The Russians have had access to a considerable number of important and sensitive networks for six to nine months. The Russian S.V.R. will surely have used its access to further exploit and gain administrative control over the networks it considered priority targets.
...
While all indicators point to the Russian government, the United States, and ideally its allies, must publicly and formally attribute responsibility for these hacks. If it is Russia, President Trump must make it clear to Vladimir Putin that these actions are unacceptable. The U.S. military and intelligence community must be placed on increased alert; all elements of national power must be placed on the table.
Where are the carriers? Man the guns! Put the nukes to Def Con 1!
Rep. Jason Crow @RepJasonCrow - 15:09 UTC Â · Dec 18, 2020The situation is developing, but the more I learn this could be our modern day, cyber equivalent of Pearl Harbor.
This is lunatic. From all we know so far the so called 'hack' was a quite nifty cyber-intrusion for the sole purpose of gathering information. The intrusion has, as far as we know, not even reached any systems on the specially protected 'secret' networks. This was a normal spying operation, not an attack. To compare it to a deadly military attack like Pearl Harbor is self-delusional nonsense:
The lack of self-awareness in these and similar reactions to the Russia breach is astounding. The U.S. government has no principled basis to complain about the Russia hack, much less retaliate for it with military means, since the U.S. government hacks foreign government networks on a huge scale every day. Indeed, a military response to the Russian hack would violate international law. The United States does have options, but none are terribly attractive.The news reports have emphasized that the Russian operation thus far appears to be purely one of espionageentering systems quietly, lurking around, and exfiltrating information of interest. Peacetime government-to-government espionage is as old as the international system and is today widely practiced, especially via electronic surveillance. It can cause enormous damage to national security, as the Russian hack surely does. But it does not violate international law or norms.
...
Because of its own practices, the U.S. government has traditionally accepted the legitimacy of foreign governmental electronic spying in U.S. government networks. After the notorious Chinese hack of the Office of Personnel Management database, then-Director of National Intelligence James Clapper said: "You have to kind of salute the Chinese for what they did. If we had the opportunity to do that, I don't think we'd hesitate for a minute."
One can not spy on other countries and then complain when they do something similar to oneself. Responding by waging destruction against another country's IT systems only guarantees that there will be a response in kind. If one wants to avert cyber-espionage and cyber-attacks there is only one way out.
We do not know if Israel, China, Russia or someone else is responsible for the recently discovered intrusion. But it is safe to assume that Russia's SVR is working on comparable projects just like the spy services of most other countries do.
But Russia has, in contrast to others, for years asked for bi-lateral treaties to prohibit malicious cyber operations. In September President Putin again offered one:
One of today's major strategic challenges is the risk of a large-scale confrontation in the digital field. A special responsibility for its prevention lies on the key players in the field of ensuring international information security (IIS). In this regard, we would like to once again address the US with a suggestion to agree on a comprehensive program of practical measures to reboot our relations in the field of security in the use of information and communication technologies (ICTs).
...
Third. To jointly develop and conclude a bilateral intergovernmental agreement on preventing incidents in the information space similarly to the Soviet-American Agreement on the Prevention of Incidents On and Over the High Seas in force since 25 May 1972.
...
We call on the US to greenlight the Russian-American professional expert dialogue on IIS without making it a hostage to our political disagreements.
Even conservative U.S. lawyers agree with Putin that such a treaty is the only way to protect the U.S. from potentially damaging operations:
Despite many tens of billions of dollars spent on cyber defense and deterrence and Defend Forward prevention, and despite one new strategy after another, the United States has failed miserably for decades in protecting its public and private digital networks. What it apparently has not done is to ask itself, in a serious way, how its aggressive digital practices abroad invite and justify digital attacks and infiltrations by our adversaries, and whether those practices are worth the costs. Relatedly, it has not seriously considered the traditional third option when defense and deterrence fail in the face of a foreign threat: mutual restraint, whereby the United States agrees to curb certain activities in foreign networks in exchange for forbearance by our adversaries in our networks. There are many serious hurdles to making such cooperation work, including precise agreement on each side's restraint, and verification. But given our deep digital dependency and the persistent failure of defense and deterrence to protect our digital systems, cooperation is at least worth exploring.
Dreams of being able to prevent intrusions on one's systems while insisting on intruding the opponent's systems are just that - dreams. There is likewise no reasonable way to deter an adversary from using such methods to gain an advantage.
To blame, without evidence, Russia for a 'hack' and to incite against it will not solve the above problems.
The only way to prevent potentially dangerous cyber-operations is too agree with adversaries on what is off-limits and to (verifiably) stick to that.
Posted by b on December 19, 2020 at 19:29 UTC | Permalink
(Note: You can view every article as one long page if you sign up as an Advocate Member, or higher).
