Canadian Security Intelligence Service (CSIS)
Information Operations
July 17, 2001
Introduction
With the advent of the personal desktop computer in 1980, the manner
in which the public and private sectors conduct business and provide services
to the public at large has changed. Over time, millions of computers and
thousands of dissimilar networks worldwide have been connected through
a global network of networks. Internet use has more than doubled annually
for the last several years to an estimated 40 million users worldwide
in nearly every country today. Connections between computer systems are
growing at an ever increasing rate with the Internet adding a new network
about every 30 minutes. According to a report by the Computer Industry
Almanac, nearly 43 percent of Canadians use the Internet, which makes
Canada the leading country for Internet use.
The growing dependence of governments, institutions, business, groups
and individuals on computer- based communications and information technologies
has resulted in a constantly changing view of what constitutes threats
in today’s “information age.” It is no longer necessary
for “hostile actors” (individuals, extremist groups, terrorist
groups, intelligence services and armed forces) to have direct physical
access to a computer to copy, destroy or manipulate data. People can use
a variety of techniques and software tools to exploit a targeted system
once they gain unauthorised access remotely via the Internet or by dialling
directly into the system using a telephone and a modem. Most legislation
and protective measures address physical attacks on critical systems and
data; however they have been, or are in the process of being, revised
and updated to deal with the new class of computer-based threats defined
as Information Operations (IO).
Information Operations
The concept of IO has its root in that of “Information Warfare”
(IW), which is the physical and computer-based operations used by military
forces to compromise the access to and viability of information received
by the decision-makers of an enemy, while at the same time protecting
their own information and information systems. The term IO is used to
denote the use of IW tools and techniques at any time. The definition
has changed over time to reflect the need for a state to maintain national
security by protecting its critical information infrastructure (CII).
The eight critical sectors in a state's infrastructure include: transportation;
oil and gas; water; emergency services; continuity of government services;
banking and finance; electrical power; and telecommunications.
IO is the outgrowth of military doctrine that focussed on the use of
electronic warfare measures to degrade the capabilities of adversaries
on the battlefield. Operations conducted during the Desert Storm campaign
indicated that technological development had provided the military with
computer- based tools and techniques that could be used to degrade not
only military systems but those of government and the private sector as
well.
Within the realm of IO, there is no safe haven and territorial boundaries
become irrelevant as IO can be conducted at any time against any sector
(public or private). All other “cyber” activity (cybercrime,
cyberterrorism, cyberwar, netspionage, hacktivism, etc.) is a subset of
IO. However, most discussions relating to the use of computer-based tools
and techniques in the context of IO have come to focus on information
assurance and the protection of computer-based systems and networks from
an intrusion or attack.
The Threat
Information Operations could be used to target national information systems
from anywhere in the world using inexpensive hardware and software. Degradation
in the operation of a targeted computer system could cause significant
social, political and economic impact that would have serious ramifications
in the area of national security. Although security measures are being
created to protect these infrastructures, the development of attack tools
to circumvent these protective measures is ongoing and these attack mechanisms
have come to be freely available via the Internet. The number of intrusions
into computer-based systems is on the rise and the tools used to exploit
existing vulnerabilities are growing in sophistication. Although
only a small number of system intrusions are reported, indications are
that the level of reported incidents and vulnerabilities is doubling roughly
every six months. In 2000, statistics released from the Computer Emergency
Response Team (CERT) at Carnegie Mellon University in Pittsburg, show
that 1,334 computer security incidents were reported world-wide in 1993,
compared to 9, 859 in 1999 and, in the first three quarters of 2000, the
incidents rose to 15,167.
The threat of unauthorised intrusions into computer systems and networks
increases proportionately to the degree of connectivity to external networks
like that of the Internet. Such connections create vulnerabilities that
can be exploited, for whatever reason, by hostile actors, using malicious
software e.g. viruses, Trojan Horses and worms via the Internet. In addition,
physical attacks like the cutting of power cables or the destruction of
hardware upon which the information infrastructure depends are the equivalent
of physical denial of service (DoS) attacks. The latter form of attack
prevents authorized users from gaining access to information systems and
data. Any of these hostile actors can attack vulnerable infrastructure
points using physical means and/or software. As a result, the growing
capability of a variety of hostile actors to make offensive use of IO,
in both its physical and nonphysical forms, has the potential to threaten
the public safety of Canadians and the national security of Canada.
This is especially true since international affairs, in all their dimensions,
will increasingly involve competition for control of information networks.
Discussions at the United Nations on the topic of the proliferation of
IO tools are couched in the rhetoric of weapons proliferation. The language
has evolved from mass destruction to include IO tools and weapons of mass
corruption. The increasing reliance of states on computer networks makes
critical infrastructures attractive targets for attack and exploitation
and many countries have embarked on programs to develop IO technologies.
According to American military and Congressional reports, Russia, China,
India and Cuba have acknowledged preparations for cyberwar and are actively
developing IO capabilities; North Korea, Libya, Iran, Iraq and Syria have
some IO capabilities. Even though many countries are developing IO capabilities,
few have the means to fully integrate various IO tools into a comprehensive
attack which would cripple a country’s infrastructure. However, some
could develop the required abilities to mount such attacks over the next
decade.
Security of Systems and Data
The development of IO tools and techniques is evolving in pace with the
rate of technological change in the communications and computer industries.
The ability to communicate and connect to networks worldwide almost instantaneously
has created both advantages and vulnerabilities.
As government departments and businesses globally have experienced both
intrusions into their networks and the loss of sensitive information,
they have attempted to install security measures to protect both systems
and data. Unfortunately, these security packages have a short life span.
Surveys and intrusion assessments conducted by private-sector security
firms and by government agencies worldwide indicate that a large number
of security packages and monitoring tools, many of which are commercially
available, are ineffective or misused. A number of surveys conducted in
the United States and the United Kingdom indicate that more than 80% of
respondents in one case did not use firewalls or any other security measures
to protect their systems and data. Up to 93% of respondents in another
case were vulnerable to rudimentary attacks even if firewalls were used.
As more and more persons, businesses and government departments become
dependent on computer-based communications and the operations of interconnected
networks, the configuration of interacting computer networks and operating
systems becomes more complex and creates vulnerabilities. Natural forces
(like storms), the natural evolution of network processes, and IO tools
could pressure these vulnerabilities and cause failures that could have
a profound affect, both short- and long-term, on the operation of government
and the private sector. For example, during the 1998 ice storm in Quebec
and eastern Ontario, the destruction of the essential electrical power
infrastructure cascaded into a disruption of key services such as water
supply, financial services, telecommunications, and transportation with
devastating effect for some Canadians.
Examples of Information Operations
Many examples of IO-related activity can be drawn from the experience
of American government departments in dealing with computer intrusions
and system exploitation. These experiences have been related in speeches
given before Senate and Congressional committees and in documents produced
by the General Accounting Office.
Extremist organizations, criminal groups and governments are acquiring
expertise in the area of IO and could threaten various systems if they
possess the proper tools and techniques to exploit vulnerabilities, and
the intent to do so. Testimony provided during committee hearings held
within government in the United States revealed the fact that an increasing
number of countries have or are developing offensive IO programs. Further,
there is data to indicate that an increasing number of extremist groups
and intelligence services are becoming proficient in the development and
/ or use of IO tools and techniques. A number of these hostile actors
may intend to use IO tools to achieve specific goals.
Recent media reports indicate that protected military networks in the
United States have been easily hacked using rudimentary tools. One American
government-sponsored exercise (Eligible Receiver) demonstrated that software
tools obtained from hacker sites on the Internet can not only degrade
the operations of government departments but can threaten the critical
infrastructure.
In April 1998, hackers belonging to the "Masters of Downloading"
(MOD), which is international in membership, claimed they had broken into
NASA and DoD classified computerized systems, having acquired the means
to gain access to these systems with impunity, and to control military
satellite and other systems. With at least two Russian members, the MOD
was considered by computer experts to be more secretive, careful and sophisticated
- and hence more dangerous - than Analyzer. The MOD threatened to sell
information about American systems to terrorist groups or foreign governments.
MOD members allegedly communicate using an elaborate system of passwords
and cover their tracks by routing messages through a variety of computer
systems all over the world. Claims made by the MOD have not been publicly
corroborated to date.
In February 2000, national infrastructures suffered degradation from
virus and distributed denial of service attacks (DDoS). The attacks, which
centred on a number of companies, each with a significant presence on
the Internet, were estimated to have caused damage in the order of billions
of dollars. The subsequent infestation of computers around the world with
the “I Love You” virus had even a more profound affect on systems
and networks. This was due in part to the fact that the phrase “I
Love You” in the subject line of an e-mail message was a simple psychological
operations ploy that enticed many individuals to open the virus-laden
e-mail attachment and infect their computer systems. The DDoS attacks
of February 2000 acted as a proof of concept to show that a number of
computers that previously had been compromised by hacker activity could
be used in concert to focus attacks on a single target or on a number
of targets.
Political tensions have resulted in hacking duels between hacker groups
and others in various countries. In 1999, there were hacking exchanges
between China and Japan over the issue of the Nanking massacre, between
China and Taiwan, and between India and Pakistan over Kashmir. In 2000,
Armenians placed false information in the Azerbaijan daily Zerkalo, and
the current tensions between Israel and Palestinians resulted in hacking
activity by the supporters of each side. This latter activity on the part
of pro-Palestinian supporters expanded to include corporations and a pro-Israel
organization in North America as targets.
Protection of the Canadian Critical Infrastructure
The Report of the Special Senate Committee on Security and Intelligence,
published in 1999, addressed the issue of the protection of Canada’s
critical infrastructure. The critical infrastructure consists of both
physical and cyber-based systems that are essential to the day-to-day
operations of the economy and government. Historically, elements of this
critical infrastructure were physically segregated. However, these elements
gradually converged, became linked and became more interdependent. Advances
in computer and communications technologies resulted in a growing level
of automation in the operation of critical systems. The report stated
that the growth of, and our increased reliance on, the critical infrastructure,
combined with its complexity, has made it a potential target for physical
or cyber-based terrorism.
In its recommendations, the Committee suggested that the government take
action to protect the critical infrastructure and to:
- develop policies and resources to deal with any attacks;
- create the capability to assess and reduce infrastructure vulnerabilities,
and to prevent or respond to physical and cyber attacks;
- create public sector-private sector partnerships to protect the critical
infrastructure; and
- ensure that the National Counterterrorism Plan regularly be reviewed
and updated, especially relating to the impact created by new and emerging
technologies that may be used by terrorists.
Similar to other countries, the Canadian government has recently announced
the creation of a new agency which is designed to protect Canada’s
electronic infrastructure against possible cyber based attacks and natural
disasters. The new agency, which is named the Office of Critical Infrastructure
Protection and Emergency Preparedness, will report to the Minister of
National Defense and will collaborate with the Solicitor General’s
department, the provinces and municipalities, private industry and other
countries.
In addition, each federal government department and agency has information
technology (IT) policies and procedures. The Communications Security Establishment
(CSE) advises the federal government on the security aspects of government
automated information systems
The Role of CSIS
The CSIS Information Operations program was initiated in 1997. As with
all CSIS investigations, this program derives its authority from the CSIS
Act. Under sections 2 (a) (b) and (c) of the Act, threats to
the security of Canada are defined as: espionage or sabotage, foreign
influence activities, or serious acts of violence against persons or property
in support of achieving a political objective. The information operations
threat may fall under any of these three sections.
The Service focuses its investigations on threats or incidents where
the integrity, confidentiality, or availability of critical information
infrastructure is affected. As a result, three conditions must appear
in order to initiate a CSIS “information operations” investigation.
That is, the incident:
a) must be a computer-based attack
b) must, within reason, appear to be orchestrated by a foreign government,
terrorist group or politically motivated extremists;
c) must be done for the purpose of espionage, sabotage, foreign influence
or politically motivated violence.
This definition excludes many of the computer intrusions occurring within
Canada. For example, most hacking activity is being done by thrill seeking
amateurs with no political agenda. Moreover, a certain amount of hacking
is conducted by criminals for monetary gain and by corporations seeking
an unfair competitive advantage over another company. These types of computer
intrusions fall outside the CSIS mandate but may be of interest to law
enforcement. The Service confines its investigation to computer intrusions
conducted with a “political motivation”. That is, whether a
hostile intelligence service is hacking into Canadian computer systems,
or an extremist group is targeting a government web site—there must
be a political aspect to the computer intrusion in order for CSIS to be
involved.
Since the threat from cyber sabotage and cyber terrorism is part of a
broader economic threat to key sectors of Canadian society, CSIS works
closely with other government departments such as the Royal Canadian Mounted
Police, the Department of National Defense and the Communications Security
Establishment.
Furthermore, within the international milieu, CSIS liaises and exchanges
information with allied agencies to remain abreast of the global threat
and how it may impact on Canada’s national security. CSIS also participates
with the federal government in broader G-8 efforts aimed at addressing
the cyber threat.
Outlook
One of the greatest challenges in countering the threat in the realm
of IO is that borders have become meaningless to anyone operating in a
virtual environment. Even if great diligence was taken in the effort to
remove vulnerabilities, it would be almost impossible to eliminate them
entirely because attack tools, networks and network control systems are
in a constant state of evolution.
As new technologies develop so too will new attack tools and mechanisms.
As a result, governments will have to set procedures in place to allow
security initiatives to evolve to deal with new threats as they arise.
For example, the risks involved with the movement of the private sector
to an e-commerce environment, the initiatives within the private sector
to provide services and system interconnection via wireless means, and
the use of personal digital assistants all present challenges from a security
perspective.
Hacking is becoming easier to a certain extent because some elements
of both the private and public sectors around the world have been more
interested in connecting to the Internet than in facilitating their operations
securely via the Internet.
National Liaison Awareness Program
CSIS maintains a national Liaison Awareness Program . The program seeks
to develop an ongoing dialogue with both public and private organizations
concerning the threat posed to Canadian interests from cyber-based attacks.
The purpose of the program is to enable CSIS to collect and analyse information
that will assist it in its investigation of these threats which could
have implications on Canada’s national security. The Service then
assesses the threat, and provides advice to government accordingly. This
program is an important vehicle used by the Service to articulate its
message to the Canadian public.
Contact
For comments/enquiries, please contact the National Coordinator, Economic
and Information Security, Canadian Security Intelligence Service (CSIS)
c/o P.O. Box 9732, Postal Station T, Ottawa, Ontario, K1G 4G4. Telephone
(613) 231-0100 or Fax (613) 842-1390.
Source: Canadian Security Intelligence Service (CSIS)
|
