UK Will Name The Nations Sponsoring Cyber Attacks

Britain will name and shame foreign states that hire hackers to carry out cyber-attacks or interfere via the Internet in national elections, the British attorney general has warned.

In a speech referring to Russian and North Korean “campaigns of intrusion”, Jeremy Wright QC called for international sanctions to be applied against countries that exploit cyberspace for illegal purposes.

“If we stay silent, if we accept that the challenges posed by cyber technology are too great for the existing framework of international law to bear, that cyberspace will always be a grey area, a place of blurred boundaries, then we should expect cyberspace to continue to become a more dangerous place,” Wright told an audience at Chatham House in central London.

“The question is not whether or not international law applies, but rather how it applies and whether our current understanding is sufficient ... Hostile actors cannot take action by cyber means without consequence, both in peacetime and in times of conflict. States that are targeted by hostile cyber operations have the right to respond to those operations in accordance with the options lawfully available to them ...

“If it would be a breach of international law to bomb an air traffic control tower with the effect of downing civilian aircraft, then it will be a breach of international law to use a hostile cyber operation to disable air traffic control systems which results in the same, ultimately lethal, effects.” 

Such rights are already established in the UN charter, Wright said, including prohibitions on interventions in the domestic affairs of states and the threat or use of force against the territorial independence or political integrity of any country. 

Cyber operations that cause, or present an imminent threat of, death and destruction on an equivalent scale to an armed attack also give rise to an inherent right to take action in self-defence as recognised under article 51 of the UN charter, Wright said.

“If a hostile state interferes with the operation of one of our nuclear reactors, resulting in widespread loss of life, the fact that the act is carried out by way of a cyber operation does not prevent it from being viewed as an unlawful use of force or an armed attack against us.”

Counter-measures cannot involve the use of force, he said. They must be both necessary and proportionate to the purpose of inducing the hostile state to comply with its obligations under international law. 

The UK does not believe that it is always legally obliged to give prior notification to a hostile state before taking counter-measures against it.

“It could not be right for international law to require a counter-measure to expose highly sensitive capabilities in defending the country in the cyber arena, as in any other arena.” 

Wright’s comments, which follow an FBI inquiry into alleged Russian interference in the 2016 US presidential election, are intended to deter hacking attacks from abroad and attempts by foreign states to influence domestic politics. Wright is keen to ensure that international law keeps up with the rapid pace of technological development and that the international community does not let cyberspace degenerate into a “lawless world”. The UK, he added, is prepared to identify states that recruit proxy actors or hackers to disguise the source of online attacks. 

The WannaCry ransomware incident last year, which affected the NHS, was attributed by the UK and its allies to North Korean-sponsored hackers.

The new National Cyber Security Centre has a mandate to protect Britain’s interests in cyberspace. In the past year it identified on average 4.5m malicious emails per month. The UK government has said it is investing £1.9bn in cybersecurity. 
Other cyber-attacks in which the UK has named and shamed state actors include the hack and leak of Democratic National Committee emails in the run-up to the US election.

This year, Britain blamed the Russian military for the NotPetya ransomware attack, which started in the Ukraine and spread around the world.

In April, the National Cyber Security Centre, the US Department for Homeland Security and the FBI issued a joint statement saying there had been an extensive and sustained Russian campaign of intrusions into the internet infrastructure of the UK and the US.

Guardian

You Might Also Read: 

Nation State Cyber Attacks Are An Act Of War:

Nation State Hacking Is On Trend In 2018:
 

« Cybercrime Is Increasing In Scotland
Facebook Gave Chinese Tech Firms Access To User Data »

Quartz Conference
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Perimeter 81 / Zero Trust Network Access Guide

Perimeter 81 / Zero Trust Network Access Guide

Curious how you can Implement a Zero Trust roadmap with insights from Gartner? Download this free report for a limited time only.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Leonardo

Leonardo

Leonardo, formerly Finmeccanica, is a global high-tech company in Aerospace, Defence, Security & Information Systems including Cybersecurity & ICT solutions.

Ethio-CERT

Ethio-CERT

National Cyber Emergency Readiness and Response Team of Ethiopia.

Sookasa

Sookasa

Sookasa offers a single, seamless CASB solution to detect breach risks, encrypt data, and enforce your security policies.

Foresite

Foresite

Foresite is a global service provider, delivering a range of managed security and consulting solutions.

Senrio

Senrio

Senrio provides a cybersecurity platform for the Internet of Things.

Woz U

Woz U

Woz U provides best-in-class technology training for Learners, Higher-Ed and Corporations. We focus on the most in-demand occupations such as Software Development, Data Science and Cyber Security.

Achtwerk

Achtwerk

Achtwerk manufacture the security appliance IRMA for critical infrastructures and networked automation in production plants.

PureVPN

PureVPN

PureVPN is a Virtual Private Network services provider offering secure encrypted access to the internet.

Sistem Integra (SISB)

Sistem Integra (SISB)

SISB provide IT Security Infrastructure & Development, Mechanical & Electrical Services, Fire Safety & Detection Services, Facilities Management & Application Development.

Safe Security (Lucideus)

Safe Security (Lucideus)

Safe Security (previously Lucideus) provides Cyber risk assessment services and platforms to multiple Fortune 500 companies and governments across the globe.

Sweepatic

Sweepatic

The Sweepatic reconnaissance platform discovers and analyses all internet facing assets and their exposure to risk.

Hacken

Hacken

Hacken provide a range of cybersecurity services including security assessments, blockchain security audits, and secure software development.

Antares NetlogiX

Antares NetlogiX

Antares Netlogix are a leading Austrian service provider for IT security, critical infrastructures and managed security services.

Pentesec

Pentesec

Pentesec is a security specialist offering professional services, managed security services and expertise within an extensive range of security technologies.

Tide Foundation

Tide Foundation

Tide's breakthrough multi-party-cryptography enables TRUE-zero-trust technology that unlocks cyber-herd immunity.

Cymptom

Cymptom

At Cymptom our purpose is to enable security managers to see at a glance all urgently risky gaps  in their organizations’ security posture at any given moment.