Try to avoid thinking of the internet as a flashy new battlefield, warns former NCSC chief

Plus: Naming 'n' shaming doesn't stop hostile countries having a pop at the UK

The former head of the National Cyber Security Centre has warned that some British government figures have a “profound lack of understanding” of cyberspace, online warfare and information security.

Ciaran Martin, who stepped down as NCSC chief earlier this year, also cautioned policymakers against seeing the online world as a place for warfare, saying: “We militarise the internet at our peril.”

In a wide-ranging speech delivered last night to King’s College London, Martin called for greater public sector focus on securing the internet and British users of it and less on looking for a “red button” to cyber-start a cyber-war.

“Policymakers,” said Martin, “both political and official, who would think nothing of offering a lay person’s view of the case for an aircraft carrier, can be oddly deferential and therefore unquestioning when confronted with discussions about digital capabilities,” he said, referring to Britain’s offensive cyber bods.

NCSC's less than intimidating HQ in the Nova building behind London's Victoria Station in pre-COVID times

Only this week GCHQ revealed it had hacked Russian state-backed miscreants who were spreading fake news about coronavirus vaccines, the second time that the British state has gone on the record about actively hacking someone else. The first instance was against Islamic State in 2018.

Martin’s warning comes weeks after the Chief of the Defence Staff, General Sir Nick Carter, called for greater UK cyber warfare capabilities as a means of seeing off countries such as Russia and China.

Indirectly referring to this school of thought, Martin said: “Remarks like ‘We should hit back hard in cyber space against those who attack us’ imply that the cyber domain is enclosed, like a boxing ring, with only like-for-like capabilities deployable against adversaries. Whereas it’s obvious… that there’s no need to fight cyber with cyber.”

Yet there are exceptions to this, as there are to any good rule, in the former NCSC chief’s view. Online adversarial capabilities are quite handy when one wants to take down criminal C2 infrastructure and/or botnets, as happened in the weeks before the US presidential election earlier this month. Where it’s less effective is when you want to deter potential state-level attackers from having a go.

He added:

Where cyber attacks don’t work, in my strong view, is as a psychological deterrent to attackers. I don’t say this as a matter of philosophical conviction; I would love it to be true that cyber-retaliation deters attackers. But it’s not true.

This also plays into something that excites cyber policy wonks and high-level infosec bods alike: attribution of attacks. What’s gained by naming and shaming countries like Iran, Russia, China and North Korea when they have a go at UK companies or public sector digital infrastructure? Does it actually make Kim Jong-Un stop and think “Hmm, better call the cyber lads off before Dominic Raab calls me out again?”

Attribution does not have that effect, according to one-time GCHQ bod Martin, who said: “In all my operational experience, I saw absolutely nothing to suggest that the existence of Western cyber capabilities, or our willingness to use them, deters attackers. Nor have I seen any convincing research.”

On the topic of attribution, Paul Chichester, NCSC director of operations, told The Register earlier this month: “We do believe attribution as part of a wider campaign is a valuable tool in the toolbox for the British government. There’s a whole range of things we as NCSC do with other government departments to counter threats. Public attribution is part of that… Over time, the deterrent effect comes from the internationalisation of that work so we do think it’s an important tool.”

What does work, in Martin’s view, is targeting individual state hackers with sanctions. While the chief of Russia’s answer to MI6 probably doesn’t care that he can no longer chuck a tenner into a Premium Bond or open a Post Office savings account, the 20 and 30-somethings working for his hacking units are probably less chuffed that they can never visit countries that have a US extradition treaty, lest charges brought by the US Department of Justice against them are activated.

“The Obama administration’s ingenious innovation of issuing criminal indictments against hostile state actors did more to deter hostile state activity than any retaliatory cyber attack: not just by embarrassing the states they accused, but by removing, for life, the prospect of travelling to the West for any of those indicted,” nodded an approving Martin.

His full speech, a rather readable document as these things go, is accessible on the website of King’s College’s Strand Group. You can also sit down with tea and biccies and watch a video of him delivering it. ®