Try to avoid thinking of the internet as a flashy new battlefield, warns former NCSC chief

Plus: Naming 'n' shaming doesn't stop hostile countries having a pop at the UK

The former head of the National Cyber Security Centre has warned that some British government figures have a “profound lack of understanding” of cyberspace, online warfare and information security.

Ciaran Martin, who stepped down as NCSC chief earlier this year, also cautioned policymakers against seeing the online world as a place for warfare, saying: “We militarise the internet at our peril.”

In a wide-ranging speech delivered last night to King’s College London, Martin called for greater public sector focus on securing the internet and British users of it and less on looking for a “red button” to cyber-start a cyber-war.

“Policymakers,” said Martin, “both political and official, who would think nothing of offering a lay person’s view of the case for an aircraft carrier, can be oddly deferential and therefore unquestioning when confronted with discussions about digital capabilities,” he said, referring to Britain’s offensive cyber bods.

NCSC HQ in Nova building behind London's Victoria Station in pre-COVID times.

NCSC's less than intimidating HQ in the Nova building behind London's Victoria Station in pre-COVID times

Only this week GCHQ revealed it had hacked Russian state-backed miscreants who were spreading fake news about coronavirus vaccines, the second time that the British state has gone on the record about actively hacking someone else. The first instance was against Islamic State in 2018.

Martin’s warning comes weeks after the Chief of the Defence Staff, General Sir Nick Carter, called for greater UK cyber warfare capabilities as a means of seeing off countries such as Russia and China.

Indirectly referring to this school of thought, Martin said: “Remarks like ‘We should hit back hard in cyber space against those who attack us’ imply that the cyber domain is enclosed, like a boxing ring, with only like-for-like capabilities deployable against adversaries. Whereas it’s obvious… that there’s no need to fight cyber with cyber.”

Yet there are exceptions to this, as there are to any good rule, in the former NCSC chief’s view. Online adversarial capabilities are quite handy when one wants to take down criminal C2 infrastructure and/or botnets, as happened in the weeks before the US presidential election earlier this month. Where it’s less effective is when you want to deter potential state-level attackers from having a go.

He added:

Where cyber attacks don’t work, in my strong view, is as a psychological deterrent to attackers. I don’t say this as a matter of philosophical conviction; I would love it to be true that cyber-retaliation deters attackers. But it’s not true.

This also plays into something that excites cyber policy wonks and high-level infosec bods alike: attribution of attacks. What’s gained by naming and shaming countries like Iran, Russia, China and North Korea when they have a go at UK companies or public sector digital infrastructure? Does it actually make Kim Jong-Un stop and think “Hmm, better call the cyber lads off before Dominic Raab calls me out again?”

Attribution does not have that effect, according to one-time GCHQ bod Martin, who said: “In all my operational experience, I saw absolutely nothing to suggest that the existence of Western cyber capabilities, or our willingness to use them, deters attackers. Nor have I seen any convincing research.”

On the topic of attribution, Paul Chichester, NCSC director of operations, told The Register earlier this month: “We do believe attribution as part of a wider campaign is a valuable tool in the toolbox for the British government. There’s a whole range of things we as NCSC do with other government departments to counter threats. Public attribution is part of that… Over time, the deterrent effect comes from the internationalisation of that work so we do think it’s an important tool.”

What does work, in Martin’s view, is targeting individual state hackers with sanctions. While the chief of Russia’s answer to MI6 probably doesn’t care that he can no longer chuck a tenner into a Premium Bond or open a Post Office savings account, the 20 and 30-somethings working for his hacking units are probably less chuffed that they can never visit countries that have a US extradition treaty, lest charges brought by the US Department of Justice against them are activated.

“The Obama administration’s ingenious innovation of issuing criminal indictments against hostile state actors did more to deter hostile state activity than any retaliatory cyber attack: not just by embarrassing the states they accused, but by removing, for life, the prospect of travelling to the West for any of those indicted,” nodded an approving Martin.

His full speech, a rather readable document as these things go, is accessible on the website of King’s College’s Strand Group. You can also sit down with tea and biccies and watch a video of him delivering it. ®

Similar topics

Other stories you might like

  • NASA's InSight doomed as Mars dust coats solar panels
    The little lander that couldn't (any longer)

    The Martian InSight lander will no longer be able to function within months as dust continues to pile up on its solar panels, starving it of energy, NASA reported on Tuesday.

    Launched from Earth in 2018, the six-metre-wide machine's mission was sent to study the Red Planet below its surface. InSight is armed with a range of instruments, including a robotic arm, seismometer, and a soil temperature sensor. Astronomers figured the data would help them understand how the rocky cores of planets in the Solar System formed and evolved over time.

    "InSight has transformed our understanding of the interiors of rocky planets and set the stage for future missions," Lori Glaze, director of NASA's Planetary Science Division, said in a statement. "We can apply what we've learned about Mars' inner structure to Earth, the Moon, Venus, and even rocky planets in other solar systems."

    Continue reading
  • The ‘substantial contributions’ Intel has promised to boost RISC-V adoption
    With the benefit of maybe revitalizing the x86 giant’s foundry business

    Analysis Here's something that would have seemed outlandish only a few years ago: to help fuel Intel's future growth, the x86 giant has vowed to do what it can to make the open-source RISC-V ISA worthy of widespread adoption.

    In a presentation, an Intel representative shared some details of how the chipmaker plans to contribute to RISC-V as part of its bet that the instruction set architecture will fuel growth for its revitalized contract chip manufacturing business.

    While Intel invested in RISC-V chip designer SiFive in 2018, the semiconductor titan's intentions with RISC-V evolved last year when it revealed that the contract manufacturing business key to its comeback, Intel Foundry Services, would be willing to make chips compatible with x86, Arm, and RISC-V ISAs. The chipmaker then announced in February it joined RISC-V International, the ISA's governing body, and launched a $1 billion innovation fund that will support chip designers, including those making RISC-V components.

    Continue reading
  • FBI warns of North Korean cyberspies posing as foreign IT workers
    Looking for tech talent? Kim Jong-un's friendly freelancers, at your service

    Pay close attention to that resume before offering that work contract.

    The FBI, in a joint advisory with the US government Departments of State and Treasury, has warned that North Korea's cyberspies are posing as non-North-Korean IT workers to bag Western jobs to advance Kim Jong-un's nefarious pursuits.

    In guidance [PDF] issued this week, the Feds warned that these techies often use fake IDs and other documents to pose as non-North-Korean nationals to gain freelance employment in North America, Europe, and east Asia. Additionally, North Korean IT workers may accept foreign contracts and then outsource those projects to non-North-Korean folks.

    Continue reading
  • Google opens the pod doors on Bay View campus
    A futuristic design won't make people want to come back – just ask Apple

    After nearly a decade of planning and five years of construction, Google is cutting the ribbon on its Bay View campus, the first that Google itself designed.

    The Bay View campus in Mountain View – slated to open this week – consists of two office buildings (one of which, Charleston East, is still under construction), 20 acres of open space, a 1,000-person event center and 240 short-term accommodations for Google employees. The search giant said the buildings at Bay View total 1.1 million square feet. For reference, that's less than half the size of Apple's spaceship. 

    The roofs on the two main buildings, which look like pavilions roofed in sails, were designed that way for a purpose: They're a network of 90,000 scale-like solar panels nicknamed "dragonscales" for their layout and shimmer. By scaling the tiles, Google said the design minimises damage from wind, rain and snow, and the sloped pavilion-like roof improves solar capture by adding additional curves in the roof. 

    Continue reading
  • Pentester pops open Tesla Model 3 using low-cost Bluetooth module
    Anything that uses proximity-based BLE is vulnerable, claim researchers

    Tesla Model 3 and Y owners, beware: the passive entry feature on your vehicle could potentially be hoodwinked by a relay attack, leading to the theft of the flash motor.

    Discovered and demonstrated by researchers at NCC Group, the technique involves relaying the Bluetooth Low Energy (BLE) signals from a smartphone that has been paired with a Tesla back to the vehicle. Far from simply unlocking the door, this hack lets a miscreant start the car and drive away, too.

    Essentially, what happens is this: the paired smartphone should be physically close by the Tesla to unlock it. NCC's technique involves one gadget near the paired phone, and another gadget near the car. The phone-side gadget relays signals from the phone to the car-side gadget, which forwards them to the vehicle to unlock and start it. This shouldn't normally happen because the phone and car are so far apart. The car has a defense mechanism – based on measuring transmission latency to detect that a paired device is too far away – that ideally prevents relayed signals from working, though this can be defeated by simply cutting the latency of the relay process.

    Continue reading
  • Google assuring open-source code to secure software supply chains
    Java and Python packages are the first on the list

    Google has a plan — and a new product plus a partnership with developer-focused security shop Snyk — that attempts to make it easier for enterprises to secure their open source software dependencies.

    The new service, announced today at the Google Cloud Security Summit, is called Assured Open Source Software. We're told it will initially focus on some Java and Python packages that Google's own developers prioritize in their workflows. 

    These two programming languages have "particularly high-risk profiles," Google Cloud Cloud VP and GM Sunil Potti said in response to The Register's questions. "Remember Log4j?" Yes, quite vividly.

    Continue reading
  • Rocket Lab is taking NASA's CAPSTONE to the Moon
    Mission to lunar orbit is further than any Photon satellite bus has gone before

    Rocket Lab has taken delivery of NASA's CAPSTONE spacecraft at its New Zealand launch pad ahead of a mission to the Moon.

    It's been quite a journey for CAPSTONE [Cislunar Autonomous Positioning System Technology Operations and Navigation Experiment], which was originally supposed to launch from Rocket Lab's US launchpad at Wallops Island in Virginia.

    The pad, Launch Complex 2, has been completed for a while now. However, delays in certifying Rocket Lab's Autonomous Flight Termination System (AFTS) pushed the move to Launch Complex 1 in Mahia, New Zealand.

    Continue reading
  • Alibaba Cloud adds third datacenter in Germany
    More Euro-presence than any other Chinese company, but still nowhere near Google or AWS

    Alibaba has pulled ahead of its Chinese rivals in Europe with the opening of a third datacenter in Germany.

    The company said the Frankfurt datacenter serves cloud computing products to Europe and "adheres to the highest security standards and the strict compliance regulations set out in the Cloud Computing Compliance Controls Catalog (C5) in Germany."

    The addition brings Alibaba Cloud to a network of 84 availability zones in 27 regions worldwide. The company's first European cloud center arrived in Frankfurt in 2016.

    Continue reading

Biting the hand that feeds IT © 1998–2022