UK tells UN that nation-states should retaliate against cyber badness with no warning
- Reference: 1623429850
- News link: https://www.theregister.co.uk/2021/06/11/uk_ungge_cyber_norms_submission/
- Source link:
A statement made by UK diplomats to the UN's Group of Governmental Experts on Advancing Responsible State Behaviour in the Context of International Security (UN GGE) called for international law to permit retaliation for cyber attacks with no notice.
"The UK does not consider that States taking countermeasures are legally obliged to give prior notice (including by calling on the State responsible for the internationally wrongful act to comply with international law) in all circumstances," said the British submission to the UN GGE, made in advance of the G7 heads of government meeting in Cornwall this week.
[1]
The declaration marks a break with cautious British policy from just two years ago, when then-foreign secretary Jeremy Hunt warned against "cyber interference" becoming "commonplace". It is, however, in line with subtly aggressive rhetoric deployed by the Ministry of Defence in its [2]Integrated Review earlier this year .
[3]
[4]
Government and policy sources have previously told The Register that UK policy is aimed at building international consensus around cyber norms, making it easier to confront Russia, China, Iran, and similar cyber-rogues.
Back in 2019 [5]Hunt had said the UK should be "more emphatic about what we consider to be unacceptable behaviour and the consequences for any breach of international law" while tempering that with warnings about normalising international hacking, but under current foreign secretary Dominic Raab it appears UK policy officials are less worried about inflaming international tensions.
[6]The Roaring Twenties: Future foreign policy will rely on rejuvenated 'cyber' sector, UK government claims
[7]UK reveals new 'National Cyber Force', announces Space Command and mysterious AI agency
[8]Try to avoid thinking of the internet as a flashy new battlefield, warns former NCSC chief
[9]We'll hack back at Russians, declare UK ministers in cyber-Blitz blitz
"Any decision to resort to countermeasures without prior notice must be necessary and proportionate to the purpose of inducing compliance in the circumstances," added the UK GGE submission, in a nod to those wanting the world wide web to remain a safe (ish) place to do business and interact with others.
Coming as the western world staggers under the impact of ransomware attacks launched mainly from Russia and Russia-aligned countries, the call for digital retaliation to be launched without warning could be seen as an increasing of pressure against those countries. Britain has also been quietly boasting of initiatives such as the National Cyber Force, [10]an offensive hacking unit supposedly dedicated to attacking online enemies of the government.
[11]
Support for increasing weaponisation of cyberspace from prominent UK figures has been lukewarm: last year ex-NCSC chief Ciaran Martin [12]raised the notion that policy makers were "oddly deferential and therefore unquestioning" when presented with the weapon-like capabilities of the NCF.
"Prior notice may not be a legal obligation when responding to covert cyber intrusion with countermeasures or when resort is had to countermeasures which themselves depend on covert cyber capabilities." ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMPc-PAG4f7314u2zkNz6QAAAE0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2021/03/18/ukgov_integrated_review_cyber/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMPc-PAG4f7314u2zkNz6QAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMPc-PAG4f7314u2zkNz6QAAAE0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2019/05/23/uk_will_hack_other_countries_say_ministers/
[6] https://www.theregister.com/2021/03/18/ukgov_integrated_review_cyber/
[7] https://www.theregister.com/2020/11/20/uk_ai_space_cyber_agency/
[8] https://www.theregister.com/2020/11/11/ciaran_martin_speech_cyber_policy/
[9] https://www.theregister.com/2019/05/23/uk_will_hack_other_countries_say_ministers/
[10] https://www.theregister.com/2020/11/20/uk_ai_space_cyber_agency/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMPc-PAG4f7314u2zkNz6QAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2020/11/11/ciaran_martin_speech_cyber_policy/
[13] https://whitepapers.theregister.com/
Re: That's a delusional idea
This has always been a risk in statescraft. Nothing new, and nothing that the intelligence agencies don't understand.
Were people giving warning before?
What does this actually change? States are engaged in cyber espionage and warfare pretty much constantly. It's like telling a jogger you ran into on the street to wait for the starter pistol. What the hell is any of this even about?
Re: Were people giving warning before?
One could say that it's about diplomats maintaining their relevancy.
But there is actually a bit more than that involved. The Western societies view themselves as the "good guys", and try to justify that by holding to a particular standard of behavior, especially when it comes to the conduct of war. This standard of behavior regarding war is in the Geneva conventions. There are additional conventions, I think the one on landmines is separate.
The problem is that if your goal is "just win", the Geneva conventions severely hamper your freedom of action, and there are some nations that happily flout the conventions. The resulting imbalance is...highly problematic.
One solution, especially when dealing with a fundamentally new technology, is to "adjust" the expectations so that signatories may adequately respond to developing situations. That is what this is.
A Recipe for Disaster ....
..... Wannabe Leaders taking on the Mantel of Reign without the Reins that Command with Controls
Sound advice to governments is ...... stay well clear of cyber offensives against phantom foe and almighty virtual defences. Defeats are guaranteed both inevitable and serial and merciless should one wantonly choose to ignore sound government advice.
"zero-notice digital punishment"
Because the Internet needs to become even more like the Wild, Wild West.
Oh, silly me, so that's what WWW stands for !
Battle-Ready Brexit Britain
Ever since Brexit it seems the UK has been shifting towards an ever more conflict-ready posture.
My fear is any pretext will do and will be used to get Johnson his desired Churchill Moment.
Given his record for over-promising and under-delivering I expect we might all be speaking Chinese, Russian or French by the end of the decade. If any of us are still around.
Its largely irrelevant
With most ransomware coming from Russia. No one is going conduct drone strikes inside their border, no matter how bad a cyber crime criminals resident there have conducted.
What they could do is if they identify the people, send in spies to poison them. Putin seemed to think that's OK when he had someone poisoned on English soil, so turnabout is fair play. I'll bet ransomware would quickly become far less common after a few of their fellows wake up dead.
That's a delusional idea
If these politicians had ANY idea how easy it is to fake attack origins they would have never even tabled that idea.
That said, does that mean I can now launch attacks against France (OVH), Canada (OVH) and the US (AWS, Google, Azure) for hosting people that try to breach my websites? Or maybe get some compensation from these operators for not even checking for users with excessive 404 returns?