5 ms·
Researchers create humanitarian law digital emblem for the Red Cross
- blamestross 3y agoThey discovered public key certificate infrastructure and are calling it an "Emblem"
- baliex 3y agoThank you — was looking for a visual
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- gus_massa 3y agoFrom the technical point of view is like a signed robots.txt , to avoid idiots publishing a "life hack" to protect your machine from virus. (Or antivirus adding it by default to every machine.) A nice name makes it easier to explain to laymen. This idea can not work unles they convince a lot of diplomatics to sign all the paperwork. But as the sibling comment said, I also was looking for an image until I understood the implementation.
- verisimi 3y agoMy goodness, what a charade! > In other words, hacker software needs to automatically load and read the emblem, so it can recognise that it is accessing a system belonging to an organisation that is protected by international humanitarian law. And that needs to happen during the software’s first reconnaissance, before it does any damage to the system. Hackers are going to look up the emblem "protected by international humanitarian law". > Another key requirement is for the digital emblem to be managed in a decentralised way rather than by a central authority. States that are committed to international humanitarian law should be able to verify that a certain digital infrastructure on their territory is entitled to protection and therefore bears an emblem. And when they say decentralised, they mean centralised: states "should be able to verify that a certain digital infrastructure". PS Felix Linker is defining a new protocol for hackers to anonymously check whether infrastructure can be attacked... The theatre of war!
- neontomo 3y agoThe whole thing feels dreamt up by AI.
- thinkingemote 3y agoThis is aimed at nation state hackers. E.g. those who work with bosses and budgets and accountability.
- dmvdoug 3y agoIt’s merely meant to be a digital equivalent of a physical red cross/crescent on a battlefield. So if the “hackers” are members of the armed forces of a State Party to the Geneva Conventions of 1949, then… yes, they had better look up the emblem, if they don’t want to be seen as war criminals. That’s the idea at least. although, as I’ve said elsewhere in my comments on this, I think they’re going to need to propose an AP for it to have any actual legal effect.
- VBprogrammer 3y agoI should probably read the article but it sounds like a great way of announcing the that you are attacking a server.
- A1kmm 3y agoThe conference paper is the best read for details: https://dl.acm.org/doi/pdf/10.1145/3576915.3616578 https://dl.acm.org/doi/pdf/10.1145/3576915.3616578 - the security properties of the scheme are 1) supports covert inspection, 2) emblems are verifiably authentic and 3) provides accountability - identification of parties that issued fraudulent emblems. The covert inspection part is primarily through broadcast of the emblem through multiple channels (so it will go to many people interacting with the systems who didn't ask) so that the attacker will see the emblem passively without having to make a request for it that only attackers would make.
- figassis 3y agoThe nature of criminal hackers is not to care about this. If it has value (financial or ideological) they will target it. Often the point is to send a message. I’m not sure they care not to attack the red cross. Also, cybercrime is one way countries try to act in the shadows. The point is to not be discovered so they can do things that are not allowed by international law. Why could they respect this if people can only accuse them and not prove it? Even when there are mountains of evidence, they still say it wasn’t us…or simply remain quiet. Did any country come forward on the pipeline attack?
- saagarjha 3y agoWonder if the real goal is that when these people are caught you go after them for crimes against humanity and not just hacking.
- krisbolton 3y agoI presume you're correct. They're trying to create a digital equivalent of the red cross emblem and encourage others to make it the norm. It sounds unbelievable that it would be effective, but so does a white paint job and a red sticker on a vehicle.
- dmvdoug 3y agoYes, but as I said in a separate comment elsewhere on this story, the sort of interesting question is, how do they extend the legal protection to this digital emblem? I smell a draft additional protocol in the pipeline.
- dotancohen 3y agoA cynical person might even suggest that the mere existence of such emblems, which are actually ineffective at increasing digital security but rather only provide a legal framework for prosecution, would encourage false flag operations.
- sgift 3y ago
- causi 3y agoI wasn't aware there was international law pertaining to not hacking medical facilities in the same way there is law pertaining to not bombing them.
- deleted 3y ago[deleted]
- dmvdoug 3y agoThere isn’t, of course, but they are clearly laying the groundwork to extend IHL that direction. Which, as I said in a different comment, seems to me like it would require an Additional Protocol to the GCs, because it surely isn’t and won’t be customary IHL.
- morsch 3y agoIt seems completely obvious that humanitarian law also covers cyber attacks. Rule 15. In the conduct of military operations, constant care must be taken to spare the civilian population, civilians and civilian objects. All feasible precautions must be taken to avoid, and in any event to minimize, incidental loss of civilian life, injury to civilians and damage to civilian objects. Disabling a hospital by attacking its IT obviously will lead to loss of life of injury and is thus, other factors notwithstanding, not permissible. If you attack power infrastructure (using bombs or by hacking, doesn't matter), that's probably also a war crime because it's indiscriminate and, among other things, affects hospital and other civilian infrastructure. https://ihl-databases.icrc.org/en/customary-ihl/v1/rule15 https://ihl-databases.icrc.org/en/customary-ihl/v1/rule15 https://ihl-databases.icrc.org/en/customary-ihl/v1 https://ihl-databases.icrc.org/en/customary-ihl/v1
- adhesive_wombat 3y agoIt should be, but I'm not sure it is, considering the use of dedicated weapons like graphite bombs to disable 85% of the grid in the Gulf War. But maybe you have to ratify Protocol I of the Geneva Conventions for that to apply. And we'll see how well they're enforced after a ratifying country has been hammering civilian infrastructure in Ukraine.
- 3y ago
- dmvdoug 3y agoWhat’s interesting to me is that they are using the analogy with the actual red-cross like that automatically makes digital resources with the emblem entitled to protection in the same way that buildings and vehicles are. In other words, they want to suggest this is a simple extension of the meaning agreed to by States Parties to the Geneva Conventions of 1949. But it’s not a simple extension. Like, this is the sort of thing that you would need to include in an Additional Protocol in order for it to be binding, because it seems to me to represent a substantive extension of the original meaning and scope of the emblem affixed in meatspace.
- potatopatch 3y agoModern states are basically just feudal states with their private extensions, particularly on the international level and over the last 3 decades they chose over and over to let analogies hold from meat space because it maintains or expands their power relative to other elements of society. The Red cross should not look for specific legislation so that any states that are foolish enough can argue their own assumed rights away and will have to take that risk if they want to take back the right the Red cross is taking by the same analogy.
- dmvdoug 3y agoI’m not sure I understand what you’re saying in that second paragraph. Can you expand a little bit? There is no “legislation” involved here at all. These are treaties. If there’s no treaty agreement, there’s no right period (setting aside customary international humanitarian law, which I think is obviously safe to do here, because, like, none of the elements required for something to be recognized as customary are present here).
- potatopatch 3y agoA new convention functions as international legislation as far as I am concerned. The US for example did not ratify the newer convention on statelessness. Take that scenerio with the Red Cross and a new convention to treat government sponsored criminals as not allowed to attack the Red Cross. It is far less risky to act like they already have that protection and every state should punish a State that violates their existing promises under existing convention than to navigate the situation where a superpower does not ratify the new convention and claims retaliations and shaming are technically violations of their sovereignty. For a state in the current situation to deny such analogies seems paradoxical to me.. The Internet was not the wild west it was supposed to be for everyone when it comes to their own advantage, but still as dangerous as the wild west due in large part to criminals that are connected to sovereign States and largely shielded using rights to war logic.
- omeid2 3y agoOne of the major reasons humanitarian organisations are not attacked or even protected is because generally they provide benefits impartially, officially or otherwise. This makes attacking them "spitting into the well" and risk not only depriving yourself of the benefits but also earning yourself enemies from all sides. I don't believe this dynamic exists online, for one, the belligerents are often in the shadows and don't depend or rely on any "community" or locality that might be benefiting from humanitarian work. The only benefit this digital certificate might provide is prosecution grounds for harsher punishments, which isn't useless, but far from being a red cross or lion.
- paganel 3y agoAnother reason is that many humanitarian organisations get out of the conflict zone pretty fast once their handlers' real antagonists come to the fore, notice how's no Red Cross or any such presence in the Donbass, to say nothing of the many countries in the Sahel and in Central Africa which have switched sides to the Russians and the Chinese. As to why the West chooses to instrumentalise humanitarian organisations, that's another discussion.
- simbolit 3y ago>notice how's no Red Cross or any such presence in the Donbass "The Russian Red Cross (RKK), together with the Office of the United Nations High Commissioner for Refugees (UNHCR), will provide assistance to internally displaced persons in Donbass" https://www.emergency-live.com/news/the-other-side-of-the-fighting-in-donbass-unhcr-will-support-the-russian-red-cross-for-refugees-in-russia/ https://www.emergency-live.com/news/the-other-side-of-the-fi... >to say nothing of the many countries in the Sahel Red Cross in Mali: https://www.icrc.org/en/where-we-work/africa/mali https://www.icrc.org/en/where-we-work/africa/mali Red Cross in Niger: https://www.icrc.org/en/document/operational-update-niger-more-130000-people-supported-by-red-cross-one-month https://www.icrc.org/en/document/operational-update-niger-mo... Could you explain further?
- paganel 3y agoDidn’t see any Red Cross thingies close to the battle-fronts, as in, putting themselves in harms’ way in order to save lives. I’m talking about Ukraine/Russia, which is the conflict I’ve followed closer. I’m convinced the same holds true about Niger and Mali, where they most probably enjoy diplomatic neo-colonial status close to the capital. In other words, show me the Red Cross people who have lost their lives close to the lines of battle in the last 5-10-15 years and I’ll change my opinion. Otherwise, stuff like this just denotes laziness when it comes to investing in real IT security.
- amenghra 3y agoI bet the same people behind this would take https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt seriously.
- mike_d 3y agoFor more technical details, here is the actual spec: https://github.com/adem-wg/adem-spec https://github.com/adem-wg/adem-spec If you are a nation state hacker, you can also install the convenient chrome extension which will tell you if you are allowed to hack a website or not: https://chromewebstore.google.com/detail/adem-dns-checker/ikjidcfbmgnajlnngicipbbekcdflcoi https://chromewebstore.google.com/detail/adem-dns-checker/ik...
- oefrha 3y agoYes, if I’m a nation state hacker I’m totally going to install a third party Chrome extension from the Chrome Web Store.
- Muromec 3y agoAn alternative is to expose yourself to ICC and universal jurisdiction of War Crimes, I dunno, maybe you should. Or maybe not, so you can claim to be on the other side of carelessly/knowingly line. The point of this is not to make ICRC unhackable, the point is to make sure that 1) you can see you are specifically hacking protected communication 2) it's possible to prove to third party that you still continued with your war crimes business, because you either don't know better or don't care.
- RobotToaster 3y ago> An alternative is to expose yourself to ICC Unless you're American, since the US doesn't recognise the ICC.
- gwervc 3y agoOr work for Tsahal. Those "universal" jurisdictions aren't are universal they pretend to be, it's just another way to enforce power for people or nations already powerful.
- sgift 3y agoVarious states don't recognize the ICC, but that doesn't stop prosecution. What does stop prosecution is if no one transfers you to the ICC or you have a state that is willing to invade if the ICC prosecutes you. In theory, the US falls in the latter category, many others fall in the first. Nonetheless, people have been prosecuted even if their state of origin didn't recognize the ICC. Otherwise, it would be really easy for some crackpot dictator to just say his state didn't recognize the ICC under his dictatorship, so he cannot be prosecuted.
- nottorp 3y agoAfaik that organization is very protective of its brands and symbols. Are these researchers authorized to use that name?
- lmz 3y agoIf you read the article there are quotes from an ICRC representative.
- Y_Y 3y ago<< Digital Ambulance -- plz do not hack!!1 >>