Hacktivism and the Government of British Columbia Prepared by: Morgan Beach Client: Information Security Branch, Office of the Chief Information Officer, Government of British Columbia School of Public Administration University of Victoria 2012 Disclaimer Although intended for an academic and professional audience, there are instances within this report where explicit language is used. The inclusion of this language is not gratuitous, and is meant to accurately reflect the realities of hacktivist culture. It is by no means the intent of the author to offend any readers, and the use of any explicit language is used simply to provide context to this report’s discussion. Hacktivism and the Government of British Columbia i Acknowledgements I would firstly like to extend a gracious thank you to Stu Hackett, without whom I would not have had the opportunity to write this report. His support over the last several months has been incredible. I would also like to thank Dr. James MacGregor and Dr. Henry Lee. Their encouragement, guidance, and expertise throughout the writing of this report has been beyond words, and I am truly grateful. Hacktivism and the Government of British Columbia ii Executive Summary Objective The British Columbia (BC) government’s Information Security Branch (ISB) is responsible for establishing information security governance in BC, implementing information security policies for the Province, and promoting security awareness amongst the Province’s employees. As such, the ISB has an interest in reviewing the information security environment for emerging threats. One such potential threat is hacktivism, which has become increasingly prominent over the last few years. As a proactive measure, the purpose of this report is to analyse current trends within hacktivism and assess the likelihood that the BC government may be an attractive target for hacktivists. The key research question for this report is: in consideration of current trends within hacktivism, to what extent may hacktivists consider the Government of BC an attractive target? Methodology In order to achieve the objectives of this report, the environmental scan methodology was used. The environmental scan methodology is a useful tool for improving organizational knowledge, and operates as an early warning system for potential threats that may exists in the external environment. For the purposes of this report, the environmental scan approach provides an effective method for reviewing and analyzing hacktivist threats to the BC government that may exist. A range of data sources were used throughout the development of this report. Sources included academic journal articles, books, online magazines and news articles, blogs, government websites, and information made available by information security practitioners. Key Findings Because of the confrontational tactics that hacktivist use, coupled with the ambiguity about what hacktivism denotes, there is a great deal of disagreement amongst academics and security practitioners about what in fact constitutes a hacktivist attack. For the purposes of this report, hacktivism may be understood as the act of committing a cyber attack for the purpose of protesting, or drawing attention to, a social or political issue; without the intent to obtain financial benefit or grievously harm the target. There are a number of groups today that are quite prominent within hacktivism, as defined by this report. These groups include the Anonymous collective, LulzSec, AntiSec, TeamPoison, and the People’s Liberation Front. Of these groups, the Anonymous collective is perhaps the most public and well-known. Some of the tactics used by these groups to commit cyber attacks may include website defacements, website redirects, distributed-denial-of-service (DDoS) attacks, and unauthorized data releases. Techniques to carry out these attacks include brute force attacks, SQL, pronounced sequel, and cross-site scripting (XSS) injections, and the use of programs to automate DDoS attacks. Interestingly, there is a great deal of uncertainty about whether or not Hacktivism and the Government of British Columbia iii instances of hacktivism are in fact increasing. Speculative statements and overstated findings have all contributed to this ambiguity. When hacktivist attacks do occur, it appears that they are triggered by changes to the status quo, or perceived instances where people’s rights and freedoms have been infringed upon. However, it is unclear why hacktivists have engaged in certain issues, while neglecting others. Nevertheless, many hacktivists have articulated a willingness to target government bodies in particular. The desire to target government organizations may come from their high profile in society, a general disdain for government bodies, or the view that all governments are intrinsically corrupt. Implications of successful hacktivist attacks may include public embarrassment, a slight to an organization’s reputation, and costly data breaches. The overall effect of hacktivist attacks appears to depend upon the type of organization that is targeted, the tactic used to commit cyber attacks, and what, if any, information is compromised as a result of the attack. Interestingly, recent studies have suggested that the financial costs associated with data breaches may be decreasing. Nevertheless, hacktivist attacks can have an impact upon both the targeted organization and the individuals who have entrusted an organization to manage their private information. Looking at recent instances of hacktivism, there appear to be a number of recurring themes that have triggered hacktivist attacks. As such, hacktivist attacks can be understood as typically aligning with one of seven categories: privacy concerns; perceived instances of censorship; alleged corruption; elections; wrongdoing on the part of law enforcement; retaliation for arrests of alleged hacktivists; and general contempt. Drawing upon this analysis, there appear to be issues within BC that could trigger hacktivist attacks against the BC government. Examples include censorship surrounding the Enbridge Northern Gateway Project review process, the perception that the BC government is a corrupt institution, the upcoming 2013 BC provincial election, the behaviour of law enforcement officers in BC, and general contempt for the BC government. Despite this observation, there is nothing at this time to suggest that hacktivists have any intent to launch attacks against the Government of BC. While the reasons for this are not clear, it is possible that the BC government is simply not considered to be an attractive, deserving, or interesting target. Nevertheless, there is still the potential that hacktivists could target the Government of BC in the future. By affording proper consideration to the on-going contentious issues in BC, and recognizing the types of issues that have stimulated hacktivists, it is expected that the BC government will be better prepared to anticipate and mitigate the likelihood of successful hacktivist attacks in the future. Regardless of whether or not the BC government is in fact facing impending attacks from hacktivists, it is essential that the BC government is proactive in its efforts to protect its information management (IM) and information technology (IT) infrastructure, and thus all information under its custody. The best security practices presented in this report include: investing the time and resources needed to regularly audit servers and conduct penetration tests of IM/IT systems; patch systems when vulnerabilities are discovered; develop a system for Hacktivism and the Government of British Columbia iv classifying sensitive information; establish clear policies for how sensitive data should be managed; do not store sensitive data on public servers; encrypt all sensitive and private information; establish measures for mitigating the effects of DDoS attacks; establish requirements for strong passwords; temporarily lockout user accounts after predetermined number of failed login attempts; and make usernames more complex. The inclusion of these best security practices in this report however does not imply that the Province does not already have some or all of these practices in place. Conclusion While there may be issues in BC that could stimulate hacktivists into targeting the BC government, there is nothing at this time to suggest that there are any impending hacktivist threats to the Government of BC. By continuing to regularly review instances of hacktivism, and remaining cognizant of the policies and activities that could trigger hacktivist attacks though, it is expected that the BC government will be much more prepared to anticipate the likelihood of hacktivist attacks. By adopting this proactive approach, coupled with the use of best security practices, the BC government may be better prepared to guard against potential hacktivist attacks, and better protect the resources and information under its custody. Recommendations Overall, there are three recommendations provided in this report for how the BC government may improve its ability to anticipate and guard against hacktivist attacks. 1. The BC government should continue to monitor trends within hacktivism. 2. The BC government should continue to periodically identify issues in BC that may attract the attention of hacktivists. 3. All areas within the BC government should be proactive about exercising best security practices for managing resources and information under their custody. Hacktivism and