“The Boys Are Back In Town” Thin Lizzy

…OK, so this classic rock metaphor continues, but I seem to have an addiction (or perhaps affliction!) that won’t let me stop. The “Town” in this case, however, refers to both brick and mortar structure defined as where we physically live and hardware resides, as well as the virtual locations where we work, play, and connect; together this comprises places in which we all live on Friedman’s (2005/2007) “flat’ world. More germane to this week’s question is the nefarious activity known collectively as cyber crime, and the “Boys” (not intentionally chauvinistic, just trying to keep it simple, so “boys” in this case generically equates to both genders) who keep coming back to perpetrate these actions.

 

Cyber crime runs the gamut from individuals who use the open net to steal identities, to active phishing actions to either cause people to squander money on unnecessary items or to actively infect individual systems or networks, to “hacktivists” that are economically or politically motivated on a cause to gain information or disrupt activities, up to organization/state-sponsored actions executed to attempt disruption of institutions, even governments, or active theft of information. This wide range of activities under the over-arching descriptor of cyber crime is often also referred to in the media and government as cyber attacks. Neither is completely accurate nor completely false. How can something be labeled as “crime” where in many cases there is no law?

 

Nations have laws, there are some international agreements, but cyber is ubiquitous and doesn’t necessarily respect national borders and by extension sovereignty. In the US alone, there are innumerable bills emanating from both houses of Congress but few have passed muster to become law. Indulge me for a moment on a couple of examples-I won’t belabor this as a it’s a deep subject and perhaps one on which we can dialogue over the next weeks (months, years, decades…!).

• The US has military organizations dedicated to protection of US military network to detect and attempt to prevent intrusion, as well as identify intruders and under certain authorities take action to counter these actions. This military capability is supported, as with actions in other domains (air, land, sea, space..) by a robust intelligence community across all disciplines (signals, electronic, geo-spatial, human, etc.). If an actor infiltrates a civilian corporation that provides support or production of a military capability on an open unclassified network, and exfiltrates data for their own use, does that constitute crime? Under what statute if the actor is non-US, especially if it’s a non-state actor? This is the big debate going on in the media between the US and China for example.
• Add a layer of complexity on the issue by the physical and virtual location of each actor. Presume the actor perpetrates the intrusion from outside the US, but targets a corporate network inside the US. Even so, the point of intrusion might emanate from and internet service provider physically located on US soil. How does this affect what US actions might be appropriate, or more correctly stated legal?  Think about the Constitutional/US Code restrictions on the use of intelligence activities targeting US citizens as well as Posse Comitatus restrictions on the use of military capabilities to enforce civil law. This may be frustrating to those in authority, but balance it from the perspective of sustainment of civil liberties, First Amendment rights, and the example we claim to set for the rest of the world as a democracy. Where does the balance between individual rights and privileges versus regulation and governmental control lie?
• What’s the threshold we should set between crime and attack? If an actor is purposely creating a worm or virus to insert into a financial institution because of anger over their perception that large banks were a significant cause of the current economic issues a crime? If that network disruption spreads deeper into other financial institutions causing loss of resources or a collapse of some specific capability (your ATM card no longer works, or worse NASDAQ fails) is that crime or does that constitute an attack; or does it matter whether the actor is an American citizen, sponsored by another nation-state, or extra-national (think about Iranian activists and Lebanese Hezbollah for example)?

 

I seem to be asking a lot more questions than providing answers, but this is a complex subject. Despite 20 years of fairly common access to the internet, the governance remains as designed fairly open and therefore what constitutes crime including potential litigation a nascent and very dynamic topic. Given consensus that our world is “flat” and becoming more wired, all digital citizens-natives and immigrants-owe their voice to the conversation. May be we’ve entered a new social compact recognizing that “The Boys are Back in Town” and likely to stay, so we all must know how to act accordingly.