PUTIN’S CYBERWAR Cyber Command Admiral Michael S. Rogers released a statement, in September 2015, describing how it would defend the US Department of Defence against cyberattacks and 62 provide support to military and contingency operations. This approach is more integrated than in other Western countries, but this is only the case within the military. Such compartmentalised thinking could lead to gaps in security, not least with regards civilian infrastructure. x Increase funding for cybersecurity education programmes. Cybersecurity is not primarily a cyber issue. As Edward Lucas has argued, “All the locksmiths in the world won’t protect 63 people who care carless with their keys.” Estimates suggest that around nine-tenths of the 140 billion emails sent daily are spam, of which around one-sixth are ‘phishing’ scams. Such attacks are a major issue if the attacker gains access to classified information, but even a breach of unclassified email systems poses major security risks. This is because all sorts of sensitive information is routinely shared in non-classified emails. In a number of the cases detailed in this report, Russia’s cyberattacks succeeded because individuals fell for such scams. Thus, widespread cybersecurity education programmes are needed. x Prepare for scenarios in which access to the Internet is limited. Cyber technology is everywhere, in civilian and military life. Growing connectivity over networks, however, leaves open the possibility that access to those networks may be limited or impaired. Take undersea fibre-optic cables, for example. More than nine-tenths of internet traffic travels through such cables, and these are dangerously bunched up in a few key points – around New York, near the Red Sea and Gulf of Aden, and at the Luzon Strait in the Philippines. Such bunching makes the cables, together with their termination points and exchange points, an obvious target for both hackers and terrorists. This suggest two things. First, civil and military contingency planning should include scenarios in which access to the Internet is limited. Second, internet infrastructure – including satellites and their bases stations, – needs at least as much defence and protection as other strategic assets. 62 Garamone, J. ‘U.S. Cyber Command Chief Details Plans to Meet Cyberspace Threats’, US Department of Defense, 8 September 2015, available at: http://www.defense.gov/News-Article-View/Article/616512/us-cyber-command-chief-details- plans-to-meet-cyberspace-threats, last visited: 9 May 2016. 63 Lucas, E. ‘We make life too easy for online fraudsters’, The Times, 7 May 2016, available at: http://www.thetimes.co.uk/article/we-make-life-too-easy- for-online-fraudsters-2bggf9rxw?acs_cjd=true, last visited: 9 May 2016. 14
Putin's Cyberwar Page 16 Page 18