Secure Channel Ziff Davis Enterprise Ziff Davis Enterprise
Advertisement
Advertisement
Monday, December 14, 2009 7:09 AM/EST

Globalizing the Fight Against a Hostile Internet


deputy-on-phone.jpgDuring my visit to Moscow last week, Kaspersky Lab CEO Eugene Kaspersky waxed poetically about the need for a global law enforcement agency to police the Internet against criminals and hackers. In his estimation, the Internet never will be free of threats so long as hackers are able to launch attacks against international targets from safe havens in their home countries.

Kaspersky isn't the only security executive calling for such an international cyber-security agency. McAfee CEO Dave DeWalt told partners and customers at his company's Focus conference in October that more international cooperation and a global police force is needed to combat the rising tide of threats and attacks against every aspect of the digital world.

It's ironic that Kaspersky, a Russian, would call for the creation of cyber-police when his own government opposes the notion of cross-border jurisdiction of hackers and cyber-criminals, as called for in the European Cybercrime Treaty.

But Kaspersky and DeWalt are essentially correct in that most successful hackers perpetrate their crimes not against domestic targets but rather against targets in other countries that would have a hard time—if any chance at all—of prosecuting suspected cyber-criminals. Consider the case of Gary McKinnon, the British citizen accused of hacking dozens of U.S. Navy systems in pursuit of UFO evidence. He was traced and caught in 2002 and is currently under indictment by U.S. authorities, but remains on British soil as he continually challenges extradition. (Last week, McKinnon lost his latest round, but his lawyers plan another appeal, saying he wouldn't survive the U.S. prison system.)

Even if local authorities are willing to investigate and prosecute cyber-crimes, many countries' domestic laws are inadequate to the task. Think back nearly a decade to what remains the worst computer virus to ever hit the Internet - LoveLetter. Onel de Guzman, a computer science student in the Philippines, “accidentally” released the virus, and within 24 hours it was infecting tens of millions of Internet-connected machines. The amateurish code made tracking the virus to its source relatively easy, but de Guzman walked free because he hadn't broken any of the existing laws.

Over the weekend, the Obama administration reversed U.S. policy and opened dialogue with Russia on curbing the militarization of the Internet. The talks, which Russia has been proposing for several years, would limit nations from developing offensive weapons in cyber-space and aim to curb rogue, terrorist use of the Internet for disrupting commerce and communications. (It's kind of ironic that these talks are happening, since the original Internet was designed by the U.S. military as a redundant communications system in the event of nuclear war.) These talks, some observers say, could lead to an international cyber-crime treaty.

Is there a model in which governments could root out hackers and cyber-criminals without violating sovereignty? In the U.S. such a model exists between states prosecuting child pornographers. Several states, such as Connecticut, require computer technicians to report evidence of child porn and other malicious materials. A similar model could be employed in which governments deputize security solution providers, VARs, hosting companies and ISPs to find, report and, in some cases, investigate hacking and criminal activity. It would then be up to prosecutors to press charges locally or allow extradition.

So the question is this: Would you be willing to be a deputy sheriff in the global effort to police hacking?

TrackBack

TrackBack

http://blogs.channelinsider.com/cgi-bin/mte/mt-tb.cgi/18718

Comments (18)

Michael :

The organization already exists as Interpol. US IT!

Michael, my understanding is that Interpol is more of a international crime intelligence service that has the power to investigate and share information. However, Interpol doesn't have the power to cross borders and make arrests. Again, correct me if I'm wrong.

Patrick O'Connor :

Yes, globally we need much better cooperation between enforcement agencies. However the McKinnon case is perhaps the worst example you could have chosen to illustrate your point.

This is the case of a slightly impaired man, clearly fixated on UFOs, embarrassing the US government (and military in particular) by meandering around some insignificant systems looking for the great X-files conspiracy.

The measure of damage done to these systems has been blown out of proportion in order to justify the punitive sentence the US courts would seek to impose. The difficulty in apprehending McKinnon almost negligible.

Leaving aside the poor choice of example (why not Eastern European bot-herders or African phishermen ? Surely these represent more of a clear and present danger than McKinnon) the notion of an international organisation that could easily interface with national law enforcement bodies is a good idea but has proved difficult to establish to confront drug smuggling or terrorism.

The world will also not tolerate the US deciding that it will be the policeman of the internet, which may appeal to a future administration. Of course the US may press ahead with it's own plans and establish such an initiative but by that time the US will have significant influence over about a third (at best) of the global network, making it a pointless and potentially antagonistic action to wards the rest of the online world.

A global agreement to pursue wrongdoers is welcome but about as easy as any other worldwide initiative one can think of, such as climate change, terrorism, drugs, people smuggling etc.

Interesting that Kaspersky should suggest this, having lived most of his life in a police-state.


You're right; there are many more examples of more serious hackers than McKinnon. I used McKinnon to illustrate the problem because he just lost his latest appeal for extradition. While that's good news to U.S. prosecutors, it's taken nearly six years to get the extradition order from a country that is supposedly friendly to our cause. Eastern European and African states would be a far more difficult challenge; depending on the severity of the hacker, extradition from those regions would probably require a "black bag" op.

mac :

Won't happen until we have a one world govt.
Wich i hope is NEVER.

Gil :

Bad idea.

Cooperation between departments/nations is not really bad but creating "global" police is just inviting abuse.
This leads to interference with a country's right/ability to enforce THEIR OWN laws and punishments.

al :

I think a global police force is a misleading definition. The thing is, there's safe havens for these criminals because their countries won't/can't investigate such crimes. Then, let's make such a global police force operative only where it's needed (so that countries that don't have such a thing can have it for free -or almost free) and keep only a collaboration relationship with law enforcement in first world countries where cybercrime is effectively punished.

Now that's not a bad idea. The U.S. government already sends "support" teams to foreign countries to investigate crimes and major incidents that result in the loss of life (terrorist attacks, plane crashes, etc.). An international cyber-SWAT team could serve the same purpose for prosecuting hackers.

Cypherpunk :

This is a terrible idea.

Look at the globalization efforts and how this has caused bad financial decisions in one area to propagate due to common financial instruments. The same will happen here as well, it will start out in one particular area and then grow to another. FinCEN.gov is another example of real-time financial monitoring.

This is all fine and good as long as two things happen: clear limits on authority and justification of same, and clear and provably workable method of punishing those who abuse the system. Neither of these will get put on the table.

It's nothing more than another attempt to use one threat to build a data collection system to manipulate the masses. The cure is worse than the disease.

Hacker :

If they create a cyber police state, I will [EXPLETIVE OMITTED] up all their computer networks and will defeat ALL of them in a cyber war. I can take down an entire government using only my laptop. If they try to take control of the internet, I will declare a cyber war against them and win!

Dennis Barr :

I've commented elsewhere that the situation we find ourselves in is a mongrel combination of warfare and crime. Whether we want to be deputized into the struggle with the cybercriminals out there or not, we're part of it.

If we're not part of the solution, I see no alternative but to admit to being part of the problem. Ignorant people responding to spam, venal people responding to get-rich-quick schemes, clueless people opening attachments, or careless people not keeping their systems updated put all the rest of us at risk. There are plenty of opportunities to get side-swiped even without being in one of these groups. Until there are real teeth in international law, and real cooperation between countries in going after these criminals, nothing substantial will happen.

If all this takes a new international police regime, so be it. I'm tired of having the criminals have the upper hand at this point. Put 'em away for life; we'll all be the better for it.

Joe :

Good idea or bad idea aside, where would the money come from to fund such a force? And if the money were available would government or private security providers be better suited to act as the Internet cops? Would a privatized global Internet police force represent a new managed services opportunity for VARs?

LMAO. So Joe, are you suggesting a "Blackwater" operation by VARs as NGO law enforcement for governments who can't or won't get their hands dirt or don't want to get their hands dirty with a "black bag" op?

My answer to the question is an emphatic YES!!!

If the crimes are being perpetrated electronically then I don't see they can't be stopped electronically. We have been self-policing for years, why not establish virtual laws and form a virtual law enforcement agency. No guns, no armies, and no violence. When someone breaks the virtual law, they get cut off from the rest of virtual society (prison).

Just like SETI used the power of distributed processing (over 3 million strong) to search for life out in the heavens, why not harness all that power for our virtual law enforcement agency to stop those who prey on others. Think of the possibilities.

I propose forming a consortium to "serve and protect" the honest members of the virtual community from those with a misguided mission of mischief and mayhem.

It's time for us to ACT as a community and take back the Internet and make it a tool for the advancement of humankind.

Mandar :

Such a global law enforcement task force already exists for certain crimes. See:


http://www.virtualglobaltaskforce.com/

Mike Sciortino :

The Internet was not invented as a way to communicate in case of a nuclear war, it was a way for college students (at MIT I believe it was) to transfer data and such over a network so there wasn't a mess of disks lying around.

Mike, you are correct, if you're excluding the current Internet that started as CERN's World Wide Web project. But the forerunning of the modern Internet started as a DARPA project that resulted in ARPANET, a packet-switching network, that was developed as an adjunct to military projects.

Rather interesting blog you've got here. Thank you for it. I like such themes and anything that is connected to them. I would like to read more soon.

Post a Comment

 
 
Advertisement
Advertisement