Stuxnet

Cyber attacks hit a new level of achievement  when the advent of stuxnet worm occurred.  This is the first time an internet worm has been used to attack a potential military target and will undoubtedly signal a new age of the potential of cyberspace in our coming future.

The year 2010 showed the first major known use of a worm attack against a specific target. The Stuxnet worm, which infected computers across the globe, was created to physically and not figuratively to destroy a specific military target: Iran’s main nuclear enrichment facilities. The goal of the worm was to target Siemens Industrial software and equipment, and specifically the computers which ran the main nuclear enrichment facilities. This was done by designing the worm to activate only in the presence of a precise configuration of Siemens controller, which exist only in a centrifuge plant.

The Stuxnet worm was designed to be hidden, dormant or a long periods of time. The end objective, which the worm successfully carried out was to accelerate the spinning rotors in the centrifuges beyond bust frequency causing the bearings and the tubes of the rotors to break .The worm also had the ability to send out a “man-in the middle code” which actually transmitted false industrial process control signs, completely masking the actions of the worm from detection of the diagnostic systems .

This man in the middle code prevented the safety system from responding, which would have saved the centrifuge by shutting it down before it could self destruct Israel and the United States, the countries likely responsible for development and implementation of the worm, caused Iran to believe that both countries initiated the first stages of cyber war, resulting in the creation of a new Iranian cyber command to prevent a future Stuxnet worm.

As a consequence, Iran has out right stated that part of their cyber command will be the development and implementation of “retaliatory measures” against scores of nations that Iran sees as hostile to their interests, Israel and the United States chief among them. This example is important since it shows the first time a cyber attack has been used to tangibly destroy a physical object that was arguably secure  and emphasizes that possibility for the future. The example also emphasizes the   escalation of conflict  with Iran and promotes evidence that a cyber arms race could come in the future, if cyber attacks are being used against secure state facilities.

Stuxnet is probably a small sign of what is to come and may prove to be the single catalyst of the true nature of the cyber security crisis yet to unfold despite skeptics claims.

Cyber Attack Advantages

Whether or not society, politicians, or the military agree that true cyber warfare will take place in the future, or cyber terrorism, undoubtedly there are key advantages that will entice the forces of criminals, governments, hackers, activities, and terrorist to continue to pursue cyber attack tools as part of their agenda, leaving many vulnerable to exploitation or worse.

Aviram Jenik, the chief executive officer of Beyond Security names several distinct criteria as to why cyber attacks hold unique  advantages in an article entitled “Cyberwar in Estonia and the Middle East.” The first reason is that a cyber attack can be selective and the ramifications controlled. A cyber attack could target a nations entire economy without necessarily destroying the critical underlying infrastructure or be used to target the nation’s infrastructure along with its economy. An economic attack may paralyze civilian life, weaken the state through loss of economic productivity and create public panic.

The second advantage, is that a cyber attack can executed in an “completely painless form” for the terrorist because an attack can be launched at the press of a button, and does not need the deployment of several operatives, which would heighten the risk of being caught by security forces.  This tactic has distinct advantages in terms of cost and visibility. The attack can be theoretically lethal with little warning and requires less effort to get past security barriers at places like airports, which may derail an operation. In addition, the operative that triggers the attack has the ease of a global expanse, able to launch  the attack  from a number of places not constrained to borders, essentially  gaining the flexibility to attack from any place in the world.  An attack at “ a click of a button” may be programmed to occur at a certain time or only if a certain logical condition is met. This enhances both the flexibility and the opportunity of the attack while increasing the likely hood of success.

Low cost is the third advantage, since “a 21 000-machine  botnet can be acquired for  just a few thousand dollars, and yet cause damage and disruption easily worth hundred of times that,.” This eliminates the cost of conventional weapons and operational risk. The fourth reason is that law enforcement and cyber security is not adequate to protect a nation’s cyber borders from these type of attacks.  A DDoS attack may be thwarted by upgrading fire walls yet no nation, save a highly totalitarian regime, currently has the legal authority to order its ISPs, telecommunications companies and other online businesses to take protective measures like installing firewalls, leaving a country vulnerable to cyber terrorism.

These advantages are concrete, real and vital attractions to cyber perpetrators, along with state and non state actors alike, being especially solidified by the fact that governments cannot effectively coordinate amongst each other or often, even internally on the nature of cyberspace security. With exponential rise  in technology, it is likely more and more actors will see the benefits of cyber attacks in the new cyber world to come.

The Plight of SCADA systems

For the past several years many politicians and security experts within both North American  have warned of “cyber war” and the potential vulnerability to national infrastructure.  Although this may seem extreme, and perhaps fear mongering with the agenda of enhancing security over personal liberties, I believe there is a growing need for concern because of the systems that control many of the western world’s infrastructure. These systems called SCADA, have often been cited as a critical security vulnerability to a cyber attack and with good reason.

Supervisory control and data acquisition or SCADA systems as well as digital control systems otherwise known as SCADA systems, which originated in the 1960s are mainly used for controlling a particular process or monitoring a certain process.  For example, all major water system authorities in the U.S have these SCADA systems. They work on site automatically and need no human controller by collecting data from sensors in devices used for industrial processing and then storing this data.

The vulnerability  of SCADA systems remains high since nearly all SCADA systems are accessible through the internet to saves cost but in doing so increases vulnerability . SCADA systems are involved in an array of vital infrastructure control  including electricity, oil, gas, water treatment, waste management, and maritime, air, railroad and automobile traffic control industries,  as well as telecommunications including 911 emergency calls. The vulnerability to cyber attacks is alarmingly high, because  the small drone like computer systems have virtually no security, firewalls, routers, or antivirus software to protect them whiling being  spread across a nations infrastructure , even in some of the most remote places imaginable. Furthermore all industrial control systems have long life cycles often 10 to 20 years and older systems were originally designed with no idea that terrorists would conceivably target infrastructure through cyberspace or with any concept of terrorism at all, and thus have little to no cyber-security, and also happen to be interconnected in ways never originally intended.

Some evidence exists that Al Qaeda is evolving into the cyber attack world as plausible option for future operations. Laptops recovered from Al Qaeda operatives held critical information on program data and software sites for SCADA info, giving alarm to the already theorized and now credible threat of a cyber attack on such systems, creating a security dilemma for the future of our infrastructure.

Cyberwar Threat

Cyber attacks have been successfully employed, enough to be an ominous window of potential threat with hazardous effects in the future.  The first wide incident of a cyber assault took place in Estonia in 2007. The incident was provoked by the moving of a bronze soldier memorial marking the burial site for soviet soldiers lost during World War II. Native Estonians saw it as a symbol of both Russian and Nazi occupation, while Russian immigrants, which constitute about 25% of the total population, saw it as a symbol of Soviet victory over Nazi Germany.

The controversial move sparked the worst riots the country had ever seen along with a massive DDoS attack by hackers traced back to Russia and likely the Kremlin .  Estonia, “one of the most wired societies in the world” saw its Internet infrastructure overwhelmed. Approximately 1 million computers worldwide were used, unknown to their users, to overwhelm the Estonian sites and services. The attack targeted government communications, banks, Internet service providers, newspapers and media, and even home users.  Estonia’s financial activity was crippled, as bank websites became unreachable.  Emergency lines were knocked out for hours.

The cyber attack shutdown these services not for a few days, but for two weeks.

More recently a warning came on October 11, 2012 from United States Defense Secretary Leon Panetta, who aimed for new legislation on capitol hill against cyber terrorism, expressed alarming concern over the potential for cyber attacks. Warning of a “cyber Pearl Harbor,” Panetta stated the attack could be a   “cyber-Pearl Harbor that would cause physical destruction and the loss of life, an attack that would paralyze and shock the nation and create a profound new sense of vulnerability.

Penetta’s words help solidify that cyber war is possible and that Estonia may very well be an ominous demonstration of things to come. It clearly represents the threats imposed on wired societies and the capabilities that both countries along with non-state actors may have. As societies around the world continue to become more wired and dependent on cyberspace, the threat of cyber war to possibly take down entire economies will increase undoubtedly posing harsh questions to global governance and international security.

No Clemency For Snowden

Last week, Edward Snowden  asked for clemency from the United States Government and to “no longer be treated as a traitor.” The damage he has done to the international community, to trust in authority has been significant, and although the government may act unethically it was not Snowden’s right to leak classified intelligence to anyone.

In the NY times article, Snowden insists “my government continues to treat dissent as defection, and seeks to criminalize political speech with felony charges that provide no defense. However, speaking the truth is not a crime. I am confident that with the support of the international community, the government of the United States will abandon this harmful behavior.”

He further argues that “systematic violations of law by my government that created a moral duty to act,” have had positive effects.”

Snowden had a responsibility to confidentiality. He was arrogant and rash and could not have possibly comprehended the negative impacts that his “revelations” may have. He compromised national security which could cost lives in the future because of the scope, magnitude, internal complexity of national security. One person’s act may have long lasting ramifications on the lives others and therefore speaking the truth is a crime.

Certainly any government can act hypocritically or break the law, but the world is becoming more integrated and complex. If Snowden believes that other countries aren’t trying to do similar things or achieve similar techniques, then he is a fool.

The hypocritical irony to this debacle is that Snowden received free speech awards in Russia, a country that actively prosecutes free speech, kills journalists, eliminates protests, and is notorious for its intelligence agencies (former KGB now SVR and FSB) and their ruthlessness.

If Snowden actually believes he’s helping anyone, he is wrong and narrow minded. Thus far, Snowden has only helped to ensue mistrust among allies who actively spy on each other even if it is not public, and strengthen the intelligence and cyberspace arms race among enemies of the United States and its allies.

Meanwhile, Snowden has loss perspective on all the human freedoms found in a democracy like the United States in hopes to encourage the delusion of perfection while serving as a PR puppet to the Putin Regime, enhancing both the authoritarian state of Russia from within and abroad.

Snowden is delusional and deserves no clemency especially since he has lost the perspective that many intelligence agencies across the world do equal if not far more sinister activities in the name of power.

“No Woman, No Drive”

Social reform is making another twitter scourge in efforts to change social policy, this time in the hard pressed conservative backdrop of Saudi Arabian society.

The movement is called Women2Drive on twitter and it is making quite the grass root stir amongst Saudi women who, by law, are not allowed to drive and must hire a male chauffer or find a male relative to drive them.  Sick and tired of what many women view as an unnecessary social injustice, a few brave women with foreign drivers permits took to the roads and filmed their protest on youtube for a call to more action.

In Saudi society, conservative men have viewed driving as a hazard to women with one cleric going as far to say that the position women are put in while driving could damage their ovaries.

The breaking of the ban is not considered to be a full out protest since it does not involved gatherings, rallies or procession of cars. Protest are inherently illegal in Saudi Arabia.

Women2Drive has resulted so far in five women posting youtube videos of themselves driving and with the campaign gaining leverage, the Saudi government reacted by setting up check points and increasing traffic patrols. Meanwhile, the official website of the campaign was hacked and displayed a background of image of an ominous red lighting bolt stating “Reason for the hacking: I am against women driving in the land of the two holy shrines.”

Both the upgrades in traffic patrols and the website hacking in my opinion serve to boaster the legitimacy of the movement and give the movement more wide spread notoriety. That argument is also reflected in that fact that three women in the Shoura Council, which advises the government on policy said the Transportation Ministry should consider letting women drive just this month.

Here, I think social change through cyberspace tools may once again be possible if carefully done, since the objective is specific and the concession is a relatively small one compared to other problems which people could choose to protest over. Even some Saudi newspapers have allowed editorials to be published that were  pro-women driving which says that this particular issue is a salient national issue that can not only be challenged by an independent movement, but by forces that have more creditability inside Saudi Arabian culture.

Meanwhile other activists have taken to YOUTUBE with a more  humorous approach, the key video being called “No Woman, No Drive.”

Internet Neutrality

In the freedom of western democracies, the issue of internet neutrality is an important and crucial notion that is coming under increasing threat, as both companies and governments begin to strengthen their grip on our cyberspace freedoms.

The basic idea of internet neutrality is that users should have the ability to access any web content they chose, use any applications they choose free of restrictions or limitations their internet service provider may impose. In addition, Berkley adds “that no bit of information should be prioritized over another.  This principle implies that an information network such as the internet is most efficient and useful to the public when it is less focused on a particular audience and instead attentive to multiple users.”

Like China, the use of censorship could impose a threat to internet neutrality, but in many ways unlike China, the threat of blocking or prioritizing content could come from internet services providers in the west of their own free choice, and unknown to many people this is happening in democratic countries. Internet providers themselves have the ability to, prioritize or block, or even slow content to giver their services an advantage over others.

Legally, there have already been cases filed in regards to the idea and freedom of internet neutrality. In 2005, the US Federal Communications Commission actually sanctioned a rural telephone company named Madison River Communications for blocking its DSL customers from making phone calls over the internet. The industry has a whole argues that it should be able to block anything which may infringe on the broad and vague term of “quality of service.” In theory this could mean that a provider may chose to block a search engine like “Yahoo” or “Google” in favor of its own.

The industry also argues that upstarts like Facebook, Google and Yahoo have taken advantage of internet service providers capital infrastructure to make billions of dollars. The incoming AT&T CEO  went as far as saying that upstarts like Google would like to “use my pipes free, but I ain’t going to let them do that because we have spent this capital and we have to have a return on it.”

Just this year a landmark net neutrality court case tested open internet rules, with Verizon bringing a federal court case against Federal Communications Commission. Verizon argued that the Federal Communications Commission lacks the authority to enforce the rules they established and that provisions established by the FCC violate the companies first amendment rights of free speech.

Cases like these should bring and keep the important debate and issue of  internet neutrality  alive and well. Organizations in both the United States and Canada have websites devoted to the cause and public knowledge of the cause. The public must continue to be informed on this issue as the world progresses onto the new terrain of cyberspace. Otherwise the freedom of content could easily be endangered.This is especially important since private companies which can consolidate so much power and influence are rapidly moving into cyberspace and will attempt to create their own advantages in the name of profit while challenging the intellectual and user freedoms of netizens across North America.

While it is encouraging to see court cases like the 2013 Verizon case light up this issue in the public sphere, much more action needs to be done to inform the public of what the idea of net neutrality really is, the impact it has on all of us, and the threat it is now under.

 

Social Media and Espionage

The news regarding United States surveillance programs and potential to violate privacy continues to show the tip of the ice burg. The Edward Snowden case has revealed new questionable abuses of power by the NSA.

Facebook and the phenomenon of social media, where many of us post our thoughts, photos, check in locations, plan events, and make connections, is now part of The NSA espionage tactics as revealed the week of September 28th 2013. It appears that NSA uses massive collections of electronic data to create a graphic analysis of some American citizen’s social connections, which includes travel, location, associates, as well as Facebook.

Even Mark Zuckerberg reacted to the revelations  with NBC summarizing his point of view that “revelations about U.S. government surveillance hurt users’ trust in Internet companies and that knowing more about the programs would help relieve some of the public concerns.”

There are growing and relevant concerns about the NSA prying into our communications and social media. Foremost among then is the potential for abuse and Facebook, with its ability to illustrate a picture of persons life, past, present and future, as well as the converging amount of personal information, definitely seems like a paramount target for abuse.

As also reported by NBC News, revelations recently surfaced that NSA employees were actively abusing their power and privileges by spying on the communications of their significant others, completely violating their own work agenda and proper conduct to use their tools in order to spy on terrorist suspects and international criminals.

Again, this raises the question of how far governments are willing to go, and how easily people in power can give into the temptations that come with power. It’s likely that spying on significant others is more wide spread than what has been revealed by the NSA and in any case, the public’s privacy continues to be undermined, questioned and most likely abused.

People should also question what information companies like Facebook are willing to sell or give the government as well as private entities.Perhaps the more ominous question is if the country or world were induced into a state of emergency or another 9/11 like attacked occurred, how many people would become innocent victims of the onslaught of privacy? Would people be detained on partial or circumstantial evidence based on Facebook connections?

The public should be questioning both the United States government and Facebook in regards to privacy, transparency and their right especially at time when so much information is coming forth because if left unchecked, personal privacy make become a victim of circumstance at the cost of many whether innocent or guilty.

 

 

The Ethics of ECHELON

With the recent controversy over Edward Snowden and his leaks regarding government surveillance, it is hardly astounding that a international communications espionage program headed by the united states would be in existence, but what is truly astounding is the publics’ seemingly oblivious knowledge of such a system and the sparse lack of attention that is paid to it even after controversies such a wiki leaks, anonymous, and Julian Assange, and Edward Snowden.  An even larger problem remains the disturbing lack of ethics revealed by the existence of such a program that is the coordination of multiple countries.

The program is called ECHELON and scholars in law have studied the programs existence before, however to many it is not common knowledge. According to scholar Lawrence Sloan in an article in the Duke Law Journal “Echelon and the Legal Restraints on Signals Intelligence”, ECHELON is a worldwide communications espionage effort. It is a joint project by the National Security Agency in the USA along with its counter parts in the United Kingdom, Canada, Australia, and New Zealand. Scholars like Sloan believe that ECHELON intercepts all forms of global communication, from telephone communications, to the Internet to satellite data transmission as well as high frequency radio, microwave radio relay, and subsea cables.

The purpose of this spy network is to comb communications for messages related to terrorism and international crime. Although Britain and America deny such a system exists, BBC News obtained confirmation that ECHELON is a reality from the government of Australia and their Inspector General of Intelligence and Security Bill Blick.

It is a tool that can easily be abused and in Europe allegations were surfacing that the system could be used to conduct illegal economic espionage on behalf of American companies to give them an advantage over their foreign competitors. Scholars already believe ECHELON has the likely potential of being used to spy on individual citizens.

ECHELON truly does represent a viable threat to personal security despite the claimed purpose. Invasion of privacy is a paramount concern, since the project seems to operate in absence of the law and order of international regimes and personal liberties of both the citizens who the agencies claim to be watching out for, and those of foreign citizens as well.  ECHELON truly takes Big Brother to an unprecedented level, standing as a hypocritical tool for nations that claim to protect the rights, liberties and freedoms of their citizens. These rights and liberties have already lost ground in the post 911 world, but one was wonder how far is too far. ECHELON begs the question, to what end will governments go in the name of “fighting terrorism”? How much more ground will our personal liberties have to give in this new era?

By merely existing this type of system may be a threat to democracy. The system itself has no moral compass for rights and wrongs; that is placed entirely in the hands of the systems operators and directors who are consolidating power with such a tool. One wonders what would happen if dictatorships and autocracies like North Korea, Iran, Syria, and Russia were to create a similar project together, or other countries as well.  Cyberspace and personal privacy could prove to become the battleground of information warfare. Thinking about how many regimes arrest, in prison, detain or kidnap private citizens already for dissent, a tool like ECHELON could expedite and simplify those highly unethical practices.

The public needs more disclosure on projects like ECHELON or personal and cyberspace privacy may very well become virtues of the past.

Democracy Beware: The Internet is No Guarantee of a Democratic Utopia

Although many scholars and people may have hoped for social media and cyber space to bring a brighter democratic future for the entire world, I happen to believe that the internet democratic utopian idea needs a much more cautious approach and more complex analysis. I believe these technologies are tools, which can be used to enhance freedom but also to consolidate power and influence and still must compete with long held institutions of power in many parts of the world.

Arguably Internet and the phenomenon of social media have given voices to those who would otherwise not be heard and in some cases allowed for significant mobilization in the name of democracy. The Internet and social media are undoubtedly powerful tools, which was ultimately proved in the Arab spring uprising, providing a tremendous platform for mobilization with an initially unprecedented outcome and in some countries a form of effective change.  However, the fact remains that almost four years later, Egypt has not been able to obtain the democracy it desired, even with such a profound tool and Syria, which followed in the tides of the Arab Spring continues to engage in a decimating civil war.

Like Egypt, in many parts of the world the Internet and democratic mobilization must clash with long held powers of institutions making change no quick agenda.  Russia faced a wave of protests against Vladimir Putin with little to no avail and Putin’s regime remains strong. As an article in Maclean’s magazine mentioned there is a popular widespread discontent among Russians with Putin and the government, but people feel powerless to change it and those who are leaving the country actually strengthen the regime.  In the case of Russia, social media and the Internet and mobilization can only go so far against the regime, state control and brutal crack down on protestors.

urther more those who want to consolidate and keep power, like Putin and the Kremlin understand that social media, multimedia, the internet and related integrated information technologies are tools to use at their disposal as well. As the Faris and Etling Article “Madison and the Smart Mob” states, the Kremlin deployed pro-Kremlin bloggers to debate critics of Putin, and Russia’s most popular blogging platform “Live Journal” was bought by a Putin ally. Further more the Kremlin established soviet like era “Pioneers” pro-Kremlin youth group, called Noshi (Ours) to establish a stronger public opinion amongst Russian youth and to counteract dissidence, all who are cable of deploying and using cyber technologies for their organization’s agenda.

The Internet is never a source of guarantee in fostering the growth of human rights.  The internet in Russia, which is relatively free despite state control of print media, for example, has done little to curve the culture of hate and discrimination to gays and lesbians bringing into question the ability of cyber information to improve human rights in countries that fall under authoritative regimes and have long held cultural mistrusts.  Despite access to educational resources through the Internet, some polls suggest as many as 84% of adults disapprove of homosexual relationships and laws like the “anti-gay propaganda law” pass with high favor in public opinion.

There is no doubt that in already democratic countries with rules and norms open to fair and free political process and public speech, cyber space and social media can increase democracy but for many parts of the world it is still the wild west as well as tool of power to be harnessed. It is important to remember that extremists groups and terrorist groups like Hezbollah and Al Qaeda have used cyberspace and multimedia as propaganda and public opinion weapons to win favor of people in their embattled regions. Often they use strategies which directly target youth through messages spread in rap videos and in the case of Hezbollah, online combat training games one which ended in the player receiving an award for assassinating Israel’s Prime Minister Sharon, among many other cyber tools and websites engineered to engage other segments of the population as well.

In Democratic societies money and influence can still create favor and consolidate power in cyber world where so many voices constantly stream. Companies and organizations with access to resources and educated people can still create a larger voice which might be heard over others.  Companies and social media can also buy and sell your information at will with little penalty and even private citizens can easily access the information of others even going as far as to use Google earth to actually locate an image of the home where someone lives. My thought is if private citizens are able to do this, one wonders what governments may be cable of.

It is important to remember that the Internet and cyberspace are tools, and although in some areas of the world, democracy has been positively affected by this revolution, these tools are at the disposal of anyone who has the knowledge and expertise to utilize them and can easily be misused and abused. Democratic change through cyberspace may prove to be a slow and uncertain process in many parts of the world where the mobilized numbers will still have to clash with the power and strength of long held institutions, which are also extending their reach onto cyberspace.

Cyberspace is no democratic utopia; it is simply the next frontier.