Agha, Dray

Rowell, Joe

Cyber espionage is an increasingly pertinent topic of attention in UK news, amongst security researchers, and within intelligence communities. Historically, spaces like Bletchley Park have framed intelligence and counterintelligence operations as interdisciplinary activities, and this is a perspective that was echoed by our cyber espionage conference at University of Oxford. The 5th annual conference was organised and run by a committee of Oxford and Royal Holloway doctoral researchers studying at EPSRC Centres for Doctoral Training, all of whom come from different discipline backgrounds, but were inspired to come together with the aim of contributing to a better cyber security future for the UK. As adversaries with evolving technological toolkits continue to mount novel attacks to undermine UK's security, surveying current cyber espionage capabilities has potentially never been more pressing. This report on the event summarises each speaker’s conference presentation*, and is intended to contribute to a discussion about UK security and also the international discussion on how cyber security and cyber espionage will advance in the 21st century. You are most welcome to download this report and contact the authors if you have any ideas on how to improve this project for the future<br/

Royal Holloway - Pure

Cyber Espionage   Conference Report2nd-3rd May 2019  Centres for Doctoral Training in Cyber Security: University of Oxford & Royal Holloway, University of London    Why Cyber Espionage?Introduction The Universities-Security-Intelligence Nexus Liam Gearon, University of Oxford Open Source IntelligenceNiamh Healy, Ridgeway Information Cyber Espionage in Law and PolicyRobert Carolina, Royal Holloway, University of London Gender and IoTLeonie Tanczer, University College London Cyber Intelligence and Offensive OperationsStephen Wolthusen, Royal Holloway, University of London Operational considerationsDavid Pickard, Independent security researcher Student Lightning TalksCDT PhD Students Summary ContentsPage 1  Page 2  Page 3  Page 4  Page 5  Page 6  Page 7  Page 8  Page 9     Cyber espionage is an increasinglypertinent topic of attention in UKnews, amongst securityresearchers, and within intelligencecommunities. Historically, spaceslike Bletchley Park have framedintelligence and counterintelligenceoperations as interdisciplinaryactivities, and this is a perspectivethat was echoed by our cyberespionage conference at Universityof Oxford.  The 5th annual conference wasorganised and run by a committeeof Oxford and Royal Hollowaydoctoral researchers studying atEPSRC Centres for DoctoralTraining, all of whom come fromdifferent discipline backgrounds, butwere inspired to come together withthe aim of contributing to a bettercyber security future for the UK.    As adversaries with evolvingtechnological toolkits continue tomount novel attacks to undermineUK's security, surveying currentcyber espionage capabilities haspotentially never been morepressing.  This report on the event summariseseach speaker’s conferencepresentation*, and is intended tocontribute to a discussion about UKsecurity and also the internationaldiscussion on how cyber security andcyber espionage will advance in the21st century.   Why Cyber Espionage?Page 1*Each talk is the editors’ summary and may not represent the totality of each speaker’s point of view   The triad of universities, security (military)forces, and intelligence communities forma nexus of knowledge exchange that hasexisted for decades. Gearon'stalk articulated the details of thisrelationship, and drew on his forthcomingpublication  'The Routledge InternationalHandbook of Universities, Security andIntelligence Studies' Two individuals who have demonstratedhow these three worlds overlap, are:Dwight Eisenhower, who served as ArmyGeneral in the US military, as 34th USPresident, and as 13th President ofColumbia University; and former FBIDirector James Comey, the latter of whomco-hosted an invite-only student cybersecurity conference at Boston College in2017 Security after World War Two expandedfrom the domain of the military tosomething now also studied andconceptually contributed to by academics -a phenomenon of militarisation, perhaps,evidenced by the existence of our ownconference.  The university campus is no stranger tothe world of espionage, a contemporaryexample being foreign students   'The Universities-Security-Intelligence Nexus': Liam Gearon, University of Oxford“What Does Secret Knowledge Achieve?” and foreign professors monitored byintelligence communities for fear ofindustrial or state espionage. Universities are a complicit actor in theintelligence-security apparatus. Attimes, universities have been thebedrock of anti-government critique, orhave cemented the power ofintelligence communities. Perceived asliberal institutions, universities may  portray their relationship withintelligence and security agencies assomewhat more distant than whatGearon would say is the reality.  Collaborative research between thesespheres is important for securingpeace, but the role of the academicmust be viewed as tied to the security-intelligence world. This realisationcomes with ethical issues, as theknowledge shared by universities cancontribute to military activities that mayresult in the death of adversaries andpossibly even civilians.  Our first speaker set the stage for us toconsider what it means for us to besecurity researchers, reminding us thatit is not a responsibility to be takenlightly.Page 2   Open source intelligence (OSINT)communities are a different and lesswell-established kind of intelligencegroup. Healy emphasised the role ofOSINT in verifying the commitmentsmade by states to nuclearnonproliferation, for example. OSINTthus maintains an internationalpeacetime status quo that avoids kineticescalation (physical retaliation).  There are several examples of civilianOSINT being used to supplement state-sanctioned cyber espionage, notablyBellingcat’s unmasking of the GRUoperatives (allegedly) responsible forthe Skripal poisoning, but also situationsin which using publicly available satelliteimagery has facilitated the identificationof cases of Chinese industrialespionage.'Open Source Intelligence': Niamh Healy, Ridgeway Information“Open Source Information is Potentially More Verifiable” The use of OSINT to avoid stateshaving to call each other out forinternational norms violations allowscivilians to do what was previously theremit of media (to whom spies leakedtheir findings).  Now, OSINT communities cancorroborate each other’s work andactively shape global relations, withoutcausing international tensions orendangering human espionageoperatives.  OSINT also highlights the imperative toapproach intelligence gathering from avariety of cultural and linguisticperspectives. The ability to translateinformation from and into variouslanguages is an asset to all intelligencecommunities; it is a telling geopoliticalpicture that GCHQ advertise jobs forspeakers of Russian, Farsi, Mandarin,and Arabic.Page 3   The spectres of China, Russia andNorth Korea loomed large duringCarolina’s talk.  Cyber espionage is simply defined, withinfluence from NATO’s Tallinn Manual,as 'information gathering via cybercapacities'. Cyber espionage as a tool isindispensable, as it gives adversaries acheap method to gather large amountsof data and influence other states, allwithout fear of potential reprisal as theveil of anonymity can obfuscate actionsand identity. Legally, ‘cyberspace’ does not exist.International law is such that cyberoperations and espionage can violatethe sovereignty of a State, andprosecution and penalties are bothdependent on the physical location ofthe attackers and their targets. However, attribution of adversaries’activities is hard, and thequestion becomes how one can legallydesignate the responsibility of an action.Is a State ‘responsible’ if one of itscitizen carries out a cyber operationagainst another State?'Cyber Espionage in Law and Policy':Robert Carolina, Royal Holloway, University of London“Cyber Espionage is a New Tool in an Old Game” Yes, the State is able to convict theattacker under their own domesticlaws, but the State that houses thisindividual is not necessarily seen as acomplicit actor. A non-state actor’s cyber-operation,when directed by the State, canbecome attributable to the State, andtherefore are an issue for internationallaw. Cyber attacks are prohibited byinternational law: one cannot injure aperson or damage objects via a cyberoperation. Still, cyber espionage, perse, is not actually a violation ofinternational law, but the methods forconducting cyber espionage mayviolate laws and agreements.   Although espionage has existed forcenturies, the prefix of ‘cyber’multiplies the complexities that the UKmust navigate in the 21st century if weare to withstand adversaries’information-gathering attempts, andlaunch our own.Page 4   Security threats are usuallyconceptualised by most to be at State-level. Tanczer highlighted that somecyber security threats are on the scaleof the household, but are still very muchexistential.  A very different notion of ‘cyber security’is enacted, whereby devices and thecontrol over them are used toundermine an individual’s privacy andsecurity on a daily basis. This is‘technology-facilitated abuse’. As theInternet of Things (IoT) expands, anincreasing number of devices in ourhome and on our body will conveyinstantaneous data.  These devices can be weaponised byanyone to facilitate surveillance, control,and abuse. Tanczer stated that thisabuse is highly gendered, with thepurchase, set-up, and maintenance ofdomestic technologies often carried outby men, leaving women in situationswhereby their devices (and their lives)are at the mercy of their partners. We participated in a live experiment toinvestigate the vast array of ‘spying’apps. We found apps - sold as 'Gender and IoT' Leonie Tanczer, University College London“Intimate Espionage; Spying within the Home” parental monitoring for children’sphones, which is problematic in itself -that could be downloaded to become adigital panoptic surveillance system foran abused person if downloaded ontotheir phone by a partner.  This app would give the controllercomplete access to GPS locationinformation, call data, messagecontent, live listening capabilities, andaccess to Internet history and picturememory.  Tanczer and her research partners runworkshops working with survivors ofsuch abuse and their social workers,arming them with the information theyneed to stay safe and to realise whenabuse is taking place.  Ultimately, however, police servicesand policymakers need to givetechnology-facilitated abuse closerattention, with a legal emphasis onhow taking control of devices cancontravene someone’s rights - even ifit is a partner committing this crime.Page 5   This session was based around thetechnical controls and tools that can beused to implement different forms ofintelligence gathering from “inside thesystem”. For all its perks, the Information Age hascaused many issues for the signalsintelligence community as there issimply too much data to becomprehensively analysed. Thissituation will only get worse - it isspeculated that by 2022 there will beover 122 Exabytes of datacommunicated over the Internet permonth. In addition to this, the deployment ofcryptographic protocols across devicesat all layers of society makesinterception and analysis of electroniccommunications more difficult. Wolthusen suggested that to negatethis, intelligence agencies (andwannabe spies) are resorting tocompromising devices at a hardwarelevel or network level, where lessverification occurs.Spying in this mannercan have the benefit of not interferingwith the target, which for some industrialsystems is vital.  'Cyber Intelligence and Offensive Operations'Stephen Wolthusen, Royal Holloway, University of London“From Port to Porch” Page 6There is also the benefit of additionalcontextual information by eavesdroppingat the endpoints of the communicationversus intercepting messages in transit. This is often enacted through supplychain attacks. Indeed, most hardwaredevelopers have been forced tooutsource the production of thehardware to a third party due to theexorbitant costs of manufacture. Thisimmediately places control of the supplychain and verification of hardware withan external organisation, which may notbe ideal.  This risk is well-known; the NSAproduced their own computer chips atFort Meadle to prevent this sort ofattack. However, the economic andmarket factors associated with such adecision ultimately prevented this frombeing a viable long-term strategy.  Suggested solutions include verificationof computer systems at all levels, builtaround secure tools and services. Thisis especially important due to theincredible difficulty of verifyingcomponents at circuit-level.    For all of the theory discussed so far,cyber espionage is still a new andchanging field. Pickard highlighted that,for British intelligence agencies, intent iskey -  namely, 'why is the operationbeing carried out?' The associatedcosts, qualities, and results are allimportant aspects to consider whendeciding which counterespionageapproach to deploy.  The contrast between humanintelligence and signals intelligence wasalso discussed at length - both in termsof personnel that are needed to carryout the operations, but also in terms ofthe information that is to be extracted.  Cyber security uniquely sits betweenthese two realms - as opposed totraditional signals intelligence (which ismostly passive) and to humanintelligence (which can be very direct).Ultimately, however, cyber espionagemust be used carefully due to theplethora of data available and the lack ofresources that so often characterisescyber operations.  'Operational considerations'David Pickard, Independent security researcher“The Reality of Cyber Espionage” Public perception of cyber capabilitiescan also impact the choices on whenand how to use certain cyber espionagetechniques - as is often the case, theymay be widely perceived positively ornegatively, depending on the scenarioand current affairs. In addition, Pickard mentioned thedifficulty of cross-border informationsharing. The tension between theincreasing internationalisation ofintelligence and data protectionregulation can cause conflict whileconducting effective and safe espionageoperations.  Even in our domestic setting, Pickardhighlighted how UK legislation restrainsand guides the behaviour of members ofour intelligence agencies. The politics ofa warrant request and warrant-signing,for example, were mentioned as crucialfor keeping surveillance at an ethicallevel - preventing undemocractic mass‘surveillance’. Page 7 The goal of this session was to allow doctoral students to discuss relevanttopics of interest To begin, Amy Ertan informed the audience about the lack of consensussurrounding the term “algorithmic warfare” in current research literature.  Following this, Freddie Barr-Smith discussed the art of penetration testingand using it to assess aspects of an organization’s security policy andculture.  Dray Agha then examined how information and territory are utilised andweaponised in contemporary Russian military doctrine.  Finally, Fatima Zahrah and Julia Slupska detailed their systematicapproach of applying the “pathetic red dot theory” to the issue of tech-facilitated domestic abuse.CDT PhD Students' Lightning Talks Page 8 One theme that influenced all of thetalks was the rule of law: how thestipulations of legislation andregulation determine what actionsinstitutions can and cannotundertake; how policy andpolicymakers with a global outlookhave inherited a mosaic of nationallaws that conflict and run parallel toone another; how these issues makeinternational legal collaborationdifficult between States; and alsohow government policy needs inputfrom industry and academia.  The UK, and its allies, are currentlygrappling with whose technologythey can trust: the concerns overHuawei, and if they are an honestglobal telecommunicationscorporation, or a mechanism for theChinese state to commit cyberespionage on a global scale. Thepotential for an adversary to haveunhindered access totelecommunications is a grave threatworth investigating by all disciplinesand communities.  Summary Now, more than ever, research isneeded to inform policymakers'decisions on what and whosetechnologies should be legislatedfor and against. Research is neededinto how technology can beexploited in unexpected ways,making material threats that couldnot have been conceived. Researchis also needed in the 'attribution'problem, to better discern whoexactly the adversary of a cyberoperation is, so they can face legaland economic repercussion. Research in espionage is difficult,given that much remains privy togovernment institutions only. Butdifficult is not impossible. It is up tous all to proactively contribute to ournation’s security and to fosterinternational relations to guaranteethat future policies and laws will becrafted within the context of a globalcommunity centred around thevalues of freedom, democracy, andequality.Page 9  Contact the Organizers and Editors Anjuli Shere Anjuli.Shere@new.ox.ac.uk Hayyu ImandaHayyu.Imanda@exeter.ox.ac.ukJoe RowellJoe.Rowell.2015@live.rhul.ac.uk Dray AghaDray.Agha.2014@live.rhul.ac.uk

Cyber Espionage - May 2019 Conference Report:A Collaboration between Centres for Doctoral Training at Royal Holloway, University of London &amp; University of Oxford

https://pure.royalholloway.ac.uk/ws/files/33922755/Cyber_Espionage_Conference_Report_.pdf

Cyber Espionage - May 2019 Conference Report:A Collaboration between Centres for Doctoral Training at Royal Holloway, University of London & University of Oxford

Abstract

Similar works

Full text

Available Versions

Royal Holloway - Pure

Cyber Espionage - May 2019 Conference Report:A Collaboration between Centres for Doctoral Training at Royal Holloway, University of London &amp; University of Oxford

Abstract

Similar works

Full text

Available Versions

Royal Holloway - Pure

Cyber Espionage - May 2019 Conference Report:A Collaboration between Centres for Doctoral Training at Royal Holloway, University of London & University of Oxford