[Music]
there's one more
participant possibly two
welcome
but
welcome to everybody uh the few people
that are here they're people online
to this impromptu talk on global
instance response in a fragmented world
this talk is gonna kind of overlap a lot
with the presentation yesterday by my
colleague sheriff hashim it's going to
be about how does the international
community
do
incidence response in a world where
things are getting a little bit
difficult
kind of some time ago there was this
headline where
google security team
patched a zero day that was known to be
used in a nation-state operation
the special thing about this is the
nation-state operation was conducted by
the u.s by the very country where google
engineers were working from and there's
a lot of conversation and
controversy about is this the right
thing to do
google argued and i agree with this
point of view that
security vulnerabilities should not be
used
to the detriment of users globally and
it puts the users of google products in
this case chrome at risk so
but is this
how it works is this how it should be
that's the question a question that's
discussed on the highest level and
that's what i'm going to talk a little
bit about
today policymakers are discussing
on about the rules of engagement about
how
instance response teams but how states
should behave in cyberspace this wasn't
always the case
in 1996
at the world economic forum in in davos
john perry barlow
which some of you may know as the head
behind the band grateful dad
published his declaration of
independence of cyberspace i recommend
you read this it really calls for states
and corporations to stay out of the
internet
these days
are long long gone states have
recognized that the internet is around
and they're conducting operations in the
internet
just to give you a brief overview
the first one that i know of kind of
that's been publicly
made available is titan reign in 2003
nearly 20 years ago
then uh
where a chinese allegedly chinese actor
attacked a u.s defense contractor and
stole a lot of intellectual property
then 2009 for me this was kind of
a shock
aurora ghost net was discovered an
attack again by the chinese on
the diaspora of the dalai lama on civil
society and that for me was kind of a
shocking thing a state attacking
civilians when you go on 2010 we had
stuxnet you see here
the picture of a street sign in iran
natanz where this
iranian uranium
enrichment facility is that stuxnet kind
of tried to slow down or bring down to
its knees
and today we can kind of stop counting
there's so many state of
uh
operations going on
that it's not really worth
counting
should we be doing this should states be
doing this that's a very good question
let's look back and see try to figure
out what is it states actually do in the
internet we read a lot about cyber war
in the news recently the center for
foreign
relations has a website that lists all
the known state operations and makes
these available
actually as a json file so it's pretty
cool you can use this
and when you look at what states mostly
do
there's a somewhat of a surprise it's
not cyber war it's espionage
states are spying on each other
that's not something new they've always
been doing this
and why are they doing this because it's
perfectly legal
states are entitled to spy on each other
if you ask representatives of a state
if that should be illegal they all say
no states actually love this because it
gives them intelligence that helps their
policy makers to help their governments
to make decisions about
the capabilities or about the intentions
of other states so they don't want to
give up on this
has it become more well yes it has
clearly
the state operations are growing
now you can argue while espionage i mean
states have always been spying on each
other we know this we all watch james
bond movies
nothing new really is this a problem
hasn't has it been a problem in the past
that states spied on each other it
hasn't in the past
but it has become a problem in my view
today
if you take one of the
big
cyber operations in the past couple of
months
the exploit of the exchange
vulnerability
that has clearly been a state-sponsored
operation has been an espionage
operation because there's mostly
government agencies that are affected by
it
but it has had a huge collateral damage
instance responders people that knew me
had to kind of work overtime to fix the
collaterals
once the vulnerabilities became public
criminals jumped on it especially
ransomware groups creating
huge damages
and
i think that is a game changer just
imagine if one state spies on another
one and blows up in a
kind of a build a garment building to
get access to information
nobody would tolerate this but in an
asian state actually
kind of conducting a an operation that
then leads to so much collateral damage
ransomware groups infecting hospitals
and so on
no one really seems to care and i think
that is a bit of a problem
now
why is
espionage while these cyber operations
in cyberspace
so much different from
from the same thing in the physical
world and that really is because
cyberspace has some things that in my
view
are kind of different
so there's first of all
i used to call this there's no borders
in the internet but that's kind of a i'm
not even sure what the concept of
borders means but what this is about is
that the sovereignty of a state naming
namely that you can do a new state what
you want
is no longer tied
to territoriality so the internet blurs
this in the olden times the spies had to
kind of travel into your country you
could protect it for them there's only a
certain number of spies that could go in
and that is a big challenge
that sovereignty versus territoriality
thing is a really big problem it affects
other parts of
cyberspace cloud act for example is
something that has to do with that where
the u.s tries to get information it's
actually not physically stored on their
territory
it's a big thing then attribution is
hard
really that is still one of the biggest
challenges how can you have rules if you
uh if you don't know who
who the actor was and
furthermore then you have what i call
class breaks
if you want to kind of rob a bank or spy
on a garment all style you have to go
there you can do
one garment agency at a time by kind of
getting us by a mole in and you can do
hundreds of them at the time we saw this
in these recent big attacks there were
thousands of government agencies
affected
and it's a lot easier because the rate
of innovation in cyberspace in the
internet is so high
this barely a week where not something
new comes out that that you have to
learn that you as a defender have to
understand how it works and so you can
protect it now we have the internet of
things where we seem to repeat all the
same mistakes we've done 20 years ago in
server software
and so on that makes it a lot harder
there hasn't really been much progress
in kind of
securing physical buildings and
we know how to do this
then there's the asymmetric capabilities
a few people can attack thousands of uh
of victims and vice versa a bunch of
teenagers can actually take a garment
down
and that doesn't make things easier
again that doesn't exist in the physical
group and last but not least there's no
global authority there's no one that
really can go there and say
you did something wrong
you're going to get your finger slapped
now
how do states uh
react to that well states actually have
been recognizing this problem
and
currently there's two groups
at the united nations level that are
active in this one of the oldest one is
the united nations garmental group of
experts i wrote down the full title this
is really government speech i'm not even
gonna
try to start
reading this out
typically these are two-year groups um
they started in 2004
and
were kind of
these hand-picked
states in the beginning 2004 is really
very few states it showed an interest so
it wasn't really a problem the last one
there was quite kind of a
demand and a lot of states wanted to get
into it was quite a competition to get
into
but it is what it is so
the highlights of the united of this
ungge it was 2013 so 2013 nine years
after they started
they came up with a report saying hey
actually we think international law
should halt in cyberspace so
states are regulated by international
laws that's what you can do for example
you you must never attack
another country unless you have a
mandate from the security council or you
do it in self defense these type of
things hold in cyberspace
but what does that mean we'll come to
that
2015 the next group actually came out
with 11 what's called norms and i'm
going to explain you what norms are
of responsible state behavior in
cyberspace
so that was actually
probably the two most successful unggs
then
in 2019
people some people felt it's actually
not okay that we
we only have 25 states that talk about
this because the internet is becoming a
global infrastructure so they started
what's called the open-ended working
group
which included every country that wanted
to participate
um
that group was restarted actually uh
last year with a five-year mandate
the last group didn't really have a
substantial output it could reaffirm
what ungg
did
but nothing more than that and we could
go into the details if you're into
political science you can spend a lot of
time arguing about this it was good that
people talk but not really much came out
now why am i telling you this
the reason is
that states start making the rules
on how we engage in the internet and
this has a direct effect on us so first
feeling that
we are part of the internet we are part
of the people that actually make the
internet run
should play a role
un recognizes this and understands
that the internet is not current and
owned or operated by states and it uses
what it calls a multi-stakeholder
process so if you if you kind of hang
out in international organizations you
hear this word multi-stakeholder
all the time what it really means is you
should not only listen to states but all
the other important players and we were
really lucky to be actually one of these
players first
several times now presented at united
nations to the delegates of all these
states discussing these things
just on a side remark
there's
a third group at the united nations it's
called the attack committee on cyber
crime in short where people talk about
the new cyber crime convention
interestingly enough cybersecurity
and cybercrime at the un level are two
totally different things
the cybersecurity stuff is in what's
called the first committee the part of
the u.n that talks about weapons of mass
destruction so i guess it's kind of an
honor to be in that part
whereas this one is more kind of on the
uh
with the organization of a drug and
crime so yeah i just said that
what all these bodies do is they're
going to come out with norms they're
going to come out with recommendations
and
that's just the un level there's many
more organizations that come out with
these you may have heard of the paris
call i had a couple of years
done in by president macron in france
who said this is how we should behave in
cyberspace
the best practices forum has put them
together there is a
hundreds of norms
out there now i've used that word quite
a bit what are norms
today
it's pretty hard to get new
international law down international law
is binding you can in principle sue
another state for violating this
but everybody agrees we're not going to
get this working right now people just
the atmosphere is too poisoned for that
to happen the next best thing you can do
is norms norms are things
that are not technically illegal but you
just don't do it if you've ever tried
to kind of
catch a bus or so in in london
uk and i guess in ireland you'll notice
that people queue up there's no law that
says you have to queue up it's just
something people do and if you if you
kind of
walk the queue and try to get in first
people aren't going to give you a hard
time but the police is not going to show
up that's what the norm is it's a
voluntary kind of agreement hey yes we
all stick to the same rules often not
written down
interestingly most of international law
is what's called
um now words are slipped
it's norms it's stuff it's customary
international law it's not written down
and it's things people have always been
doing in the past
norms have become customary
international law and after certain time
so if states stick to this stuff for 10
years 20 years it actually becomes
binding they can't go back and say okay
but we never agreed to this because an
international court would say
but you stuck to it for the past 20
years
now i mentioned these 15 norms that the
ungg came out with and i don't want to
go
through all of them in detail
let's just point out
a couple of things and the good news
really is is we are in cesar zorin
there's this norm k that essentially
says
states
should not attack each other's instance
response teams
c-series are the only group explicitly
mentioned several times in this u.n
negotiations and that gives us kind of a
special role states it seems recognize
the value of the work we do as people
who defend the internet who keep the
internet running who defend the users
and there's a prize for that it also
means we should not be offensive we
should not be part of attacks
in 2021 the ungg also said
states please stop politicizing c-suits
do not kind of use t-shirts
as an instrument to play politics and
again this is a very very strong
statement i feel
it's not law
but it is a something that states are
encouraged to do
now so you may say welp does this really
kind of affect us i mean
it's all good and right what states do
it doesn't really affect me i mean
it's never ever a president has shown up
at
my office
so what then and i'll give you an
example there's another norm that states
should actually
handle vulnerabilities
uh responsibly we just saw they don't do
this
no one really reported this exchange
vulnerabilities another example is the
log4j which i think is a very
interesting example because it was
discovered by alibaba a chinese company
alibaba did what it was supposed to do
what we expected to do it reported this
to the developers
told them hey there is an issue the
developers put out an update and
gave us time to fix this
turns out the chinese government was
very very unhappy with alibaba they lost
the big contract because china argued
well you should have told us about this
vulnerability first before it is closing
it
that's not really unique to china
the u.s and the uk in particular have
what's called a
vulnerability equity process that
describes how they decide
when to keep
a vulnerability secret or not
the us obviously did keep a couple of
vulnerabilities
secret we saw this with the first slide
and google actually found out about the
vulnerability in chrome
and patched it
so
but again what does that mean for us
it's all states it's just states
what are the obligations for private
industry what are the obligations for
software vendors and
that is a very good question to ask and
no one really knows what this is
um
the swiss garment started a process
called the geneva dialogue where it
tries to bring together people from
software development companies to try to
figure out what does it mean what does
it mean to do responsible vulnerability
disclosure how can we do this why
doesn't it really work
and
kind of me being the naive guys at first
has all these
has all these guidelines out so what
you're talking about but it's really
important that states start to
understand
what this implies and start to kind of
um create processes if you look at
switzerland switzerland has decided to
not stockpile vulnerabilities so that's
the swiss position that's published
the uk and the u.s haven't and
no water state so far to my knowledge
has actually made a statement on how
they treat this
but even if states like the us and uk
say we actually keep vulnerabilities in
certain cases
them admitting this is a really good
important thing because it actually
tells you where they stand and you may
have a problem there
it hasn't really solved
the dilemma that google as a us entity
is in if it finds something if it finds
another vulnerability that is used by
its own government and that is something
we have to figure out
now
i mentioned you to you that first is a
has done several kind of inputs at the
united nations by what is first position
our position really is is that it's
really important that whatever norms and
laws states decide on they should make
sure that instance responders can keep
working the way they used to that means
you should not criminalize the tools we
have
tcp dump is not a hacker tool a
malicious hacker tool it also means we
need to be able to uh
to talk to each other right now we're
not there's several countries that are
under sanctions that we cannot talk to
that's a very important thing and
that we say um
we also feel that when states make
decisions about what kind of con
operations they conduct they should
always take the good of all internet's
users into account so it should not be
the intelligence services that decide
hey we have a great opportunity
to catch some fish here
and we don't really care about the
damage it creates to the rest of society
it's very important for us that our
users are actually at the end of the day
safe and secure
we also feel very strongly that the core
of the internet the part the
infrastructure
deepsea cables
internet exchanges
all of this stuff should be off limits
they should not be part
of a
of a malicious cyberactive
cyber operation and should not be
targeted even if you could make a great
gain
and last but not least the open-ended
working group has starting has been
starting to emphasize
capacity building so all states are
encouraged to build capacity because
they've realized actually we need
c-suits we need security staff we don't
have it
but first says is well it's not good
enough to just deliver yet another
c-cert 101 training but rather that we
should start building up communities
where c-suits learn to work together
with all the stakeholders all stuff
that's really obvious to us but not so
obvious to states
and that is a position we keep on
reiterating
and i think
with good results at least
states agree to these statements all the
these norms i've actually shown you have
been agreed upon by all members of the
channel the u.n general assembly so in
principle you can say you all said yes
to that so aren't you sticking to this
they are not
of course there is a couple of problems
like attribution is one um
it's not really clear who plays what
role in attribution first view here
really is that c suits should stay out
of attribution because it kind of puts
us part
into part of a conflict attribution
inherently is a political process it's
one country
blaming another one we don't want to be
part of the blaming game we actually
want to be part of the
we protect our users we often compare
ourselves to firefighters
firefighters are not in the game of
arresting arsonists during the game of
uh
extinguishing fires obviously they work
with law enforcement to say we found
this kind of
bottle of gasoline here so maybe you
want to have a look at this sure we do
that but we're not the ones that do
attribution
it could be completely second talk about
attribution it's a really
tricky topic and if you talk to people
in
that represent states it becomes even
trickier
at the end of the day we start to kind
of wonder
at first how
how should all of this work together for
us what does this really mean and that's
kind of a little pr session for our own
code of ethics ethics first that there
is a signatixic at first that started
talking about
what does this do
it's really based on
the
fairly old universal declaration of
human rights
and what we actually feel is that what
we do as instance response we protect
users we really protect this during
their basic rights
the code of ethics is not very much into
human rights it just says that in one
sentence but what it delivers you is
kind of duties for example the duty to
reply to a request
duty to be trustworthy and so on and we
acknowledge that there is often dilemmas
because what the work we do is not
always easy are we gonna kind of
publish something a vulnerability that
then can be abused by someone or are we
gonna keep it secret just tell it to
some small group these are difficult
questions and the code of ethics
tries to kind of
give you advice on that and guidance on
how to find a solution that really fits
to you
that already brings me to the end of the
talk and i think why do i give these
non-technical talks while i talk about
this
it's because i really feel as much as
policy makers need to learn how the
internet works and how
instance responders work
we need to understand
that we're not the only ones in the
internet anymore that there is policy
makers that there is states and
authorities that use and abuse and
regulate the internet
and
we all together need to work on a way to
make internet a better place for our
users
and for mankind it's more than half the
population of this planet now is on the
internet
for some people
it uh
is very much on it
it's very much kind of their entire life
surrounding if you go to certain
nations in africa
the lives and the goods people own are
all tied to a mobile phone if that's
compromised we have a problem they have
a problem and that's what we try to
solve
that's it for my side
any questions
sorry thank you for that talk
this is not really a question but can
you elaborate a bit on
how do you interpret borders on the
internet
in terms that most of the infrastructure
is owned by private entities which are
then governed by
state entities
and how that falls into this
that is indeed a very good question and
and i know there's a couple of
international lawyers that are hard at
working trying to exactly figure this
about now
i would argue
the concept of
binary borders where two entities touch
on each other
they have
they're gone so when we look at at cloud
services we have the location of the
data center that potentially gives the
state where this data center is located
in
access to
[Music]
to all the information in that data set
then we have the customer who may be in
in a different country
and we have the service provider who's
going to be yet in another country so
there's at least three entities in there
and i think what it will have to come
down to is that states
need to start to come to agreements and
and how they treat this the us cloud act
is one attempt to do so if you study the
cloud it actually tells
says what what cloud providers or u.s
cloud providers are obliged to do if the
us government comes but it also says
countries are free to have specific
agreements with the united states to
change these rules a little bit
so i think at the end of the day sooner
or later we will have to come to grips
with how how are we going to deal with
this territoriality thing can we can we
kind of come up with internet
territoriality or jurisdiction but right
now that's an unsolved problem no one
really knows
great question
hey sirs uh was asn hijacking part of
the conversation at all
sorry asn hijacking so they're basically
hijacking by telecoms communicators of
uh
data packs was that part of the
conversation at all
i guess you it's a it's a good question
so i guess it's it's talking about
like what happened that china for
example started to attract certain
traffic to route it through its own
system so we can spy on it uh you can
have this asked a similar question is it
okay to actually
kind of listen snoop into deep sea
cables and uh
that hasn't really been part of
of the conversation you could argue that
when when people say hey you should not
you should leave the core of the
internet alone and not fiddle around
with this
that
should kind of be a message you
shouldn't really fiddle around with the
global routing tables
as for c cables it's actually totally
legal
to intercept these
everything outside the 200 mile zone
is open for grabs and you can do with
this stuff whatever you want to
so
that was kind of like first time i
talked to an international lawyer and he
asked me is the law of the seas relevant
to the internet yes it is because it
permits you
to listen into deep sea cables
any more questions
thank you serge thank you for coming and
[Applause]
for stepping in in a short notice yes
and thanks everybody
for rushing from the dessert to my talk
much appreciated
next the talk is at the three o'clock
here in the this room
fill out the survey recognizing search
for stepping in
and yeah that's a short break next
speaker thanks