In view of the
cyber-warfare dimension to the Russia-Georgia conflict, and the
Chinese cyber-espionage ongoing against the west since c.2003
("Titan Rain", and so on), how concerned should we in the UK be
about state-sponsored hacking?
Politically motivated computer crime has been growing steadily
since the late 1980s. The threat comes from both nation-states and
individuals or groups with political agendas. Governments,
businesses and individuals can all be affected by state-sponsored
online attacks or espionage and, as demonstrated in the 2007 cyber
attacks against Estonia, significant disruption to public services
such as banking and communications are possible.
The UK, like most developed countries, is highly dependent on
its information infrastructure and as a major world power (both
financially and politically) is a potential target. This threat was
recently recognized by the UK government in the 2008 National
Security Strategy of the United Kingdom which states "the security
and intelligence agencies will continue to protect the United
Kingdom against covert activity by foreign intelligence
organizations aimed at political, economic and security targets,
including cyber-attack."
The threat is not limited to state secrets or the military but
extends to commercial and economic interests and, therefore,
industries such as finance, high technology, bio technology and
telecommunications.
While the threats of cyber war and cyber espionage are very
real, it can be difficult to quantify. There are several reasons
for this. First, identifying the true source of an attack is
difficult because most attackers use a chain of connections between
themselves and their target. For example, a "hacker" somewhere in
Europe may use a computer system in China to attack a system in the
UK. Inexperienced investigators are often misled when they
attribute an attack to the most immediate link.
Secondly, it is very difficult to establish motive in online
attacks.
As with all cyber crime there is no "silver bullet" solution to
preventing politically motivated computer crime. However, basic
security precautions and awareness can significantly mitigate the
potential impact.