Vodaphone Bungles a Cyber-Crime Investigation

The Athens affair is likely to become a textbook case of how a cyber-crime investigation get mishandled.

Briefly, the case is as follows.

During the 2004 Olympics in Athens, security services used the legal phone tapping system installed in Vodafone's cellular network in order to gather intelligence on potential terrorist attacks. However, after the Olympics, someone (most likely the National Security Agency) used sophisticated spyware that was nearly stealth, in order to tap into the highest echelons of the Hellenic government. These conversations were sent to particular cell phones in the Athens area.

Eventually, the tap was discovered; however, Vodaphone bungled the investigation by erasing data logs and other important evidence which could have been used to track down the perpetrators. The only evidence that is available is the triangulation of the spy-phones, all of which were in the vicinity of the U.S. Embassy there.

The lack of either a cyber-forensics squad, or know how of how to conduct a cyber-crime investigation on the part of the Hellenic police is indicative of an important problem in tackling the issue of cyber-crime not only in Hellas, but in all countries.

Without technical know-how of a dedicated corps of officers, it will be impossible for even developed countries to assure prosecution of cyber-crime.

The solution: I propose an international task force that trains and maintains a liaison with police departments. It would be best to do so under the auspices of INTERPOL. The authors of the article would agree.

U.N. Website Hacked

THE official website of the United Nations appeared to have been hacked last night and briefly displayed a message protesting US and Israeli policies in the Middle East
"The chief architects of this protest are myself, Eno 7 from Turkey, and the byond hackers team from Chile ... We expanded our efforts as nine other countries joined us afterwards," it said.

FULL ARTICLE

What remains to be seen is how the governments of Turkey and Chile will respond to this.

Domestic Efforts at Governing Cyberspace

Many national governments have a set of laws governing cyberspace. The problem with these laws is that they are domestic and not-binding on other countries. Therefore, what is needed is an international law that harmonizes domestic laws, and sets up an international CERT.

This article is a case in point for why international negotiations have to take place in order to secure cyberspace.

It has been suggested that more cybersecurity laws here will help with computer security. Thompson and I agreed on a view about that. It's a waste of time to pass laws in the US that can't or won't be enforced in Russia or China.

Of course, there can be economic carrot and sticks associated with a country abiding by U.S. cyber-law. That is, if you obey the U.S. cyber-law then you will have access to advanced technology, if not, then you will be sanctioned. That is the black and white view at least.

China's Emerging Cyber-Power

The below newsfeed was barely noticed, but it is pertinent discussions for why it is important to begin finding ways to govern the use of cyberspace.

WASHINGTON (Reuters) -- China is seeking to unseat the United States as the dominant power in cyberspace, a U.S. Air Force general leading a new push in this area said Wednesday.

"They're the only nation that has been quite that blatant about saying, 'We're looking to do that,"' 8th Air Force Commander Lt. Gen. Robert Elder told reporters

Elder is to head a new three-star cyber command being set up at Barksdale Air Force Base in Louisiana, already home to about 25,000 military personnel involved in everything from electronic warfare to network defense.

The command's focus is to control the cyber domain, critical to everything from communications to surveillance to infrastructure security.

"We have peer competitors right now in terms of doing computer network attack ... and I believe we're going to be able to ratchet up our capability," Elder said. "We're going to go way ahead."

The Defense Department said in its annual report on China's military power last month that China regarded computer network operations -- attacks, defense and exploitation -- as critical to achieving "electromagnetic dominance" early in a conflict.

China's People's Liberation Army has established information warfare units to develop viruses to attack enemy computer systems and networks, the Pentagon said.

China also was investing in electronic countermeasures and defenses against electronic attack, including infrared decoys, angle reflectors and false-target generators, it said.

The Chinese Foreign Ministry rejected the U.S. report as "brutal interference" in China's internal affairs and insisted Beijing's military preparations were purely defensive.

Elder described the bulk of current alleged Chinese cyber-operations as industrial espionage aimed at stealing trade secrets to save years of high-tech development.

He attributed the espionage to a mix of criminals, hackers and "nation-state" forces. Virtually all potential U.S. foes also were scanning U.S. networks for trade and defense secrets, he added.

"Everyone but North Korea," he said. "We've concluded that there must be only one laptop in all of North Korea -- and that guy's not allowed to scan" overseas networks, Elder said.

In October, the U.S. Joint Chiefs of Staff defined cyberspace as "characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures."

The definition is broad enough to cover far more than merely defending or attacking computer networks. Other concerns include remotely detonated roadside bombs in Iraq, interference with Global Positioning Satellites and satellite communications, Internet financial transactions by adversaries, and radar and navigational jamming.

Since cyberspace is such fresh battleground, it is possible for an incident in cyberspace to spiral out of control and bring two powers into a physical war. Without international laws of cyberspace defining exactly what kind of electronic attack would constitute an act of war, and with the high potential for a cyber-arms-race between great and not so great powers, the future becomes perilous.

Keep in mind that cyber-attacks will cause harm to a country if and only if its economy, critical infrastructure, security and happiness of its citizens rely on cyberspace. This is the case in America.

Scarily enough, the U.S. military appears to be behind in making sure cyberspace is safe.

Identity Theft Legislation

The recent legislation signed by the governor of Massachusetts is a step in the right direction for protection personal information from theft. Identity theft is a huge propblem. This is due largley to the shift of storing people's personal data on networked computers that can be penetrated by crackers.

However, it is not just crackers who can steal your personal information. Identities can be compromised in several ways. An example of a threat to your personal information that does not require a a computer science degree is an ID thief taking your trash before the garbage man does, and finding your unshredded personal information.

Cyber-War Video

The Cyber-War series, the full video which is offered by PBS online is a must see for anyone who is wondering why on earth this guy is writing the blog. The scope of my blog is to make people aware of the security problems coming from the electromagnetic spectrum. Of course, there are doubters who will tell you that its not that big of a problem. However, when its too late, these same doubters will tell you that we didn't do enough, even though there was some danger.

Its better to be one step against other states, such as China, or even violent non-state actors who will want and train use cyberspace against us.

Some say that they already have, but the government is keeping mum about it. When cyber-war does come, it will definatley be something new to see.

U.N.I.T.A.R. Webinars

The United Nations Institute for Training and Research Webinars offer a great glimpse into where the future of computing lies. After wathcing some of the topics, it is safe to say that the the future is with Wi-Fi enabled youth who use Free Open Source Software. That seems to be the trend that has been going on in there once, and future, webinars.

National Security Strategy for Cyberspace

While the U.S. appears to be inflicted with problems of information (in)security, it is on the right track. The National Security Strategy for Cyberspace (P.D.F.) is an interesting and important read since it shows that the U.S. is aware of the peril of not security cyberspace. The government, like any bureaucracy, will take a long time before it is able to claim that it’s the information stored on government, business and personal computers are at low risk. As long as cyberspace remains insecure, so does almost every aspect of our lives. From the federal to the local.

Note: The President's Critical Infrastructure Protection Board is now known as the National Infrastructure Advisory Council (NIAC) and operates within the U.S. Department of Homeland Security.

Information (In)Security

And if you think that the U.S. is the top in terms of computer security, well, that is dead wrong. Essentially what this means is that the U.S., while being the world super power, is especialy vulnerable to cyber-attacks I guess the electromagnetic spectrum is its soft underbelly. For the full report follow the link

http://www.computerweekly.com/Articles/2007/07/30/225877/learn-from-mistakes-made-in-us-security.htm