Welcome!

Cloud Security Authors: Elizabeth White, Ed Featherston, John Katrick, Liz McMillan, Maria C. Horton

Related Topics: @CloudExpo, Cloud Security, Government Cloud

@CloudExpo: Blog Feed Post

The Sony Hack, It’s Still Not War Or Terrorism | @CloudExpo [#Cloud]

The term “act of war” has been used by some, most notably former Speaker of the House Newt Gingrich and Senator John McCain

The Sony Hack, It’s Still Not War Or Terrorism

By SeanLawson

For more than a decade we have heard constant warnings about the coming of “cyber war” and “cyber terrorism.” The prophets of cyber doom have promised that cyber attacks are just around the corner that will be on par with natural disasters or the use of weapons of mass destruction. With every new report of a cyber attack, the prophets exclaim that their visions have finally come to pass, and so it is with the most recent attack against Sony. But in most prior cases, after the dust has settled, the belated arrival of cyber war, terrorism, or doom has failed to live up to the initial hype. The same will be the case with the Sony hack. It is neither war nor terrorism as those terms are commonly defined. It certainly is not cyber doom.

Are We There Yet? Not So Fast

The term “act of war” has been used by some, most notably former Speaker of the House Newt Gingrich and Senator John McCain, to describe the Sony hack, which the FBI attributes to North Korea. When people are using this term, what they really mean is that it is an “armed attack,” an act that can justify the use of force in self defense.

But the Sony hack does meet the common definition of that term. The best current guidelines for when a cyber attack can be considered an armed attack come from the NATO Tallinn Manual. The manual’s lead author has analyzed the Sony case and has concluded that it is not an armed attack.

The cyber operation against Sony involved the release of sensitive information and the destruction of data. In some cases, the loss of the data prevented the affected computers from rebooting properly. Albeit highly disruptive and costly, such effects are not at the level most experts would consider an armed attack.

This is because to qualify as armed attack, an action generally must result in “substantial injury or physical damage.” Some of the authors of the Tallinn Manual would also consider an act “resulting in a State’s economic collapse” to be an armed attack. Clearly, the Sony hack fits neither of those descriptions.

If the Sony hack is not war, then maybe it is terrorism. Some have argued that the United States should just “declare” that acts like this are terrorism and their perpetrators terrorists. Though the term “terrorism” has been notoriously ambiguous, nonetheless, it does not mean just anything. In fact, we have a definition of terrorism in U.S. Code:

(1) the term “international terrorism” means activities that—

(A) involve violent acts or acts dangerous to human life that are a violation of the criminal laws of the United States or of any State, or that would be a criminal violation if committed within the jurisdiction of the United States or of any State;

(B) appear to be intended—

(i) to intimidate or coerce a civilian population;

(ii) to influence the policy of a government by intimidation or coercion; or

(iii) to affect the conduct of a government by mass destruction, assassination, or kidnapping; and

(C) occur primarily outside the territorial jurisdiction of the United States, or transcend national boundaries in terms of the means by which they are accomplished, the persons they appear intended to intimidate or coerce, or the locale in which their perpetrators operate or seek asylum

The Sony case fails to meet this definition, and for the same reasons it fails to meet the definition of armed attack: there was no physical harm. Sure, the hack appears to have been for the purposes of coercing or intimidating a civilian organization and to have transcended international boundaries. But it did not “involve violent acts or acts dangerous to human life” and thus fails to meet the very first requirement of the definition regardless of whatever later parts of the definition may fit. Do not pass go.

Another possibility is that the Sony hack is an example of a sub-category of terrorism, so-called “cyber terrorism,” whose definition could potentially include a wider range of effects. More than a decade ago, Dorothy Denning provided (PDF) one of the clearest and most widely accepted definitions of “cyber terrorism.”

Cyberterrorism is the convergence of terrorism and cyberspace. It is generally understood to mean unlawful attacks and threats of attack against computers, networks, and the information stored therein when done to intimidate or coerce a government or its people in furtherance of political or social objectives. Further, to qualify as cyberterrorism, an attack should result in violence against persons or property, or at least cause enough harm to generate fear. Attacks that lead to death or bodily injury, explosions, plane crashes, water contamination, or severe economic loss would be examples. Serious attacks against critical infrastructures could be acts of cyberterrorism, depending on their impact. Attacks that disrupt nonessential services or that are mainly a costly nuisance would not.

There is more room for debate about whether the Sony hack meets this definition, but it still seems like a stretch. Though economic effects are contemplated, those that would qualify are described as “severe” or directed against “critical infrastructure,” not “nonessential services.” The implication seems to be that the economic consequences should be national in scope, not against one private entity. Though Sony may take a large financial hit as a result of the attack, it is hard to imagine that there will be “severe” impacts on the national economy as a result. It is also a stretch to argue that Sony’s services are “essential.”

Confusing Causes with Effects

It seems clear that the Sony hack does not meet these definitions of war, terrorism, or cyber terrorism. So why are so many using these terms? One answer is fear-induced overreaction. Another, more cynical answer is militaristic animus. One or both of these may play some role for some individuals. But another factor is a fundamental confusion, whether purposeful or inadvertent, of causes and effects in cyber conflict, an issue I have discussed at length elsewhere and to which I will call attention once more.

In each case, the definitions examined above are “effects based.” That is, an attack is an armed attack, is terrorism, or is cyber terrorism based on its effects. If those effects meet certain criteria, cross a certain threshold, then they meet the definition. In each case, physical harm to humans or property is a key criteria or threshold. Denning’s definition of cyber terrorism adds some kinds of severe economic effects. But it is still an effects based definition.

In public debates about the meaning of incidents like the Sony hack, we see a number of disturbing tendencies. We see a tendency to define what counts as war, terrorism, or cyber terrorism based on who conducted the attack and/or what instruments were used in the attack, that is, a shift towards an actor or instrument, as opposed to effects, based definition. In this new scheme, it is tempting to say that if a terrorist group uses cyber instruments, then the incident is cyber terrorism regardless of what actual damage is done. Similarly, it is tempting to say that if a foreign military or intelligence service, especially of a hostile nation, uses cyber instruments in a malicious way, then the incident is armed attack, again, regardless of actual damage done.

Expanding the Definitions of War and Terrorism

The implications of this confusion should be as clear as they are dangerous. Those who call for affixing the war or terrorism label to the Sony hack are not just encouraging us to reconsider how we think about malicious acts in cyberspace. Instead, they are, perhaps inadvertently, encouraging us to redefine what counts as war and terrorism. In doing so, the definitions of both of those terms become absurdly and dangerously broad. Suddenly, financial loss for a multinational media company and embarrassment for its CEO from leaked emails is “war” like World War II or “terrorism” like the attacks of September 11, 2001. This is absurd.

But it is also dangerous. When we accept certain events as really, truly being war or terrorism, then we accept certain kinds of responses to those events that we otherwise would not. We accept the use of physical violence, or actions that could escalate to physical violence, in response to these kinds of events when such responses would not be seen as acceptable if these events were defined differently. To say that the Sony hack is an armed attack by North Korea is to say that it would be legitimate and acceptable for the United States to launch a physical attack on North Korea in response. Some will say, “That is unrealistic. The United States would not actually do that!” But that misses the point. By seriously calling the Sony hack an armed attack or terrorism, we are saying, in effect, “Even though the United States is unlikely to launch a physical attack in response, it would be acceptable for it to do so.” In fact, it would not be.

We should not diminish the seriousness of what happened to Sony. The Sony incident is emblematic of very serious and longstanding threats to cyber security. Indeed, while the world focused on the Sony case, news broke of yet another massive data breach at a major retailer, this time Staples, where information from over one million payment cards was stolen. The Sony incident is a warning that the impacts of such data breaches can be even worse, going far beyond stolen credit card data. But hysterical screams of “terrorism” and “war” are not a serious response to a serious problem. What’s more, such hysterical responses risk broadening the definitions of these terms in a way that is both absurd and dangerous. It is time to take a deep breath and return from the “realm of beyond stupid” before we do something, well, stupid.

Read the original blog entry...

More Stories By Bob Gourley

Bob Gourley writes on enterprise IT. He is a founder of Crucial Point and publisher of CTOvision.com

@ThingsExpo Stories
Everything run by electricity will eventually be connected to the Internet. Get ahead of the Internet of Things revolution. In his session at @ThingsExpo, Akvelon expert and IoT industry leader Sergey Grebnov provided an educational dive into the world of managing your home, workplace and all the devices they contain with the power of machine-based AI and intelligent Bot services for a completely streamlined experience.
It is of utmost importance for the future success of WebRTC to ensure that interoperability is operational between web browsers and any WebRTC-compliant client. To be guaranteed as operational and effective, interoperability must be tested extensively by establishing WebRTC data and media connections between different web browsers running on different devices and operating systems. In his session at WebRTC Summit at @ThingsExpo, Dr. Alex Gouaillard, CEO and Founder of CoSMo Software, presented ...
DXWorldEXPO LLC, the producer of the world's most influential technology conferences and trade shows has announced the 22nd International CloudEXPO | DXWorldEXPO "Early Bird Registration" is now open. Register for Full Conference "Gold Pass" ▸ Here (Expo Hall ▸ Here)
Amazon started as an online bookseller 20 years ago. Since then, it has evolved into a technology juggernaut that has disrupted multiple markets and industries and touches many aspects of our lives. It is a relentless technology and business model innovator driving disruption throughout numerous ecosystems. Amazon’s AWS revenues alone are approaching $16B a year making it one of the largest IT companies in the world. With dominant offerings in Cloud, IoT, eCommerce, Big Data, AI, Digital Assista...
Recently, REAN Cloud built a digital concierge for a North Carolina hospital that had observed that most patient call button questions were repetitive. In addition, the paper-based process used to measure patient health metrics was laborious, not in real-time and sometimes error-prone. In their session at 21st Cloud Expo, Sean Finnerty, Executive Director, Practice Lead, Health Care & Life Science at REAN Cloud, and Dr. S.P.T. Krishnan, Principal Architect at REAN Cloud, discussed how they built...
As ridesharing competitors and enhanced services increase, notable changes are occurring in the transportation model. Despite the cost-effective means and flexibility of ridesharing, both drivers and users will need to be aware of the connected environment and how it will impact the ridesharing experience. In his session at @ThingsExpo, Timothy Evavold, Executive Director Automotive at Covisint, discussed key challenges and solutions to powering a ride sharing and/or multimodal model in the age ...
When shopping for a new data processing platform for IoT solutions, many development teams want to be able to test-drive options before making a choice. Yet when evaluating an IoT solution, it’s simply not feasible to do so at scale with physical devices. Building a sensor simulator is the next best choice; however, generating a realistic simulation at very high TPS with ease of configurability is a formidable challenge. When dealing with multiple application or transport protocols, you would be...
Detecting internal user threats in the Big Data eco-system is challenging and cumbersome. Many organizations monitor internal usage of the Big Data eco-system using a set of alerts. This is not a scalable process given the increase in the number of alerts with the accelerating growth in data volume and user base. Organizations are increasingly leveraging machine learning to monitor only those data elements that are sensitive and critical, autonomously establish monitoring policies, and to detect...
Data is the fuel that drives the machine learning algorithmic engines and ultimately provides the business value. In his session at Cloud Expo, Ed Featherston, a director and senior enterprise architect at Collaborative Consulting, discussed the key considerations around quality, volume, timeliness, and pedigree that must be dealt with in order to properly fuel that engine.
In his session at @ThingsExpo, Dr. Robert Cohen, an economist and senior fellow at the Economic Strategy Institute, presented the findings of a series of six detailed case studies of how large corporations are implementing IoT. The session explored how IoT has improved their economic performance, had major impacts on business models and resulted in impressive ROIs. The companies covered span manufacturing and services firms. He also explored servicification, how manufacturing firms shift from se...
IoT solutions exploit operational data generated by Internet-connected smart “things” for the purpose of gaining operational insight and producing “better outcomes” (for example, create new business models, eliminate unscheduled maintenance, etc.). The explosive proliferation of IoT solutions will result in an exponential growth in the volume of IoT data, precipitating significant Information Governance issues: who owns the IoT data, what are the rights/duties of IoT solutions adopters towards t...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settl...
With tough new regulations coming to Europe on data privacy in May 2018, Calligo will explain why in reality the effect is global and transforms how you consider critical data. EU GDPR fundamentally rewrites the rules for cloud, Big Data and IoT. In his session at 21st Cloud Expo, Adam Ryan, Vice President and General Manager EMEA at Calligo, examined the regulations and provided insight on how it affects technology, challenges the established rules and will usher in new levels of diligence arou...
Organizations planning enterprise data center consolidation and modernization projects are faced with a challenging, costly reality. Requirements to deploy modern, cloud-native applications simultaneously with traditional client/server applications are almost impossible to achieve with hardware-centric enterprise infrastructure. Compute and network infrastructure are fast moving down a software-defined path, but storage has been a laggard. Until now.
Digital Transformation is much more than a buzzword. The radical shift to digital mechanisms for almost every process is evident across all industries and verticals. This is often especially true in financial services, where the legacy environment is many times unable to keep up with the rapidly shifting demands of the consumer. The constant pressure to provide complete, omnichannel delivery of customer-facing solutions to meet both regulatory and customer demands is putting enormous pressure on...
Dion Hinchcliffe is an internationally recognized digital expert, bestselling book author, frequent keynote speaker, analyst, futurist, and transformation expert based in Washington, DC. He is currently Chief Strategy Officer at the industry-leading digital strategy and online community solutions firm, 7Summits.
IoT is at the core or many Digital Transformation initiatives with the goal of re-inventing a company's business model. We all agree that collecting relevant IoT data will result in massive amounts of data needing to be stored. However, with the rapid development of IoT devices and ongoing business model transformation, we are not able to predict the volume and growth of IoT data. And with the lack of IoT history, traditional methods of IT and infrastructure planning based on the past do not app...
"Akvelon is a software development company and we also provide consultancy services to folks who are looking to scale or accelerate their engineering roadmaps," explained Jeremiah Mothersell, Marketing Manager at Akvelon, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
More and more brands have jumped on the IoT bandwagon. We have an excess of wearables – activity trackers, smartwatches, smart glasses and sneakers, and more that track seemingly endless datapoints. However, most consumers have no idea what “IoT” means. Creating more wearables that track data shouldn't be the aim of brands; delivering meaningful, tangible relevance to their users should be. We're in a period in which the IoT pendulum is still swinging. Initially, it swung toward "smart for smart...
IoT is rapidly becoming mainstream as more and more investments are made into the platforms and technology. As this movement continues to expand and gain momentum it creates a massive wall of noise that can be difficult to sift through. Unfortunately, this inevitably makes IoT less approachable for people to get started with and can hamper efforts to integrate this key technology into your own portfolio. There are so many connected products already in place today with many hundreds more on the h...