Keeping Cyber-attacks At Bay Calls For Whole-of-Society Commitment BA Hamzah

The Ministry of Defence Malaysia issued a statement on 17 May 2021 on the Armed Forces’ state of readiness to combat possible intrusions by hackers and rouge perpetrators. In an increasingly digital interdependent world, where digital devices are connected to the internet, criminals will always be probing for weak links in the integrated -computer network, to exploit vulnerabilities in the cyber space, to extort money, for example. Likewise, rogue states will exploit any vulnerabilities to test the defence capabilities of their competitors and to use the information to gain strategic advantage in times of crisis.

Hackers will always try to breach the security codes of digital devices where competitors keep their national data on defence, for example, are kept. There were a few incidents of cyber-attacks in Malaysia, which the Government played down. A person familiar with the cyber-attacks told me in confidence that a response would compromise our security!

Such defensive strategy would encourage more attacks. The Government must think of a more proactive strategy to deal with cyber-attacks. Cyber security calls for everyone in the country to be vigilant with the way we use computers and digital devices. According to experts, ninety percent of data breaches are due to negligence that can be prevented with better security training and enforcement oversight.

We need to develop a strong security culture and awareness at homes, schools, and workplaces. Maintaining a high-level cyber security in Malaysia calls for total vigilance, a whole-of-society and a whole-of-Government commitment.

Many states are now proactive in the cyber domain. While they take effective measures to prevent intrusions, they also dismantle the activities of hackers. Some states have no qualms in destroying targets of their respective competitors. For example, the US used cyber weapons to disable the Iranian maritime operations in the Gulf of Hormuz in June 2019. The attack on the computer network of Iran was an immediate response to the downing of the US Global Hawk surveillance drone by an air- to- air missile in the Gulf of Hormuz. Like Israel, Iran is known for its cyber espionage activities.

Few countries in the world have water-tight defense mechanisms against cyber-attacks, which happen every thirty-nine seconds in the US. The recent attack in May 2021, by a group of criminals from Russia and eastern Europe on Colonial Pipeline, the company that supplies oil and gas to the eastern board of the United States was just the tip of an iceberg. The Company paid US $4.4 million to restore the operations.  WannaCry, Petya and Bad Rabbit are recent ransom ware attacks which succeeded in extorting money from various companies, health, and educational   institutions. In May 2017, WannaCry malware did manage to infect the computers in more than 150 countries and put them out of action for weeks. One month later, Petya caused extensive damage to the computer systems in Ukraine and infected other countries around the world including some oil companies. According to one source, ransomware is fast becoming a US billion-dollar criminal industry.

Of course, the world is familiar with the Stuxnet malware (purportedly from Israel and the US) and its variants that destroyed the centrifuges in the Iranian nuclear facility at Natanz, not once but three times, since 2010. The updated versions of the malware have been used to destroy water treatment plants, power plants and pipelines carrying gas and oil any other critical national infrastructure. The shipping company such as Maersk and a Taiwanese electronic manufacture were attacked and ransom sought.

During the most recent conflict (September- December 2020) between Armenia and Azerbaijan over the disputed Nagorno-Karabakh region, besides cyber space intrusions, both sides employed artificial intelligence enabled unmanned aerial vehicles like “loitering munitions”. Fitted with cameras, these UAVs ‘loiter’ in the air for a specific amount of time, to gather and relay intelligence to troops on the ground. They can also act like the modern-day suicide bombers by self-detonating themselves to destroy targets.

As lethal autonomous weapons, these suicidal UAVs tend to favour the attackers more than the defenders. It gives the wrong impression that those who dare will win the war in the cyber domain.

The Israeli forces used unmanned drones to drop tear gas canisters on Palestinians protesting around Al Aqsa Mosque in May 2021, to avoid face- to -face confrontation, during the recent crisis with Hamas. In Estonia and Georgia in the previous decade, cyber-attacks put both states out action for weeks when their computer network systems and the digital infrastructure containing critical national data were compromised by an external party. Exactly who was behind the attacks was never known. Both governments blamed Russia but Moscow denied involvement.

In 2015 and 2016 Russian hackers caused blackouts in Ukraine.

Those are examples of the growing use of artificial intelligence to cripple potential antagonists. This potential for havoc has stirred concern in world capitals over cyber and lethal autonomous weapons. It is described in a chilling report by the United States National Security Commission on Artificial Intelligence (UNSCAI).

Some irresponsible parties have used AI weapons to interfere with global navigational/positioning systems.  GPS signals that guide airliners have experienced jamming and interfered with the normal working or functionality of the GPS. Apparently, the jamming can be done by novices without sophisticated technology. Not only ships and airlines are dependent on GPS for direction, other systems like electric grids and the stock market depend on GPS signals for their operations.

There have been cases of GPS spoofing or falsifying data to gain illegitimate access. According to one source, more than 20 ships in the Black Sea reported problems with their GPS signals in 2017. Similar incidents have taken place in Shanghai (China) and Saint Lawrence Seaway (Canada). Recent spoofing incidents in the Mediterranean Sea and elsewhere have caused ships to suddenly lose GPS signals and compromise their locations. Vessels are known to have accidentally strayed into marine protected areas and violating local rules as result of a failure in the navigational systems.

AI technology is key in cyber warfare. These autonomous weapons can also be used together with other cyber weapons as force multipliers. More significantly, AI can be used to control autonomous tools like drones and navigation satellites as well as for offensive purposes. Scientists fear that in the absence of regulations to curb their deployment in the cyber domain can result in undesirable outcomes for human society.

Among those who feared the over development of the artificial intelligence was the late Stephen Hawking. He was worried that artificial intelligence could surpass human intelligence that “thinking machines could one day take charge” which could imperil humanity. The current debate revolves around the ethical standards in the application of AI in the hands of rogue states, for example. New international rules on how governments use autonomous weapons including subjecting them to International Human Right Law are urgently needed.

Staying ahead in the space domain-both outer and cyber- calls for continuous updating of the systems’ capabilities, especially in AI. This requires agility and investments that favour those with deep pockets. Regulating the uses AI weapons and cyber-space weapons will go a long way in advancing global peace.

Defence against cyber-attacks requires a holistic approach. It must be a whole-of-society commitment and a whole-of-nation engagement. Everyone must play a role to achieve a minimum national cyber resilience. This means everyone must get involved in preventing, detecting, and defeating cyber-attacks to ensure economic and political survivability.

BA Hamzah is a keen student of geopolitics.