By Dr. Kim-Kwang Raymond Choo.
In our increasingly interconnected world, threats to our national (and cyber) security can come from unexpected sources and directions. This is what one may label as a 360-degree challenge and the threat landscape is extremely fast-moving. Cyber threats are increasingly important and strategically relevant in both developed and developing countries. In Australia, the then Prime Minister Kevin Rudd in his inaugural 2008 National Security Statement to Parliament acknowledged that cyber threats now form one of the country’s top tier national security priorities. More recently on 31 May 2011, the Minister for Broadband, Communications and the Digital Economy, Senator Conroy, announced a new Digital Economy Strategy committing to enhancing “Australia’s productivity, maintain our global competitiveness and bring about tangible social wellbeing improvements”. Another statement jointly issued by Australia’s Federal Attorney General, Minister for Defence and Minister for Broadband, Communications and the Digital Economy announced the commissioning of a Cyber Security White Paper “to maximise the benefits of the digital economy, build Australia’s digital future and support Australia’s national security”. All three senior ministers emphasized that it was necessary to examine ‘Australia’s enduring priorities in the cyber environment’.
The Australian Government Defence Signals Directorate, for example, indicated that the number of reported incidents of malicious cyber activity targeting Defence networks has been on the increase since 2009 – a total of 5,600 cyber incidents targeting Defence networks were detected in the first six months of this year compared to a total of 8,400 and 2,400 cyber incidents detected in 2010 and2009 respectively. Earlier this year, the parliamentary computers of at least ten Australian Federal ministers, including the Prime Minister, Foreign Minister and Defence Minister, were reportedly compromised. It is evident that cyber threats are seen as one of the top issues in crime and national security today, and an increasingly challenging policy area for governments.
Cyber crime is not a victimless crime, and has both short and long-term impacts on those victims. It affects the daily activities of individual end users (for example their ability to receive up-to-date information and carry out financial transactions such as with drawing cash from ATMs). Businesses can experience significant financial and other losses, such as exposure to lawsuits and increases in operational costs. Governments are affected by national security breaches (such as the incident in 2010 where classified/confidential government information was leaked to Wikileaks), and by social discontent and unrest (such as loss of public confidence in the government even if the actual damage caused by the cybercriminal activities was minimal). Cybercrime can also result in the loss of intellect property, which can in turn affect the long-term competitiveness of businesses and governments where industrial and military espionage is a factor.
End User Complacency
Most of us, as individual ICT end users, tend to underestimate how valuable our personal information such as login credentials to social networking sites is. Many of us may not understand the risks and do not perceive cyber crime as a real threat. For example, one might think “Why would cyber criminals target me? I’m a nobody”. Many of us have no idea of the value of our collective identities to criminals, who can sell them to the highest bidder. As individual ICT end users, we need to take measures to protect ourselves online, otherwise we are easy targets to even the less sophisticated cyber criminals.
The escalating complexities of the end-user online environment underscore the need for constant and ongoing training programs for basic online security, and promotion of a culture of security for information systems and networks among end users, businesses and government agencies. Such initiatives would enable end users to maintain current knowledge of the latest cyber crime activities and the best cyber crime prevention measures available. Coordinated action by government agencies, researchers and the private sector can also help to ensure the most effective cybercrime prevention advice is provided to the community; this was a recommendation of the Australian Government’s House of Representatives Standing Committee on Communications in its 2010 report on cyber crime.
A Comprehensive Solution
Technical solutions can provide effective protection against security threats, but alone cannot provide a comprehensive solution. When approaching cyber security issues we need to be creative and flexible. If we are to build a resilient cyber space, we need a robust regime that identifies individuals who can make important decisions, factors that will encourage a culture of security, innovation and information sharing; which in turn leads to the formulation of policies and building of technologies that provide us with a safer cyber environment.
An open nation cannot shut down its cyber systems in the face of security threats. Instead it must build the national resilience needed to maintain an open yet secure cyberspace. Governments cannot work in isolation and a majority of the critical infrastructures sectors – perhaps, with the exception of communist nations such as China – are privately owned. The success of the society in overcoming existing security weaknesses, and delivery methods having significant penetration will depend upon close partnerships with consumers, businesses and governments and stronger and more proactive leadership by governments, businesses and research institutions. It is, therefore, essential for governments, businesses and research institutions to innovate faster than criminals and other actors with malicious intents. It is, therefore, welcoming that the Department of the Prime Minister and Cabinet’s new discussion paper titled “Connecting with Confidence: Optimising Australia’s Digital Future” seeks to engage, gather and encapsulate input from all Australians on issues such as cyber crime, online security and privacy, protection of intellectual property and public private partnership.
The United Nations Office on Drugs and Crime–International Telecommunication Union (UNODC–ITU) “Asia-Pacific Regional Workshop on Fighting Cybercrime” was held in Seoul, Korea in September 2011. At the workshop, Gary Lewis, UNODC Regional Representative for East Asia and the Pacific, pointed out that “Cooperation between law enforcement agencies and with the information and communication technology (ICT) sector is essential. Let us not forget that in fighting [organised criminal] network, we ourselves also constitute a network. It may sound corny to say this, but it takes a network to defeat a network.”
Where To From Here?
During the workshop, views on current and future issues in cyber security and resultant cyber crime were collected from over 60 industry experts, ICT security specialists, public prosecutors and other representatives from 20 Asia-Pacific countries. The meeting recognised that participating countries are at different stages of development in countering cyber crime but identified the following imperatives for all:
- the criminalisation of cybercrime including conventional crimes facilitated by electronic means
- top level political commitment to support counter-cyber crime efforts
- cooperation and coordination among different stakeholders at the international, regional, and national (public-private entities) levels
- regional and international consensus and standards regarding cyber crime and digital evidence gathering
- emphasis on education and prevention of cyber crime.
The meeting agreed that as a first step, countries should be encouraged, where needed, to elaborate and undertake a comprehensive assessment of cyber security and cyber crime at the national level. For countries that are at the start of their response to the threat posed by cyber crime, a holistic approach should be adopted encompassing:
Capability building – by ensuring necessary training for all relevant law enforcement officials, prosecutors, judiciary, policy makers, regulators and technical organisations
Establishing the legal framework – focusing not only on criminalisation of cybercrime but also enacting laws on procedure, evidence, mutual legal assistance and extradition and reviewing existing laws to ensure applicability to the information society
Cooperation – building partnerships between stakeholders such as those in the policy making and regulatory authorities, criminal justice system, private sector and civil society to effectively combat cybercrime; and building regional and international cooperation mechanisms between national law enforcement and prosecutorial agencies while leveraging and strengthening existing cooperation frameworks (for example Interpol’s 24/7 network)
Public awareness – giving due emphasis to educating service providers and users thereby preventing cyber crime.
For countries that have a longer track-record of efforts to counter cyber crime, in addition to the above, their response should undertake legislation and capacity review to ensure countermeasures to the newer threats such as identity theft, online child sexual abuse and exploitation and content crime (such as hate speech).
Regardless of their stage of response, countries should pursue a multi-disciplinary approach at national level comprising of all relevant stakeholders dealing with legal, law enforcement, forensics, policymaking, industry, education and civil society. This should include developing capability for rapid response to coordinated cyber attacks (for example Computer Incident Response Teams)
Countries are encouraged to utilise technical assistance from international organisations with relevant expertise such as UNODC, ITU and Member States as well as other relevant players based on their own assessed needs. Furthermore, in order to promote consistent approaches against cybercrime, consideration should be given to building consensus on global cyber crime response, legislation and best practices in an appropriate form (such as a global agreement, and model law or code of conduct).
A Full list of references is available on request from editorial@australianmediagroup.com
Dr. Kim-Kwang Raymond Choo, a 2009 Fulbright (DFAT Professional) Scholar, is a senior lecturer at the University of South Australia. He presented as an invited expert at the United Nations Office on Drugs and Crime–International Telecommunication Union (UNODC–ITU) “Asia-Pacific Regional Workshop on Fighting Cybercrime” from 21st to 23rd September 2011 in Seoul, Republic of Korea. The Workshop was supported by the Korean Supreme Prosecutors’ Office (which hosted the meeting), the Korean Institute of Criminology and the Korean Internet Security Agency.
