UNINTERRUPTED and secure information flow is vital to the successful functioning of the Irish economy, yet there is a sense of disorganisation and even disinterest in terms of how Irish authorities could deal with the growing global trend of deliberate assaults on countries' information technology and communications infrastructure.
So-called cyber attacks or even cyber espionage are not radically new types of asymmetric warfare [see panel] between nation states, and incidents of corporations using hacks to steal information from each other or from governments date back to the widespread adoption of the internet in the early nineties. Indeed there are allegations that governments sometimes lend national industrial champions their digital espionage expertise to assist them in complex international trade discussions, and this issue was raised at the Asia Pacific Co-operation (Apec) summit in Sydney earlier this month where South Korean president Roo Moo-hyun proposed an intergovernmental 'cybersecurity exercise' to be launched in November. Defence analysts have highlighted this part of Presient Roo's speech as the seeds for a regional cold, or 'wired', war.
The government of Ireland supposedly doesn't have the geopolitical, military or strategic might to attract the attentions of the alleged leaders in electronic warfare . . . China, Russia, Britain, France, Malaysia, North Korea and the US . . . but analysts suggest the Republic could be an "indicator target" for cyber criminals or politically-motivated online militants to demonstrate the ease at which they could cripple a western economy by a series of dedicated denial-ofservice attacks (DDoS).
These DDoS attacks are initiated when a multitude of compromised computers attack a single point, thereby causing denial of service for users of the targeted system by flooding it with malicious messages. In May Estonia experienced this type of attack on its online governmental, political, media and banking systems, while the former head of MI5 last year reportedly told a meeting of British senior business that Whitehall had experienced significant state-sponsored hacking. Earlier this month it was revealed both the house of commons and the foreign office had come under recent cyber attack. The Irish government was unable to answer questions on whether it has ever experienced any concerted assault on its information systems.
"It's important to note that a lot of organised crime groups, as well as big multinationals, some of which would have operations in Ireland, have the electronic espionage resources of a small state at their fingertips, and it's important that [the government] is at least aware of this and has some defences or contingencies in place, " said defence analyst Declan Power.
Power believes Ireland's government or economic institutions would present unlikely targets for any of the major powers "because they are plugged into us economically, politically and culturaly". However it is neutral Ireland's cultural affinity with many western powers that could make it a target for so-called cyber jihadists, tech-savvy supporters of militant Islamism who the FBI estimate number around 120,000 based on their monitoring of extremist websites and online discussion boards.
Last week the US Air Force established a provisional cyber command in Louisiana in direct response to the rising number of deliberate assaults on governments' IT systems across the world. Earlier this month, the US government blamed elements of the Chinese military for hacking into the Pentagon, necessitating the shut down of some systems in the department of defence. The Chinese have denied any involvement, but the most illuminating aspect of this incident was the revelation that US authorities run dual systems so that if one is compromised, another completly separate IT network is activated. In terms of this redundancy, Ireland seems woefully unprepared for a concerted attack on its information technology infrastructure, as recently experienced by Estonia.
In May the Baltic country underwent a sustained attack on its government and economic information technology systems, almost crippling a small country that . . . not unlike Ireland . . . prides itself on its burgeoning IT-reliant technology sector and e-government facilities.
Based on Irish government departments' responses to enquiries from the Sunday Tribune over several weeks, there is a distinct confusion as to responsibility for defence and security of the state's and Ireland Inc's IT infrastructure, and an admission that "addressing this issue will involve the collaboration of a number of government departments, including communications, defence, justice, foreign Affairs, as well as the telecoms industry and end users".
The Irish Defence Forces does have information operation specialists, and runs an IT network separately from other government departments for security reasons. However a spokesman said it had received no direction to date on the wider country's information technology requirements.
"Defence policies are directed by the department of defence and no such policy has been delegated by the department of defence, " said an IDF spokesman.
The department of defence said it protected its own systems and, at a policy level, national IT infrastructure defence was the responsibility of the department of communications.
In a statement, the department of communications, marine and natural resources said it would not comment on "cyber defence plans" because it is a new development only recently brought to its attention due to the "unprecedented" attacks on Estonia.
"The Estonian experience involved both net computers in a number of countries interfering with the normal operation of [the] internet in Estonia. The full effects of the Estonian experience are still being analysed by computer experts throughout the world and these developments are being closely monitored by the Irish government."
A senior civil servant told the Sunday Tribune that one of the pressing tasks for defence minister Willie O'Dea will be to deal with the security of Ireland's communications resources during the life of the current government in light of the Estonian experience, as well as pressure emanating from a special meeting of NATO ministers in Brussels convened in June to discuss cyber warfare.
"[The attacks on Estonia] were sustained, coordinated and focused. They had clear national security and economic implications, " a spokesman for the Alliance told reporters at the closed conference. "That will be the subject of work here."
Irish security and defence analyst Declan Power said although the government apparatus of the Republic of Ireland was an unlikely target for cyber attack, economic hubs such as the IFSC were.
"Nobody would ever deny Ireland Inc is incapable of being a target of a cyber attackf and there's no doubt the security services should take the possibility on board, " he said.
One leading IT security expert who has "worked for most of the top IFSC firms at one time or another" and helped to set up the IT security systems of a number of other important Irish institutions, said the majority had "hardened perimeters, okay web systems, but were soft inside". This means networks are vulnerable from internal attack or external Trojan horse-style assaults . . . a supposed speciality of hackers with links to the Chinese military.
He claimed Ireland actually experienced the first known cyber attack launched by a state in the mid-nineties when it is alleged the Indonesian government blocked out an East Timorese website hosted in Ireland.
"In military terms interdiction rather that attack, ie jamming, is more of a threat, and there is very little awareness of this at policy level in the Irish government."
The expert said spare server capacity is the only real defence against concerted cyber attacks on the Estonian model, known as distributed denial of service (DDoS) attack.
"Excess capacity is the only defence but that is very expensive. It's essentially a numbers game."
In a speech to the Centre for Stategic and International Studies last week, retired US general John Abizaid said the internet would become the next theatre of warfare and strategic influence in the modern state system.
"We've got to contest the virtual space, " the former US commander in the Middle East told attendees. "In the Napoleonic era, war was land and sea.
Today we have to operate, not only land, sea, air and space, but we have to understand that the virtual domain is a domain of war that requires our constant attention and vigilance and it's not just an area to be watched."
-=-=-=-
Under attack: a world wide web of cyber terrorism
ESTONIA MOONLIGHT MAZE FBI codename for series of cyber attacks on the US in 1999, reportedly traced back to Russian servers.
TITAN RAIN Name given to a series of attacks, believed to be Chinese in origin, on NASA and aerospace research labs in 2002.
YUGOSLAVIA NATO was reported to have hacked Serbian communication systems before it entered Kosovo. In response, the Serbian Black Hand group used In May angry Russians living in Estonia expressed their rage online when the government removed a Soviet-era statue from the capital, Talinn.
Government, political parties, newspaper, banking and other businesses' online systems were then hit by coordinated waves of distributed denial-of-service attacks (DDOS) causing widespread disruption. Estonia rushed to point the finger at the Kremlin, and NATO sent cyber warfare specialists to the Baltic, but subsequent investigations showed millions of computers had been harnessed by organised Russian cyber criminals to stage the attack.
cyber attacks to disrupt the rebuilding process in Kosovo.
CHINA-TAIWAN
Several political and naval stand-offs between Taiwan and China during the late 1990s were punctuated by hackers on both sides of the Taiwan Strait launching attacks.
KOREA
South Korean authorities claim North Korea has trained up to 600 electronic warfare specialists who regularly probe Seoul's cyber defences.
TITAN RAIN II
During the past three months the US Pentagon and several British government departments claim to have come under cyberattack from Chinese hackers. Australian and New Zealand government departments were also affected.
GERMANY
Germany's chancellor Angela Merkel complained to Chinese authorities in August after an article in 'Der Spiegel' magazine reported Chinese cyberespionage software had been found scattered across sensitive economic and foreign affairs departments, including Merkel's private of"ce.
|