[Infowarrior] - GCHQ: Cyber attacks will 'catastrophically' spook public

[Richard Forno]

Original URL: http://www.theregister.co.uk/2010/02/22/csoc_report/

Cyber attacks will 'catastrophically' spook public, warns GCHQ
Cheltenham spies 'cyber arms race'

By Chris Williams

Posted in Enterprise Security, 22nd February 2010 12:02 GMT

Exclusive A digital attack against the UK causing even minor damage  
would have a "catastrophic" effect on public confidence in the  
government, GCHQ has privately warned Whitehall.

The Cheltenham spy agency's new Cyber Security Operations Centre  
(CSOC) makes the prediction in a document prepared for Cabinet Office  
and seen by The Register.

Growing reliance on the internet to deliver public services will  
"quickly reach a point of no return", meaning "any interruption of  
broadband access becomes intolerable and will have serious impacts on  
the the economy and public well being", CSOC says.

"A successful cyber attack against public services would have a  
catastrophic impact on public confidence in the government, even if  
the actual damage caused by the attack were minimal," it adds.

The warning forms part of a preliminary "horizon scanning" report  
produced by the new unit, which is scheduled to begin operations next  
month. Its job will be to continually monitor internet security,  
producing intelligence on botnets, denial of service attacks and other  
digital threats to national security.

CSOC was established by last summer's Cyber Security Strategy. With an  
initial staff of 19 and funded from GCHQ's budget of hundreds of  
millions of pounds, it reports to the equally nascent Office of Cyber  
Security within the Cabinet Office, which coordinates digital national  
security policy across Whitehall.

Most cyber attacks are likely to remain difficult to trace to official  
sources, the report explains, citing the denial of service attacks on  
Georgia as Russia's army invaded in 2008. This year GCHQ's close US  
counterpart, the National Security Agency (NSA), has been called in to  
investigate attacks on Google's GMail service apparently from inside  
China.

"An internationally agreed definition of cyber warfare will remain  
elusive, with state actors making increasing use of hired criminals  
and 'hacktivists' to carry out deniable cyber attacks on their  
behalf," CSOC predicts.

The offical British view casts ongoing talks (http://www.nytimes.com/2009/12/13/science/13cyber.html 
) between the US and Russia - aimed at fostering cooperation between  
states on internet security and agreeing ground rules - in a  
pessimistic light.

"States are likely to increasingly see the cyber domain as an area in  
which to wage war... it is difficult to see international agreement on  
what acts are and are not acceptable in a cyber war being achieved  
within five years," CSOC says. "Even if regulation of this kind was to  
emerge, it is likely that it would make little difference.

"The increasing sophistication of criminal cyber tools and the  
availability of cheap, fast broadband will mean that states are able  
to achieve their aims by hiring criminal botnets to carry out DDOS or  
other attacks on their enemies' infrastructure."

Cyber arms race
Government eavesdroppers also face a secret "cyber arms race" to  
develop quantum cryptography technology, according to GCHQ.

"In the next 5 to 10 years, states are likely to engage in a cyber  
arms race for quantum cryptanalysis, which would enable the users to  
crack any encryption within a very short space of time, and for  
quantum cryptography, which would prevent secure communications from  
being intercepted," it said.

Quantum computers would be able to test every possible cipher for a  
traditionally-encrypted message very quickly. Meanwhile a quantum- 
encrypted message would be impossible to intercept because just by  
observing it the eavesdropper would destroy it.

GCHQ - the descendent of the UK's famous World War Two codebreaking  
effort at Bletchley Park - is responsible for intercepting foreign  
communications and for trying to ensure government communications are  
not intercepted. Without directly referring to its own work on quantum  
cryptography, it said the revolution the technology would spark in  
both areas remains out of reach.

"It is unlikely that any state actor will have been able to put  
quantum systems into operation by 2015, although some state actors may  
have basic quantum computing capabilities by 2020," CSOC says.

The NSA is said to be investing heavily in quantum computing.

The predictions in CSOC's report have served as the basis of a series  
of classified and unclassified meetings with industry and academics  
hosted by the Office of Cyber Security in recent weeks. Officials plan  
to feed the results of the meetings into policy, including whether and  
how the UK should develop offensive capabilities online. ®