15 ms·
This is merely a taste of what is to come. When President Obama stated in December[0] that we will deliver a "proportional response" to Russian hacking at the
by apeace 9y ago
This is merely a taste of what is to come.
When President Obama stated in December[0] that we will deliver a "proportional response" to Russian hacking at the "time and place of our own choosing", it seemed that most of the country was proud, almost gleeful at the thought that we would be striking back. I for one was mortified.
We should not be escalating cyberwar, even if we do have proof of who attacked us. People are going to die. We can see from this article that hacking can cause serious real-world problems.
When we strike back, does Russia then strike back again? What does it look like after four or five volleys? Will entire power grids be down for days or weeks? Will the stock market crash?
It's time for the American people to demand that the N.S.A. become a defensive organization, not an offensive one. And it's time for us to demand peace in general. Cyberwar is war.
[0] http://www.cnn.com/2016/12/15/politics/obama-russia-hacking-election/index.html http://www.cnn.com/2016/12/15/politics/obama-russia-hacking-...
- jameskegel 9y agoOh what a world we live in where cyberwarfare could result in death. I would have never thought, as a kid, that life (and death) would end up this "real".
- NumberCruncher 9y agoThe hacker Karl Koch [1] thought being responsible for the disaster at Chernobyl [2] back in 1986 causing 2M deaths in the last 30 years. I think we will never know whether he was right or not. [1] https://en.wikipedia.org/wiki/Karl_Koch_(hacker) https://en.wikipedia.org/wiki/Karl_Koch_(hacker) [2] (German) https://de.wikipedia.org/wiki/KGB-Hack https://de.wikipedia.org/wiki/KGB-Hack
- peterwaller 9y agoI'm confused what the connection is with Chernobyl. But 2M deaths in the last 30 years is not likely correct - this interesting WHO report on the matter suggests the final toll from the radiation would be more like "up to 4k": http://www.who.int/mediacentre/news/releases/2005/pr38/en/ http://www.who.int/mediacentre/news/releases/2005/pr38/en/ http://www.who.int/ionizing_radiation/chernobyl/chernobyl_digest_report_EN.pdf http://www.who.int/ionizing_radiation/chernobyl/chernobyl_di... > The main causes of death in the Chernobyl-affected region are the same as those nationwide — cardiovascular diseases, injuries and poisonings — rather than any radiation-related illnesses
- NumberCruncher 9y ago>> The main causes of death in the Chernobyl-affected region... The Chernobyl-affected region includes big parts of Western Europe. Back then in 1986 my godfather was cleaning trains coming from Russia through Ukraine (but not directly from the Chernobyl region) and was contaminated. He lost his teeth and hair. We lived ca. 800 km away from Chernobyl. On the other hand thanks the river Dnepr the Chernobyl region is connected to the Ukraine ground water system. The astimation of 2M deaths caused by long time effects of contamination comes from a friend from Kiew. She never drunk tap water.
- digi_owl 9y agoWhile not affecting humans directly, an indication of the far reach of Chernobyl is that sheep farmers in parts of Norway still have to medicate the herd.
- roywiggins 9y agoIt's such an extraordinary claim that, without evidence, it's reasonable enough to dismiss. The causes of Chernobyl have been pretty exhaustively thrashed out, and it all seems pretty well explained without any hacking intrusion. If every claim like this has to be met with a shrug and "I guess we'll never know the truth" then it becomes very hard to ever know anything, because there's always some nutter willing to claim something that's totally at odds with all the available evidence.
- lobster_johnson 9y agoThe cause of the Chernobyl disaster are extremely well researched and documented; the explosion was caused by a planned test that went terribly wrong. Nothing I have read indicates anything about a hack, and everything can be explained by the actions of the people physically present.
- tripzilch 9y ago> The hacker Karl Koch [1] thought being responsible for the disaster at Chernobyl [2] back in 1986 causing 2M deaths in the last 30 years. I don't think that's right, the German wikipedia article says: > Im April 1986 kam es zur Katastrophe von Tschernobyl. Karl Koch, zu diesem Zeitpunkt schon lange schwer drogenabhängig und in einem oft zweifelhaften geistigen Zustand, sah dies als unmittelbare Folge eines seiner Hacks an, da er kurz vorher in den Rechner eines Atomkraftwerks eingedrungen war. Unless my understanding of German is flawed, what I'm reading is that it was Koch's drug-fueled paranoia that made him believe he was responsible for the Chernobyl disaster because he had recently hacked into a computer in a nuclear power station. It doesn't say whether this computer even was in Chernobyl, maybe he didn't know exactly where the computer on the other end was, or maybe it was more paranoia. He was, after all, in a pretty bad state near the end of his "career". It's such a fascinating and sad story, this guy. I've watched the film "23 nichts ist wie es scheint" (initially because of the RAW/Discordia/Illuminatus Trilogy references) a long time ago, but I don't remember anything about Chernobyl in that film (but it was a long time ago). There was another film, a US movie IIRC, that tells his story from the side of an FBI or CIA (or some agency) agent chasing him. I forget the title, anyone know?
- sillysaurus3 9y agoI don't want the NSA to become a defensive organization. I like that Iran's nuclear program is being delayed. That's not a defensive action. You don't seem to be proposing that the NSA become defensive, either. If Russia attacks us and we don't respond, that's not even defensive. That's dismantling.
- wu-ikkyu 9y agoA defensive response would be to inform major vendors of our own infrastructure (i.e. Microsoft, Cisco) of the gaping holes in their systems, instead of leaving them open for the world to attack.
- killjoywashere 9y agoI can name at least one netsec guy who attributes his entire team's existence to the NSA calling his employer and doing exactly that.
- sillysaurus3 9y agoRight. It's a false dichotomy that the NSA doesn't do that and needs to disarm itself. There's a happy middle ground where people don't attack us because they're worried about our retaliation and we also improve our own defenses.
- wu-ikkyu 9y agoSounds like that netsec guy's team serves military customers then?
- killjoywashere 9y agoNo, they do design work for consumer products. But good job reading my prior comments :)
- wu-ikkyu 9y ago
- NumberCruncher 9y agoMan's way to peace is by having a bigger gun than his neighbor.
- thrillgore 9y agoAt some point, someone will use their Bitsy Big-Boy Boomeroo, and that'll be the end of that.
- SCHiM 9y agoThus ushering in a new era of peace and prosperity for the termites scuttling through the ruins of human civilization. Sounds like a plan.
- Asdfbla 9y agoThe problem is such traditional calculus doesn't apply anymore in cyberwar. For one thing, your big "guns" weaken your own infrastructure, since you use about the same technology that your adversary uses too. Secondly, your guns can be copied without many problems and then suddenly they are directed at you and your weakened infrastructure.
- ionised 9y agoThat's obscenely naive.
- gregmac 9y ago> When we strike back, does Russia then strike back again? What does it look like after four or five volleys? Will entire power grids be down for days or weeks? Will the stock market crash? And at what point, after "cyber-damaging" some piece of critical infrastructure (and/or harming/killing people), does the the other side run out of exploits and just launch actual missiles instead?
- devrandomguy 9y agoDo these missiles require a working communications network? If this goes on long enough, there might not be any way to launch them.
- rjsw 9y agoWhy do you think that different countries have put missiles in submarines ?
- SCHiM 9y agoAnd Russia reportedly even has a deadmans-switch that can be triggered by seismic activity on Russian soil and rapid changes in air pressure. I'd presume that such a system is not connected to the internet.
- TeMPOraL 9y agoAll of those systems predate the Internet, so you bet nuclear capabilities will not be affected much by cyber attacks.
- graedus 9y agoNuclear capabilities will probably not be affected much by cyber attacks over the internet. There are other vectors, but they obviously require a much more serious investment in espionage, spycraft, etc.
- 9y ago
- tr1ck5t3r 9y agoMaybe the hacks were a side show, maybe the hacks were designed to raise awareness of Bitcoins in the collective consciousness?
- joe_the_user 9y agoThe primary way for the NSA to be a defensive organization would be for it to very publicly take a lead in closing up the holes they find on a structural level. Whether the NSA hoards zero-day exploits or not isn't the big issue since someone will be doing that. The issue is they should be sounding the alarm on whatever broad class of system vulnerabilities they find. They should be evangelizing against remotely updateable hard drive firmware, against insecure IoT devices and similar things.
- sqeaky 9y agoThis is so obvious and true that everyone cannot help but overlook it. What happened to the days when the NSA helped make world class crypto like AES256 in a public forum?
- MrZongle2 9y agoI think the world-class individuals who made the NSA into a competent organization left after the end of the Cold War. It looks to have been run by wingnuts ever since; Keith Alexander's "Star Trek" room ( https://www.theguardian.com/commentisfree/2013/sep/15/nsa-mind-keith-alexander-star-trek https://www.theguardian.com/commentisfree/2013/sep/15/nsa-mi... ) comes to mind.
- willstrafach 9y ago> The issue is they should be sounding the alarm on whatever broad class of system vulnerabilities they find. Sounds like the IAD mission. Examples: - https://github.com/iadgov/Pass-the-Hash-Guidance/blob/master/README.md https://github.com/iadgov/Pass-the-Hash-Guidance/blob/master... - https://www.iad.gov/iad/library/reports/nsa-methodology-for-adversary-obstruction.cfm https://www.iad.gov/iad/library/reports/nsa-methodology-for-... I mention that first one especially because Pas-The-Hash was a major reason the most recent ransomware outbreak was able to get onto already-patched machines.
- joe_the_user 9y agoMy gawd, Firefox is telling the iad's security certificate is broken. Now if there was ever a sign the world is going to heck, that would be it.
- pc2g4d 9y agoHow big is the space of potential exploits? If organization A searches for exploits for five years in a given piece of software, and organization B does the same, what percentage of the exploits they find will be found by both rather than just one? If hackers/governments tend to find the same exploits as each other then it makes more sense to take a defensive strategy since you can protect against a large portion of the weapons your enemies develop. But if there's not much overlap in which exploits are found then an offensive strategy may make more sense. In the nuclear arms race there was basically one type of attack and one set of mitigations. In cyberwarfare there are potentially endless types of attacks, each with its own set of mitigations. This changes the calculus. The likelihood of one's weapons being stolen and used against you, your allies, or humanity in general is also a huge consideration.
- willstrafach 9y ago> When we strike back, does Russia then strike back again? It seems that Russia is happy to continually strike regardless of retaliation.