Thursday, 25 September 2014

Green light for GCSB as the internet becomes a weapon

According to a recent poll, Kiwi CEOs say cyber attacks are their second highest international concern behind the Australian economy. This is a remarkable display of prescience from the private sector with two recent events encapsulating the accuracy of our business leader’s fears.

As is becoming clearer each day, the internet is a domain in which every country sits directly in the centre. Last week’s political games attempted to expose pieces of New Zealand’s internet spying efforts. Spying is potentially scandalous but public reaction was minimal. Voters chose instead to support the programs by reaffirming the incumbent political party.
GCSB satellite up/downlink radomes in Waihopai

For those of us striving to maintain a healthy debate on this issue, it was an extremely interesting social experiment. A supportive public implies that despite shrill rhetoric of Orwellian state surveillance there prevails a widespread contentment with where the GCSB has set the bar balancing our security and liberty.

The second of last week’s events was the climax of an investigation into Australians plotting terror attacks. Dozens, if not hundreds, of Australian nationals are being tracked by Australia’s equivalent of the GCSB as they participate in foreign conflicts. Canberra worries these folk will return home with new terror skills bent on destruction.

New Zealand might too face a similar militant threat in the future. Last week shows how translucent the curtain has become as the secret workings of government spill into private life and security threats begin to look increasingly as innocuous as the face in the mirror.

The internet is the pattern forming the edge pieces of the puzzle. The tool is not simply changing the way humans talk, it is more like the reinvention of language itself. Travelling along its tiny glass wires zooms everybody’s communication where it is virtually impossible to differentiate the good guys from the bad guys.

Unfortunately for the GCSB slinking back into the shadows, the two events are part of an unstoppable trend. Yet the mood of argument is evolving. Citizens are realising their great internet is no longer only a medium for personal benefit, it is growing into an entirely new form of weapon. A distinct reddish colour of warned pre-dawn conflict oozes onto the horizon and it is not yet clear what this new day will bring.

Heightened state spying is one aspect. If your government is not spying on adversaries then you are in for a world of pain. However, there’s a line – albeit grey and unwritten – when a government moves dangerously from using digital strictly spying tools, to becoming an inflictor of real-world pain. That blurred line has already been crossed. The internet is now being used as both bullhorn and bullet by the secret agencies of the free world.

Aside from this election’s implicit green light for ongoing spying, and the concurrent fears voiced by CEOs, the public probably won’t condone digital warfare. The internet is too new a concept to have been fully thought out. No one really knows exactly what it promises for humanity as a one of the greatest tools ever devised.

That was the same argument about the Manhattan Project. The bomb’s technology began as a weapon but ended up contributing to communications. Now in an inversion, the internet started as communications before evolving inexorably into a weapon. And it pretty much blindsided us.

The problem is that anyone can use the internet. Essentially there are three operator tiers: the nation state, organised criminals and basement-dwelling hackers or militants. The digital tools available to each level rise exponentially in destructive potential. In a trickle-down effect, over time, the capabilities of the lowest tier rise to the spot previously occupied by the highest. Such is nature, and such is the internet.

Growing computer capabilities are great news for everyone, or are they? Consider what would have happened in Australia had the arrested boys chosen digital destruction of infrastructure computers instead of knives. It still boggles the intelligence world as to why terror groups don’t leverage computers to inflict more damage than blades ever could. Yet the tiered structure above indicates it might only be a matter of time.

Nation states are already using the internet as a weapon. The internet domain is now populated with digital military as a weapon of war. Earlier this year, for instance, Russia unleashed a torrent of digital attacks on Ukrainian government networks prior to their annexation of the Crimean peninsula.
Iran's nuclear reactor facility at Natanz in central Iran

Yet one example in particular stands out as different from the others. That is the story of the Stuxnet worm in 2010.

In short, Stuxnet is a computer virus of tremendous complexity built to infect a specific Siemens computer system in a nuclear facility. Speculation is rife as to which nation state was responsible for creation of the virus, but only a few possess sufficient resources to accomplish something like that.

By means still unknown, the virus infected computers at the Natanz nuclear facility in central Iran where it commanded centrifuge cascades to spin at self-destructive speeds while displaying to human operators that the system was working perfectly. Hundreds of centrifuges were subsequently destroyed and the facility went offline for months halting the nuclear experimentation of the Iranian regime.

Now, most people might file this event safely away in a ‘very good news’ archive, which can’t be too full these days. And yet taking a step back, the full ramifications of the destroyed Iranian facility show us what the internet is becoming.

To understand, let me repeat the Stuxnet story in a slightly different tone: A computer virus created on the internet almost surely by a nation state infected and destroyed - in peacetime - what could only have been called another nation state’s critical infrastructure.

Read that as many times as you need, the dire implications for international safety are the same.

A digital tool, which until 2010 was used strictly as a means of communication, has evolved into the extension of politics by other means. Four years later we are not sure how to deal with this new weapon nor even how to speak about it.

Without anywhere near as much political fanfare as in August 1945, an entirely new weapon changed human history forever and we are only beginning to understand the consequences. If what happened in Natanz is not called an act of war by historians, the concept of war has lost its meaning absolutely.

The internet was once strictly a zone of communications but is increasingly a zone of conflict too. This time the zone is not somewhere else. It is in your city’s electrical system, its traffic light network, hydro-dams, a building’s central security - it’s even in your pocket. Blessedly the capability for destruction is presently limited to the nation state level, it will not always be that way.

If the history of the internet is any guide, replicating Natanz will surely percolate down to the second tier (organised criminals), taking only a bit longer to get to the third tier (malicious hackers and militants).

It’s that third tier now keeping GCSB officials up at night, especially since Australia. What happens when a Natanz-esque capability falls into the hands of a terrorist or angry skilled teenager? It will be very difficult to track either down for justice.

Protecting New Zealand is going to get increasingly difficult for the GCSB. So public and corporate support for their tough work must be incredibly encouraging for the agency. GCSB officers will operate within the legal box they’ve been given, but they’ll play right to the edges to protect us. We should be thankful for their self-control and talents.

No comments: