How do we tackle political cyber-crime?

Politically motivated computer crime has been growing steadily since the late 1980s. How should we deal with it? Kent Anderson, managing director at Encurve, LLC and member of ISACA’s Security Management Committee, offers his opinion.

In view of the cyber-warfare dimension to the Russia-Georgia conflict, and the Chinese cyber-espionage ongoing against the west since c.2003 ("Titan Rain", and so on), how concerned should we in the UK be about state-sponsored hacking?

Politically motivated computer crime has been growing steadily since the late 1980s. The threat comes from both nation-states and individuals or groups with political agendas. Governments, businesses and individuals can all be affected by state-sponsored online attacks or espionage and, as demonstrated in the 2007 cyber attacks against Estonia, significant disruption to public services such as banking and communications are possible.

The UK, like most developed countries, is highly dependent on its information infrastructure and as a major world power (both financially and politically) is a potential target. This threat was recently recognized by the UK government in the 2008 National Security Strategy of the United Kingdom which states "the security and intelligence agencies will continue to protect the United Kingdom against covert activity by foreign intelligence organizations aimed at political, economic and security targets, including cyber-attack."

The threat is not limited to state secrets or the military but extends to commercial and economic interests and, therefore, industries such as finance, high technology, bio technology and telecommunications.

While the threats of cyber war and cyber espionage are very real, it can be difficult to quantify. There are several reasons for this. First, identifying the true source of an attack is difficult because most attackers use a chain of connections between themselves and their target. For example, a "hacker" somewhere in Europe may use a computer system in China to attack a system in the UK. Inexperienced investigators are often misled when they attribute an attack to the most immediate link.

Secondly, it is very difficult to establish motive in online attacks.

As with all cyber crime there is no "silver bullet" solution to preventing politically motivated computer crime. However, basic security precautions and awareness can significantly mitigate the potential impact.

• By Kent Anderson, Encurve, LLC
•