Iranian Computers Targeted by new Cyberweapon

The Associated Press reported this morning that a new large scale cyberattack has hit computers in Iran.  The new program, named "Flame" apparently has the ability to take screenshots, activate a computer's microphone and webcam, and even capture data from bluetooth enabled smartphones connected to the infected computer. 

 UPDATE: More information on Flame:

• The Flame: Questions and Answers
• NPR: 'Flame' Malware Said To Be Targeting Iran: Huge Deal Or Huge Hype?

NPR: Cyber Briefings 'Scare The Bejeezus' Out Of CEOs

In NPR's continuing series on the costs of cybersecurity and who will pay for hardening the assets that control the nation's critical resources, they detail how public-private partnerships are being used to help disseminate information about the latest cyberwar capabilities to industry.

Some of the corporate systems are so vulnerable the government informed CEO's that "we can turn your computer into a brick," which scared "the bejeezus out of them." Actual quotes.


Listen to the story here.

NPR on Cybersecurity: New Bill would have Businesses Foot the Cost of Cyberwar

I was listening to a very interesting story on NPR this morning about the state of the nation when it comes to cybersecurity. One of the main points was that our national infrastructure is very vulnerable to offensive cyber operations since private companies are mainly responsible for critical infrastructure such as electricity and virtually no private companies have been spending money on keeping their systems safe from intrusion.

There are split feelings on this issue about whose responsibility it is to keep infrastructure safe. Surprisingly, it isn't the typical Democrat-Republican split.  Many former security officials from the Bush administration feel that business should be devoting their resources to meet this challenge, while business leaders quoted in the piece feel that this is the government's responsibility, not theirs - and the government should pay for hardening their systems.

Outside of a federal takeover of these critical assets (which no one wants), I personally think legislation, regulation, and incentives codified into the tax code are the only ways to force businesses to take their cyber responsibilities seriously. The threats have been present and well documented for long enough. Business leaders have had their chance to police themselves, and they have failed miserably.

Listen to the story here.

NPR: Extending the Law of War to Cyberspace

I heard an interesting story this morning on NPR regarding the international law of war and the growing debate about how cyberwar fits into the existing framework.

This report was a real eye-opener for me. Nations around the world are building up a capacity to conduct cyberwar, which can have extreme consequences in the physical world. What is the threshold of damage that a cyber operation has to cause in order for it to be considered an act of war? Another problem discussed was the concept of "proportionality," meaning under the rule of law, any use of force must be reasonable to achieve the military objectives. The United States has extensive experience with this concept in the physical world, but this sort of analysis is much harder in the cyber domain. With the high levels of connectivity between military, government, and civilian networks, any cyber operation has the potential of causing more damage than the mission planners expected.

This is a two part report, which concludes tomorrow. I'll be tuning in.

Link to Part 1 of the report.
Link to Part 2 of the report.