Keeping Tabs on Terrorists: Aaron Mannes & V.S. Subrahmanian in the "Wall Street Journal"

The Wall Street Journal Asia just posted an article my colleague V.S. Subrahmanian and I wrote on the ongoing game of catch-up intelligence agencies are forced to play as terrorists quickly adopt and adapt the latest communications technologies.


* OPINION INDIA
* AUGUST 22, 2010

Keeping Tabs on Terrorists
India's spat with the maker of the Blackberry underlines a broader technological challenge for intelligence agencies.


By V.S. SUBRAHMANIAN AND AARON MANNES

The war on terror came closer to home this month, when the Indian government pressured Canadian company Research in Motion to hand over encryption keys for its popular Blackberry device. New Delhi claims terrorists are using the company's secure networks for covert communications. The United Arab Emirates, Saudi Arabia and Indonesia—all of which face significant terror threats—have also expressed concern. But such moves may do more harm than good.

India's concern is clearly justified: Terrorists are using new media sources to facilitate covert communications that—directly or indirectly—have led to numerous deaths. According to the U.S. National Counterterrorism Center's Worldwide Incident Tracking System, Pakistan-based terror group Lashkar-e-Taiba (LeT), perpetrator of the deadly 2008 Mumbai attacks, is responsible for over 700 fatalities in India during the last five years.

But publicly browbeating RIM into providing its encryption keys is a Pyrrhic victory. Terrorist organizations can only survive if they study the capabilities of their adversaries and adapt. Terrorist organizations backed by intelligence agencies tend to be even more sophisticated. If terrorists know that Blackberries are monitored, terrorists will not employ them—or will do so only in combination with other channels of communication in order to evade intelligence agencies. The much-publicized nature of India's threat to Blackberry thus may well have compromised potential operational gains.

LeT's Mumbai attack shows how quickly terrorists adapt to new technology. According to the publicly released portion of an Indian intelligence dossier, the LeT terrorists were in continuous communication with their Pakistani handlers using a mix of mobile phones and an obscure Voice over Internet Protocol provider called Callphonex. Handlers based in Pakistan were able to monitor Indian security efforts, providing real-time intelligence to the terrorists that prolonged the attack for three days and provided the terrorists with the media exposure they craved. In other words, using readily available commercial technology, the Mumbai terrorists created an effective battlefield communication system.

Intelligence agencies, on the other hand, are often slow to develop the monitoring mechanisms needed for new communications media. This is a weakness that terrorists systematically exploit. As new communications media proliferate, security analysts are forced to play a constant game of "catch up" irrespective of whether a Blackberry or Google hand over their security keys and provide server access.

Security agencies need to quickly identify emerging communication technologies and develop monitoring mechanisms tailored for each new media in almost in real-time. The technical and analytical requirements of monitoring Voice over Internet Protocol, for example, are very different from those needed to monitor photo-sharing sites. Monitoring mechanisms must be grounded in systematic research about how people actually use communications media and how new forms of communication can be monitored.

This sounds like an impossible task, but it isn't. These studies can be combined with "red team" activities in which specialists game out the terrorist role in live and virtual simulations to consider how new technologies can be used. An important virtue of "red teams" is not that they will always identify specific terrorist methods, but that they will foster a culture of rapid adaptation to technological innovation within the security services.

The development of monitoring mechanisms is a technical issue, distinct from the legal and ethical question of when a nation should monitor electronic communications. However, well-designed monitoring mechanisms can help intelligence agencies operate ethically and within the laws and discern appropriate targets for surveillance from legitimate, legal online activity. It is in the absence of effective monitoring mechanisms that states may be tempted to take in data without discrimination, violating the privacy rights of their citizens.

While there are legitimate security needs that require communications companies to provide access to their systems, simply obtaining more data without developing both a process and technology to monitor emerging communications media is a losing proposition even for the most capable intelligence agencies. As new communications technologies proliferate, smarter intelligence strategies are needed to get ahead of terrorists and prevent rather then react to the next attack.

Mr. Subrahmanian is the director and Mr. Mannes is a researcher at the University of Maryland's Laboratory for Computational Cultural Dynamics.

Real Cyberwar: Mannes & Hendler in the Washington Times

This morning, The Washington Times ran an op-ed on cyberwar I co-wrote with my friend (and former boss) Jim Hendler. Much has been written about cyber-war, but very little of it is grounded in reality. Many over-hype the issue while others discount it completely. Much of the misinformation about cyberwar revolves around denial of services attacks, which are serious criminal activity but not much of a national security concern - we've written on this topic in the wake of Russian conflicts with Estonia and Georgia.

Here we try to inject a bit of sober and informed reason into the discussion.


Wednesday, August 5, 2009
Profile of a real cyberwar

Aaron Mannes and James Hendler

The denial-of-service (DoS) attacks that started on July 4 garnered typical headlines about cyberwar, but in fact, from a technical standpoint, those "attacks" may be the opposite of real cyberwar. A much less noticed report in Israel's leading daily, Ha'aretz, on Israel's operations against Iran's nuclear program may give greater insight into how cyberwar actually will work.

It is no secret that several countries, including the United States, China, Russia and Israel, have examined cyberwar capabilities. What those capabilities might be or how a cyberwar might look are shrouded in mystery. The denial-of-service attacks that made headlines are not it.

Those attacks are nothing more than the sending of enormous numbers of requests to servers, preventing Web sites from responding to legitimate traffic and interfering with e-mail. Competent information-technology professionals usually can mitigate these attacks, and even when successful, their impact -- from a national security standpoint -- is marginal.

The DoS attacks are carried out by botnets, thousands of compromised computers that can be commanded to simultaneously send e-mails or visit a Web site. The botnets are built using malware that attacks individual computers, often simply taking advantage of software that has not downloaded current security patches. Computers linked to government agencies have been compromised and have become part of botnets -- but this does not necessarily have tremendous security implications. Real cyberwar may require the opposite of the skills required for the DoS attacks that make headlines.

According to the article in Ha'aretz, Israeli intelligence has sought to systematically insert malware that can damage information systems within the Iranian nuclear program. It is believed those systems are not connected to the broader Internet and that the malware is inserted into equipment sold to the Iranian government.

This is the probable future cyberwar. Modern societies are complex networks of people, information systems and equipment. Enormous advantages will be obtained by powers that can quickly identify and neutralize critical nodes within the systems.

Critical government systems are run on Intranets, networks that are separate from the Internet. The most crucial systems, such as the command-and-control system for nuclear weapons, are believed to be air-gapped -- that is, they do not link to other systems. Most government Intranets do have points at which they interface with the Internet, and Intranets have been infected with malware from the Internet. However, Intranets are relatively controlled environments, so anomalous activity (at least theoretically) can be controlled and isolated quickly.

Because compromising those networks may be crucial in a military conflict, nation-states with serious cyberwar ambitions will carefully tailor malware for specific systems. This is the opposite of the malware that builds botnets by seeking low-hanging fruit.

The most serious cases of identity theft usually involve social engineering, tricking the target to reveal crucial information that facilitates the crime. The same may be true in tailoring attacks to critical networks. Most advanced nation-states have extensive infrastructures of contractors and academics that have both public roles and contacts with the security establishment. Social-network analysis could be used to identify individuals who are likely to have contacts within the security establishment and attempt to insert malware through them.

Imagine the now ubiquitous phishing attacks masquerading as e-mail from banks and credit card companies but instead designed by sophisticated intelligence agencies and carefully targeted at small communities.

What the malware might do when it gets into a system is an open question. Chinese hackers reportedly have infiltrated computers and manipulated them to remove sensitive documents, log keystrokes and trigger Web cameras. Whether these capabilities could operate for a substantial length of time on a secure Intranet is an open question. Any malware that entered a sensitive system might have a short life span and its designers would need to consider carefully how best to use this window. Alternatively, this malware may be embedded for long periods of time and activated when needed. Options might include relaying valuable information, manipulating information, damaging the network or providing information on the real-world location of crucial network nodes so that they can be destroyed physically.

However, cyberwar capabilities cannot be used lightly. Once malware is detected, the defenders can counter it and make their system stronger and more resistant to further infiltration.

In the heat of battle, the ability to penetrate an enemy information network could be crucial. However, in the long-term dialectic of war, in which sides continually respond to one another's innovations, cyberwar will become another facet of conflict -- at times decisive and at other times peripheral. The nations that first master cyberwar could obtain a fundamental advantage at the beginning stages of a conflict. Nations that ignore cyberwar will do so at their own peril.

Aaron Mannes is a researcher at the University of Maryland. James Hendler is a professor of computer science at Rensselaer Polytechnic Institute.

Aaron Mannes in the Guardian: Russia-Georgia CyberWar Assessment

The Guardian Online just posted an assessment I co-wrote with my friend Jim Hendler (computer science professor at RPI) about the Georgia-Russia Cyberwar.


The first modern cyberwar?

Aaron Mannes and James Hendler
Friday August 22 2008

The Russian-Georgian conflict is being described as the first time cyber-attacks have accompanied an actual war. Last year, the Russian-Estonian spat was described as the first modern cyber-war. These descriptions over dramatise events and are a distraction from the more prosaic, but more serious, danger these illicit cyber-actions represent. The technology used in these cyber-conflicts has only limited strategic impact, but represents a major threat to one of the most successful engines of human freedom and opportunity – the World Wide Web itself.

The strikes against Georgian government websites, along with last April's attacks against Estonian websites, were distributed denial of service attacks (DDoS) where many computers simultaneously send messages to a website, preventing legitimate traffic from reaching the site. These attacks are relatively easy to launch, but taking a website down does not affect real world infrastructure and competent IT professionals can counter or at least mitigate DDoS attacks. The increasing volume and sophistication of these attacks is a subject much discussed among IT professionals, but its impact is to create an inconvenience.

Theoretically taking down Georgian government sites could have prevented Georgia from publicising its side of the conflict. However, some Georgian sites were migrated to new locations. More importantly, the Georgian government's message was getting out to the world. The problem was that the United States and Nato had limited options for supporting Georgia. In short, the cyber component had no significant known impact.

Advanced economies and militaries rely on sophisticated information networks. Damaging or infiltrating these networks will probably be an important component of future wars. The ability to listen in on or disable an enemy's military communications net could be the difference between victory and defeat. It is also conceivable that information inside these networks could be influenced, or that the networks running critical infrastructure - military or civilian - could be infiltrated and used to cause real-world damage. However the skills and technologies needed for these attacks will be highly specialised, and not akin to the DDoS attacks which a relative amateur can launch.

Russia, home to a sophisticated core of cyber-criminals, undoubtedly possesses some of these capabilities. But, considering Russia's massive military advantage over tiny Georgia, it is unlikely that Russia would have turned to advanced cyber war to guarantee victory, particularly when deploying it would provide potential future adversaries with valuable intelligence about Russia's cyber war strategies and tactics. In addition, much of Georgia's infrastructure is old and consequently not online and therefore invulnerable to a cyber strike. (The Georgians claim that Russia has targeted their phone system, and while that is possible, it is more likely that Georgian phone systems were overwhelmed in the general crisis accompanying the Russian attacks.)

The Russian government may have instigated the DDoS attacks, although the evidence is unclear, and it is difficult to identify the origins of a DDoS attack. It appears that the DDoS attacks were in fact a mass action by regular Russian citizens. For the future of the Web, this is even more worrisome.

DDoS attacks typically use botnets, networks of thousands of compromised computers that, unbeknownst to their owners, are used to disseminate spam. Five years ago DDoS attacks and botnets were the domain of highly skilled cyber-criminals. Now, botnets can be rented online, and rentals come with tech support. The massive DDoS attacks on Georgia included botnets, but ordinary citizens joined in, using simple tools distributed online to join in the attacks. The tools of cybercrime are becoming progressively easier to use.

The Web was established as an open environment, with minimal governance, that puts a premium on individual liberty and initiative. This openness has been essential to the Web's success as a tremendous engine of creativity, opportunity, and liberty. DDoS attacks that take down websites are bad manners and one threat to the open spirit that underpins the Web. But the technology behind these attacks represents even greater threats.

The primary use of botnets is not DDoS attacks, but to perpetrate an ever expanding repertoire of online frauds and distribute malicious software. These activities undermine the physical and moral integrity of the Web. Some estimates are that more than 75% of the emails sent worldwide are spam. With botnets becoming easier and easier to create and manage, the rate of spam is increasing faster than new internet capacity. Spam also represents a moral threat to the Web, as online fraud undermines trust in e-commerce and online communications in general.

Governments can better prepare for specific events, such as international cyberspats. There are a number of improvements that could be made in coordination and in developing early warning systems. But the systemic issues also need to be addressed. Software designs need to be improved to reduce the vulnerabilities that cyber-criminals exploit and the public needs to be better educated about safer online behaviour. Major Web users such as governments, ISPs, universities, and corporations need incentives to better secure their networks, and educate their users. Finally, serious efforts must be made to develop international laws that can prevent increasingly sophisticated cyber attacks and to prosecute cyber-criminals. All of these steps are costly, but without them more draconian efforts that impinge on individual privacy may be needed to keep the Web viable.

The cyber-component of the Russian-Georgian conflict was only a sideshow, but it highlighted the threats facing one of history's great promoters of freedom and innovation - the World Wide Web.

Golden Oldie: Russian-Estonian Cyberwar Overview

Spring 2007, a spat between Russia and Estonia was accompanied by a "cyberwar." With my friend, and former boss, Jim Hendler (now a professor at RPI) I wrote an overview. The story is now relevant again for assessing the cyber component of the Georgian-Russian conflict. This difference is that this time, for all of the hype about cyberwar, there is real world fighting that is having a more permanent impact.

At the same time the growing level of illicit activity on the web is a concern in its own right.

June 5, 2007

COMMENTARY

Net Attack
By AARON MANNES and JAMES HENDLER
June 5, 2007

The age of cyberwar has arrived. The attacks on Estonian government and commercial Web sites following the relocation of a Soviet World War II memorial in Tallinn in late April made news around the world. Yet these were not the only, or even the most significant, such assaults this year.

In February, hackers laid siege to six of the 13 "root servers" that form the backbone of the Internet. Had they succeeded in disabling these servers, the Internet would have ceased to function. Fortunately, only two of the root servers were severely affected, causing only some localized slowdowns. The emerging threat of cyberattacks against vital parts of the global economy highlights the urgent need to protect the Net from criminals.

The attack on Estonia was perhaps more akin to a riot than a military strike. Just as a mob might wreck storefronts, cyberattacks defaced or knocked prominent commercial and government Web sites offline. Similar attacks have accompanied other international political spats. Arab and Israeli hackers attack each other's Web sites, as do Pakistani and Indian hackers. After a South Korean speed skater was disqualified for bumping an American rival during the 2002 Winter Olympics, several strikes apparently originating from South Korea hit U.S. servers.

In all these cases, the hackers can cause email delays and fetter access to targeted Web sites. In Estonia, they prevented the national government from explaining the situation, hampered financial transactions and interfered with telephone systems, which rely in part on the Internet to function.

The strikes against the Estonian sites and the Internet root servers are of a type known as Distributed Denial of Service attacks, or DDoS. The assailants begin by installing a virus or other malicious software on a computer, directing it to send messages without its owner's knowledge. These compromised computers, known as bots, are bound together into large networks called botnets. They then simultaneously send messages to the targeted system, overwhelming it and leaving it unable to respond to queries. Low-end estimates indicate that there are tens of millions of bots in the world, and experts have identified some botnets that included more than 100,000 compromised computers.

One reason for the increasing frequency of these attacks is that they don't require high-level skills. In chat rooms where cybercriminals congregate, botnet builders offer their "products" for rent, their real identities obscured behind aliases. There are even online help desks to assist users. Because botnets consist of computers from all over the world, it is difficult to trace the origin of an attack, making it particularly attractive to governments who can deny any responsibility.

Consider the Estonian case. Tallinn accuses Russian state officials of involvement in the recent attacks. But even if that is true, it is difficult prove that this was state policy instead of the actions of sympathetic individuals. State computers may have been part of botnets, but so were other computers around the world. Russia is also a major center for cybercriminals, many of whom happen to be staunch Russian patriots. In this recent cyber levée en masse, many ordinary Russians participated in the attacks against Estonia; at its peak over one million computers were involved.

Because of their ease of use, DDoS attacks have proved attractive to various malevolent actors. According to a report by the Middle East Media Research Institute, Islamist chat rooms have included discussions of attack techniques and work to coordinate attacks on Web sites that oppose their cause. DDoS attacks may favor the assailant, but skilled IT professionals can counter them. More important, they have limited efficacy: Knocking out the power company's Web site is not the same as taking down the power grid. Breaking into a system to gather information, or launching an attack that damages real-world infrastructure, requires more extensive skills. So far, the few publicly known incidents involving real-world infrastructure -- most famously an April 2000 case in Australia in which raw sewage was released into rivers and streams -- have involved disgruntled insiders.

DDoS is also of limited utility in economic warfare. Knocking out the Web site of an online business is obviously bad for that business, but it has a negligible overall economic effect: Frustrated customers can simply purchase from competitors.

Little is known about the people behind the February attacks on the Internet root servers. The investigation into the incident suggested that the attack was by cybercriminals who wanted to advertise their sophisticated botnet. Criminals have used DDoS to blackmail online businesses, particularly gambling sites. But botnets are used more profitably to disseminate spam and malware. While the botnets cannot yet destroy the Web technically, they are undermining its vital trust and openness.

There are no simple ways to prevent the World Wide Web from becoming a zone where powerful criminals operate unfettered and large players can push around small ones. Software makers can work to make systems more secure, but many computers are compromised by user error rather than technical flaws. The public can be better educated in computer security, but human nature is imperfect.

International standards for addressing the problem, such as the Council of Europe's Convention on Cybercrime, are evolving. Setting international standards to counter cybercrime, while still protecting civil liberties, will be a continuing challenge. But the greater challenge will be pressing nation-states to adhere to these standards by enacting and enforcing laws against cybercrime.

Yet as the attacks against Estonia show, the task cannot be delayed -- the increasing sophistication and accessibility of malware means these problems will only become worse. The future of the Web is at stake.

Mr. Mannes is a researcher in international security affairs and Ph.D. student at the University of Maryland. Mr. Hendler is a professor of computer science at Rensselaer Polytechnic Institute.