MASTER THESIS Cyber Attribution: Problem Solved? Analyzing the Communication of Blame and Evidence for Nation-State Involvement in Cyber Operations, 1998-2018 Author: K.M. (Koen) van den Dool Student Number: S1747525 E-Mail: [email protected] Date: June 6, 2018 Word count: 20237 Supervisor: Prof. Dr. B. van den Berg Second Reader: Mr. S. Boeke Program: MSc in Crisis and Security Management Faculty of Governance and Global Affairs – Universiteit Leiden Master Thesis | K.M. van den Dool Table of Contents 1. INTRODUCTION ...................................................................................................... 4 2. THEORY: ATTRIBUTION OF CYBER OPERATIONS ...................................................... 8 2.1. Defining Cyber Operations ............................................................................ 8 2.2. Attribution in Cyberspace ............................................................................ 11 2.2.1. Identification ............................................................................................. 12 2.2.2. Response ................................................................................................. 21 2.2.3. Communication ........................................................................................ 28 3. ANALYSIS: BLAME AND EVIDENCE IN CYBER ATTRIBUTION ..................................... 31 3.1. Methodology ................................................................................................ 31 3.1.1. Case Selection ......................................................................................... 33 3.1.2. Variables .................................................................................................. 37 3.2. Analysis ....................................................................................................... 43 3.2.1. First Results ............................................................................................. 43 3.2.2. Neutral Attribution..................................................................................... 47 3.2.3. Territorial Attribution ................................................................................. 54 3.2.4. Nation-State Attribution ............................................................................ 62 4. CONCLUSION ....................................................................................................... 72 BIBLIOGRAPHY ........................................................................................................... 76 APPENDIX A: DATASET ............................................................................................... 95 1 Master Thesis | K.M. van den Dool LIST OF TABLES Table 1: Levels of Identification .............................................................................................. 13 Table 2: Levels of State Involvement in Cyber Operations ..................................................... 20 Table 3: Law Enforcement vs. National Security Approach to Attribution ............................. 21 Table 4: State Involvement and Response Types ..................................................................... 27 Table 5: Operation Levels (Examples) ..................................................................................... 36 Table 6: First Results of Categorization ................................................................................... 43 Table 7: Number of Cases per Operation Type ........................................................................ 45 Table 8: Classification of Attribution Occurrences for CNA and CNE Cases ........................ 45 Table 9: Number of Cases per Target Type ............................................................................. 46 Table 10: Classification of Attribution Occurrences per Target Type ..................................... 46 LIST OF FIGURES Figure 1: Attribution of Cyber Operations, 1998-2018 ............................................................ 44 LIST OF ILLUSTRATIONS Image 1: Calvin and Hobbes ...................................................................................................... 4 Image 2: Parody of the 1993 New Yorker cartoon .................................................................. 15 Image 3: Excerpt from the TRANSCOM report (screenshot) ................................................. 64 Image 4: ThreatConnect's Diamond Model and Attribution of FancyBear (screenshot) ......... 68 2 Master Thesis | K.M. van den Dool LIST OF ABBREVIATIONS ACSC Australian Cyber Security Centre APT Advanced Persistent Threat ARSIWA Articles on Responsibility of States for Internationally Wrongful Acts C2 (or C&C) Command and Control CFR Council on Foreign Relations CNA Computer Network Attack CNE Computer Network Exploitation CNO Computer Network Operations DDoS Distributed Denial of Service DHCP Dynamic Host Control Protocol DIME(LE) Diplomacy, Information, Military, Economy (and Law Enforcement) DNC Democratic National Convention DNS Domain Name System EU European Union FBI Federal Bureau of Investigation NSA National Security Agency GCHQ Government Communications Headquarters GDPR General Data Protection Regulation IO Information Operations IOC Indicators of Compromise ISP Internet Service Provider IAAF International Association of Athletics Federations MFA Ministry of Foreign Affairs NATO North Atlantic Treaty Organization NISCC National Infrastructure Security Coordination Centre RAT Remote Access Tool TOR The Onion Router US United States VPN Virtual Private Network VPS Virtual Private Server WADA World Anti-Doping Agency 3 Master Thesis | K.M. van den Dool 1. Introduction Image 1: Calvin and Hobbes1 “Cyberspace. A consensual hallucination experienced daily by billions of legitimate operators […] A graphical representation of data abstracted from the banks of every computer in the human system.”2 This is the original definition of the word ‘cyberspace’, first used by science fiction writer William Gibson in his book ‘Neuromancer’, published in 1984. 26 years later, the Pentagon defined it as “a global domain within the information environment consisting of the independent network of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.”3 An important characteristic of cyberspace is the detachment of the physical identity from the technical identity. Digital identifiers such as IP addresses and domain names are not inherently linked to one person or entity in the same way as fingerprints or DNA profiles are. Put differently, strings of digital code in themselves are neutral and replicable. As a result, when trying to identify criminals and aggressors in cyberspace, Bruce Schneier says: “In cyberspace you can’t see anything directly, so it’s all going to be circumstantial.”4 This statement sheds light on one of the core dilemmas that decision makers face when responding to cyber attacks – the so-called attribution problem in cyberspace. A standard 1 “Calvin and Hobbes by Bill Watterson for Jan 20, 1994,” Go Comics (website), accessed May 22, 2018, http://www.gocomics.com/calvinandhobbes/1994/01/20. 2 William Gibson, Neuromancer (New York: The Berkley Publishing Group, 1984), 51. 3 Noah Shachtman, “26 years after Gibson, Pentagon defines ‘Cyberspace’,” Wired, May 23, 2008, accessed May 22, 2018, https://www.wired.com/2008/05/pentagon-define/. 4 VICELAND, “The Attribution Problems in Cyber Attacks: CYBERWAR (Extra Scene),” YouTube (website), July 14, 2016, accessed February 20, 2018, https://www.youtube.com/watch?v=OJ9myAO445w. 4 Master Thesis | K.M. van den Dool dictionary defines “to attribute” as “to explain (something) by indicating a cause”.5 After a violation of the law in the ‘physical’ world, a crime is (ideally) attributed to a criminal based on evidence, which is presented before a court, which may find the criminal guilty beyond any reasonable doubt. In addition, an attack in the context of interstate conflict is generally overt and attributable.6 This process can be complex, but the procedural rules and standards of evidence are relatively straightforward. Coming to grips with responding to cyber attacks is more problematic, because attribution is more ambiguous when the ‘crime scene’ or ‘battlefield’ consists of globally spread fragments of code. Joseph S. Nye Jr. illustrates the difficulty of cyber attribution by comparing it to conventional deterrence of nuclear attacks: “Nuclear attribution is not perfect, but only nine states possess nuclear weapons; the isotopic identifiers of their nuclear materials are relatively well known; and although weapons or materials could be stolen by third parties, there are serious barriers to entry for non-state actors. None of this is true in cyberspace, where a few lines of malicious code can be written (or purchased on the dark web) by any number of state or non-state actors.”7 Attributing cyber attacks is an important issue for decision makers, as is explained by Susan Brenner, because knowing who is behind a cyber attack indicates what type of threat one is facing – i.e. terrorism, crime, warfare.8 This, in turn, indicates whether the threat requires a law enforcement response or a national security response. Although some have called attribution “perhaps the most difficult problem” in cyberspace,9 others are less pessimistic. Thomas Rid, for example, says “there is still this ‘attribution is impossible’ knee jerk reaction”,