2015 7th International Conference on Cyber Conflict: Architectures in Cyberspace M.Maybaum, A.-M.Osula, L.Lindström (Eds.) 26-29 MAY 2015, TALLINN, ESTONIA 2015 7TH INTERNATIONAL CONFERENCE ON CYBER CONFLICT: ARCHITECTURES IN CYBERSPACE Copyright © 2015 by NATO CCD COE Publications. All rights reserved. IEEE Catalog Number: CFP1526N-PRT ISBN (print): 978-9949-9544-2-1 ISBN (pdf): 978-9949-9544-3-8 CopyriGHT AND Reprint Permissions No part of this publication may be reprinted, reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of the NATO Cooperative Cyber Defence Centre of Excellence ([email protected]). This restriction does not apply to making digital or hard copies of this publication for internal use within NATO, and for personal or educational use when for non-profit or non-commercial purposes, providing that copies bear this notice and a full citation on the first page as follows: [Article author(s)], [full article title] 2015 7th International Conference on Cyber Conflict: Architectures in Cyberspace M. Maybaum, A.M. Osula, L. Lindström (Eds.) 2015 © NATO CCD COE Publications PrinteD copies of THIS publication are AVAILABLE from: NATO CCD COE Publications Filtri tee 12, 10132 Tallinn, Estonia Phone: +372 717 6800 Fax: +372 717 6308 E-mail: [email protected] Web: www.ccdcoe.org Layout: Jaakko Matsalu LEGAL NOTICE: This publication contains opinions of the respective authors only. They do not necessarily reflect the policy or the opinion of NATO CCD COE, NATO, or any agency or any government. NATO CCD COE may not be held responsible for any loss or harm arising from the use of information contained in this book and is not responsible for the content of the external sources, including external websites referenced in this publication. NATO CooperatiVE CYBER Defence Centre of EXcellence The Tallinn-based NATO Cooperative Cyber Defence Centre of Excellence is a NATO- accredited knowledge hub focused on interdisciplinary applied research and development as well as consultations, trainings and exercises in the field of cyber security. The Centre’s mission is to enhance capability, cooperation and information-sharing between NATO, Allies and partners in cyber defence. Membership of the Centre is open to all Allies. Currently, the Czech Republic, Estonia, France, Germany, Hungary, Italy, Latvia, Lithuania, the Netherlands, Poland, Slovakia, Spain, the United Kingdom and the USA have signed on as sponsoring nations. Greece and Turkey are working on finalising their accession process. Austria has become a contributing participant and Finland is well on its way to doing the same. The Centre is staffed and financed by sponsoring nations and contributing participants. The Centre is not part of NATO command or force structure, nor is it funded from the NATO budget. For more information, please visit the Centre’s website at http://www.ccdcoe.org. CYCON 2015 Sponsors ForeWorD This, the seventh annual International Conference on Cyber Conflict (CyCon 2015) organised by the NATO Cooperative Cyber Defence Centre of Excellence, has again been held in the historic city of Tallinn, the capital of Estonia. Over the years the CyCon conferences have proved to be world-recognised forums on advanced methods of modelling cyber conflicts and their strategic, legal and policy implications for society, business and world affairs. Every year, CyCon devotes its attention to a specific aspect of cyber conflict. In 2013, the conference discussed the roles and methods of automated cyber defence: it looked at automation, not only as an enabling technological field that allows for an increase in the effectiveness and sophistication of cyber defensive and offensive actions, but also as a social factor which touches on the political, legal, moral and ethical framework of modern society. In 2014, the conference concentrated on active cyber defence. The focus of CyCon 2015 is on the architectural aspects of cyberspace, from – as is true for all CyCon conferences – information technological, strategic, legal, and policy perspectives. As cyber attacks and countermeasures are becoming more complex and sophisticated, it is time to take our understanding of the very nature of these attacks to the next level regarding how they impact the overall framework of personal, business, national, and international security and what are the best approaches to counter the threat. The mission of CyCon conferences is to look at the issues, models, and solutions for cyber conflict from a multi-disciplinary perspective. We would like to thank both the members of the CyCon 2015 Programme Committee and the distinguished peer reviewers for their tireless work in identifying papers for presentation at the conference and for publication in this book. Last, but not least, we are delighted to congratulate the dedicated editors of this volume. Programme Committee Co-Chairs Dr Gabriel Jakobson Chief Scientist, Altusys Corp Dr Rain Ottis Associate Professor Tallinn University of Technology Brookline, Tallinn, April 2015 TABLE of Contents Introduction 1 Jason Rivera Achieving Cyberdeterrence and the Ability of Small States 7 to Hold Large States at Risk Robert Brose Cyberwar, Netwar, and the Future of Cyberdefense 25 Margarita Jaitner and Peter A. Mattsson 39 Russian Information Warfare of 2014 Tim Maurer, Robert Morgus, Isabel Skierka and Mirko Hohmann 53 Technological Sovereignty: Missing the Point? Sergei Boeke, Caitriona Heinl and Matthijs Veenendaal 69 Civil-Military Relations and International Military Cooperation in Cyber Security: Common Challenges & State Practices across Asia and Europe Geoffrey Deweese 81 Anticipatory and Preemptive Self-Defense in Cyberspace: The Challenge of Imminence Paul Walker 93 Law of the Horse to Law of the Submarine: The Future of State Behavior in Cyberspace Uchenna Jerome Orji 105 Multilateral Legal Responses to Cybersecurity in Africa: Any Hope for Effective International Cooperation? Richard Hill 119 Dealing with Cyber Security Threats: International Cooperation, ITU, and WCIT Jennifer Stoll and Rainhard Bengez 135 Visual Structures for Seeing Cyber Policy Strategies Alison Lawlor Russell 153 Anti-Access/Area Denial @ the Physical Layer of Cyberspace Robert Koch and Mario Golling 169 Blackout and Now? - Network Centric Warfare in an Anti-Access Area-Denial Theatre ii Andrea Balboni, Michele Colajanni, Mirco Marchetti and Andrea Melegari 185 Supporting Sense-Making and Decision-Making Through Time Evolution Analysis of Open Sources Alexis Le Compte, Tim Watson and David Elizondo 203 A Renewed Approach to Serious Games for Cyber Security Matteo Casenove 217 Exfiltrations Using Polymorphic Blending Techniques: Analysis and Countermeasures Christos Xenakis and Christoforos Ntantogian 231 Attacking the Baseband Modem of Mobile Phones to Breach the Users’ Privacy and Network Security Biographies 245 iii INTRODUCTION For the seventh year in a row, the International Conference on Cyber Conflict (CyCon) has brought together national security thinkers, strategists, political scientists, policy-makers, lawyers, and technology experts interested in cyber defence, and has served as a hub for knowledge and networking on an international level. CyCon 2015 – themed ‘Architectures in Cyberspace’ – focused on the construction of the internet and its potential future development. The main principles and foundations for the internet were laid four decades ago, and they have been used ever since. The ‘net’ has been a tremendous success story and today it is much more than just a commodity. However, can the structures that we rely on support the increasing demand and the different ways in which we want to use it, and what are the effects of this revolution on norms, international politics and security? Building on these questions, this book contains selected articles that were presented during CyCon 2015. The articles dedicated to the strategy and policy dimensions cover a wide array of topics. Deterrence in cyberspace has been one of the key issues at the strategic level for quite some time; Jason Rivera challenges the often-repeated claim that cyber deterrence is difficult or near impossible. His article aims to explain how even small and less powerful states can hold larger and more powerful states at risk in cyberspace. Robert Brose invites us to reflect on the concept of information warfare and its direct implications for cyber defence organisations today. Following up on the theoretical aspects of information warfare, Margarita Jaitner and Peter A. Mattson provide a case study of Russian information operations during the Ukraine crisis; they specifically explain the role of cyberspace in the broader Russian strategy for information warfare. Tim Maurer et al. take a closer look at the European proposals for technological sovereignty. Their article provides a comprehensive mapping and impact assessment of these proposals, covering both the technical and the non-technical, and evaluates how these proposals may protect against foreign surveillance. Finally, Sergei Boeke et al. take a look at how militaries in their own national contexts contribute to defensive cyber security across Asia and Europe. Common national challenges are identified, along with approaches to improve cyber security through better civil-military cooperation, specifically betweenAsia and Europe. The articles that focus on the developments of international