National Cyber Security Framework

T IreIImInary ConsIderalIons.
On NalIonaI Cyber SecurIly

1. PRELIMINARY CUNSIDERATIUNS. UN
NATIUNAL CYBER SECURITY
Melissa l. Hathaway, Alexandei llimbuig
1.1. !NTRODUCT!ON
Whal, exaclly, is 'haliohal cybei secuiily`? Theie is lillle queslioh lhal lhe advehl of
lhe ihleihel is havihg a decisive ihluehce oh how haliohal secuiily is beihg dehhed.
Naliohs aie ihcieasihgly facihg lhe lwih lehsiohs of how lo expedile lhe ecohomic
behehls of lCT
1
ahd lhe ihleihel-based ecohomy while al lhe same lime pioleclihg
ihlelleclual piopeily, secuiihg ciilical ihfiasliucluie ahd piovidihg foi haliohal
secuiily. Mosl haliohs` elecliohic defehces have beeh puhcluied ahd lhe polehlial
cosls of lhese aclivilies aie cohsideiable. Moie lhah ohe huhdied haliohs have some
lype of goveihmehlal cybei capabilily ahd al leasl hfly of lhem have published some
foim of a cybei slialegy dehhihg whal secuiily meahs lo lheii fuluie haliohal ahd
ecohomic secuiily ihilialives.
Z
Theie cah be lillle doubl, lheiefoie, lhal couhliies
have ah uigehl heed lo addiess cybei secuiily oh a haliohal level. The queslioh is
how lhis heed is beihg foimulaled ahd addiessed.
This seclioh piovides a cohlexl foi how haliohal cybei secuiily cah be cohceived.
ll piovides ah ihlioduclioh, hol ohly lo lhe lopic ilself, bul also lo lhe Mahual as a
whole, sellihg lhe scehe foi lhe fuilhei secliohs lo exploie ih deplh. Accoidihgly,
lhis seclioh highlighls lhe bioad sel of leims ahd missiohs beihg used lo desciibe
lhe oveiall cybei ehviiohmehl. ll examihes how vaiious haliohs ihlegiale lheii
iespeclive cohcepls of haliohal secuiily ahd cybei secuiily, ahd pioposes ils owh
dehhilioh of whal haliohal cybei secuiily could ehlail. Thiee cohceplual lools aie
ihlioduced lo help focus lhe slialegic cohlexl ahd debale. These aie leimed lhe
'lhiee dimehsiohs`, lhe 'hve mahdales`, ahd lhe 'hve dilemmas` of haliohal cybei
secuiily. As lhe ieadei will discovei, each dimehsioh, mahdale ahd dilemma will
play a vaiyihg iole ih each halioh`s allempl lo foimulale ahd execule a haliohal
cybei secuiily slialegy accoidihg lo lheii specihc cohdiliohs. This seclioh, like
lhe Mahual as a whole, does hol allempl lo piesciibe a specihc sel of lasks oi a
checklisl of issues lhal heed lo be iesolved. Ralhei, il cohcehliales oh helpihg lo
foimulale a cohceplual picluie of whal 'haliohal cybei secuiily` cah ehlail.
1
lnloimation and communications technology used inteichangeably with the teim inloimation
technology` (lT).
?
}ames A. lewis and latiina Timlin, Cybeisecuiity and Cybeiwailaie. lieliminaiy Assessment ol
National Doctiine and Oiganization, (Ceneva. LNlDll, Z011), hllp.//www.uhidii.oig/pdf/ouviages/
pdf-1-9?-9045-011-}-eh.pdf.
lhlioduclioh
1.1.1. Cyber. Converging Dependencies
The ihleihel, logelhei wilh lhe ihfoimalioh commuhicaliohs lechhology (lCT) lhal
uhdeipihs il, is a ciilical haliohal iesouice foi goveihmehls, a vilal pail of haliohal
ihfiasliucluies, ahd a key diivei of socio-ecohomic giowlh ahd developmehl.
Ovei lhe lasl foily yeais, ahd especially sihce lhe yeai ?000, goveihmehls ahd
busihesses have embiaced lhe ihleihel, ahd lCT`s polehlial lo geheiale ihcome ahd
employmehl, piovide access lo busihess ahd ihfoimalioh, ehable e-leaihihg, ahd
facililale goveihmehl aclivilies. lh some couhliies lhe ihleihel cohliibules up lo 8
of gioss domeslic pioducl (CDl), ahd membei couhliies of bolh lhe luiopeah Ihioh
(lI) ahd lhe C?0 have eslablished goals lo ihciease lhe ihleihel`s cohliibulioh
lo CDl.
3
This cybei ehviiohmehl`s value ahd polehlial is huiluied by piivale ahd
public secloi ihveslmehls ih high-speed bioadbahd helwoiks ahd afoidable mobile
ihleihel access, ahd bieak-lhiough ihhovaliohs ih compulihg powei, smail powei
giids, cloud compulihg, ihdusliial aulomalioh helwoiks, ihlelligehl liahspoil
syslems, elecliohic bahkihg, ahd mobile e-commeice.
The iise of lhe ihleihel, ahd lhe ihcieasihg social depehdehce oh il, did hol occui
oveihighl. The hisl 'ihleihel` liahsmissioh occuiied ih Oclobei 1969 wilh a simple
message belweeh lwo uhiveisilies. Now, ?94 billioh e-mail aie sehl pei day. lhleihel
piolocols evolved duiihg lhe 1970s lo allow foi hle shaiihg ahd ihfoimalioh exchahge.
Now, ih ohe day, ehough ihfoimalioh is geheialed ahd cohsumed lo hll 168 millioh
DVDs. lh 1983 lheie was a successful demohslialioh of lhe Domaih Name Syslem
(DNS) lhal piovided lhe fouhdalioh foi lhe massive expahsioh, populaiisalioh ahd
commeicialisalioh of lhe ihleihel. l-commeice ahd lhe e-ecohomy weie made
possible ih 1985 wilh lhe ihlioduclioh of lop-level-domaihs (e.g., .mil, .com, .edu,
.gov) ahd lhis giowlh was fuilhei fuelled ih 1990 wilh lhe ihvehlioh of lhe woild
wide web which facililaled usei-fiiehdly ihfoimalioh shaiihg ahd seaich seivices.
Today, heaily lwo-lhiids of lhe ihleihel-usihg populalioh ieseaich pioducls ahd
busihesses ohlihe befoie ehgagihg wilh lhem ofihe, ahd mosl use seaich ehgihes
like Coogle, Baidu, Yahoo, ahd Bihg lo complele lhal ieseaich. Social helwoiks how
ieach ovei ?0 of lhe global populalioh.
4
SMS liafc geheiales S81?,000 eveiy
mihule.
5

3
David Dean et al., The Connected Woild. The Digital Manilesto. How Companies and Countiies Can
Win in the Digital lconomy,` BCC. leispectives, Z7 }anuaiy Z01Z.
4
comScoie, lt`s a Social Woild. Top 10 Need-to-lnows About Social Netwoiking and Wheie lt`s
Headed,`hllp.//www.comscoie.com/liess_lvehls/liesehlaliohs_Whilepapeis/?011/il_is_a_social_
woild_lop_10_heed-lo-khows_aboul_social_helwoikihg.
5
lTL-D, The Woild in Z010. lCT lact and liguies, (Ceneva. lTL, Z010), hllp.//www.ilu.ihl/lTI-D/icl/
maleiial/laclsliguies?010.pdf.
3 IreIImInary ConsIderalIons. On NalIonaI Cyber SecurIly
lh 1996, lhe lhleihaliohal Telecommuhicaliohs Ihioh (lTI) adopled a piolocol
lhal allowed liahsmissioh of voice commuhicalioh ovei a vaiiely of helwoiks.
This ihhovalioh gave way lo addiliohal lechhological bieaklhioughs like
videocohfeiehcihg ahd collaboialioh ovei ll helwoiks. Today, ?? millioh houis of
lelevisioh ahd movies aie walched oh Nellix ahd appioximalely 864,000 houis
of video aie uploaded lo YouTube pei day.
6
Skype has ovei 31 millioh accouhls
ahd lhe aveiage Skype cohveisalioh lasls ?7 mihules.
7
The mobile maikel has also
exploded, pehelialihg ovei 85 of lhe global populalioh. 15 of lhe populalioh use
lheii mobile phohes lo shop ohlihe ahd lheie aie how moie mobile phohes oh lhe
plahel lhah lheie aie people.
8
The ihleihel ecohomy has deliveied ecohomic giowlh al uhpiecedehled scale,
fuelled by diiecl ahd ubiquilous commuhicaliohs ihfiasliucluies ieachihg almosl
ahyohe, ahywheie. Al lhe same lime, ihfiasliucluie modeihisalioh efoils have
embiaced lhe cosl savihgs ahd efciehcy oppoiluhilies of lCT ahd lhe global ieach
of lhe ihleihel. Ovei lhe pasl decade, busihesses ieplaced oldei equipmehl wilh
cheapei, faslei, moie ubiquilous haidwaie ahd soflwaie lhal cah commuhicale wilh
lhe ihleihel. Al lhe heail of mahy of lhese ciilical ihfiasliucluies is ah ihdusliial
cohliol syslem (lCS) lhal mohilois piocesses ahd cohliols lhe low of ihfoimalioh.
lls fuhcliohalily is like lhe oh oi of fealuie of a lighl swilch. loi example, ah lCS cah
ad|usl lhe low of haluial gas lo a powei geheialioh facilily, oi lhe low of elecliicily
fiom lhe giid lo a home. Ovei lhe lasl decade, ihdusliy has ihcieased cohhecliohs
lo ahd belweeh ciilical ihfiasliucluies ahd lheii cohliol syslem helwoiks lo ieduce
cosls ahd ihciease efciehcy of syslems, somelimes al lhe expehse of iesiliehcy.
9
Today, busihesses aiouhd lhe woild lehdei seivices ahd pioducls lhiough lhe
ihleihel lo moie lhah ?.5 billioh cilizehs usihg secuie piolocols ahd elecliohic
paymehls. Seivices iahge fiom e-goveihmehl, e-bahkihg, e-heallh ahd e-leaihihg
lo hexl geheialioh powei giids, aii liafc cohliol ahd olhei essehlial seivices, all
of which depehd oh a sihgle ihfiasliucluie.
10
The ecohomic, lechhological, polilical
ahd social behehls of lhe ihleihel aie al iisk, howevei, if il is hol secuie, piolecled
ahd available. Theiefoie, lhe availabilily, ihlegiily ahd iesiliehce of lhis coie
ihfiasliucluie have emeiged as haliohal piioiilies foi all haliohs.
6
Caia liing, 100 Social Media, Mobile and lnteinet Statistics loi Z01Z (Maich),` The Social Skinny, Z1
Maich Z01Z.
7
Statistic Biain, Skype Statistics,` Statistic Biain, Z8 Maich Z01Z.
8
ldwaid Coiam-}ames and Tom Skinnei, Most Amazing lnteinet Statistics Z01Z,` lunny }unk, hllp.//
www.fuhhy|uhk.com/chahhel/sciehce/Mosl+Amazihg+lhleihel+Slalislics+?01?/umiNChz.
9
Melissa l. Hathaway, leadeiship and lesponsibility loi Cybeisecuiity,` Ceoigetown }ouinal ol
lnteinational Afaiis Special lssue (loithcoming).
10
Seivices and applications include, but aie not limited to. e-mail and text messaging, voice-ovei-ll-based
applications, stieaming video and ieal-time video-conleiencing, social netwoiking, e-goveinment,
e-banking, e-health, e-leaining, mapping, seaich capabilities, e-books, and llTV ovei the inteinet.
lhlioduclioh
ll is ahlicipaled lhal a decade fiom how, lhe ihleihel will louch 60 of lhe woild`s
populalioh (ovei 5 billioh cilizehs), will ihleilihk moie lhah 50 billioh physical
ob|ecls ahd devices, ahd will cohliibule al leasl 10 of developihg haliohs`
CDl ihcludihg Chiha, Biazil, lhdia, Nigeiia ahd lhe Russiah ledeialioh.
11
These
piedicliohs, if iealised, will ceilaihly allei polilics, ecohomics, social ihleiaclioh
ahd haliohal secuiily. How couhliies huiluie ahd piolecl lhis ihfiasliucluie will
vaiy. Haid choices ahd sublle lehsiohs will have lo be iecohciled, because lheie aie
al leasl lwo compelihg iequiiemehls uhdei cohsliaihed hscal budgels. deliveiihg
ecohomic wellbeihg ahd meelihg lhe secuiily heeds of lhe halioh.

TabIe Z. Today and lhe Near Iulure
1Z

Today Z0Z0
LsIimaIed WorId PopuIa-
Iion
7 billioh people ~8 billioh people
LsIimaIed !nIerneI Popu-
IaIion
?.5 billioh people
(35 of populalioh is ohlihe)
~5 billioh people
(60 of populalioh is ohlihe)
ToIaI Number oI Devices
1?.5 billioh ihleihel cohhecled
physical ob|ecls ahd devices
(~6 devices pei peisoh)
50 billioh ihleihel cohhecled
physical ob|ecls ahd devices
(~10 devices pei peisoh)
!CT ConIribuIion Io Ihe
Lconomy
~4 of CDl oh aveiage foi C?0
haliohs
10 of woildwide CDl (ahd pei-
haps moie foi developihg haliohs)
1.1.Z. The CosI oI ConnecIiviIy
Coveihmehls aiouhd lhe woild aie pushihg foi cilizeh access lo fasl, ieliable, ahd
afoidable commuhicaliohs lo meel lhe demahd cuive of lhe e-ecohomy. This visioh
is ielecled ih lhe Oigahisalioh foi lcohomic Co-opeialioh ahd Developmehl`s
(OlCD) lhleihel lcohomy, luiope`s Digilal Agehda, lhe Ihiled Slales` Naliohal
Bioadbahd llah, ahd ih mosl lTI ihilialives. A humbei of developihg haliohs have
giasped lhe impoilahce of lCT foi developmehl. Biazil, foi ihslahce, is ih lhe middle
of a ma|oi upgiade lo ils bioadbahd ihfiasliucluie.
13
liogiess lowaids becomihg
11
Dave lvans, The lnteinet ol Things. How the Next lvolution ol the lnteinet ls Changing lveiything,
(San }ose, CA. Cisco lnteinet Business Solutions Cioup, Z011), hllp.//www.cisco.com/web/aboul/ac79/
docs/ihhov/loT_lBSC_0411llNAl.pdf.
1?
lvans, The lnteinet ol Things. How the Next lvolution ol the lnteinet ls Changing lveiything.
13
Angelica Maii, lT`s Biazil. The National Bioadband llan itdecs.com, Z6 }uly Z011.
ah advahced membei of lhe ihfoimalioh sociely is ofleh measuied ih leims of
lowei piice-poihls, expahded bahdwidlh, ihcieased speed ahd bellei qualily of
seivice, expahded educalioh ahd developed skills, ihcieased access lo cohlehl ahd
lahguage, ahd laigeled applicaliohs foi low-ehd useis.
14
Bul is lhe lTI measuiihg
lhe iighl lhihgs? Should lhe lTI also be measuiihg lhe allehdahl ihveslmehls ih lhe
secuiily of lhal ihfiasliucluie, cohheclivily ahd ihfoimalioh seivice? loi example,
Soulh loiea was iahked lhe mosl advahced halioh ih lhe lTI`s ihfoimalioh sociely
ih leims of ils ihleihel pehelialioh, high-speed bioadbahd cohhecliohs ahd lCT
usage, yel il was also iahked by lhe lhleihel secuiily ieseaich him Team Cymiu
as 'Asia-lacihc`s leadihg hosl of peei-lo-peei bolhels.`
15
Soulh loiea is hol lhe ohly
advahced halioh lo expeiiehce lhe challehges of cohheclivily. Highly-cohhecled
couhliies aie lemplihg laigels foi ciimihals.
16
lh facl, accoidihg lo Symahlec,
lhe C?0 haliohs haiboui lhe ma|oiily of malicious code ahd ihfecled compuleis.
Amohg lhe lop lhiee couhliies aie Chiha, Ceimahy, ahd lhe Ihiled Slales, of lhose
lhiee, lhe Ihiled Slales accouhls foi lhe highesl humbei (?3) of all malicious
compulei aclivily.
17
The ihleihel is uhdei siege ahd lhe volume, velocily, vaiiely, ahd complexily of
lhe lhieals lo lhe ihleihel ahd globally cohhecled ihfiasliucluies aie sleadily
ihcieasihg. loi example, il is eslimaled lhal lhe C?0 ecohomies have losl ?.5 millioh
|obs lo couhleifeilihg ahd piiacy, ahd lhal goveihmehls ahd cohsumeis lose S1?5
billioh ahhually, ihcludihg losses ih lax ievehue.
18
Oigahisaliohs eveiywheie aie
beihg pehelialed, fiom small busihesses lo lhe woild`s laigesl ihsliluliohs. Ciimihals
have showh lhal lhey cah haihess bils ahd byles wilh piecisioh lo delivei spam,
casl phishihg allacks, facililale click-fiaud ahd lauhch disliibuled dehial of seivice
(DDoS) allacks.
19
Allack loolkils sold ih lhe uhdeigiouhd ecohomy foi as lillle as
S40 allow ciimihals lo cieale hew malwaie ahd assemble ah ehliie allack plah
14
lTL, Measuiing the lnloimation Society, (Ceneva. lTL, Z011), hllp.//www.ilu.ihl/hel/piessofce/
backgiouhdeis/geheial/pdf/5.pdf. See also Melissa l. Hathaway and }ohn l. Savage, Stewaidship
ol Cybeispace. Duties loi lnteinet Seivice liovideis, (Cambiidge, MA. Bellei Centei loi Science and
lnteinational Afaiis, Z01Z), hllp.//belfeicehlei.ksg.haivaid.edu/hles/cybeidialogue?01?_halhaway-
savage.pdf.
15
Botnet. compiomised, inteinet-connected computeis typically used loi illegal activities, usually
without the ownei`s knowledge.
16
leuteis, South loiea discoveis downside ol high speed inteinet and ieal-name postings,` The Cuaidian,
6 Decembei Z011.
17
lbid.
18
liontiei lconomics luiope, lstimating the global economic and social impacts ol counteileiting and
piiacy. A lepoit commissioned by Business Action to counteileiting and piiacy (BASCAl), (laiis.
lCCWBO, Z011), hllp.//www.iccwbo.oig/Dala/Documehls/Bascap/Clobal-lmpacls-Sludy---lull-
Repoil.
19
See Melissa l. Hathaway, lalling liey to Cybeiciime. lmplications loi Business and the lconomy,`
in Secuiing Cybeispace. A New Domain loi National Secuiity, ed. Nicholas Buins and }onathon liice
(Queenstown, MD. Aspen lnstitute, Z01Z).
lhlioduclioh
wilhoul havihg lo be a soflwaie piogiammei.
Z0
lh ?011, Symahlec idehlihed ovei
400 millioh uhique vaiiahls of malwaie lhal exposed ahd polehlially exhllialed
peisohal, cohhdehlial, ahd piopiielaiy dala.
Z1
Mahy goveihmehls sufeied dala
bieaches ih ?011, ihcludihg Auslialia, Biazil, Cahada, lhdia, liahce, New Zealahd,
Russia, Soulh loiea, Spaih, Tuikey, lhe Nelheilahds, lhe Ihiled lihgdom ahd lhe
Ihiled Slales. Huhdieds of compahies have also sufeied sighihcahl bieaches ih
?011-?01?, ihcludihg Ciligioup, e-Haimohy, lpsiloh, lihked-lh, lhe Nasdaq, Sohy
ahd Yahoo. Ohe ihdusliy iepoil eslimales lhal ovei 175 millioh iecoids weie
bieached ahd aholhei ihdusliy iepoil eslimales lhal il cosl ehleipiises I79
(S1?5.55) pei losl iecoid,
ZZ
excludihg ahy hhes lhal may have beeh imposed foi
violaliohs of haliohal dala piivacy laws.
Al lhe same lime, lhe pace of foieigh ecohomic colleclioh ahd ihdusliial espiohage
aclivilies agaihsl ma|oi coipoialiohs ahd goveihmehls is also acceleialihg. The
hypei-cohheclivily ahd ielalive ahohymily piovided by lCT loweis lhe iisk of
beihg caughl ahd makes espiohage sliaighlfoiwaid ahd alliaclive lo cohducl. lh
iecehl leslimohy befoie lhe Ihiled Slales Cohgiess, lhe Assislahl Diiecloi of lhe
Couhleiihlelligehce Divisioh of lhe lBl lold lawmakeis lhal lhe lBl is 'ihvesligalihg
ecohomic espiohage cases iespohsible foi S13 billioh ih losses lo lhe IS ecohomy.`
Z3

Some of lhe cases iefeiehced ihclude lhe laigelihg, pehelialioh, ahd compiomisihg
of compahies lhal pioduce secuiily pioducls. lh pailiculai, ceilihcale aulhoiilies
ihcludihg Comodo, DigiNolai, ahd RSA, fell piey lo lheii owh weak secuiily
posluies, which weie subsequehlly exploiled facililalihg a wave of olhei compulei
bieaches.
Z4
Digilal ceilihcales iepiesehl a secohd foim of idehlily lo help ehhahce
'liusl` foi hhahcial oi olhei piivale ihleihel liahsacliohs by cohhimihg lhal
somelhihg oi someohe is gehuihe.
Z5
These ceilihcales have become lhe de lacto
ciedehlials used foi secuie ohlihe commuhicaliohs ahd sehsilive liahsacliohs,
such as ohlihe bahkihg oi accessihg coipoiale e-mail fiom a home compulei.
?0
Symantec Coipoiation, lnteinet Secuiity Thieat lepoit. Z011 Tiends, (Mountain View, CA. Symantec
Coipoiation, Z01Z), hllp.//www.symahlec.com/lhiealiepoil.
?1
lbid., 9.
??
Veiizon, Z01Z Data Bieach lnvestigations lepoit, (Ailington, VA. Veiizon Business, Z01Z), hllp.//
www.veiizohbusihess.com/iesouices/iepoils/ip_dala-bieach-ihvesligaliohs-iepoil-?01?_eh_xg.pdf,
lonemon lnstitute, Z010 Annual Study. L.l. Cost ol a Data Bieach. Compliance piessuies, cybei
attacks taigeting sensitive data diive leading lT oiganisations to sometimes pay moie than necessaiy,
(Mountain View, CA. Symantec Coipoiation, Z011), hllp.//www.symahlec.com/cohlehl/eh/us/aboul/
media/pdfs/Il_lohemoh_CODB_?010_031611.pdf?om_exl_cid=biz_socmed_lwillei_facebook_
maikelwiie_lihkedih_?011Mai_woildwide_coslofdalabieach.
?3
L.S. House ol lepiesentatives, Testimony. Beloie the Subcommittee on Counteiteiioiism and
lntelligence, Committee on Homeland Secuiity, House ol lepiesentatives. Committee on Homeland
Secuiity, Z8 }une Z01Z.
?4
Hathaway, leadeiship and lesponsibility loi Cybeisecuiity.`
?5
Ceitihcate Authoiities issue secuie socket layei (SSl) ceitihcates that help enciypt and authenticate
websites and othei online seivices.
Duiihg oial leslimohy befoie lhe IS Sehale Aimed Seivices Commillee, IS
Aimy Ceheial leilh Alexahdei idehlihed Chiha as lhe piime suspecl behihd lhe
RSA pehelialioh ahd subsequehl lhefl of ihlelleclual piopeily.
Z6
leihaps lhe IS
Naliohal Couhlei-lhlelligehce lxeculive pul il besl wheh he iepoiled lhal, '[m|ahy
slales view ecohomic espiohage as ah essehlial lool ih achievihg haliohal secuiily
ahd ecohomic piospeiily. Theii ecohomic espiohage piogiams combihe colleclioh
of opeh souice ihfoimalioh, HIMlNT, sighals ihlelligehce (SlClNT), ahd cybei
opeialiohs - lo ihclude compulei helwoik ihliusiohs ahd exploilalioh of ihsidei
access lo coipoiale ahd piopiielaiy helwoiks - lo develop ihfoimalioh lhal could
give lhese slales a compelilive edge ovei lhe Ihiled Slales ahd olhei iivals.`
Z7
lihally, uhaulhoiised access, mahipulalioh of dala ahd helwoiks, ahd desliuclioh
of ciilical iesouices also lhiealehs lhe ihlegiily ahd iesiliehce of ciilical coie
ihfiasliucluies. The piolifeialioh ahd ieplicalioh of woims like Sluxhel, llame, ahd
Duqu lhal cah peheliale ahd eslablish cohliol ovei iemole syslems is alaimihg.
lh ah Apiil ?01? hewslellei, lhe lhdusliial Cohliol Syslem Compulei lmeigehcy
Readihess Team (lCS-ClRT) disclosed lhal il was ihvesligalihg allempled ihliusiohs
ihlo whal il desciibed as 'mulliple haluial gas pipelihe secloi oigahisaliohs.` ll
wehl oh lo say lhal lhe ahalysis of lhe malwaie ahd ailefacls associaled wilh lhis
aclivily was ielaled lo a sihgle campaigh wilh lhe ihilial pehelialioh, iesullihg
fiom speai-phishihg mulliple peisohhel.
Z8
While lhe Sluxhel allack agaihsl liah
was quile sophislicaled, il does hol hecessaiily iequiie a sliohg ihdusliial base oi
a well-hhahced opeialioh lo hhd lCS vulheiabililies - leehageis iegulaily aie able
lo accomplish lhe lask.
Z9
Those molivaled lo do haim seek soflwaie vulheiabililies
- efeclively eiiois ih exislihg soflwaie code - ahd cieale malwaie lo exploil lhem,
subsequehlly compiomisihg lhe ihlegiily, availabilily ahd cohhdehlialily of lhe lCT
helwoiks ahd syslems.
30
Some ieseaicheis huhl foi lhese 'zeio-day` vulheiabililies
oh behalf of goveihmehls, olheis oh behalf of ciimihal syhdicales, bul mahy 'while
hal` ieseaicheis cohslahlly do lhe same |ob foi lillle oi ho pay. To ehcouiage
lhe 'while hal` secuiily commuhily lo efeclively hhd holes ih lheii commeicial
?6
L.S. Senate Committee on Aimed Seivices, Statement ol Ceneial leith B. Alexandei, Commandei Lnited
States Cybei Command, Z7 Maich Z01Z.
?7
L.S. Ofce ol the National Counteiintelligence lxecutive, loieign Spies Stealing LS lconomic Seciets in
Cybeispace. lepoit to Congiess on loieign lconomic Collection and lndustiial lspionage, Z009-Z011,
(Washington, DC. LS Ofce ol the National Counteiintelligence lxecutive, Z011), hllp.//www.hcix.gov/
publicaliohs/iepoils/fecie_all/loieigh_lcohomic_Colleclioh_?011.pdf.
?8
lCS-CllT, lCS-CllT Monthly Monitoi, (Washington, DC. LS Depaitment ol Homeland Secuiity, Z01Z),
hllp.//www.us-ceil.gov/cohliol_syssupialems/pdf/lCS-ClRT_Mohlhly_Mohiloi_Api?01?.pdf.
?9
lobeit O`Haiiow, Cybei seaich engine Shodan exposes industiial contiol systems to new iisks,` The
Washington lost, 3 }une Z01Z.
30
Hathaway, leadeiship and lesponsibility loi Cybeisecuiity.`
Cybei Teims ahd Dehhiliohs
pioducls befoie ciimihals oi cybei waiiiois do, compahies like Coogle, lacebook,
ahd Miciosofl have piogiammes lhal pay foi iespohsibly disclosed vulheiabililies.
31
The above examples illusliale lhal lhe ihleihel ahd ils associaled global helwoiks
have gieally ihcieased lhe woild`s depehdehce oh lCT ahd lhus also ihcieased lhe
level of disiuplioh lhal is possible wheh lhe ihfiasliucluie is uhdei allack. Ahd il is
cohslahlly uhdei allack, bolh by slale ahd hoh-slale aclois. Allhough lhe pioblem
is obvious, lhe iole of goveihmehl vis-a-vis lhe piivale secloi ih lhe pioleclioh
of lhis ciilical ihfiasliucluie is ofleh slill uhcleai. This lack of claiily ahd visioh
iegaidihg goveihmehl aclioh is hol lolally uhsuipiisihg, howevei. To dale, lheie
is hol eveh a uhiveisal uhdeislahdihg oh basic cybei leims ahd dehhiliohs, so
commoh soluliohs will iemaih scaice.
1.Z. CY8LR TLRMS AND DLI!N!T!ONS
The ihleihel, lhe lCT lhal uhdeipih il ahd lhe helwoiks lhal il cohhecls aie al limes
also iefeiied lo as compiisihg 'cybeispace`. Meiiiam-Webslei dehhes 'cybei` as.
'of, ielalihg lo, oi ihvolvihg compuleis oi compulei helwoiks (as lhe lhleihel).`
3Z

Cybeispace is moie lhah lhe ihleihel, ihcludihg hol ohly haidwaie, soflwaie ahd
ihfoimalioh syslems, bul also people ahd social ihleiaclioh wilhih lhese helwoiks.
The lTI uses lhe leim lo desciibe lhe 'syslems ahd seivices cohhecled eilhei diieclly
lo oi ihdiieclly lo lhe ihleihel, lelecommuhicaliohs ahd compulei helwoiks.`
33

The lhleihaliohal Oigahisalioh foi Slahdaidisalioh (lSO) uses a slighlly difeiehl
leim, dehhihg cybei as 'lhe complex ehviiohmehl iesullihg fiom lhe ihleiaclioh of
people, soflwaie ahd seivices oh lhe ihleihel by meahs of lechhology devices ahd
helwoiks cohhecled lo il, which does hol exisl ih ahy physical foim.`
34
Sepaialely,
goveihmehls aie dehhihg whal lhey meah by cybeispace ih lheii haliohal cybei
secuiily slialegies (NCSS). loi example, ih ils ?009 slialegy papei, lhe Ihiled
lihgdom iefeis lo cybeispace as 'all foims of helwoiked, digilal aclivilies, lhis
ihcludes lhe cohlehl of ahd acliohs cohducled lhiough digilal helwoiks.`
35
By
addihg lhe phiase, 'lhe cohlehl of ahd acliohs cohducled lhiough,` lhe goveihmehl
31
Chiis lodiiguez, Vulneiability Bounty Hunteis,` liost & Sullivan, 3 lebiuaiy Z01Z.
3?
Cybei, Meiiiam-Webstei, hllp.//www.meiiiam-webslei.com/dicliohaiy/cybei.
33
lTL, lTL National Cybeisecuiity Stiategy Cuide, (Ceneva. lTL, Z011), hllp.//www.ilu.ihl/lTI-D/cyb/
cybeisecuiily/docs/lTINaliohalCybeisecuiilySlialegyCuide.pdf. 5.
34
lSO/llC Z703Z.Z01Z, lnloimation technology - Secuiity techniques - Cuidelines loi cybeisecuiity.`
35
Ll Cabinet Ofce, Cybei Secuiity Stiategy ol the Lnited lingdom. Salety, secuiity and iesilience in
cybei space (Noiwich. The Stationeiy Ofce, Z009). 7. Howevei, in Z011 a new dehnition ol cybeispace
was put loiwaid undeistood as an inteiactive domain made up ol digital netwoiks that is used to stoie,
modily and communicate inloimation. lt includes the inteinet, but also the othei inloimation systems
that suppoit oui businesses, inliastiuctuie and seivices (see Ll Cabinet Ofce, The Ll Cybei Secuiity
Stiategy. liotecting and piomoting the Ll in a digital woild (london. Ll Cabinet Ofce, Z011).).
cah also addiess humah behaviouis lhal il hhds acceplable oi ob|ecliohable. loi
some haliohs, lhis ihcludes cohsideialioh of ihleihel cehsoiship, ohlihe ihfoimalioh
cohliol, fieedom of speech ahd expiessioh, iespecl foi piopeily, pioleclioh of
ihdividual piivacy, ahd lhe pioleclioh fiom ciime, espiohage, leiioiism, ahd
waifaie. Coveihmehls, busihesses, ahd cilizehs khow ihluilively lhal cybeispace is
mah-made ahd ah evei-expahdihg ehviiohmehl, ahd lhal lheiefoie lhe dehhiliohs
aie also cohslahlly chahgihg.
1.Z.1. !nIormaIion, !CT, and Cyber SecuriIy
Mosl goveihmehls slail lheii NCSS piocess by desciibihg lhe impoilahce of
'secuiihg ihfoimalioh`, implemehlihg 'compulei secuiily` oi ailiculalihg lhe heed
foi 'ihfoimalioh assuiahce`. These leims aie ofleh used ihleichahgeably, ahd
cohlaih commoh coie lehels of pioleclihg ahd pieseivihg lhe cohhdehlialily,
ihlegiily ahd availabilily of ihfoimalioh. 'lhfoimalioh secuiily` focuses oh
dala iegaidless of lhe foim lhe dala may lake. elecliohic, piihl oi olhei foims.
'Compulei secuiily` usually seeks lo ehsuie lhe availabilily ahd coiiecl opeialioh of
a compulei syslem wilhoul cohceih foi lhe ihfoimalioh sloied oi piocessed by lhe
compulei. 'lhfoimalioh assuiahce` is a supeisel of ihfoimalioh secuiily, ahd deals
wilh lhe uhdeilyihg piihciples of assessihg whal ihfoimalioh should be piolecled.
lfeclively, all lhiee leims aie ofleh used ihleichahgeably, eveh if lhey addiess
slighlly difeiehl viewpoihls. Mosl uhaulhoiised acliohs lhal impacl ahy of lhe coie
lehels oi ihfoimalioh secuiily alliibules
36
aie cohsideied a ciime ih mosl haliohs.
The globalisalioh of lhe lCT maikelplace ahd ihcieasihg ieliahce upoh globally
souiced lCT pioducls ahd seivices cah expose syslems ahd helwoiks lo exploilalioh
lhiough couhleifeil, malicious oi uhliuslwoilhy lCT. Ahd while hol dehhed ih
diplomalic foia, lhe leim 'lCT secuiily` is ofleh used lo desciibe lhis cohceih.
lh geheial, lCT secuiily is moie diieclly associaled wilh lhe lechhical oiigihs
of compulei secuiily, ahd is diieclly ielaled lo 'ihfoimalioh secuiily piihciples`
ihcludihg lhe cohhdehlialily, ihlegiily ahd availabilily of ihfoimalioh iesidehl oh a
pailiculai compulei syslem.
37
lCT secuiily, lheiefoie, exlehds beyohd devices lhal
aie cohhecled lo lhe ihleihel lo ihclude compulei syslems lhal aie hol cohhecled
lo ahy ihleihel. Al lhe same lime, lhe use of lhe leim 'lCT secuiily` usually excludes
all quesliohs of illegal cohlehl, uhless lhey diieclly damage lhe syslem ih queslioh,
ahd ihcludes lhe leim 'supply chaih secuiily`.
36
The most basic attiibutes aie Conhdentiality, lntegiity and Availability, and aie known as the C-l-A
tiiad. Some systems expand this by including authenticity, ieliability, oi any numbei ol othei attiibutes
as well.
37
See, loi instance, LS DoC/NlST, Minimum Secuiity lequiiements loi ledeial lnloimation and
lnloimation Systems, (Caitheisbuig, MD. NlST, Z006), hllp.//csic.hisl.gov/publicaliohs/hps/hps?00/
lllS-?00-hhal-maich.pdf.
T0 Cybei Teims ahd Dehhiliohs
Iigure 1. ReIalIonshIp belween Cyber SecurIly and olher SecurIly DomaIns
38
This liguie has been adopted liom lSO/llC Z703Z.Z01Z, lnloimation technology - Secuiity
techniques - Cuidelines loi cybeisecuiity.` lt slightly difeis liom the oiiginal in that it contains lCT
Secuiity instead ol Application Secuiity`. The lattei has been dehned as a piocess to apply contiols
and measuiements to an oiganization`s applications in oidei to manage the iisk ol using them. Contiols
and measuiements may be applied to the application itsell (its piocesses, components, soltwaie and
iesults), to its data (conhguiation data, usei data, oiganization data), and to all technology piocesses
and actois involved in the application`s lile ciicle` (ibid., 10.). lnloimation Secuiity is conceined
with the piotection ol conhdentiality, integiity, and availability ol inloimation in geneial, to seive
the needs ol the applicable inloimation usei` (ibid.). Netwoik Secuiity is conceined with the design,
implementation, and opeiation ol netwoiks loi achieving the puiposes ol inloimation secuiity on
netwoiks within oiganizations, between oiganizations, and between oiganizations and useis` (ibid.).
lnteinet Secuiity is conceined with piotecting inteinet-ielated seivices and ielated lCT systems and
netwoiks as an extension ol netwoik secuiity in oiganizations and at home, to achieve the puipose ol
secuiity. lnteinet Secuiity also ensuies the availability and ieliability ol lnteinet seivices` (ibid., 11.).
Clll is conceined with piotecting the systems that aie piovided oi opeiated by ciitical inliastiuctuie
piovideis, such as eneigy, telecommunication, and watei depaitments. Clll ensuies that those systems
and netwoiks aie piotected and iesilient against inloimation secuiity iisks, netwoik secuiity iisks,
inteinet secuiity iisks, as well as Cybeisecuiity iisks` (ibid.). Cybeiciime has been dehned as the
ciiminal activity wheie seivices oi applications in the Cybeispace aie used loi oi aie the taiget ol a
ciime, oi wheie the Cybeispace is the souice, tool, taiget, oi place ol a ciime` (ibid., 4.). Cybeisalety has
been dehned as the condition ol being piotected against physical, social, spiiitual, hnancial, political,
emotional, occupational, psychological, educational oi othei types oi consequences ol lailuie, damage
eiioi, accidents, haim oi any othei event in the Cybeispace which could be consideied non-desiiable`
(ibid.). Cybeisecuiity`, oi Cybeispace Secuiity` has been dehned as the pieseivation ol conhdentiality,
integiity and availability ol inloimation in the Cybeispace` (ibid.). Howevei, it has also been noted that
|i|n addition, othei piopeities such as authenticity, accountability, non-iepudiation and ieliability can
also be involved` (ibid.) in cybei secuiity.
TT IreIImInary ConsIderalIons. On NalIonaI Cyber SecurIly
The Ihiled Slales, lhdia, Russia ahd mahy olhei couhliies aie ihcieasihgly voicihg
cohceihs lhal lhe ihlioduclioh of couhleifeil, malicious oi uhliuslwoilhy lCT could
disiupl lhe peifoimahce of sehsilive haliohal secuiily syslems, ahd compiomise
essehlial goveihmehl seivices. The lCT supply chaih cohsisls of mahy phases,
ihcludihg desigh, mahufacluie, ihlegiale, disliibule, ihslall ahd opeiale, maihlaih
ahd decommissioh. The piocesses by which haliohs cohsidei lhe secuiily of lheii
lCT supply chaih should liy lo addiess each phase of lhe lifecycle. lioleclioh
measuies musl be developed acioss lhe pioducl lifecycle ahd be ieihfoiced lhiough
bolh acquisilioh piocesses ahd efeclive implemehlalioh of goveihmehl/ehleipiise
secuiily piaclices. loi example, lhe highesl iisk faclois ih lhe supply chaih aie
'aflei build` (e.g., duiihg lhe ihslall ahd opeiale ahd ieliie phases) because lhis
is wheie mulliple vehdois pailicipale ih lhe piocess (e.g., ihlegiale pioducls wilh
olhei syslems, palch/updale, elc.) ahd lheie aie few measuies lo mohiloi ahd assuie
ihlegiily lhioughoul lhe ehliie piocess. This is a pioblem foi all couhliies. lhe
evolulioh of lhe lCT ihdusliy meahs lhal mahy couhliies ahd global coipoialiohs
how play a iole ih lhe lCT supply chaih, ahd ho couhliy cah souice all compohehls
fiom lolally 'liusled piovideis`. This liusl is heeded, howevei, as lhe piomise of
lCT-diiveh ecohomic giowlh is depehdehl upoh lhe coie ihfiasliucluie beihg bolh
secuie ahd iesiliehl.
Theie is ho agieed dehhilioh of 'ihleihel secuiily`. Wilhih a lechhical cohlexl,
ihleihel secuiily 'is cohceihed wilh pioleclihg ihleihel-ielaled seivices ahd ielaled
lCT syslems ahd helwoiks as ah exlehsioh of helwoik secuiily ih oigahizaliohs
ahd al home, lo achieve lhe puipose of secuiily. lhleihel secuiily also ehsuies
lhe availabilily ahd ieliabilily of ihleihel seivices.`
39
Howevei, ih a polilical
cohlexl, ihleihel secuiily is ofleh equaled wilh whal is also khowh as 'ihleihel
safely`. lh geheial, ihleihel safely iefeis lo 'legal ihleihel cohlehl`. While lhis has
somelimes beeh lihked lo goveihmehl cehsoiship ih aulocialic goveihmehls,
iesliicliohs oh ihleihel cohlehl aie, ih facl, commoh. Besides issues suiiouhdihg
lhe exploilalioh of childieh, ihleihel cehsoiship cah also ihclude issues such as
ihlelleclual piopeily iighls as well as lhe pioseculioh of polilical oi ieligious views.
Whal ihleihel secuiily piobably does hol ihclude is hoh-ihleihel ielevahl lechhical
issues, ihcludihg lhose lhal addiess lhe vaiious 'ihleihels` which aie hol cohhecled
lo lhe woild wide web. These, howevei, aie coveied by lhe leim 'helwoik secuiily`.
Nelwoik secuiily is pailiculaily impoilahl foi ciilical ihfiasliucluies lhal aie ofleh
hol diieclly cohhecled lo lhe ihleihel. Cohsequehlly, foi some, ihleihel secuiily
implies a global goveihmehl iegime lo deal wilh lhe slabilily of lhe ihleihel code
ahd haidwaie, as well as lhe agieemehls oh lhe pioseculioh of illegal cohlehl.
lSO/llC Z703Z.Z01Z, lnloimation technology - Secuiity techniques - Cuidelines loi cybeisecuiity,` 11.
The leim 'cybei secuiily` was widely adopled duiihg lhe yeai ?000 wilh lhe
'cleah-up` of lhe millehhium soflwaie bug.
40
Wheh lhe leim 'cybei secuiily` is
used, il usually exlehds beyohd ihfoimalioh secuiily ahd lCT secuiily. lSO dehhed
cybei secuiily as lhe 'pieseivalioh of cohhdehlialily, ihlegiily ahd availabilily of
ihfoimalioh ih lhe Cybeispace.`
41
The Nelheilahds dehhed cybei secuiily moie
bioadly, lo meah 'fieedom fiom dahgei oi damage due lo lhe disiuplioh, bieakdowh,
oi misuse of lCT. The dahgei oi damage iesullihg fiom disiuplioh, bieakdowh oi
misuse may cohsisl of limilaliohs lo lhe availabilily oi ieliabilily of lCT, bieaches of
lhe cohhdehlialily of ihfoimalioh sloied oh lCT media, oi damage lo lhe ihlegiily
of lhal ihfoimalioh.`
4Z
The lTI also dehhed cybei secuiily bioadly as.
'[T|he colleclioh of lools, policies, secuiily cohcepls, secuiily safeguaids,
guidelihes, iisk mahagemehl appioaches, acliohs, liaihihg, besl piaclices,
assuiahce ahd lechhologies lhal cah be used lo piolecl lhe cybei ehviiohmehl
ahd oigahizalioh ahd usei`s assels. Oigahizalioh ahd usei`s assels ihclude
cohhecled compulihg devices, peisohhel, ihfiasliucluie, applicaliohs, seivices,
lelecommuhicaliohs syslems, ahd lhe lolalily of liahsmilled ahd/oi sloied
ihfoimalioh ih lhe cybei ehviiohmehl. Cybeisecuiily sliives lo ehsuie lhe
allaihmehl ahd maihlehahce of lhe secuiily piopeilies of lhe oigahizalioh
ahd usei`s assels agaihsl ielevahl secuiily iisks ih lhe cybei ehviiohmehl. The
geheial secuiily ob|eclives compiise lhe followihg. availabilily, ihlegiily, which
may ihclude aulhehlicily ahd hoh-iepudialioh, ahd cohhdehlialily.`
43
Mahy couhliies aie dehhihg whal lhey meah by cybei secuiily ih lheii iespeclive
haliohal slialegy documehls. As of lhe publicalioh of lhis Mahual, moie lhah 50
haliohs have published some foim of a cybei slialegy dehhihg whal secuiily meahs
lo lheii fuluie haliohal ahd ecohomic secuiily ihilialives.
Wheh lhe leim 'defehce` is paiied wilh 'cybei` il usually is wilhih a mililaiy cohlexl,
bul also may lake ihlo accouhl ciimihal oi espiohage cohsideialiohs. loi example,
lhe Noilh Allahlic Tiealy Oigahisalioh (NATO) uses al leasl lwo leims wheh il
comes lo cybei defehce ahd ihfoimalioh secuiily. The hisl addiesses a bioadei
ihfoimalioh secuiily ehviiohmehl. commuhicaliohs ahd ihfoimalioh syslems
44

The millennium bug was a pioblem loi both digital (computei-ielated) and non-digital documentation
and data stoiage situations which iesulted liom the piactice ol abbieviating a loui-digit yeai to two
digits.
lSO/llC Z703Z.Z01Z, lnloimation technology - Secuiity techniques - Cuidelines loi cybeisecuiity.`
Dutch Ministiy ol Secuiity and }ustice, The National Cybei Secuiity Stiategy (NCSS). Stiength thiough
Coopeiation,` (The Hague. National Cooidinatoi loi Counteiteiioiism and Secuiity, Z011), 4.
lecommendation lTL-T X.1Z05 (04/Z008), Section 3.Z.5.
ClS secuiity is dehned as. The ability to adequately piotect the conhdentiality, integiity, and availability
ol Communication and lnloimation Systems (ClS) and the inloimation piocessed, stoied oi tiansmitted.
T3 IreIImInary ConsIderalIons. On NalIonaI Cyber SecurIly
(ClS) secuiily, wheie 'secuiily` is dehhed as lhe abilily lo adequalely piolecl lhe
cohhdehlialily, ihlegiily ahd availabilily of ClS ahd lhe ihfoimalioh piocessed,
sloied oi liahsmilled.
45
NATO uses a difeiehl dehhilioh foi lhe leim 'cybei
defehce`. 'lhe abilily lo safeguaid lhe deliveiy ahd mahagemehl of seivices ih ah
opeialiohal ClS ih iespohse lo polehlial ahd immihehl as well as aclual malicious
acliohs lhal oiigihale ih cybeispace.`
46
The Ihiled Slales mililaiy dehhes il ih
lwo cohlexls as well. The hisl, fiom lhe }oihl Slaf, dehhes 'compulei helwoik
defehce` (CND) as. 'acliohs lakeh lo piolecl, mohiloi, ahalyze, delecl, ahd iespohd
lo uhaulhoiized aclivily wilhih lhe Depailmehl of Defehse ihfoimalioh syslems
ahd compulei helwoiks.`
47
lihally, lhe hewly foimed Ihiled Slales Cybei Commahd
opeialiohalised lhe leim ahd dehhes 'defehsive cybei opeialiohs` as. 'diiecl ahd
syhchiohize acliohs lo delecl, ahalyse, couhlei ahd miligale cybei lhieals ahd
vulheiabililies, lo oulmahoeuvie adveisaiies lakihg oi aboul lo lake ofehsive
acliohs, ahd lo olheiwise piolecl ciilical missiohs lhal ehable IS fieedom of aclioh
ih cybeispace.`
48
The commoh lheme fiom all of lhese vaiyihg dehhiliohs, howevei, is lhal cybei
secuiily is fuhdamehlal lo bolh pioleclihg goveihmehl seciels ahd ehablihg
haliohal defehce, ih addilioh lo pioleclihg lhe ciilical ihfiasliucluies lhal peimeale
ahd diive lhe ?1
st
cehluiy global ecohomy. The slighl difeiehlialioh ih dehhilioh
belweeh goveihmehls ahd ihleigoveihmehl oigahisaliohs is iiielevahl, as lheii
shaied focus oh lhe issues illusliales lhe hisl slep ih lhe lohg |ouihey lo aclually
piovidihg foi cybei secuiily - ho mallei whal lhe dehhilioh.
1.Z.Z. Cyber Crime
Theie does hol appeai lo be a commoh view iegaidihg whal cohslilules illegal oi
illicil aclivily oh lhe ihleihel. Yel mosl would agiee lhal ohe of lhe faslesl-giowihg
aieas of ciime is lhal which is lakihg place ih cybeispace.
49
lfoils lo claiify ahd
addiess lhis issue begah ih lhe Ihiled Naliohs (IN) ih 1990, wheie lhe Ceheial
Assembly (IN CA) debaled ahd adopled a iesolulioh dealihg wilh compulei ciime
legislalioh which was lalei expahded ih ?000 ahd agaih ih ?00? lo combal lhe
45
Ceii Hallingstad and luc Danduiand, Cybei Delence Capability liamewoik - levision Z. leleience
Document lD-3060 (The Hague. NATO C3 Agency, Z010).
46
lbid.
47
LS }oint Chiels ol Staf, }oint lublication 6-0. }oint Communications System, (lt. Belvoii, VA. DTlC,
Z010), hllp.//www.dlic.mil/docliihe/hew_pubs/|p6_0.pdf.
48
CAO, Delense Depaitment Cybei lfoits. Moie Detailed Cuidance Needed to lnsuie Militaiy Seivices
Develop Appiopiiate Cybeispace Capabilities, (Washington, DC. CAO, Z011), hllp.//www.gao.gov/
pioducls/CAO-11-4?1. 5.
49
luiopol, Thieat Assessment (Abiidged). lnteinet lacilitated Oiganised Ciime (iOCTA), (The Hague.
luiopol, Z011), hllps.//www.euiopol.euiopa.eu/siles/defaull/hles/publicaliohs/iocla.pdf.
ciimihal misuse of lCT.
50
As a iesull, lhese eaily discussiohs ehcouiaged couhliies
lo updale lheii pehal codes. loi example, ih 1997, lhe Russiah goveihmehl updaled
lhe Russiah lehal Code (Chaplei ?8) lo addiess cybei ciime, lT ciime, ahd cybei
leiioiism. lehallies weie idehlihed foi, amohg olhei lhihgs, illegal access lo lhe
ihfoimalioh oh a compulei, compulei syslems ahd helwoiks, ciealioh, spieadihg
ahd usage of haimful soflwaie ahd malwaie, violalioh of opeialioh ihsliucliohs
of a compulei, compulei syslems ahd helwoiks, illegal ciiculalioh of ob|ecls of
ihlelleclual piopeily, illegal ciiculalioh of iadio-elecliohic ahd special high-lech
devices, ahd mahufacluiihg ahd spieadihg of child poihogiaphy.
Also ih 1997, lhe felohies of 'illegal ihliusioh ihlo a compulei ihfoimalioh syslem`
ahd 'causihg damage lo a compulei ihfoimalioh syslem` weie specihcally added lo
lhe Ciimihal law of lhe leople`s Republic of Chiha. lh }uhe ?010, lhe lhfoimalioh
Ofce of lhe Slale Couhcil published a while papei oh lhe ihleihel ih Chiha. ll delailed
Chiha`s piihciples foi lhe ihleihel ahd idehlihed pailiculai aclivilies lhal weie
ob|ecliohable lo lhe slale. loi example, il slaled. 'lhe secuiily of lelecommuhicaliohs
helwoiks ahd ihfoimalioh shall be piolecled by law. No oigahizalioh oi ihdividual
may ulilise lelecommuhicalioh helwoiks lo ehgage ih aclivilies lhal |eopaidise
slale secuiily, lhe public ihleiesl oi lhe legilimale iighls ahd ihleiesls of olhei
people.`
51
lh addilioh lo Chiha ahd Russia, mahy olhei couhliies also have updaled
lheii legal fiamewoiks lo addiess ciimihal aclivilies ih accoidahce wilh lhe spiiil
of lhe discussioh lhal begah heaily ?5 yeais ago.
The Couhcil of luiope (Col) also adopled a Cohvehlioh oh Cybeiciime ih }uly ?004,
5Z

lhe hisl ihleihaliohal cohvehlioh lo addiess lhis issue. ll cohlaihs a ielalively high
slahdaid of ihleihaliohal coopeialioh foi ihvesligalihg ahd pioseculihg cybei ciime.
ll iecoghised lhal ciimihals exploil lhe seams of cioss-|uiisdicliohal coopeialioh
ahd cooidihalioh amohg haliohs. The liealy dehhed key leims such as 'compulei
syslem`, 'compulei dala`, 'liafc dala`, ahd 'seivice piovidei` ih ah efoil lo cieale
commohalily amohg sighaloiies` exislihg slalules, bul does hol dehhe lhe key leim
'cybeiciime`. The liealy wehl oh lo highlighl acliohs lhal haliohs musl uhdeilake
lo pievehl, ihvesligale ahd piosecule, ihcludihg copyiighl ihfiihgemehl, compulei-
ielaled fiaud, child poihogiaphy ahd violaliohs of helwoik secuiily. loi example, il
oullihed ofehces agaihsl lhe cohhdehlialily, ihlegiily ahd availabilily of compulei
dala ahd syslems (e.g., illegal access, illegal ihleiceplioh, dala ihleifeiehce, syslem
ihleifeiehce, misuse of devices). ll also discussed compulei-ielaled fiaud ahd
foigeiy. The liealy also cohlaihed a seiies of poweis ahd pioceduies, such as lhe
Maico Ceicke, legional and lnteinational Tiends in lnloimation Society lssues,` in HllCAl - Woiking
Cioup 1 (St. lucia. lTL, Z010).
Chinese lnloimation Ofce ol the State Council, The lnteinet in China (White lapei) (Bei|ing.
Coveinment ol the leople`s lepublic ol China, Z010).
Council ol luiope, Convention on Cybeiciime (lTS No. 185) (Budapest. Council ol luiope, Z001).
seaich of compulei helwoiks ahd ihleiceplioh. Ovei leh yeais aflei lhe liealy
was foimed, il has beeh sighed by 47 slales, ahd has beeh ialihed by 37.
53, 54
This
is cohlioveisial ih some haliohs, ahd mighl explaih lhe ielalively small humbei
of couhliies lhal have mahaged lo appiove lhe liealy ih accoidahce wilh lheii
domeslic cohsliluliohal iequiiemehls ahd lheieby makihg il ehfoiceable.
Olhei oigahisaliohs have lakeh similai appioaches, wilhih lheii owh fiamewoiks.
lh }uly ?006, lhe ASlAN Regiohal loium (ARl) issued a slalemehl lhal ils
membeis should implemehl cybei ciime ahd cybei secuiily laws 'ih accoidahce
wilh lheii haliohal cohdiliohs ahd should collaboiale ih addiessihg ciimihal
ahd leiioiisl misuse of lhe lhleihel.`
55
These commilmehls weie lalei codihed
ih lhe ?009 agieemehl wilhih lhe Shahghai Coopeialioh Oigahizalioh (ASlAN-
Chiha liamewoik Agieemehl) oh ihfoimalioh secuiily. Addiliohally, il is lhe ohly
ihleihaliohal liealy lhal addiesses cohceihs of a widei cohcepl of 'ihfoimalioh
wai`, which lhe liealy dehhed as 'cohfiohlalioh belweeh lwo oi moie slales
ih lhe ihfoimalioh space aimed al damagihg ihfoimalioh syslems, piocesses
ahd iesouices, ahd uhdeimihihg polilical, ecohomic ahd social syslems, mass
biaihwashihg lo deslabilise sociely ahd slale, as well as foicihg lhe slale lo lake
decisiohs ih lhe ihleiesl of ah opposihg paily.`
56
lllicil ahd illegal aclivily dehhiliohs difei fiom iegioh lo iegioh. Ohlihe fiaud, ohlihe
lhefl ahd olhei foims of cybei ciimes which misappiopiiale lhe piopeily of olheis
aie oh lhe iise. ll is ihexpehsive lo develop ahd use malwaie, as was obseived ih
?011 wilh lhe 400 millioh uhique vaiiahls ahd as mahy as eighl hew zeio-day
vulheiabililies weie exploiled pei day.
57
As cilizehs adopl ahd embed moie mobile
devices ihlo lheii busihess ahd peisohal lives, il is likely lhal malwaie aulhois will
cieale mobile specihc malwaie geaied lowaid lhe uhique oppoiluhilies lhal lhe
mobile ehviiohmehl piesehls foi abuse of elecliohic liahsacliohs ahd paymehls.
Naliohs aiouhd lhe woild have idehlihed cybei ciime (howevei il is dehhed) as
a haliohal piioiily. They also iecoghise lhal |uiisdiclioh foi pioseculihg cybei
ciime slops al haliohal boideis, which uhdeiscoies lhe heed foi coopeialioh ahd
cooidihalioh lhiough iegiohal oigahisaliohs like ASlAN ahd lhe Couhcil of luiope.
53
Biian Hailey, A Clobal Convention on Cybeiciime?,` Science and Technology law leview, Z3 Maich
Z010.
54
Council ol luiope, Convention on Cybeiciime (Tieaty Status),` hllp.//cohvehliohs.coe.ihl/Tiealy/
Commuh/CheicheSig.asp?NT=185&CM=8&Dl=&Cl=lNC.
55
Cieg Austin, China`s Cybeisecuiity and lie-emptive Cybei Wai,` Newluiope, 14 Maich Z011.
56
See Shanghai Coopeiation Oiganization, Agieement on Coopeiation in the lield ol lnsuiing
lnteinational lnloimation Secuiity |based on unofcial tianslation| (Yekateiinbuig. Shanghai
Coopeiation Oiganization, Z009). Annex l, Nils Melzei, Cybei opeiations and |us in bello,` Disaimament
loium, no. 4 (Z011).
57
Symantec Coipoiation, lnteinet Secuiity Thieat lepoit. Z011 Tiends. See also Hathaway, lalling liey
to Cybeiciime. lmplications loi Business and the lconomy.`
1.Z.3. Cyber Lspionage
Cybeispace piovides ah excepliohal ehviiohmehl foi espiohage because il piovides
'foieigh colleclois wilh ielalive ahohymily, facililales lhe liahsfei of a vasl amouhl
of ihfoimalioh, ahd makes il moie difcull foi viclims ahd goveihmehls lo assigh
blame by maskihg geogiaphic localiohs.`
58
While some haliohs dehhe lhese
ihliusiohs oi uhaulhoiised access lo dala oi ah aulomaled ihfoimalioh syslem as
ah 'allack,` mosl of lhe obseived aclivily loday does hol qualify as ah allack uhdei
ihleihaliohal law. ll is cohsideied lo be lhefl of commeicial ihlelleclual piopeily
ahd piopiielaiy ihfoimalioh, of dala wilh sighihcahl ecohomic value, oi lhe lhefl
of goveihmehl sehsilive ahd classihed ihfoimalioh. These giveh cohsideialiohs aie
dehhed by almosl all haliohs as ciimihal acls hisl, ahd espiohage secohd. This
is also a simple hecessily. wilh lhe iise of piesumed slale-spohsoied ihdusliial
espiohage, il is veiy ofleh uhcleai if ah aclivily lhal foi ceilaih cah be calegoiised
as cybei ciime should ihslead be desciibed as cybei espiohage.
lspiohage is dehhed as, 'lhe piaclice of spyihg oi usihg spies lo oblaih ihfoimalioh
aboul lhe plahs ahd aclivilies especially of a foieigh goveihmehl oi a compelihg
compahy.`
59
lh lhis cohlexl, espiohage is wheh foieigh goveihmehls oi ciimihal
helwoiks sleal ihfoimalioh oi couhleifeil goods ih ways lhal eiode lhe public`s
liusl ih ihleihel seivices. ll is peivasive lhioughoul lhe woild, lhe humbei of
busihesses fallihg viclim lo lhese ciimes ihcieases daily ahd ho secloi is wilhoul
compiomise. Compahies ahd goveihmehls iegulaily face allempls by olheis
lo gaih uhaulhoiised access lhiough lhe ihleihel lo lheii dala ahd ihfoimalioh
lechhology syslems by, foi example, masqueiadihg as aulhoiised useis oi lhiough
lhe suiieplilious ihlioduclioh of malicious soflwaie.
60
Some dehhe lhis aclivily
as Compulei Nelwoik lxploilalioh (CNl). ehablihg opeialiohs ahd ihlelligehce
colleclioh capabililies lhiough lhe use of compulei helwoiks lo galhei dala fiom
laigel oi adveisaiy aulomaled ihfoimalioh syslems oi helwoiks.
61
ll is impoilahl lo
hole lhal CNl is ofleh ah ehablihg pieiequisile foi disiuplive oi damagihg aclivilies
oh ah ihfoimalioh syslem (see below).
Howevei il is dehhed, cybei espiohage, pailiculaily wheh laigelihg commeicial
ihlelleclual piopeily, iisks, ovei lime, uhdeimihihg a haliohal ecohomy. Mahy
couhliies use espiohage lo spui iapid ecohomic giowlh based oh advahced
lechhology, laigelihg sciehce ahd lechhology ihilialives of olhei haliohs. Because
58
LS Ofce ol the National Counteiintelligence lxecutive, loieign Spies Stealing LS lconomic Seciets in
Cybeispace. lepoit to Congiess on loieign lconomic Collection and lndustiial lspionage, Z009-Z011.
59
lspionage, Meiiiam-Webstei, hllp.//www.meiiiam-webslei.com/dicliohaiy/espiohage.
60
See Hathaway, lalling liey to Cybeiciime. lmplications loi Business and the lconomy.`
61
L.S. }oint Chiels ol Staf, }oint lublication 3-13. lnloimation Opeiations, (lt. Belvoii, VA. DTlC, Z006),
hllp.//www.dlic.mil/docliihe/hew_pubs/|p3_13.pdf.
lCT foims lhe backbohe of heaily eveiy olhei lechhology used ih bolh civiliah ahd
mililaiy applicaliohs loday, il has become ohe of lhe piimaiy espiohage laigels.
Of couise, mililaiy ahd civiliah dual-use lechhologies will iemaih of ihleiesl lo
foieigh colleclois, especially advahced mahufacluiihg lechhologies lhal cah boosl
ihdusliial compelilivehess.
1.Z.4. 'Cyber WarIare'
The leim 'cybei waifaie` is bolh ambiguous ahd cohlioveisial - lheie is ho ofcial
oi geheially accepled dehhilioh. While lhe leim ilself is viilually hevei used ih
ofcial documehls, ils ielalives - 'lhfoimalioh Opeialiohs` (lhfo Ops oi also lO) ahd
'lhfoimalioh Waifaie` (lW) - aie commohly used, albeil wilh difeiehl meahihgs.
Moie lhah 30 couhliies have ah ailiculaled docliihe ahd have ahhouhced dedicaled
ofehsive cybei waifaie piogiammes, moslly usihg lO oi lW as leimihology.
6Z

Nohelheless, lhe leim 'cybei wai` has a useful academic puipose, ih leims lhal
il cohcehliales lhihkihg oh slale lo slale cohlicl wilhih ahd lhiough cybeispace,
ahd lhe iamihcaliohs lhis cah have. Accoidihgly, cybei waifaie has become ah
uhavoidable elemehl ih ahy discussioh of ihleihaliohal secuiily. loi example,
Russia discusses ihfoimalioh waifaie melhods as a meahs lo 'allack ah adveisaiy`s
cehlies of giavily ahd ciilical vulheiabililies,` ahd goes oh lo slale lhal by doihg so,
'il is possible lo wih agaihsl ah oppohehl, mililaiily as well as polilically, al a low
cosl wilhoul hecessaiily occupyihg lhe leiiiloiy of lhe ehemy.`
63, 64
This docliihe
is a syhlhesis of lhe ofcial posilioh of slale policy foi maihlaihihg ihfoimalioh
secuiily. likewise, Chiha also discusses ihfoimalioh waifaie ih deplh, ahd lhe heed
lo cohducl ofehsive opeialiohs exploilihg lhe vulheiabililies ahd depehdehce of
haliohs oh lCT ahd lhe ihleihel ih a iecehlly published book.
65
Chiha cohlihues
6?
lewis and Timlin, Cybeisecuiity and Cybeiwailaie. lieliminaiy Assessment ol National Doctiine and
Oiganization.
63
loland Heickeio, lmeiging Cybei Thieats and lussian Views on lnloimation Wailaie and lnloimation
Opeiations, (Stockholm. Swedish Delence leseaich Agency Z010), hllp.//www.highseclabs.com/
Coipoiale/foii?970.pdf. 18.
64
Alexandei llimbuig and Heli Tiimaa-llaai, Cybeisecuiity and Cybeipowei. Concepts, Conditions and
Capabilities loi Coopeiation loi Action within the lL, (Biussels. luiopean lailiament, Z011), hllp.//
www.oiip.ac.al/hleadmih/Ihleilageh/Daleieh/lublikalioheh/ll_Sludy_llNAl.pdf.
65
loi a iecent non-state Chinese account see Hunan leople`s lublishing House, China Cybei Wailaie. We
Can`t lose the Cybei Wai (Hunan. China South lublishing & Media Cioup).
lo evolve ils mililaiy slialegy ahd docliihe foi cohduclihg ihfoimalioh waifaie
campaighs ahd lakihg advahlage of lhe 'ihfoimaliohisalioh`
66
of sociely.
Of couise wheh haliohs begih lo discuss cybei waifaie, lhey heed lo claiify whal
lhey meah by cybei allack.
67
Ceimahy dehhes a cybei allack as ah lT allack ih
cybeispace diiecled agaihsl ohe oi seveial olhei lT syslems ahd aimed al damagihg
lT secuiily - cohhdehlialily, ihlegiily ahd availabilily - which may all oi ihdividually
be compiomised.
68
The Ihiled lihgdom oullihed foui difeiehl melhods of cybei
allack ih ils haliohal cybei slialegy. elecliohic allack, subveisioh of supply chaih,
mahipulalioh of iadio speclium, disiuplioh of uhpiolecled elecliohics usihg high
powei iadio fiequehcy.
69
The Ihiled Slales dehhes Compulei Nelwoik Allack (CNA)
as 'acliohs lakeh lhiough lhe use of compulei helwoiks lo disiupl, dehy, degiade,
oi deslioy ihfoimalioh iesidehl ih compuleis ahd compulei helwoiks, oi lhe
compuleis ahd helwoiks lhemselves`.
70
The difeiehce belweeh lhe IS ahd Ceimah
dehhilioh of cybei allack is ah illuslialive ohe. lhe IS dehhilioh does hol ihclude
allacks oh cohhdehlialily (e.g., lhiough a 'piobe` oi espiohage) as a cybei allack
while, accoidihg lo lhe Ceimah dehhilioh, lheie is ho difeiehce belweeh a piobe
ahd a cybei allack. The leim lakes oh difeiehl meahihgs lo meel lhe secuiily iemil
of difeiehl commuhilies. loi example, il is haluial foi lhe mililaiy lo be ambiguous
as lo whelhei ah allack is cohsideied a use of foice (as dehhed by lhe law of Aimed
Cohlicl), wheieas lhe law ehfoicemehl commuhily (police ahd pioseculois) aie
moie likely lo desciibe ah allack as a ciime. lhcidehl iespohse piofessiohal ahd
lechhical expeils will likely use lhe leim lo geheiically chaiacleiise ahy malicious
allempl agaihsl cohhdehlialily oi availabilily. A sihgle dehhilioh will hol help lhis,
bul claiily aboul which meahihg of 'allack` is meahl ih a pailiculai cohlexl cah help
ieduce cohfusioh.
lh geheial, lheie is agieemehl lhal cybei aclivilies cah be a legilimale mililaiy
aclivily, bul lheie is ho global agieemehl oh lhe iules lhal should apply lo il. This
is fuilhei complicaled by lhe ambiguous ielaliohship belweeh cybei wai ahd cybei
China has is piomoting inloimationisation development loi economic iestiuctuiing, inliastiuctuie

modeinisation, and national secuiity. lt is similai to the Digital Agenda ol luiope, in that it is piomoting
all the means to acceleiate the piocess liom the industiy society to the inloimation society. lt contains
seven aieas ol emphasis. (1) lCT and lCT industiies (manulactuie, seivice), (Z) lCT applications (e-gov,
e-commeice), (3) lnloimation lesouices (Content), (4) lnloimation lnliastiuctuie (Netwoik), (5)
lnloimation Secuiity, (6) Talents (all kinds), (7) laws, legulations, Standaids, and Specihcations (see
Xiaolan Zhao, liactice and Stiategy ol lnloimatization in China,` (Shanghai. LlAN, Z006).).
See Section 3.1.3 loi a moie detailed examination ol cybei attack classihcations.
Ceiman ledeial Ministiy ol the lnteiioi, Cybei Secuiity Stiategy loi Ceimany (Beilin. Beaultiagtei dei
Bundesiegieiung lui lnloimationstechnik, Z011). 14-5.
Ll Cabinet Ofce, The Ll Cybei Secuiity Stiategy. liotecting and piomoting the Ll in a digital woild.
13-4.
L.S. }oint Chiels ol Staf, }oint lublication 3-13. lnloimation Opeiations.

espiohage - lheie is a veiy hhe lihe belweeh bieakihg ihlo a compulei lo spy ahd
bieakihg ih lo allack.
71
Naliohs aie cohceihed lhal ihfiasliucluie disiuplioh could
ihlicl sighihcahl ecohomic cosls oh lhe public ahd piivale seclois ahd impaii
peifoimahce of essehlial seivices. This is why some haliohs aie demahdihg a
dialogue iegaidihg whal cohslilules a legilimale laigel ih cybeispace, code of
cohducl foi slewaidship ahd cohlicl, ahd lhe heed foi cohhdehce buildihg measuies
lo ieduce lhe iisk of uhwahled oi uhhecessaiy miscalculalioh ahd subsequehl
escalalioh of cohlicl ahd misuhdeislahdihg.
loi example, Chiha, Russia, Ta|ikislah ahd Izbekislah ihlioduced ah lhleihaliohal
Code of Cohducl foi lhfoimalioh Secuiily foi cohsideialioh by lhe 66
th
IN Ceheial
Assembly.
7Z
This documehl was ihlehded lo |umpslail discussioh oh wide-iahgihg
appioaches foi dealihg wilh appiopiiale behaviouis ih cybeispace. This specihc
pioposal ahd lhe oveiall cohcepl of a 'code of cohducl`, will likely be iaised al a
humbei of upcomihg ihleihaliohal foia dealihg wilh cybei secuiily ahd ihleihel
policy malleis.
To dale, il appeais lhal lhe Ihiled Slales ahd a humbei of luiopeah couhliies
oppose lhe holioh lhal a code of cohducl oi liealy is heeded lo addiess cybei
waifaie. They aigue lhal lhe pioposed obligaliohs seem lo be ih cohlicl wilh
exislihg ihleihaliohal law buill aiouhd cohcepls such as iefiaihihg fiom lhe 'lhieal
oi use of foice` (Ailicle ?(4) of lhe IN Chailei) ahd lhe iighl lo exeicise 'self-defehce
if ah aimed allack occuis` (Ailicle 51 of lhe IN Chailei). Moieovei, il is uhcleai how
a pioposed code`s cohcepls of 'hoslile aclivilies` ahd 'lhieals lo ihleihaliohal peace
ahd secuiily` ielale lo lhe 'lhieal oi use of foice` slahdaid ih Ailicle ?(4), oi whelhei
lhe pioposed code would cohsliaih lhe ihheiehl iighl lo self-defehce iecoghised
ih Ailicle 51. Olhei haliohs aie lakihg lhe ihilialive lo diive debale ahd iesolulioh
iegaidihg whal is heeded, giveh lhe ecohomic ahd haliohal secuiily cohsequehces
of whal is al slake. These efoils have lakeh oh a hew lempo ahd seiioushess giveh
lhe use of Sluxhel agaihsl liah`s hucleai ihfiasliucluie. loi example, lhe Ihiled
lihgdom hosled a cohfeiehce oh hoims of behavioui ih lohdoh ih ?011 lo help
foslei ah ihleihaliohal dialogue, ahd il is expecled lhal lhis discussioh will cohlihue
ih Huhgaiy ahd Soulh loiea ih lhe comihg yeais.
}ames lewis, Conhdence-building and inteinational agieement in cybeisecuiity,` Disaimament loium,

no. 4 (Z011). 56.
See LNCA, lettei dated 1Z Septembei Z011 liom the leimanent lepiesentatives ol China, the lussian
ledeiation, Ta|ikistan and Lzbekistan to the Lnited Nations addiessed to the Secietaiy-Ceneial
(A/66/359) (New Yoik. Lnited Nations, Z011).
Naliohal Cybei Secuiily
1.3. NAT!ONAL CY8LR SLCUR!TY
Theie is ho uhiveisally accepled explicil dehhilioh of whal cohslilules 'haliohal
cybei secuiily` (oi NCS foi shoil). lhdeed, allhough lhe exacl leim is haidly evei
used ih ofcial slialegies, il is commohly employed by goveihmehl spokespeisohs
wilhoul evei beihg dehhed. NCS has lwo obvious iools. lhe leim 'cybei secuiily` ahd
lhe leim 'haliohal secuiily` - bolh of which aie ofleh difeiehlly dehhed ih ofcial
haliohal documehls. lveh if lhe leim 'haliohal cybei secuiily` is seldom explicilly
dehhed, il is possible lo deiive a woikihg dehhilioh based oh lhe iespeclive use of
lhe olhei lwo leims.
1.3.1. Comparison oI 'NaIionaI' and 'Cyber' SecuriIy
Wheh ahalysihg lhe use of lhe leims 'cybei secuiily` ahd 'haliohal secuiily`
ih ofcial documehls, il is hisl ahd foiemosl hecessaiy lo accepl lhal haliohal
difeiehces (lo say holhihg of lihguislic difeiehces) will ofleh pievehl a diiecl ahd
lileial compaiisoh. As discussed above, lhe leim 'cybei secuiily` does hol have
a sihgle accepled commoh dehhilioh, ahd lhis is especially lhe case wheh used
wilhih public policy documehls. Also, lhe leim 'haliohal secuiily` is hol always
dehhed eveh wilhih a specihc haliohal cohlexl - ah ofleh ihlehliohal move aimed lo
piovide goveihmehl wilh heeded lexibilily.
73
Ihlil ielalively iecehlly, lhe leim 'haliohal secuiily` was laigely used ohly wilhih
lhe Ihiled Slales. The widespiead ihlioduclioh of dedicaled 'haliohal secuiily
slialegies` (NSS) ih a humbei of OlCD couhliies is a ielalively iecehl phehomehoh
lhal appeais lo have beeh closely lied lo a shifl ih slialegic lhoughl away fiom
focusihg oh a few specihc 'lhieals` lo lhe idea agaihsl of miligalioh agaihsl myiiad
'iisks`. Thus, foi example, ih heaily all of lhe posl-?007 slialegies, cybei secuiily is
dehhed as a key haliohal secuiily issue. lhdeed, ih some cases, lhe lopic of 'cybei
secuiily` (oi eveh 'haliohal cybei secuiily`) piedales lhe aclual ciealioh of lhe
haliohal secuiily slialegy, ahd somelimes eveh seems lo fuhclioh as a diivei foi lhe
paiadigm shifl lo a moie compiehehsive haliohal secuiily slialegy, ohe ih which
lhe slale hol ohly iecoghises lhal vaiious iisks heed lo be addiessed, bul lhal lhey
ohly cah be addiessed by woikihg logelhei wilh hoh-slale aclois.
73
loi example, the Ll Secuiity Seivice (also known as Ml5) states that. The teim national secuiity` is
not specihcally dehned by Ll oi luiopean law. lt has been the policy ol successive Coveinments and
the piactice ol lailiament not to dehne the teim, in oidei to ietain the lexibility necessaiy to ensuie
that the use ol the teim can adapt to changing ciicumstances` (Ll Secuiity Seivice (Ml5), liotecting
National Secuiity,` hllps.//www.mi5.gov.uk/home/aboul-us/whal-we-do/pioleclihg-haliohal-secuiily.
hlml.).
?T IreIImInary ConsIderalIons. On NalIonaI Cyber SecurIly
Wheh lookihg al specihc couhliies, lhis paiadigm shifl becomes faiily cleai. Auslialia,
foi ihslahce, published ils liisl Naliohal Secuiily Slalemehl lo ils lailiamehl ih
?008,
74
which was pul ih place as pail of a lohg-leim iefoim agehda lo eslablish a
suslaihable haliohal secuiily policy fiamewoik. Wheh lhe Auslialiah goveihmehl
ieleased ils Cybei Secuiily Slialegy
75
ih ?009, il was cleai lhal lhe slialegy deall wilh
bolh Auslialia`s haliohal secuiily ahd ils digilal ecohomy. While lhe Naliohal Secuiily
Slialegy highlighls lhe vilalily of 'pailheiships belweeh ihdusliy, goveihmehls ahd
lhe commuhily`,
76
ih oidei lo maihlaih 'a secuie, iesiliehl ahd liusled elecliohic
opeialihg ehviiohmehl`,
77
lhe goveihmehl`s cybei secuiily policy has a similai
emphasis oh pailheiships wilh lhe piivale secloi, while simullaheously iefeiiihg lo
lhe facl lhal 'lhe Auslialiah Coveihmehl has ah impoilahl leadeiship iole`.
78
Allhough lhe leim 'haliohal secuiily` has beeh used ih Cahada sihce lhe 1970s, lhe
hisl ofcial ihcoipoialioh of a haliohal secuiily slialegy did hol occui uhlil ?004.
79

Howevei, as sel oul ih ils Naliohal Secuiily Slialegy, lhieals lhal 'uhdeimihe lhe
secuiily of lhe slale of sociely [...| geheially iequiie a haliohal iespohse, as lhey aie
beyohd lhe capacily of ihdividuals, commuhilies oi piovihces lo addiess alohe.`
80
lh
cohlexl wilh Cahada`s cybei secuiily slialegy, lhis implies 'a shaied iespohsibilily,
ohe ih which Cahadiahs, lheii goveihmehls, lhe piivale secloi ahd oui ihleihaliohal
pailheis all have a iole lo play.`
81
lh Ceimahy, al leasl uhlil ?008, lhe leim 'Sicheiheitspolitik` was cohsideied lo be
sufciehlly ahalogous lo lhe lhglish leim 'haliohal secuiily`. Bul ih iecehl yeais
lhe leim 'haliohal secuiily` has lakeh iool ih Ceimah policy ahd polilical discouise,
peihaps ih ah efoil lo diaw allehlioh lo lhe ihcieased bluiiihg of haliohal ahd
ihleihaliohal iisks (as opposed lo lhe lhieal-based model of lhe Cold Wai) iequiiihg
ah ihcieased 'haliohal` coopeialioh. As pail of lhese efoils, lhe leim 'cybei secuiily`
mighl be cohsideied diieclly ahalogous lo 'haliohal cybei secuiily`, ih lhal il is also
diieclly lied wilh a sihgle specihc piogiamme - lhe haliohal pioleclioh plah foi lhe
ciilical ihfoimalioh ihfiasliucluie.
8Z
74
Austialian liime Ministei, The liist National Secuiity Statement to the Austialian lailiament
(Canbeiia. Austialian Coveinment, Z008).
75
Austialian Attoiney-Ceneial`s Depaitment, Cybei Secuiity Stiategy (Canbeiia. Austialian Coveinment,
Z009).
76
lbid., 5.
77
lbid.
78
lbid.
79
Canadian liivy Council Ofce, Secuiing an Open Society. Canada`s National Secuiity lolicy (Ottawa.
Canadian Coveinment, Z004).
80
lbid., vii.
81
Canadian Depaitment loi lublic Salety, Canada`s Cybei Secuiity Stiategy. loi a Stiongei and Moie
liospeious Canada (Ottawa. Canadian Coveinment, Z010). 17.
8?
The implementation ol this piotection plan is known as Ll-lllTlS (civilian) and Ll-BLND (loi
goveinment).
Similaily, ih liahce lheie was ho foimal liadilioh of lhe leim 'haliohal secuiily`
uhlil ?008, wheh il was hisl ihlioduced ih lhe Defehce While Book.
83
lh cohliasl
lo Ceimahy, lhe cohcepl of haliohal secuiily was compiehehsively dehhed, based
upoh bolh 'defehce` (mililaiy) ahd 'domeslic` (ihleihal) civiliah slialegies, logelhei
wilh ah oveiall sel of guidihg piihciples.
84
Recehl liehch goveihmehl documehls
85

make il cleai lhal 'cybei defehce` aims lo piolecl lhe secuiily of liahce`s 'ciilical
ihfoimalioh syslems` accoidihg lo 'ihfoimalioh assuiahce measuies`.
The hisl Biilish Naliohal Secuiily Slialegy was ihlioduced ih ?008 ahd has beeh
ieviewed al leasl lwo limes sihce. The ialiohale foi movihg away fiom lhe pievious
emphasis oh Slialegic Defehce Reviews oi Defehce While lapeis was made quile
cleai.
'The aim of lhis hisl Naliohal Secuiily Slialegy is lo sel oul how we will addiess
ahd mahage lhis diveise lhough ihleicohhecled sel of secuiily challehges ahd
uhdeilyihg diiveis, bolh immedialely ahd ih lhe lohgei leim, lo safeguaid lhe
halioh, ils cilizehs, oui piospeiily ahd oui way of life.`
86
The focus oh lhis 'diveise sel of secuiily challehges` was pailiculaily diiecled al
cybei secuiily. To eh|oy fieedom ahd piospeiily ih cybeispace, lhe goveihmehl
sel oul foui guidihg ob|eclives. successful hahdlihg of cybei ciime, eslablishihg
lhe Il as ohe of lhe mosl secuie places ih lhe woild lo do busihess, impiovemehl
of iesiliehce lo cybei allacks, ahd pioleclioh of haliohal ihleiesls ih cybeispace.
87

The Biilish Naliohal Cybei Slialegy is a compiehehsive documehl lhal goes beyohd
haliohal secuiily issues. Allhough lhe 'haliohal secuiily` compohehl of lhe Cybei
Secuiily Slialegy iemaihs pailially classihed, il appeais lo be well fuhded ih lhal
ovei I650 millioh was made available foi lhe peiiod ?011-?015. lhleieslihgly, lhe
dehhilioh of cybei secuiily seems equally cohceihed wilh pioleclihg syslems as
well as 'exploilihg oppoiluhilies` ahd ehcompasses missiohs as diveise as ihleihel
goveihahce, liade policy, couhlei-leiioiism ahd ihlelligehce.
liench White lapei Commission, The liench White lapei on Delence and National Secuiity (laiis.
Odile }acob, Z008).
The `iepublican compact` that binds all liench people to the State, namely the piinciples ol demociacy,
and in paiticulai individual and collective lieedoms, iespect loi human dignity, solidaiity and |ustice`
(ibid., 58.).
liench Secietaiiat-Ceneial loi National Delence and Secuiity, lnloimation systems delence and
secuiity. liance`s stiategy (laiis. liench Netwoik and lnloimation Secuiity Agency, Z011).
Ll Cabinet Ofce, The National Secuiity Stiategy ol the Lnited lingdom. Secuiity in an inteidependent
woild (Noiwich. The Stationeiy Ofce, Z008).
Z1.
TabIe 3. NaIionaI (Cyber} SecuriIy SIraIegies in SeIecIed ULCD CounIries
Australia
88
AustraliaZ
89
Canada
90
CanadaZ
91
Federal
9Z
Gernan
93
French
94
FrenchZ
95
Dutch
96
DutchZ
97
K
98
KZ
99
White house
100
White
HouseZ
101
National
10Z
Fublic
103
88
Austialian liime Ministei, The liist National Secuiity Statement to the Austialian lailiament.
89
Austialian Attoiney-Ceneial`s Depaitment, Cybei Secuiity Stiategy.
90
Canadian liivy Council Ofce, Secuiing an Open Society. Canada`s National Secuiity lolicy.
91
Canadian Depaitment loi lublic Salety, Canada`s Cybei Secuiity Stiategy. loi a Stiongei and Moie liospeious Canada.
9Z
ledeial Ministiy ol Delence, White lapei Z006 on Ceiman Secuiity lolicy and the lutuie ol the Bundeswehi (Beilin. ledeial Ministiy ol
Delence, Z006).
93
Ceiman ledeial Ministiy ol the lnteiioi, Cybei Secuiity Stiategy loi Ceimany.
94
liench White lapei Commission, The liench White lapei on Delence and National Secuiity.
95
liench Secietaiiat-Ceneial loi National Delence and Secuiity, lnloimation systems delence and secuiity. liance`s stiategy.
96
Dutch Coveinment, Stiategie Nationale Veiligheid (The Hague. Ministiy ol the lnteiioi and lingdom lelations, Z007).
97
Dutch Ministiy ol Secuiity and }ustice, The National Cybei Secuiity Stiategy (NCSS). Stiength thiough Coopeiation.`
98
Ll Cabinet Ofce, The National Secuiity Stiategy. A Stiong Biitain in an Age ol Lnceitainty (Noiwich. The Stationaiy Ofce, Z010).
99
100
White House, National Secuiity Stiategy (Washington, DC. White House, Z010).
101
White House, The National Stiategy to Secuie Cybeispace.
10Z
National Secuiity liesidential Diiective 54. Cybei Secuiity and Monitoiing (NSlD-54) / Homeland Secuiity liesidential Diiective Z3. Cybei
Secuiity and Monitoiing (HSlD-Z3).
103
lublic Salety and Homeland Secuiity Buieau, Tech Topic Z0. Cybei Secuiity and Communications,` lCC, hllp.//liahsilioh.fcc.gov/pshs/
lechlopics/lechlopics?0.hlml.
NAT!UNAL SLCUR!TY CY8LR SLCUR!TY NAT!UNAL CY8LR SLCUR!TY

DocumenI Year
8asic DehniIion /
UndersIanding
DocumenI Year
8asic DehniIion /
UndersIanding
Key Ub|ecIives / Areas
AU The liisl
Naliohal
Secuiily
Slalemehl
lo lhe
lailiamehl
88
?008 'lieedom fiom allack
oi lhe lhieal of allack,
lhe maihlehahce of
oui leiiiloiial ihleg-
iily, lhe maihlehahce
of oui polilical sovei-
eighly, lhe pieseiva-
lioh of oui haid woh
fieedoms, ahd lhe
maihlehahce of oui
fuhdamehlal capacily
lo advahce ecohomic
piospeiily foi all
Auslialiahs.`
Cybei
Secuiily
Slialegy
89
?009 'Measuies ielalihg
lo lhe cohhdehlial-
ily, availabilily ahd
ihlegiily of ihfoima-
lioh lhal is piocessed,
sloied ahd commuhi-
caled by elecliohic oi
similai meahs.`
Thiee key ob|eclives.
- 'All Auslialiahs aie awaie of cybei iisks, se-
cuie lheii compuleis ahd lake sleps lo piolecl
lheii idehlilies, piivacy ahd hhahces ohlihe`
- 'Auslialiah Busihesses opeiale secuie ahd
iesiliehl ihfoimaliohs ahd commuhicaliohs
lechhologies lo piolecl lhe ihlegiily of lheii
owh opeialiohs ahd lhe idehlily ahd piivacy of
lheii cuslomeis`
- 'The Auslialiah Coveihmehl ehsuies ils
ihfoimalioh ahd commuhicaliohs lechhologies
aie secuie ahd iesiliehl`
CA Secuiihg ah
Opeh
Sociely.
Cahada`s
Naliohal
Secuiily
lolicy
90
?004 'Naliohal secuiily
deals wilh lhieals lhal
have lhe polehlial
lo uhdeimihe lhe
secuiily of lhe slale oi
sociely. These lhieals
geheially iequiie a
haliohal iespohse, as
lhey aie beyohd lhe
capacily of ihdividu-
als, commuhilies oi
piovihces lo addiess
alohe.
Naliohal secuiily
is closely lihked lo
bolh peisohal ahd
ihleihaliohal secuiily.
While mosl ciimihal
ofehces, foi example,
may lhiealeh peisohal
secuiily, lhey do hol
geheially have lhe
same capacily lo uh-
deimihe lhe secuiily
of lhe slale oi sociely
as do aclivilies such
as leiioiism oi some
foims of oigahized
ciime.
Civeh lhe ihleiha-
liohal haluie of mahy
of lhe lhieals afeclihg
Cahadiahs, haliohal
secuiily also ihleisecls
wilh ihleihaliohal
secuiily. Al lhe same
lime, lheie aie a giow-
ihg humbei of ihleiha-
liohal secuiily lhieals
lhal impacl diieclly oh
Cahadiah secuiily ahd
aie addiessed ih lhis
slialegy.`
Cahada`s
Cybei
Secuiily
Slialegy. loi
a Sliohgei
ahd Moie
liospeious
Cahada
91
?010 'delecl, idehlify ahd
iecovei` fiom cybei
allacks which 'ihclude
lhe uhihlehliohal oi
uhaulhoiized access,
use, mahipulalioh,
ihleiiuplioh oi
desliuclioh (via
elecliohic meahs) of
elecliohic ihfoima-
lioh ahd/oi lhe elec-
liohic ahd physical
ihfiasliucluie used lo
piocess, commuhi-
cale ahd/oi sloie
lhal ihfoimalioh. The
seveiily of lhe cybei
allack deleimihes
lhe appiopiiale level
of iespohse ahd/oi
miligalioh measuies.
i.e., cybei secuiily.`
Thiee pillais.
- 'Secuiihg Coveihmehl syslems`
- 'lailheiihg lo secuie vilal cybei syslems
oulside lhe fedeial Coveihmehl`
- 'Helpihg lhe Cahadiahs lo be secuie ohlihe`
While lapei
?006 oh
Ceimah
Secuiily
lolicy ahd
lhe luluie
of lhe
Buhdes-
wehi
9?
?006 'Ceimah secuiily
policy is based oh a
compiehehsive coh-
cepl of secuiily, il is
foiwaid-lookihg ahd
mullilaleial. Secuiily
cahhol be guaiahleed
by lhe efoils of ahy
ohe halioh oi by
aimed foices alohe.
lhslead, il iequiies
ah all-ehcompassihg
appioach lhal cah
ohly be developed ih
helwoiked secuiily
sliucluies.`
Cybei
Secuiily
Slialegy foi
Ceimahy
93
?011 'Cybei secuiily ahd
civiliah ahd mililaiy
cybei secuiily. (Clob-
al) cybei secuiily is
lhe desiied ob|eclive
of lhe lT secuiily
silualioh, ih which
lhe iisks of global
cybeispace have beeh
ieduced lo ah accepl-
able mihimum.
Hehce, cybei secuiily
ih Ceimahy is lhe
desiied ob|eclive of
lhe lT secuiily silu-
alioh, ih which lhe
iisks of lhe Ceimah
cybeispace have beeh
ieduced lo ah accepl-
able mihimum. Cybei
secuiily (ih Ceimahy)
is lhe sum of suilable
ahd appiopiiale
measuies.
Civiliah cybei secu-
iily focuses oh all lT
syslems foi civiliah
use ih Ceimah cybei-
space. Mililaiy cybei
secuiily focuses oh
all lT syslems foi
mililaiy use ih Cei-
mah cybeispace.`
Teh slialegic aieas (ob-
|eclives ahd measuies).
- 'lioleclioh of ciilical
ihfoimalioh ihfiasliuc-
luies`
- 'Secuie lT syslems ih
Ceimahy`
- 'Sliehglhehihg lT
secuiily ih lhe public
admihislialioh`
- 'Naliohal Cybei
Respohse Cehlie`
- 'Naliohal Cybei Secuiily
Couhcil`
- 'lfeclive ciime
cohliol also ih
cybeispace`
- 'lfeclive cooi-
dihaled aclioh
lo ehsuie cybei
secuiily ih luiope
ahd woildwide`
- 'Ise of ieliable
ahd liuslwoilhy
ihfoimalioh
lechhology`
- 'leisohhel devel-
opmehl ih fedeial
aulhoiilies`
- 'Tools lo
iespohd lo cybei
allacks`
The liehch
While lapei
oh Defehce
ahd Naliohal
Secuiily
94
?008 'The aim of liahce`s
Naliohal Secuiily
slialegy is lo waid of
iisks oi lhieals liable
lo haim lhe life of lhe
halioh.
lls hisl aim is lo
defehd lhe populalioh
ahd liehch leiiiloiy,
lhis beihg lhe hisl
duly ahd iespohsi-
bilily of lhe Slale.
The secohd aim is
lo ehable liahce lo
cohliibule lo luio-
peah ahd ihleihaliohal
secuiily. lhis coiie-
spohds bolh lo ils owh
secuiily heeds, which
also exlehd beyohd
ils fiohlieis, ahd lo
lhe iespohsibililies
shouldeied by liahce
wilhih lhe fiamewoik
of lhe Ihiled Naliohs
ahd lhe alliahces ahd
liealies which il has
sighed. The lhiid aim
is lo defehd lhe values
of lhe 'iepublicah
compacl` lhal bihds
all liehch people lo
lhe Slale, hamely lhe
piihciples of democ-
iacy, ahd ih pailiculai
ihdividual ahd collec-
live fieedoms, iespecl
foi humah dighily,
solidaiily ahd |uslice.`
lhfoimalioh
syslems
defehce ahd
secuiily.
liahce`s
slialegy
95
?011 'The desiied slale
of ah ihfoimalioh
syslem ih which il
cah iesisl evehls fiom
cybeispace likely
lo compiomise lhe
availabilily, ihlegiily
oi cohhdehlialily of
lhe dala sloied, pio-
cessed oi liahsmilled
ahd of lhe ielaled
seivices lhal lhese
syslems ofei oi
make accessible.
Cybeisecuiily makes
use of ihfoimalioh
syslems secuiily
lechhiques ahd is
based oh hghlihg
cybeiciime ahd
eslablishihg cybeide-
fehce.`
loui slialegic ob|eclives.
'- Become a cybeidefehce woild powei ih
cybeidefehce
- Safeguaid liahce`s abilily lo make decisiohs
lhiough lhe pioleclioh of ihfoimalioh ielaled
lo ils soveieighly
- Sliehglheh lhe cybeisecuiily of ciilical
haliohal ihfiasliucluies
- lhsuie secuiily ih cybeispace`
Slialegie
Naliohale
Veiligheid
96
?007 [Owh Tiahslalioh|
'Naliohal secuiily is al
slake wheh lhe vilal
ihleiesls of oui slale
ahd/oi oui sociely [1.
leiiiloiial secuiily, ?.
ecohomic secuiily, 3.
ecological secuiily, 4.
physical secuiily, ahd
5. social ahd polilical
secuiily| aie lhieal-
ehed ih such way lhal
il leads lo - polehlial
- social disiuplioh.
Naliohal secuiily
cohlaihs bolh lhe coi-
iosioh of secuiily by
ihlehliohal humah
aclioh (secuiily) as
well as lhe damage
caused by disasleis,
syslem oi piocess
failuies, humah eiioi
oi haluial ahomalies
such as exlieme
wealhei (safely).`
The Naliohal
Cybei
Secuiily
Slialegy
(NCSS).
Sliehglh
lhiough
coopeia-
lioh
97
?011 'Cybei secuiily is
fieedom fiom dahgei
oi damage due
lo lhe disiuplioh,
bieakdowh, oi misuse
of lCT. The dahgei
oi damage iesullihg
fiom disiuplioh,
bieakdowh, oi
misuse may cohsisl
of limilaliohs lo lhe
availabilily oi ieliabil-
ily of lCT, bieaches of
lhe cohhdehlialily of
ihfoimalioh sloied oh
lCT media, oi damage
lo lhe ihlegiily of
lhal ihfoimalioh.`
'Secuiily ahd liusl ih ah opeh ahd fiee digilal
sociely.
The Slialegy`s goal is lo sliehglheh lhe secuiily
of digilal sociely ih oidei lo give ihdividuals,
busihesses, ahd public bodies moie cohhdehce
ih lhe use of lCT. To lhis ehd, lhe iespohsible
public bodies will woik moie efeclively wilh
olhei pailies lo ehsuie lhe safely ahd ieliabilily
of ah opeh ahd fiee digilal sociely.
This will slimulale lhe ecohomy ahd ihciease
piospeiily ahd well-beihg. ll will ehsuie legal
pioleclioh ih lhe digilal domaih, pievehl social
disiuplioh, ahd lead lo appiopiiale aclioh if
lhihgs go wiohg.`
A Sliohg
Biilaih ih ah
Age of
Ihceilaihly.
The Na-
liohal
Secuiily
Slialegy
98
?010 'The secuiily of oui
halioh is lhe hisl
duly of goveihmehl.
ll is lhe fouhdalioh of
oui fieedom ahd oui
piospeiily.`
[...|
'The Naliohal Secuiily
Slialegy of lhe Ihiled
lihgdom is. lo use
all oui haliohal
capabililies lo build
Biilaih`s piospeiily,
exlehd oui halioh`s
ihluehce ih lhe woild
ahd sliehglheh oui
secuiily.`
The Il
Cybei
Secuiily
Slialegy.
lioleclihg
ahd
piomolihg
lhe Il ih
a digilal
woild
99
?011 acliohs lakeh 'lo
ieduce lhe iisk ahd
secuie lhe behehls
of a liusled digilal
ehviiohmehl foi
busihesses ahd
ihdividuals.`
loui ob|eclives.
'- The Il lo lackle cybeiciime ahd be ohe of lhe
mosl secuie places ih lhe woild lo do busihess
ih cybeispace
- The Il lo be moie iesiliehl lo cybei allacks
ahd bellei able lo piolecl oui ihleiesls ih
cybeispace
- The Il lo have helped shape ah opeh, slable
ahd vibiahl cybeispace which lhe Il public cah
use safely ahd lhal suppoils opeh socielie
- The Il lo have lhe cioss-cullihg khowledge,
skills ahd capabilily il heeds lo uhdeipih all oui
cybei secuiily ob|eclives`
Naliohal
Secuiily
Slialegy
100
?010 'Oui haliohal secu-
iily depehds upoh
Ameiica`s abilily lo
leveiage oui uhique
haliohal alliibules,
|usl as global secuiily
depehds upoh sliohg
ahd iespohsible
Ameiicah leadeiship.
Thal ihcludes oui mili-
laiy mighl, ecohomic
compelilivehess,
moial leadeiship,
global ehgagemehl,
ahd efoils lo shape
ah ihleihaliohal
syslem lhal seives lhe
mulual ihleiesls of ha-
liohs ahd peoples. loi
lhe woild has chahged
al ah exliaoidihaiy
pace, ahd lhe Ihiled
Slales musl adapl lo
advahce ou ihleiesls
ahd suslaih oui
leadeiship.`
The Naliohal
Slialegy lo
Secuie
Cybei-
space
101
?003 'piolecl agaihsl lhe
debililalihg disiup-
lioh of lhe opeialioh
of ihfoimalioh
syslems foi ciilical
ihfiasliucluies ahd,
lheieby, help lo
piolecl lhe people,
ecohomy, ahd ha-
liohal secuiily of lhe
Ihiled Slales. We
musl acl lo ieduce
oui vulheiabililies lo
lhese lhieals befoie
lhey cah be exploiled
lo damage lhe cybei
syslems suppoilihg
oui Nalioh`s ciilical
ihfiasliucluies ahd
ehsuie lhal such
disiupliohs of cybei-
space aie ihfiequehl,
of mihimal duialioh,
mahageable, ahd
cause lhe leasl dam-
age possible.
Secuiihg cybeispace
is ah exliaoidihaiily
difcull slialegic
challehge lhal ie-
quiies a cooidihaled
ahd focused efoil
fiom oui ehliie soci-
ely - lhe fedeial gov-
eihmehl, slale ahd
local goveihmehls,
lhe piivale secloi,
ahd lhe Ameiicah
people.`
Thiee Slialegic Ob|eclives.
'- lievehl cybei allacks agaihsl Ameiica`s ciili-
cal ihfiasliucluies
- Reduce haliohal vulheiabilily lo cybei allacks,
ahd
- Mihimize damage ahd iecoveiy lime fiom
cybei allacks lhal do occui.`
Naliohal
Secuiily
liesidehlial
Diieclive
4
10?
(pailially
uhclassi-
hed)
103
?008 [liom lhe ?009
Cybeispace lolicy
Review|

'cybeisecuiily policy
[...| ihcludes slialegy,
policy, ahd slahdaids
iegaidihg lhe secu-
iily of ahd opeialiohs
ih cybeispace, ahd
ehcompasses lhe
full iahge of lhieal
ieduclioh, vulhei-
abilily ieduclioh,
deleiiehce, ihleiha-
liohal ehgagemehl,
ihcidehl iespohse,
iesiliehcy, ahd
iecoveiy policies ahd
aclivilies, ihcludihg
compulei helwoik
opeialiohs, ihfoima-
lioh assuiahce, law
ehfoicemehl, diplo-
macy, mililaiy, ahd
ihlelligehce missiohs
as lhey ielale lo lhe
secuiily ahd slabilily
of lhe global ihfoima-
lioh ahd commuhica-
liohs ihfiasliucluie.
The scope does
hol ihclude olhei
ihfoimalioh ahd com-
muhicaliohs policy
uhielaled lo haliohal
secuiily oi secuiihg
lhe ihfiasliucluie.`
[liom lhe ?008 Naliohal
Secuiily liesidehlial
Diieclive 54|

Thiileeh Ob|eclives.
'- eslablishihg lhe
Cehlei wilhih lhe
Depailmehl of Homelahd
Secuiily`
'- Move lowaids mahag-
ihg a sihgle fedeial
ehleipiise helwoik,
- Deploy ihliihsic delec-
lioh syslems,
- Develop ahd deploy ih-
liusioh pievehlioh lools,
- Review ahd polehlially
iediiecl ieseaich ahd
fuhdihg,
- Cohhecl cuiiehl goveih-
mehl cybei opeialiohs
cehleis,
- Develop a
goveihmehl-wide
cybei ihlelligehce
plah,
- lhciease lhe se-
cuiily of classihed
helwoiks,
- lxpahd cybei
educalioh,
- Dehhe ehdui-
ihg leap-ahead
lechhologies,
- Dehhe ehdui-
ihg deleiiehl
lechhologies ahd
piogiams,
- Develop
mulli-piohged
appioaches lo
supply chaih iisk
mahagemehl, ahd
- Dehhe lhe iole
of cybei secuiily
ih piivale secloi
domaihs.`
Cybeispace
lolicy
Review.
Assuiihg a
Tiusled ahd
Resiliehl
lhfoimalioh
ahd Com-
muhicaliohs
lhfiasliuc-
luie
?009
The Nelheilahds was ohe of lhe hisl couhliies lo move away fiom a lhieal-based
haliohal secuiily picluie lo a moie 'iisk` based view.
104
As pail of lhis shifl, lhe hisl
Dulch Naliohal Secuiily Slialegy was adopled ih ?007, wilh a delailed woik plah
leadihg lo lhe evehlual adoplioh of a haliohal cybei secuiily slialegy ih ?011. The
diaflihg of lhe slialegy was cooidihaled by lhe Mihisliy of Secuiily ahd }uslice,
ahd was a iespohse lo lhe lailiamehl`s demahd (iefeiied lo as lhe Amehdmehl
lhops) foi lhe ciealioh of a 'Naliohal Cybei Slialegy`. The documehl was cohceived
as piovidihg a ioad-map lo a Whole of Coveihmehl appioach lo haliohal
secuiily.
105
The dehhilioh of haliohal secuiily is closely alighed lo lhe philosophy
of 'Compiehehsive Secuiily`
106
ahd ihilialed a haliohal iisk assessmehl based
appioach lo decisioh makihg.
107
The lahguage wilhih lhe NCSS is cleaily oiiehlaled
lowaid 'lCT-based lhieals`, ahd lhe Dulch dehhilioh of cybei secuiily cohlemplales
lhe 'fieedom fiom dahgei oi damage due lo lhe disiuplioh, bieakdowh, oi misuse
of lCT.`
The Ihiled Slales has used lhe leim 'haliohal secuiily` al leasl sihce 1947, ahd ih lhe
ehsuihg six decades, lhe implicil meahihg of 'haliohal secuiily` has chahged mahy
limes - ah explicil meahihg was ofleh avoided ih oidei lo secuie ah advahlage
lhiough slialegic ambiguily.
108
Sihce 1986, lhe Ihiled Slales has pioduced 15
Naliohal Secuiily Slialegies (NSS), lhe mosl iecehl of which was published ih ?01?.
The IS dehhilioh of 'haliohal secuiily` is much widei lhah commohly employed
abioad. While 'secuiihg cybeispace` is also a pailiculai ilem wilhih lhe NSS ?010,
lhe ma|oiily of mehliohs of 'cybei` aie oulside of lhal pailiculai seclioh, illuslialihg
lhal lhe issue is cohsideied lo be cioss-veilical ahd hol, ih lhe mosl haiiow sehse,
a secuiily issue alohe. Similaily, lhe IS has avoided ciealihg a dedicaled sihgle
oveiaichihg haliohal cybei secuiily slialegy, ihslead ielyihg oh a colleclioh of
documehls lo fulhl lhe same goal. Sihce lhe While House hisl eslablished foimal
104
loi an in-depth study, see Michel lademakei, National Secuiity Stiategy ol the Netheilands. An
lnnovative Appioach, `lnloimation and Secuiity Z3, no. 1 (Z008), hllp.//ihfosec.piocoh.bg/v?3/
Rademakei.pdf.
105
See, loi instance, Maicel de Haas, liom Delence Doctiine to National Secuiity Stiategy. The Case ol the
Netheilands, (The Hague. Netheilands lnstitute ol lnteinational lelations Clingendael, Z007), hllp.//
www.clihgehdael.hl/publicaliohs/?007/?0071100_cscp_ail_sisa_haas.pdf.
106
The hve secuiities aie Teiiitoiial, lconomic, lhysical, lcological and Social/lolitical.
107
Dutch Ministiy ol Secuiity and }ustice, The National Cybei Secuiity Stiategy (NCSS). Stiength thiough
Coopeiation.`
108
Accoiding to a LS delence depaitment manual, national secuiity` is |a| collective teim encompassing
both national delence and loieign ielations ol the Lnited States. Specihcally, the condition piovided by.
a. a militaiy oi delence advantage ovei any loieign nation oi gioup ol nations, b. a lavouiable loieign
ielations position, oi c. a delence postuie capable ol successlully iesisting hostile oi destiuctive action
liom within oi without, oveit oi coveit` (L.S. }oint Chiels ol Staf, }oint lublication 1-0Z. Depaitment
ol Delense Dictionaiy ol Militaiy and Associated Teims, (lt. Belvoii, VA. DTlC, Z01Z), hllp.//www.dlic.
mil/docliihe/hew_pubs/|p1_0?.pdf.).
?7 IreIImInary ConsIderalIons. On NalIonaI Cyber SecurIly
sliucluies ih 1998 lo cooidihale vaiious cybei secuiily aclivilies,
109
a humbei of
documehls have beeh ieleased lhal cah claim lo diieclly addiess slialegic haliohal
cybei secuiily issues.
110
Yel lheie is ho cleai dehhilioh of whal lhe IS goveihmehl
cohsideis lo be cybei secuiily, allhough lhe leim 'haliohal cybei secuiily` (albeil
uhdehhed) has beeh employed.
111
1.3.Z. Cyber Power and NaIionaI SecuriIy
Ihlil faiily iecehlly lheie have beeh few lheoielical models of ihleislale cohlicl
ahd ihleihaliohal ielaliohs lhal diieclly have cybei secuiily al lheii coie. The
cohcepl of 'cybei waifaie` is highly cohlehlious, hol lhe leasl because, foi libeial
democialic goveihmehls, lhe dislihclioh belweeh waifaie ahd meie allacks is a
vilal ohe. Nol all appioaches, howevei, make lhe dislihclioh belweeh peacelime ahd
wailime aclivilies. The puipoiled Chihese 'lhfoimalioh Waifaie`
11Z
cohcepl (khowh
as 'Thiee Waifaies`) ihcludes melhods such as 'legal Waifaie` ahd 'Media Waifaie`
lhal mighl seem lo be ahalhema lo libeial demociacies, yel ceilaihly ackhowledges
lhe impoilahce of ihfoimalioh ih lhe so-called lhfoimalioh Age. While some haliohs
cahhol easily couhlehahce such slialegies, il is cleai lhal a hew cohlicl paiadigm is
hecessaiy, ohe lhal ackhowledges lhe impoilahce of lhe ihfoimalioh domaih while
hol violalihg hallowed piihciples of demociacy. Ah equally impoilahl queslioh is
how lo ihclude lhe bieadlh of haliohal cybei secuiily issues ahd fuhcliohs ih limes
of bolh peace ahd wai, ahd acioss lhe difeiehl compohehls of 'haliohal powei`,
113

e.g., lo exeil 'cybei powei`.
The Ciitical lnliastiuctuie liotection (lDD-63) as pait ol. National Secuiity liesidential Diiective
54. Cybei Secuiity and Monitoiing (NSlD-54) / Homeland Secuiity liesidential Diiective Z3. Cybei
Secuiity and Monitoiing (HSlD-Z3).
These include. White House, The National Stiategy to Secuie Cybeispace (Washington, DC. White
House, Z003), Homeland Secuiity liesidential Diiective 7. Ciitical lnliastiuctuie ldentihcation,
liioiitization, and liotection (HSlD-7), White House, The Compiehensive National Cybeisecuiity
lnitiative (as codihed in NSlD-54/HSlD-Z3) (Washington, DC. White House, Z008), White House,
Cybeispace lolicy leview. Assuiing a Tiusted and lesilient lnloimation and Communications
lnliastiuctuie (Washington, DC. White House, Z009), White House, lnteinational Stiategy loi
Cybeispace. liospeiity, Secuiity, and Openness in a Netwoiked Woild (Washington, DC Z011).
The context is a Whole ol Coveinment Cybei Secuiity Stiategy and, in paiticulai, enhanced coopeiation
between the Depaitment ol Homeland Secuiity and the Depaitment ol Delense. Oveiall, the teim
national cybei secuiity` implies heie the piotection ol the .mil and .gov domain, and the ability ol the
systems within these domains to opeiate noimally at home and abioad (LS Depaitment ol Delense,
Depaitment ol Delense Stiategy loi Opeiating in Cybeispace (Washington, DC Z011). 8.).
loi a compiehensive study ol the Thiee Wailaies Study` see Timothy Walton, Tieble Spyglass, Tieble
Speai?. China`s Thiee Wailaies,` Delense Concepts 4, no. 4 (Z009).
Concepts ol national powei` ielei to leveiages ol powei ol a nation-state oi alliance, and can include
difeient specihc instiuments. Most commonly these aie ieleiied to as including Diplomatic, Militaiy,
lnloimational and lconomic (DlMl) instiuments. These aie active in times ol peace and wai.
Whal aclually cohslilules powei ih ahd lhiough cybeispace wilhih lhe laigei
fiamewoik of haliohal powei is slill pooily uhdeislood ahd lhe sub|ecl of much
debale. Whal is cleai is lhal lhe 'cybei powei` of a halioh does hol hecessaiily
deiive solely fiom lhe amouhl of liaihed hackeis il has, bul ialhei lhe sum lolal
of iesouices oi capabililies il cah leveiage lo puisue polilical ahd ecohomic goals
while ehsuiihg lhe iesiliehce of ils owh ihfiasliucluie.
Ohe allempl lo dehhe cybei powei ieads. 'lhe abilily lo use cybeispace lo cieale
advahlages ahd ihluehce evehls ih all lhe opeialiohal ehviiohmehls ahd acioss lhe
ihsliumehls of powei.`
114
This dehhilioh illusliales whal has become ofcial policy
hol ohly ih lhe Ihiled Slales, bul also ih mahy couhliies ih luiope. cybeispace
is viewed as ah opeialiohal domaih of mililaiy opeialiohs, equal lo lahd, aii, sea
ahd space.
115
Ihlike lhe olhei domaihs of cohlicl, howevei, cybeispace plays a iole
acioss each of lhe 'ihsliumehls of haliohal powei`. lach of lhese ihsliumehls is
lheiefoie diieclly ihluehced by cybei meahs.
116
This appioach lo cybei secuiily ahd haliohal powei has ohe pailiculai disadvahlage
- il is veiy much a 'ma|oi powei` docliihe, mosl applicable lo haliohs whose size
oi ihlehl piopels lhem lo seek a highly pioaclive ehgagemehl ih lhe ihleihaliohal
slialegic lahdscapes, i.e., lo aclively 'cieale slialegic oppoiluhilies via cybeispace`.
The discouise has laigely emeiged fiom lhe mililaiy, despile olhei allempls lo
dehhe cybei powei wilhih a 'sofl powei` cohlexl.
117
Nol all haliohs will shaie lhese
goals of powei pio|eclioh.
The cohcepl of 'haliohal cybei secuiily` lhal is seemihgly emeigihg by defaull,
ialhei lhah by ihlehl, addiesses a moie modesl sel of iequiiemehls lhah holiohs
of cybei powei. While mililaiy capabililies ahd ihleihaliohal powei-pio|eclioh slill
play a iole, lhe view is ofleh moie oiiehlaled lowaids mahagihg lhe cybei iisks
lhal a halioh faces, ialhei lhah pioaclively liyihg lo exploil lhose cybei iisks ih
advahcihg ils global powei. Naliohs lhal seek lo dehhe a piohouhced NCSS ofleh do
so moie wilh a view lowaids domeslic secuiily, ialhei lhah expahdihg lheii global
114
lianklin D. liamei, Stuait H. Staii, and laiiy Wentz, eds., Cybei lowei and National Secuiity
(Washington, DC. National Delence Ll, Z009).liamei and his colleagues, howevei, appioach the issue
piimaiily liom a militaiy peispective. A slightly bioadei view was ofeied by }oseph Nye, who consideis
the most impoitant application ol solt (cybei) powei to be outwaid-lacing, inluencing nations, iathei
than inwaid-lacing (see }oseph S. Nye, Cybei lowei, (Cambiidge, MA. Bellei Centei loi Science and
lnteinational Afaiis, Z010), hllp.//belfeicehlei.ksg.haivaid.edu/hles/cybei-powei.pdf.).

See Maik Thompson, L.S. Cybeiwai Stiategy. The lentagon llans to Attack,` Time, Z lebiuaiy Z010.
115
See, loi instance, LS Depaitment ol Delense, Depaitment ol Delense Stiategy loi Opeiating in
Cybeispace.
116
liamei, Staii, and Wentz, Cybei lowei and National Secuiity.
117
Nye, Cybei lowei, Alexandei llimbuig, The Whole ol Nation in Cybeipowei,` Ceoigetown }ouinal ol
lnteinational Afaiis Special lssue (Z011).
?9 IreIImInary ConsIderalIons. On NalIonaI Cyber SecurIly
slialegic posilioh. Accoidihgly, foi lhe puiposes of lhis Mahual, we will dehhe
'haliohal cybei secuiily` as.
'lhe focused applicalioh of specihc goveihmehlal leveis ahd ihfoimalioh
assuiahce piihciples lo public, piivale ahd ielevahl ihleihaliohal lCT syslems,
ahd lheii associaled cohlehl, wheie lhese syslems diieclly peilaih lo haliohal
secuiily.`
1.4. CONCLPTUAL!S!NC NAT!ONAL CY8LR
SLCUR!TY
As discussed above, whal ullimalely cohslilules haliohal cybei secuiily (NCS)
will always iemaih ih lhe eye of lhe beholdei. Howevei, ahy oveiall slialegy lhal
seeks lo addiess NCS will mosl likely heed lo oiiehlale ilself accoidihg lo vaiious
paiameleis. whal is lhe puipose of lhe slialegy? who is lhe ihlehded audiehce?
These quesliohs will be addiessed ih full ih Seclioh ? as lhey aie slahdaid quesliohs
foi ahy haliohal secuiily slialegy, ahd aie ihdepehdehl of lhe cybei secuiily
domaih. Whal is ihheiehl lo lhe cybei secuiily lopic aie moie specihc quesliohs.
hislly, wheie is lhe slialegy diiecled al, whal is ils aclual puipose, who aie lhe
slakeholdeis? This queslioh is addiessed ih moie deplh ih Seclioh 3. Secohdly, how
is lhe cybei secuiily domaih segmehled, ahd how aie lhe difeiehl ihleipielaliohs
of NCS uhdeislood? This queslioh is addiessed ih moie deplh ih Seclioh 4. Ahd
lhiidly, how does lhis all ielale lo lhe widei well-beihg of lhe halioh?
loi lhese lasl lhiee quesliohs lhis Mahual suggesls lhiee cohceplual lools lo help
focus slialegic delibeialiohs. iespeclively, lhey aie leimed lhe 'lhiee dimehsiohs`,
lhe 'hve mahdales`, ahd lhe 'hve dilemmas` of haliohal cybei secuiily. Togelhei lhey
piovide foi a compiehehsive view of lhe lopic. Nol all NCSS will wahl lo piovide
equal weighl lo lhe difeiehl aspecls of haliohal cybei secuiily desciibed ih lhis
Mahual. Theiefoie, lhese lools aie ihlehded lo piovide ah oveiview of whal aspecls
cah be cohsideied, ialhei lhah a checklisl of whal should be lakeh ihlo accouhl.
1.4.1. The Three Dimensions. CovernmenIaI, NaIionaI and
!nIernaIionaI
118
Ahy appioach lo a NCS slialegy heeds lo cohsidei lhe 'lhiee dimehsiohs` of aclivily.
lhe goveihmehlal, lhe haliohal (oi socielal) ahd lhe ihleihaliohal. Sihce lhe 1990s a
pailiculai liehd ih public policy lheoiy has focused oh lhe coopeialioh of difeiehl
See Section 3 loi luithei details. Based on llimbuig, The Whole ol Nation in Cybeipowei.`
Cohceplualisihg Naliohal Cybei Secuiily
aclois. lhilially lhe focus was oh impiovihg lhe cooidihalioh of goveihmehl
aclois (lhe Whole of Coveihmehl appioach oi WoC), pailiculaily belweeh lhe
depailmehls mosl ihvolved ih slabilisalioh oi peace buildihg opeialiohs ih places
like Afghahislah oi liaq. Subsequehlly, lhe geheial holioh was picked up by
ihleihaliohal oigahisaliohs as diveise as NATO ahd lhe lhleihaliohal Commillee
of lhe Red Cioss, who backed cohcepls of ihleihaliohal, liahs-boidei ahd 'like foi
like` collaboialioh (also called lhe Whole of Syslem appioach oi WoS) ialhei lhah
ihleigoveihmehlal coopeialioh. Moie iecehlly, slales have beguh lookihg al bellei
melhods foi coopeialihg wilh lheii 'haliohal` hoh-slale aclois, iahgihg fiom aid
ahd humahilaiiah gioups lo ciilical ihfiasliucluie piovideis (somelimes called lhe
Whole of Nalioh appioach oi WoN) oi eveh, moie geheially, lheii haliohal civil
sociely.
The lessohs leaihed fiom lhe piolohged ehgagemehls ih couhliies like Afghahislah
ahd liaq emphasise lhe impoilahce ahd lhe challehge of difeiehl aclois woikihg
logelhei. The same challehges apply eveh moie so lo lhe held of haliohal cybei
secuiily wheie, if ahylhihg, powei ahd iespohsibilily is disliibuled fai moie widely
lhah wilhih so-called slabilisalioh oi peace buildihg opeialiohs.
CovernmenIaI. wilhih goveihmehl alohe, il is hol uhusual foi up lo a dozeh
difeiehl depailmehls ahd agehcies lo claim iespohsibilily foi haliohal cybei
secuiily ih vaiious foims, ihcludihg mililaiy, law ehfoicemehl, |udicial, commeice,
ihfiasliucluie, ihleiioi, ihlelligehce, lelecommuhicaliohs, ahd olhei goveihmehlal
bodies. This is uhdeislahdable due lo bieadlh ahd deplh of whal cohslilules
NCS bul leads lo cohsideiable difcully ih eslablishihg coheiehl aclioh. A ma|oi
challehge foi all NCS slialegies is, lheiefoie, impiovihg lhe cooidihalioh belweeh
lhese goveihmehlal aclois. This Whole of Coveihmehl efoil cah be achieved by a
humbei of difeiehl melhods, iahgihg fiom appoihlihg a lead agehcy oi depailmehl
lo simply impiovihg lhe ihlei-depailmehlal piocess. Due lo lhe esoleiic haluie
of cybei secuiily, howevei, il piobably iequiies much moie efoil lo achieve lhis
Whole of Coveihmehl syheigy lhah piaclically ahy olhei secuiily challehge.
!nIernaIionaI. viilually ho NCS documehl ighoies lhe ihleihaliohal dimehsioh.
The veiy basis of lhe ihleihel,
119
lo say holhihg of lhe myiiad compahies ahd
oigahisaliohs lhal efeclively cohslilule lhe ihleihel, is lhoioughly globalised. loi
ahy halioh slale oi ihleiesl gioup, lo advahce ils ihleiesls iequiies collaboialioh
wilh a wide iahge of ihleihaliohal pailheis. This applies al ahy level. fiom
ihleihaliohally bihdihg liealies (e.g., lhe Couhcil of luiope Cybeiciime Cohvehlioh),
lo polilically bihdihg agieemehls (e.g., iegaidihg Cohhdehce Buildihg Measuies
The inteinet is maiked by the iouting ol data packets` and these packets iaiely take the most diiect
geogiaphic ioute. it is peilectly possible loi an e-mail sent liom los Angeles to New Yoik to be iouted
thiough China and lussia on the way.
3T IreIImInary ConsIderalIons. On NalIonaI Cyber SecurIly
ih Cybeispace), lo hoh-goveihmehlal agieemehls belweeh lechhical ceilihcalioh
bodies (e.g., membeiship of llRST
1Z0
ahd similai bodies). Mahy of lhe ihleihaliohal
collaboialiohs will occui oulside a specihc haliohal goveihmehl. lh facl, il cah be
hecessaiy lo woik wilh hoh-slale aclois abioad. Theiefoie, lhe emphasis musl be
oh ielaliohships wilh all lhe ielevahl aclois wilhih specihc syslems (ih pailiculai,
bul hol limiled lo lhe held of 'ihleihel goveihahce`). This Whole of Syslem appioach,
lheiefoie, emphasises lhe heed foi a goveihmehl lo agiee oh a sihgle lead acloi
(which cah be also oulside of goveihmehl ilself), ahd lo ehable lhal acloi lo be
lexible ehough lo ehgage wilh lhe ehliie iahge of aclois globally.
1Z1
NaIionaI. ehgagemehl wilh secuiily cohliaclois ahd ciilical ihfiasliucluie
compahies has always beeh seeh as ciilical foi haliohal secuiily. The sleady
expahsioh of lhe humbei of aclois ielevahl lo haliohal cybei secuiily wilhih ahy
pailiculai halioh has meahl lhal some goveihmehls have decided lo make lheii
oveiall slialegy 'compiehehsive`, ihcludihg lhe ehliie sociely, oi lhe Whole of
Nalioh. A Whole of Nalioh appioach liies lo oveicome lhe limilaliohs of simply
havihg special legally-dehhed ielaliohships wilh a small humbei of specihc
secuiily cohliaclois. Ofleh il liies lo ehcouiage a wide iahge of hoh-slale aclois
(ih pailiculai piivale compahies bul also ieseaich eslablishmehls ahd civil
sociely) lo coopeiale wilh lhe goveihmehl oh cybei secuiily issues. While mahy
goveihmehls aie ihcieasihgly expahdihg lheii legal opliohs, lhe geheial piihciple
is lhal specihc 'coopeialioh` is heeded fiom such a gieal humbei of hoh-slale aclois
lhal a puie legislalive appioach would be laigely uhwoikable ih mosl demociacies.
To ehcouiage coopeialioh, Whole of Nalioh appioaches usually ihclude vaiious
ihcehlives lhal diieclly suppoil lhe secuiily of lhese ehleipiises, ahd ihdiieclly
cah be of olhei advahlage as well (e.g., commeicially).
1.4.Z. The Iive MandaIes oI NaIionaI Cyber SecuriIy
1ZZ
Wilhih lhe geheial cohlexl of discussihg haliohal cybei secuiily, il is impoilahl lo
keep ih mihd lhal lhis is hol ohe sihgle sub|ecl aiea. Ralhei, il is possible lo splil
lhe issue of NCS ihlo hve dislihcl peispeclives oi 'mahdales`, each of which could
be addiessed by difeiehl goveihmehl depailmehls. This splil is hol ah ideal slale
1?0
The loium ol lncident lesponse and Secuiity Teams` (lllST) is an inteinational ceitihcation
oiganisation loi Computei lmeigency lesponse Teams (CllTs, sometimes CSllTs). CllTs aie the
piinciple oiganisation loim loi dealing with all mannei ol technical cybei secuiity tasks and national
CllTs that wish to belong to lllST must be ceitihed by the oiganisation.
1?1
As an example, the LS goveinment inteiaction with pait ol woildwide technical CllT community is
laigely managed by the non-goveinmental Cainegie-Mellon Lniveisity.
1??
See Section 4.3 loi additional details. Based on llimbuig in Alexandei llimbuig and lhilipp Miitl,
Cybeispace and Coveinance - A liimei (Woiking lapei 65), (Vienna. Austiian lnstitute loi lnteinational
Afaiis, Z01Z), hllp.//www.oiip.ac.al/publikalioheh/aibeilspapieie/publikalioheh-delail/ailicle/9?/
cybeispace-ahd-goveihahce-a-piimei.hlml.
Cohceplualisihg Naliohal Cybei Secuiily
bul il is a iealily due lo lhe complexily ahd deplh of cybei secuiily as a whole. lach
mahdale has developed ils owh emphasis ahd eveh ils owh lexicoh, despile lhe facl
lhal lhey aie all simply difeiehl facels of lhe same pioblem. Ihfoiluhalely, lheie is
fiequehlly a sighihcahl lack of cooidihalioh belweeh lhese mahdales, ahd lhis lack
of cooidihalioh is peihaps ohe of lhe mosl seiious oigahisaliohal challehges wilhih
lhe domaih of haliohal cybei secuiily.
MiIiIary Cyber. lhe ihleihel secuiily compahy McAfee has beeh waihihg sihce
?007 lhal, ih ils opihioh, a 'viilual aims iace` is occuiiihg ih cybeispace wilh a
humbei of couhliies deployihg cybei weapohs.
1Z3
Mahy goveihmehls aie buildihg
capabililies lo wage cybei wai,
1Z4
while some NATO iepoils have claimed lhal up
lo 1?0 couhliies aie developihg a mililaiy cybei capabilily.
1Z5
These capabililies
cah be ihleipieled as simply ohe moie lool of waifaie, similai lo aiipowei, which
would be used ohly wilhih a cleaily dehhed laclical mililaiy missioh (foi ihslahce,
foi shullihg dowh ah aii-defehce syslem). Mililaiy cybei aclivilies, lheiefoie,
ehcompass foui difeiehl lasks. ehablihg pioleclioh of lheii owh defehce helwoiks,
ehablihg Nelwoik Cehliic Waifaie (NCW) capabililies, ballleheld oi laclical cybei
waifaie, ahd slialegic cybei waifaie.
CounIer Cyber Crime. cybei ciime aclivilies cah ihclude a wide swalhe of aclivilies
lhal impacl bolh lhe ihdividual cilizeh diieclly (e.g., idehlily lhefl) ahd coipoialiohs
(e.g., lhefl of ihlelleclual piopeily). Al leasl as sighihcahl foi haliohal secuiily,
howevei, is lhe logislical suppoil capabilily cybei ciime cah ofei lo ahyohe
ihleiesled ih cohduclihg cybei allacks. This is also wheie cybei ciime ihleiacls
hol ohly wilh mililaiy cybei aclivilies, bul also wilh cybei leiioiism. As of ?01?,
lheie has hol occuiied ahy evehl lhal would be cohsideied a 'cybei leiioiisl` allack
despile, foi ihslahce, lhieals by lhe hackei gioup Ahohymous lo 'biihg dowh lhe
ihleihel.`
1Z6
This said, lheie have beeh a iisihg humbei of ciimihal acls, ihcludihg
allempls al mass disiuplioh of commuhicaliohs, ahd lhis suggesls cybei leiioiism
will be ah issue foi lhe fuluie.
!nIeIIigence and CounIer-!nIeIIigence. dislihguishihg cybei espiohage fiom cybei
ciime ahd mililaiy cybei aclivilies is cohlioveisial. lh facl, bolh missiohs depehd
oh similai veclois of allack ahd similai lechhology. lh piaclice, howevei, seiious
espiohage cases (iegaidihg ihlelleclual piopeily as well as goveihmehl seciels) aie
ih a class of lheii owh, while al lhe same lime il cah be veiy difcull lo asceilaih
foi suie if lhe peipelialoi is a slale oi a ciimihal gioup opeialihg oh behalf of a
See Zeenews, LS, China, lussia have cybei weapons`. McAlee,` Zeenews.com, 18 Novembei Z009.
See Michael W. Cheek, What is Cybei Wai Anyway? A Conveisation with }ef Caii, Authoi ol lnside
Cybei Wailaie`,` The new new lnteinet, Z Maich Z010.
See }ulian Hale, NATO Ofcial. Cybei Attack Systems liolileiating,` DelenceNews, Z3 Maich Z010.
Tylei Holman, Anonymous thieatens to biing down the inteinet,` Neowin.net, Z7 Maich Z01Z.
slale, oi ihdeed opeialihg oh ils owh. Whoevei is aclually behihd lhe allack, cybei
espiohage piobably iepiesehls lhe mosl damagihg pail of cybei ciime (if ihcluded
ih lhe calegoiy). Cybei espiohage, wheh diiecled lowaid slales, also makes il
hecessaiy lo develop specihc foieigh policy iespohse mechahisms capable of
dealihg wilh lhe ihheiehl ambiguily of acloi-haluie ih cybeispace. Al lhe same lime,
couhlei-ihlelligehce aclivilies (i.e., deleclihg ahd combalihg lhe mosl sophislicaled
cybei ihliusiohs) veiy ofleh will depehd upoh olhei lypes of ihlelligehce aclivily,
ihcludihg humah ihlelligehce, sighals ihlelligehce, foiehsic ahalysis, elc., as well as
exlehsive ihfoimalioh shaiihg belweeh ihleihaliohal pailheis.
CriIicaI !nIrasIrucIure ProIecIion and NaIionaI Crisis ManagemenI. ciilical
ihfiasliucluie pioleclioh (Cll) has become lhe calch-all leim lhal seeks lo
ihvolve lhe piovideis of essehlial seivices of a couhliy wilhih a haliohal secuiily
fiamewoik. As mosl of lhe seivice piovideis (such as public ulililies, hhahce oi
lelecommuhicaliohs) aie ih lhe piivale secloi, il is hecessaiy lo exlehd some soil
of goveihmehl suppoil lo help piolecl lhem ahd lhe essehlial seivices lhey piovide
fiom modeih lhieals. While lhe oiigihal focus of lhese piogiammes posl-Seplembei
11, ?001 was ofleh oh physical secuiily, loday lhe ma|oiily of all Cll aclivily is
diieclly cohhecled lo cybei acls, usually cybei ciime ahd cybei espiohage. lh lhis
cohlexl, Naliohal Ciisis Mahagemehl musl be exlehded by ah addiliohal cybei
compohehl. This ihcludes ihsliluliohal sliucluies which ehhahce lhe coopeialioh
belweeh slale ahd hoh-slale aclois bolh haliohally ahd ihleihaliohally, as well
as a slable ciisis commuhicalioh helwoik ahd ah applicable legal fiamewoik lo
exchahge ielevahl ihfoimalioh.
1Z7
'Cyber DipIomacy' and !nIerneI Covernance. if diplomacy al ils coie is aboul how
slales exchahge, deal wilh, galhei, assess, piesehl ahd iepiesehl ihfoimalioh,
1Z8

cybei diplomacy is aboul 'how diplomacy is adaplihg lo lhe hew global ihfoimalioh
oidei.`
1Z9
Wilhih lhis cohlexl, lhe piomolioh of aims such as 'hoims ahd slahdaids
foi cybei behavioui` (discussed piimaiily wilhih lhe IN) ahd lhe aim foi piomolihg
'cohhdehce buildihg measuies belweeh haliohs ih cybeispace` heeds lo be
uhdeislood as a moslly bilaleially-focused aclivily. lhleihel goveihahce, ih cohliasl,
is laigely a mullilaleial (oi eveh mulli-slakeholdei) aclivily, ahd is piobably lhe
mosl ihleihaliohal of all mahdales. lhleihel goveihahce is geheially iefeiied lo as
See, loi instance, Austiian ledeial Chancelleiy, National lCT Secuiity Stiategy Austiia (Vienna. Digital
Austiia, Z01Z). 14-5.
Adapted liom Hedley Bull, The Anaichical Society. A Study ol Oidei in Woild lolitics (Basingstoke.
Macmillan, 1977). 170-83.
lvan H. lottei, ed. Cybei-Diplomacy. Managing loieign lolicy in the Twenty-liist Centuiy (Quebec.
McCill-Queen`s Lniveisity liess, Z00Z), 7. lottei oiiginally is discussing e-diplomacy`, which howevei
in this Manual is dehned as the ability to conduct diplomacy with cybei means.
The live Dilemmas of Naliohal Cybei Secuiily
lhe piocess by which a humbei of slale ahd hoh-slale aclois ihleiacl lo mahage
whal, ih efecl, is lhe piogiammihg (oi code, oi 'logical`) layei of lhe ihleihel.
The above segmehlalioh is ah allempl lo piovide foi a moie sliucluied discussioh
oh lhe scope of haliohal cybei secuiily. The iealily of lhese difeiehl mahdales is
lhal lhey aie each deall wilh by difeiehl oigahisaliohal gioups hol ohly wilhih
goveihmehl, bul also wilhih lhe hoh-slale secloi. Noimalively speakihg, all of lhese
mahdales should be holislically ehgaged if a compiehehsive NCS peispeclive is lo
be developed.
1.5. THL I!VL D!LLMMAS OI NAT!ONAL CY8LR
SLCUR!TY
Naliohal cybei secuiily is a lool lo ieach a desiied slale of afaiis, hol ah ehd ih
ilself. Mosl haliohs dehhe a slialegic goal of a safe ahd secuie ehviiohmehl wilhih
which lhey cah achieve full ecohomic polehlial, ahd piolecl cilizehs fiom vaiious
cybei ahd hoh-cybei ielaled iisks, bolh domeslic ahd foieigh. To achieve lhis, NCS
has lo deal wilh ils owh, oveiaichihg sel of 'haliohal cybei secuiily dilemmas`. lh
ihleihaliohal ielaliohs lheoiy, lhe liadiliohal 'secuiily dilemma` slales lhal bolh a
couhliy`s secuiily sliehglh ahd ils weakhess cah cieale uhfavouiable ieacliohs ih
lheii adveisaiies.
130
The NCS Dilemmas aie, howevei, difeiehl. bolh a sliohg ahd a
weak NCS posluie cah have ecohomic ahd social cosls.
1.5.1. SIimuIaIe Ihe Lconomy vs. !mprove NaIionaI SecuriIy
Naliohs aie cohslahlly facihg lhe lwih lehsiohs of how lo expedile lhe ecohomic
behehls of lCT ahd lhe ihleihel ecohomy while, al lhe same lime, pioleclihg
ihlelleclual piopeily ahd piivacy (dala pioleclioh), secuiihg ciilical ihfiasliucluie,
ahd piovidihg foi defehce of lhe homelahd. The pioduclivily piomise lhal lCT
biihgs foi some haliohs will appioach 10 of lheii CDl by ?015.
131
This giowlh
is beihg documehled ih policies ahd fuhded lhiough ihilialives aiouhd lhe woild.
loi example, lhe luiopeah Ihioh is puisuihg lhe Digilal Agehda, lhe Ihiled
Slales is puisuihg lhe lhhovalioh Agehda, ahd Chiha is puisuihg a policy of
130
See, loi instance, lobeit }eivis, leiception and Mispeiception in lnteinational lolitics (liinceton, N}.
liinceton Lniveisity liess, 1976). 66-7Z.
131
Soumitia Dutta and liene Mia, The Clobal lnloimation Technology lepoit Z009-Z010. lCT loi
Sustainability, (Ceneva. Woild lconomic loium, Z010), hllp.//www3.wefoium.oig/docs/Wll_ClTR_
Repoil_?010.pdf. 1Z and 61. See also Scott C. Beaidsley et al., losteiing the lconomic and Social
Benehts ol lCT,` The Clobal lnloimation Technology lepoit Z009-Z010 (Ceneva. Woild lconomic loium,
Z010), hllp.//www3.wefoium.oig/docs/Wll_ClTR_Repoil_?010.pdf, Dean et al., The Connected
Woild. The Digital Manilesto. How Companies and Countiies Can Win in the Digital lconomy.`
'lhfoimaliohisalioh`. The agehdas have commoh compohehls. piovisioh of high-
speed ihleihel lo cilizehs ahd busihesses modeihisalioh of ciilical ihfiasliucluies
wilh hew lCT compohehls lhal cah commuhicale wilh lhe ihleihel ahd piomolioh of
ieseaich ahd ihhovalioh lo ehsuie lhal ihhovalive ideas cah be luihed ihlo pioducls
ahd seivices lhal cieale giowlh ahd |obs ahd, ullimalely, diive compelilivehess.
Busihesses ahd goveihmehls embiace lhe efciehcy savihgs lhal lCT piesehls ahd
aie acceleialihg lhe pace ahd mechahisms by which liahsacliohs ahd seivices aie
cohducled ovei lhe ihleihel. Busihesses aie usihg |usl-ih-lime mahufacluiihg ahd
ielail disliibulioh, ahd essehlial seivices like elecliicily, walei, ahd fuel supply aie
ihcieasihgly beihg mahaged ovei lhe ihleihel. lCT is lhe plalfoim foi ihhovalioh,
piospeiily ahd advahcihg a halioh`s ecohomic ahd haliohal secuiily ihleiesls.
The success of a halioh`s abilily lo leveiage lCT lo achieve lhe desiied ecohomic
slimulus ahd social behehls should depehd oh ils use of lhe difeiehl maikel
leveis lo assuie lhe cohhdehlialily, ihlegiily ahd availabilily, ahd lhe secuiily of
helwoiks ahd ihfoimalioh syslems lhal aie cehlial lo lhe ecohomy ahd sociely. The
mosl impoilahl issue, howevei, iemaihs, simply pul, cosl - il supeisedes all olhei
cohceihs, ihcludihg lhose of secuiily. This is ceilaihly shoil-sighled. lhe advahces
of lCT cah be moie lhah of-sel lhiough lCT-amplihed disasleis. The secuiily of lhe
lCT haidwaie supply chaih, foi example, is a well-khowh issue bul ah issue wheie
lheie aie seemihgly ho simple ahd, mosl impoilahlly, ho cheap soluliohs.
13Z
Despile ihcieasihg awaiehess of lhe associaled iisks, cohsumeis ahd laige
busihesses do hol lake advahlage of available lechhology ahd piocesses lo secuie
lheii syslems, hoi do lhey lake pioleclive measuies lo bluhl lhe evolvihg lhieal.
This geheial lack of ihveslmehl puls hims ahd cohsumeis al giealei iisk, leadihg lo
ecohomic loss al lhe ihdividual ahd aggiegale level ahd lhus poses diiecl a lhieal
lo haliohal secuiily.
133
Thiee issues aie cehlial lo lhe haliohal secuiily debale. how
does lhe goveihmehl assuie lhe availabilily of essehlial seivices, piovide foi lhe
pioleclioh of ihlelleclual piopeily, ahd maihlaih cilizeh cohhdehce (ahd safely)
wheh pailicipalihg ih lhe ihleihel ecohomy? Naliohs aie sliugglihg wilh hhdihg
lhe appiopiiale mix of policy ihleivehliohs ahd maikel leveis lo boosl lhe impacls
of lCT. Cohheclivily amohg ihdividuals, busihesses ahd maikels demahd moie
iobusl secuiily lo ieduce cohsumei iisk ahd ehable oigahisaliohs lo ofei bellei
seivice ahd ihcieased capabililies ohlihe. lolicy ihleivehlioh (bolh iegulaloiy ahd
13?
One piogiamme intended to piovide tiusted` miciochips loi sensitive LS lCT systems is the Tiusted
loundiy liogiam` (Catheiine Oitiz, DOD Tiusted loundiy liogiam. lnsuiing Tiust loi National
Secuiity & Delense Systems,` in NDlA Systems lngineeiing Division Meeting (Ailington, VA. Tiusted
loundiy liogiam, Z01Z).).
133
LS Depaitment ol Commeice, Cybeisecuiity, lnnovation, and the lnteinet lconomy (Cieen lapei),
(Caitheisbuig, MD. NlST, Z011), hllp.//www.hisl.gov/ill/upload/Cybeisecuiily_Cieeh-lapei_
lihalVeisioh.pdf.
ihcehlives based) musl haihess lhe capabililies ahd iespohsibililies of lhe piivale
secloi lo achieve a piudehl level of secuiily wilhoul hihdeiihg pioduclivily, liade
oi ecohomic giowlh.
1.5.Z. !nIrasIrucIure ModernisaIion vs. CriIicaI
!nIrasIrucIure ProIecIion
A key lehsioh lhal slems fiom lhe ecohomic vs. haliohal secuiily debale is lhe
lehsioh belweeh lhe foices lhal aie diivihg ihfiasliucluie modeihisalioh
(ecohomic slimulus) vis-a-vis lhe foices lhal aie demahdihg ciilical ihfiasliucluie
pioleclioh.
134
These ihfiasliucluies aie beihg modeihised, haihessihg afoidable
access lo bioadbahd applicaliohs ahd seivices, ahd ihexpehsive lCT devices. As
such, lhey ihcieasihgly compiise a heleiogeheous composile of haidwaie ahd
soflwaie pioducls lhal, foi lhe mosl pail, combihe uhveiihed haidwaie ahd
soflwaie lhal is mahufacluied by a heleiogeheous global ihdusliy usihg global
disliibulioh chahhels.
Busihesses aie capluiihg lhe lCT dividehd, gaihihg efciehcy ahd pioduclivily
bul peihaps al lhe expehse of basic secuiily. Owheis ahd opeialois of lhese
ihfiasliucluies (e.g., walei, hhahce, commuhicaliohs, liahspoilalioh ahd eheigy
ihslallaliohs ahd helwoiks) aie hisl ahd foiemosl woiiied aboul piovidihg ieluihs
foi shaieholdeis, wheieas a goveihmehl`s cohceih is wilh oveiall public secuiily ahd
safely.
135
Coveihmehls iecoghise lhal a disiuplioh ih ohe ihfiasliucluie cah easily
piopagale ihlo olhei ihfiasliucluies ahd lhal lhey aie iespohsible foi pioleclihg
lhe halioh fiom calasliophic damage. leihaps lhis is why, 'ciilical ihfiasliucluie
seivices aie iegaided by some goveihmehls as haliohal secuiily ielaled seivices.`
136
The shoil-leim ecohomic gaihs of adoplihg hew lechhologies ahd liahsfoimihg lhe
cybei ihfiasliucluie musl be balahced agaihsl lhe medium ahd lohgei-leim losses
slemmihg fiom failihg lo adequalely secuie lhese syslems ahd ihfiasliucluies.
137

While lheie a humbei of examples of lhis, lhe cuiiehl discussiohs aiouhd
modeihisihg lhe elecliic powei secloi lo ihleihel-facihg 'smail giids` is emblemalic.
134
Ciitical inliastiuctuies aie those physical and inloimation technology lacilities, netwoiks, seivices
and assets which, il disiupted oi destioyed, would have a seiious impact on the health, salety, secuiity
oi economic well-being ol citizens oi the efective lunctioning ol goveinments` (See luiopean Lnion,
Ciitical inliastiuctuie piotection,` hllp.//euiopa.eu/legislalioh_summaiies/|uslice_fieedom_
secuiily/hghl_agaihsl_leiioiism/l33?59_eh.hlm.).
135
letei Sommei and lan Biown, leducing Systemic Cybeisecuiity lisk, (laiis. OlCD, Z011), hllp.//www.
oecd.oig/sli/fuluies/globalpiospecls/468899??.pdf.
136
lSO/llC Z703Z.Z01Z, lnloimation technology - Secuiity techniques - Cuidelines loi cybeisecuiity,` 11.
137
}ack Coldsmith and Melissa Hathaway, The cybeisecuiity changes we need,` The Washington lost, Z9
May Z010.
while lhe ihdusliy would ieap gieal pioduclivily gaihs, lheie aie a humbei of
seiious uhsolved secuiily cohceihs. loi example, 'smail meleis wilh desighaled
public ll addiesses may be susceplible lo dehial of seivice allacks which could
iesull ih loss of commuhicalioh belweeh lhe ulilily ahd lhe meleis ahd lheiefoie
dehy powei lo homes ahd busihesses.`
138
Thus, a polehlial 'modeihisalioh` agehda
is bioughl ihlo diiecl cohlicl wilh a secuiily agehda.
Deployihg appiopiiale secuiily measuies lo mahage iisk lo ciilical syslems ahd
assels is coslly. The queslioh is. whal aie lhe mosl appiopiiale ahd efeclive secuiily
measuies lo mahage iisk lo ciilical syslems ahd assels ahd who pays foi il? Owheis
ahd opeialois of lhese ihfiasliucluies have lo play ah aclive iole ih dehhihg lhe
slahdaids lhal musl be implemehled lo meel lhe goveihmehl`s mahdale ih assuiihg
essehlial seivices. lhdusliy also may be asked lo make secuiily ihveslmehls lhal
go beyohd whal is iequiied lo meel compliahce ahd iegulaloiy iegimes. The
policy ihleivehlioh lhal a goveihmehl uses lo meel lhe heeds of lhe halioh musl
be caiefully balahced lo heighleh cybei secuiily wilhoul ciealihg baiiieis lo
ihhovalioh, ecohomic giowlh, ahd lhe fiee low of ihfoimalioh.
1.5.3. PrivaIe SecIor vs. PubIic SecIor
A ciilical fealuie of modeih NCS is lhe iole of lhe piivale secloi. ll is iespohsible
foi lhe ieseaich, desigh, developmehl ahd mahufacluiihg of lhe vasl ma|oiily of
soflwaie ahd haidwaie used ih lCT. ll has, ih efecl, become 'lhe` seivice piovidei,
lhe slewaid of lhe ihleihel lhal plahs ahd mahages iesouices, piovides ieliable
cohheclivily, ahd ehsuies deliveiy foi liafc ahd seivices.
Ciilical ihfiasliucluies ahd ihdusliies aie ihcieasihgly lhe piimaiy laigel of cybei
ciime, cybei espiohage, ahd, mosl iecehlly, seiious cybei allack. Theii elecliohic
defehces have beeh puhcluied ahd lhe polehlial cosls of lhese aclivilies aie
cohsideiable. loi example, lhe lhefl of ihlelleclual piopeily (which ihcludes cybei
espiohage aclivily) is said lo have cosl lhe Il ecohomy up lo I9.? billioh ih ?010.
139

Some adveisaiies have ambilioh lo deslioy oi, peihaps woise, delibeialely ihseil
eiioheous dala lo iehdei syslems ihopeiable ahd ihfoimalioh uhusable. The cosls of
lhese aclivilies agaihsl lhe ciilical ihfiasliucluie aie difcull lo eslimale, howevei,
ohe ihdusliy iepoil claimed lhal ih lhe IS 'lhe iepoiled cosls of dowhlime due
138
Melissa Hathaway, lowei Hackeis. The L.S. Smait Ciid ls Shaping Lp to Be Dangeiously lnsecuie,`
Scientihc Ameiican, 5 Octobei Z010, 16.
139
Detica, The Cost ol Cybei Ciime. A Detica lepoit in laitneiship with the Ofce ol Cybei Secuiity
and lnloimation Assuiance in the Cabinet Ofce, (london. Ll Cabinet Ofce, Z011), hllp.//www.
cabihelofce.gov.uk/siles/defaull/hles/iesouices/lhe-cosl-of-cybei-ciime-full-iepoil.pdf.
lo cybei allacks exceed S6 millioh a day`.
140
lh Apiil ?009, lhe Noilh Ameiicah
llecliic Reliabilily Coipoialioh (NlRC) issued a public holice lhal waihed lhal lhe
elecliical giid is hol adequalely piolecled fiom cybei allack. 'facililies, syslems, ahd
equipmehl which, if deslioyed, degiaded, oi olheiwise iehdeied uhavailable, would
afecl lhe ieliabilily oi opeiabilily of lhe Bulk llecliic Syslem.`
141
Some obseiveis
have waihed lhal a seiious cybei allack oh lhe IS elecliical giid could cause 'ovei
S6 billioh ih damages,`
14Z
ahd lhe Commahdei of IS Cybei Commahd said lhal,
belweeh ?009 ahd ?011, allacks oh IS ciilical ihfiasliucluies had 'iiseh ?0-fold.`
143
Coveihmehls have a cleai ihleiesl ih assislihg lhe piivale secloi ih pioleclihg lhe
halioh`s essehlial seivices, weallh ahd giowlh polehlial (e.g., ihlelleclual piopeily
pioleclioh) fiom lhese aclivilies, bul lhe ways ahd meahs of lhis assislahce
is heicely debaled. loi example, some goveihmehls aie choosihg lo iegulale
ciilical ihfiasliucluie piovideis by imposihg mihimum slahdaids foi lechhology
deploymehl, ihleihal secuiily cohliols, ahd disaslei iecoveiy ahd busihess
cohlihuily plahs. Wheieas olhei goveihmehl ihleivehlioh opliohs may ihclude lhe
piovisioh of lax ihcehlives, slimulus giahls, low-cosl oi ho-cosl loahs, goveihmehl
subsidies, ihsuiahce, ahd eveh liabilily pioleclioh. These ihcehlives aie meahl lo
ehcouiage ihdusliy pailicipalioh ih meelihg lhe desiied ihfiasliucluie ob|eclives
- lo be bolh secuie ahd iesiliehl.
lilhei ohe of lhese opliohs usually is suppoiled by ihfoimalioh exchahges, somelimes
also iefeiied lo as lhe piivale-public pailheiship, lhal diaw oh combihihg lhe besl
of bolh paily`s uhdeislahdihg of lhe ehviiohmehl lo suppoil opeialiohal cybei
secuiily. loi example, ih some cases lhis ihcludes poolihg khowledge of laclics,
lechhiques ahd pioceduies used lo piobe ahd successfully bieach coipoiale ahd
goveihmehl helwoiks.
144
Olhei ihfoimalioh exchahges shaie couhlei-measuie
lechhologies ahd soluliohs lo dehy oi ihvesligale lhe cybei peipelialoi.
145
Some
goveihmehls eveh ofei lo help piolecl lheii ciilical ihfiasliucluie diieclly, by
deployihg sehsois ih lhe helwoiks lo (supposedly) delecl lhe mosl advahced
140
Stewait Bakei, Shaun Wateiman, and Ceoige lvanov, ln the Ciosshie. Ciitical lnliastiuctuie in the Age
ol Cybei Wai, (Santa Claia, CA. McAlee, Z010), hllp.//www.mcafee.com/us/iesouices/iepoils/ip-ih-
ciosshie-ciilical-ihfiasliucluie-cybei-wai.pdf.
141
Michael Assante, Ciitical Cybei Asset ldentihcation |lettei to lndustiy Stakeholdeis|, (liinceton, N}.
NllC, Z009), hllp.//www.heic.com/hleIploads/lile/News/Cll-00?-ldehlihcalioh-lellei-040709.
pdf.
14?
}ohn O. Biennan, Time to piotect against dangeis ol cybeiattack,` The Washington lost, 16 Apiil Z01Z.
143
}asmin Melvin, White House lobbies loi cybeisecuiity bill amid woiiies it may stall,` leuteis, 1 August
Z01Z.
144
See Ciitical lnliastiuctuie liotection lnitiative (ClNl). hllp.//www.cphi.gov.uk/aboul.
145
lNTlllOl, lNTlllOl and lCANN advance coopeiation on lnteinet secuiity altei histoiic hist
meeting,` Media lelease, Z3 May Z011.
lhieals.
146
These cah be accompahied by ehcouiagihg lhe developmehls of voluhlaiy
codes of cohducl, ciealihg ieposiloiies of besl piaclices, ahd ehcouiagihg piivale-
secloi ihilialives lo iegulaily lesl lheii syslems` secuiily posluie ahd piaclice lheii
iecoveiy piocesses ahd pioceduies. lach of lhese ihilialives helps build liusl ahd
uhdeislahdihg amohg ahd wilhih lhe pailheiship ahd, peihaps moie impoilahlly,
begihs lo piomole educalioh ahd awaiehess-iaisihg acioss lhe halioh.
While il iemaihs uhcleai lo whal exlehl lhese measuies aclually help piolecl
piivale busihess ahd lhe halioh`s helwoiks, ah equally cohlehlious debale is beihg
waged aiouhd lhe goveihmehlal appioach lo ihleivehlioh ih lhe piivale secloi.
eilhei seekihg voluhlaiy coopeialioh oi 'mahdaled` (i.e., piesciibed by law oi
iegulalioh). Ihdeislahdably lhis ihvolvemehl of lhe slale ih piivale afaiis is a deeply
ideological queslioh ih mahy haliohs. Accoidihg lo ohe ?009 sludy oh luiopeah
Clll piogiammes,
147
of 16 lI Membei Slales examihed, aiouhd half favouied
moie voluhlaiy lhah mahdaloiy piihciples ih lheii piogiammes, appioximalely six
balahced voluhlaiy ahd legal measuies, ahd ohly lwo Membei Slales seemed lo
laigely oi complelely depehdehl oh iegulalioh. ll is howevei veiy likely lhal lhis
humbei has chahged, giveh lhe iecehl luiopeah liehd foi applyihg legislalioh lo
lhe issue.
Mosl haliohs, howevei, agiee lhal cybei secuiily is a shaied iespohsibilily. The
Diiecloi of lhe Il Coveihmehl Commuhicaliohs Headquaileis (CCHQ) iecehlly
aigued lhal il is lhis 'holislic appioach lo cybei secuiily lhal makes Il helwoiks
ihliihsically iesiliehl ih lhe face of cybei lhieals.`
148
He wehl oh lo explaih lhal lhis
ehhahced secuiily posluie would lead lo a moie compelilive, ecohomic posluie foi
lhe halioh.
1.5.4. DaIa ProIecIion vs. !nIormaIion Sharing
Aholhei baiiiei lo iealisihg lhe full ecohomic behehls of lhe ihleihel ecohomy
ihvolves lhe haluial cohlicl belweeh cilizehs` expeclaliohs ahd goveihmehl policy
foi dala pioleclioh ahd pieseivihg piivacy vis-a-vis lhe heed lo shaie ihfoimalioh
acioss bouhdaiies ahd boideis (e.g., goveihmehl lo ihdusliy, goveihmehl lo
goveihmehl, ihdusliy lo ihdusliy) wilh lhe ihlehl lo ehhahce secuiily. lhleipiises
of all kihds iely oh lhe willihghess of cohsumeis ahd busihess pailheis lo ehliusl
lhem wilh piivale ihfoimalioh. These cohsliluehls, ih luih, expecl lhal lhis
ihfoimalioh will slay bolh piivale ahd secuie. Cilizehs expecl pioleclioh fiom
Waiwick Ashloid, BT extends cybei secuiity agieement with MoD,` ComputeiWeekly.com, 4 }uly
Z01Z.
Booz & Company, Compaiison and Aggiegation ol National Appioaches (}lS/Z008/D1/019 - Wl 4)

(Z009). Z8.
BBC, Ll inliastiuctuie laces cybei thieat, says CCHQ chiel,` BBC News, 1Z Octobei Z010.
ihliusiohs by bolh piivale ahd goveihmehlal aclois. lh 1980, lhe OlCD issued a
'Recommehdalioh Cohceihihg ahd Cuidelihes Coveihihg lhe lioleclioh of liivacy
ahd Tiahsboidei llows of leisohal Dala.`
149
The OlCD guidelihes ihluehced
ihleihaliohal agieemehls, haliohal laws ahd self-iegulaloiy policies.
This documehl spaiked discussioh aiouhd lhe woild ahd, ovei lhe hexl lhiee
decades, difeiehl appioaches lo piivacy policy ahd iegulalioh emeiged foi ieasohs
iahgihg fiom ehhahcihg haliohal secuiily lo hegalively impaclihg ecohomic
giowlh. As ohe ihdusliy expeil holed, 'piovidihg seamless piivacy pioleclioh foi
dala as il lows lhiough lhe global ihleihel iequiies a caieful iecohsideialioh of lhe
busihess commuhily`s ihleiesl ih piomolihg commeice, lhe goveihmehl`s ihleiesls
ih fosleiihg ecohomic giowlh ahd pioleclihg ils cilizehs, ahd lhe ihleiesl of
ihdividuals ih pioleclihg lhemselves fiom ihliusive oveiieach by goveihmehl ahd
lhe piivale secloi.`
150
Today, mahy goveihmehls have eslablished piivacy iighls foi
ihdividuals, developed dala pioleclioh fiamewoiks ahd mahdaled piivacy policies
lo pieseive lhis holioh of cohhdehlialily.
Yel, couhleiihg ciime, espiohage, ahd olhei illicil aclivilies ih cybeispace demahds
limely exchahge of waihihgs ahd follow up ihfoimalioh amohg ahd belweeh
piivale ahd public ehlilies, ofleh exchahgihg sehsilive dala lhal may fall wilhih lhe
iemil of lhese piivacy ahd dala pioleclioh laws. A ma|oi example of lhis dicholomy
could be seeh ih luiope, wheie lhe 'luiopeah Dala Relehlioh Diieclive` (lDRD)
151

was ih some ways lhe ohe of lhe mosl cohlioveisial pieces of lI legislalioh evei
passed, ahd ihdeed is slill beihg iesisled by some lI Membei Slales. Compulei
ihcidehl iespohse cehlies ahd ihdusliy ihfoimalioh secuiily specialisls aigue lhal
lhey heed ah ihfoimalioh shaiihg mechahism lhal swiflly deliveis aleils iegaidihg
laclics, lechhiques, ahd pioceduies used lo piobe ahd successfully bieach viclim
helwoiks. loi some couhliies, lhis falls wilhih lhe piivale-public pailheiship
coopeialioh models wheie ihdusliy ahd goveihmehl shaie lhe iespohsibilily
foi secuiily ahd iesiliehce ob|eclives. loi example, lhe Ihiled Slales, lhe Ihiled
lihgdom ahd olhei goveihmehls aie piovidihg acliohable ihfoimalioh ahd ahalysis
iegaidihg cuiiehl lhieals lo lheii ihdusliy. While hol iobusl, lhese ihilialives aie
liyihg lo eslablish bi-diiecliohal ihfoimalioh shaiihg aichilecluies lo acceleiale
bellei uhdeislahdihg oi silualioh awaiehess aboul how ihdusliy oi lhe halioh
oveiall is beihg laigeled, whal ihfoimalioh is beihg losl, ahd lhe melhods lhey
149
OlCD, OlCD Cuidelines on the liotection ol liivacy and Tiansboidei llows ol leisonal Data (laiis.
OlCD, 1980).
150
CDT, Chaptei Thiee. lxisting liivacy liotections,` ed. CDT, CDT`s Cuide to Online liivacy (Washington,
DC. CDT, Z009), hllps.//www.cdl.oig/piivacy/guide.
151
The lDlD was adopted in Z006 and iequiies, among othei things, that all lSls keep theii customei
logs six months to two yeais to suppoit ciiminal piosecution.
4T IreIImInary ConsIderalIons. On NalIonaI Cyber SecurIly
(ihdusliy ahd goveihmehl) cah use lo defehd lheii ihfoimalioh assels, ahd iespohd
lo, ahd iecovei fiom sighihcahl ihcidehls.
Naliohal laws may be ihsufciehl, oh lheii owh, lo piovide cilizehs wilh piivacy
piolecliohs acioss boideis while al lhe same lime allowihg foi lhe limely exchahge
of lhieal ihfoimalioh. This ihheiehl lehsioh lies al lhe heail of lhe cybei secuiily
debale.
1.5.5. Ireedom oI Lxpression vs. PoIiIicaI SIabiIiIy
Recehl hews iepoils have illuslialed how lCT ahd ihhovalive use lheieof cah
ehhahce oi cohsliaih lhe powei of poliliciahs ahd lhe geheial public. loi some,
lCT allows foi widespiead pailicipalioh by cilizehs ih day-lo-day policy decisiohs.
loi example, ih }ahuaiy ?01?, IS poliliciahs faced widespiead ouliage iegaidihg
lhe Slop Ohlihe liiacy Acl (SOlA), a bill lhal was ihlioduced ahd debaled befoie
Cohgiess.
15Z
Oppohehls lo lhe bill slaled lhal lhe pioposed legislalioh lhiealehed
fiee speech ahd ehabled law ehfoicemehl lo block access lo lhe ihleihel due lo
copyiighl ihfiihgihg (ahli-piiacy) cohlehl posled oh web pages oi blogs. Oh }ahuaiy
18, ?01?, Wikipedia, Reddil, Twillic ahd ah eslimaled 7,000 olhei smallei websiles
cooidihaled a seivice blackoul lo iaise awaiehess. The bill was quickly poslpohed
foi cohsideialioh due lo lhis public piessuie. lh Augusl ?011, duiihg lhe lhglahd
iiols, some iioleis used Blackbeiiy Messehgei lo oigahise lheii aclivilies ahd
olheis ulilised Twillei ahd lacebook lo cooidihale cleah-up opeialiohs.
153
Biilish
ofcials used facial iecoghilioh soflwaie wilh social helwoiks like lacebook lo
allow cilizehs lo iepoil iioleis lo aulhoiilies. lh addilioh, social helwoikihg helped
idehlify suspecls ahd appiehehd lhem foi ciimihal damage, buiglaiy, ahd violehl
disoidei. A widei 'ciackdowh` oh social media was haiiowly avoided.
154
lCT ihhovaliohs also iaise piivacy cohceihs because goveihmehls ahd coipoialiohs
cah use 'digilal suiveillahce lechhologies, such as helwoiked webcams, localioh
liackihg, digilal idehlihcalioh (lD) devices, dala mihihg ahd ahalyses of
commuhicalioh liafc ahd seaich ehgihe queiies` lo cieale digilal dossieis of oui
cilizehs.
155
Aclivisl gioups such as Ahohymous, lulzSec ahd Wikileaks, expose
viclim`s dala lo embaiiass oi achieve olhei ob|eclives. Howevei, lhe Ihiled Slales
cohlihues lo push foi equal access lo khowledge ahd ideas acioss lhe digilal
15?
Ned lottei, Wikipedia Blackout,` SOlA and lllA lxplained,` ABC News, 17 }anuaiy Z01Z.
153
BBC, lngland iiots. Twittei and lacebook useis plan clean-up,` BBC News, 9 August Z011.
154
See, loi instance, letei Apps, Analysis. Ll social media contiols point to widei `inlo wai`,` leuteis, 18
August Z011.
155
Waltei S. Baei et al., Machiavelli Conlionts Z1st Centuiy Digital Technology. Demociacy in a Netwoik
Society (Woiking lapei), (Oxloid. Oxloid lnteinet lnstitute, Z009), hllp.//papeis.ssih.com/sol3/
papeis.cfm?absliacl_id=15?1???. 5.
Cohclusioh
fiohlieis of lhe ?1
st
cehluiy. 'This fieedom is ho lohgei dehhed solely by whelhei
cilizehs cah go ihlo lhe lowh squaie ahd ciilicise lheii goveihmehl wilhoul feai of
ieliibulioh. Blogs, e-mail, social helwoiks ahd lexl messages have opehed up hew
foiums foi exchahgihg ideas - ahd ciealed hew laigels foi cehsoiship.`
156
New lechhologies aie beihg used lo chahge lhe oulcomes ih lhe sliuggle foi fieedom
ahd piogiess. The ihleihel cah be co-opled as a lool lo laigel ahd silehce cilizehs
ahd il cah be used lo dehy access lo ahd use of key applicaliohs. loi example,
ih eaily Apiil ?01?, lhe liahiah mihislei foi lhfoimalioh ahd Commuhicaliohs
Techhology ahhouhced lhal liah will held a haliohal lhliahel ahd begih blockihg
seivices like Coogle, Cmail, Coogle llus, Yahoo ahd Holmail, ih lihe wilh liah`s plah
foi a 'cleah ihleihel.` These 'Wesleih` seivices will be ieplaced wilh goveihmehl
ihleihel seivices like liah Mail ahd liah Seaich lhgihe.
157
lh addilioh, duiihg lhe eaily days of lhe social upiisihg lhal ullimalely lead lo lhe
ouslihg of liesidehl Hoshi Mubaiak, lhe lgypliah lelecommuhicaliohs aulhoiily
ieceived ah oidei fiom lhe secuiily seivices lo shuldowh ihleihel access. 88
of lgypliahs losl access lo lhe ihleihel duiihg lhis episode.
158
Olhei slales ih lhe
iegioh (e.g., libya ahd Syiia) implemehled similai measuies lo liy lo maihlaih social
slabilily as lhe 'Aiab Spiihg` cohlihued. While lhe acls of aulhoiilaiiah iegimes
hghlihg foi lheii polilical lives may seem exlieme lo mahy ih lhe Wesleih woild,
whal lhese episodes demohsliale is lhal lhe veiy ihleicohhecledhess lhal people
aiouhd lhe globe eh|oy because of impiovemehls ih lCT cah be swiflly dehied, ahd
lhal fieedom of commuhicalioh ahd polilical fieedom aie cleaily lihked.
1.6. CONCLUS!ON
Addiessihg a halioh`s cybei secuiily heeds is ho easy lask. lhdeed, il is hol eveh
always appaiehl whal lhose heeds exaclly aie, oi whal pioleclihg (oi hol pioleclihg)
a halioh`s cybei ehviiohmehl aclually ehlails. Quile ofleh lheie aie difeiehl ahd
compelihg cohsideialiohs wilhih each halioh`s appioach. Yel each halioh is faced
wilh a sleadily ihcieasihg level of cybei lhieal, ahd lhus iequiies lhe halioh`s
leadeiship lo iecoghise lhe slialegic pioblem ahd sel foilh goals ahd slialegies
lo addiess il. lh lhis seclioh we have dehhed NCS as 'lhe focused applicalioh of
specihc goveihmehlal leveis (which ihcludes bolh ihcehlives ahd iegulalioh) ahd
ihfoimalioh assuiahce piihciples lo public, piivale, ahd ielevahl ihleihaliohal
Hillaiy l. Clinton, lnteinet lieedom |Speech at Newseum in Washington, DC|,` loieign lolicy, Z1
}anuaiy Z010.
Amiutha Cayathii, lian To Shut Down lnteinet leimanently, Clean` National lntianet ln lipeline,`
lnteinational Business Times, 9 Apiil Z01Z.
Chiistophei Williams, How lgypt shut down the inteinet,` The Telegiaph, Z8 }anuaiy Z011.
lCT syslems, ahd lheii associaled cohlehl, wheie lhese syslems diieclly peilaih
lo haliohal secuiily.` As haliohs ahd ihleigoveihmehlal oigahisaliohs sel aboul
developihg ahd implemehlihg measuies lo eslablish NCS slialegies, lhey musl
balahce lhe ecohomic ahd social impoilahce of fiee low of ihfoimalioh lo lhe
secuiily heeds of goveihmehl, ihdusliy, ahd cilizehs. The cohceplual piism sel
foilh ih lhis seclioh is desighed lo assisl ih lhis developmehl ahd debale.

National Cyber Security Framework

Загружено:

Сведения о документе

Исходное описание:

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

National Cyber Security Framework

Загружено:

Авторское право:

Доступные форматы

T IreIImInary ConsIderalIons.

On NalIonaI Cyber SecurIly

lSO/llC Z703Z.Z01Z, lnloimation technology - Secuiity techniques - Cuidelines loi cybeisecuiity.`

lecommendation lTL-T X.1Z05 (04/Z008), Section 3.Z.5.

China has is piomoting inloimationisation development loi economic iestiuctuiing, inliastiuctuie

L.S. }oint Chiels ol Staf, }oint lublication 3-13. lnloimation Opeiations.

}ames lewis, Conhdence-building and inteinational agieement in cybeisecuiity,` Disaimament loium,

NAT!UNAL SLCUR!TY CY8LR SLCUR!TY NAT!UNAL CY8LR SLCUR!TY

Booz & Company, Compaiison and Aggiegation ol National Appioaches (}lS/Z008/D1/019 - Wl 4)

Вам также может понравиться