Britain has offensive cyberwar capability, top general admits | Hacker News Reader

Britain has offensive cyberwar capability, top general admits

theguardian.com

64 pointselorant54 comments

Is this news for the Five Eyes countries? I heard earlier last year about Australian ASD working with NSA and I'd assume GCHQ in Operation Glowing Symphony, where they hacked a bunch of ISIS recruiting sites.

I'd be surprised if they didn't have this to be honest.

It'd be interesting to know the magnitude of the capability. Can they crash the internet? or a person's life? or a power station? And it'd also be great to know what their target acquisition time time was and ROE.

I had the same thought. Why would anyone be surprised? Quite honestly (because the UK way of life aligns with mine) I'm glad that they do.

This isn't surprising, but it seems like posturing and deception are more effective for cyberwar than conventional capabilities, and this article was probably written for that purpose.

That's what I was thinking. I'd imagine cyberwar capabilities are a lot more difficult for enemies to assess, at least in regards to conventional weapons. You can't spot them by satellite or anything; you'd have to estimate them based on knowledge of past attacks or reports from spies/informants.

That strong element of uncertainty, combined with confident public statements and the knowledge of UK technical expertise in general, is probably a pretty decent deterrent, even if the abilities in question happened to be exaggerated.

> even if the abilities in question happened to be exaggerated.

I donno. Stuxnet demonstrated how sophisticated the capabilities are of highly advanced nations, and that was around 10 years ago.

At this point, I suspect that the assumption is that any computer-controlled system will be a target for cyber-espionage, and that it might not be obvious that such an attack is underway without some kind of monitoring that relies on statistical analysis of the performance deviance from some expected value.

To compound the problem, the USA & China can likely obtain technical specs for just about any system produced in the world by just asking, and failing that, through corporate espionage. Which means these countries are pretty well positioned to pull off crazy hacks that wouldn't even seem possible.

Yeah, I wasn't trying to imply the abilities were exaggerated; just saying that the amorphous nature of cyberwar means you could give an adversary pause by claiming abilities you may not have yet.

(Whereas claiming you have, say, 1,200 bombers when you only have half that number is more easily determined).

No it is not news in the least.

Even Canada has offensive cyber and has members of the military talking with some regularity about how they use it in completely declassified settings. You can literally buy a ticket to a conference and hear these guys talk about it.

Is this stuff available on youtube?

The stuff on YouTube that I've seen has US generals talking vaguely about it. But even as far back as 2012 I was talking with US red team operators who were pretty open about the structure of cyber operations. At that time there was a team working in one branch of the government (NSA) developing malware for zero-day vulnerabilities, and another branch of the government (Air Force) putting the malware to work in actual operations. I think they called them "bit bombs" at the time, not sure what it's called now, but I can only imagine that the capability is even more developed and probably more widespread within US DoD. I'd expect the Army probably has their own cyber operators, for example, in addition to the specialized operators in cyber command.

Anyone with a boat anchor can crash the internet. Well... Maybe a few anchors and some coordination.

this article and a lot of the comments here seem to be unfamiliar with the basic terminology of cyber (cyberwar, cyber weapons, cyber power, cyber craft, fifth dimension, etc) and it shows.

there was a great talk by grugq this month at disclosure2020 which debunks both the language in this article and some of the opinions here: https://invidious.snopyta.org/embed/_k0MkJMHPi0?start=536

there is a lot of horse manure peddled in this domain (and a lot of thought-thinkers have turned out to be spectacularly wrong). This article is so terribly wrong everywhere that it's neither worth reading nor discussing imvho.

Whenever i hear someone talking about "cyber" a large part of my brain switches off. Im sure that some people are told they simply have to use the term, but i find real experts shy away. If i have a choice between talks on "remote exploitation analysis" or "cyberwar weapons research" ill go with the boring title every time.

> Whenever i hear someone talking about "cyber" a large part of my brain switches off. Im sure that some people are told they simply have to use the term, but i find real experts shy away. If i have a choice between talks on "remote exploitation analysis" or "cyberwar weapons research" ill go with the boring title every time.

You actually have two different sets of experts here with their own jargon: the military/political leaders and the soldier-hackers. The HN readership likely has a lot more in common with the latter than the former, but it might be a mistake to insist that all groups use the latter's jargon. Kinda like it would be a mistake to insist biologists talk in the jargon of particle physics.

The article is a lot lower on jargon that your pretty aggressive comment.

It is also very light on actual content. It basically states that the UK has put in place the military organization, developed offensive capabilities relating to information systems (ergo developed exploits and recruited experts) and has used them offensively in the past.

While I agree none of this is terribly interesting (everyone does this), I fail to see how it is spectacularly wrong. Would you mind explaining ?

Is there any developed country that doesn't have this type of capability? Certainly all five-eyes countries have some form of capabilities. China, Russian, North Korea, Iran all regularly demonstrate they do too.

The question is: who's putting effort into the far less-sexy defensive capability?

compare https://news.ycombinator.com/item?id=24575935

Defending systems against hacking tends to be far harder than hacking them, if only because you have to think of everything, and then harden it.

Based on the UK's record with IT I would be far more reassured if it was working hard to defend critical civilian infrastructure than if it could take out a few servers in a remote country.

> I would be far more reassured if it was working hard to defend critical civilian infrastructure

NCSC has an 'exercise in a box' [0] that you can use for precisely this purpose.

[0] https://www.ncsc.gov.uk/information/exercise-in-a-box

Both one would hope I wont say any details in public but I do remember conversations with colleagues and some people on a networking course how fragile some of the CNI is in the UK.

I thought that was going to be about the recent 'official' stories that the British Army was going to get rid of its tanks:

https://www.bbc.co.uk/news/uk-53909087

What we can be certain of is that the Army will never willingly get rid of its horses.

Wow. We somehow failed to notice that horses don't fit in foxholes, but we did eventually get rid of ours when we noticed they weren't really cut out for NBC suits.

(Youtube is failing miserably for Parade Song of the Camp Animals. Kipling actually had tunes in mind for them, something none of the interpreters in my bubble seem to have noticed.

For instance: https://www.youtube.com/watch?v=Av2-A-igOJk

    By the brand on my shoulder, the finest of tunes
    Is played by the Lancers, Hussars, and Dragoons,
    And it's sweeter than "Stables" or "Water" to me--
    The Cavalry Canter of "Bonnie Dundee"!

    Then feed us and break us and handle and groom,
    And give us good riders and plenty of room,
    And launch us in column of squadron and see
    The way of the war-horse to "Bonnie Dundee"! )

The Army has had more horses than tanks for a while:

https://www.bbc.co.uk/news/uk-scotland-highlands-islands-229...

> The British Army has not used horses in a combat role since World War I

Note that this isn't true - several British Army combat units genuinely fought on horseback during WWII.

https://api.parliament.uk/historic-hansard/lords/1941/aug/06...

And I believe you can still do a combat horse riding course at one of the US special forces schools today.

One good explanation for having so many horses is simply that a tank carries four soldiers while a horse only carries one!

In reality we have one regiment minus (just two squadrons) of horse mounted cavalry, just one troop plus of horse-drawn field artillery, and a mounted band. Doesn't seem excessive.

mechanised by 1942: https://en.wikipedia.org/wiki/North_Somerset_Yeomanry#Palest...

Right... that's 3 years into WWII, isn't it?

Yes. Expanding upon your comment, not disagreeing with it. Thanks for the Hansard!

According to the mongols, one can't maintain tempo with only one horse per trooper.

(so, does the Cheshire Yeomanry still drill "column of squadron"? I neglected the minor detail above that we still do field mounted recce, which in dual-use is how we train most of our civilian farriers.)

We try not to line up neatly these days to avoid getting bombed or shelled!

Indeed, it’s quite a nice thing for ceremonial and historical purposes

As part of my Young Officer training in the Royal Artillery I had to learn to ride (although ‘riding’ is not the best description, more bouncing around)

> more bouncing around

Thinking of "never trust a clergyman whose toes don't point out when he rides," that's probably a good sign.

So... what's 2+2? https://news.ycombinator.com/item?id=24440882

Indeed, US Special Forces utilized horses in Afghanistan in October 2001:

https://www.militarytimes.com/news/your-military/2019/10/18/...

"be prepared to use indigenous animals for transportation"!

Apparently one of first requests was an appeal for western style saddles as the afgan ones where painful to ride on.

There is also case of an actual cavalry charge being performed by the northern alliance

That's odd, afghan saddles strike me as far more closely related to western[1] than to english.

(I've heard buzkashi matches are usually won by men in their late 40s or early 50s. Given the physical nature of the sport, I believe that says something about spontaneous organisation afghan political culture.)

Edit: oh, the saddle thing was a size issue. I'd've told them to embrace the suck, because better the saddle fit the mount[2] than the trooper :-)

[1] lending credence to the persian->arabic->iberian->western hypothesis.

[2] taking that to the extreme, one gets the proposed saddle design by a european general, which was suitable for leaving on the mounts in camp, even being rollable, but undoubtedly would've required much-better-than-conscript troopers. (the wrong tradeoff for modern times: compare Napoleon vs Mamluks.)

or Corb Lund's Horse Soldier

along with its companion Horse Doctor Come Quick, suitable for the 2020 wave of self-prescriptions.

> who's putting effort into the far less-sexy defensive capability?

In this case, exactly the same people. The UK's defensive capability is public knowledge - here's the website of the public facing part:

https://www.ncsc.gov.uk/

This article is news because its one of the few times they have spoken about the offensive side.

It was the gchq that hacked european institutions way back in 2012(?). And then Belgacom of course.

As an ex British Army officer, this sounds as if the Generals are pretty excited about a new toy to accompany their train set.

How well integrated it is into their battle plans is a question to which the answer is probably; not much

I think traditional military's are finding hard to recruit and also realise there cyber warriors are not going to be enlisted ranks.

The sort who in ww2 would have been a cheery chappie dispatch ride from section Y, who works out a break into shark whilst jamming (with a uke) with some of Glen Millers band in the Bar of the Bear in Bedford.

For non brits I am of course thinking of George Formby -

For esprit de corps maybe Cyber should issue regimental robes and wizard hats?

ROBES AND HATS, BY NUMBERS — ONE!

For Cyber I suspect the uniform would be more leather / mirror shades - and Gucci kit a modem remake of the FG42

And can we the dress uniform looking like Psi Core from Bab 5.

Red cyber, at least according to Rossiya 1, agrees on the leather but their shades aren't mirrored. (the clip lacks the resolution to check if their eyes are Ono Sendai, Zeiss Ikon, or Progress Lomo.)

https://news.ycombinator.com/item?id=24453689 (any russophones care to help us out with the lyrics?)

TIL who may have been a banjolele influence on Mr. B? https://www.youtube.com/watch?v=9A2UDllfCOY

Oh I forgot we need a snazzy hat - a cross between the Tarleton Bonnet and the Berglisari Hat.

Motto: ex purgamentis purgamenta fit

You'll also need quick and slow marches...

FAST A March Version of "The Harder They come" by Jimmy Cliff

What a strangely phrased headline. Putting aside the discussion of whether a nation _should_ do this, isn’t this basically a fair number of government employees’ job description?

“British government employees perform their assigned tasks successfully, top general admits”

Whilst also raising the profile of Cyber ahead of the defence review.

This is a weird story. At the prices involved in maintaining this capability it would be strange if Belize didn't have "offensive cyber".

Belize barely has stable broadband throughout most of the country, so not sure if this is a typo or some kind of inside joke? Maybe autocorrected from Britain -> Belize?

No, I meant Belize. As in, at the costs involved, practically every country can maintain this capability.

Does North Korea have stable broadband throughout? I don't think that's a requirement, except for wherever you've stashed your handful of people who do the work.

No. Stable broadband across the country has nothing to do with whether a state can maintain an offensive "cyber" capability.

It would be far more scandalous if any developed country (with an economy which depends on electronic infrastructure) wasn't investing in this capacity.

Having "capacity" is like having a military... it doesn't mean you're using it, it means you understand it and can use it as a viable deterrent.

What offensive cyberwar capabilities do civilians have to fight back?

Don't Panic!

Reply on news.ycombinator.com