Inside Cyber Warfare - Jeffrey Carr [118]
The advent of engaged civil society groups has changed this. Since 2005, these groups have published a flood of reports that have examined suspicious cyber behavior, mostly originating in Russia and China. The Georgian cyber attacks were particularly interesting, as the timing seemed to indicate at least some level of coordination between the Russian military’s kinetic attacks and the assault on Georgian servers. Reports such as those generated by Project Grey Goose helped to show that although the information of Russian government complicity in the cyber assault on Georgia was far from conclusive, there was much circumstantial evidence. For the reports, and the Western media that depended on them, this was sufficient. Unlike governments, for the public, “perfect” was clearly the enemy of the good.
The information in these reports is not good enough for cruise missiles, but it certainly is good enough for CNN. The barrage of reports that imply direct Russian government involvement has been widely reported in Western media. The increase of embarrassing questions posed to the Kremlin is probably a direct result of this media attention. At a cyber security conference at the Organization for Security and Co-operation in Europe (OSCE) in 2008, an American official privately remarked to me that the incessant accusations repeated in the media were leading the Kremlin to reduce its support of various groups, such as the pro-Putin Nashi, whose members have been implicated in cyber attacks. He directly credited the work of the civil society groups—including Grey Goose—in bringing this about. Sunlight as a disinfectant seems to work across borders as well.
It therefore appears that the best defense against a compromised or captive civil society is a free one. I have taken to referring to these “free” groups as security trust networks (STNs), and there are considerable differences between these groups and the ones that they often seem to work in direct opposition to:
An STN is independent and not beholden to any agency of government or private business. The state does not exert direct control over them, and cannot (easily) shut it down. This does not mean that the STN does not support a government; it just means that it chooses when and if to do so.
An STN is defined not only by the trust within the network itself but also the trust that other networks bring to it. For instance, an STN will often be seen as a credible partner for government and law enforcement, despite having no formal structure or pedigree.
STNs are defined by ethics: besides (generally) operating within the remits of the law, its members share a common moral code, explicit or implicit, based on “doing the right thing.” The shared moral mission of the STN is its official raison d’être.
Western governments often depend on these STNs much more than they realize. This is especially true for the technical experts, who invest a large amount of labor that mostly goes unnoticed, but also for the investigative STNs, such as Grey Goose, that certainly have helped frame the public debate.
So is it possible for a government to help create these STNs? The question is not as bizarre as it might seem. Russia has actively followed this course since at least 2000 (the publication date of its “Information Security Doctrine”) and is trying to “build a information society.” Although Alexis de Tocqueville might well wince at the idea of a government building a civil society, there is indeed much that truly democratic governments can do to encourage the formation of