Cyber threats

Cyber conflict and cyber attacks are something Estonians know about first hand. In April of 2007, when the Estonian government relocated a World War II war memorial statue that commemorated the Russian liberation of Tallinn to a cemetery outside of town, rioting broke out.

Some ethnic Russians in Estonia were angered by the move and protests turned violent. Estonians, on the other hand, do not see the Soviets as liberators but as occupiers.

As a result of the controversy, Estonia found itself the focus of concentrated attacks from cyber space in the form of denial of service attacks against government and banking websites.

Denial of service attacks happen when thousands of computers are linked together using software or an agent called a 'botnet' to overwhelm a website with requests, essentially crashing the servers that host the website.

This was particularly disruptive to Estonia as the small Baltic nation is one of the most highly developed countries in the world when it comes to the Internet. Daily life in this small nation, whether it be banking or voting or filing tax returns is conducted almost exclusively on the Internet. So when banking or government websites are out of service, life grinds to a halt.

No one is immune

Standing on the stage at the 2010 Conference on Cyber Conflict, held this month in the Estonian capital, Dr. Charlie Miller, a mathematician with a PhD from Notre Dame who spent five years at the National Security Agency in Maryland, demonstrated to the experts and government representatives present just how serious this is.

He sent an email from the head of the Cyber center to a journalist, with a link to the Cyber Conference agenda, asking the journalist to click on the link and let the director know which seminars he would be interested in attending.

The link in the email was a link to a page on the conference website but as the link was clicked, for just a split second, the user was directed to a URL with Loadstone in the title. Then another split second later, the conference agenda came up.

Nothing seemed out of the ordinary, but Dr. Miller was now in control of the other laptop. And he demonstrated his control by reading the person's email, scanning through their files, and taking a picture of the person using the laptop's camera.

Many different forms of cyber attacks

Cyber threats vary and cyber espionage is one of the biggest issues in the world today. Cyber crime is the also one of the fastest growing and most lucrative aspects of illegal use of the Internet. According to one of the speakers at the conference, identity theft has outpaced illegal drugs in dollar volume.

Cyber terrorism is the one thing that keeps government Internet security people awake at night. Massive power outages caused by cyber terror attacks on a nation's electricity grid could be catastrophic. Equally chaotic if not deadly results could ensue if cyber terrorists managed to shut down the air control system over Europe.

On the other end of the spectrum is Cyber vandalism, which is usually more benign, and consists of websites being defaced, or taken offline, but the hacker's skills serve notice that if they deface a website, they might be able to do more damage.

All about the browsers

For most netizens, the greatest nuisance is the computer virus. They usually arrive via email in an attachment, or by visiting questionable websites. Ordinarily, most anti-virus software will disable these viruses but some get through, generally due to flaws in web browsers.

A virus can be as benign as someone snooping around, or as dangerous as someone being able to read your keyboard strokes and gaining access to passwords to your bank accounts.

According to Dr. Miller, most flaws are usually repaired within months. Companies will send out security updates and it is up to the user to install them. But flaws can go undetected for months if not years.

What constitutes cyber warfare

For three days, the venue of the cyber conference buzzed with activity as participants shared information, struggled to come up with working and acceptable definitions of cyber warfare, and long term prognostications.

Ennekin Tikk is the legal counsel for the Cooperative Cyber Defense Centre of Excellence Tallinn, and when asked to define warfare, acknowledged that finding a definition is not easy.

"Well frankly speaking, there is none," said Tikk. "And at the same time that is not to say that there is no understanding among the legal community what we are talking about. What we are talking about is the cyber equivalent of an armed attack, that means tanks across the border, damages and loss of life comparable to those resulting from kinetic warfare."

And there are other issues surrounding cyber warfare or cyber conflict are. What are the appropriate responses? How to confirm attribution; finding the legal means to bring the perpetrators to justice; establishing legal conventions for dealing with cyber conflict.

One thing all participants agreed on though as the conference came to a close: our world is becoming ever more dependent on the Internet to handle the running of our critical infrastructures. Thus, threats will keep coming and governments as well as companies will have to be ever more vigilant to keep things running smoothly.

Author: Andy Valvur
Editor: Mark Mattox