By Jeffrey Carr

The fun of movie scenarios aside, consider the same strategy when the hostage is not a human being but a piece of technology or a legacy policy that no one wants to change.

Here’s a new scenario. A state or nonstate hacker attacks US critical infrastructures and Department of Defense networks at will and without fear of detection or attribution. He is able to do this from behind the protection of two very valuable “hostages” or, more precisely, “sacred cows” that US government officials, including the Congress, are loathe to change—using Microsoft Windows and regulating a segment of private industry:

In this case, the best solution, bar none, is to metaphorically “shoot the hostage,” thus denying an adversary both of his weapons (1) malware configured for the Windows OS and (2) his attack platform—the most reliable Internet services companies in the world.

Shoot the first hostage by switching from Microsoft Windows to Red Hat Linux for all of the networks suffering high daily-intrusion rates. Red Hat Linux is a proven secure OS with less than 90% of the bugs found per 1,000 lines of code than in Windows. Many decision makers don’t know that it is the most certified operating system in the world, and it’s already in use by some of the US government’s most secretive agencies. Computers are changed out every three to four years on average anyway, so the monetary pain is probably not as great as it might seem. The benefit, however, would be immediate.

The data from Kaspersky Lab in Figure 13-1 shows how few malware have been developed for operating systems other than Windows. Linux certainly has its vulnerabilities, but the math speaks for itself. Shoot Windows and eliminate the majority of the malware threat with one stroke.

Shoot the second hostage by cracking down on US companies that provide Internet services to individuals and companies who engage in illegal activities, provide false WHOIS information, and other indicators that they are potential platforms for cyber attacks.

Figure 13-1. Kaspersky figures on malware distribution by OS

The StopGeorgia.ru forum—whose members were responsible for many attacks against Georgian government websites, including SQL injection attacks that compromised government databases—was hosted on a server owned by SoftLayer Technologies of Plano, TX.

The distributed denial of service (DDoS) attacks of July 2009 that targeted US and South Korean government websites were not controlled by a master server in North Korea or China. The master server turned out to be located in Miami, FL.

ESTDomains, McColo, and Atrivo—all owned or controlled by Russian organized crime—were all set up as US companies with servers on US soil.

The Russian criminal underground prefers to host their web operations outside of Russia to avoid prosecution. And the robust US power grid, cheap broadband, and friendly business environment makes this country the ideal platform for cyber operations against any target in the world, including the US government.

Congress needs to send a strong signal to US Internet hosting and service provider companies that profit must be tempered by due diligence and that they are, effectively, a strategic asset and should be regulated accordingly.

Neither of these recommendations is politically safe. However, the United States is now facing a serious threat from a new domain with so many evolving permutations that senior leadership, both civilian and military, seem to be standing still. And that’s absolutely the wrong strategy to employ.

By Lieutenant Commander Matthew J. Sklerov ^[40]

Cyberspace is a growing front in 21st-century warfare. Today, states rely on the Internet as a cornerstone of commerce, communication, emergency services, energy production and distribution, mass transit, military defenses, and countless other critical state sectors. In effect, the Internet has become the nervous system of modern society. Unfortunately, reliance on the Internet is a two-edged sword. While it provides tremendous benefits to states, it also opens them up to attack from state and nonstate actors. Given the ease with which anyone can acquire the tools necessary to conduct a cyber attack, anonymously and from afar, cyber attacks provide the enemies of a state with an ideal tool to wage asymmetric warfare against it. Thus, it should come as no surprise that states and terrorists are increasingly turning to cyber attacks to wage war against their enemies.

Today, the United States treats cyber attacks as a criminal matter and has foregone using active defenses to protect its critical information systems. This is a mistake. The government needs to modernize its approach to cyber attacks in order to adequately protect US critical information systems. Unless policymakers change course, the United States will continue to be at greater risk of a catastrophic cyber attack than need be the case.

Modernizing the US approach to cyber attacks requires major changes to the way the federal government currently does business.

First and foremost, the United States needs to start using active defenses to protect its critical information systems. This will better protect these systems, serve as a deterrent to attackers, and provide an impetus for other states to crack down on their hackers.

Second, the United States needs to devote significantly more resources and personnel to its cyber warfare forces. Creating the preeminent cyber warfare force is an absolute imperative in order to secure US critical infrastructure against cyber attacks, and to prevent the Internet from becoming the Achilles’ heel of the United States in the 21st century.

Furthermore, a large, expertly trained cyber warfare force should be a prerequisite to actually using active defenses, since using active defenses on the national scale without properly trained personnel could easily lead to unjustified damage against illegitimate targets.

The decision to use active defenses will, no doubt, create a lot of controversy, as would any major change to state practice. However, there is sound legal justification to use them, as long as their use is limited to attacks originating from sanctuary states, as laid out in Chapter 4. Limiting active defenses to attacks originating from sanctuary states still leaves states vulnerable to cyber attacks from rogue elements of cooperating states, but this change to state practice significantly improves US cyber defenses without running afoul of international law.

Furthermore, under a paradigm where active defenses are authorized against sanctuary states, the United States could feel comfortable knowing that either cyber attacks would be defended against with the best computer defenses available or that when computer defenses were limited to passive defenses alone, the state of origin would fully cooperate to hunt down and prosecute the attackers.

In adopting this approach, the United States needs to use its diplomatic influence to emphasize states’ duty to prevent cyber attacks, defined as passing stringent criminal laws, conducting vigorous law enforcement investigations, prosecuting attackers, and, during the investigation and prosecution, cooperating with the victim-states of cyber attacks. Using US influence to emphasize this duty, combined with the threat that the United States will respond to cyber attacks with active defenses when states violate this duty, should help coerce sanctuary states into taking action against their hackers. This is an essential step toward both a global culture of cyber security and eliminating the threat of cyber attacks from nonstate actors.

Admittedly, the decision to use active defenses is not without complications. Technological limitations will still make it difficult to detect, assess, and trace cyber attacks. As a result, frontline forces will run into trouble trying to factually assess attacks and, given the speed with which cyber attacks execute, will frequently be forced to make decisions with imperfect information. (These difficulties are assessed in greater detail in Chapter 4.) Thus it is imperative for the United States to invest the capital necessary to ensure that its cyber warfare forces are able to overcome these difficulties. Otherwise, poor decisions are likely to be made, and active defenses might accidentally be directed against allied states or used before the legal thresholds for their use are crossed.

At a time when cyber attacks threaten global security and states are scrambling to find ways to improve their cyber defenses, there is no reason to shield sanctuary states from the lawful use of active defenses, and every reason to enhance US defenses to cyber attacks by using them. Selectively targeting sanctuary states with active defenses will not only better protect the United States from cyber attacks but should also push other states to take cyber attacks seriously as a criminal matter because no state wants another state acting within its borders, even electronically.

Using force against other states may sound like a harsh measure, but states that wish to avoid being the targets of active defenses can easily do so; all they must do is fulfill their duty to prevent cyber attacks.

Lieutenant Commander Sklerov is a native of upstate New York. He received his Bachelor of Arts from the State University of New York at Binghamton, his Juris Doctorate from the University of Texas, and his Masters of Law in International and Operational Law from the US Army Judge Advocate General’s School. He is admitted to practice before the Texas Supreme Court, the US District Court for Southern Texas, the US Court of Appeals for the Armed Forces, and the US Supreme Court.

In June 2006, Lieutenant Commander Sklerov reported to USS NIMITZ as deputy command judge advocate. While on NIMITZ, he deployed twice and served as officer of the deck (Underway) during combat operations in support of OEF and OIF. He is currently stationed at Naval Base Kitsap Bangor in Silverdale, Washington, where he serves as the staff judge advocate for Submarine Groups NINE and TEN (also known as Submarine Group TRIDENT).

The following are fictional scenarios various government and private organizations come across for which there is insufficient legislation or frameworks to guide them in deciding on a proportionate response to cyber attacks.

With these scenarios I have provided a list of options for response, to assist in the creation of future legislation governing such responses. As of this writing, some of the options considered here are either not legal or may be legally questionable.

Policymakers would be well-advised to consider these scenarios as realistic depictions of events that could and do occur in many nation-states. The only question is which option best addresses the interests of the state and its citizens, and the answer to that question is outside the scope of this submission.

This essay was written by an active duty member of an international law enforcement agency.

By Alexander Klimburg

The general public is often wholly unaware of how much of what we commonly call “security” depends on the work of informal groups and volunteer networks. For a while it seemed that Western governments had generally gotten the message: when most of your critical infrastructure is in private hands, it is natural that new forms of private-public partnerships need to be created to be able to work on critical infrastructure protection. Organizations such as the US ISAC (Information Sharing and Analysis Center) and the UK WARP (Warning, Advice, and Reporting Point) are examples of this thinking. Unfortunately, most governments have a hard time moving beyond the “two society” (government and business) model. In an age where even the “managing” bodies of the Internet (such as ICANN) do not belong to either of these groups but instead are really part of the “third society”—i.e., the civil society—this is a critical, and potentially fatal, omission. From groups of coders working on open source projects to the investigative journalism capability of blogs, the breadth of the involvement of the civil society and nonstate actors in cyber security is wide and growing. But what are these groups, exactly?

The variety of these groups is as wide as the Internet itself, and these groups also interact directly with the harder side of cyber security. Nongovernment forces of various descriptions have attacked countries on their own (e.g., Estonia, Lithuania) and defended them, helped wage a cyber war (e.g., Georgia), and sought to uncover government complicity in them. One can even argue that most of the cyber terror and cyber war activity seen over the last decade can be ascribed to various nonstate actors. A recent US Congressional inquiry heard that the great majority of the Chinese attacks against the United States were probably being done by young volunteer programmers whose connection with the security services was probably more accidental then anything else. Indeed, if one looks at the sum total of cyber security-relevant behavior, from software and patch development on the technical side to the freelance journalism and general activism on the political side (and with the “script kiddie patriot hackers” somewhere in between), it indeed seems that most “cyber security” work is done by members of the third society, with business following close behind—and government bringing up the rear.

Do these groups really have anything in common? After all, it is questionable whether heavily instrumentalized civilian hacker groups in China and Russia really qualify as representatives of a “civil society.” Should they really be compared to, say, a Linux developers’ group or an INFOSEC blog network? Aren’t these “patriot hackers” just an update of the age-old paradigm of the citizen militia and the flag-burning rent-a-mob, but with broadband?

Although the militia model can to a limited extent be applied to some of the Russian and Chinese groups (indeed, the Russians actively talk of the need to maintain an “information society” for their national security, and the Chinese have recruited an “information operations militia”), the model just does not hold for the many groups rooted in liberal democratic societies. This is particularly evident when examining nontechnical (i.e., not “White” or “Grey” hacker) groups and their activities. They are increasingly able to provide critical input into one of the most difficult aspects of any wide-scale cyber attack, namely attacker attribution.

Identifying the true actors behind a cyber attack is a notoriously difficult task. Attributing attacks to individual actors is traditionally seen as being the acid test to determine whether an attack is rated as an act of cyber war or an act of cyber terrorism (or even “cyber hooliganism”). Given these rather high standards, governments have been notoriously reluctant to point fingers. After all, there was no evidence that could be shared publicly. On the surface it seemed that the authoritarian governments of Russia and China had found the ultimate plausible-deniability foil with which to jab the West: rather then personally engaging in hostile cyber attacks, these governments could simply refer to the activities of their “engaged and active civil society” and wash their hands of the affair.

The advent of engaged civil society groups has changed this. Since 2005, these groups have published a flood of reports that have examined suspicious cyber behavior, mostly originating in Russia and China. The Georgian cyber attacks were particularly interesting, as the timing seemed to indicate at least some level of coordination between the Russian military’s kinetic attacks and the assault on Georgian servers. Reports such as those generated by Project Grey Goose helped to show that although the information of Russian government complicity in the cyber assault on Georgia was far from conclusive, there was much circumstantial evidence. For the reports, and the Western media that depended on them, this was sufficient. Unlike governments, for the public, “perfect” was clearly the enemy of the good.

The information in these reports is not good enough for cruise missiles, but it certainly is good enough for CNN. The barrage of reports that imply direct Russian government involvement has been widely reported in Western media. The increase of embarrassing questions posed to the Kremlin is probably a direct result of this media attention. At a cyber security conference at the Organization for Security and Co-operation in Europe (OSCE) in 2008, an American official privately remarked to me that the incessant accusations repeated in the media were leading the Kremlin to reduce its support of various groups, such as the pro-Putin Nashi, whose members have been implicated in cyber attacks. He directly credited the work of the civil society groups—including Grey Goose—in bringing this about. Sunlight as a disinfectant seems to work across borders as well.

It therefore appears that the best defense against a compromised or captive civil society is a free one. I have taken to referring to these “free” groups as security trust networks (STNs), and there are considerable differences between these groups and the ones that they often seem to work in direct opposition to:

Western governments often depend on these STNs much more than they realize. This is especially true for the technical experts, who invest a large amount of labor that mostly goes unnoticed, but also for the investigative STNs, such as Grey Goose, that certainly have helped frame the public debate.

So is it possible for a government to help create these STNs? The question is not as bizarre as it might seem. Russia has actively followed this course since at least 2000 (the publication date of its “Information Security Doctrine”) and is trying to “build a information society.” Although Alexis de Tocqueville might well wince at the idea of a government building a civil society, there is indeed much that truly democratic governments can do to encourage the formation of such groups and work together with them:

It is not an exaggeration to claim that an independent, vibrant, and engaged civil society is one of the unique indicators of a liberal democracy. The fact that they are a benefit, not a cost, is most evident in security trust networks. Democratic governments would do well to support them as a centerpiece in Whole of Nation cyber security.

Alexander Klimburg is a Fellow at the Austrian Institute for International Affairs. Since joining the Institute in October 2006, he has worked on a number of government national security research projects. Alexander has partaken in international and inter-governmental discussions, and he acts as a scientific advisor on cyber security to the Austrian delegation to the OSCE as well as other bodies. He is regularly consulted by national and international media as well as private businesses.