Law & Disorder —

UK “cyber strategy”: Stuxnet, censorship, and cyber-specials

The UK government has announced a "cyber strategy" outlining its plans to make …

London Bridge (Tower Bridge) : Reflection on the River Thames

On Friday, the UK government released its "Cyber Security Strategy," acknowledging the importance of the Internet to modern life, but also the risks it poses from criminals, terrorists, and nation states. Over the next four years, and at a cost of £650 million ($1 billion), the National Cyber Security Programme (NCSP) has four objectives: "tackle cyber crime," make the UK more resilient to "cyber attacks," create an open and stable "cyberspace," and ensure that the UK has the skills and knowledge to provide all "cyber security" needs.

In a document that unironically uses the word "cyber" more often than a mid-90s AOL chatroom, a wide range of future actions are described. Some are unremarkable common sense—helping educate Internet users about best practices such as keeping anti-malware software up-to-date, allowing crimes to be reported online in 15 minutes or less, working to ensure that critical infrastructure is robust, and so on.

But a few are more surprising. A new group to be formed within GCHQ, the UK's signals intelligence and information assurance agency, will "develop new tactics, techniques and plans to deliver military effects, including enhanced security, through operations in cyberspace." The UK will take a "proactive approach to tackling cyber threats and exploiting the cyber environment for our own national security needs."

In promising to undertake aggressive, military cyberattacks, the UK will be following in the footsteps of the US and Israel—together the presumed creators of the Stuxnet worm—and China, a nation regularly accused of infiltrating and compromising both private and government organizations to extract information.

Such measures might also be used for law enforcement, rather than national security, measures: NCSP will "use cyber techniques to disrupt other types of organised crime." The British judiciary earlier this year ordered an ISP to censor the Internet to block access to a Usenet search engine: such actions could become the norm as UK law enforcement seeks to act against criminals it has no jurisdiction over.

The strategy's plans for Internet users also raise eyebrows. Though the EU is no fan of Internet filtering, most UK Internet access is subject to censorship, through the "voluntary" (but not really; ISPs have been threatened with legal compulsion if they don't implement the system), ineffective and routinely problematic Cleanfeed.

The government wants to extend these restrictions on Internet usage by developing technology to enforce a range of prohibitions and restrictions applied to suspected and convicted criminals. The Home Office and Ministry of Justice will investigate "cyber-tags," which are "triggered by the offender breaching the conditions that have been put on their internet use, and which will automatically inform the police or probation service."

The conditions applied to UK Internet users range from broad bans on Internet usage—alleged LulzSec member Ryan Cleary is subject to such a ban as part of his bail terms—to more specific restrictions, such as barring convicted fraudsters from offering goods for sale online. Enforcement of such restrictions will require extensive invasive monitoring of Internet usage, and is unlikely to be limited to those convicted of any crimes.

To help establish the necessary skills to do this, the government wants to recruit "cyber-specials." Police forces in the UK already use "Specials"—15,000 part-time police officers, sometimes paid, sometimes not—to augment their numbers. The Metropolitan Police's Police Central E-crime Unit (responsible for the arrest of, among others, Ryan Cleary) already uses Specials with relevant computer skills. Expanded use of these specialist Specials will give police forces a greater ability to respond to computer crime.

You must to comment.