Nations' response to cyber attacks 'will set global norms'

How US tackles alleged hacking by Russia will set precedent, says cyber security expert

Mr Kanuck says the US' response to the alleged hacking of e-mails by Russia, and Russia's subsequent reaction may well be a defining moment in how states deal with other states when it comes to cyber warfare.
Mr Kanuck says the US' response to the alleged hacking of e-mails by Russia, and Russia's subsequent reaction may well be a defining moment in how states deal with other states when it comes to cyber warfare. ST PHOTO: DESMOND WEE

In the lead-up to next week's United States presidential election, there have been hackings of sensitive US computer and e-mail systems.

There is no question about who is behind them - at least not to the US intelligence community, which has unequivocally fingered Russia as the one behind stolen e-mails linked to politicians and the Democratic National Convention.

But the question is, how will the US respond to these attacks?

That and how Russia will in turn react may well be a defining moment in how states deal with other states when it comes to cyber warfare, a visiting US cyber security expert told The Straits Times in an interview.

"I'm a very avid spectator and curious to see how it plays out, because, however this does play out, it will set the bar for de facto cyberspace norms between states," said Mr Sean Kanuck, who was until this May the most senior cyber security official at the US Office of the Director of National Intelligence. Before this, he spent a decade in the Central Intelligence Agency.

"If the United States responds, do they respond publicly, or do they respond secretly in a way that only Russia receives the message? And if the United States does respond, does Russia counter-respond?" he asked.

"This will be a very interesting example to see how things play out, and it will set a precedent for other countries in the future," said the 45-year-old lawyer, who was here last week as a distinguished visiting fellow at the S. Rajaratnam School of International Studies' Centre of Excellence for National Security.

While there are broad-brush international agreements on fighting cybercrime such as a G-20 leaders' communique last year which affirmed that international law applies to the conduct of states in cyberspace, "real progress" in this area will be measured by what happens in reality, said Mr Kanuck.

As cyber attacks continue to be perceived by states as low-cost and low-consequence, "this type of conflict remains desirable and countries try to do what they can and get away with it", he said.

And like a company that has been hacked, a state might not want to own up to being attacked as this might reveal their cyber capabilities, defence vulnerabilities and intelligence-gathering methods.

Mr Kanuck drew a parallel between countries' thinking on cyber issues today to strategic nuclear thinking in the early 1950s. "We're all now highly aware of the incredible impact and influence that these technological capabilities can have, but we haven't worked through the strategic relationships or found the way towards a strategic equilibrium yet," he said.

As the international community continues searching for a cyber security architecture that works, it has to work out two elements that proved essential in formulating a global pact at the dawn of the nuclear age: the rules have to be transparent and apply to everyone regardless of each country's cyber capabilities; and the penalties have to be enforceable and serve as an effective deterrent.

"In the nuclear Cold War model, it took us a few decades to find that balance, and it was an imperfect and uncomfortable balance," he said. "But during the 70s, you started to see these treaties where you get some degree of cooperation out of mutual self-interest. We're not there yet in cyberspace."

Join ST's Telegram channel and get the latest breaking news delivered to you.

A version of this article appeared in the print edition of The Straits Times on November 05, 2016, with the headline Nations' response to cyber attacks 'will set global norms'. Subscribe