A group called the Disposable Heroes of Hiphoprisy wrote in their 1992 song The Winter Of The Long Hot Summer a rather scathing rhyme about how an air force plays into industrial “proxy” war:
The pilots said their bombs lit Baghdad
Like a Christmas tree
It was the Christian thing to do you see
They didn’t mention any casualties
No distinction between the real
And the proxy
Only football analogies
We saw the bomb hole
We watched the Super Bowl
If bombing from the sky was the proxy violence of the industrial revolution, shouldn’t we look at hacking from home as the logical next evolution of conflict for the information age? Sure beats trying to engineer smart bombs to make the difficult leap into intelligence.
The Washington Post has profiled one such group calling itself partisans. It was formed in late 2020 and has grown to 30 civilians allegedly in Belarus.
…Cyber Partisans are more akin to a digital resistance movement than a “cyber proxy” like the Ukrainian government-backed “IT Army.” The group does not appear to be acting as an intermediary for another government’s interests, and has a history of independent operations against the government of Belarus. With an extensive online presence, the Cyber Partisans also differ from other nongovernmental hacking efforts supporting the Ukrainian resistance during the war, such as Anonymous or Squad303. Though many Cyber Partisan claims remain unverifiable, the available evidence suggests that this is a small group of closely linked individuals with a strong connection to Belarus. […] “Thousands of Russian troops didn’t receive food, didn’t receive fuel, and didn’t receive equipment on time,” noted Franak Viacorka, spokesman for Belarus’ opposition leader.
Denial of service, which led to denial of service, seems a lot like bombing infrastructure like fields to stop production and distribution even though it’s far less destructive.
Speaking of government-backed action, there’s an interesting note about Russian “militarism” in another article.
…the third month of war finds Russia, not the United States, struggling under an unprecedented hacking wave that entwines government activity, political voluntarism and criminal action. Digital assailants have plundered the country’s personal financial data, defaced websites and handed decades of government emails to anti-secrecy activists abroad. One recent survey showed more passwords and other sensitive data from Russia were dumped onto the open Web in March than information from any other country. The published documents include a cache from a regional office of media regulator Roskomnadzor that revealed the topics its analysts were most concerned about on social media — including antimilitarism…
To be fair the United States is not officially at war, so it makes for an illogical target unless being brazenly drawn in (e.g. Pearl Harbor, which technically would be a destructive kinetic attack not cyber). Russia, however, made itself into such an ugly militant aggressor it’s obvious why it became such a very large target of hacking.
The fact that Russia centers its social media strategy on stopping antimilitarism says a lot. Their incompetence at militarism is impossible to ignore, attracting all forms of resistance. They clearly are losing on every front but most notably hackers around the world easily slice and dice their way through a creaky old and corrupt dictatorship.
All that being said, the NSA says it doesn’t like competition.
“I will tell you that the idea of the civil vigilantes joining in a nation-state attack is unwise, right? I really think it is,” the NSA’s Rob Joyce said May 4 at a Vanderbilt University security summit. “As you pointed out, it’s illegal. But it’s also unhelpful, because one of the things we talked about is we’re trying to get Russia to take account for the ransomware attacks and hacks that come out of Russia and emanate.”
Here we go.
First, just being illegal isn’t the high bar some people want it to be. Laws change because sometimes they’re bad laws. In fact, the act of doing something and showing the logic of it can be the impetus to make it legal.
Second, whataboutism is a logical fallacy even in reverse. The world can still get Russia to account for hacks even if the rest of the world engaged in hacks. It’s also a nuanced question of power balance and authorization, such as saying the police can drive a speeding car to arrest someone for driving a speeding car.
Let me just go even further on this point and say Joyce is the NSA, and NOT the State Department, yet for some reason he tries to jump ship.
“This certainly isn’t going to make the State Department discussions with Russia of ‘you need to hold your people accountable’ any easier,” Joyce said Wednesday.
Thank you for your concern, yet it may be entirely misplaced. Joyce may as well be arguing “we shouldn’t advance nuclear weapons because it isn’t going to make discussions with Russia about nuclear weapons any easier.”
Nonsense.
And it only gets worse in that article when a certain CEO adds his voice to Joyce’s.
Kevin Mandia, CEO of American cybersecurity firm Mandiant, at the same summit said random individuals swaying relationships between countries and dictating foreign policy could be dangerous. “You can’t have the private sector influencing the doctrine between nations,” he said. “You don’t have us fighting on air, land and sea without being deputized or part of a force and with an agenda and a mission plan.”
That seems quite the opposite of a narrative he tried to spin back in October 2021.
The CEO of US cybersecurity firm Mandiant said today that he believes the next big advancement in cybersecurity will be the ability of governments and private companies to work together in a “coordinated national and global response” to incidents — not unlike how he said his firm worked with the government in response to the SolarWinds hack. […] Speaking at the Mandiant 2021 Cyber Defense Summit, the executive disclosed for the first time that he called the NSA right before Thanksgiving last year…
To put it together, Mandia is warning you can’t have the private sector influencing doctrine between nations, right after he boasted about jumping on the phone with the government to tell them he’s already engaged in a fight with another nation… as a civilian.
If Mandia is not an example of a random individual swaying relationships and influencing policy doctrine I don’t know what is. His company was founded on the idea that a government could use a proxy in the private sector to do security work of government, right?
I will never forget officials in the U.S. government telling me how legislation was written very specifically to release millions of dollars to Kevin Mandia, who hired former government staff if you see what I’m saying about why he/they don’t want “random” people competing with them in the market.
Mandia and the NSA sound like they’re heavily invested in what Eisenhower warned us to avoid — a Military-Industrial-Congressional Complex — if we’re interested in achieving cyber peace.
Perhaps the most telling aspect of the debate of who should hack and from where is this anecdote:
The IT army is reminiscent of volunteers who physically traveled to Ukraine and took up arms, despite enormous risks and warnings from officials. But hacking from home — or at least not from the bombarded and besieged locales of Ukraine — offers a sense of safety the frontlines do not.
Sniper rifles offer sense of safety. Airplanes offers sense of safety. Artillery (e.g. the longbow) offers sense of safety. Drones offer a sense of safety… the list of low risk high impact conflict models goes on and on. The question shouldn’t be how unsafe is the hacker at home, but how different is it from any other celebrated advance in battlefield technology.
One gets the sense that the NSA and Mandia as a proxy see themselves as vaulted innovators that somehow are distinct and unique, without really understanding that they’re focused on the wrong metrics.
Invention is easily overrated, and implementation is often underrated.
Hacking from home seems as logical for an implementation as shooting arrows from the woods was in the 1400s (before defensive hardened steel was deployed), let alone planes dropping bombs.
In any case I’d like to see far more feel-good reporting about hackers at home. I mean it seems only fair considering how other civilian volunteers are being depicted.
For about a month now, U.S. Marine veteran Sean Schofield has been sending dispatches back to Cullman, Alabama, from a place few would volunteer to go.
Since late March, he’s been one of more than 6,000 foreign volunteers from the U.S., Australia, the UK and other western countries who’ve left their civilian lives behind and traveled to Ukraine, aiding military personnel and civilian supporters in mounting a sovereign defense against Russian invasion.
It’s like if you can run a fast 100 meter dash through a hail of bullets you’re some kind of hometown hero, but if you can type a few commands on a keyboard to stop those bullets you’re an anti-social vigilante.
