1. 2-1/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 INFORMATION WARFARE Part 2: Theory Advanced Course in Engineering 2005 Cyber Security Boot Camp Air Force Research Laboratory Information Directorate, Rome, NY M. E. Kabay, PhD, CISSP-ISSMP Assoc. Prof. Information Assurance Program Direction, MSIA & BSIA Division of Business & Management, Norwich University Northfield, Vermont mailto:mkabay@norwich.edumailto:mkabay@norwich.edu V: 802.479.7937

2. 2-2/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Topics 08:00-08:15 Introductions & Overview 08:15-09:00 Fundamental Concepts 09:05-10:25 INFOWAR Theory 10:35-11:55 Case Histories & Scenarios

3. 2-3/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Topics What is INFOWAR? Schwartaus Levels of INFOWAR Examples of IW levels Military Approaches to IW

4. 2-4/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 What is INFOWAR? Use of or attacks on information and information infrastructure to achieve strategic objectives Tools in hostilities among Nations Trans-national groups (companies, NGOs, associations, interest groups, terrorists) Corporate entities (corporations, companies, government agencies) Individuals

5. 2-5/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Dorothy Dennings Nutshell Information Warfare and Security (1999). ACM Press (ISBN 0-201-43303-6). Offensive information warfare operations alter availability and integrity of information resources Benefit of offense & detriment to defense Offense acquires greater access to info Defense loses all or partial access to info Integrity of information diminished

6. 2-6/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Dennings Theory of INFOWAR Information resources include people & tools Containers Transporters Sensors Recorders Processors Value of resource differs Over time To different people

7. 2-7/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Schwartaus Levels of INFOWAR I: Against individuals Theft, impersonation Extortion, blackmail Defamation, racism II: Against organizations Industrial espionage Sabotage Competitive & stock manipulation III: Against nations Disinformation, destabilization Infrastructure destabilization Economic collapse

8. 2-8/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Military Approaches to IW HUMINT INTEL COINTEL SIGINT COMINT ELINT FISINT MASINT IMINT TECHNINT OSINT Human intelligence Intelligence Counterintelligence Signals intelligence Communications Electronic Foreign Instrumentation Measurement & signals Imagery Technical information Open source intelligence

9. 2-9/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Information Warfare: Chaos on the Electronic Superhighway (1996.05) Winn Schwartau, The Security Awareness Co. Overview Military Model Must Reflect Changes in Warfare What Is War?

10. 2-10/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Schwartaus View (1996.05) Overview National economies increasingly virtual Most money no longer tangible Espionage increasing for economic benefits 14% increase in espionage according to FBI Must resolve problem of defending against powerful technology not limited to military use Should define defensive posture against potential enemies capabilities, not perceived motivations

11. 2-11/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Schwartaus View (1996.05) Military Model & Changes in Warfare Military systems are not necessarily the prime targets of attack Psyops increasingly important: manipulation of perceived reality using the gullibility of the mass media Attacks on software: increasing the failure rates of systems even when people are trying to reduce errors Denial of service increasing: airports, phone systems, banks

12. 2-12/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Schwartaus View (1996.05) What Is War? Physical attacks are no longer the only basis for defining acts of war What will military and civil response be to concerted attack on civilian / industrial infrastructure? taking down the banks interfering with air-traffic control damaging productivity of major industries …and if this is war, what is the response?

13. 2-13/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Schwartaus View (1996.05) Destruction vs Reducing Competitiveness Question: in a free-market world, not necessary to destroy enemy; need merely render less competitive Response from Schwartau: US govt must defend country, yet military limited to physical warfare Classifying EW threats is foolish; should educate civilian sector Should define conditions for termination of hostilities

14. 2-14/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Schwartaus View (1996.05) How do we know who is attacking? Anonymity pervasive throughout cyberspace Stealth attacks natural consequence of Internet architecture Agents can be hired without knowing their handlers Conventional intelligence services must wake up to electronic threats See Information Warfare 1 st Edition online http://www.thesecurityawarenesscompany.com/chez/IW1-1.pdf

15. 2-15/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 RAND on INFOWAR (1999.01) Strategic Information Warfare Rising The RAND Corporation mid-1998 (reported in press 1999.01) Debate within the Pentagon wisdom of offensive information warfare cyberattacks on critical infrastructure worse for US 4 basic scenarios U.S. supremacy in offense and defensive strategic IW strategic IW elites no first use global defensive dominance arms control market-based diversity defend well, recover fast

16. 2-16/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 INFOWAR @ AAAS (1999.02) American Association for Advancement Science (AAAS) panelists government private industry INFOWAR real threat Need better cooperation among law enforcement officials around world catch culprits responsible for attacks Changes international law extradiction suspects Sceptics (e.g., Kevin Poulson) scoffed no electricity by now if IW threat so bad

17. 2-17/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Kosovo Cyberwar (1999.03) Attacks on US government & military agencies began 1999.03 Serbian hackers Retaliation for war against Serbs As NATO bombing began in Serbia "Black Hand" hacker group "Serbian Angel" hackers White house Web site defaced Red letters"Hackerz wuz Here

18. 2-18/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 European Basketball Contest (1999)

19. 2-19/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Asymmetric INFOWAR (1999.04) Countering New Terrorism by I.O. Lesser B. Hoffman J. Arquilla D.F. Ronfeldt M. Zanini & B.M. Jenkins New terrorism more diverse sources motivations tactics More lethal global reach Asymmetric strategy less-capable adversaries political violence

20. 2-20/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 INFOWAR? Nonsense, says Christy (1999.09) US has never been target of information warfare James Christy Defense-wide Information Assurance Program (DIAP) Cybercriminals not cyberwarriors Fundamental difficulties responding military has expertise computer crime but cannot help law enforcement agencies without presidential directive

21. 2-21/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 INFOWAR? Nonsense. (contd) Civilian sector ignorant of computer crime countermeasures Cant tell cyberattacks under way most victims keep information secret dont help law enforcement investigators Precise attribution & blame extremely difficult in cyberspace anonymity Public favors privacy over cybercrime prevention & law enforcement ignorance Jurisdiction over cyberspace crimes confused competing geographical claims

22. 2-22/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 INFOWAR in Oz? (1999.10) Foreign (US?) military site attacked Stock Exchange late 1998? Richard Humphrey Managing Director Australian Stock Exchange implied attacking site was in USA Foreign government denied any possibility such attack from military site Urged changes to Australian laws make it easier to try hackers present laws require criminal hackers be apprehended in act of hacking

23. 2-23/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 INFOWAR / China (1999.11) Importance of INFOWAR grows in PRC Chinese military newspaper Jiefangjun Bao authors Leng Binglin, Wang Ylin, Zhao Wenxiang For maximum war role, must integrate INFOWAR with other combat actions Cybersuperiority necessary but not sufficient for military victory today

24. 2-24/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 INFOWAR / China (2000.02) Taiwan Research Institute Gird itself against information warfare People's Republic China Elements IW: disruption critical infrastructure disruption military C3I ops misinformation campaigns damage economic activity lower morale on island before initiating conventional warfare

25. 2-25/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 INFOWARGAMES (1999.11) Institute for Security Intelligence's Center for Technology Terrorism & Jane's Publications War-game simulation (did not really hack) IRS primary target False information, denial of service Hack into IRS audit system Send out millions audit & tax-due notices Tap into immigration control (Dept State) to issue visas to known terrorists Create fake documents IRS investigating personal lives members Congress Leak fakes to media + send fake compromising photographs

26. 2-26/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Critical Infrastructure Protection (1999.11) Information Technology Association of America (ITAA) Statement of Principles Importance protecting national information infrastructure Private industry: primary authority Lowest possible government regulation in critical infrastructure protection Call for distinctions among cyber-mischief, cybercrime, cyberwar Appropriate law enforcement agencies take charge specific cases minimal jurisdictional confusion assurance clear legal basis for prosecution

27. 2-27/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 German Government Plans Net Defenses German plans for early-warning of hacker attacks (2001.05) Build Computer Emergency Response Teams throughout country Increased cooperation should permit rapid response to hacker attacks

28. 2-28/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Republic of Korea Warns of Cyber Attacks ROK Ministry of Information and Communication issues warnings (2001.05) Concern about US & (PRC) Chinese hackers using Korea as staging ground for INFOWAR KISA launched special task force against US and Chinese attacks Instructed Korean Internet-site operators to report unusual traffic at any time

29. 2-29/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 US Warns of Military Response to Cyberattacks Richard Clarke tells Senate Judiciary Committee of plans for retaliation (2002.02) White House Technology Advisor says that cyberattack would be met in any appropriate way: through covert action, through military action, any one of the tools available to the president.* In 2003.02, President Bush signed an order authorizing development of guidelines on unilateral or retaliatory cyberattacks against foreign computers and networks *Question: HOW DO YOU KNOW FOR SURE WHO IS ATTACKING YOU?

30. 2-30/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 STRATCOM focuses on Cyberwar (2003.02) U.S. Strategic Command (Stratcom) will focus on computer network attack Stratcom now in charge of global command, control, communications, computer, intelligence, surveillance and reconnaissance (C4ISR) capabilities All pieces of the enemy's system of systems that are valid military targets [are] on the table as we go about war planning. …Unimportant whether we take out a computer center with a bomb or a denial-of-service program. If it's critical to the enemy and we go to war, it will be in our sights.

31. 2-31/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Cyberattack Implications Studied Cyberterror impact, defense under scrutiny (2004.08) Coordinated cyberattack against U.S. could topple parts of Internet, silence communications and commerce, paralyze federal agencies and businesses disrupt $M in financial transactions, Contd

32. 2-32/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Cyberattack Implications (contd) hang up air traffic control systems, deny access to emergency 911 services, shut down water supplies and interrupt power supplies to millions of homes More than 2 dozen countries have asymmetrical warfare strategies

33. 2-33/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 North Korea Ready for Cyberwar? North Korea ready to launch cyber war North Korea has trained more than 500 computer hackers capable of launching cyber warfare against the United States, South Korea's defense ministry says. In a report to the National Assembly's National Defense Committee, the ministry said that hackers from North Korea were among the best in the world. --Agence France Presse, 2004.10

34. 2-34/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Cyberterrorism by 2006? Cyberterrorism a possibility in two years Cyberterrorism could become a reality in 2006, a leading UK information security expert has said. Speaking at the SC Magazine Conference in London on Thursday, October 21, director of information security for Royal Mail David Lacey said that that the world would witness cyberterrorism within two years. Lacey said, there is a lot of consistency in research that shows many of the real risks won't come to a crescendo until then. We know a lot about some of the trends coming. Real terrorists have not had the capability to carry out threats. But that will change as the stakes get higher. --ZDNet (UK), 2004.10

35. 2-35/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 New Cyberwar Command Center Cyber warriors anticipate center Personnel in the military's new cyberdefense organization hope to operate a new command center by late spring. The facility will include new hardware and software to help workers of the Joint Task Force-Global Network Operations (JTF-GNO) operate, manage and defend the military's 10 computer networks. "It will be a state-of-the- art facility," said Army Brig. Gen. Dennis Via, deputy commander of the JTF-GNO. He spoke Wednesday, February 23 at the Department of Defense Global Information Grid Enterprise Services conference held by the Association for Enterprise Integration, an industry trade group. The opening of the new command center coincides with JTF-GNO becoming fully operational. --Federal Computer Week, 2005.02

36. 2-36/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Chinese Cyberwar From South America? U.S. officials warn of Chinese intelligence and cyberwarfare roles in Latin America U.S. officials … warned about Chinese intentions to establish an intelligence and cyberwarfare beachhead in the [S. America]. Roger Noriega, assistant secretary of state for Latin America, and Rogelio PardoMaurer, the top Defense Department official for the Western Hemisphere, testified before a House panel [and] said China's interests in Latin America were mostly on the economic side, but warned that Beijing could also have an intelligence agenda as it increased trade with Latin America. PardoMaurer said that we need to be alert to rapidly advancing Chinese capabilities, particularly in the fields of intelligence, communications and cyberwarfare, and their possible application in the region. --Miami Herald, 2005.04

37. 2-37/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 US Army on Lookout for Sensitive Info Online Army officials have said they will take a closer look at blogs and Web sites maintained by soldiers. Many such blogs and Web sites include photographs or other information that inadvertently exposes classified or sensitive information to anyone with access to the Internet. Gen. Peter Schoomaker, the Armys chief of staff, noted that soldiers routinely post pictures online that include "tactics, techniques, and procedures" for weapons systems. According to Richard Cody, Army vice chief of staff, "The enemy is actively searching the unclassified networks for information, especially sensitive photos." Schoomaker issued a memo saying that the Army will work to closely monitor Web sites and blogs to avoid operational security violations, which "needlessly place lives at risk and degrade the effectiveness of our operations." --Federal Computer Week, 2005.08

38. 2-38/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Hacker Attacks In U.S. Linked To Chinese Military A systematic effort by hackers to penetrate U.S. government and industry computer networks stems most likely from the Chinese military, the head of a leading security institute said. The attacks have been traced to the Chinese province of Guangdong, and the techniques used make it appear unlikely to come from any other source than the military, said Alan Paller, the director of the SANS Institute, an education and research organization focusing on cybersecurity. In the attacks, Paller said, the perpetrators "were in and out with no keystroke errors and left no fingerprints, and created a backdoor in less than 30 minutes. How can this be done by anyone other than a military organization?" Paller said that despite what appears to be a systematic effort to target government agencies and defense contractors, defenses have remained weak in many areas. Security among private-sector Pentagon contractors may not be as robust, said Paller, because "they are less willing to make it hard for mobile people to get their work done." The U.S. military has code-named the recent hacker effort "Titan Rain" and has made some strides in counter-hacking to identify the attackers, Paller said. -- DSH IAIP Daily 2005.12.13

39. 2-39/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Insidious Attacks DIGITAL DOOMSDAY CAN BE AVOIDED WITH PREPARATION A common nightmare scenario in the business world is that a hacker will crack a company's digital defenses, steal sensitive data or disable the network. Scott Borg, director and chief economist at the U.S. Cyber Consequences Unit (US-CCU), an independent organization that churns out information security data on behalf of the government, says enterprises face a darker possibility. Online outlaws could quietly penetrate the network and, over six to eight months, alter critical data so that it's no longer accurate. For instance, an attacker could access a health insurance company's patient records and modify information on a person's prescriptions or surgical history. Or an attacker could access an automotive company's database and tamper with specifications on various car parts. --Bill Brenner, SearchSecurity 2006.05.03

40. 2-40/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Psyops in Cyberspace – and Society Digital photographs may not be photographs Audio recordings may not be recordings Log files may be fiction Opinion polls may be nonsense Election results may be fixed Conspiracy theories may be true References may be nonexistent Facts may be illusory History may be fiction Enemies may be invented Threats may be propaganda

41. 2-41/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 Class Resumes at 10:35:07