The Fax on National Security Secrecy

Greetings from the seminar "Neither Confirm Nor Deny: National Security Secrecy and Australia's Liberal Democracy" from ANU. Emily Hitchman points out that technology has presented a challenge for national security in the past, with fax machines providing a way to breach security long before Wikileaks. This may have an effect on the AUKUS agreement with the USA and UK. One way I suggest would be the question of nuclear weapons. 

ps: I am actually in a bus shelter waiting for a bus to take me to the University. I am listening to the presentation via video conference on my phone. A tip is to use "driving mode": this turns off video and the microphone, avoiding embarrassing images and noises on the conference when you are out and about (it also reduces the bandwidth required on your mobile connection). 

Crisis Simulation for Teaching Next Generation of Leaders

Barrie & Worthington
in ACSS Control Room, CC-BY 29/8/2023

Greetings from the Control Room of the Australian Crisis Simulation Summit at the Australian National University in Canberra. There is a team of ten students sitting at computers, in a horseshoe shaped room running through the scenarios. Next week, 100 students in teams around Australia and the USA will respond to these in real time. It is not quite as high-tech as the control room in the Hunger Games, but works much the same way. 

The game-masters are using Conducttr crisis simulation software, coordinating the release of made up news reports, and social media posts about a fictional future crisis. While all the teams participating share the same simulated world view, they have different scenarios to respond to. These involve cyber and kinetic (stuff blowing up) attacks, and the participants need to work out what to do. There are then scripted events to keep the participants busy.

I have the role of a mentor, pro diving advice to the game-masters and participants. This is a new experience. I have participated in a paper based version of a simulation at what is now Australian War College (AWC), but on a much smaller scale. Next to me providing advice is the patron for the ACSS, Professor Admiral Chris Barrie.

The scenarios the students have prepared are set about a decade in the future. Even so they reflect current events, to the extent when someone mentioned a Chinese submarine may be missing, I had to ask "Is this real world or exercise?". 

I am mentoring, for ACSS, using my experience from working at DoD. But also I would like to see how such exercises can be incorporated as part of student's formal learning and assessment. I talked about  "Projects & internships for student employability" at EduTECH, Australia last week. Simulations can provide a form of quicker, work relevant learning. 

Alternatives to Chinese technology training for the Indo-Pacific

Presenting on M-learing for the Indo-Pacific, 2018. 

In "China Inc. and Indonesia’s Technology Future", van der Kley, Herscovitch, and  Priyandita (ANU National Security College, 2022), suggest Australia and its allies should provide tech training in Indonesia, to counter China's influence. This is a viable idea, from geopolitical, developmental, and market development perspectives. However, Indonesia has excellent tech educators (I have met many), and so this would be better done by assisting them, rather than being imposed from outside.  In 2018 I suggested countries of the Indo-Pacific could jointly educate professionals using mobile devices, in to counter the influence of China's Belt and Road Education Plan.

Rather than creating free courses, dependent on intermittent foreign aid programs. I suggest that allied educational institutions, and entrepreneurs, could be assisted to set up not-for-profit, and for-profit programs, which will be able to be self funding. This can be done using standard start-up techniques, and Indonesia's exceptionally vibrant commercial sector. 

CEO Needed for ANU Cyber Institute

The Australian National University (ANU) is looking for a CEO for its new ANU Cyber Institute. This is an initiative of the ANU's College of Engineering and Computer Science (CECS) and the National Security College (NSC).

"The ANU has recently announced the establishment of Australia’s first interdisciplinary Cyber Institute, bringing together expertise across a range of areas to deal with the increasingly complex issues in the cyber domain. 

The Institute will present exciting new opportunities for research, innovation and education. The Chief Executive Officer (CEO) is the Institute’s Head, operating under the broad direction of the Institute Advisory Board. 

The CEO will be responsible for driving the strategic vision and operational plan for the Institute, working closely with executives and stakeholders across the University, industry and government, to create a globally pre-eminent Institute focused on addressing Australian and global cyber needs."

From: Chief Executive Officer - ANU Cyber Institute, Reference 10646, KPMG, November 2017.

Fake day care center website

ANU students get a preview of some cyber issues in the Networked Information Systems course (COMP2410/COMP6340), where I run them through a Cyberwar Hypothetical Over the South China Sea. This includes the example of a fake day care center website, apparently targeting Australian intelligence staff in Canberra.

Cyber Information Warfare in Canberra

Dr Herb Lin, Senior Research Scholar, Stanford University, is speaking on "Cyber-enabled information warfare and the end of the Enlightenment" at the Australian National University in Canberra. He argues that Information Warfare and Influence Operations (IWIO) is a hostile act, but not "warfare" under the UN Charter and laws of war. I agree that using the Internet to influence an enemy is just an extension of previous analog information techniques, but I am not sure those being targeted would not see it as warfare.

Dr Lin's characterizes IWIO operations as being effective, with the use of violence. However, the doctrine of the USA (and Australia) is to respond to cyber attacks based on the effect the attack has, not the nature of the weapons used:

"When warranted, the United States will respond to hostile acts in cyberspace as we would to any other threat to our country. ... We reserve the right to use all necessary means—diplomatic, informational, military, and economic—as appropriate and consistent with applicable international law, in order to defend our Nation, our allies, our partners, and our interests.”

From: International Strategy for Cyberspace, The Whitehouse, May 2011

I suggest that if IWIO has a damaging effect on a nation, that nation will respond accordingly. If the attacked nation has a IWIO capability, then they may use that to respond, but reciprocity doesn't require that. 

Conventional military forces could be used to respond to IWIO, despite the problem that this may play into the information agenda of the attacker. For this reason a nation may use a covert kinetic military response to IWIO.

Dr Lin discussed ways to disarm a information warfare attack, by carefully identifying the attacker and their motives, as well as debunking false claims made. However, this task may be made more difficult, I suggest, by the nation's own politicians and organizations using the same IW techniques for political campaigning and marketing.

Dr Lin asserted cyber warfare is not a threat to civilization. I don't agree. Conventional and nuclear weapons can only kill people, but cyber war can kill an idea.

Dr Lin used the example of the Russian Government allegedly funding both "black lives matter" and "while lives matter" campaigns in social media in the USA, to spread discontent. These he characterized as chaos-producing operations. While such attacks existed before the Internet, they can now be carried out much easier on-line.

As an example, the technique of fuzzing with AI (Rajpal, Blum & Singh, 2017) might be applied to IW. With fuzzing is used to test the security of computer systems by generating a large number of sets of test data. AI can be used to see which sets are most effective for breaking into a system. The same could be (and may already be) applied to IW: the attacker would generate a large number of variations on a message, such as "black lives matter" and AI would be used to refine the versions of the message which are most effective at creating discontent. On-line marketers already use similar techniques to measure the effectiveness of advertising, by sending slightly different advertisements to individual consumers. However the use of AI could speed up the process. It may that social media is itself is a form of inadvertent IW attack, with a reports linking social media use and depression in teenagers.

One one the more amusing parts of Dr Lin's entertaining presentation was a clip from Star Trek Deep Space Nine:

"The truth is usually just an excuse for lack of imagination ...".

From "The Wire", script by Robert Hewitt Wolfe, Episode 2x22, Production number: 40512-442, First aired: 8 May 1994).

Start Trek presented an idealized image of a united world where a western (mostly US) world view had prevailed. This form of soft-power perhaps should not be underestimated.

Dr Lin's "On Cyber-Enabled Information/Influence Warfare and Manipulation" with Jackie Kerr is to be published in the Oxford Handbook of Cybersecurity (2018).

"The West has no peer competitors in conventional military power. But its adversaries are increasingly turning to asymmetric methods for engaging in conflict. In this public seminar, Dr Herb Lin will address cyber-enabled information warfare (CEIW) as a form of conflict or confrontation to which the Western democracies are particularly vulnerable. 

CEIW applies the features of modern information and communications technology to age-old techniques of propaganda, deception, and chaos production to confuse, mislead, and perhaps to influence the choices and decisions that the adversary makes. A recent example of CEIW can be seen in the Russian hacks on the US presidential election in 2016. CEIW is a hostile activity, or at least an activity that is conducted between two parties whose interests are not well-aligned, but it does not constitute warfare in the sense that international law or domestic institutions construe it. Some approaches to counter CEIW show some promise of having some modest but valuable defensive effect. If better solutions for countering CEIW waged against free and democratic societies are not forthcoming, societal discourse will no longer be grounded in reason and objective reality – an outcome that can fairly be called the end of the Enlightenment."

References

Rajpal, M., Blum, W., & Singh, R. (2017). Not all bytes are equal: Neural byte sieve for fuzzing. arXiv preprint arXiv:1711.04596. URL https://arxiv.org/abs/1711.04596

Securing our Future in Cyberspace

Greetings from the Australian National University where a research symposium on "Towards a political ecology of cyberspace" is taking place as part of the conference "Securing our Future in Cyberspace". There is a public forum on "Quantum sovereignty: the Westphalian principle and the global governance of cyberspace" tomorrow, "Taming cyberspace: applying international law in a new domain" Wednesday,  "The role of cybersecurity in Chinese foreign policy" Thursday and "Securing our future in cyberspace - next steps" on Friday.
The event has not started well, with the first speaker asking "What is Cyberspace?" and answering their own question with "Well it is really big.". This sounds like a line from the 1995 Steven Seagal  film "Under Siege 2: Dark Territory": a US DoD technician searching for a orbital weapons platform says something like "It called 'space' because it is really big". ;-)

The first presentation on the ontology of cyberspace. The second presentation was on the ethics of cyberwarfare. An interesting aspect is the interaction of IT and military ethics. Perhaps the most insightful comment of the morning was describing cyber-warfare as "a game of rock, paper scissors".

The last session I attended was on Balkanization of the internet". This seemed to have missed the point that "The Internet" (with a capital "I") is an internet (small "i"): that is a network of networks. So the term "Balkanization of the Internet" is a tautology: the Internet is, by design balkanized and this is one of its strengths. The network of networks provides for security and Resistance of the Intent. Balkanization is not an emergent property of the Internet, it is an important part of the design.

The "Towards a political ecology of cyberspace" research symposium was disappointing. It presented some introductory material which would be suitable for a first year introduction lecture. Some of the material was technically incorrect. The work presented was of practical minimal pratical value and not high quality academic research.

International Cybersecurity Research Collaboration

Greetings from the National Security College at the Australian National University in Canberra, where Malcolm Turnbull, Minister for Communications, is speaking at the launch of "Strategy and Statecraft in Cyberspace" research. This research will use techniques of complex systems and natural ecology. The researchers are asking for input from the community and will reach out via blogs and other on-line forms.

Minister  Turnbull started by saying the Internet is the single most powerful driver of innovation in human history (I would nominate the invention of language and writing as greater influences). He included ASD one agency which has a role in cyber security policy. Also he made a reference to "Mr. Snowdens's burglary". Minister  Turnbull pointed out that governments had to protest publicly about being spied on by NSA, because the details were made public.


Minister Turnbull then turned to the digital economy. He emphasised that the Internet was built and is run by the private sector, not governments. I don't agree that this is so significant: most human activities are run by private individuals, non-profit and for-profit organisations (not government). I helped set up the structure used to run the Internet and it was not so different to the structures I help run for other civic activities. However, I agree with his assertion that maintaining a cyberspace not dominated by government is a goal.

 Minister Turnbull asserted that the Internet is run by US based bodies, but not run by the US government. He characterises the way the Internet is governed as ad-hoc, but this is not the case. The Internet was set up with a governance structure carefully designed to prevent government control: this is no accident.

I will post a link, when the text of the speech is available.

Formulating National Security in Cyberspace

Greetings from the Australian National University in Canberra, where an international research project on "Political Strategic Ecology in Cyberspace" is being launched.  This research uses techniques of complex systems and natural ecology. The researchers are asking for input from the community and will reach out via blogs and other on-line forms.

Professor Paul Cornish from University of Exeter UK, argued that cyberspace should be treated as a strategic space. Professor Roger Bradbury,  National Security College at ANU expressed concern about the Internet being balkanized with countries such s China separating their national systems from the global network.

One of the audience members commented that the Internet was built by engineers and and that might cause an impediment to security. I found this discussion of balkanization and engineers acting without reference to the public interest troubling. The term "internet" refers to a "Network of Networks", with "The Internet" as the global example of this. Those designing the Internet did not so in isolation from issues of governance, that was key to the system.

I suggest researchers need to first look at how the Internet was created and is now governed. Professor Fred Cate , Director of the Center for Applied Cybersecurity Research at Indiana University, pointed out that most of the Internet is run by non-government organizations. He argued that the law and governance was lagging actual use of the Internet. However, this is not my experience.

When advocating the use of the Internet in Australia in the 1990s, myself and others considered the governance and legal implications. In my day job I had to devise policies for the use of the Internet and the world Wide web by the Department of Defence. This turned out to be relativity easy, identifying existing polices, laws and guidelines and interpreting these where necessary. The general assumption which many people in government and academia made, that public utilities are administered primarily by government turned out not to be true. In practice, most public services are provided by non-government entities following guidelines and standards written by non-government bodies. This approach-was extended to the Internet and proved resilient.

Governments and researchers who want to impose top-down government control of the Internet in order to protect democracy are missing the point.

One student in the audience asked an interesting question about cyber-war, outer-space and conventional warfare in developing nations. One of the panel responded that cyber-war would be an adjunct to use of conventional forces and may make conflicts harder to mange.

I asked the panel how we could get the results of their research to policy makers and practitioners quickly. In the 1990s we used the ANU fellow bar as a forum for formulating public policy, but perhaps something more systematic is needed. 

Strategy and Statecraft in Cyberspace

Join us for a panel discussion and open forum to explore the complexities of cyberspace from a national security perspective – a domain in which states and non-state actors interact with each other in an increasingly contested environment.

This event has been organized by the ANU National Security College (NSC) as it finalises priorities for its new research program on Strategy and Statecraft in Cyberspace. The NSC has brought together leading researchers from Australia, the United States and the United Kingdom for this event which will be facilitated by the ABC’s Michael Brissenden:

• 
  Professor Roger Bradbury is a complex systems scientist with experience in international cyber issues, and is with the National Security College at ANU.
• Professor Fred Cate specialises in information privacy and security law issues, and is Director of the Center for Applied Cybersecurity Research at Indiana University, USA.
• Professor Paul Cornish is an expert in cyber security and cyber war, and Professor of Strategic Studies at the Strategy and Security Institute at the University of Exeter, UK.
• Dr Jon Lindsay is an expert in international relations at the University of California Institute on Global Conflict and Cooperation at UC San Diego, USA.

Like the traditional domains of land, sea, air and space, states and non-state actors are using the cyberspace domain to pursue their objectives in an increasingly complex world. The panel will discuss the rise of cyberspace, which has created a number of ‘wicked’ policy problems for global security including:

the proliferation of cyber weapons to state and non-state actors

the systemic vulnerabilities in the infrastructure of globalisation and military power

the friction between private sector actors who manage the Internet and the public sector actors who are supposed to defend them

the mismatch between the pace of policy formation and the pace of technological change

the failure to coordinate among government agencies responsible for national security, law enforcement and industrial policy

major disagreements about how the Internet should be managed domestically and internationally.

Some authors foresee grave new risks of a ‘digital Pearl Harbor’, while their critics dismiss these warnings as inflating the threat. Technological complexity has amplified political complexity, which in turn has complicated political analysis. Our panel will endeavor to unpick these issues from the perspectives of social policy, security policy and the future of technology. We look forward to welcoming you at this important event focusing on an issue of critical significance.