance of diplomacy in cyberspace. Even after working for 26 years in this (highly depressing) space, he’s reportedly still passionate, calling cyber ‘the new black’.

Famed ‘hero’ and supposedly white-hat hacker @MalwareTechBlog, aka Marcus Hutchins, was arrested at Las Vegas Airport shortly after Black Hat and DEF CON 2017. The FBI has accused Hutchins of creating, distributing and updating ‘Kronos’ (the banking trojan that was designed to infect computers and grab online banking credentials for profit) in 2014 and 2015. Hutchins has ponied up US$30,000 in bail, and is set to face a Nevada court on 14 August.

While the Australian Government’s Cyber Security Strategy contains many good initiatives, the government’s narrative needs to evolve to account for inevitable failures. Current government rhetoric is decidedly inconsistent: cyber espionage is alive and well, yet at the same time the data of the Australian people is safe and secure.

The Prime Minister has spoken about the importance of meaningful conversations about cybersecurity, but that narrative clearly has some internal inconsistencies and isn’t a realistic or nuanced message. As the Australian Public Service, business and the broader community raise their levels of cyber sophistication, we need to continually reframe government communications to push real cyber resilience.

Services delivered over the internet are exposed to several interesting asymmetries that all but guarantee that there’ll be cybersecurity failures of consequence. Imagine a hypothetical government IT project (let’s call it ‘Project ORCA’) that aims to provide a perfectly secure government portal to deliver vital services to the Australian public.

Our first asymmetry is that the teams building online services have only finite time to deliver their products. This is a good thing, as we want IT projects to be delivered, and infinite timelines aren’t helpful (even though that can feel like standard practice in government at times).

By contrast, malicious actors (baddies and hackers) on the internet are not time bound; their time horizon is effectively infinite. ORCA, for example, while built over a relatively short time, will be exposed to attack for the rest of its working life—which may possibly run from years to even decades. A successful attack on ORCA can be damaging to the government at any time throughout its life.

Second, teams building online services have limited skills and capabilities. The Project ORCA team is limited to the pool of skills available within the team. The very best we can hope for is that it implements the best possible solution at that point in time. But even this best-case scenario isn’t good enough.

Malicious actors can not only access the state of the art at the time when ORCA is built, but are also able to use new vulnerabilities that are discovered after the service has been delivered. In a very real sense, the Project ORCA team is trying to defeat hackers from the future!

Third, the ORCA team is focused on delivering what it uniquely adds to and builds upon the best frameworks and architectures available at the time.

Malicious actors, however, can attack not only what the ORCA team builds directly, but all the software and hardware that ORCA relies on and is connected to. The Project ORCA team can deliver its project perfectly, but the security of ORCA overall can still be undermined by factors outside the team’s control. In recent years, for example, there have been several very severe bugs that have affected internet services in totally unexpected ways, and Project ORCA can’t mitigate that class of threats.

Although this sounds pessimistic, this is broadly understood in private industry; breaches are common and inevitable, and there’s a very real focus on resilience and recovery. The cyber-mettle of an organisation isn’t measured by whether the organisation suffers a compromise, but by how quickly the compromise is discovered, how well it’s contained, and how effectively it’s cleaned up.

Government’s current narrative is focused on implementing the ‘Essential Eight’. These are the eight highest priority actions from the Australian Signals Directorate’s Strategies to Mitigate Cyber Security Incidents that help prevent cybersecurity breaches. The Essential Eight grew out of what were initially branded the ‘Top Four’, and when implemented will prevent a large majority of cyber intrusions that the ASD currently sees.

Even when these strategies are implemented, however, they are still only mitigation strategies. That is, they make things less bad than they were before. They aren’t a guarantee that security is perfect; they are just the first steps to take when your security baseline is very bad.

Real security doesn’t consist of implementing the ASD’s Top Four mitigations, and then a year or two later expanding that to the Essential Eight. Real security is the ongoing work that arises from an acceptance that failure is inevitable: understanding your network; detecting and investigating anomalies; patching, monitoring and alerting; clean-up, backup and disaster recovery.

The Prime Minister has spoken about the importance of meaningful conversations about cybersecurity events. But by denying the scope of the problem our political leaders are preventing the meaningful conversations that they desire and lulling us into a false sense of security. The conversation needs to change to account for the inevitability of failure.

Since 2015 Australia—partnering with Switzerland—has built support among 36 countries to address concerns about military and police forces’ interest in the use of highly toxic chemicals, such as anaesthetic and sedative agents, as weapons for law enforcement. This is a great achievement on an issue first brought forward by the International Committee of the Red Cross (ICRC) in 2003, and on which there has been scant multilateral progress. Particularly so given that in recent years the Organisation for the Prohibition of Chemical Weapons has been focused on efforts to dismantle Syria’s chemical weapons and put a halt to the repeated use of chemical weapons in Syria and Iraq.

This development signals two important characteristics of Australia’s approach: a willingness to tackle threats to international law and civilian protection, even where there are significant differences in viewpoints among countries; and an ability to remain attentive to emerging risks, even while embroiled in an ongoing crisis.

Such international leadership is urgently needed in other areas where science and technology collide with international law and humanitarian concerns.

The ICRC, for its part, has always pressed for a realistic assessment of new technologies of warfare to ensure they are not employed prematurely if respect for the law cannot be guaranteed. And so I’m pleased to be in Australia this week to take part in the Symposium on the Ethical, Legal and Social Implications of Emerging Military Technologies at Melbourne Law School.

At the UN, efforts to address the implications of increasing autonomy in weapon systems have moved forward slowly. General agreement among States that ‘views on appropriate human involvement with regard to lethal force and the issue of delegation of its use are of critical importance’ has been an important outcome of three, week-long, informal discussions at the Convention on Certain Conventional Weapons (CCW). However, this work now needs to step up a gear.

Here there are opportunities for constructive proposals—based on states’ obligation to uphold international humanitarian law (IHL) and minimise risks to civilians and to combatants no longer taking part in hostilities.

Australia’s efforts to promote better implementation of the legal obligation, and policy necessity, for countries to conduct national legal reviews of new weapons prior to their acquisition or use, are very welcome. It’s something the ICRC has long advocated. However the ICRC believes there is a critical need to achieve an understanding at the international level on how to ensure that humans remain in control of weapon systems and the use of force while making the necessary legal decisions on targeting in armed conflict.

What’s needed now is state-driven work by the newly established CCW Group of Government Experts to start answering the difficult questions. Recognising the critical importance of human ‘involvement’, ‘control’ and ‘judgement’ in the use of force in armed conflict, the ICRC has suggested that states now determine the type and degree of human control necessary to ensure compliance with IHL, and ethical acceptability. Switzerland’s IHL ‘compliance based’ approach has gained significant support, in particular from Brazil, Chile, Finland, Netherlands, Republic of Korea, South Africa, and Sweden, at the CCW Review Conference in December 2016. Here again, Australia might consider the benefits of joining Switzerland and other concerned States.

Similar arguments for foresight and unity could be made for international debates about other new technologies of warfare. Recently, discussions about robotic weapon systems that are not autonomous but remain remote controlled have focussed on transparency in armed drone operations. With the rapid proliferation of military drones to over 90 countries, and non-State armed groups starting to employ improvised versions, the implications for IHL compliance and humanitarian consequences could evolve considerably. Could a move towards reliance on robotic weapon systems on land lead to new risks for civilian populations?

Elsewhere, international discussions on cyber warfare—notably through another UN GGE, which Australia chaired from 2012-13—have been considering the applicability of international law in cyberspace.  Australia has stressed the importance of ‘elaboration of how international law applies to states’ behaviour in cyberspace especially in non-conflict situations.’

Nevertheless, there is also a need to consider the potential humanitarian consequences of the use of cyber weapons in armed conflict and constraints that may be needed in future on cyber weapons development, acquisition and use. Some ideas are also emerging from industry, for example Microsoft’s recent proposal for a ‘Digital Geneva Convention’ for peacetime, which might influence the debate in situations of armed conflict.

The risks from weapons targeting space systems are also of increasing concern. Although the recurring UN General Assembly Resolution on the prevention of an arms race in outer space has almost universal support, there are different views among major powers on the means of prevention. Given these realities, Australia has called for greater focus on voluntary transparency and confidence building measures.

From the ICRC’s perspective, the ever-increasing military attention to the contested domains of cyber and outer space, and the reliance of civilian infrastructure and services on these interconnected networks, bring with them a particular need to consider the potential humanitarian consequences.

There’s much work to do.  Australia—with its government, think-tank, and academic expertise—is well placed to play a greater role.

The fallout from the WannaCry ransomware incident continued this week. ShadowBrokers, who released the Eternal Blue exploit used by the WannaCry ransomware, have announced a new program where members will gain access to new vulnerabilities and tools, as well as information supposedly stolen from Iranian, Chinese and North Korean missile programs. While ShadowBrokers have been linked to Russian intelligence services, it’s noteworthy that Russia itself was significantly affected by the incident. As expected, additional uses of the EternalBlue exploit have been uncovered, including to install software that mines the cryptocurrency Monero.

Speculation over whether the Hermit Kingdom is behind WannaCry has also continued this week. Cybersecurity firm Symantec’s Security Response team have released further evidence which they claim more closely ties WannaCry to the North Korean-linked Lazarus Group of hackers. Symantec notes that similarities in the tools used in last week’s attack link the ransomware to the tools used in other cyber incidents linked to North Korea—including the 2014 Sony hack and last year’s attack on Bangladesh’s Central bank. However, the difference between previous incidents and WannaCry is the nature of the malware’s autonomous propagation through networks using the EternalBlue exploit, whereas previous Lazarus Group linked malware required greater intervention by the hackers, limiting the extent of its spread.

WannaCry has also focused international attention on North Korea’s cyber capabilities. Jim Lewis from CSIS noted that the Sony hack marked a steep change in the nature of North Korean cyber espionage and hacking activity. Lewis notes that before Sony North Korea focused on espionage and harassment of South Korean political targets, but afterwards they’ve increasingly used their skills for criminal activity to generate hard currency for the regime.

Various North Korean People’s Army units have been identified as being involved in cyber operations, but Unit 180 in the Reconnaissance General Bureau has been most closely linked to WannaCry. Greg Austin from UNSW told a seminar in Canberra last week that over 6,000 North Koreans are involved in various aspects of cyber operations including disrupting the South’s military critical infrastructure and command and control systems. And over at the UN, the North Korean Sanctions Committee has warned members to be alert to North Korean hacking after one of its panel of experts was hacked. The warning ominously noted that the hackers had gained ‘very detailed insight’ into the work of the committee.

Another infamous hacking group—variously known as APT3, Gothic Panda and UPS—has been linked to the Chinese Ministry of State Security (MSS) in a blog published by Intrusion Truth, an anonymous cybersecurity blogging group. The post notes the links between two directors of the Guangzhou Boyu Information Technology Group (Boyusec), and the domains used by APT3 for their activities. Boyusec is also linked with Chinese technology firm Huawei, and the US Defense Department reportedly noted in an internal investigation in 2016 that Boyusec and Huawei had been cooperating to develop products with “backdoors” installed to enable future espionage activity. Intrusion Truth believes that Boyusec is contracted to MSS through various intermediary state organs, keeping with that agency’s  conventional intelligence collection methods by utilising  commercial organisations as cover for intelligence collection. APT3 has previously been linked with cyber operations targeting both the US and Hong Kong.

Closer to home, the Australian government has agreed to work with the Information Commissioner to develop a privacy code for Commonwealth agencies. Back in March, Commissioner Tim Pilgrim requested that the new code be developed, spurred by the fact that significant bungles including #censusfail and data breaches from the Health Department and Public Service Commission had the potential to significantly undermine public trust in the government’s ability to manage data appropriately. The code will be implemented in 2018.

Also in Canberra, in an attempt to improve their own skills and attract more tech-savvy people, teams of government cybersecurity personnel will take part in a cyber ‘war game’ this September, hosted by the Department of Human Services. The teams will work on a cyber test range to defend Lego models of trains, bridges and towns.

AFP Commissioner Andrew Colvin revealed last week that an AFP officer had, in the course of an investigation, accessed the call record metadata of a journalist without a warrant, putting the error down to poor processes within the AFP. While much of the data retained under the scheme can been accessed by Australian law enforcement agencies without a warrant, data on journalists is specifically exempt. The incident comes only two weeks after the controversial legislation came into force, and has added more fuel to the fire for privacy advocates. Guardian Australia journalist Paul Farrell has called the incident a ‘systemic, structural failure of the AFP’s internal policies’, and Electronic Frontiers Australia has renewed its push for a universal warrant requirement for metadata access. While the affected journalist hasn’t been told that their data was inappropriately accessed and no action has been taken against the officer, the Commonwealth Ombudsman will now conduct their own inquiry to the incident. On the same day news broke about the AFP’s bungle, UNESCO released a report Protecting Journalism Sources in the Digital Age, which notes the ‘chilling’ effect of data retention schemes, undermining public access to information, the democratic role of the media and journalistic quality.

Last Thursday marked the 10th anniversary of the 2007 cyber attack on Estonia. The three-week spat, sparked when Estonian authorities moved a Russian war memorial, resulted in a massive and coordinated campaign of cyber operations that severely disrupted the highly-connected Baltic state. In the decade since, Estonia has championed norms of responsible behavior in cyberspace, including the Tallinn Manual, and it hosts NATO’s Cooperative Cyber Defence Centre of Excellence (CCDCoE). To mark the anniversary, CCDCoE hosted NATO’s annual cyber exercise, Exercise Locked Shields, where 25 countries fought to defend themselves from a major cyber attack on military assets. Australia’s foreign minister Julie Bishop observed part of the exercise, and has indicated that Australia may join future iterations.

The 2007 attacks on Estonia have been widely attributed to Russia, and Russians remained a key issue for cyber security across Europe this week. In France evidence has emerged that Russian hacking group APT28 (aka Fuzzy Bear), also responsible for hacking the DNC last year, have been targeting centrist candidate and current frontrunner Emmanuel Macron’s campaign team since January, trying to steal email credentials. It’s also been revealed that GCHQ has been placed at a higher state of readiness to respond to cyber threats to the forthcoming general election, forming surge teams to respond to potential cyber incidents affecting the election.

Denmark’s Centre for Cyber Security has released a report into hacking incidents that targeted the Danish defence and foreign ministries in 2015 and 2016. While the report doesn’t attribute the activities to a country, it does brand APT28 as the likely culprit. The Danish defence minister later told a national newspaper that Russia was behind the incident. And the International Olympic Committee has announced a new Digital and Technology Commission charged with strengthening the organisations cyber security. The new commission comes several months after the World Anti-Doping Agency claimed it was hacked by APT28.

While the weekend marked President Trump’s first 100 days in office, concerns remain about the role of fake news in the 2016 US election. Facebook has released a report into information operations conducted through the social network to spread misinformation, noting that they will increase their monitoring of suspicious activity in order to reduce the spread of fake news.

Also in the US, CSIS hosted a panel last week on the effects of significant cyber security breaches in the US. The panelists, including former Cyber Czar Michael Daniel and CrowdStrike’s Dmitri Alperovitch, discussed the apparent futility of existing defences, the link between foreign policy and cyber security, and the need to be more forthcoming when attributing cyber incidents.

And in brief news this week, South Australia has followed NSW’s lead by appointing its first state government Chief Information Security Officer. David Goodman, currently the SA government’s cyber risk director has been appointed to develop and deliver a new government cyber security strategy. British police have charged a man who allegedly provided information to Islamic State on the use of encryption and ToR to hide their activities, including producing instructional videos. And Rwanda has passed a law to establish a National Cyber Security Authority—hats off to them!