1 THE FOG OF CYBER DEFENCE Eds. Jari Rantapelkonen & Mirva Salminen National Defence University Department of Leadership and Military Pedagogy Publication Series 2 Article Collection n:o 10 Helsinki 2013 2 © National Defence University/Department of Leadership and Military Pedagogy ISBN 978–951–25–2430–3 ISBN 978–951–25–2431–0 (PDF) ISSN 1798–0402 Cover: Toni Tilsala/National Defence University Layout: Heidi Paananen/National Defence University Juvenes Print Oy Tampere 2013 3 CONTENTS Foreword ........................................................................................ 5 Summary ........................................................................................ 6 Jari Rantapelkonen & Mirva Salminen Introduction: Looking for an Understanding of Cyber ............. 14 Part I: Cyberspace Jari Rantapelkonen & Harry Kantola Insights into Cyberspace, Cyber Security, and Cyberwar in the Nordic Countries ...................................... 24 Topi Tuukkanen Sovereignty in the Cyber Domain ...................................... 37 Jari Rantapelkonen & Saara Jantunen Cyberspace, the Role of State, and Goal of Digital Finland .................................................................................. 46 Margarita Jaitner Exercising Power in Social Media ....................................... 57 Kari Alenius Victory in Exceptional War: The Estonian Main Narrative of the Cyber Attacks in 2007 ............................. 78 PART II: Cyber Security Anssi Kärkkäinen The Origins and the Future of Cyber Security in the Finnish Defence Forces ................................................. 91 Kristin Hemmer Mørkestøl Norwegian Cyber Security: How to Build a Resilient Cyber Society in a Small Nation ....................................... 108 Roland Heickerö Cyber Security in Sweden from the Past to the Future........................................................................... 118 4 Simo Huopio A Rugged Nation ............................................................... 126 Erka Koivunen Contaminated Rather than Classified: CIS Design Principles to Support Cyber Incident Response Collaboration ..................................................................... 136 Part III: Cyberwar Tero Palokangas Cyberwar: Another Revolution in Military Affairs? ........ 146 Sakari Ahvenainen What Can We Say About Cyberwar Based on Cybernetics? ................................................................. 154 Jan Hanska The Emperor's Digital Clothes: Cyberwar and the Application of Classical Theories of War ................... 169 Rain Ottis Theoretical Offensive Cyber Militia Models .................... 190 Jarno Limnéll Offensive Cyber Capabilities are Needed Because of Deterrence ..................................................................... 200 Jouko Vankka & Tapio Saarelainen Threats Concerning the Usability of Satellite Communications in Cyberwarfare Environment ............. 208 Timo Kiravuo & Mikko Särelä The Care and Maintenance of Cyberweapons ................ 218 Mikko Hyppönen The Exploit Marketplace ................................................... 231 5 Foreword Internet is a good example of how technology can dramatically alter our everyday lives. In the past two decades, Internet has evolved from the “playground of the geeks” to a serious tool to do business with. With a single click of a mouse, it is possible to share information with millions of people. Unfortunately, this evolution has also brought about all of the negative side effects of global communication and digital freedom. As the tip of the iceberg, Internet is full of junk mail, malware, scam, and identity thefts – just to name a few examples. Simultaneously, we – the benevolent users – are suffering more and more from attacks on the availability of services and information. Similarly like the mobile phones, Internet has become a commodity without which our modern lifestyle would not survive. Therefore, we have seen governmental level strategies to “protect our critical information infrastructures” or to “secure cyberspace”. Neither Internet, nor any other communication channel is anymore controllable by a single entity, government or corporate. On the contrary, they are networks of networks on which we have very little control on how they evolve. We are living in a world of ubiquitous computing, where various computing devices are communicating and sharing information around us, for us, and about us. Clouds of computers are formed and deformed dynamically without any need of human intervention. World Wireless Research Forum, WWRF, has predicted that there will be seven billion mobile phones in the world by the year 2017. At the same time, the number of computers will rise to seven trillion, that is, there will be roughly a thousand computing devices per person. Thus, our physical space and “cyberspace” will overlap completely. When considering cyberspace from the military perspective, we can ask whether cyber will cause an evolution or a revolution in warfighting. On the one hand, cyber enables us to “see, hear, and talk” faster and over longer distances, which enables us to perform our military objectives faster and with a greater accuracy. On the other hand, cyber is a totally different battlefield with different rules and engaged players than the conventional land, sea, air, and space. This book generates new ideas and opens new topics of discussion with regard to cyber. Even though bits usually do not kill – at least, not directly – we must consider the consequences of cyber operations also from the military perspective. Plenty of questions will rise on this research area, such as “Who are the enemies?”; “What are the rules of engagement?”; “Shall we be defensive or offensive in Cyber?”; and “How do we define ‘credible defence’ in cyber?”. Hannu H. Kari Research Director, Professor, National Defence University 6 SUMMARY The Fog of Cyber Defence is a study made primarily for the NORDEFCO (Nordic Defence Cooperation) community. Nonetheless, it can be applied to other contexts in which enhanced understanding of the challenges of cyberspace is important. The research project was originally called Cyber Defence in the Nordic Countries and Challenges of Cyber Security. For the purposes of the book and due to issues that were raised during the project, the name was changed to better describe the significance and omnipresence of cyber in information societies. However, cyber remains very much a "foggy" challenge for the Nordic countries which are considered cyber savvies. The book focuses on Nordic cooperation in the field of defence policy on a political level. It is a collection of articles that aim to answer the many questions related to cyber security and take a stand on the practical possibilities of cyber defence. The meeting of the Defence Ministers on the 12th and 13th of May 2009 was an example of political positioning with regard to cyber. All Nordic countries – Finland, Sweden, Norway, Denmark and Iceland – participated. In addition to familiar topics such as cooperation in crisis management, material cooperation and operational cooperation, the meeting also witnessed a new common will to deal with new challenges. In the same year, during the June 2009 meeting of the Ministers for Foreign Affairs in Reykjavik, the Nordic countries acknowledged the need for enhanced cooperation to respond more effectively to cyber security problems. Two years later, when the Foreign Ministers of Denmark, Finland, Iceland, Norway and Sweden met on the 5th of April 2011 in Helsinki, the ministers stated that the Nordic Declaration on Solidarity would be followed up with practical measures, such as cooperation in the field of cyber security. On the political level, there is a desire to move towards concrete and practical cyber cooperation. This study on cyber defence was assigned in the 2012 NORDEFCO MCC Action Plan, and it was Finland's turn to conduct a study of an area of interest that would be implemented within the NORDEFCO framework. It was agreed that the recently commenced study, "Cyber Defence in the Nordic Countries and Challenges of Cyber Security," would form the basis for further exploration of possibilities for Nordic cooperation in the field of cyber defence. Key Results The concepts of cyber, cyberspace, cyber security and cyberwar are multidimensional and ambiguous. The key results support the development of a common language and understanding in cyber activities among the Nordic countries, as well as the development of practical cooperation. The phenomenon is greater than what a single country can deal with alone. a) Cyberspace o The Nordic countries are the most developed countries in cyberspace. Simultaneously, they recognise the importance of and their dependence on cyberspace for managing the welfare and security of the countries and their citizens. 7 o Cyberspace is a vague domain in relation to state and defence activities. It raises many unanswered and significant philosophical, but also clearly critical national security questions about how states should relate themselves to cyberspace. o Cyberspace has different qualities and attributes than physical spaces. Cyberspace can be described as a “ubiquitous,” “networked”, and “virtual” world, and cyber activities have even been considered “anonymous.” If this is understood through power politics, bureaucracy and hierarchical leadership, new kinds of political practices can be created and cyber cooperation can be strengthened. In any case, cyberspace on its own