Posts Tagged ‘Internet’

h1

SBU claims Ukrainian State IT systems received 247 cyber attacks in 2016

December 23, 2016

According to the SBU, Ukrainian State information systems were subjected to 247 cyber attacks during 2016 (which is 2 weeks from ending at the time of writing – so there will be more before the year is through).  As a result 64 criminal proceedings are apparently under way – “proceedings” however is not defined as being arrests, or charged, or convicted.

As it appears only 64 instances have resulted in criminal proceedings with 5 convictions and 4 “wanted” circulations, it may be “proceedings” amounts to little more than “under investigation”.

Thus according to the SBU, if allocating 1 attack per day, 2 of every 3 days witnessed Ukrainian State IT systems under cyber attack throughout the entirety of 2016.  Naturally that is not how matters occurred on such an evenly spaced timeline – neither does it account for the cyber ops that are and have been on-going undetected daily for months, or perhaps years, against the Ukrainian State.

Were there peaks and troughs in cyber attacks?  Did those peaks and troughs align to peaks and troughs of Ukrainian allies?  If there is any correlation does that provide some form of guide to the capabilities of hostile cyber foes?

cyber

Nevertheless 247 is the number of cyber attacks the SBU states the Ukraine State IT system has been subjected to.

It is however unclear what classification of cyber attacks have occurred and in what number under any sub-classifications of cyber attack.  Such attacks may vary from DDoS, to data hacks, to actually taking control of the systems themselves.

Further the SBU is not the only Ukrainian institution charged with looking after and monitoring cyber naughtiness to which Ukraine is subjected.   The Ministry of Interior also has a very similar statutory  obligation.  There is then the State Service for Special Communications and Information Protection, notwithstanding the Ukrainian Computer Emergency Response Team.

Quite whether each would measure and/or count the cyber attacks to which the Ukrainian State IT systems have been subjected to in the same way as the SBU is unknown.  Are the definitions the same?  Is the ability to monitor (and prevent/mitigate) such attacks the same?  Which is the lead agency?  Is there a lead agency?

Of the 247 attacks, which have been attributed and to whom?  Specifically what was the attack?  State (and/or State infrastructure)?  Business (State Owned Enterprises)?  Banking (State owned banks and/or the NBU)?  Others?

What damage was done?  What losses were incurred?  What was stolen?  Has the “how” been shared with allies and/or applicable regional/international treaty bound institutions?

How many can be publicly attributed to Russia and/or the known Russian proxies?  If they could be attributed, were they?  (Just because they can be, for either political and/or operational reasons they may not be.)

How many can be publicly attributed to organised crime – both that interconnected with Russia, that of domestic origin, and also others?

How many can be publicly attributed to those that are neither State actors (or known State associated actors), or organised (criminal) groups, but that are simply lone actors with either criminal intent or a curiosity that defies legal boundaries?

What is behind the SBU numbers?  Are the numbers of the other statutory monitoring agencies similar to those of the SBU?  If not, what are the discrepancies and where and why do they exist?

h1

The Reflex(ive Control)

November 6, 2016

Having just engaged in a chat over “old school” issues, today’s entry will be retro too – for it seems what is retro to this blog remains (unbelievably) a new discovery to others in this information age.

Do any readers remember Duran Duran?  (It’s OK to admit it.)

How about a song called The Reflex?

“Oh the reflex what a game, he’s hiding all the cards
The reflex is in charge of finding treasure in the dark
And watching over lucky clover, isn’t that bizarre?
Every little thing the reflex does leaves you answered with a question mark”

If that was not contemporary commentary through art then – perhaps it is now.

Whilst regressing a reader’s memory, there may be a few among that number who recall the launch of a Russian journal called “Reflexive Processes and Control” (launched around 2001).

It was not a journal for scientists simply producing material on a fringe issue to swallow Russian governmental funding.  It was a journal with a heavyweight editorial council (not editorial board).  That editorial council contained members of the diplomatic corps, the Russian Federation Security Council and FAPSI (the federal agency for government communications).  The subject was also far from a fringe subject within Kremlin thinking.

Certainly the “Cold War Warriors” on either side of the trenches are well aware of Reflexive Control.  Even if recollections may occasionally be faded and/or tinted with a hint of nostalgia (among other failings), what is witnessed today cannot help but give cause to reminisce.

The Soviet Union began to experiment with the concept of Reflexive Control in the late 1960s – albeit a concept that took a while to gain traction within both military and government.  Eventually however traction was found in both military and civil quarters.  For those readers wishing to delve further into its proponents during development, on the military side the names Druzhinin, Ionov and Leonenko would be a suitable starting point.  On the civil/governance side then Schedrovitsky, Lepsky, Burkov and Lefebvre were prominent.

Data digital flow

A reader will rightly deduce that Reflexive Control therefore has both military and civil uses.  It also has both human and computer uses – for the objective of Reflexive Control is to influence decision making.  That in the contemporary world can be human decision making or that of AI.

A reader may also note a distinctive difference between western framing and perception management and that of Reflexive Control.  As the name suggests Reflexive Control seeks to control rather than manage perceptions and decision making.

Reflexive Control, at its most basic, is a process where one party seeks to transmit, predominantly by means of maskerovka and disinformation, a line of reasoning and/or logic that effects another party’s decision making – thus allowing the possibility for the first party to control the decision making process of the second party.

That control does not necessarily mean that the first party can control the second party sufficiently into making “decision x”, but that control may designed to interfere with the decision making process so as to avoid “decision x” being made.  (Thus it is sometimes a matter of insuring the other side makes decisions that insure they do not win, even if we can’t win).

Staying clear of the battlefield tactical military uses of Reflexive Control, and also regarding its abilities to interfere with relation to AI decision processing, a reader perhaps now ponders Reflexive Control within the parameters and framework of social media and MSM for example.

If Reflexive Control within this arena relies upon the ability to best predict the thoughts and behaviour of “the other side” then psyops and maskerovka within the Reflexive Control matrix become clear.

In the 1990’s distraction, information overload (sending huge amounts of often contradictory information), paralysis, exhaustion, division, deception, pacification, deterrence, provocation, suggestion and pressure had all been identified as the core intellectual pieces in an effective Reflexive Control operation in the information warfare arena by Russia – numerous public articles stated as much.

Thus what is seen today is nothing new and not an innovation that should have caught anybody by surprise by way of methodology employed.

The current Kremlin trend of providing an incomplete or erroneous interpretation of events and attempting to pass it on to both a western and domestic audience is not new.

Attempts to create a goal for the other party in which they act favourably to The Kremlin narrative (for example attempts to entice the US into a joint mission in Syria) are not new.

Feigning weakness to create a different narrative is not new (fortress Russia surrounded by NATO, when geography simply discounts the possibility to surround Russia).

The setting of the stage to imply to the other side one course of action and then carrying out another is not new.  (For example the Minsk process or the “Syrian withdrawal”, or the prima facie aim of supporting Mr Trump – which has less to do with Mr Trump winning and much more to do with the lasting undermining the US political system across the political board.  In fact, should Mr Trump win and prove to be far less destructive to US interests as some fear/expect, perhaps a GOP and/or Trump email/kompromat dump would follow if destabilising and undermining the system is the operational goal. .)

The projection of a false self-perception and/or decision making process for the digestion of the “other” – and accepting the increased risks this may have – is not new.

The control by a third party over a bilateral party and/or proxy (be they attributable or plausibly deniable) did not end with the Cold War within the FSU geography or internally of Russia itself – what goes on today is also not new.

Eventually the term Reflexive Control will return to mainstream discourse – though it is not new.

If and when it does, should Duran Duran re-release “The Reflex”, for younger readers, that too is not new!

 

l

h1

The CyberJunta hack – How will the populists respond?

October 24, 2016

CyberJunta, one of the Ukrainian hacking groups has apparently (and unsurprisingly) targeted Vladislav Surkov and an email address v14691@yandex.ru purported to be used by him under the pseudonym Nikolay Pavlov.

Also compromised was an email address of a Surkov associate/underling pabnik@yandex.ru used by Pavel Karpov.

Within the documents thus far released in two pdf files file-1 and file-2 – 17.4 MB in total (with more to come undoubtedly) it has to be said there are absolutely no surprises when it comes to the tactics and instruments to be used in undermining Ukraine beyond the occupied Donbas.

Neither would the suggested time frame between November 2016 to March 2017 for implementation of destabilisation within Ukraine come as a surprise to many.  Events both external and internal of Ukraine would dictate this period as being optimal.

Clearly fermenting social unrest during the heating season when tariffs have risen so sharply requires little tactical thinking within the Kremlin when Ms Tymoshenko long-since grasped that opportunity – and she has been banging the social unrest drum for several months over the issue.

Forcing/encouraging new Verkhovna Rada elections in Spring 2017, something long anticipated, is another goal that would fit the Opposition Block, Batkivshchyna/Tymoshenko, and possibly Radical Party design.  As all are populist, if they cannot force early elections following the hardship many will face during a heating season of high tariffs then they will probably never manage to force early elections.

Plans attempting to bring about calls for a “federal Transcarpathia” are an obvious alternative to the failed Novorossiya project.  (Although not specifically mentioned, how great a role Viktor Orban would/could play in agitating the Hungarian diaspora is unknown.)

What is perhaps most informative about the documents is that Mr Surkov aka Pavlov (if the email address is genuinely one of Surkov’s pseudo-email addresses) is that it is not the most Kremlin friendly Opposition Block that is identified as the critical political machinery to push the Kremlin active measures within the Ukrainian constituency.  Neither is it the Radicals.

cyber

The main focus was/is to concentrate upon the Batshchivyna (Ms Tymoshenko’s) Party.  This because it has the best outreach/network throughout Ukraine of the 3 political parties identified that would/could dance to the Kremlin tune – wittingly or unwittingly.  It is indeed true that of the Oppo Block, Radicals and Batkivshchyna, the latter has by far the widest regional networks.

The obvious question is whether Ms Tymoshenko would willingly allow her (and it is hers and nobody else’s) party to be used to further Kremlin active measures?

If so, wittingly or unwittingly?  (And would it matter either way when it comes to issues of implementation?)

A reader is left to ponder the morality (or not) of Ms Tymoshenko and the integrity (or not) of Batkivshchyna in pursuit of its vision for Ukraine even if it meant becoming a covertly willing accomplice of Mr Surkov/The Kremlin.

To be blunt, that Batkivshchyna vision probably goes no further than Ms Tymoshenko ruling Ukraine, for there is nothing whatsoever offered by way of detailed policy (as a reader would expect from a populist) and to be frank during her nearly 20 years in Ukrainian politics, meaningful and credible policy is not something that Ms Tymoshenko has ever actually offered (let alone delivered).  Her political judgement is also somewhat suspect, for despite many years involved in grubby deals with The Kremlin/Gazprom whilst in control of UESU and Somoli Ent, she still managed to hand Ukraine the most punitive gas deal in its history in 2009.

Whatever the case, how does Ms Tymoshenko and Batkivshchyna, (notwithstanding the Radicals and to a lesser extent the Opposition Block of whom such cooperation would be expected) mitigate the revelations within the apparently hacked emails detailing Kremlin plans as authored by Mr Surkov/Pavlov?

If denying (perhaps rightly) any political activity coordinated, or even useful to The Kremlin, the fact of having been identified as the political parties most likely to further Kremlin active measures to undermine Ukraine is a rather damning frame to be placed within.

Ms Tymoshenko/Bakivshchyna (and the others) may try to label CyberJunta a presidential provocation, but that carries risks – particularly if it is not, for hacker retribution is unlikely to be kind.  Batkivshchyna (or other named parties) emails becoming public is probably not a something that would be appreciated (unless you are employed within the Presidential Administration or are a Deputy of the People’s Front), nor is it likely to contain nothing but wholesome morally upstanding text and thoughtful policy alternatives.  Scams and scheming may well dominate any correspondence, be it party or personal in nature.

To be effectively labeled The Kremlin’s best ally/option in destabilising Ukraine, wittingly or unwittingly, within allegedly Kremlin designed active measures takes some explaining even if the entire incident is a fake – for unfortunately for Ms Tymoshenko and Batkivshchyna (and more or less the entirety of the political class more broadly), anonymous pro-Ukrainian hackers probably have as much, if not more credibility with the constituency than she does.

How to respond with the minimum of political damage sustained?

If it is a fake (or parts therein are fake), then who is responsible?  The Bankova or People’s Front?  It is doubtful it was a joint project.  If not either of those two, who else benefits?

h1

Corruption conviction statistics – MOJ publish them anywhere?

August 30, 2016

Never has this blog written an open letter or public request to any of the many Presidents, Prime Ministers or Cabinets whose governance (for want of a better description) it has lived under over the past decade and more in Ukraine.

The first reason for doing so is that once a reader has seen one Verkhovna Rada or Gov UA email address, it is very simple to work out the email address for any of them (no differently from working out the email address for somebody at the State Department or FCO etc.) and private communication has always remain the preferred channel of this blog.

Secondly, it would indeed be conceited to think that such a lowly foreign language hobby blog may get more than an infrequent and/or accidental visit from policymakers and/or legislators in Kyiv (discounting the diplomatic corps that seeks out what little English language “non-party line” commentary that spews forth from Odessa due to the absence of major “western” consulates in the region.  In short an OSINT source with friendly “useful idiocy” potential).

However, even lowly hobby bloggers occasionally write for money – and naturally to a far higher and heavily cited standard than that which appears in a free blog.  Indeed that writing can be academic and has been published by academic journals.

Facts and statistics even in a post-fact political world still have some resonance.  Being sarcastic, how else to produce unreliable facts from reliable figures – or vice versa?

Undoubtedly the Ministry of Justice is very busy.  Its reform agenda is vast and the obstructionism it faces is as robust as it is never ending.  Yet the role of the Ministry of Justice in combating corruption cannot be overstated.

Clearly there is pressure upon the “rule of law” ministries and State institutions to deliver anti-corruption results.  Indeed the blog’s social media time line and “favourite sites” are forever recording and highlighting the arrests of politicians and civil servants for corruption.  The beginning of a process for each and every cases- but not a result.

The Ukrainian anti-corruption fight will not be measured in the number of arrests, but in the number of convictions.

Naturally media and political attention focuses upon the high profile cases – or currently upon the absolute lack of convictions in high profile cases.  Important as they are, they too will only make up part of the picture when it comes to the fight against corruption.

Having searched in reasonable English, average Russian, and admittedly woeful Ukrainian, the blog is yet to find a consolidated list of corruption convictions – be it official statistics or a “best capture” effort by bloggers/civil society/media.

keep-calm-its-only-statistics-1

Somebody in the Ministry of Justice must have a list of every conviction for corruption of political and civil service figures across the entirety of Ukraine – if for no other reason to have a list of names that will subsequently be banned from holding office for a period of time following any conviction.

It would perhaps assist Ukraine in making its case that it is indeed fighting corruption and not just orating rhetoric and passing legislation that remains unimplemented – and certainly assist academic observation, even if empirical in nature – to provide easily located, easily accessible simple corruption conviction statistics.

The number of convictions for corruption per month (or per annum at least).  The judicial verdict/punishment handed down.  The region/oblast.  Ideally the specific court and/or the judge too would be enough.

How else can even empirical observation consider why one region may be far more active in arriving at convictions than another?  Is there a consistency in the sentencing – regionally or nationally?  What of proportionality?  Is one court far more “forgiving”/lenient than another?  Would any “unofficial punishment banding” become empirically apparent correlating to the level of the convicted in the bureaucratic machinery – or alternatively to the level of bribe received for their nefarious acts?

Naturally nobody would expect the Minister to know these statistics without having to refer to somebody in the “boiler room” of the Ministry of Justice – but somebody in the “boiler room” will know – and if nobody knows, then how is the Ministry of Justice (or any other ministry) measuring the fight against corruption where it counts – and the reactive side of the equation counts only in convictions (hopefully with proportionate and consistent sentencing).

(Admittedly it is far more difficult to accurately measure the proactive preventative side of the fight against corruption because if proactively preventing it then logically it didn’t happen to be measured – an inaccurate science no different in difficultly to accurately measuring any crime prevention initiative.)

Thus this entry is aimed at those that may have contact within Ministry of Justice (rather than personally at the Minister of Justice who won’t read it) – hopefully one of the fairly frequent diplomats that drop by will raise the question of where to locate collated, official, easily accessible, frequently updated statistics regarding convictions (not arrests) for corruption and accurately recorded sentencing handed down.

Perhaps somebody within the EU, EU Member States, US or Canada that are rightly spending taxpayers money to support the fight against corruption have such statistics available?  If not, how are they measuring the fight against corruption if convictions are not part of that benchmarking?

There is surely publicly available, updated statistics for the convictions and sentencing of public servants – for they are a matter of public record somewhere – and as headline grabbing as even a solitary conviction and sentencing of a sacrificial “big fish” will be (if it happens), the statistics sufficient to paint a much broader empirical picture, by region and nationally, would be gratefully received.

In the fairly certain knowledge that there will be no response to this plea/ admission of search engine defeat, perhaps the erudite readers will perchance furnish links to such hidden statistical knowledge that despite searches in 3 languages have thus far failed to produce the desired results?

Obliged in advance to any that may assist.

h1

Data accessibility – Apps4Cities competition

August 16, 2016

About a week ago, whilst sat with a friend (and soon to be business partner) fluent in those strange tongues of Java, C++ and other exotic yet unintelligible languages that produce Microsoft Ukraine winners,  the blog tentatively mentioned the fact that an “Odessa App” would be a rather good idea – particularly if the city emerges as the Eurovision host.  (“Tentatively mentioned” owing to the fact that keeping said friend (and soon to be business partner) concentrating on our mutual project was and is the priority.)

Some ideas were tossed about.

The issue was raised simply because the City and Oblast are particularly bad at communication both with each other, and perhaps more importantly with the local constituency.  Indeed “communication” is perhaps the wrong word when mentioning local government for it implies to many a two-way interaction.  It is more accurate to state that both City and Oblast are particularly bad at information and its delivery.

That said, our “tossing of ideas” covered far more than communicating Odessa local governance issues via an App. – nothing quite so dull.

App

Nevertheless, and by coincidence, 16th August witnessed the NGO OPORA announce an “Apps4Cities” competition.  What’s more there is a small $5000 incentive for winner(s) – not much, but a financial incentive nonetheless.

OPORA are certainly on the right track for expecting local governance to provide sensible solutions to their own woeful communication is folly – they can’t even communicate with each other.

Hopefully there will be a qualitative response.  It will be very interesting indeed to see just what solutions are offered by a very creative civil society and IT community now well used to filling gaping voids where governance fails. – and where governance fails the most is effective implementation and communication.

Expect some very smart solutions to be offered!

h1

NATO Warsaw 2016 – What does a “good result” for Ukraine look like?

July 4, 2016

With the NATO Summit in Warsaw now upon its Members (and partners), and with clear eyes noting the numerous issues facing the organisation and the Member States that form its constituent parts, be those issues coming from Russia, MENA, from cyberspace, or climate issues and its repercussions (to name but the most obvious) it is perhaps worth pondering what constitutes a “good result” for Ukraine.

Putting aside fanciful rhetoric of actual membership in the near future (if ever) there are certain possibilities and opportunities that with far less political will than that required regarding membership (in the near future, if ever) are worthy of pursuit – even if Warsaw 2016 be the official or unofficial platform from whence such goals, policies and strategies begin (or are further developed).

So what does a “good result” for Ukraine look like?  (Apart from more US anti-battery radar systems and assorted high-tech kit.)  Most will have their own ideas of what a “good result” would be, so here are a few thoughts that would/should/could fall within the limits of (wildest) expectation and acceptance by both parties.

It is already clear that Ukraine still blips brightly upon the NATO radar – even if it is not entirely clear where NATO “Ukraine policy” ends and NATO “Russia policy” begins.  Perhaps there is a necessarily (or deliberately – “strategic ambiguity” and all that) smudged line/overlap in places.

nato

Whatever the case, Ukraine gets a top table one to one with NATO leaders on 9th July – a propaganda result in and of itself (be the tangible outcome good, bad or indifferent).

It is also almost assuredly going to be the recipient of a package of NATO political and practical assistance.  Clearly the support thus far given with regard to capability development, defence restructuring, continued training and advice (both military and civilian), and progress toward universally meeting the most basic of NATO standards will continue.

As assuredly the repeated yet necessary rhetoric regarding the unequivocal support for, and recognition of, Ukrainian sovereignty and territorial integrity will continue – and be clearly orated.  No doubt there will be mention of Minsk, but hopefully not one that overshadows or dilutes the unequivocal support for, and recognition of Ukrainian sovereignty and territorial integrity in and of itself (with or without Minsk).

Specific NATO trust funds (hopefully under NATO administration) will be announced for various issues (Vets care etc) as well as future assistance in dealing with IEDs/war remnants, strategic communications, more non-lethal aid et al.

So far, so predictable – but not necessarily a “good result”.

However, having mentioned the prospect of (highly unlikely) NATO membership, it is perhaps time that the NATO Members actually made a decision with real meaning behind it regarding further NATO membership (regardless of what the Washington/North Atlantic Treaty actually says).

Ukraine, despite any rhetoric to the contrary, is at least a decade away from meeting the most basic of NATO standards in a holistic manner (and despite PM Groisman’s statements that he believes the nation will be within the EU in a decade, that certainly wont happen either – due to EU budgetary cycles and nations like France who will not want to see a lot more “Eastern European” MEPs contesting with “Club Med” MEPs, if for no other reasons).  Indeed perhaps Ukraine is further away from NATO standards than a decade considering the sound and sensible advice it has already received – and occasionally ignored.  (Take the stop-start policy of numerically large, and thus poorly prepared and trained mobilisation/demobilisation it continues to pursue, against the advice given regarding a rolling mobilisation/demobilisation in smaller yet better trained numbers as one very basic example of several when it comes to ignoring the advice it asks for.)

Nevertheless, weak and non-committal NATO “open door policy” statements are little use to anybody.  A definitive “Yes the door is open when you make the grade”, or equally explicit “No the door is not open for Membership whether you make the grade or not – but this is unquestionably on offer if you do” is now approaching something of a policy necessity – particularly when Georgia is there or thereabouts when it comes to making the NATO grade.

It is perhaps time the NATO Members made very clear the prospects (or almost certainly lack thereof) for NATO Membership.  If Montenegro, and perhaps Macedonia if it can settle its “name” issue with Greece, together with a few Balkan nations are to be the final membership count, then that should be made clear – whether it rubs against the text of the NATO Founding Treaty or not.

There are however anchors that Ukraine can drop solidly into the NATO waters that both partners can and perhaps should pursue sensibly – but also in earnest.  For all the West looks in at Ukraine, and Ukraine (to varying degrees examines itself), it also seeks an opportunity to do something practical and tangible externally to assist those that currently assist it quid pro quo,  and to project itself beyond its borders and UN physical commitments.

Perhaps those practical and tangible opportunities should be offered.

As written within entries past, the convergence between espionage, sabotage, organised crime and terrorism within cyberspace is increasing.  It is reaching a point where it can be difficult to tell espionage from sabotage until sometime after the fact (deliberately leaving delayed “nasties” in the system far beyond intelligence gathering).  Likewise organised crime becomes a funding revenue stream for terrorism, increasingly on-line.  There is certainly significant room for a far closer and integrated partnership considering the clear cyber-convergence trend and overlaps for all things illicit in the grubbier parts of the dark net.

There is certainly a common interest and possibilities for dedicated and prolonged Ukrainian participation in the Romanian led call for a NATO Black Sea presence – a legacy of an increasingly militarised Crimea.  As suffering as the Ukrainian Navy currently is, as yesterday’s entry infers, there is also the scope for its inclusion in any NATO and EU efforts with MENA migration on the open seas too.  It would go some way toward Ukraine meeting its new obligations toward the EU CSDP, increase interoperability with NATO, and enhance the necessary deepening of relations with Romania.  (Warsaw being the other vital capitol to deepen ties with in the neighbourhood when it comes to understanding shared threats.)

It is not all a one way street either.  Ukraine has hard earned experience of front line Russian led warfare to share.  It has experience of Russian equipment limitations and weaknesses.  It has experience of Kremlin led warfare against it in cyberspace (including infrastructure disabling), social manipulation, disinformation on a colossal scale (its domestic effects and effective counters), of continued and continuing infiltration, of agent provocateur and “Potemkin destabilising projects” etc., etc.

Significant and unambiguous steps toward clarifying and/or participating in all of the above during Warsaw 2016?  Now that would be a “good result” for Ukraine.

h1

When is cyberwar an act of war? Is NATO getting close to answers?

May 3, 2016

Just over a month ago, an entry appeared raising some issues that to be quite blunt, remain somewhat perplexing.  The entry was inspired by a chat with an Oxford University boffin at the Odessa Security Forum.  Answers, it has to be said despite over a month of pondering, are still difficult to reach.

“Whether it be something approaching a temporary national convulsion as experienced by Estonia in 2007, with banks, the parliament, and broadcasters being downed, or the disruption of technical operations in conventional warfare experienced by Georgia in 2008, or the physical infrastructure damage such as that caused by the Stuxnet worm in 2011, or system wide computer malfunctions experienced by Sony in 2014, or the 2016 hack of the Ukrainian power grid, there would appear to be an empirical trend of escalation – or “pushing the envelope” to use the Tom Wolfe idiom.  (It is perhaps a blessing that so old and ignored is Ukrainian infrastructure since independence that manual systems still exist to rectify matters swiftly.)

Directly or indirectly lives may have been lost through such acts, perhaps deliberately so on the battlefield, and perhaps as a consequence of downing power grid (or other) infrastructure.

The above incidents are employed to simply display a perception of escalation – there are numerous public domain incidents that could have been cited, and undoubtedly even more incidents remaining without the public domain that could have been used that may have already led to the loss of life.

All of which leads to the especially difficult question regarding what, exactly, will be the threshold for a cyber act that is deemed an act of war?  Particularly so when such acts can be far more easily and deniably outsourced to non-State entities by the State?

Clearly those attacking any system have the advantage over those trying to defend it.  There is no such thing as 100% security – on line or off line.  Where there is a will there is a way with sufficient skill, determination, time, or money – or a combination thereof.

How do those on the receiving end recognise the difference between espionage (which all States engage in) and what is an attack (which perhaps not all States currently have the capability for) that will leave behind something nasty and that in the months ahead bring down critical defences and/or infrastructure?

Yet further, how easy would it be to misinterpret intent or miscalculate effects?  How to judge the proportionate response – at least in a timely manner?

……..there is an empirical convergence of cyberspace and terrorism.  There is an empirical convergence of cyberspace and organised crime – indeed with some States it is not always easy (if at all possible) to separate the State from organised crime, or organsised crime from the State.  There is an empirical convergence of cyberspace and geopolitics.  All of which leads to the empirical convergence of the space between war and peace – and ultimately what will be deemed and act of war – or not?

There will never be an international law that bans espionage – because every State engages in it.  Domestic statute will predominantly deal with those caught engaging in espionage against the domestic interest, but will not ban the practice against others.”

cyber

These are all particularly difficult and thorny issues.

When does cyberwar become an act of war?

NATO Secretary-General Jens Stoltenberg recently told a key alliance planning summit that “cyber is now a central part of virtually all crisis and conflicts, NATO has made clear that cyber attacks can potentially trigger an Article 5 response.”  Quite rightly too.

When sparing with Chairman of Russia’s Federation Council Committee on International Affairs Konstantin Kosachev over whether NATO would bomb a nation suspected of cyber attacks, the NATO Secretary General stated “We will do what’s necessary to do to protect all allies, but I’m not going to tell you exactly how I’m going to do that … that’s the main message.”  The return of ambiguity in an very ambiguous theatre perhaps – or perhaps such a strategy and protocols remain work in progress, thus ambiguity masks developing strategy.  Perhaps a little of both.

Having previously stated – “How do those on the receiving end recognise the difference between espionage (which all States engage in) and what is an attack (which perhaps not all States currently have the capability for) that will leave behind something nasty and that in the months ahead bring down critical defences and/or infrastructure?

Yet further, how easy would it be to misinterpret intent or miscalculate effects?  How to judge the proportionate response – at least in a timely manner?”, the NATO Secretary General half-answered this issue raised with a statement that would infer, perhaps deliberately misleadingly (perhaps not) that policy is seemingly still under development when he said NATO should “sharpen our early warning and situational awareness … so we know when an attack is an attack.

That statement does perhaps also infer that what constitutes an attack (that crosses certain thresholds) has at least been defined – as has what doesn’t constitute an attack (which doesn’t meet the parameters, whatever they are defined as).

Perhaps NATO is getting closer, or has indeed answered for itself, the issues raised by the blog last month.  If so, bravo, for certainly the convergences mentioned above continue placing time constraints upon clever thinking.

Perhaps it will only be when policy triggers are pulled when as yet unknown red lines are crossed – and those red lines may not all be particularly obvious to those “pushing the envelope”.  What then to do if those lines are crossed by deniable outsourced entities with no clear links to a State?

It’s a policy realm that’s enough to make your head hurt – but it is one faced by all the protagonists (for better or for worse)!  It is also a theatre of war in which Ukraine can theoretically hold its own.

%d bloggers like this: