5 ms·

It used to be the case during the Cold War that there was an unspoken, tacit understanding that assassination would not be used as a tool against the leadership

It used to be the case during the Cold War that there was an unspoken, tacit understanding that assassination would not be used as a tool against the leadership of the great powers: assassins are cheap, so if it became established as a tool it would create a level playing field. (There were exceptions, e.g. in the third world, but there was a big difference between a front-rank player (the USSR) murdering someone like Hafizullah Amin during the opening moves of an invasion, and something like the shootdown of Dag Hammarskjöld's plane during the Congo crisis: assassinating the UN Secretary General was a huge scandal at the time.) Today, the use of weaponized CVEs by SIGINT agencies seems to have developed into a free-for-all: the big players were clueless about the potential for accidentally normalizing this practice, or the scale of the consequences as computers became ubiquitous and indispensable components of everything from hospital medicine carts to automobiles, and thereby leveled the playing field and quasi-legitimized it for non-state level actors. And we're all going to be paying the price for at least a generation.

nostrademons 7y ago
I thought the big deal with EternalBlue is that the Shadow Brokers released the NSA's hacking trove as open-source, thus opening it up to all sorts of people with minimal technical skills. There's a big difference between having a zero-day but requiring the technical chops to turn it into a working exploit, and downloading a file off the Internet and running it. There's this huge pandora's box about opening up state-level weaponry to the general public. Ultimately, it undermines the nation state as an organizing principle. And that's the world we live in now. (For that matter, all these attacks are credited to Russia or North Korea or Iran - but do we actually have any evidence that that's who's behind them? Couldn't it just as easily be a teenager in his bed in upstate NY who has compromised a server in Russia? $100K in Bitcoin ransom is peanuts for a nation-state and would even be peanuts for a number of Silicon Valley techies on this site, but it's a lot of money to a high school kid.)
- sterlind 7y ago
  This BlackHat keynote[0] makes the good point that cyberattacks by other countries, especially Russia (the 'bears') work fundamentally differently from the US. In the US, private companies aren't allowed to do any hacking whatsoever, and organized crime is swiftly prosecuted by the FBI. The NSA would often have a dozen meetings before changing course on an operation... the bureaucracy is slow and autonomy is non-existent. In Russia, there is no extradition for hackers, and it's rare for someone to be prosecuted for ransomware. Malware writers and organized crime rings form a loose network with Kremlin officials. Attacks are done as favors, or even launched because the hackers think Putin would like it. Guccifer 2.0 is a prime example of this.. their espionage op against the DNC got blown, and 12 hours later they relaunched the op as a hacktivist campaign. It's altogether more casual and efficient. As a bonus, you don't have to pay your hackers if you let them make their own profits... hence all the ransomware. $100k is a good haul for an enterprising Russian criminal. 0. https://youtu.be/gvS4efEakpY https://youtu.be/gvS4efEakpY
  - chupasaurus 7y ago
    Corrections: > it's rare for someone to be prosecuted for ransomware. Because of the choice between prison time with blackmail and other dirty deeds or working on the 3-letter organization. Russian law enforcement agencies are large criminal organizations themselves. > Malware writers and organized crime rings form a loose network with Kremlin officials. Those form a very tight network, former also with Lubyanka officials (location of FSB HQ).
- paulie_a 7y ago
  There has been pretty strong attribution for NK in the past doing ransomware. 100k isn't a lot but you are talking about NK, a country that has it's diplomats selling meth and heroin
- blotter_paper 7y ago
  > There's this huge pandora's box about opening up state-level weaponry to the general public. Ultimately, it undermines the nation state as an organizing principle. And that's the world we live in now. I feel like this point is hardly ever appreciated. I don't think we quite live in that world (where's my open source nuke?), but we're always oscillating on the continuum if we take a long enough view of the situation. The extent to which power is distributed relies on the extent to which technology is distributed, but also the extent to which the distributed technology can be utilised by a relatively small group. A small group with equally good spear designs still loses to the larger group. A small group with equally good drones, nukes, viruses, and firewalls might be able to put up something closer to an even fight. A radical open sourcing of technology might lead to a breakup of the modern nation state into smaller entities. Until it does, or some sort of parallel structures form alongside the nation states which they are unable to actually police, I wouldn't call them undermined. The parallel structure scenario might be somewhat arguable today, but always has been; the line between organized crime and government is blurry. I don't think we've moved significantly far in that direction as a result of open source tools yet. If there ever comes a day when private defense contractors can accept Bitcoin without KYC and taxes, just rolling through the streets in a small division of tanks selling AK-47s to passing school children, I'll completely agree that the nation state has been undermined.
  - ethbro 7y ago
    Imho, what keeps the nation-state from being undermined by the techno-anarchist crowd is the requirement to hold territory. Any halfway competent person in a number of fields (cyber security, virology, chemistry) could probably "take over" a small town with a few buddies. And then the US government surrounds it. Blockades it. Allows nothing in or out. And waits. As the Palestinians, South Sudanese, Tibetans, Taiwanese, Hongkongers have found (with varying degrees of success), independence is only viable as a going concern if you have international allies and trade.
    - blotter_paper 7y ago
      Agree completely. I think this is one of the reasons for so much interest in seasteading despite the high barrier of entry and maintenance compared to living on land (not that a group of ships can't be surrounded and sanctioned). Ultimately, I fear that joining the WMD club is a prerequisite to true self determination.
tptacek 7y ago
I am not sure how you are getting from SIGINT to assassination. Since at least WW2, and almost certainly long before, there has been no tacit agreement that the great powers wouldn't spy on each other. Quite the opposite, in fact. Is your argument instead that things like ransomware attacks are more akin to sabotage than to intelligence gathering? In that case, I'd suggest keeping two things in mind: 1. The one well-attributed case of state-level ransomware attacks was to North Korea, the norms-violating exception that somewhat proves the rule. 2. The majority of ransomware attacks are carried out by bona fide private actors unaffiliated with any state, and ransomware is also a part of our current norm, and has been for many years. It will be interesting to see what happens when China shuts the power grid in Omaha, Nebraska off --- a capability they almost certainly have. The fact that you don't see things like that happening today suggests to me that the norm (I believe) you're referring to remains intact.
- jorblumesea 7y ago
  Major powers set international standards, and failure to establish standards for cyber has produced a situation where exploitation of CVEs has become so normalized that there are almost zero repercussions for using them in destructive ways. Especially if you are a non major power or non state actor, there seems to be little incentive not to wreak damage and havoc. The US and Europe have failed to clearly state the consequences for a major attack, instead, we muddle along assuming that that the implications will be enough. Even huge damage attacks by nation state actors such as the Sony North Korea hack seem to have gone unpunished.
  - tptacek 7y ago
    Respectfully, that's pretty silly. People have been "wreaking havoc" with exploits for as long as there have been exploits. Nobody in the world was waiting for China's permission to do this kind of stuff. I don't think that's the previous commenter's argument.
    - jorblumesea 7y ago
      No country "needed" permission for anything, ever. But there's a reason that the cold war didn't turn hot, and in part it was because the major powers, US and Russia, were able to set formal and informal international standards for intelligence, espionage and data collection, for themselves and for their allies. The same can be said with the arms control treaties, nuclear weapons, non-proliferation, etc. That all seems to have gone out the window in the cyber realm, where there aren't any standards or consequences for nefarious actions. This seems like a very basic and obvious observation.

nostrademons 7y ago

I thought the big deal with EternalBlue is that the Shadow Brokers released the NSA's hacking trove as open-source, thus opening it up to all sorts of people with minimal technical skills. There's a big difference between having a zero-day but requiring the technical chops to turn it into a working exploit, and downloading a file off the Internet and running it. There's this huge pandora's box about opening up state-level weaponry to the general public. Ultimately, it undermines the nation state as an organizing principle. And that's the world we live in now. (For that matter, all these attacks are credited to Russia or North Korea or Iran - but do we actually have any evidence that that's who's behind them? Couldn't it just as easily be a teenager in his bed in upstate NY who has compromised a server in Russia? $100K in Bitcoin ransom is peanuts for a nation-state and would even be peanuts for a number of Silicon Valley techies on this site, but it's a lot of money to a high school kid.)

sterlind 7y ago
This BlackHat keynote[0] makes the good point that cyberattacks by other countries, especially Russia (the 'bears') work fundamentally differently from the US. In the US, private companies aren't allowed to do any hacking whatsoever, and organized crime is swiftly prosecuted by the FBI. The NSA would often have a dozen meetings before changing course on an operation... the bureaucracy is slow and autonomy is non-existent. In Russia, there is no extradition for hackers, and it's rare for someone to be prosecuted for ransomware. Malware writers and organized crime rings form a loose network with Kremlin officials. Attacks are done as favors, or even launched because the hackers think Putin would like it. Guccifer 2.0 is a prime example of this.. their espionage op against the DNC got blown, and 12 hours later they relaunched the op as a hacktivist campaign. It's altogether more casual and efficient. As a bonus, you don't have to pay your hackers if you let them make their own profits... hence all the ransomware. $100k is a good haul for an enterprising Russian criminal. 0. https://youtu.be/gvS4efEakpY https://youtu.be/gvS4efEakpY
- chupasaurus 7y ago
  Corrections: > it's rare for someone to be prosecuted for ransomware. Because of the choice between prison time with blackmail and other dirty deeds or working on the 3-letter organization. Russian law enforcement agencies are large criminal organizations themselves. > Malware writers and organized crime rings form a loose network with Kremlin officials. Those form a very tight network, former also with Lubyanka officials (location of FSB HQ).
paulie_a 7y ago
There has been pretty strong attribution for NK in the past doing ransomware. 100k isn't a lot but you are talking about NK, a country that has it's diplomats selling meth and heroin
blotter_paper 7y ago
> There's this huge pandora's box about opening up state-level weaponry to the general public. Ultimately, it undermines the nation state as an organizing principle. And that's the world we live in now. I feel like this point is hardly ever appreciated. I don't think we quite live in that world (where's my open source nuke?), but we're always oscillating on the continuum if we take a long enough view of the situation. The extent to which power is distributed relies on the extent to which technology is distributed, but also the extent to which the distributed technology can be utilised by a relatively small group. A small group with equally good spear designs still loses to the larger group. A small group with equally good drones, nukes, viruses, and firewalls might be able to put up something closer to an even fight. A radical open sourcing of technology might lead to a breakup of the modern nation state into smaller entities. Until it does, or some sort of parallel structures form alongside the nation states which they are unable to actually police, I wouldn't call them undermined. The parallel structure scenario might be somewhat arguable today, but always has been; the line between organized crime and government is blurry. I don't think we've moved significantly far in that direction as a result of open source tools yet. If there ever comes a day when private defense contractors can accept Bitcoin without KYC and taxes, just rolling through the streets in a small division of tanks selling AK-47s to passing school children, I'll completely agree that the nation state has been undermined.
- ethbro 7y ago
  Imho, what keeps the nation-state from being undermined by the techno-anarchist crowd is the requirement to hold territory. Any halfway competent person in a number of fields (cyber security, virology, chemistry) could probably "take over" a small town with a few buddies. And then the US government surrounds it. Blockades it. Allows nothing in or out. And waits. As the Palestinians, South Sudanese, Tibetans, Taiwanese, Hongkongers have found (with varying degrees of success), independence is only viable as a going concern if you have international allies and trade.
  - blotter_paper 7y ago
    Agree completely. I think this is one of the reasons for so much interest in seasteading despite the high barrier of entry and maintenance compared to living on land (not that a group of ships can't be surrounded and sanctioned). Ultimately, I fear that joining the WMD club is a prerequisite to true self determination.

tptacek 7y ago

I am not sure how you are getting from SIGINT to assassination. Since at least WW2, and almost certainly long before, there has been no tacit agreement that the great powers wouldn't spy on each other. Quite the opposite, in fact. Is your argument instead that things like ransomware attacks are more akin to sabotage than to intelligence gathering? In that case, I'd suggest keeping two things in mind: 1. The one well-attributed case of state-level ransomware attacks was to North Korea, the norms-violating exception that somewhat proves the rule. 2. The majority of ransomware attacks are carried out by bona fide private actors unaffiliated with any state, and ransomware is also a part of our current norm, and has been for many years. It will be interesting to see what happens when China shuts the power grid in Omaha, Nebraska off --- a capability they almost certainly have. The fact that you don't see things like that happening today suggests to me that the norm (I believe) you're referring to remains intact.

jorblumesea 7y ago
Major powers set international standards, and failure to establish standards for cyber has produced a situation where exploitation of CVEs has become so normalized that there are almost zero repercussions for using them in destructive ways. Especially if you are a non major power or non state actor, there seems to be little incentive not to wreak damage and havoc. The US and Europe have failed to clearly state the consequences for a major attack, instead, we muddle along assuming that that the implications will be enough. Even huge damage attacks by nation state actors such as the Sony North Korea hack seem to have gone unpunished.
- tptacek 7y ago
  Respectfully, that's pretty silly. People have been "wreaking havoc" with exploits for as long as there have been exploits. Nobody in the world was waiting for China's permission to do this kind of stuff. I don't think that's the previous commenter's argument.
  - jorblumesea 7y ago
    No country "needed" permission for anything, ever. But there's a reason that the cold war didn't turn hot, and in part it was because the major powers, US and Russia, were able to set formal and informal international standards for intelligence, espionage and data collection, for themselves and for their allies. The same can be said with the arms control treaties, nuclear weapons, non-proliferation, etc. That all seems to have gone out the window in the cyber realm, where there aren't any standards or consequences for nefarious actions. This seems like a very basic and obvious observation.