Cyber-Spies For Hire

Reports of malicious and targeted cyber-attacks are becoming increasingly common around the world. In early February, for example, Australia’s security agencies revealed they were investigating an attempt to hack on the country’s parliament and hadn’t ruled out another country being behind it. 

As more complex and potentially damaging attacks into critical national infrastructure systems are discovered, calls are growing louder for international rules to govern this emerging battlefront. 

Efforts towards cyber-arms control have predominantly centred around a model where the “arms” relates to weaponised code – specific hacking tools or the software vulnerabilities that enable them.  Attempts have been made to curtail the proliferation and spread of what are called “zero-day exploits”, the flaws in a program’s code that allow malicious attackers to interfere with the systems that run them. 

A recent Reuters expose of the operations of a clandestine wing of the United Arab Emirates’ (UAE) National Electronic Security Authority (NESA) exposed another component of offensive cyber-attacks, expertise. This issue sparked further international attention when the FBI announced charges in mid-February against Monica Witt, a former US Air Force analyst, accused of espionage and defecting to Iran.

Cyber Mercenaries
The Reuters investigation detailed how some former employees of the US National Security Agency (NSA), operatives with expertise in digital penetration techniques, online intelligence gathering and offensive cyber-operations, were contracted via a Maryland-based firm to work for the UAE. 

The investigation makes specific mention of one of the tools, Karma, that these contractors employed on behalf of the UAE against specific targets. 

This hacking tool allowed its operators to gain uninvited and remote access to a target’s Apple phone through an unspecified flaw which is now believed to have been fixed by Apple. Reuters reported that the targets of these attacks ranged from human rights activists, to American journalists.

The article raised questions about whether these contractors might have provided their NESA employees with advanced cyber-capabilities developed by their former employer, the NSA. But the subtext of the Reuters investigation is that the expertise of these former intelligence officers is just as attractive to their new employers as any tools they might bring with them. In a separate article, specifically examining Karma, Reuters alleges that it was purchased by the Emirati government from a vendor outside of the country. 

In effect, the UAE had hired a team of out-of-work specialist engineers who couldn’t bring the tools they had used in the US with them, so it then bought them the tools they needed to get the job done. This suggests that there are two components required to kit out any state or group with advanced cyber-capability: the tools and the expertise. 
Tools and Expertise

Global efforts are underway to govern the tools used in cyber-attacks, such as the Global Commission on the Stability of Cyberspace, which introduced a series of international norms about the use of cyberspace to promote the stability of the internet and good practice of everyone involved. 

Other efforts have been on the legislative level, such as specific additions to the Wassenaar Arrangement, an export control arrangement that seeks to curtail the spread of civilian technologies that can be put to militarised use. But the expertise of cyber operatives has so far seen limited attention. In the scenario described by Reuters, NESA and its Project Raven could not have operated without either the tools or the expertise. The tool itself, Karma, and the expertise and experience required to use it and train others to do so, both require significant investment. 

The dangers of state investment in the collecting of software flaws and the creation of powerful tools which then exploit these previously unknown weaknesses was painfully demonstrated through the leaking of the vulnerability stockpiled by the NSA, EternalBlue. 

This was the backbone of the WannaCry attack which made international headlines in 2018 through its impact on the British NHS and other international business and government services.

But concerns should be growing about the capability that states invest in the skill sets of the people who discover and then weaponise flaws in the software which power our increasingly interconnected and internet-dependent lives. 

Governments across the world are gearing up for what they see as the next domain of warfare by trying to recruit existing talent to government projects or through training the next generation of cyber-security experts who they hope will give them an advantage. 

There’s a risk that in global efforts which focus on states’ use of cyber tools and exploitation of vulnerabilities in programming code, there is a legislative and governance gap developing. 

This could see states invest in training the cyber-spies, saboteurs or soldiers of the future only to find those critical skills and the capability they provide being snapped up by the highest bidder.

The Conversation

You Might Also Read: 

Spyware Proliferates To 45 Countries:

 

« Top Six Cyber Secure Countries
Criminal Groups Offer Big Salaries For Cyber Skills »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

APMG International (APM Group)

APMG International (APM Group)

APM Group is a global accreditation, certification and examination body specializing in certification schemes for individuals, organizations and software.

Corero Network Security

Corero Network Security

Corero Network Security is dedicated to improving the security of the Internet through the deployment of its innovative DDoS & Network Security Solutions.

General Dynamics Information Technology

General Dynamics Information Technology

General Dynamics IT delivers cyber security services to defend critical information and infrastructure.

Seclab

Seclab

Seclab is an innovative player in the protection of industrial systems and critical infrastructure against sophisticated cyber attacks.

Copenhagen FinTech

Copenhagen FinTech

Copenhagen FinTech is a centre for R&D and innovation in the Danish finance IT sector. Focus areas include cyber security and payments platforms.

Onspring

Onspring

Onspring is the cloud-based platform of choice for governance, risk and compliance (GRC) teams and business operations experts across multiple industries.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

DreamIt Ventures

DreamIt Ventures

DreamIt Ventures is an early stage venture fund that accelerates startups building transformative tech products in the fields of Healthtech, Securetech, and Urbantech.

swIDCH

swIDCH

swIDch is a technology company that aims to eliminate CNP (card not present) Fraud.

Liberty Mutual

Liberty Mutual

Liberty Specialty Markets offers specialty and commercial insurance and reinsurance products, including Cyber, across the USA, Europe, Middle East and other international locations.

Pyxsoft PowerWAF

Pyxsoft PowerWAF

Pyxsoft PowerWAF responds to the problem of business cybersecurity. We protect our clients' websites and data against attacks and exploitation of all kinds of vulnerabilities.

Mobileum

Mobileum

Mobileum is a leading provider of Telecom analytics for roaming, security and risk management and end-to-end domestic and roaming testing solutions.

QuSecure

QuSecure

QuSecure provides a software-driven security architecture that overlays your current infrastructure and provides next-generation security to protect your entire network from quantum threats.

Concourse Labs

Concourse Labs

Concourse Labs Security Guardrails continuously verify cloud infrastructure and workloads. Continuously assess clouds for security, resiliency, and regulatory compliance.

Mindaro Insurance

Mindaro Insurance

Mindaro is adding the crucial piece of the cyber security puzzle that protects your organization from the financial ramifications of cyber attacks.

SE Ventures

SE Ventures

SE Ventures provides capital to big ideas and bold entrepreneurs who can benefit from Schneider Electric's deep domain expertise, R&D assets, and global customer base.