In a shift of policy, US government indicates a willingness to approach cooperate in a United Nations forum to reduce the risk of cyberwar. In this item from the Washington Post, the US joins China, Russian, Brazil, and others. Witht he big actors in the field agreeing to talk, it is an interesting development. Problems of attribution, civilian vs. military use, and technological change persist, but moving from solely a cybercrime approach is interesting.

Definetely something to watch in the months to come.

Cybercrime or Cyberwar?

In the recently published Virtual Criminality Report 2009 McAfee asked if the transition from criminality to war has already happened, citing evidence that countries hostile to industrial democracies are involved in some of the more serious and sustained cybercrime. In response, McAfee said, “nation-states are arming themselves for the cyberspace battlefield.” McAffee CEO is careful to point out that experts disagree on the definitions of cyber war, but it is apparent that attacks are increasing in number and sophistication. Business, as well as government, must take steps to be prepared.

Georgetown University: Cyber Security, Law, and Policy

Georgetown University: Cyber Security, Law, and Policy

Posted using ShareThis

Excellent panel discussion on policy isssues surrounding cybersecurity in the US. Discusses the problem in getting Congress and the public to see cybersecurity as a risk and threat to national security.

Policy efforts have lagged in recent months as the White House and Congress are focused on healthcare and other issues.

Factual vice inflamatory. Pentagon leads the way as others stand and wait.

Cyber Storm III, practicing the policy

The US Dept of Homeland Security recently announced the date for Cyber Storm III. This third in the series event will be the first chance to test the Obama Adminstration's cyber security strategy.

As pointed out in the linked article it is a chance to test the policy issues of coordination between Federal and State/local government and between the public and private sectors.

An old dictum states that the the scene of a disaster is not the place to exchange business cards for the first time.

This will be an interesting project to follow, especially if the open it to international players.

Conficker and Cyber War

Two recent articles from the NY Times on Conflicker and the limitations of cyberwarfare point out the risks and paucity of tools to combat cyber threats.

Conflicker is complex and soundly designed worm program that has infected more than 6 million computers worldwide. Over 200 countries have compromised computers. Buenos Aires is thought to be one of the initial infection points. Even though fixes have been available since January 09, the worm continues to spread and even takes measures to protect itself!

The big problem is that no one (besides the maker/controller) really knows what it was designed to do. Someone controls more than 6 million computers that can be unleashed at will.

This brings us to the second article which discusses the limitations and controls on military (and by extension law enforcement) forces to take action. The same abilities that the hackers/malware types possess, the good guys have but they have to operate under rules of engagement and the norms of law and war. Is an attack via computer on a country's critical infrastructure and act of war? Dropping a bomb or launching a missile certainly is. A nation's power grid is a legitimate target for aircraft and missiles in a shooting war, wouldn't it be in a cyber war? What can be done in self-defense? The UN Charter permits self-defense under Article 52. Are we ready for wars fought with electrons?

Lots to ponder.