Today’s article is by our guest writer Ozanay Bozkaya. He’s a second year student at McGill. While mainly interested in history, politics, and international relations, he also closely follows technological developments.
As the title suggests, we live in an era of limitless possibilities… and YES, it does include ‘printing’ your very own ‘currency’ with no legal consequences. At least for now, that is.
A dark screen with green code reflects on to the man’s face, his hands fly across the keyboard as sweat drips down his forehead. We all know a movie scene where the hacker furiously breaches multiple computer systems with dizzying button mashes. In a way, these people exist in real life as well (though minus the reflective screen and overly dramatic tension), hacking into business and government systems, much like the recent Bundestag hack, which was revealed on March 1st. In light of this, it is important to ask why cyber-attacks matter, and what the rising trend tells us.
Cyber-attacks constitute the fifth dimension of warfare as defined by U.S. military doctrine. They are the sum of all computer systems-related attacks designed to control, malfunction or destroy various systems, and can hit literally any computer system in the world – even ones not connected to the internet – avoiding reliable detection. Generally, they are a potent tool in the hands of individuals or crime rings and are even utilized by powerful state actors. They come in vastly different scale and form, ranging from a ‘dirty’ USB stick designed to introduce malware to a personal computer, to a ‘worm’ the size of Stuxnet, which almost shut down the Iranian nuclear program.
The Bundestag hack very aptly demonstrates the danger of cyber-attacks to all organizations, especially governments and financial institutions. In light of the confrontation between Russia and the ‘West,’ it is safe to say that cyber-attacks are now the norm instead of a rarity. Just recently, there was a Distributed Denial of Service (DDoS) that targeted Dutch banks ABN Amro and ING, as well as the Dutch Revenue Service and the Dutch Central Bank. So, the increase in attacks and hacks are not only just some problem between government sponsored hackers, it’s a very personal problem if it means the average Joe loses their assets.
But, where do these attacks originate from? The real problem with cyber-attacks is just that. It’s never an easy task to determine the origin of the attacks, let alone discovering and then prosecuting those behind them. Frequently, cyber-attacks are blamed on Russian hacker groups like Cozy Bear or Snake, or Chinese groups like APT3. The US government, in particular, has claimed that such groups also frequently receive state backing through shadowy channels. Yet these groups are not the only threat. Though obviously on a much smaller scale, there are also individual hackers, hacking away for more personal reasons, such as ego. The real danger comes from a combination of both. Systems designed to only fight one or the other will inevitably let something slip through the cracks.
In the past year alone, there have been several major attacks: WannaCry, NotPetya, the Ethereum hack, the Equifax breach are but a few. WannaCry and NotPetya were largely ransomware attacks which encrypt the hard drive data of the computer, then require some form of payment, usually cryptocurrency, in order to regain access to the files. These spread far and wide, affecting computers in banks, universities and airports, among other places. The Ethereum hack, though not as widespread and well-known as the other hacks, involved the heist of over $35 million in cryptocurrency from the Ethereum app platform. The Equifax breach took the cases to a more serious level, exposing 147.9 million users’ data in the US, which included information such as Social Security Numbers, birth dates, addresses and even driver license numbers. It is a chilling thought that major corporations can sometimes fall prey to such attacks. Moreover, while the great majority of hacks currently target user or organization data, a new kind of attacks have also recently emerged. One of these is the attack on a Saudi petrochemical plant that investigators say was “meant to sabotage the firm’s operations and trigger an explosion.” The same kind of destructive tendency can also be seen with the ongoing effort to hack into U.S. infrastructure systems such as power plants and water systems, which the Department of Homeland Security attributes to Russian networks. In theory, since a great part of the international financial system is also built on digitization, any hacker able to breach the London Stock Exchange or Euronext Stock Exchange could decide to tank the price of a stock by altering the details. Such actions could wipe out millions of euros in value, all with the push buttons.
The Bundestag hack, along with other hacks of its kind, such as ongoing attacks on government services of Estonia, also point to the reality that Europe is also directly a target of such activities. These attacks also have a political dimension. A breach designed to infiltrate the foreign ministry of a country, as in the case of the Bundestag hack, would yield information regarding diplomatic capacity. Here, an apt comparison would be where you know exactly what lie a friend will tell you to avoid going out with you on Saturday evening. The power that that information gives may not make much a difference at your personal scale, but it can make the world when Russia, say, knows exactly how far the German government is willing to go in pushing or enforcing sanctions. The value of that information cannot really be overstated. It’s like playing chess against somebody when you know every single move they will make ahead of time. In a sense, humanity has gone full circle; where once, during the Cold War, it was a matter of the person next to you being a double-agent for the Soviets, or vice-versa, it is now the computer you use that threatens to become a tool for the opponent or competitor.
Even as cyber-attacks grow common however, governments and organizations have begun to take measures. On the one hand, this has led to the growth of an interesting sector, which is known as ‘white-hat hacking,’ otherwise known as penetration testing. The idea here is that actors in this sector sign contracts with various organizations to actively attempt to hack into their systems. This way, by attempting to penetrate the security of an organization, white-hat hackers provide valuable information on the security flaws within a system. The target organization can then use this knowledge to improve and further protect its computer systems. On the other hand, many governments now allocate sizeable budgets to IT security. The Dutch government, for example, allocated about 0.0005 of Gross Domestic Product (GDP) in 2014, but has increased this amount to 0.005 of GDP as of 2018. Yet these increases still do not seem to match the losses incurred from cybercrime. A report by the Hague Center for Strategic Studies put the total annual government spending on cyber-security in 2015 at about €30 million, a number that it claims falls short of what it should be spending. Accordingly, the HCSS suggested that 1.5% of Dutch GDP was lost to cybercrime, in addition to €10 billion value lost by cyber-risks.
Cyber-attacks have grown in number and scale around the world, threatening a variety of computer systems in different ways: in order to extract data, destroy or disrupt systems, or to extract material payment. They have a material cost, as well as psychological effect, burdening society further. The Bundestag hack is just a stark reminder that the computer systems on which modern society depends are vulnerable to outside influence.