proposal

Security in Cyberspace

Motohiro Tsuchiya
Professor, Keio University

1. Introduction

Generally speaking, cybersecurity consists of three main parts. First, defense called Computer Network Defense (CND); second, attack called Computer Network Attack (CNA); and third, operation called Computer Network Exploitation (CNE). "Exploitation," represented by "E" of the acronym CNE, originally means "selfish use and wealth extraction," or, in the context of cybersecurity, the use of hardware and software in a way different from the original intention. In this sense, it is operation.

Most of the "cyberattacks" taken up by the mass media do not correspond to "attacks" in international law. Most of them are a kind of harassment, cybercrime, or cyber espionage (spying activity), with few cases of attack and defense defined by the Law of Armed Conflict. They are gray zones cases categorized as CNE. A former US government high-rank official states that "CNE is a necessary tool for any state."1

Security in cyberspace differs from conventional weapons security in that the border between attack and defense is not definite, and large gray zones spread between attack and defense. This paper will begin with a review of the pre-history of cybersecurity where cybersecurity was not recognized as a significant security issue; review the five types of cyberattacks since the 2010s; and lastly discuss the goals of the latest National Defense Program Guidelines (NDPG) for FY 2019 and beyond worked out by the Japanese government.

2. Pre-History of Cybersecurity

From 1981 to 1982, there was a spy called Vladimir Vetrov (codename: "Farewell"), who provided the French government with information about the Soviet Union. The French government shared Vetrov's information with the US government, and discovered a list of what the Soviet Union wanted to acquire from the West. Gus W. Weiss who served on the US National Security Council (NSC) succeeded in having a gas pipeline control software intentionally stolen by the Soviets through a Canadian corporation. Soviet use of the doctored software caused a large explosion in a Siberian gas pipeline.2 This is probably the first case of kinetic destruction by cyberattack.

Shortly thereafter, in 1983, the motion picture "War Games" was released in the United States. President Ronald Reagan watched it, and asked the Chairman of the Joint Chiefs of Staff, "Could something like this really happen?" He answered, "Mr. President, the problem is much worse than you think." As a result, the Reagan administration created a document numbered NSDD-145 and formulated the first cybersecurity policy measures.3

Following the Gulf Crisis in 1990, the Gulf War broke out in 1991. The US military demonstrated overwhelming strength through the seizure of air control and the ensuing introduction of ground forces. The heroes at the battleground were Commander of US Central Command Norman Schwarzkopf and Chairman of the Joint Chiefs of Staff Colin Powell. But the unsung heroes were William Studeman, Director of the National Security Agency (NSA) and Mike McConnell who headed the Integrated Intelligence Center created by Studeman. Analysts under McConnell sneaked into the nucleus of the command and control networks supervised by Iraqi President Saddam Hussein. They discovered that there were optical fiber networks running from the Iraqi capital, Baghdad, to Basra, a city near Kuwait, and that the Iraqi army was using them as command and control networks. The US military destroyed connecting points of the optical fiber networks. The Iraqi army immediately switched to a wireless system, but their radio signals leaked. The NSA, anticipating this, captured the weak leaking signals by using satellites, and saw the movement of the Iraqi army, thereby fighting the war with an advantage. The Iraqi army stopped using wireless communication and switched to motorcycle message delivery! Iraq lost the war as a natural consequence. What mattered most in this war was brain supremacy rather than air supremacy. The war is rated as the first anti-command and control warfare or a precursor to a future cyber war.4

In February 1998, an illegal online intrusion was detected at the Andrews Air Force Base in the United States. The base is where the Air Force One and Marine One airplanes take off and land. The incident was named Solar Sunrise. The US side commenced tracking the attackers and succeeded in tracking them down to the United Arab Emirates (UAE). Since it was a time when the memories of the 1991 Gulf War were still vivid, Iraq was suspected to have perpetrated the intrusion. However, the culprits turned out to be two Californian teenagers encouraged by Israelis.

The following month, an intrusion dubbed Moonlight Maze took place, targeting the Wright-Patterson US Air Force Base. This also was thought to be mischief, but the attackers were tracked down to the Russian Academy of Sciences. In those days, an ostensibly close relationship had been established between US President Bill Clinton and Russian President Boris Yeltsin, but to the consternation of many people, the truth was that Russia aimed at stealing classified information behind the scenes.

During the Clinton administration era, the boom of information and communication technology (IT) led to a buoyant economy, which was considered to be the advent of the "new economy" free from business cycles. However, the booming economy burst in July 2001, and the situation changed dramatically with the September 11 terrorist attacks by Al Qaeda against the US mainland.

In January 2003 when a war in Afghanistan was underway, and another war with Iraq was imminent, the proliferation of malicious software called the SQL Slammer worm took place at the Davis-Besse nuclear power plant in Ohio. The nuclear power plant came to a functional standstill. Although no serious damage occurred because the reactors had been shut down, it was discovered that the worm invaded the power plant through a subcontractor. This has helped change the perception that critical infrastructures are not vulnerable to computer viruses because they are ordinarily not connected to the Internet.

Around 2008, a US military personnel picked up a dropped USB flash drive in a US military base in the Middle East. The person connected it to a computer in the base, which caused malware infiltration of US military networks around the world. To cope with this, the US military launched the "Operation Backshot Yankee" to eliminate illegal access and to strengthen cybersecurity. As part of these efforts, the US Cyber Command (USCYBERCOM) was established as a subordinate unified combatant command under the US Strategic Command (USSTRATCOM). Keith Alexander, director of the NSA, was concurrently appointed to the commander of USCYBERCOM.

3. Five Types of Cyberattacks

(1) DDoS: Distributed Denial of Service

In 2007, the news spread that a bronze statue in a park in the central part of the Estonian capital Tallinn would be relocated to somewhere else. Since the statue was commemorating Soviet soldiers in World War II, its relocation to a war dead cemetery in a suburban area invited the condemnation of Russian residents. As a result, a distributed denial of service (DDoS) attack was delivered against financial institutions in Estonia. DDoS attack is a technique to crash a target web server or online system by overwhelming it with data sent from multiple malware-infected computers. Ordinarily, the owners of the infected computers are unaware that their computers are misapplied, while the targeted party cannot distinguish normal access from unauthorized access, eventually suffering malfunctions. Since Estonia had started to advance toward a cashless economy in those days, the malfunction of its financial services had a serious impact on Estonian society.

Russia was contextually suspected of being the mastermind of this attack, but the Russian government denied the allegation. Later a Russian non-governmental organization acknowledged its involvement. It is, however, still suspected that the attack had the support of the Russian government. Either way, the incident is considered to be significant in the sense that the whole country of Estonia was targeted.

After that, DDoS attacks have been delivered extensively in many countries to obstruct the business of financial institutions and government agencies. Since effective countermeasures are becoming available, DDoS attacks are unlikely to cause a catastrophic situation. Nonetheless, organizations without preparedness will not be able to avoid damages. Financial institutions that depend on high-frequency trading may incur business losses due to delays caused by DDoS attacks.

From this period onward, cybersecurity came to be acknowledged as one of the important security issues, and every country began to work on countermeasures.

(2) APT: Advanced Persistent Threat

Advanced Persistent Threat (APT) is sometimes found to be synonymous with targeted email attack, but it does not rely solely on email. Using "social engineering," APT infiltrates targeted systems of individuals and organizations by various tricks, thereby destroying systems, stealing data, and engaging in secret surveillance.

In Japan, attention to APT was heightened by a media report that in September 2011, 83 computers owned by Mitsubishi Heavy Industries, Ltd. were infected with a computer virus and information was stolen. Reportedly, no important confidential information was stolen, but the attack targeting Japan's largest defense corporation came as a shock.

The major perpetrator of the APT attacks is said to be China. There are abundant media reports on China's APT attacks. The US cybersecurity company FireEye has assigned different numbers to Chinese groups executing APT attacks; for example, APT1 is the PLA's 61398 Unit.5 APT10 is a Chinese group targeting civil engineering, aerospace, and telecommunications businesses, and government agencies in the United States, Europe and Japan.

At the US-China summit talk in California in June 2013, President Barack Obama demanded that China should stop cyber espionage, but Xi Jinping refuted the accusation and noted that China is a victim of cyber espionage. A few days before the summit, Edward Snowden appeared in the media and stated that he monitored the NSA's surveillance of communications, and that China was the target of this surveillance.

In 2015, the Japan Pension Service suffered cyberattacks, in which 1.24 million cases of pension information were stolen. Reportedly, not only the Japan Pension Service but also 1,000 organizations were targeted at that time. Because of its inadequate security, the Japan Pension Service happened to be attacked and pension information was stolen.

These APT attacks are continuously conducted by employing varying methods in various places. The extent of damages varies considerably, ranging from the theft of state or military secrets to that of personal information. In many cases, victims are not aware of unauthorized access or theft of information. APT attacks do not directly injure human life. Since, however, stolen military information could, for instance, affect the outcome of war, they are a potentially dangerous act.

(3) CCC: Combination of Cyber and Conventional Weapons

It was known to those concerned that cyberattacks could cause kinetic destruction, as seen in a Siberian pipeline explosion in the early 1980s. In 2007, the US Department of Homeland Security conducted a secret experiment named "Aurora Generator Test." The test was carried out to see what would happen to a ship generator, if its ventilation system was doctored to malfunction by adding 21 lines of code to a computer program connected to the generator. The generator failed in minutes and broke down, emitting black smoke. Disassembly after the experiment revealed that all generator components were affected. The US government has reconfirmed that cyberattacks could cause kinetic destruction.

In 2008, the Israeli government noticed that a North Korean type nuclear plant was under construction in the Syrian desert. Israel called on the United States to bomb the facilities. President George W. Bush rejected the request, because the United States was fighting wars in Afghanistan and Iraq at the same time. Later the nuclear plant was bombed. The Syrian government had no idea what happened. The truth is that Israel had, in advance, delivered cyberattacks on Syrian military radar networks and made them unserviceable. Then Israeli fighter jets flew over Syria and easily bombarded the target facilities.6 This is an example proving that a combination of cyberattacks and conventional weapons is quite an effective mode of attack.

Thus, attacks achieved by the combined use of cyber and conventional weapons can be called CCC (combination of cyber and conventional weapons). There are, however, few cases where actually conventional weapons were used in combination. The following three cases suggest that cyberattacks can be used advantageously to fight a war.

In 2010, an incident involving Iran's nuclear plant occurred, which is considered to be the most sophisticated cyberattack ever in history. The Iranian government had insisted that the nuclear facilities were used for peaceful purposes, but other countries were skeptical. Unidentified parties who wanted to prevent Iran's nuclear development while avoiding armed conflict with the country, launched cyberattacks on the plant in Natanz. The attacks were directed to centrifuge control devices, thus disabling about 1,000 centrifugal separators. Iran's nuclear development was delayed due to this attack. The New York Times later reported that it was a joint operation by Israel and the United States.7

Secondly, on December 23, 2015, cyberattacks were perpetrated against electricity supply networks in western Ukraine immediately before Christmas. Some 230,000 people were left helpless in utter darkness for one to six hours.8 In Ivano-Frankivsk, a town in western Ukraine, the average highest temperature in December is three degrees Celsius, while the average lowest minus five degrees Celsius. Fortunately, no residents froze to death. Meanwhile, the loss of social functions and disturbance created by a largescale blackout turned out to be very effective at an early stage of a military operation.

Thirdly, according to the New York Times, in 2014 the Obama administration ordered cyberattacks to check North Korea's missile launch, and this policy was taken over by the Donald Trump administration.9 It is unknown whether the US Cyber Command's cyberattacks actually functioned, but the success rate of North Korea's missile tests plunged for a certain period of time. But when the news came out, the operation was seemingly abandoned or lost its effectiveness. If an actual war broke out, cyberattacks on the opponent's weapon system would be mandatory. In most cases, preparations to that end may be undertaken prior to the war.

(4) SC: Supply Chain

The US Secretary of Defense annually submits reports to Congress on China's military and security developments. Its 2009 edition expressed concern that "Information technology companies, including Huawei, Datang, and Zhongxing,10 maintain close ties to the PLA and collaborate on R&D."11 Since then, Huawei has been under suspicion for over a decade.

When the Trump administration was inaugurated in January 2017, US trade deficits with China became a problem, and trade and technological frictions between the two countries became prominent. Huawei was made a scapegoat amidst the frictions.

In October 2018, Bloomberg Newsweek reported that a tiny chip was found in a server shipped by Elemental Technologies LLC, and that the users' data was suspected to have been illegally transmitted to third parties.12 The servers were delivered to Apple Inc. and Amazon Web Services, Inc. (AWS) The AWS is Amazon's cloud service, and its customers included the US Central Intelligence Agency (CIA), the US Navy, and the Pentagon.

In December 2019, the Canadian government arrested Meng Wanzhou, Huawei's chief financial officer (CFO) and the daughter of the corporation's founder Ren Zhengfei at the request of the US Government. As of February 2020, Meng is awaiting further developments of the lawsuit --- with a GPS tracker around her ankle.

Huawei is suspected of its involvement in supply chain attacks --- the implantation of malicious programs into hardware and software. An unintentional error in a program is called a bug (defect, flaw), but the type of error that someone intentionally plants is called a supply chain attack.

There are two types of supply chain attacks. One of them is the implantation of malware into products at the manufacturing stage, potentially affecting all users of the infected products. Huawei is suspected of its involvement with this type of trick. The other is the implantation of malware in products taken out during delivery after shipment. For instance, at the request of some government agency, products are removed during delivery, planted with some information collection device, and then put again for delivery to the target.

Regarding the second type, a senior US government official said, "If there is a chance to do, you should do it 99 percent."14 Supply chain attacks against specific targets for diplomatic and security purposes fall under a grey zone category under international law. Rather, such intelligence activities may be a necessary evil, if they are executed to prevent war and terrorism.

The US government does not object to the Chinese government's intelligence activities within the United States for diplomatic and security purposes, because it also engages in such activities.

However, the first type of supply chain attack is made indiscriminately against civilians and private corporations, and is likely to be done for economic purposes or to infringe on the privacy of individuals. For this reason, the United States and China agreed that they should not resort to this kind of supply chain attack, and put the question on the agenda of US-China talks. At the US-China summit talk in September 2015 in Washington, DC, the two leaders agreed not to carry out such cyberattacks, but issued only an oral statement at a press conference and did not come up with any agreement on paper.

(5) IO: Influence Operation

Republican candidate Donald Trump won over Democratic candidate Hillary Clinton in the 2016 US presidential election. The US government later declared that they confirmed the Russian government's interference during the election. Groups suspected of being related to the Russian government hacked and exposed the email systems of the Democratic National Committee and of Clinton's officials, and published fake news on social media.

It is extremely difficult to verify or conclude whether Trump won the election thanks to this interference, and the US government has not yet made a judgement. The purpose of the cyberattacks is alleged to make American citizens skeptical about the results of the elections and, ultimately, the legitimacy of democracy itself.

This issue has been shaking US politics since the inauguration of the Trump administration in January 2017. In January 2020, President Trump was subjected to an impeachment trial, and was the third president in US political history to undergo an impeachment trial. He was ultimately acquitted in the Senate, but the trial demonstrates the US' political divide.

Russia also attempted to interfere with the November 2018 US midterm elections. Since the US government designates the electoral system as a critical infrastructure, the US Cyber Command can be mobilized to block foreign interference. On that occasion, the US Cyber Command prevented Russian meddling in the midterm elections by disrupting internet lines at the Internet Research Agency (IRA), which was believed to disseminate false news in Russia, and by frustrating the machinations of Russian operatives.

The US Department of Defense called this kind of strategy for preventing foreign interference a "defend forward" strategy. The Commander of the US Cyber Command, General Paul Nakasone, is trying to prevent through "persistent engagement" interference by Russia and other nations.

In January 2020, a presidential election was held in Taiwan. Until a year before the election, the incumbent President Tsai Ing-wen was expected to have little prospect of being re-elected, but the situation in Hong Kong helped her in the election. Also, before the election, President Tsai Ing-wen repeatedly warned about China's meddling in the presidential election, which alarmed the Taiwanese people. As a result, China did not meddle very much, and President Tsai Ing-wen overwhelmingly won over the Kuomintang candidate Han Kuo-yu. However, China is thought to be interfering with elections in Cambodia and elsewhere,15 and the possibility of China's interference with the US presidential election cannot be completely ruled out.

4. The New National Defense Program Guidelines (NDPG) and Cybersecurity

How ready is Japan to respond to this situation? The Japanese government's two principal organizations responsible for cybersecurity policy --- the Cybersecurity Strategic Headquarters (formerly the Information Security Policy Council) and the National center of Incident readiness and Strategy for Cybersecurity (NISC)16 ---issued Japan's "Cybersecurity Strategy" in 2013, 2015 and 2018, releasing the cybersecurity policy of the government as a whole.

In March 2014, the Ministry of Defense established the Cyber Defense Group under the SDF C4 (Command, Control, Communication & Computers) Systems Command under the direct control of the Minister of Defense. The Cyber Defense Group ordinarily defends the systems and networks of the Ministry of Defense and the SDF. Once a defense mobilization order is issued, the Group will be in charge of the overall cyber defense of Japan.17

In December 2018, the Cabinet approved a new National Defense Program Guidelines. The new NDPG's keyword is multi-dimensional integrated defense, which essentially aims to counteract cross-domain attack and multi-domain battle (MDB). (These operational concepts developed by the US military came to be called multi-domain operations for all phases including peacetime.)

The new NDPG states, "SDF will fundamentally strengthen its cyber defense capability, including capability to disrupt, during attack against Japan, opponent's access to cyberspace for the attack." If any attack (not limited to cyberattack) is conducted against Japan, the SDF will be able to prevent attackers or hostile countries from accessing cyberspace; that is, the SDF will then carry out cyberattacks as counterattacks.

Figure 1: Frequency of Technical Term Usage in the NDPG

Furthermore, "SDF will leverage its capabilities in all domains to conduct wide-area, persistent intelligence, surveillance and reconnaissance (hereinafter referred to as "persistent ISR") activities around Japan. SDF will prevent occurrence or escalation of emergencies by employing flexible deterrent options and other measures." If cyberspace is included in "all domains," measures to realize persistent ISR activities in cyberspace may have already been considered.

Although the new NDPG's keyword is "multi-dimensional" integrated defense, yet, as seen from Figure 1, the words "multi-dimension" or "dimension" appear only a few times in the text of the NDPGs. They contextually mean "domain." Official English translation of the keyword is "Multi-domain Defense Force." The new NDPG underlines the importance of increased efforts in three new domains: cyberspace, space, and the electromagnetic spectrum.

5. Conclusion

Events that predicted something that is very similar to cybersecurity of today took place as early as the 1980s during the Cold War between the United States and the Soviet Union. Since the 2010s, however, the appearance of five types of cyberattacks and multiple actors has added to the complexity of the situation.

Japan released the new NDPG in 2018 that highlights the establishment of multi-domain defense force. In parallel with efforts to that end, responses ahead of the time will be needed, as the situation evolves incessantly.

James Clapper, a former US Director of National Intelligence (DNI), said in his book, "At the Pentagon I'd often heard the military truism that every nation is preparing to refight its last war."18 For Japan, the last war is World War II. There crypto warfare was fought in those days, but what we now see in modern cyber warfare was hard to imagine. Recently, USADEN or a new Japanese acronym for space (uchu), cyber (saibah), and the electromagnetic spectrum (denjiha) seems to have some currency --- exclusively in Japan, of course. Improvement of defense capabilities in these new domains is now essential to our country.

(This paper was translated into English by Tsutomu Inuzuka, SSDP Associate)

proposal
current topics
letter