Hacker News Reader

Comment by karl_schlagenfu | Hacker News Reader

As a European I think the West are pussies, why won't they fight back against these blatant attacks? Is it because computer hacking laws are much more stringent and punitive here?

View on HN

As a fellow European I think this fight back rhetoric is pretty stupid. Instead of amassing 0days by the military and the secret services while gaining us, the population, zero benefits for the millions spent (because we will still get hacked, regardless of the number of 0days hoarded), why not invest all these ressources into securing our broken software infrastructure? Forcing companies to fix their shit?

That would actually help against foreign hackers while also helping the actual population.

How do you force a company who uses OSS to fix the vulnerability? Do you hold the company or the OSS organization accountable? Who do you fine? Both?

I use OSS all the time but I am not capable of fixing a lot of it. I’d just use something else. Companies will just buy closed software instead from companies who will do the support and fixing for them. “It’s closed source we can’t fix it.”

We are talking about hundreds of millions of Euros here. The resources are there, just used for propping up prices in the black market instead of securing the software. The EU could pay a bunch of security researchers to review open source software (analog to e.g. Googles project zero). Or implement bug bounty programs for the most used open source software.

In general, though, I think the company using the software should be held liable. Almost every OSS license explicitly disclaims warranty and liability. That means the company has to provide this if it wishes to use the OS software.

> EU could pay a bunch of security researchers to review open source software (analog to e.g. Googles project zero). Or implement bug bounty programs for the most used open source software.

Some EU programmes have done exactly that.

The answer to your first question seems obvious for me. If it's open source, you contribute improvements, rather than forcing anyone else to do so.

How do you in a democracy force a company to do this?

With liability law? If a company sells a broken car or lawnmower, liability is expected. Just software seems exempt from this. This has to change.

How do you know they're not? I hardly expect either side to put out a press release if they are.

But the West is quite capable of its own state-assisted industrial espionage, such as between Airbus and Boeing. Or random incidents like https://www.theguardian.com/uk-news/2018/sep/21/british-spie... - would you expect retaliation by Belgium, and how?

the airbus case you mention was a corruption investigation and was done in conjunction with german state intelligence, not industrial espionage. the belgian telecom hack you link was regular espionage. there is an actual difference between what china is doing and what the rest of us do.

I’d say the EU lacks capability and likely a legal route to actually do it. The US and UK certainly do. Obama and Trump have both confirmed the use of cyber weapons in 2 instances against Iran.

I think it’s very much a hush hush matter for the US and UK. There’s probably a few stories on HN that the US or UK are actually behind.

Europe will have to push back a lot more against persistent campaigns. This isn’t a one off. It’s persistent. Maybe the EU should leverage NATO or something pan-national because small countries individually fighting off a giant isn’t as effective.

The US/UK/EU need to push back hard. They are probably the only places that will actually hold their citizens accountable for cybercrime. Russians and Chinese can hide behind no extradition.

The west needs to draw lines, create treaties, create legal definitions and frameworks. It all needs to be done in a very public forum. Not secret courts. If the lines are crossed there needs to be real and serious consequences that aren’t all for show like the recent Russian and Iranian sanctions.

For god sakes no limited strikes.

Those Iranian sanctions aren't for show. I don't think the Iranians share your perspective at all. They're brutally crushing the Iranian economy at the moment and causing the regime to lash out aggressively. The Russian sanctions are more reasonably in the for show category by comparison.

Their oil output has collapsed by 50%, from roughly 4m barrels per day. Their currency has lost 2/3 of its value versus the dollar and is near record lows. Inflation has skyrocketed, around 30% in 2018 and perhaps 40% in 2019. It's hammering living standards:

"In the past 12 months, the cost of red meat and poultry has increased by 57%, milk, cheese and eggs by 37%, and vegetables by 47%, according to the Statistical Centre of Iran."

2019-04-29: "Iran’s economy is expected to shrink for the second consecutive year and inflation could reach 40 percent, an International Monetary Fund senior official said, as the country copes with the impact of tighter sanctions imposed by the United States."

https://www.reuters.com/article/us-iran-economy-imf/iran-inf...

https://www.bbc.com/news/world-middle-east-48119109

https://www.theguardian.com/world/2018/nov/28/we-are-despera...

https://www.jpost.com/Middle-East/Iran-News/Iranians-stock-u...

I was thinking more serious things than sanctions. For example, if Iran launches a cyber attack on the west like the Saudi-Americo wiper attack we shut off their internet for a few days. Hack our infrastructure, we shut down the whole power grid.

> Under the 1949 Geneva Conventions, collective punishment is a war crime. By collective punishment, the drafters of the Geneva Conventions had in mind the reprisal killings of World War I and World War II. In the First World War, the Germans executed Belgian villagers in mass retribution for resistance activity during the Rape of Belgium. In World War II, both the Germans and the Japanese carried out a form of collective punishment to suppress resistance. Entire villages or towns or districts were held responsible for any resistance activity that occurred at those places.[5] The conventions, to counter this, reiterated the principle of individual responsibility. The International Committee of the Red Cross (ICRC) Commentary to the conventions states that parties to a conflict often would resort to "intimidatory measures to terrorize the population" in hopes of preventing hostile acts, but such practices "strike at guilty and innocent alike. They are opposed to all principles based on humanity and justice."

Geneva convention seems to be working very well in the Middle East and Russia.

Russian used a nerve agent in London and not much happened. They’ve also annexed part of a sovereign nation in Europe. The last time that happened WWII started. They likely provided chemical agents or technical know how to Syria. The Saudis do whatever they please.

Ukraine is not part of Europe. They have a trade agreement with the European Union.

Still, there was much more pushback against Russia before Trump took office. Sanctions hurt their economy and Russia was forced to sell from their gold reserves to defend large dips in the ruble's value.

"Ukraine is not part of Europe."

Ukraine is 100% part of Europe, as per any conceivable map or definition of Europe.

The Ukraine is not an EU member country.

i don't disagree, except the cw stuff. the US breaks the conventions too (eg waterboarding) but they're still there for a reason. many people, mostly elderly or critically ill, would die in the event of a power grid being shut down. it is effectively indistinguishable from terrorism.

Your points are very valid. The US should absolutely be held accountable.

Smarter and more experienced people than me need to draw the lines.

We do have the UN for that. Unfortunately, all permanent members (except possibly France) are guilty of state sponsored cybercrimes, so nothing comes of it, as with many other issues.

> Europe will have to push back a lot more against persistent campaigns.

If they start that, they might target the US. Do you believe they should?

> Maybe the EU should leverage NATO or something pan-national because small countries individually fighting off a giant isn’t as effective.

The EU isn't a small country, it is already a pan-national union.

It’s the Wild West in cyber warfare right now. Draws lines for the US and UK to follow with plans of action if they are crossed.

The EU is a bunch of small countries and last time I checked there is no EU army or intelligence service. So yes it is a pan-national countries fighting off giants.

NATO needs to have offensive and defensive cyber ware capabilities if they don’t already have it.

Why would the EU do this its a massive overreach and I say this as a remainer.

Because in this case it's a European company being hacked (Ericsson).

It's a Swedish company.

Sweden is in the European Union.

Sure, but the bodies that would attempt to push back against this form of attack sit within the nation-state, not the EU.

The EU doesn't really have a military capability of its own, let alone a "cyberwarfare" one. There's no "overreach" going on.

Not all offensive cyber is military, although there's certainly ambition within the EU there. That aside, the EU didn't have a Cybersecurity Agency with legal powers to prevent and respond to cyber threats yesterday.

Coincidentally, it does today.

Baby steps I'm sure and with the imminent potential withdrawal of a 5 eyes member it isn't unsurprising. So this picture looks to be changing in the future.

https://www.europarl.europa.eu/doceo/document/TA-8-2019-0151...

Reply on news.ycombinator.com