Police don’t need intrusive powers to tackle modern Internet crime – there’s a new paradigm

I’m at the Citizen Lab, an interdisciplinary research facility at the Munk Centre for International Studies, University of Toronto. I am reviewing reports on cyber security. With me is Nart Villeneuve, senior research fellow and chief research officer for our partner company, SecDev.Cyber.

Nart is busy doing what he usually can be found doing: following hunches, deeply engaged in cyber forensic investigations. In his latest work, he has gained backdoor access to track a very large, Russian-operated botnet – a collection of infected computers under the control of an attacker.

No doubt about it, the perpetrators of this botnet are into criminal behaviour. Although it is Russian in origin, the botnet uses control servers in China and manipulates thousands of compromised computers in the United States and Germany (so-called “zombies [http://en.wikipedia.org/wiki/zombie_computer]“) to launch computer network attacks. Russian criminal organizations are known to contract out such attacks to anyone who will pay. We witness a real-time attack against an obscure Russian website, lasting a few minutes.

This botnet also appears to be connected to a massive spam operation that sends out bogus links to gambling, pornography, pharmaceuticals and fake anti-virus software. Nart’s probes uncover directories containing four million recipient e-mail addresses. They are also engaged in widespread “click fraud,” redirecting browsers of infected computers to online ads without the users’ knowledge in order to generate microincome on a massive scale.

In fact, botnets like this one are at the heart of just about every imaginable menacing and serious act of Internet crime, from espionage to child pornography. They are so vexing for law enforcement and intelligence, we are often told, because of the so-called “attribution” problem – the challenge of identifying the perpetrators.

It has become a truism to say the Web facilitates anonymity. “On the Internet, no one knows you are a dog,” went the famous New Yorker cartoon [http://weblogs.mozillazine.org/gerv/archives/2007/images/internet_dog.jpg] – or in this case, a fraudster, terrorist or gangster. Perpetrators can mask their real identities through proxy computers located in foreign jurisdictions, or contract out to third parties who carry out their criminal deeds.

Some have advocated radical solutions to this problem, including the end of anonymity, the requirement for Internet users to have permanent IDs, even the wholesale scrapping of the Internet as we know it. Bills C-46 [http://www2.parl.gc.ca/housepublications/publication.aspx?docid=4008179&language=e&mode=1] and C-47 [http://www2.parl.gc.ca/housepublications/publication.aspx?pub=bill&doc=c-47&parl=&ses=〈uage=e], currently working their way through Canadian parliamentary committees, would require Internet service providers to install new surveillance equipment, collect personal data, retain it for longer periods of time and allow law enforcement and intelligence to see that personal information, in some circumstances without a court warrant. The Privacy Commissioner of Canada and others have raised serious concerns about this.

Although attribution, anonymity, and investigation of Internet crime remain very real challenges, I believe they are not insurmountable and do not require radical infringements on privacy or wholesale alterations to the Internet as we know it. In fact, the Internet itself, and the mass of data it contains, points to the solution.

Shortly after our observations, Nart uncovered a lead to the possible botnet operator: a Russian student registered at Moscow State University. There was no magical sniffing tool or lawful access provisions clearing his way. He simply pieced together bits of seemingly disparate information – a name here, a string of code there, a domain registration, a recurring handle, an e-mail address, all pieced together by searching Google results.

It’s not the first time Nart has done this. In 2008, he uncovered a massive spy network being run through the Chinese version of Skype, and was able to locate, access and archive the control servers behind them using creative Google searches.

Earlier this year, the Information Warfare Monitor (one of our projects with SecDev.Cyber) tracked down Ghostnet [http://www.theglobeandmail.com/news/technology/meet-the-canadians-who-busted-ghostnet/article732409], a massive cyber espionage network infecting 1,295 computers in a 103 countries. Nart provided a critical break in the investigation by Googling a 22-character string collected during field research. It led to one of the poorly secured command server interfaces.

The Information Warfare Monitor is now working on a report about attacks against the websites of prominent Burmese human-rights groups. Many people suspect the attacks are connected to Myanmar’s military regime, but our investigation leads conclusively to a single individual. We even have his picture from his social networking pages.

The reason for such successes are twofold: our methods and the nature of superabundant information in the cyber age.

As university-based researchers and private sector researchers without access to warrants and private information, we have been forced to do more with less. We rely on qualitative, as opposed to quantitative, approaches. We engage in multidisciplinary analysis of data, as opposed to its automated mining. We search for connections between disparate sources of open information, instead of digging through that which is private.

The problem for law enforcement and intelligence today is not the lack of information; it is the deluge of it. The U.S. National Security Agency reportedly sucks up the equivalent of the contents of the Library of Congress every six to eight hours, every single day.

This is an old paradigm, based on methods where information is easy to hide and hard to find. It’s ill-suited to our modern hypermedia environment, which includes more than four billion cellphones around the world, according to the International Telecommunication Union. Many of them are equipped to snap pictures and videos, and upload them instantly to YouTube or Twitter. These images can be geotagged through Google Maps, which now includes street-level images of many major cities.

In other words, who needs more surveillance powers when people willingly monitor themselves? Social networking has brought us the Age of Auto-Surveillance. These are my friends, here is my house, this is the bus I take, here is my dog, this is my e-mail address, here is my phone number, this is my place of work, this is what I like to eat for lunch.

Criminals and terrorists rarely tweet about their crimes, true. But they cannot escape the digital traces and electronic signatures that everyone, even the most determined criminal, now leaves. In the case of the Russian student, it was a user name posted on a hacker forum that was also used as part of a website domain, which then showed up as a prefix on an e-mail address of an innocuous undergraduate essay that was posted online, along with the student’s name.

In a time when every person’s digital life is now turned inside out and electronically dispersed and disaggregated, does it really make sense to think solutions lie in adding to that flood? Law enforcement and intelligence don’t need to sidestep court protections and civil liberties to meet the challenges of cyber crime – they need a new investigatory paradigm.

Ron Deibert is director of the Citizen Lab and a principal with the SecDev Group. He is a cofounder of and principal investigator for the Information Warfare Monitor.

He may sound overly dramatic, until one thinks back to what happened to the tiny Baltic country of Estonia. In 2007, for a period of two weeks Estonia’s Web sites were hit by so many bogus requests for information that its sites crashed.

The Internet warfare broke out amid a furious row between Estonia and Russia over the removal of a Soviet war monument. While Russia may be considered a superpower, Hamdoun Toure says in a cyber war, there is no such thing as a superpower.

“Every citizen on this planet is a potential superpower and, it will be unfortunate if we have to fight the next fight in the cyber space,” he said. “And, we know from the conventional wars today that the best way to win a war, any war, is to avoid it in the first place.”

A couple of months after the cyber attack paralyzed Estonia’s Internet, the ITU announced an ambitious two-year plan to curb cyber crime. As part of that effort, the ITU teamed up with a Malaysian company called IMPACT to come up with a system to help nations and their citizens prevent, defend and respond to cyber threats.

The result of this collaboration is the so-called Global Response Center, which is demonstrated here at Telecom by Technical Advisor for IMPACT, Mohammed Shihab.

“The Global Response Center has two functions,” he said. “Function one is an early warning system. Now what an early warning system means is that all the global threat intelligence is brought to us on a near real time basis. We collate all this information and we let all member countries have access to this information.”

The second function is called ESCAPE.

“Once you detect an attack, what you do is you access the ESCAPE part of the Global Response Center,” said Shihab. “So from here, the analyst will be able to identify that if a country has raised a particular issue, you look at the network trends and then you look at the attack scenarios, find out where the concentration of these attacks are and then getting the experts to help a country solve these problems.”

The ITU reports there are more than one billion Internet users in the world today. It says the number of crimes committed in cyber space is increasing at an alarming rate. And, it says, the cyber criminals are becoming more sophisticated in their tactics.

ITU officials say the days of the teenage hacker accessing the Web sites belonging to the White House or Pentagon for fun are receding. They say billions of dollars can be made in cyber space. Criminal gangs know this and are going where the money is.

“The next world war could happen in cyberspace and that would be a catastrophe. We have to make sure that all countries understand that in that war, there is no such thing as a superpower. … Loss of vital networks would quickly cripple any nation, and none is immune to cyberattack. … The best way to win a war is to avoid it in the first place.”

Hamadoun’s observations on the likelihood of a global World War III, provided via the Agence France-Presse, may be a bit tardy, according to a West Point officer charged with training the next generation of Army officers on cybersecurity.

U.S. Army Lt. Col. Gregory Conti, an academy computer science professor at the U.S. Military Academy, said cyberwarfare isn’t as evident as a conventional war, but it’s just as real. In an interview I conducted for one of our podcasts, Conti said:

“I personally believe – cyberwarfare cold war, for sure – a full-out cyberwarfare war is ongoing now. Major companies that are being attacked aren’t really talking about it, but it’s going on. Information is being stolen, machines compromised; attacks are occurring on an incredible scale right now.

That’s why every West Point graduate who enters the military must take at least two cybersecurity courses, regardless of the cadet’s major, and IT security is integrated into the curriculum of nearly every computer science course taught at the academy.

But training young military officers in cyberwarfare might not be sufficient. In the interview, and in an article he co-authored, Conti proposes the establishment of a fourth military branch, a Cyberspace branch, to complement the Army, Navy and Air Force in defending our nation and interests. From the article, co-written with Army Col. John “Buck” Surdu:

“Adding an efficient and effective cyber branch alongside the Army, Navy and Air Force would provide our nation with the capability to defend our technological infrastructure and conduct offensive operations. Perhaps more important, the existence of this capability would serve as a strong deterrent for our nation’s enemies.”

But will a strong deterrent work in a world – a cyber world – where you not only can’t see the enemy, but don’t know where he or she is hiding? It must.

“The next world war could begin in cyberspace,” warned Hamadoun Touré, secretary general of the International Telecommunication Union, the United Nations agency that organized the event.

The beginnings of such an unconventional war could be out of the control of conventional diplomacy, he said, because in cyberspace “there is no such thing as a superpower: Every citizen is a superpower.” With an army of “bots,” or compromised computers, at their command, almost anyone could wield great power in a virtual battle, as a number of recent denial-of-service attacks against targets around the world have shown.

“We know from conventional wars that the best way to win is not to start,” Touré said.

That’s why the ITU is pushing an ambitious worldwide program for cybersecurity and peace.

“By the end of next year, we will broker a global agreement with every country to protect its citizens online, not to harbor cyberterrorists, and not to start an online attack,” he said.

U.N. Secretary General Ban Ki-moon began by expressing his sorrow at news of an all-too-real attack, the suicide bombing earlier in the day of the Islamabad, Afghanistan, office of the U.N. Food and Agriculture Organization, which left several people dead.

Returning to the theme of the conference, he highlighted “a world divided,” those with access to information on one side, and those without on the other.

Encouraging the participation of “our youth, drivers of innovation and change,” is vital if those divisions are to be eradicated, he said.

Investment in infrastructure and services must be encouraged too in order to eliminate the technology divide — but the motive should be profit, not charity, Touré said.

“In our strategy of connecting the world, we have no need for charity: It’s pure business. If you have the right business plan, you will have investment,” he said.

The telecommunications industry will always have investment, because it’s a profitable industry, he said.

That’s turning out to be the case in Rwanda, said President Paul Kagame, where state infrastructure projects have attracted investment from Chinese network equipment manufacturers.

“The availability of capital for everything is getting more and more scarce, but in our country there is a strong partnership between public and private sectors,” he said.

China continues to invest internationally, despite the impact of the global economic crisis and the attraction of the untapped potential of its home market, said Wang Jianzhou, chairman and chief executive officer of China Mobile, also present at the news conference.

“We have still got challenges from the international financial crisis,” he said. In the company’s home market, revenue from international calls is down 20 percent because of a reduction in tourism and manufacturing exports, he said.

23 September 2009 – The importance of bolstering international cooperation to combat the rising tide of cyber-crime across Asia and the Pacific was underlined by participants of a regional United Nations information and communications technology (ICT) gathering that kicked off in India today.Bringing together 120 participants from 19 countries throughout the Asia-Pacific region, the UN International Telecommunications Union (ITU) forum in Hyderabad aims to reinforce collaboration and development of a harmonized approach to protecting people against the growth of criminal activity on the Internet.

Sami Al Basheer Al Morshid, an ITU Director, noted the progress already made in global collaboration through the signing of an agreement between the agency and the International Multilateral Partnership Against Cyber Threats (IMPACT) last year.

The agreement with IMPACT makes state-of-the-art cyber-security measures and early warning systems available to 30 ITU member States.

“These services allow countries to prepare themselves against cyber threats, while at the same time ensuring coordination and cooperation at the national and international levels,” said Mr. Al Basheer.