German Cyber Security Policy: Focus and Approach
Total Page：16
File Type：pdf, Size：1020Kb
German Cyber Security Policy: Focus and Approach Oliver Schmidt-Voss Student number: 1236148 Word count: 15221 10 June 2018 Master Thesis Crisis and Security Management Thesis supervisor: Dr. Myriam Benraad Second reader: Dr. Ernst Dijxhoorn Leiden University Faculty of Governance and Global Affair 1 Acknowledgements In memory of my beloved father. With deepest gratitude, I would like to thank dr. Myriam Benraad and dr. Joey Mathys for their unconditional support. I would like to acknowledge Mr. Sergei Boeke for introducing me to the field of cyber security and sparking my fascination for a topic I wish to engage with in my future path. 2 Table of Contents Acknowledgements ........................................................................................................... 2 Abbreviations ..................................................................................................................... 4 1. Introduction .................................................................................................................... 5 Relevance ...................................................................................................................................... 6 Research Question ..................................................................................................................... 6 Aim .................................................................................................................................................. 7 2.1 Cyber Security & Cyber Threats ..................................................................................... 7 Malware ....................................................................................................................................................... 9 Hackers ...................................................................................................................................................... 10 Complexity ............................................................................................................................................... 12 2.2 Securitizing the Cyber Domain ..................................................................................... 12 Cyber Security in Germany ............................................................................................................... 13 2.3 Cyber Security Policy ....................................................................................................... 15 Whole of Government and Public-Private Partnerships ...................................................... 15 Cyber Defense ......................................................................................................................................... 15 Section Summary ................................................................................................................................... 17 3. Research Design & Methodology .......................................................................... 18 3.1 Single case study ................................................................................................................ 18 3.2 Document analysis ............................................................................................................ 18 3.3 Interviews ............................................................................................................................ 20 Email questionnaire ............................................................................................................................. 20 Expert interviews .................................................................................................................................. 20 4. Analysis ......................................................................................................................... 21 Preventative Measures & Civilian Agencies .................................................................... 22 Protection and Resilience .................................................................................................................. 22 Economy .................................................................................................................................................... 24 Private Sector .......................................................................................................................................... 25 Incident response .................................................................................................................................. 27 Section summary ................................................................................................................................... 29 Active Cyber Defense & Security Agencies ...................................................................... 30 Law enforcement & Security Agencies ........................................................................................ 30 Hacking Back ........................................................................................................................................... 35 Bundeswehr ............................................................................................................................................. 38 5. Conclusion .................................................................................................................... 39 6. Further Research ....................................................................................................... 40 References ........................................................................................................................ 41 3 Abbreviations AA Federal Foreign Office BBK Federal Office for Civil Protection and Disaster Assistance BfV Federal Office for the Protection of the Constitution BKA Federal Crime Police Office BMI Federal Ministry of Interior BMVg Federal Ministry of Defense BMWi Federal Ministry of Economic Affairs and Energy BND Federal Intelligence Service BRH Federal Court of Auditors BSI Federal Office of Information Security Cyber-AZ National Cyber Defense Center Cyber-SR National Cyber Security Council MAD Military Counter-Intelligence Service ZITIs Zentrale für Informationstechnik im Sicherheitsbereich 4 1. Introduction The German government is exposed to cyber attacks on the private sector, the economy, and public administration on a daily basis (BSI, 2017: 7). According to the Federal Ministry of Information Security (Bundesamt für die Sicherheit in der Informationstechnik, abbr. BSI) the possibilities to conduct cyber attacks are evolving continuously. With the growing digitalization of society, the economy and government institutions, there is also a congruent development of the attack methods and mediums. The Internet as platform to conduct cyber attacks facilitates the anonymity and impunity of perpetrators. Cyber attacks can be mounted with limited resources, simply a computer and an Internet connection is necessary. Instructions on how to administer these attacks can be found online on the darkweb (Zedler, 2016: 2). The increasing necessity to address the cyber threat situation in Germany is also thematized in the media like the hacking of the government network in February 2018 and the Bundestag in May 2015 (Beuth et al., 2015) or the disruption of the Internet for 1.25 million users in November 2016 (Baumgärtner et al.: 2017, November 24). With these incidents cyber security has gained increasing attention in Germany. The increasing amount of devices connected to the Internet is creating what has been described as the Internet of Things. A new source of danger has developed for cyber security. The devices are easily targetable as in the production process as well as in the decision to purchase consideration for IT-security do not play a sufficient role (BSI, 2017: 23). The failure or disruptions of industrial control systems - particularly in the critical infrastructure sector - can have grave physical impact leading in the form of electricity breakdown or production processes. Furthermore, a recent phenomenon has been cyber-espionage of government institutions with the purpose to leak the acquired information in order to manipulate the democratic process. The reputation of a candidate is hampered influencing public opinion (BSI, 2017: 74-75). In recent years several developments have taken place in regard to Germany’s cyber security policy. In 2015 the IT-Security Law was passed aiming to establish protection for critical infrastructure. The same year the German government announced the development of a cyber command within the armed forces (BMVg, 2015). In November 2016 a new cyber security strategy was published (BMI, 2016), a document much more elaborative and broader in scope than the previous strategy (BMI, 2011). Furthermore, in the course of 2017 a political debate ensued on the potential use of offensive cyber capabilities as part of Germany cyber security policy (Reinhold & Schultz, 2017). The study thereby aims to examine how Germany is dealing with the cyber threat landscape it faces and how these recent developments figure into Germany’s cyber security policy. 5 Relevance The study has academic relevance as to date there has not been an extensive study on Germany’s cyber security strategy of 2016. Furthermore, while previous studies have dealt with Germany’s cyber security policy (Kullik, 2014; Zedler, 2016; Steller, 2017) these have not focused on the institutional structures but have not examined how