The 'cyber-attack' threat to London's Olympic ceremony
bbc.co.uk
bbc.co.uk
A giant intelligence-industrial facility was set up for what is effectively a large sports-day type event. The opening ceremony was potentially at risk of having lights turned off due to an unspecified and as yet unqualified threat.
The intelligence-industrial complex went into action to qualify the threat and it's clear from the butterflies in stomach moment that they didn't realise it was a false alarm until afterwards.
This tells us a lot about the effectiveness of GCHQ's fibre-splicing 3 day archiving of all Internet traffic, and of the security services' abilities to monitor threats through other means in order to determine whether or not they exist.
In conclusion, it appears that the olympics were chasing their own tails, supported by a giant security state apparatus and couldn't determine whether or not the threat was real, let alone any details about the threat until after the event.
Disgusting.
As for the military presence, it's debatable about this. Do you deploy the defences and the Spies so you're able to react and protect, should anything occur? Or do you take a chance that something won't happen (like the Boston bombing, 9/11, 7/7, Munich Olympics, Manchester bombing occuring during Euro '96) but if anything does happen, accept that the damage is likely to be much higher (potential many people dying in the worlds spotlight)?
Personally, I'm happy to accept that the people making these decisions are (hopefully) privy to a lot more information than I am and, generally, I'm happy to trust them with my personal safety allowing me to enjoy the worlds greatest sporting event.
Also, general point regarding military spending; Military things are generally so expensive because of all the clever work that goes into designing, testing and building them. Again, think of how many people the 'military machine' employs, all that expertise on rocketry, nuclear physics, cyber skills, communications, etc. As an added bonus, Military organisations, especially spooks, employ a high percentage of natives, so you're effectively giving jobs and money to your direct neighbours, friends and relatives and not some foreign Chinese industrial Goliath.
Regarding actual infrastructure work: if the target was regeneration, surely it would have been cheaper to build it anyway and just give it away for free, which wouldn't have required a massive (and massively expensive) security effort, all the G4S-style jobs-for-cronies and so on?
Personally, I'd rather see the State undertake real infrastructure work on clear and honest terms, rather than having to wait for some international sport mafia rolling into town so that money can be spent.
Yes, I agree with this.
"Waste" is the misallocation of resources whereby you don't get as much benefit from choosing A and you would from choosing B. I would certainly rather see money and resources spent on civil engineering projects, like HS2, broadband rollout, CERN, new Motorways than old military technology.
However, tying to sell this to the public is where it gets hard, selling a sporting event seems a lot easier than selling a Nuclear power plant.
>but do you really want to live in a country where everyone is directly or indirectly hired by the military?
This hardly describes the UK, we have an average defence budget that is being cut more and more almost on a daily basis. It's tiny compared to the US.
>considering most of the "spying infrastructure" (and military as well, these days) is still bought from abroad
I'm assuming from your comment you're from the UK, in which case we are that 'abroad'. Defence and cyber engineering is one of our few exports, for better or worse.
And yes, our defence budget is small compared to the US, but looking at how this budget is used in the States, I'd say keeping it small is a good choice: the less bombs we have, the less likely we are of dropping them on random countries (yes we went to Iraq and Afghanistan, but we also pulled out much earlier exactly because of budgetary constraints).
This is the problem with weapons, real or cyber: once you make them, you'll want to use them one way or another.
So what? A billion people might get bored for five minutes and go on a planet destroying rampage? More a reflection of the myopic TV world, where a black screen is a cardinal sin, than any real problem. There would have been no safety issue, since the stadium would certainly have had battery backed emergency lights and exit signs, so the people inside would not have been in pitch black.
It's worth noting that the moving cauldron got jammed for several minutes in Sydney's opening ceremony, in 2000, and the world didn't end. In fact, it was one of the best bits of the telecast, watching the guys underneath furiously belting it with sledge hammers, in an effort to get it moving.
We don't, so either: it's not that easy, or no one has worked out how to do it yet.
What it doesn't indicate is that spying on everyone helps at all. What GCHQ should be doing is working with infrastructure providers to make sure all their security software is up to date, deploying things like SELinux (one good thing the NSA has done), doing free pen-testing, advising companies on how to architect critical networks and so on.
The threat isn't entirely hype. Stuxnet basically proved that dropping a grid is do-able.
Not sure how you'd do individual companies, but the power grid as a whole is a lot more fragile than you might think.
The industry is taking things seriously, but there are a lot of problems to sort out. Fixing legacy network architectures takes time, and a lot of critical systems never get patched. That's before you factor in espionage or 0day.
But the idea that someone was actually planning to do this to the Olympics opening ceremony probably was hype.
The source of the info isn't stated, but it's more likely to be a case of "forensics panic" or on-site network sensors going off than anything else.
Didn't Stuxnet target very specific Siemens SCADA systems, unless our grids all run the same controllers and the same software (which they might well do, I have no idea) - surely an attack like that would be difficult to scale?
Typically you might only need to cause a few targeted failures at the right time, and if you do this in a nasty way you can cause a cascading failure, taking out key transmission lines or other nodes in the network.
* http://en.wikipedia.org/wiki/Cascading_failure
* Structural Vulnerability of the North American Power Grid - http://arxiv.org/pdf/cond-mat/0401084v1.pdf
* Risk-aware Attacks and Catastrophic Cascading Failures in U.S. Power Grid - http://www.ele.uri.edu/nest/paper/Globecom_2011.pdf
It's a very "Dr Evil" topic, I know...
Oh no... http://www.energy.siemens.com/hq/en/power-transmission/ http://www.energy.siemens.com/hq/en/fossil-power-generation/ http://www.siemens.co.uk/en/news_press/index/news_archive/20...
What I meant was, how diverse are the control systems for national grids. If they are highly diverse then they are going to be more difficult to target, if they are all the same generation kit from the same vendor then the threat will be higher.
Which one is it?
So your point is valid, but diversity doesn't help if the overall resilience of the grid is so low that attacking a few carefully chosen targets could cause a massive blackout.
For Critical National Infrastructure this is handled through an organisation called CPNI[1], that runs information exchanges. Where data is regulated by the government's own security framework this is handled by the Cabinet Office[2] and by a section of GCHQ called CESG[3].
> deploying things like SELinux (one good thing the NSA has done)
Are you suggesting that GCHQ should go around installing SELinux on peoples' computers, or that they should tell others to do it? There's actually a pretty comprehensive (if typically bureaucractic) information assurance framework in use throughout .gov.uk.
> doing free pen-testing
CESG (part of GCHQ) have a full service catalogue and they do provide certification for private sector suppliers through the CESG CHECK Scheme[4].
> advising companies on how to architect critical networks and so on.
Again, that's more Cabinet-officey type stuff, but CESG does provide guidance in the form of Good Practice Guide (GPG) documents, here's[5] an example of one.
GCHQ does actually do a lot of good stuff, but Olympic power switch threat management probably isn't the best example.
[1] - http://www.cpni.gov.uk/
[2] - https://www.gov.uk/government/publications/security-policy-f...
[3] - http://www.cesg.gov.uk/Pages/homepage.aspx
[4] - http://www.cesg.gov.uk/servicecatalogue/CHECK/Pages/index.as...
[5] - https://www.gov.uk/government/uploads/system/uploads/attachm...
IMHO the Pirate party UK are completely right in thier 140 char summary: "GCHQ tries to win over public detailing how something didn't happen: http://ow.ly/mKqxw #Olympics plan basically turn it off + on again"
It was either that or tea.
I really hope some general has not ordered nuclear missiles to be on the internet.
There's a lot of exaggeration in the story. It makes it sound as if the stadium would have been plunged into darkness, when in fact there's significant contingency planning at these type of events around power loss, and there is in nearly all cases a mechanical (rather than computerised) failover.
A far more interesting (I think, anyway) would be an attack on the actual lighting control systems themselves. Like I said, they're running over ethernet on a variety of proprietary and not-so proprietary protocols that haven't had much attention on the security side of things. And yes, they're not connected to the internet, but it wouldn't be too difficult to compromise a lighting unit itself before it was shipped from the rental shop to the stadium.