CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Search for "intelligence community"

Search Results for: intelligence community

Moscow Rules: The original protocol for operating in the presence of adversaries can be applied to cyber defense

allendullesLessons learned from US agents who operate in enemy territory have been captured for years and transformed into a code of conduct popularly known as “Moscow Rules.” Those old rules existed for a reason. Real-world experience proved their effectiveness when agents had to operate in the presence of adversaries.

Since modern cyber defenders are also frequently required to operate in the presence of adversaries there are lessons from these old Moscow Rules relevant to cyber defense.

With that as an introduction, the following is a modified list of the old Moscow Rules designed to help the cyber defender under fire.

Consider these as “Moscow Rules for Cyber Operations”

  • Do not trust your gut. Your gut is not used to the manmade creations of cyberspace.  Instrument, measure, monitor and seek to confirm everything.
  • Do not trust any single source of information. Seek multiple sources, especially sources from outside your organization.
  • Design your cyber defense monitoring system to bring all sources together for “big data” analysis. This includes structured network and computer derived information and also unstructured feeds from advisory reporting, vulnerability reports, social media and specialized cyber intelligence feeds.
  • Backup everything of importance to your mission, and keep unalterable logs. This will save you, again and again.
  • Understand your actions are being observed. Your adversary is watching you watch them; you are never completely alone.
  • Trust no one. Trust no device. Every device in your system is potentially under opposition control. Your computers, networks, VOIP phone, your Telepresence system, your laptop, tablet and even cell phone, are all potentially compromised. Architect your enterprise to ensure penetrated systems are detected, isolated and their comms grounded.
  • Even in the complex heterogenous world of modern enterprise IT you can find boundaries and control points. Know where they are and how to leverage them to your advantage. Establish rules at every gate.
  • Protect your most important data, knowing that its loss could destroy your business. Other things need to be protected, but you likely can’t afford to treat everything the same.
  • Don’t harass the opposition. You want to enhance your defenses and keep them out. You do not want to embolden/encourage hatred. You want them to go away. More than likely you are not good enough at defending your own enterprise to even think of doing anything offensive. Save that for the government.
  • Keep your options open. Understand your adversary is a thinking, creative entity that will react and surprise you. The team you push out of your system may be replaced by a much more sophisticated team.
  • Know your tradecraft and make sure your entire team does as well (many exemplars and best tradecraft practices are available, a favorite of mine is the community produced Consensus Audit Guidelines).
  • Training and education of your workforce is important, but it will fail you. Even with all the training in the world your workforce will eventually be deceived by creative, determined adversaires. Know that right now a user somewhere in your organization is doing something they should not be.
  • Be careful about outside consultants. The cyber defense field, unfortunately, attracts charlatans who assert that they have special knowledge of how to defend. The only way to vet experienced cyber defenders is to have either observed their past performance first-hand or to get first-hand reports by those you trust.
  • Pick the time and place for action. Move fast to protect your most important info. Take actions to keep your adversary off balance. Build plans in well thought out ways to raise all other info defenses on your schedule.
  • Understand the human tendency to forget about the threat as soon as the current attack has been mitigated. Do not fall victim to this cyber threat amnesia. When not under visible attack, study, prepare, and test your own defenses.

Have you had responsibilities for defending an enterprise in the face of adversaries? Does the list above resonate with you, or is any part of it out of whack with your experiences? I would appreciate your thoughts.

Till the, remember:

Trust no one. Trust no device. Every device in your system is potentially under opposition control.

For more on these topics see the CTOvision Guide to National Security Technology and

Awake Yet? The list of cyber security "wake up calls" grows as predicted

cyber-workforce.previewThere are several certainties in computer security. One is that when adversaries have intent they will always find a way to get what they want. Another certainty is that leadership in government and industry is quick to forget the lessons learned in cyber security, especially those dealing with adversary action. This situation is known as Cyber Threat Amnesia.  I believe there are cures for Cyber Threat Amnesia, and I think those cures might come with education, training and awareness, but that is just a theory, one that I hope is tested one day.

Till then, resolve yourself to this observable fact: Our history indicates cyber security events frequently cause action and remediation and those can get widespread attention. But soon after the attempt to remediate, organizations collectively forget about the threat.

Here is an updated list of major events. This is not all major events, just those widely reported to be “wake up calls” for the nation.

  • 1970 and 1971 – The Defense Science Board publishes what will be known as the “Ware Report” highlighting the potential dangers to department information in the coming age of connected computing. This report was widely seen as a “wake up call” for computer security and caused changes at institutions like the National Security Agency to enhance the departments security posture.
  • Nov 1988 – The Morris Worm was released and propagated throughout internetworked systems including those of the federal government. This “wake up call” resulted in establishment of computer response organizations throughout DoD and also resulted in increased funding for computer security research being provided to academic organizations and institutions. The CERT/CC at Carnegie Mellon University was funded.
  • 1995 – The President’s Commission on Critical Infrastructure Protection (PCCIP) was widely regarded as a “wake up call” for the entire federal government and since it was extensively coordinated with industry and academia was also seen as a way forward in cybersecurity for the entire nation.
  • 1997 – Deputy Secretary of Defense John Hamre was quoted as saying “Solar Sunrise was a wake up call for DoD.” This activity resulted in increased funding to cyber defense organizations and the creation of a new joint activity called DoD’s “Joint Task Force Computer Network Defense” or JTF-CND (Gourley was first Director of Intelligence (J2) there).
  • 1998 Assistant Secretary of Defense Art Money was quoted as saying “Moonlight Maze was a wake up call for DoD.”  This activity resulted in enhanced counterintelligence resources and more information sharing across the DoD law enforcement and counterintelligence.
  • 2009 Director of National Intelligence Admiral Blair testified that “Buckshot Yankee was a wake up call” for the government. This activity resulted in more awareness and more funding for cyber security throughout the federal government.
  • 2010 Deputy Secretary of Defense Lynn writes that “Google’s Aurora attacks were a wake up call for us all.”  This wake up call resulted in stronger, deeper coordination across the federal space and underscored need for a DoD strategy.
  • 2011 Deputy Assistant Secretary of Defense Bob Butler says “Wikileaks was a wake up call for DoD.”   This wake up call resulted in significant activities and planning across the federal space aimed at enhancing security of information from disclosure.
  • 2012 Sep, In one of the most destructive attacks against computers noted against any company to date, Saudi state-owned ole company ARAMCO had data destroyed on over 3/4 of their companies computers. The NY Times reports this as a “wake up call” and attributes intelligence officials with that assessment.
  • 2012 Oct, South Carolina Gov Nikki Haley announced a massive hack into state websites. The Gov offered the excuse that these attacks are increasingly common. Reporters suggested this be her “wake up call”.
  • 2012 Oct, Secretary of Defense Pannetta issues what he said is a “clarion call” for American’s to “wake up” to the growing cyber threat.
  • 2012 Nov, Former Director of National Intelligence provides “wake up call” warning of a potential 9/11 type attack via cyber.
  • 2012 Sep, Department of Energy issues a report on internal cybersecurity practices. This report by their internal inspector general was reportedly seen as a “wake up call” for the agency’s cyber security group.
  • 2013 Jan, New York Times acknowledges hacks into its papers by Chinese sources. This was widely reported as a “wake up call” for security experts in media.
  • 2013 Jan, Twitter was hit by a major hack in what security experts called a “wake up call” for the ecommerce and social media community.
  • 2013 Jan, Attacks on US banks called a “wake up call” for the industry by cyber security professionals.
  • 2013 Feb, Anonymous attacks against Federal Reserve investigated by FBI. Compromise, called a “wake up call” compromised data from the Fed’s Emergency Communications System.
  • 2013 Feb, Chairman of the House Intelligence Committee expressed confidence that the hackers recently targeting newspapers and other companies would soon “wake up” Washington on cybersecurity.
  • 2013 Feb, Mandiant releases a report exposing one of China’s Cyber Espionage Groups. This report, widely considered one of the best articulations of the threat, resulted in significant positive awareness on the seriousness of the threat and was widely called a wake up call. We believe this is one of the best pieces of cybersecurity research ever produced by an independent company, and we know it is making positive, virtuous change. We hope this goes a long way to really being the wake up call we all need.

Of course the reason to publish this list is not to make fun of people for using the term “wake up call.”  The reason to publish the list is to get your brain deeper into the game. Maybe there is something you can do to prevent Cyber Threat Amnesia.  Maybe you can suggest action to current community or government or business leaders? Or maybe you can find ways to educate policy makers or Congress or the American public? Or maybe you have other ideas for stopping this madness of forgetting about the threat.

For more on these topics see the CTOvision Guide to National Security Technology and

Social Media and Extremism: Sideshow or Center Stage?

CTOTerrorismblogOn Twitter, Mike Olson of Cloudera asked me and Alex Olesker what we thought about the use of social media in the latest dustup between Israel and Hamas in Gaza. He linked me to an article taking a broader look at the role of social media in terrorism and extremism. The following is some thoughts on how to think about the relationship of social media to social movements, extremist and benign. Tech audiences with a practical interest in tech and social movements can benefit from considering some theoretical perspectives not usually seen in most tech conversations.

2013 will likely see much more attention on information technology and social movements. In 2011, the Arab Spring and Occupy Wall Street spurred debate about the tactical applications of social media, not all of it productive. On one hand, there was a “gee whiz” tone to much of the coverage that ignored other important dynamics. In October, Thomas Frank wrote a biting article about how journalists and academics, infatuated with the idea that OWS represented a radically new (and superior) form of social movement, ignored the substantial and sometimes self-imposed barriers to its success. The same can probably be said of coverage of the Arab Spring, much of it based on a simplistic image of kids with MacBooks and iPhones toppling autocrats. On the other hand, Malcolm Gladwell and others denied the very real differences between social movements 1.0 and 2.0. Particularly useless was Gladwell’s presumption that analog-era activism was somehow more authentic and powerful than IT-mediated activism. So where to go from here?

First, social media can’t be analyzed with the presumption that social media is somehow separate from the overall web of social conflict. Rather, we should move forward with the assumption that we have one reality, composed of both organic and technological layers. Cyberspace is a sociotechnical system, which as CTOVision contributor Sean Lawson explains can be understood as follows:

[Sociotechnical systems] are large, complex systems in which the lines between the social and the technological, the human and the machine are increasingly blurry. As the passage implies, even something as seemingly simple as an airplane flying in the sky is actually just one part of a large sociotechnical system composed of various human and machine elements, from the pilot and airplane to a series of airports, communication and navigation systems, bureaucracies, regulations, rules and norms of flight, and more.

With the Arab Spring “twitter revolutions” we can see that human and machine elements and organizations all meaningfully combined to produce powerful and fundamentally emergent movements. Social media may not have been a primary cause but it also very much defined the realm of possibility for social action. Technology isn’t neutral, and certain technologies are more conducive to decentralized movements. Information age social networks have reduced transaction costs in a way earlier communications have not. There’s also a collaborative aspect that Alexis Madrigal covered in his post about the “APIs” of Occupy Wall Street.

The composition of sociotechnical systems also constantly shifts due to shifts in norms, regulations, rules, technological shifts, and bureaucratic hierarchies. Cyberspace may have some essential characteristics rooted in its function as a zone of machine-mediated communication, but it is also a designed environment with a constantly shifting landscape. Politics and networks of social capital are a part of that landscape, and this certainly includes extremist groups.

We can understand jihadi social media usage as being part of an overall assemblage of techniques, key personnel, and resources that constitutes a complex structure that can be tapped on by insurgents looking to advance their instrumental ends and communicate and discourse with an extended community of ideological fellow travelers. Israeli researcher Dima Adamsky argued in 2009 that, lacking the war colleges, doctrinal institutions, or military service journals of the West, jihadis debate theories of strategy evolve on web forums and zines. It’s still unclear how social media precisely fits into the radicalization process, despite the tendency of Western police departments to equate possession of jihadi media with radical intent. We’re on more solid ground in terms of tactical planning when we look at non-jihadi international social movements’ usage of twitter as a medium for directing protests and outsmarting police crowd control methods. Finally, there’s always the use of social media as a rapid-fire propaganda weapon that can influence external audiences and regulate and stimulate domestic audiences.

Police researcher John P. Sullivan has also written about how Mexican drug cartels have used social media to spread “narcocultura” in Mexican public life. When combined with coercive actions, narco-glorifying folk songs, provision of services, and murals, social media becomes a powerful means of making the violent image of the Mexican drug cartels part of everyday life. Jihadi groups have arguably not attained a similar level of cultural penetration, but Daveed Garteinstein-Ross and other counterterrorism experts have written about the ways in which jihadi culture–online and offline–can create a unique lifeworld for those who feel left out of secular culture.

Yet there’s a risk in looking at technology without the political and operational considerations. Terrorist organizations are clandestine in nature and practice tradecraft that limits their exposure to Western intelligence organizations. Thus assuming that covert networks function in the same way as social movements or Facebook friend groups is of limited utility. Taking down an extremist site is not equivalent to taking down a network node. Second, there’s often a harmful tendency in tech analysis to place social media use as the dominant element of a social conflict. Reporters salivated over the IDF and Hamas Twitter-fighting each other and missed the centrality of actual combat to the outcome of the short Gaza conflict. At the end of the day, as Rear Admiral J.C. Wylie wrote, the “man on the scene with the gun” decides the war, not the kid with the iPhone.

A balanced understanding of the ways social media is vehicle for and a shaper of contentious political movements will be a net benefit to CTOs, tech reporters, and technologically-minded national security analysts. Watch this space for more on this subject in the future.

Public-Private Information Sharing and Lessons for the Government CIO/CTO

Public-Private Information Sharing, or a varient of that concept, has been a part of federal government strategic plans for as long as I can remember. Every cyber security related study I know of, including the famous 1966 President’s Commission on Critical Infrastructure Protection, has made public-private information sharing a key strategy.  Federal agencies and studies have made important suggestions regarding public-private information sharing part of most every major IT study.  I’ve seen this type of information sharing work very well, but as a technologist I’ve also seen a need for (and urged) improvements to the model.

For example, too frequently the way government executives are forced to do public-private information sharing is through processes that flow from the Federal Acquisition Regulations (FAR).  The FAR mandates market assessments and surveys to be done in ways that do not give one company an unfair advantage over another. This is smart of course, but results in some industrial age information gathering that is not very timely.

Federal technologists also do quite a bit of direct coordination with industry to learn and they do this under the watchful eye of procurement executives to make sure this is all above board, and this sort of coordination with industry technologists is absolutely critical to the smooth functioning of federal enterprises. The executives in DC who make trips to Silicon Valley or great hubs of innovation like Boston or Raleigh or Boulder (home of WayIn) come back with information that can help their strategic planning and this sort of public-private info exchange also helps industry know important things about government mission needs.

But too frequently government is tempted to just ask their local industry reps for info and advice on the future of technology. This is still public-private info sharing, and when budgets get tight is can be incredibly cost effective to just turn to a favored federal systems integrator that you already have on contract and ask them questions and consider this your public-private information exchange. There are many great integrators in the DC area and I know and love them but this is not optimal long term, since most integrators serving government become captured by government and talking to them is almost like talking to yourself.

There are also many non profit collegial organizations and consortia in the federal space that government frequently turns to for public-private information sharing and coordination.  These include many great organizations that I volunteer time with, like the Intelligence and National Security Alliance (INSA), the Armed Forced Computer and Electronics Association (AFCEA), and the National Defense Industrial Association (NDIA).  I volunteer with these groups because I love them and strongly support the positive change they make in the world. But when government turns to these groups for their public-private information exchange it is sub-optimized. They are full of people like me, former government executives who might be easy to talk with but who might not be as up to date with the best information industry has to offer.

Some lucky few government technologists get to interact with In-Q-Tel, a collective of very savvy technology and business professionals who absolutely master the art of surveying industry for best technology. The entire government would be well served if this model were replicated for all. But for now In-Q-Tel cannot serve the entire federal space. And it also serves mostly in the new technology space, not in areas like process, procedure and lessons learned exchanges. In-Q-Tel is only part of a solution.

I always recommend to government friends that they make the most of the great resources American industry has to offer and that includes learning from locals in the DC ecosystem but should also include a program of focused interaction with others far from DC.  You will make great friends doing this and the connections you make can turn into long term trust-based relationships that can help both the government and American industry advance.  Time is precious to all of us, so government executives need to plan how this is done wisely, but periodic visits to the champions of industry like Oracle, Microsoft, IBM, Apple, HP, VMware, EMC, Cloudera, Cleversafe, Terracotta, AT&T and the great Venture Capital and Private Equity firms for reviews of their portfolios are critically important. I’ve also been so fortunate in my career to have spent time with chip makers, security firms, and even great institutions like Disney. It is all a learning experience.

Direct interaction is best for these long term trust based relationships, but when that is hard you can also meet industry online. One great place to do that is through venues like the Enterprise CIO Forum. Since this is a forum backed by CXO Media (the parent company of CIO magazine) it is a well resourced venue that includes a world class community manager (John Dodge).  If you are a CTO or CIO in the federal space you probably already read CIO Magazine. Why not join the Enterprise CIO Forum to interact directly with people from outside the federal ecosystem?

Related Posts:

Changing Government Requirement For Market Research to Continuous Market Assessment

Thoughts on the Government Shutdown: from a technologist perspective

The Role of the CTO: Four Models for Success

Cyber Offense, Defense, and Economics

The Center for Strategic and Budgetary Assessments (CSBA)–known for its assessments of the precision-strike revolution and work on Air Sea Battle–is tackling the intellectual challenge of cyber strategy. Its new report, Cyber Warfare: A ‘Nuclear’ Option? has not gotten much play in the blogosphere but has a number of interesting ideas. CSBA challenges dogmas on both sides of the cyber debate while retaining a welcome sense of humility about its ability to predict the future.

The report’s author, Andrew Krepinevich, was one of the people in the early 90s that explicitly predicted cyber operations and tactics as a precursor to and element of major war. In his late Cold War work on the military-technical revolution (MTR), Krepinevich predicted that future conventional wars might start with an effort by both sides to use information warfare to suppress each other’s systems. So his thoughts on the cyber weapon are definitely of interest to policymakers and enterprise CTOs.  Having read a lot of dreck lately on all things cyber strategic-related, I was pleasantly surprised to find a historically informed argument that stakes a middle path between endemic cyber hype and underestimating the threat of state and non state cyber operations.

First, Krepinevech takes a fairly nuanced view of strategic bombing in World War II. While infrastructure attacks were not sufficient to break the will of the enemy in the European Theater of Operations, they did impose massive costs on the Germans. From the sheer density of air defense personnel tasked to the damage inflicted on crucial industries, strategic bombing did achieve effects–albeit at a high cost. Still, German forces had to be ground down the old-fashioned way, and at the time of surrender large combat units still remained in the field. The ability to realize prompt destruction only arrived with the atomic bomb, but its use as a battlefield weapon was at best ambiguous after Hiroshima and Nagasaki. Though the United States always planned to deploy nuclear weapons to stop the Soviet hordes should they break through its defenses, it used nuclear weapons primarily to advance its position in a bipolar international system.

Instead of raising the specter of a catastrophic “Cyber Pearl Harbor,” the report raises the possibility of cost-imposing infrastructure attacks that progressively raise the financial losses involved in patching vulnerabilities and adapting to compromises with wide-ranging implications. Thus, while a countervalue cyber attack may not cause a societal collapse it could nonetheless cause problems that would advance an attacker’s political objective. Infrastructure failures that mesh with features of modern society such as the dependence on electricity for refrigerated food would represent formidable advantages for the defender if coordinated together. Krepinevech, echoing Sam Liles’ recent work on the evolution of cyber weapons, suggests that future weapons might not necessarily depend on exploits as we currently understand them. With a large enough botnet, an attacker could potentially crack even secure codes and enable attacker control. The CSBA report notes that officials are right to be concerned about vulnerabilities, but need to understand the distinct features of the weapons at hand. While not absolute weapons, the risks are real.

Much of the report rehashes vulnerability assessments and incidents (Aurora, Operation Shady RAT) that cyber observers will be well-familiar with. But James Hasik picks up some of the report’s implications for the defense industrial complex:

As we saw in the Stuxnet case, cyber weapons can, with enough information, be targeted at individual pieces of equipment within individual facilities. And as we also saw, those things can escape into the wild, given just “one idiot with a thumb drive” (as I read the line once on Ars Technica). It’s also notable that the surgicality is likely inversely related to the cost of the weapon: the more targeted, the more expensive (see below for more on costs). This is mostly the reverse from physical weapons—guided bombs and missiles, for example, are more expensive by the round, but by saving on all those unguided rounds that would go astray, and the extra aircraft to deliver them, they actually turn out to be more economical than dumb bombs. It’s not necessarily that way with cyber weapons. … As frequently as computer operating systems are updated, money sunk into developing a cyber weapon should show a high depreciation rate. That rate can even go stepwise as major desktop and industrial operating system upgrades roll out. Some military aircraft and ships may last for decades, but cyber weapons will likely have much shorter shelf-lives.

The costs of offense, when measured against the combined costs of defense and consequence management reveal some unique tradeoffs. On one hand, attackers seeking to cause damages that will generate strategic effect will require a substantial monetary investment in intelligence, targeting, and testing. But the weapon’s shelf-life will be short. But defenders still face formidable costs in protecting infrastructure and conducting consequence management across interagency boundaries. Hence, while it is true that offense still is dominant in one side of the equation, the operational value of weapons are also complicated by their relatively short shelf lives and some of the uncertainties involved in whether or not they achieve desired effects on the target. Krepinevech’s comments on the latter are also thought-provoking, if disturbing:

It may, therefore, be difficult for the leadership of one cyber power to determine when, in the mind of its enemy, it has crossed the line between cyber operations that are “acceptable” and those that will trigger a major escalation in the intensity of cyber activity that could lead to catastrophic attacks.

He concludes with a sensible call by the strategic studies community to examine cyber warfare with the same intensity it examined nuclear warfare during the Cold War. The community of analysts with a background in strategy and war studies looking at the issue is fairly small—but is nonetheless steadily growing. I will look forward to any future insights Krepinevech has on the subject.

Meet the new Cyber Czar (a Putin pal who fights to limit US Cyber interests)

Friend and writer Noah Shachtman has produced a nice piece for Wired Magazine titled “Russia’s Top Cyber Sleuth Foils US Spies, Helps Kremlin Pals”  Most all in the cyber security and national security communities have heard about Kaspersky and I imagine you have familiarity with his software and company and connections to Russian intelligence services.  But Noah’s post gives a fantastic overview of that plus more.  It also dives into Kaspersky’s move into the global policy realm, and it probably comes as no surprise that the policies he pushes are very much aligned with Putin’s. In that regard that makes him into an actor of even more importance for the US national security community to track.

There is a good chance that because of the strange and at times dysfunctional governance processes we put over our systems and our inability to keep bad guys out, Kaspersky may have more influence over the security status of key US networks than US officials do. Which is why I believe Kaspersky deserves the title of Cyber Czar.

Noah writes very well and his research includes time with Kaspersky. Noah’s ending is a great metaphor for a question more people should be asking.

Anyway, I thought you would enjoy reading this as much as I did.

To read the full post visit: “Russia’s Top Cyber Sleuth Foils US Spies, Helps Kremlin Pals”

Here is a snippet:

It’s early February in Cancun, Mexico. A group of 60 or so financial analysts, reporters, diplomats, and cybersecurity specialists shake off the previous night’s tequila and file into a ballroom at the Ritz-Carlton hotel. At the front of the room, a giant screen shows a globe targeted by crosshairs. Cancun is in the center of the bull’s-eye.

A ruddy-faced, unshaven man bounds onstage. Wearing a wrinkled white polo shirt with a pair of red sunglasses perched on his head, he looks more like a beach bum who’s lost his way than a business executive. In fact, he’s one of Russia’s richest men—the CEO of what is arguably the most important Internet security company in the world. His name is Eugene Kaspersky, and he paid for almost everyone in the audience to come here. “Buenos dias,” he says in a throaty Russian accent, as he apologizes for missing the previous night’s boozy activities. Over the past 72 hours, Kaspersky explains, he flew from Mexico to Germany and back to take part in another conference. “Kissinger, McCain, presidents, government ministers” were all there, he says. “I have panel. Left of me, minister of defense of Italy. Right of me, former head of CIA. I’m like, ‘Whoa, colleagues.’”

Kaspersky has 300 million customers. His geek squad uncovers US cyberweapons. And he has deep ties to the KGB’s successors in Moscow.

He’s bragging to be sure, but Kaspersky may be selling himself short. The Italian defense minister isn’t going to determine whether criminals or governments get their hands on your data. Kaspersky and his company, Kaspersky Lab, very well might. Between 2009 and 2010, according to Forbes, retail sales of Kaspersky antivirus software increased 177 percent, reaching almost 4.5 million a year—nearly as much as its rivals Symantec and McAfee combined. Worldwide, 50 million people are now members of the Kaspersky Security Network, sending data to the company’s Moscow headquarters every time they download an application to their desktop. Microsoft, Cisco, and Juniper Networks all embed Kaspersky code in their products—effectively giving the company 300 million users. When it comes to keeping computers free from infection, Kaspersky Lab is on its way to becoming an industry leader.

But this still doesn’t fully capture Kaspersky’s influence. Back in 2010, a researcher now working for Kaspersky discovered Stuxnet, the US-Israeli worm that wrecked nearly a thousand Iranian centrifuges and became the world’s first openly acknowledged cyberweapon. In May of this year, Kaspersky’s elite antihackers exposed a second weaponized computer program, which they dubbed Flame. It was subsequently revealed to be another US-Israeli operation aimed at Iran. In other words, Kaspersky Lab isn’t just an antivirus company; it’s also a leader in uncovering cyber-espionage.

Serving at the pinnacle of such an organization would be a remarkably powerful position for any man. But Kaspersky’s rise is particularly notable—and to some, downright troubling—given his KGB-sponsored training, his tenure as a Soviet intelligence officer, his alliance with Vladimir Putin’s regime, and his deep and ongoing relationship with Russia’s Federal Security Service, or FSB. Of course, none of this history is ever mentioned in Cancun.

What is mentioned is Kaspersky’s vision for the future of Internet security—which by Western standards can seem extreme. It includes requiring strictly monitored digital passports for some online activities and enabling government regulation of social networks to thwart protest movements. “It’s too much freedom there,” Kaspersky says, referring to sites like Facebook. “Freedom is good. But the bad guys—they can abuse this freedom to manipulate public opinion.”

These are not exactly comforting words from a man who is responsible for the security of so many of our PCs, tablets, and smartphones. But that is the paradox of Eugene Kaspersky: a close associate of the autocratic Putin regime who is charged with safeguarding the data of millions of Americans; a supposedly-retired intelligence officer who is busy today revealing the covert activities of other nations; a vital presence in the open and free Internet who doesn’t want us to be too free. It’s an enigmatic profile that’s on the rise as Kaspersky’s influence grows.

For more cyber threat context see:

Advancing Cyber History at the Atlantic Council

On 16 May 2012 I attended, with Alex Olesker and defense contractor Robert Caruso the Atlantic Council/Cyber Conflict Studies Association’s event “Lessons From Our Cyber Past: The First Cyber Cops.” Jason Healey of ACUS/CCSA moderated a discussion between the ODNI’s Steven R. Chabinsky, Crowdstrike President Shawn Henry, the State Department’s Christopher Painter. Alex has already written a wonderful summary of the event itself, but I’d like to add a different angle.

Cybersecurity is a field very much focused on the future. That’s unsurprising–the technology is improving by leaps and bounds, and the tech community as a whole makes a living by predicting and creating the future as we know it. I wouldn’t have it any other way. We should be focused on future threats and opportunities. But future-centrism has a cost. First, we can succumb to the problem of “presentism” by extrapolating the present to the future without consideration of the often disruptive breaks in history. Second, we can also have a “everything is new” attitude that blinds us to useful information and experiences from the past.

For example, why do so many cybersecurity and information warfare discussions ignore the Cuckoo’s Egg case? And Gregory Rattray has also observed that cyberpower theory has mirrored some of airpower theory’s problematic assumptions about the vulnerability of industrial complex architectures to cascading destruction. Finally, Samuel Liles has traced the evolution of cyber approaches from the invention of the telegraph (!).

That’s why what Jason Healey is doing with his cyber conflict history project and event series is so important. Healey is making a conscious effort to capture the lessons of the last 30 years (yes, there was cybercrime before the Facebook era) and make them available for future network defenders, policy analysts, and laymen. Moreover, cyber history also can help the analyst draw connections that might not seem readily obvious. As Alex points out, a look at cyber history also yields some meatspace parallels:

The similarities and overlaps between cyber and physical crime also mean that many solutions are the same as for any crime wave. Much of cybersecurity focuses on reducing vulnerabilities, but as in the case of burglary, simply locking your door isn’t enough to deter burglars, you also have to catch and punish the criminals. To do so, law enforcement faces the age old problem of getting victims to talk to the police. Just as many crimes in bad neighborhoods go unreported for fear of retaliation, a reputation as a snitch, and getting into deeper trouble with the law, many companies fear working with law enforcement due to the stigma surrounding getting hacked and fears that the investigation will only make things worse by confiscating servers or hampering recover.

Being an Angeleno transplanted to DC, I’d also add another interesting parallel: the problematic status of law enforcement in maintaining order. The federal government and its law enforcement functions, on one hand, is responsible for a sizable aspect of cyber defense. But just like in certain “bad neighborhoods,” the presence of the government is very thin and defense is privatized. There is also lot of suspicion of the government among many “residents” of the neighborhood, some of which take to defacing the odd government billboard or two. As noted in the briefing, the government’s power came to be seen as more legitimate—especially once the hacking shifted from the Kevin Mitnicks of the world to politically motivated hackers and Advanced Persistent Pandas…cough cough…Threats.

One interesting subject, covered to some extent in the briefing, is the tension between evolving law enforcement approaches and national security imperatives. While much of cybersecurity deals with crime, the international nature of many criminals as well as the growing involvement of foreign intelligence organizations and proxies created a wedge between law enforcement approaches and national security decisions. Law enforcement does have a role to play in national security (the FBI does counterintelligence, for example) but the divide certainly exists. I’m hoping to see more of this in future briefings, although I’m sadly going to miss part of the Estonia event.

For more on these topics see the CTOvision Guide to National Security Technology and

We track these and many related issues in our CyberWar site.

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]