A Cavalcade of Paranoia

It's episode 399 of the Cyberlaw Podcast

A special reminder for fans of the Cyberlaw Podcast that we will be doing episode 400 live in audio and video and with audience participation on March 28, 2022 at noon Eastern daylight time. So, mark your calendar and when the time comes, use this link to join the audience:

https://riverside.fm/studio/the-cyberlaw-podcast-400

See you there!

There's nothing like a serious shooting war to bring out the paranoia and mistrust, and the Russian invasion of Ukraine is generating mistrust on all sides.

Everyone expected a much more damaging cyberattack from the Russians, and no one knows why it hasn't happened yet. Dave Aitel walks us through some possibilities. Cyberattacks take planning, and Russia's planners may have believed they wouldn't need to use large-scale cyberattacks—apart from what appears to be a pretty impressive bricking of the Viasat terminals used extensively by Ukrainian forces. Now that the Russians could use some additional cyber weapons in Ukraine, the pace of the war may be making it hard to build and deploy them. None of that is much comfort to the Western countries that have imposed sanctions, since their infrastructure makes a nice fat sitting-duck target, and may draw fire soon if American intelligence warnings prove true.

Meanwhile, Matthew Heiman reports, the effort to shore up cyber defenses is leading to a cavalcade of paranoia. Has the UK defense ministry banned the use of WhatsApp due to fears that it's been compromised by Russia? Maybe. But WhatsApp has long had known security limitations that might justify downgrading its use on the battlefield. Speaking of ambiguity and mistrust, Telegram use is booming in Russia, Dave Aitel says, either because the Russians know how to control it or because they can't.  Take your pick.

Speaking of mistrust, the German security agency has suddenly discovered that it can't trust Kaspersky products.  Good luck finding them, Dave offers, since many have been white-labeled into other companies' software. He has limited sympathy for the agency, which resolutely ignored U.S. warnings about Kaspersky for years.

Even when governments aren't subverting software, the war is producing products that can't be trusted. One open-source maintainer of a popular open-source tool turned it into a data wiper for anyone whose computer looks Belarussian or Russian. What could possibly go wrong with that plan?

Meanwhile, people who've advocated tougher cybersecurity regulation are doing a victory lap in the press about how it will bolster our defenses.  It'll help, I argue, but only some, and at a cost of new failures. The best example is TSA's effort to regulate pipeline cybersecurity, which has long struggled to find its feet while being critiqued by an industry that has been hostile to the whole effort from the start.

The most interesting impact of the war is in China. Jordan Schneider explores how China and Chinese companies are responding to sanctions on Russia. Jordan argues that Chinese companies will follow their economic interests and adhere to sanctions – at least where it's clear they're being watched – despite online hostility to sanctions among Chinese digerati.

Matthew and I think more attention needs to be paid to Chinese government efforts to police and intimidate overseas Chinese, including Chinese Americans, in the United States. The Justice Department for one is paying attention; it has arrested several alleged Chinese government agents engaged in such efforts.

Jordan unpacks China's new guidance on AI algorithms. I offer grudging respect to the breadth and value of the  topics covered by China's AI regulatory endeavors.

Dave and I are disappointed by a surprise package in the FY 22 omnibus appropriations act. Buried on page 2334 is an entire smorgasbord of regulation for intelligence agency employees who go looking for jobs after leaving the intelligence community.  This version is better than the original draft, but mainly for the intelligence agencies; intelligence professionals seem to have been left out in the cold when revisions were proposed.

Matthew does an update on the peanut butter sandwich spies who tried to sell nuclear sub secrets to a foreign power that the Justice Department did not name at the time of their arrest. Now that country has been revealed. It's Brazil, apparently chosen because the spies couldn't bring themselves to help an actual enemy of their country.

And finally, I float my own proposal for the nerdiest possible sanctions on Putin. He's a big fan of the old Soviet empire, so it would be fitting to finally wipe out the last traces of the Soviet Union on the internet, where the .su country code has lingered for thirty years too long in the Internet domain system.  Check WIRED magazine for my upcoming op-ed on the topic.

Download the 399th Episode (mp3)

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [e-mail]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Comments

[Longtobefree]

Everyone has overestimated the Russian capabilities.

[Orbital Mechanic]

I work in cybersecurity.

The most likely reason that Russia has not conducted cyber warfare operations against Ukraine is that they are not capable of it at this time. They did a "test run" of sorts back in 2015 and did a lot of damage and it was mostly to see what they could do. The problem for them is that it was a test run for the Ukrainian defenders as well.

The thing about cyber attack weapons is that once they appear they are very straightforward to defend against. The software gets updated and patched, the firewalls get new rules and monitoring software then knows what to look for. And above all the defending operators got their wakeup call and suddenly the institutional managers are willing to provide a decent budget.

So once you do an attack you need brand new munitions the next time around. These so-called "zero-day exploits" are not that easy to find and may go stale in less than a month. My bet is that the Russian operations have at best DDOS (Distributed Denial-Of-Service) attacks at their disposal and those do only temporary damage at best.

So I don't expect much out of the Russians here.

[AmosArch]

They have or had significant capabilities. But they probably figured knocking over Ukraine would be straight forward. And if you were going to roll a tank in. Why bother with the fancy cyber attacks? Now its too late to unleash a virus on the rubble you're shelling. There's also no point in a huge cyber attack on the west at this point either. It's not like they re going to start liking Putin if he hacks the Italian electric grid. It's too late to waste the effort to expend valuable zero days and the capabilities to do so are degrading by the hour.

[Orbital Mechanic]

Good points. However I do maintain that the key factor in a cyber security event is whether the target is complacent or not. We can speculate about whether Russia has up-to-date capability or not, but there can be little doubt that nobody of consequence in Ukraine is complacent this time around.

[Commenter_XY]

OM...May I ask two clarifying questions?

Is it the case you believe that the Russians simply do not have the 'weaponry' (i.e. zero-day exploits, etc) to carry out cyberattacks here in the US? How do you mitigate against 'Solar Wind' kinds of attacks?

My hypothesis is that we will have repeats of the Colonial Pipeline type shutdown, but at the municipal level (but not state, fed, or much private industry). And mostly because those IT departments don't keep current with patches (either by lackadaisical-ness or lack of budget). My impression is that IT staffs at the municipal level are thin, and stretched (just based on what I see in my town).

[Orbital Mechanic]

I didn't mean to imply that the Russian cyber capability and become nonexistent or completely impotent. Of course they will still be able to carry out attacks against the unwary and unprotected. (Under-protected more likely).

But as far as war efforts go, there is a big difference between taking out a city's traffic hazard reporting web site versus a major bank or a Ukraine defense system.

And one other thing that I have been wondering about. The Internet in Ukraine is much degraded from what it was. Many links cut and who knows how many hubs totally offline. That makes it hard to carry out DDOS attacks in that area.

Most likely the most potent Internet in Ukraine right now is Elon Musk's Starlink system. He has been sending thousands of terminals to them. That system will still have an attack surface but it will be much harder for Russians or anyone else to access.

[Commenter_XY]

Got it....thx for clarifying. Musk's Starlink system raises interesting possibilities regarding business continuity and redundancy. Never really thought about it until now.

[Dan Schiavetta]

No, I am not impressed by having created 400 episodes.

I can do, all by myself, 500 episodes of "Today in Supreme Court History", or even "Today in Additional Insured History", or even "Today in Star Trek TOS History", and be less hardworking, and less meretricious.