An Cosantóir

www.military.ie THE DEFENCE FORCES MAGAZINE | 19 Hostile states will use cyberspace to influence referendums or elections for their own advantage against other states. They will even use cyberspace to persecute and harm their own people. The government of Burma has used cyberspace via social media to both 'justify' and facilitate its vast levels of harm against the Ro- hingya population. These ongoing war crimes perpetrated directly by the Manamar govern- ment and its leaders have been labelled 'genocide' by the UN and the International Criminal Court. Cyber security here is about ensur- ing that social media platforms are not used for 'fake news' and the facilitation of information which can be used either to influence an election, or, far worse, facilitate the 'ethnic cleans- ing' of entire com- munities. Both the US and the EU are stepping up their efforts to ensure that cyberspace is not used to these ends. Although progress is slow, they are making some headway with the social me- dia platforms. They increasingly appear to recognise their responsibilities to prevent fake news and propaganda from harming the democratic pro- cess, or, in the case of Burma, from directly facilitating the brutalisation of innocent civil- ians who have no ability to defend themselves. As we saw in February's An Cosantóir social engineering is used for a vast number of cyber security breaches. It can be used by hostile actors to create false profiles luring anyone to give up highly personal information with which they can be blackmailed. What we post online - photos of our families, our address, children's schools, partner's work location, our house, where we're going on deployment - can be used by hostile actors to create a complete picture. This background can then be used to threaten us into doing something that facilitates the hostile's intentions. Moreover, emails and texts are easy to fake. Simply clicking on a link in a text or email can cause our phones or smart-watches to be used as a micro- phone, camera, or location tracking devise when we are at home or deployed overseas. Such 'phishing' messages are highly convincing, appearing to be from someone you know and trust, but actually sent by someone else. Preventing this manipulation of cyberspace via social engineering is one of the most important parts of cyber security for the Defence Forces. Cyberspace can be used by those within an organisation who might have a vendetta. It is very easy for just one person to cause disaster with long-lasting consequences, as we saw with the US contractor Edward Snowden. So cyber security needs to become an organisational matter, making sure we have the structures to prevent the misuse of cyberspace within our own organisations, via the early detection of problems in a 'no blame' environment. Hostile states, terrorists, and criminals are far more effective at using cyberspace to pursue their objectives than any of us in NATO or the EU. Terrorists are well able to use cyberspace to communi- cate securely with one another. The 9/11 terrorist attacks were one of the first examples of cyberspace being used by terrorists. Cyber- space was used in the recruitment, planning, and execution of the atrocities. The subsequent 9/11 Commission Report identified that we need to completely change the way we prevent and respond to these new emerging, asymmetric threats. The previous system of intelligence sharing was simply not fit for purpose. Worse, it was actually dangerous as it created a false sense of security in which nefarious actors could plan their outrages while we assured ourselves we were doing everything possible to prevent terrorist attacks of any size, let alone like those that occurred on 9/11. Prior to 9/11 we were living in a bubble of self assured (but un- justified), security in regard to terrorism. It is the same today in our relation to cyber security and the security of cyberspace. The 9/11 Commission's response to preventing terrorism is very relevant to securing cyberspace for the Defence Forces, the State and across the EU. Cyber security is a hybrid, multifaceted challenge, and it requires a hybrid response. It is about how we structure our organisations and how we share information. If criminals, terrorists, hostile states, or even someone within our organisation wants to cause harm they presently have a near infinite number of ways to do so in cyberspace; they will find someone or some way to breach the Defence Forces, as they only need one route in. Moreover, the EU has at least 188 national intel- ligence agencies and vastly more regional agencies. This is many times more than the US and information sharing between them all is not particularly good. So the battle is lost? Not at all. Let's flip the advantage from attacker to attacked. If every member of the Defence Forces - from new Recruit to the Chief of Staff - becomes part of a system that can alert possible breaches and misuses of cy- berspace as early as possible, then we flip the advantage from them to us. By enabling cyber security to become everyone's responsibil- ity - in Ireland and across the EU - we help secure cyberspace, and thereby our own security, the security of the Defence Forces, and the security of the State. Dinos Anthony Kerigan-Kyrou coordinates and instructs on the 1st Joint Command & Staff Course cyber security module. He is an instructor on NATO's DEEP - Defence Education Enhancement Programme - and is a co-author of the NATO / Partnership for Peace Consortium Cyber Security Curriculum. Satellite image of Burma after a community has been burnt down.

• Cover