7 ms·

Britain has offensive cyberwar capability, top general admits

64 points by elorant 6y ago

a5withtrrs 6y ago
Is there any developed country that doesn't have this type of capability? Certainly all five-eyes countries have some form of capabilities. China, Russian, North Korea, Iran all regularly demonstrate they do too.
- 082349872349872 6y ago
  The question is: who's putting effort into the far less-sexy defensive capability? compare https://news.ycombinator.com/item?id=24575935 https://news.ycombinator.com/item?id=24575935
  - TheOtherHobbes 6y ago
    Defending systems against hacking tends to be far harder than hacking them, if only because you have to think of everything, and then harden it. Based on the UK's record with IT I would be far more reassured if it was working hard to defend critical civilian infrastructure than if it could take out a few servers in a remote country.
    - KineticLensman 6y ago
      > I would be far more reassured if it was working hard to defend critical civilian infrastructure NCSC has an 'exercise in a box' [0] that you can use for precisely this purpose. [0] https://www.ncsc.gov.uk/information/exercise-in-a-box https://www.ncsc.gov.uk/information/exercise-in-a-box
    - C1sc0cat 6y ago
      Both one would hope I wont say any details in public but I do remember conversations with colleagues and some people on a networking course how fragile some of the CNI is in the UK.
  - arethuza 6y ago
    I thought that was going to be about the recent 'official' stories that the British Army was going to get rid of its tanks: https://www.bbc.co.uk/news/uk-53909087 https://www.bbc.co.uk/news/uk-53909087 What we can be certain of is that the Army will never willingly get rid of its horses.
    - 082349872349872 6y ago
      Wow. We somehow failed to notice that horses don't fit in foxholes, but we did eventually get rid of ours when we noticed they weren't really cut out for NBC suits. (Youtube is failing miserably for Parade Song of the Camp Animals. Kipling actually had tunes in mind for them, something none of the interpreters in my bubble seem to have noticed. For instance: https://www.youtube.com/watch?v=Av2-A-igOJk https://www.youtube.com/watch?v=Av2-A-igOJk By the brand on my shoulder, the finest of tunes Is played by the Lancers, Hussars, and Dragoons, And it's sweeter than "Stables" or "Water" to me-- The Cavalry Canter of "Bonnie Dundee"! Then feed us and break us and handle and groom, And give us good riders and plenty of room, And launch us in column of squadron and see The way of the war-horse to "Bonnie Dundee"! )
      - arethuza 6y ago
        The Army has had more horses than tanks for a while: https://www.bbc.co.uk/news/uk-scotland-highlands-islands-22951548 https://www.bbc.co.uk/news/uk-scotland-highlands-islands-229...
        chrisseaton 6y ago
        > The British Army has not used horses in a combat role since World War I Note that this isn't true - several British Army combat units genuinely fought on horseback during WWII. https://api.parliament.uk/historic-hansard/lords/1941/aug/06/operations-in-syria#S5LV0119P0_19410806_HOL_41 https://api.parliament.uk/historic-hansard/lords/1941/aug/06... And I believe you can still do a combat horse riding course at one of the US special forces schools today. One good explanation for having so many horses is simply that a tank carries four soldiers while a horse only carries one! In reality we have one regiment minus (just two squadrons) of horse mounted cavalry, just one troop plus of horse-drawn field artillery, and a mounted band. Doesn't seem excessive.
  - KineticLensman 6y ago
    > who's putting effort into the far less-sexy defensive capability? In this case, exactly the same people. The UK's defensive capability is public knowledge - here's the website of the public facing part: https://www.ncsc.gov.uk/ https://www.ncsc.gov.uk/ This article is news because its one of the few times they have spoken about the offensive side.
gonzo41 6y ago
Is this news for the Five Eyes countries? I heard earlier last year about Australian ASD working with NSA and I'd assume GCHQ in Operation Glowing Symphony, where they hacked a bunch of ISIS recruiting sites. I'd be surprised if they didn't have this to be honest. It'd be interesting to know the magnitude of the capability. Can they crash the internet? or a person's life? or a power station? And it'd also be great to know what their target acquisition time time was and ROE.
- mtgx 6y ago
  If you stop seeing this as "news" and start seeing it as "PR", then it makes more sense.
- brodouevencode 6y ago
  I had the same thought. Why would anyone be surprised? Quite honestly (because the UK way of life aligns with mine) I'm glad that they do.
- vsareto 6y ago
  This isn't surprising, but it seems like posturing and deception are more effective for cyberwar than conventional capabilities, and this article was probably written for that purpose.
  - csilverman 6y ago
    That's what I was thinking. I'd imagine cyberwar capabilities are a lot more difficult for enemies to assess, at least in regards to conventional weapons. You can't spot them by satellite or anything; you'd have to estimate them based on knowledge of past attacks or reports from spies/informants. That strong element of uncertainty, combined with confident public statements and the knowledge of UK technical expertise in general, is probably a pretty decent deterrent, even if the abilities in question happened to be exaggerated.
    - mywittyname 6y ago
      > even if the abilities in question happened to be exaggerated. I donno. Stuxnet demonstrated how sophisticated the capabilities are of highly advanced nations, and that was around 10 years ago. At this point, I suspect that the assumption is that any computer-controlled system will be a target for cyber-espionage, and that it might not be obvious that such an attack is underway without some kind of monitoring that relies on statistical analysis of the performance deviance from some expected value. To compound the problem, the USA & China can likely obtain technical specs for just about any system produced in the world by just asking, and failing that, through corporate espionage. Which means these countries are pretty well positioned to pull off crazy hacks that wouldn't even seem possible.
SCHiM 6y ago
It was the gchq that hacked european institutions way back in 2012(?). And then Belgacom of course.
deleted 6y ago
[deleted]
bpodgursky 6y ago
It would be far more scandalous if any developed country (with an economy which depends on electronic infrastructure) wasn't investing in this capacity. Having "capacity" is like having a military... it doesn't mean you're using it, it means you understand it and can use it as a viable deterrent.
jacknews 6y ago
Don't Panic!
tptacek 6y ago
This is a weird story. At the prices involved in maintaining this capability it would be strange if Belize didn't have "offensive cyber".
- arthurcolle 6y ago
  Belize barely has stable broadband throughout most of the country, so not sure if this is a typo or some kind of inside joke? Maybe autocorrected from Britain -> Belize?
  - tptacek 6y ago
    No, I meant Belize. As in, at the costs involved, practically every country can maintain this capability.
  - andrewflnr 6y ago
    Does North Korea have stable broadband throughout? I don't think that's a requirement, except for wherever you've stashed your handful of people who do the work.
    - tptacek 6y ago
      No. Stable broadband across the country has nothing to do with whether a state can maintain an offensive "cyber" capability.
jack_riminton 6y ago
As an ex British Army officer, this sounds as if the Generals are pretty excited about a new toy to accompany their train set. How well integrated it is into their battle plans is a question to which the answer is probably; not much
- C1sc0cat 6y ago
  I think traditional military's are finding hard to recruit and also realise there cyber warriors are not going to be enlisted ranks. The sort who in ww2 would have been a cheery chappie dispatch ride from section Y, who works out a break into shark whilst jamming (with a uke) with some of Glen Millers band in the Bar of the Bear in Bedford. For non brits I am of course thinking of George Formby -
  - 082349872349872 6y ago
    For esprit de corps maybe Cyber should issue regimental robes and wizard hats? ROBES AND HATS, BY NUMBERS — ONE!
    - C1sc0cat 6y ago
      For Cyber I suspect the uniform would be more leather / mirror shades - and Gucci kit a modem remake of the FG42 And can we the dress uniform looking like Psi Core from Bab 5.
      - 082349872349872 6y ago
        Red cyber, at least according to Rossiya 1, agrees on the leather but their shades aren't mirrored. (the clip lacks the resolution to check if their eyes are Ono Sendai, Zeiss Ikon, or Progress Lomo.) https://news.ycombinator.com/item?id=24453689 https://news.ycombinator.com/item?id=24453689 (any russophones care to help us out with the lyrics?) TIL who may have been a banjolele influence on Mr. B? https://www.youtube.com/watch?v=9A2UDllfCOY https://www.youtube.com/watch?v=9A2UDllfCOY
      - 6y ago
DyslexicAtheist 6y ago
this article and a lot of the comments here seem to be unfamiliar with the basic terminology of cyber (cyberwar, cyber weapons, cyber power, cyber craft, fifth dimension, etc) and it shows. there was a great talk by grugq this month at disclosure2020 which debunks both the language in this article and some of the opinions here: https://invidious.snopyta.org/embed/_k0MkJMHPi0?start=536 https://invidious.snopyta.org/embed/_k0MkJMHPi0?start=536 there is a lot of horse manure peddled in this domain (and a lot of thought-thinkers have turned out to be spectacularly wrong). This article is so terribly wrong everywhere that it's neither worth reading nor discussing imvho.
- sandworm101 6y ago
  Whenever i hear someone talking about "cyber" a large part of my brain switches off. Im sure that some people are told they simply have to use the term, but i find real experts shy away. If i have a choice between talks on "remote exploitation analysis" or "cyberwar weapons research" ill go with the boring title every time.
  - ardy42 6y ago
    > Whenever i hear someone talking about "cyber" a large part of my brain switches off. Im sure that some people are told they simply have to use the term, but i find real experts shy away. If i have a choice between talks on "remote exploitation analysis" or "cyberwar weapons research" ill go with the boring title every time. You actually have two different sets of experts here with their own jargon: the military/political leaders and the soldier-hackers. The HN readership likely has a lot more in common with the latter than the former, but it might be a mistake to insist that all groups use the latter's jargon. Kinda like it would be a mistake to insist biologists talk in the jargon of particle physics.
- brmgb 6y ago
  The article is a lot lower on jargon that your pretty aggressive comment. It is also very light on actual content. It basically states that the UK has put in place the military organization, developed offensive capabilities relating to information systems (ergo developed exploits and recruited experts) and has used them offensively in the past. While I agree none of this is terribly interesting (everyone does this), I fail to see how it is spectacularly wrong. Would you mind explaining ?
Arubis 6y ago
What a strangely phrased headline. Putting aside the discussion of whether a nation _should_ do this, isn’t this basically a fair number of government employees’ job description? “British government employees perform their assigned tasks successfully, top general admits”
- C1sc0cat 6y ago
  Whilst also raising the profile of Cyber ahead of the defence review.
mechnesium 6y ago
What offensive cyberwar capabilities do civilians have to fight back?

64 points by elorant 6y ago

Is there any developed country that doesn't have this type of capability? Certainly all five-eyes countries have some form of capabilities. China, Russian, North Korea, Iran all regularly demonstrate they do too.

082349872349872 6y ago
The question is: who's putting effort into the far less-sexy defensive capability? compare https://news.ycombinator.com/item?id=24575935 https://news.ycombinator.com/item?id=24575935
- TheOtherHobbes 6y ago
  Defending systems against hacking tends to be far harder than hacking them, if only because you have to think of everything, and then harden it. Based on the UK's record with IT I would be far more reassured if it was working hard to defend critical civilian infrastructure than if it could take out a few servers in a remote country.
  - KineticLensman 6y ago
    > I would be far more reassured if it was working hard to defend critical civilian infrastructure NCSC has an 'exercise in a box' [0] that you can use for precisely this purpose. [0] https://www.ncsc.gov.uk/information/exercise-in-a-box https://www.ncsc.gov.uk/information/exercise-in-a-box
  - C1sc0cat 6y ago
    Both one would hope I wont say any details in public but I do remember conversations with colleagues and some people on a networking course how fragile some of the CNI is in the UK.
- arethuza 6y ago
  I thought that was going to be about the recent 'official' stories that the British Army was going to get rid of its tanks: https://www.bbc.co.uk/news/uk-53909087 https://www.bbc.co.uk/news/uk-53909087 What we can be certain of is that the Army will never willingly get rid of its horses.
  - 082349872349872 6y ago
    Wow. We somehow failed to notice that horses don't fit in foxholes, but we did eventually get rid of ours when we noticed they weren't really cut out for NBC suits. (Youtube is failing miserably for Parade Song of the Camp Animals. Kipling actually had tunes in mind for them, something none of the interpreters in my bubble seem to have noticed. For instance: https://www.youtube.com/watch?v=Av2-A-igOJk https://www.youtube.com/watch?v=Av2-A-igOJk By the brand on my shoulder, the finest of tunes Is played by the Lancers, Hussars, and Dragoons, And it's sweeter than "Stables" or "Water" to me-- The Cavalry Canter of "Bonnie Dundee"! Then feed us and break us and handle and groom, And give us good riders and plenty of room, And launch us in column of squadron and see The way of the war-horse to "Bonnie Dundee"! )
    - arethuza 6y ago
      The Army has had more horses than tanks for a while: https://www.bbc.co.uk/news/uk-scotland-highlands-islands-22951548 https://www.bbc.co.uk/news/uk-scotland-highlands-islands-229...
      - chrisseaton 6y ago
        > The British Army has not used horses in a combat role since World War I Note that this isn't true - several British Army combat units genuinely fought on horseback during WWII. https://api.parliament.uk/historic-hansard/lords/1941/aug/06/operations-in-syria#S5LV0119P0_19410806_HOL_41 https://api.parliament.uk/historic-hansard/lords/1941/aug/06... And I believe you can still do a combat horse riding course at one of the US special forces schools today. One good explanation for having so many horses is simply that a tank carries four soldiers while a horse only carries one! In reality we have one regiment minus (just two squadrons) of horse mounted cavalry, just one troop plus of horse-drawn field artillery, and a mounted band. Doesn't seem excessive.
- KineticLensman 6y ago
  > who's putting effort into the far less-sexy defensive capability? In this case, exactly the same people. The UK's defensive capability is public knowledge - here's the website of the public facing part: https://www.ncsc.gov.uk/ https://www.ncsc.gov.uk/ This article is news because its one of the few times they have spoken about the offensive side.

gonzo41 6y ago

Is this news for the Five Eyes countries? I heard earlier last year about Australian ASD working with NSA and I'd assume GCHQ in Operation Glowing Symphony, where they hacked a bunch of ISIS recruiting sites. I'd be surprised if they didn't have this to be honest. It'd be interesting to know the magnitude of the capability. Can they crash the internet? or a person's life? or a power station? And it'd also be great to know what their target acquisition time time was and ROE.

mtgx 6y ago
If you stop seeing this as "news" and start seeing it as "PR", then it makes more sense.
brodouevencode 6y ago
I had the same thought. Why would anyone be surprised? Quite honestly (because the UK way of life aligns with mine) I'm glad that they do.
vsareto 6y ago
This isn't surprising, but it seems like posturing and deception are more effective for cyberwar than conventional capabilities, and this article was probably written for that purpose.
- csilverman 6y ago
  That's what I was thinking. I'd imagine cyberwar capabilities are a lot more difficult for enemies to assess, at least in regards to conventional weapons. You can't spot them by satellite or anything; you'd have to estimate them based on knowledge of past attacks or reports from spies/informants. That strong element of uncertainty, combined with confident public statements and the knowledge of UK technical expertise in general, is probably a pretty decent deterrent, even if the abilities in question happened to be exaggerated.
  - mywittyname 6y ago
    > even if the abilities in question happened to be exaggerated. I donno. Stuxnet demonstrated how sophisticated the capabilities are of highly advanced nations, and that was around 10 years ago. At this point, I suspect that the assumption is that any computer-controlled system will be a target for cyber-espionage, and that it might not be obvious that such an attack is underway without some kind of monitoring that relies on statistical analysis of the performance deviance from some expected value. To compound the problem, the USA & China can likely obtain technical specs for just about any system produced in the world by just asking, and failing that, through corporate espionage. Which means these countries are pretty well positioned to pull off crazy hacks that wouldn't even seem possible.

SCHiM 6y ago

It was the gchq that hacked european institutions way back in 2012(?). And then Belgacom of course.

deleted 6y ago

[deleted]

bpodgursky 6y ago

It would be far more scandalous if any developed country (with an economy which depends on electronic infrastructure) wasn't investing in this capacity. Having "capacity" is like having a military... it doesn't mean you're using it, it means you understand it and can use it as a viable deterrent.

jacknews 6y ago

Don't Panic!

tptacek 6y ago

This is a weird story. At the prices involved in maintaining this capability it would be strange if Belize didn't have "offensive cyber".

arthurcolle 6y ago
Belize barely has stable broadband throughout most of the country, so not sure if this is a typo or some kind of inside joke? Maybe autocorrected from Britain -> Belize?
- tptacek 6y ago
  No, I meant Belize. As in, at the costs involved, practically every country can maintain this capability.
- andrewflnr 6y ago
  Does North Korea have stable broadband throughout? I don't think that's a requirement, except for wherever you've stashed your handful of people who do the work.
  - tptacek 6y ago
    No. Stable broadband across the country has nothing to do with whether a state can maintain an offensive "cyber" capability.

jack_riminton 6y ago

As an ex British Army officer, this sounds as if the Generals are pretty excited about a new toy to accompany their train set. How well integrated it is into their battle plans is a question to which the answer is probably; not much

C1sc0cat 6y ago
I think traditional military's are finding hard to recruit and also realise there cyber warriors are not going to be enlisted ranks. The sort who in ww2 would have been a cheery chappie dispatch ride from section Y, who works out a break into shark whilst jamming (with a uke) with some of Glen Millers band in the Bar of the Bear in Bedford. For non brits I am of course thinking of George Formby -
- 082349872349872 6y ago
  For esprit de corps maybe Cyber should issue regimental robes and wizard hats? ROBES AND HATS, BY NUMBERS — ONE!
  - C1sc0cat 6y ago
    For Cyber I suspect the uniform would be more leather / mirror shades - and Gucci kit a modem remake of the FG42 And can we the dress uniform looking like Psi Core from Bab 5.
    - 082349872349872 6y ago
      Red cyber, at least according to Rossiya 1, agrees on the leather but their shades aren't mirrored. (the clip lacks the resolution to check if their eyes are Ono Sendai, Zeiss Ikon, or Progress Lomo.) https://news.ycombinator.com/item?id=24453689 https://news.ycombinator.com/item?id=24453689 (any russophones care to help us out with the lyrics?) TIL who may have been a banjolele influence on Mr. B? https://www.youtube.com/watch?v=9A2UDllfCOY https://www.youtube.com/watch?v=9A2UDllfCOY
    - 6y ago

DyslexicAtheist 6y ago

this article and a lot of the comments here seem to be unfamiliar with the basic terminology of cyber (cyberwar, cyber weapons, cyber power, cyber craft, fifth dimension, etc) and it shows. there was a great talk by grugq this month at disclosure2020 which debunks both the language in this article and some of the opinions here: https://invidious.snopyta.org/embed/_k0MkJMHPi0?start=536 https://invidious.snopyta.org/embed/_k0MkJMHPi0?start=536 there is a lot of horse manure peddled in this domain (and a lot of thought-thinkers have turned out to be spectacularly wrong). This article is so terribly wrong everywhere that it's neither worth reading nor discussing imvho.

sandworm101 6y ago
Whenever i hear someone talking about "cyber" a large part of my brain switches off. Im sure that some people are told they simply have to use the term, but i find real experts shy away. If i have a choice between talks on "remote exploitation analysis" or "cyberwar weapons research" ill go with the boring title every time.
- ardy42 6y ago
  > Whenever i hear someone talking about "cyber" a large part of my brain switches off. Im sure that some people are told they simply have to use the term, but i find real experts shy away. If i have a choice between talks on "remote exploitation analysis" or "cyberwar weapons research" ill go with the boring title every time. You actually have two different sets of experts here with their own jargon: the military/political leaders and the soldier-hackers. The HN readership likely has a lot more in common with the latter than the former, but it might be a mistake to insist that all groups use the latter's jargon. Kinda like it would be a mistake to insist biologists talk in the jargon of particle physics.
brmgb 6y ago
The article is a lot lower on jargon that your pretty aggressive comment. It is also very light on actual content. It basically states that the UK has put in place the military organization, developed offensive capabilities relating to information systems (ergo developed exploits and recruited experts) and has used them offensively in the past. While I agree none of this is terribly interesting (everyone does this), I fail to see how it is spectacularly wrong. Would you mind explaining ?

Arubis 6y ago

What a strangely phrased headline. Putting aside the discussion of whether a nation _should_ do this, isn’t this basically a fair number of government employees’ job description? “British government employees perform their assigned tasks successfully, top general admits”

C1sc0cat 6y ago
Whilst also raising the profile of Cyber ahead of the defence review.

mechnesium 6y ago

What offensive cyberwar capabilities do civilians have to fight back?