The Rise of Politically Motivated Cyber Attacks

Actors, Attacks and Cybersecurity

Tine Munk

• Publisher: Routledge
• Year: 2022
• Print ISBN: 9780367648695
• eBook ISBN: 9781000548839
• Edition: 1
• Topic: Computer Science
• Subtopic: Human-Computer Interaction
• Index: Computer Science

This book outlines the complexity in understanding different forms of cyber attacks, the actors involved, and their motivations. It explores the key challenges in investigating and prosecuting politically motivated cyber attacks, the lack of consistency within regulatory frameworks, and the grey zone that this creates, for cybercriminals to operate within.

Connecting diverse literatures on cyberwarfare, cyberterrorism, and cyberprotests, and categorising the different actors involved – state-sponsored/supported groups, hacktivists, online protestors – this book compares the means and methods used in attacks, the various attackers, and the current strategies employed by cybersecurity agencies. It examines the current legislative framework and proposes ways in which it could be reconstructed, moving beyond the traditional and fragmented definitions used to manage offline violence.

This book is an important contribution to the study of cyber attacks within the areas of criminology, criminal justice, law, and policy. It is a compelling reading for all those engaged in cybercrime, cybersecurity, and digital forensics.

1Introduction

DOI: 10.4324/9781003126676-1

Introduction

Politically motivated cyber attacks are escalating. For years there has been an assumption that these attacks were linked to geopolitics, national states, or minor conflicts with no noticeable effect on ordinary online users or populations. Therefore, not much attention has been given to these attacks compared with personal and financial types of cybercrime. Yet, the number of attacks is rising, and it is becoming apparent that the impact of these attacks spills over to the other domains. These attacks are not just another form of cybercrime to be managed using the current cybercrime legislation. The attacks are much more complicated, involving numerous different actors, targets, and attack routes. Attacks are conducted in a borderless environment where geopolitics makes it impossible to reach international agreements to limit the attacks.

Public awareness about these attacks is rising. Currently, the attacks make headlines in mass media, placing politically motivated attacks high on the agenda. Headlines dominate tech reporting in mass media, and there is not a week without doomsday headings, such as “Barely able to keep up: America’s cyberwarriors are spread thin by attacks” (Collier, 2021); “New Ransomware Attack By Russian Hackers Highlights Cybersecurity Challenges” (Segal, 2021); “U.S. to Treat Cyber Attacks With Same Urgency as Terrorism” (Paytoncular, 2021).

This book aims to provide an understanding of the various actors, the targets, and the cybersecurity strategies developed to manage these complex areas. Chapter 1 introduces a complex area intending to create a general fundament by conceptualising the actors, cyberspace and attacks, targets, cyber strategies, and security. Finally, this chapter also provides an outline of the book’s different chapters.

Politically Motivated Actors

Politically motivated attacks are increasing rapidly where the attacks have a substantial impact. There is a growing awareness about how dangerous they can become (Kale, 2021). The different types of politically motivated actors fall under the scope of war and warfare, terrorism, or activism. However, these online actions cannot be compared with those conducted in the offline environment. Currently, there is no precise classification of these actors, and they are considered in isolation without seeing the pattern and considering the groups’ means and methods. Still, there are different levels of sophistication used in the attacks. The least intrusive, low impact attacks are easier to detect and prosecute as they are likely to be conducted by non-state actors as a part of a political protest. In contrast, there is a low probability of prosecuting the national state, state-sponsored/supported actors conducting the most sophisticated and intrusive attacks.

There has been a significant setback in diplomacy and transnational collaborations between states to develop comprehensive norms and practices for managing this area. Warmongering rhetoric is being used, which sounds like a return to the Cold War, albeit online. Actors are increasing their online capabilities and capacities and showing off their powers through actions. The United States (US) President Biden has warned that significant cyber attacks would lead to a real conventional war on the ground (Tung, 2021a). This argument is supported by the North Atlantic Treaty Organization (NATO), which has stated that the series of cyber attacks directed at Western states should be considered similar to a threat of armed attacks (Tung, 2021b). The US agencies, the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) have warned about hacking campaigns tied to the Russian military. In particular, the SolarWinds attack in 2020 demonstrated the impact of supply-chain attacks. The Russian state-sponsored group, Fancy Bear, was subsequently attributed for the attacks on Western states’ public and private entities. In particular, it has caused concerns that SolarWind targets included the US Justice, State, Energy, and Commerce Departments (Corera, 2021; Gagliordi, 2021; Whitaker, 2021). Some of the attributions of attacks have increased tension and harsh verbal exchanges between the different actors. The US, NATO, the European Union (EU), and the United Kingdom (UK) have accused China of being behind the Microsoft Exchange hack. In return, China accused the US of being behind several attacks against China (Janofsky, 2021; Vincent, 2021).

Ransomware groups have intensified their attacks on critical infrastructure (CI) and essential services with a frequency and severity that has surpassed other cybersecurity concerns. Of all the Western states, the US has experienced an unusually high number of ransomware attacks, directly impacting the public. The 2021 attacks on the Colonial Pipeline and the meat plant JBS prompted the US authorities to raise concerns about the attacks originating from Russia. This led to the Western security actors classifying ransomware attacks as a national security threat. The US took this one step further by directly linking ransomware attacks with terrorism (Barnes, 2021; Bing, 2021; Chapple, 2021; Palmer, 2021; Security, 2021).

Politically motivated cyber attacks are not only associated with state, state-sponsored, and state-supported actors. Non-state actors also use the online environment for political protests, affecting public and private entities, services, and infrastructures. In 2020–2021, hacktivists and other political activists conducted several legal and illegal attacks, which caught worldwide attention. Older, established hacktivist groups, like Anonymous, emerged from the shadows along with new groups showing that hacktivism still constitutes a threat online (Molloy & Tidy, 2020). However, new groups have emerged which are more engaged in collecting data troves in the public spare or accessing open-source codes online (Reuters, 2021; Stone, 2020). Contrary to the hacktivist groups, another breed of political actors launched innovative attacks that did not break the law, i.e. Gen Z and K-pop stans (Alexander, 2020; Lorenz et al., 2020).

Cyberspace and Attacks

The term ‘cyberspace’ was coined in 1984 by the sci-fi writer Gibson in his novel ‘Neuromancer’. Gibson describes the space as a ‘consensual hallucination’ by referring to the ability of the online space to alter the offline reality by those engaging in virtual chat rooms or virtual environments (Cavelty, 2013, p. 107; Gibson, 1984; Puyvelde & Brantly, 2019, p. 2; Shires, 2020, p. 89). Yet, the term, cyberspace, originates from cybernetics using the Greek word kybernētēs, which means rudder, pilot, a device used to steer a boat or support human governance. For example, a self-steering mechanism is applied to techniques to keep ships on the course during the night watch (Cyber Security Intelligence, 2017; Green, 2001, p. 199; Marinescu, 2017). Plato used kybernētēs to describe the governance of people (Marinescu, 2017). In a more contemporary context, the word ‘cyber’ is associated with the digital environment creating an intellectual and emotional interactional space within a technological realm (Green, 2001, p. 199).

Cyberspace is now considered a global domain that creates an information environment of independent networks of systems infrastructure, interlinking Internet telecommunication networks, computer systems, and various embedded processors and controllers (Clark, 2010, p. 1; US DoD 2016; NIST, 2020). The online space comprises an ecosystem blending network technologies and online users based on organic technological evolutions. Different technologies coexist and influence each other within the ecosystem, combined with external forces fuelled by social and technological changes. Technological innovations, computer technologies, interconnectivity, and interdependency create immediate changes to the online ecosystem. These changes are based on a fusion of all communication networks, databases, and information sources in a universal context (Cavelty, 2013, p. 108; Lapointe, 2011, pp. 2–3).

The technology used is instrumental in understanding cyberspace. The material and physical aspects, the electronics used in hardware, software, and the applications linked to the actual operative technologies are defining aspects. Equally important are the language, the interpersonal interactions, the use, and the performance (Manning, 2019, p. 291). Global connectivity is linked to various communication pathways where software is used on millions of computers controlling cyberspace’s storage devices and pathways. These computers continually sense the status of interlinked routers, which means that the online traffic does not follow a linear and direct route. Instead, the data are being routed through various global pathways to arriving at a destination only miles away in the shortest time possible (Inglis, 2016, p. 19).

Cyber Attacks

The distinction between illegal activities of states and organised crime groups is becoming blurred, and various groups are coving their activities behind a false front, making the attribution difficult. Many foreign state-sponsored groups are threatening other states’ interests. Attempts from states, state-sponsored and state-supported attacks penetrating networks for political, diplomatic, technological, commercial, and strategic advances are also a growing concern. These groups are principally targeting governments, defence, finance, energy, and telecommunication sectors. According to the UK National Cyber Security Strategy 2016–2021, the capacity and impact of these state/state-sponsored actors vary. The most technologically advanced states continue to update their capabilities and methods using encryption and anonymised services to remain covert. Other actors do not have the same abilities. However, they can archive similar impacts using basic tools and techniques because of the low level of cybersecurity imposed by the targets (HM Government,...

Table of contents

• Cover
• Half-Title Page
• Series Page
• Title Page
• Copyright Page
• Dedication
• Contents
• List of Tables
• Acknowledgements
• List of Abbreviations
• 1 Introduction
• 2 The Growing Online Threat: The Actors
• 3 Cyber Attacks, Means, and Methods
• 4 Cybersecurity and Strategies
• 5 Cyberwar and Warfare: State and State-sponsored Attacks
• 6 Cyberterrorism and Ransomware: State-supported Groups
• 7 Other Politically Motivated Attacks: Political Activists and Hacktivists
• 8 Conclusion
• Index