Senate stalls cyber commander to probe digital war

When hackers a continent away attack a military computer system, using computers belonging to unsuspecting private citizens or businesses as cover, what are the rules when the U.S. fights back?

As U.S. officials struggle to put together plans to defend government networks, they are faced with questions about the rippling effects of retaliation. Taking action against a hacker could affect foreign countries, private citizens or businesses -- ranging from hospitals to power plants -- whose computers might get caught up in the electronic battle.

Difficult questions about how and when the U.S. military conducts electronic warfare have stalled the creation of the Pentagon's Cyber Command for months as senators dig into such scenarios involving the rules of the digital battlefield, according to congressional officials.

Government leaders have grown increasingly alarmed as U.S. computer networks face constant attacks, including complex criminal schemes and suspected cyber espionage by other nations, such as China. But the nation's ability to protect its networks and respond to attacks are largely kept secret because of national security concerns and the government's slowly evolving cyber security plans.

Electronic warfare by U.S. forces is not new. For example, in the Iraq war, U.S. forces jammed cellular phone networks in Fallujah in 2004 to disrupt communications between enemy insurgents, and interrupted radio signals designed to trigger roadside bombs.

But U.S. officials refuse to discuss any current offensive cyber operations or monitoring, particularly anything that involves other countries or terror organization. businessweek

McAfee: U.S. Needs Clear Cyber War Doctrine

A recent study from McAfee on cyber crime and cyber warfare concluded that, like it or not, the world's information infrastructures are becoming theaters of war, as nations develop offensive and defensive capabilities to wage cyber warfare.

"Cyber weapons exist, and we should expect that adversaries might use them," said James Lewis, director of the Technology and Public Policy program at the Center for Strategic and International studies. Lewis is one of 2,000 national and cybersecurity experts who were interviewed for the study.

The threat of cyber war is not comforting, but more disturbing is the fact that we do not know how to use the weapons we are developing. Our ability to defend ourselves and to take the struggle to our enemies is hindered by the difficulty in understanding the sources and motives behind what might be considered hostile action against our networks and systems. Unlike attacks by conventional and nuclear military weapons, cyber attacks tend to be asymmetrical, remote and hidden. It is difficult to tell who is behind an attack and what its objective is. redmondmag

Report: China building cyberwarfare capabilities

WASHINGTON – China is building its cyberwarfare capabilities and appears to be using the growing technical abilities to collect U.S. intelligence through a sophisticated and long-term computer attack campaign, according to an independent report.

Released Thursday by a congressional advisory panel, the study found cases suggesting that China's elite hacker community has ties to the Beijing government, although there is little hard evidence.

The commission report details a cyberattack against a U.S. company several years ago that appeared to either originate in or come through China and was similar to other incidents also believed to be connected to the country.
SFGate

World War III Could Be Fought on Internet, Says ITU Head

Threats of cyberwar and a story of real violence rubbed shoulders at a news conference to mark the opening of the ITU Telecom World exhibition and forum in Geneva on Monday.

"The next world war could begin in cyberspace," warned Hamadoun Touré, secretary general of the International Telecommunication Union, the United Nations agency that organized the event.

The beginnings of such an unconventional war could be out of the control of conventional diplomacy, he said, because in cyberspace "there is no such thing as a superpower: Every citizen is a superpower." With an army of "bots," or compromised computers, at their command, almost anyone could wield great power in a virtual battle, as a number of recent denial-of-service attacks against targets around the world have shown.

"We know from conventional wars that the best way to win is not to start," Touré said.

That's why the ITU is pushing an ambitious worldwide program for cybersecurity and peace.

"By the end of next year, we will broker a global agreement with every country to protect its citizens online, not to harbor cyberterrorists, and not to start an online attack," he said.

U.N. Secretary General Ban Ki-moon began by expressing his sorrow at news of an all-too-real attack, the suicide bombing earlier in the day of the Islamabad, Afghanistan, office of the U.N. Food and Agriculture Organization, which left several people dead.

Returning to the theme of the conference, he highlighted "a world divided," those with access to information on one side, and those without on the other.

Encouraging the participation of "our youth, drivers of innovation and change," is vital if those divisions are to be eradicated, he said.

Investment in infrastructure and services must be encouraged too in order to eliminate the technology divide -- but the motive should be profit, not charity, Touré said.

"In our strategy of connecting the world, we have no need for charity: It's pure business. If you have the right business plan, you will have investment," he said.

The telecommunications industry will always have investment, because it's a profitable industry, he said.

That's turning out to be the case in Rwanda, said President Paul Kagame, where state infrastructure projects have attracted investment from Chinese network equipment manufacturers.

"The availability of capital for everything is getting more and more scarce, but in our country there is a strong partnership between public and private sectors," he said.

China continues to invest internationally, despite the impact of the global economic crisis and the attraction of the untapped potential of its home market, said Wang Jianzhou, chairman and chief executive officer of China Mobile, also present at the news conference.

"We have still got challenges from the international financial crisis," he said. In the company's home market, revenue from international calls is down 20 percent because of a reduction in tourism and manufacturing exports, he said.

PC World

We're losing the war on cybercrime

While we chase after two-bit malicious hackers, cybercrime syndicates remain untouchable...

You may have read the reports: We have captured Albert Gonzalez, one of the "world's biggest malicious hackers." Big deal.

I've been fighting cybercrime for more than 20 years, so you'll have to excuse me if I'm a little jaded for thinking that this "huge" hacker is but another small-time player in the big-time world of cybercrime. In fact, I'm pretty sure that we still haven't captured a single major player -- the Pablo Escobars.

We know there are large, corporate crimeware gangs that steal tens (if not hundreds) of millions of dollars from unsuspecting Internet victims each year. They have corporate headquarters that would fit the mold of the Fortune 1000. They have extensive payrolls, pay millions in taxes, and enjoy business growth that would be the envy of Wall Street. Yet we haven't prosecuted a single person from any of these big online cybercrime syndicates, and I have no reason to believe that will change over the next few years. We are getting better at prosecuting cybercriminals in countries such as the United States, but these large organizations are based in other countries, protected by those nations' political leaders.

Professional organized cybercrime started with the "king of spam" corporate giants in the late 1990s. These organizations often made millions under the guise of legitimate Internet marketing while sending billions of illegal e-mails. Many of the owners became and remained rich. They bought large houses and outrageous cars, got new beautiful wives, and sent their kids to expensive private schools. Heck, spammers aren't even considered in the top 200 spammers unless they are sending out hundreds of millions of illegal e-mails per day.

Despite all the time we've have to deal with the spam giants, we've done a poor job in shutting them down. Yeah, we certainly manage to close down a few token shops each year and even eventually get some of the bigger guys back into court for the umpteenth time. However, spam is more widespread than ever, compromising 60 to 85 percent of all Internet e-mail in any given month. It's also more profitable than ever.

But the cybercrime giants of today make the old spam kings seem like island-owning fiefdoms. The Russian Business Network (RBN) is a representative example of today's new crimeware leaders. (You know you've made criminal history when your criminal organization has a three-page entry in Wikipedia.) The RBN operates on a massive scale, perpetrating nearly every form of illegal online crime available. Nothing is out of bounds. It participates in child pornography, huge denial-of-service attacks, spam, botnets, malware development, and it hosts perhaps the largest online criminal network. The RBN leads multilevel marketing platforms that rival the heady days of Avon.

InfoWorld