GCCS2015 Part II: Government Influence is the Key Issue

gccs2(As published on Norse: Feb 5th, 2015)

As we noted in Part I: GCCS2015: Battlefield for the Internets’ Multi-stakeholder Coup, the next iteration of the Global Conference on CyberSpace (GCCS2015) will be held on April 16th and 17th in The Hague, the Netherlands this year. It is the worlds’ premier political conference on Cyberspace.

The Internet was founded on, and has ever since been based on, the multi-stakeholder principle. That is to say: the Internet does not belong to any government, it belongs to everyone equally.

In fact, aside from lending material support, governments have had precious little to do with the development, implementation and administration of the Internet. The brunt of the work has been done by civilian institutions such as the IETF, ICANN, IANA and a whole slew of similar civilian non-profit organizations.

But as time progressed and the significance of the Internet grew, so too did the urge to control grow at the worlds’ governments.  This is signified most clearly by the continued attempts of the UN to move this piece of internet governance away from US-based ICANN to the International Telecoms Union (ITU).

At first glance, the ITU seems innocuous enough. It has a membership of over 193 countries and over 700 commercial entities such as Apple and Cisco. However, the ITU is an agency of the UN and therein lies the rub.

The ITU is ultimately subject to the will of the UN charter members. They will face considerable pressures by many UN nations such as Russia, China and Iran, who are staunch supporters of ‘cyber sovereignty’.

The ‘cyber sovereignty’ camp considers the current state of affairs to be directly threatening their national security primarily because they have no easy way to censure content. They will no doubt push for measures stifling internal dissent and perhaps even for measures to censure content disagreeable to them.

In fact, they’ve pretty much said so.

Several blows have already been dealt to advance the power shift towards the ITU during the 2012 World Conference on International Telecommunications (WCIT), as excellently commented on by Alexander Klimburg in his article “The Internet Yalta”.

In his article he describes how China and Russia managed to sway most of the developing nations to supporting ‘cyber sovereignty’, and the whole issue devolved into essentially a bipartisan issue in which the developing nations aim for governmental control of the Internet, and the Western nations prefer to keep the status quo.

There does not appear to be a middle ground. WCIT was, in this respect, a political cloak-and-dagger event of almost Machiavellian proportions.

It had it all: the polarization of the voters, sudden ‘midnight votes’ that most parties were left uninformed about, and attempts at tricking voters into voting on articles that were thought to contain something other than it did.

Both the ‘code of conduct’ and the battle for the internet’s multi-stakeholder principle shine through in the Seoul Framework for and Commitment to Open and Secure Cyberspace that was drafted for the 2013 conference in South Korea.

It is this framework that will be the key talking point in The Hague this year. The Netherlands has already stated that it would support further work on this framework, but given its democratic nature and strong culture of international trade, this is hardly surprising.

In an earlier published flyer the official statement was made that the ‘self-organization of the Internet should be supported and is preferred to regulation imposed by states’.

It can only be hoped that all sides remain cordial and that political sleight-of-hand doesn’t catch anyone off guard. The result of such an event could very well mean the end of the Internet as we know it.

On Dutch Banking Woes and DDoS Attacks

DDOS-attackIf you don’t live in the Netherlands or don’t happen to have a Dutch bank account, you can certainly be forgiven for not having caught wind of the major banking woes that have been plaguing the Dutch. For weeks now, massive DDoS attacks (linked article in Dutch) have brought low the online services of several banks, interrupting mobile payments and slowing down overall online financial traffic. At the center of the digital storms is ING, which was hit first (Dutch) and is hit the most often (Dutch), but Rabobank, ABN AMRO and SNS Bank are also frequent targets. Dutch online payment system iDeal has also been attacked several times, impacting virtually all Dutch banks as well as the many online retailers that use it.

What the goal behind this wave of DDoS attacks is, is as yet unknown, but there are several possible motives at play. It could be simple vandalism, a rather hefty attempt at misdirection to cover up real hacking attempts, or it could have something to do with ING and ABN AMRO being implicated or involved with investigations into tax evasion through offshore banking by the ICIJ. The latter seems unlikely, as most of the DDoS traffic appears to be coming from Romania (according to hackers collective HacksIn – I had a link about that, but lost it somehow) and no motive has made itself known thus far. It was a matter of time until Anonymous came along to jump on the bandwagon, and indeed its Dutch chapter appears to have done so this week when someone posing as Anonymous posted a message on Pastebin. In it, they claim to know who is behind the DDoS attacks (a group of Muslim extremists called Izz al-Din al Qassam Cyber Fighters), and that the Dutch people should go out and collect their money from these banks because it is not safe there.

There are, however, some issues with this post on Pastebin. Firstly, the group they blame for the DDoS attacks is in fact the group responsible for attacks on US BANKS, and there is no discernible link between the US banks being hit or the Dutch banks currently under attack. The motive for the attack against US banks seems clear: Izz al-Din al Qassam demands the removal of the movie “Innocence of Muslims” from Youtube. Once the movie is removed the attacks will stop, they claim. To my knowledge, no such demands have been made here in the Netherlands.

The second issue is that the advice posed by Anonymous would, in fact, immediately collapse the Dutch financial market, as no Dutch bank is currently strong enough to survive such a proposed bank run. They simply don’t have sufficient cash in their vaults. In other words: this is a really bad idea.

So what now?
For starters, ING should hire someone who knows how to communicate during a crisis. Its obvious that they suck at it. They’ve finally stepped off their “Silence, Evade, Deny” strategy but its taken a while. All major companies should look into this, because they may very well be next. Second, major companies with a serious online presence should really start taking this stuff seriously. DDoS attacks are hardly new material to deal with, and proper impact negation tactics have been around for a while. If your income is dependant on online services and this income is significant, get a real ISP that understands this and has expertise in countering such digital vandalism such as Arbor Networks or Prolexic.

The bad news is that according to a recent Prolexic report, DDoS attacks are getting increasingly stronger. They have seen the first 130GB/s DDoS attack this year, and during the first quarter of this year the average attack bandwidth was 48.25GB/s, which signifies a whopping 718% increase over last year. The increase seems to come from a change of victims in the botnets (Dutch) they use. Apparently, they are now targeting web servers especially for their higher bandwidth capacity, which in turn increases overall attack bandwidth. On top of that, the DDoS attack seems to have regained its popularity because the targetlist is growing. Airlines such as KLM (Dutch) and Dutch authentication firm DigID (Dutch) have also recently been hit with massive attacks. In an effort to stave off this wave of disruptions, the Dutch National Cyber Security Center has been organising collective defense (Dutch) between Dutch banks, but it seems they may have to include firms from other walks of life as well. I think we can safely conclude that this avenue of attack is still very worthwhile and won’t be going away anytime soon.

In fact, things may get a lot worse if this newly discovered DDoS technique gets incorporated. Apparently Incapsula mitigated a small attack of 4GB/s recently, and they traced it back to a single source. Generating 8 million DNS queries per second, causing ALL of the 4 GB/s traffic by its lonesome, certainly qualifies it to be called a DDoS Cannon instead of a lowly bot. I don’t know if it is technically feasible, but imagine 100K+ systems doing this.

Wrapping up this piece, I would like to ask mainstream news reporters to please start learning some basic truths about information security. Stop referring to DDos attacks as “(sophisticated) cyber attacks”. They’re not. A DDoS attack is annoying, yes. But on the scale of sophistication they rate roughly as digital graffiti. Also, some major outages are caused by stupidity from the victim rather than an outside source. At least ONE major outage on april 4th of this year at ING was caused by someone messing up certain files that had to be read into a system. This caused a major outage and customers seeing the wrong amount on their bank accounts. This incident was also the most significant failure of ING’s webcare / crisis communication because they didn’t do anything until the problem was almost fixed (many hours later). Still, mainstream media fed the panic frenzy that it was an external “sophisticated cyber attack” until the absolute very end. Very poor reporting if you ask me. Proper reporting matters because your news is read by people who take it for immediate truth. You can, and do, cause panic and unrest when you blow things out of proportion, so please stop doing so. Thank you.

Trojans for the Bundestag – German PD acquired Finfisher

FinfisherIn December of last year, the German public prosecutors’ office had declared that there was no legal basis for the use of the so-called “Bundestrojaner” spyware, which was used to spy on German citizens. On top of it being illegally used, it was also found to be of very poor quality by extensive research performed by the Chaos Computer Club. In a surprising turn of events, German political platform NetzPolitik.org has now uncovered secret documents belonging to the Ministry of Finance, that the Ministry of the Interior sent to the Bundestag (the political seat of Germany) that reveals the German Federal Police’s intention to use Gamma Group’s Finfisher spyware to do the exact same thing.

Finfisher is quite an elaborate suite that allows for remote take-over of both computer systems and mobile devices such as iPhones, Androids, Blackberries and Windows Mobile-phones by pretending to be a software update. Gamma Group sells this product to dictatorial regimes all over the world, and that says a lot. What is also quite interesting is the presence of the logo for the UK’s Home Office and a link to its’ premier Security & Policing Exhibition. Does this imply that the UK government also purchased this product? Wikileaks recently published a document that looks like Finfishers’ marketing brochure and it is certainly geared towards the more modern police forces, as it sports solid integration with LEMF, which stands for Law Enforcement Monitoring Facility.

In august of last year, Bloomberg published an article that reported Finfisher presence on 5 continents and analysis performed by Rapid7 indicated its presence in at least Australia, the Czech Republic, Dubai, Ethiopia, Estonia, Indonesia, Latvia, Mongolia, Qatar, Bahrain  and the United States.  Now, of course this is not concrete proof that these governments actually use Finfisher, but Gamma Group is based in the UK and they have placed this software in the category of goods requiring an export permit because of the restrictions on exporting such digital weapons. Combined with how Gamma specifically markets Finfisher as ‘Governmental IT intrusion‘, it is highly unlikely that the British government would allow legitimate export to be done to just anyone. In a similar story posted by the New York Times, Bloomberg spoke to Martin J. Muench, who is managing director of Gamma International, and he stated that they had not sold their product to Bahrain and the malware that was found must have either been a stolen demonstration copy, or reverse-engineered by criminals.

To be clear, the use of this software is highly questionable. A while back the Dutch Minister of Safety and Justice Ivo Opstelten revealed that a plan was in the works to change the law so that it became allowed for the Dutch police to hack systems belonging to suspects. This led to international resistance and an open emergency letter [PDF warning – Dutch] was sent to the Minister to have this plan terminated because it was a gross violation of privacy. Apparently Germany is already at least one step further than this, having purchased the software already. Is this the future for the Netherlands as well? Will Minister Opstelten dust off his ill-advised plan and follow Germany in purchasing this software? I hope not. Not only is the Dutch police severely understaffed as it is, it also has a serious history of bending (or outright breaking) the rules and violating people’s rights when it comes to (ab)using technology such as this. And just how long will it take before hacking a suspects’ computer will no longer require an approval from a court judge? Where is our oversight then?

The Dutch, the Yanks, the Cloud and YOU

Recently a research project by the Amsterdam University [PDF Alert] revealed that US law allows for the US government to access information stored in the Cloud, by (ab)using the PATRIOT act. Multiple Dutch politicians have started asking questions from state secretary Teeven of the Justice department as to whether he knew about this before the research project, and whether he did anything to prevent this or to warn Dutch citizens about this potential breach of privacy. He has since sent in an official answer. Unsurprisingly, he confirms that the issue is real, but does not answer the question about whether he knew about this beforehand. He goes on to saying that it is up to each individual to be careful with any information they publish online, be it to a cloud-based service or anywhere else.

What surprises me, is that people still don’t seem to understand what the Cloud is, what it does and how it works. The effects of the PATRIOT act have long been known, and its effects have been hotly debated for years. How is this any surprise to anyone?

Please follow this logic:

The Cloud is the Internet. It really is that simple. Cloud Services are simply applications that run on clustered computer systems. Maybe on two, ten, a hundred or a thousand systems at a time, it doesn’t matter. Users –and data- are replicated to every system in this cloud regardless of where they are. There could be ten in your own country, twenty in the US and another fifty in Russia. This is (most often) invisible to the end user, and very often special effort is made to keep this invisible to the end user, and to make it one big system regardless of what server you are connecting to, or from where. To be on the safe side, you should assume that regardless of where you are located when you upload data, it is uploaded to the entire grid – not just the part in your country.

And it matters where these systems are located geographically, because that is the only factor in the question as to what country’s laws this system –and more importantly the data on that system- is subject to. For example: Google has servers dedicated to Google Docs in a lot of countries such as the Netherlands, Germany, Britain, the US and probably several countries in Asia. You upload a document to Google Docs while in the Netherlands. As soon as you do, it is replicated to either all the systems all over the globe, or replicated between central data storages all over the globe. It is generally safe to assume that your data will be everywhere, regardless of where you are. ANY country that has Google servers for Google Docs within its borders can in theory –this depends on what laws exist in said country- demand access to this data. The US is almost certainly not the only government that can do this, but even if no other country has such laws, you can rest assured that if the need ever arises (from a national security standpoint) to access your data, things tend to get very ‘flexible’ on very short notice in most countries. Therefore you should assume that you can not trust any online service with your data, regardless of its classification or nature.

As has always been the case, in the end you –and only you- remain the only person responsible for what happens to your data. If you absolutely do not want it leaked, don’t put it on the internet.

Two Million Budget for Dutch Cyber Operations in 2012

Records posted by the Dutch government reflect that the Armed Forces budget for Dutch cyber operations in 2012 has been estimated at 2 million euro´s. A small sum, but still a considerable one in the face of ongoing budget cuts at the Dutch Ministry of Defence. The money is intended to reenforce the Defence department´s digital defences and to develop the capability to partake in “cyber operations”.

According to the published information, Dutch cyber operations capability will be developed in stages. Focal points will be the improvement of defences of its networks, systems and information, and the expansion of capabilities in Cyber Intelligence. The budget is listed at € 2 million in 2012, but the total budget between 2012 and 2015 will be closer to € 50 million. Most of the larger plans for the upcoming years are dependant on the sale of material and real estate, but the monies involved with cyber operations are small enough to have been allocated regardless.

One has to wonder though, with all that has been going on these last few years, what exactly will be done with a mere € 2 million for an entire year. This would pay for roughly 10 people and some hardware. What exactly will they be doing in 2012, and more importantly: How will they be spending the remaining € 48 million over the next 3 years? Sadly, this is not really mentioned in the budget discussions. All that is stated is that effort will be put into the new National Cyber Security Center that was recently stood up, and that there are two JIP´s (Joint Investment Program) of interest: One about Unmanned Aerial Systems (UAS) and one only referred to as ´cyber security´.

Last year, the Dutch military CIO Maj.Gen. Koen Gijsbers held a speech at InfoSecurity.nl, a Dutch conference on information security. While giving only limited information, at least he was there to answer some questions. This year no such opportunity seems to be planned, which leads me to believe that 2012 might be a very uneventful year for actual Dutch cyber operations.

Dutch Minister of Defence: Cyber to get its share

Dutch Defence minister Hans HillenConfirming earlier official documents published by the Dutch government, the new Dutch Defence minister Hans Hillen re-stated that the Dutch armed forces will indeed be spending part of its budget for 2011 on Cyber Warfare related activities. This confirmation can be found in the online transcript of the debate.

The relevant paragraph containing said confirmation reads:

<…>”And then there are the technological advances. Right now we’re faced with Wikileaks. You can judge this all you like, and they do so gratuitously in America, but at the same time this acts as a severe warning about leaks in information flows. If WikiLeaks can do it, others can too. Apparently our connections are vulnerable too. This should be a warning for us to be more careful. Cyber Warfare will be a far greater point on our agenda tomorrow or the day after that. “

<….> “I have one more topic that goes to Personnel, but also to decisionmaking. Its about the furnishing of Defence and involves Cyber. I don’t want to spend too much time on this, because I still have some decisions to make, but Cyber will receive some serious attention. It will be discussed with positive light in the upcoming policy letter.”

I don’t suppose that this would be the time to point out to Minister Hillen the finer points about Wikileaks, in that Wikileaks itself was not the perpetrator of the leak but the receiving party. Instead it was 22-year-old US Army intelligence analyst PFC Bradley Manning who leaked classified information (to which he had access without breaking in) to Wikileaks. Since this is a matter of internal security and vetting of your personnel, something I hope the Dutch Defence department already does as a matter of standard, I fail to see how this relates to Cyber spending but I digress. Any progress is progress and The Netherlands can surely need it.

Dutch Dept. of Defence CIO speaks on Cyber Warfare

Major General Koen Gijsbers(Apologies for my tardiness regarding the posting of this information, I was too engrossed in work to post this sooner. I had planned to see this talk of Major General Gijsbers myself, but I was denied access at the door due to too many people already being in the room. Therefore the information below is gleaned from an article on security.nl (in Dutch) and the (Dutch) slides he used during his presentation.)

Maj. General Koen Gijsbers spoke at the InfoSecurity convention in Utrecht on november 4th this year, and his take on Cyber Warfare confirms a lot of what I previously posted. Regardless of budget cuts, the Dutch Department of Defence still wants to invest in the development of cyber warfare capabilities. “Our citizens expect that if everything stops working in the Netherlands, the army will come in and help out. For that to be possible, our networks need to remain operational.” he said during his presentation. “However, we are not just investing in defence. If you only defend yourself, you’ll eventually lose the war too.”

Gijsbers went on to say that the most gain can be had in cyber defence, even though the Defence network is already heavily secured. Another major point they will be focusing on is Awareness. “The main point is that people need to be aware that there are consequences to their actions”.  For instance, USB sticks are strictly off-limits around confidential systems. In those rare cases where they are allowed, they use encrypted USB sticks. Gijsbers goes on to note that it doesn’t even matter what is on the sticks. “Whether there is useful information on the sticks is irrelevant. If someone finds a DoD USB stick they can read, even if it’s useless information, your image is damaged severely.”

When asked if the Netherlands possessed offensive cyber capabilities, the General noted that there are several countries that are being suspected of having offensive capabilities. None of them ever publicly admitted it, and he wasn’t about to be the first. He did add that you need knowledge of offensive capabilities to defend yourself properly, so we can safely assume that there will be some research on offensive capabilities going on.

Unlike some other countries, the Netherlands doesn’t have a specific battalion for cyber warfare. This may change in the future. Its one of the things currently being considered by the ministry, Gijsbers said. “In this day and age you have to compete with other capabilities, and the budget is getting cut. We may develop special cyber warfare units in the future.”.

When asked how the General felt about privacy and control issues currently being debated, he stated that the army has no intention to control the internet. “We’re not in charge of the Internet. Its just another theatre we operate in, and we have to accept that as it is.” He went on to say that the government shouldn’t try to solve every problem. “There’s a line between the government, citizens and corporate entities. We all have to chip in.”

He wasn’t opposed to cyber reservists; volunteers that help in securing systems. Estonia created such an organization of reservists after the cyber attacks in 2007, and the US also has a large core of such reservists. “I think its a great idea. Its a great idea because there are a large number of reservists that were actually trained by the army at some point, and have the capabilities to help us. The question is how to organize something like this? ” He added that military knowledge probably wouldn’t become a requirement to help out, if such an organization ever came into existence.

Dutch government to design Cyber Defence doctrine

Cyber WarfareIn the past I’ve always said that the Dutch government needs to do more in the area of Cyber Warfare / Cyber Security because there didn’t seem to be too much going on. Our Defence department didn’t post anything about starting up a Cyber Command, nor was there any government activity to be seen. However, though it wasn’t easy to find, there does finally appear to be some movement on the horizon.

During a meeting about the 2010 Defence budget, members Knops (CDA), Voordewind (CU) and Eijsink (PVDA) established that there was no mention of Cyber Warfare in the budget. They note that Cyber Warfare is an issue of great concern, and submitted motion 32 123x nr. 66 (in Dutch) to start interdepartemental development of a Cyber Security Strategy and urges The Netherlands to start actively participating in NATO initiatives on the subject.

In a letter by the Minister of Defence (again in Dutch), Eimert van Middelkoop acknowledges that rapid developments in technology have also led to certain threats such as cyber crime and cyber warfare. He describes what is understood by the term Cyber Warfare and how it relates to his department, along with how various other ministries also have responsibilities regarding cyber security issues.

A brief overview:

  • Interdepartmental coordination of Cyber Security in general is handled by the Ministry of the Interior through the National Security Program;
  • Cyber Crime is handled by the Ministry of Justice;
  • Cyber Terrorism falls under the National Coordinator of Counter-Terrorism (NCTb);
  • Cyber Defence is a shared responsibility between the Ministry of Defence and the Ministry of the Interior;
  • National Critical Infrastructure is handled by the Ministry of Economics

Minister van Middelkoop asserts that commercial parties also have a role to fulfill in the development and implementation of a cyber security strategy, to which I can only wholeheartedly agree. The next paragraph of this most clarifying letter confirms the existance of the Defence departments’ own CERT (DEFCERT), and its responsibilities towards defending its networks. In a separate letter he mentions that DEFCERT is growing and is expected to be fully operational in 2012.

Probably the most important information that can be obtained from this letter is in the final paragraph. It contains The Netherlands’ intentions in this area, which resemble those of Great Britain:

  • Creation of a Cyber Defence doctrine and implementation of a strategy;
  • Development of a Cyber Incident Responce strategy;
  • Investigation of Cyber Intelligence Gathering and the legal ramifications thereof;
  • Establishment of bilateral communications and best practices with NATO and the CCDCOE in Tallinn, Estonia

Compared to what has been released by the Dutch government on this topic, its a lot of information that suddenly became available. As a concerned Dutch citizen, I am very happy to see that this threat is finally addressed. With the dependency on technology growing every day, cyber security will continue to grow in importance along with it. If we do not work towards creating a safer cyberspace now, the consequences could be dire.