Tag Archive for: cyber security

US–China cyber relations: not a new Cold War

Cold War One - IMG_4192Describing cyber activities by the US and China as a new Cold War in cyberspace is hyperbolic and inaccurate. The relationship between the US and China and the international environment for this relationship are very different from the Cold War, when relations and contacts with the Soviet Union were extremely limited and there was no economic interdependence or interconnection. There have been none of the threats, ideological challenges or proxy conflicts that characterised the Cold War.

The US has sought to avoid a military focus in its cybersecurity efforts. It has cast China’s cyber espionage as a commercial matter (Treasury Secretary Lew has told China’s President that cyberattacks are ‘a very serious threat to our economic interests’). For example, the US indictments of People’s Liberation Army officers for cyber espionage focused intentionally on trade and economic crimes to avoid any implication that this was a military contest.

China has never used ‘force’ (defined as acts of violence) against the US in cyberspace; it will use cyberattack against US military forces in any clash, but espionage isn’t war—if it were grounds for war, the US would find itself at war with many countries. Both China and the US have implicitly avoided truly damaging attacks or military confrontation in cyberspace, each restricting its activities to espionage. Espionage isn’t a crime under international law, and it’s not in the US interest to make it so. Dealing with China’s cyber espionage requires a sustained effort to construct norms and persuade China to observe them, to create consequences for Chinese actions, and to improve cyber defences in the interim. Read more

Cyber wrap

blue boardLast week the government launched the third update to its cloud computing policy. In what’s being dubbed the ‘Cloud First’ policy, agencies and departments are now required to first consider cloud computing before traditional storage and networking. But it comes with the caveat that it must meet the agency’s IT requirements, provide adequate data protection and remain cost effective.

The announcement is set to please Microsoft, which last week had its Azure cloud service approved by the ASD’s Industry Security Registered Assessors Program. Azure is the first public cloud service to successfully pass the assessment.

Others are less pleased, arguing that ‘Cloud First’ policy lacks clear centralised leadership and specific targets, and without increased budgetary funding will fail. Only time will tell how well the new strategy is taken up.

President Obama has devised a solution to his own cyber policy woes according to White House cyber czar Michael Daniel. In an attempt to pass its latest batch of cyber security legislation through a hostile Congress, the Administration will now seek to break the bill into smaller pieces, allowing the passage of specific proposals that already have bipartisan support. Read more

Cyber wrap

As tensions rise on the streets of Ferguson, Missouri over the shooting of Michael Brown, activists have taken their protests to the cyber sphere in a variety of ways. News reports have linked ‘hacktivist’ group Anonymous with a distributed denial of service (DDoS) attack on the websites and email servers of the town’s administrators which also took down the IP phone system and left most of the city’s government officials working via text message. The attack was executed following a video post by the group on YouTube that threatened to take down ‘every web-based asset of your departments and governments offline’. The group also released personal information of members of the Ferguson Police Department.

In his recent speech at the University of Canberra, Major General Stephen Day expressed concerns that state governments’ safeguards against computed-based attacks were ‘patchy and variable’, an issue he associated with a lack of depth in the understanding of the threat at the upper echelons of the state government system. MAJGEN Day, who heads up the Cyber Security Operations Centre in the Australian Signals Directorate, noted that at this level, a change of minister or senior bureaucrat ‘can have an extraordinary impact on the understanding in a state government in terms of the cyber threat.’ Read more

Cyber wrap

Iron Dome battery in Ashkelon

With this week marking 100 years since the start of World War I, the Australian Army’s release of its Future Land Warfare 2014 report (PDF) is a timely consideration of what war means in the 21st century and where we might see it develop. Cyber issues feature heavily, from developing Army’s cyber capabilities, to leveraging omnipresent communications technologies, and appreciating the interconnectedness of the cyber commons with those of sea, land, air, space and electromagnetic spectrum. The report foresees a future where social media, like Facebook and Twitter, will be ‘widespread and accessible to both friend and foe, potentially allowing any individual to influence political outcomes, transform perceptions of events, and create positive or negative responses’.

Still with Army, this quarter’s Australian Army Journal carries an article by Captain Nathan Mark in which he makes the case for cyber forensic investigative capabilities to support indigenous forces. The full piece is available here (PDF). Read more

Cyber wrap

Cyber policy was on the table at the 5th Japan–Australia 2+2 Foreign and Defence Ministerial Consultations in Tokyo last week. Building on Tony Abbott’s April commitment to hold a bilateral cyber dialogue, the consultation established that Canberra would host the inaugural event before the year’s end. The dialogue will explore common cyber threats and look to strengthen cooperation at the regional and international levels. This news comes on the back of a $400,000 cash injection from Japan and the US to the Association of Southeast Asian Nations (ASEAN), which will go toward developing ASEAN’s cybercrime investigative capacities.

Stateside, the net neutrality saga rages on. Last month, the Federal Communications Commission (FCC) proposed a new set of rules to maintain net neutrality, which confusingly seem to allow the ‘pay-for-priority deals’ that are newly being investigated. This week it has launched an investigation into recent deals between entertainment companies and Internet Service Providers (ISPs) to determine if they undermine the principle of net neutrality (whereby web traffic is treated equally by ISPs). The practice of content providers like Netflix agreeing to pay ISPs like Verizon and Comcast to guarantee faster delivery of their products has critics concerned that the Net will be divided into fast and slow lanes according to who can pay what, and that risks stifling competition from start-ups. US Congress have become involved in the issue overnight, with the Democrats introducing a bill requiring the FCC to use whatever authority it deems necessary to stop ‘paid prioritization agreements’. Read more

Cyber wrap

Big numbers splatter the headlines as cybercrime owns the front page for a third straight week. Estimates of the global losses attributable to cybercrime range between $575 billion and a more conservative $375 billion, while the latest report by McAfee and CSIS settles at $400 billion—around the GDP of Austria.

The report, Net Losses: Estimating the Global Cost of Cybercrime (PDF), notes the difficultly in accurately estimating a figure for certain types of online crime, but the trend is clear. As more businesses move online the figure, and the impact of cybercrime on the performance of private industry and the strength of national economies is set to increase. The paper also outlines how cybercrime is damaging export growth with the knock-on effect of speeding up job losses; some reports put this at around 20,000 positions in the United States alone. In the end, the one undeniable conclusion is that cybercrime certainly is a ‘growth industry’. Read more

Cyber wrap

First up, a haiku on the Internet from the New York Times haiku generator:

The Internet is // emotionally a very // flat experience.

Many Turkish citizens would agree with that sentiment this week as they found YouTube access blocked for reasons of ‘national security’—after Twitter had been blocked the week before. Prime Minister Recep Tayyip Erdoğan ordered a clamp down on the social media sites after a leaked audio file showed Turkish government and military leaders discussing a military strike on Syria. The PM has also been fighting off corruption charges that surfaced on those platforms. The ban on YouTube was made days before municipal elections, which Erdoğan’s party won comfortably. Read more

Cyber wrap

This week saw the long-awaited release of US President Obama’s Framework for Improving Critical Infrastructure Cybersecurity after a year of concentrated effort by the National Institute of Standards and Technology (NIST). The document has been heralded as a step in the right direction; the White House is seeking to motivate private sector uptake by framing these standards as means to support profit. Despite a lack of Congress support, it may also become ‘the de facto standard for private sector cyber security in the eyes of US lawyers and regulators’. The NIST also released an accompanying Roadmap document that will guide the future of the framework, detailing cybersecurity development, alignment and collaboration planning.

Over in Beijing, internet freedom was on the agenda when US Secretary of State John Kerry met with Chinese bloggers over the weekend. The bloggers appealed to Secretary Kerry to help ‘tear down the great internet firewall’ in a discussion that also touched on human rights issues. In contrast, China’s leadership labelled Kerry’s expression of support of internet freedom ‘naive’. Read more

2013 review – the year in cybsecurity

International cyber policy centre logo2013 was a significant year in cyberspace, both internationally and closer to home. Whilst the Edward Snowden leaks dominated the headlines, several important agreements and policy achievements were made further away from the glare of the media spotlight.

Beginning back in January, then Prime Minister Julia Gillard announced the creation of the Australian Cyber Security Centre (ACSC). The centre intends to co-locate government operational cyber security assets from DIO, ASD, ASIO, CERT, AGD, the AFP and the ACC whilst working closely with the private sector. The centre still ‘intends’ to achieve these goals as it’s yet to become operational. This is due to a number of factors, not least of all that its new home, the ASIO building, isn’t ready for occupancy.

Read more

Reader response: government and cybersecurity – how big a role?

I’m glad to see Klee Aiken offer his thoughts on cybersecurity, and I share his suspicion of intrusive surveillance. But it’s for this very reason that I’m raising alternative uses of ‘big data’, and I fear Klee’s assessment of the potential role for government neglects several key issues.

To begin with, I’m not particularly confident the private sector will prove capable of protecting their own systems as cyber security becomes more burdensome. I’d welcome Klee’s input on this point, but I see a classic example of market failure behind industry’s lagging response to the system-wide costs inflicted by malware. After all, the US government has been announcing plans to foster more security-conscious behaviour since 2003, and yet they’re still waiting for any meaningful changes which can keep pace with new dangers.

Read more