Skating on Stilts

More Good News on Attribution: The Face of a Russian Cyberspy?

I've been beating the drums for the value of tracking down the cyberspies who are attacking US government agencies and private companies alike. Somebody seems to be listening. Counterhackers have already unmasked a Chinese cyberspy.

And now the government of Georgia has landed an even bigger fish, seizing control of a cyberspy's computer and taking screen shots of him. Adding insult to injury, the Georgians also managed to steal files from his computer that strongly suggest ties to Russia's intelligence service. Network World has the story:

The photos of the hacker were taken after investigators with the Georgian government's Computer Emergency Response Team (Cert.gov.ge) managed to bait him into downloading what he thought was a file containing sensitive information. In fact, it contained its own secret spying program.

...

They allowed the hacker to infect one of their computers on purpose. On that computer, they placed a ZIP archive entitled "Georgian-Nato Agreement." He took the bait, which caused the investigators' own spying program to be installed.

From there, his webcam was turned on, which resulted in fairly clear photos of his face. But after five to 10 minutes, the connection was cut off, presumably because the hacker knew he had been hacked. But in those few minutes, his computer -- like the ones he targeted in the Georgian government -- was mined for documents.

One Microsoft Word document, written in Russian, contained instructions from the hacker's handler over which targets to infect and how. Other circumstantial evidence pointing to Russian involvement included the registration of a website that was used to send malicious emails. It was registered to an address next to the country's Federal Security Service, formerly known as the KGB, the report said.

For those who can't get enough of this satisfying story, here's the original Georgian CERT report on the sting.

But I can't help thinking the Stylistics said it best: "Payback is a dog."    

The Legality of Counterhacking: Baker's Last Post

Now the debate with Orin is actually getting somewhere. Sort of. Orin has posted a further reply. Here’s a scorecard:

 1. Does authorization depend exclusively on ownership?

 Orin’s latest post does a good job of showing that the CFAA often draws a coherent distinction between rights in data and rights in a computer, and that rights in the computer are the statute’s principal focus. I don’t disagree.

Where we differ is how much that matters. Orin seems convinced that this distinction makes rights in data irrelevant to the question of what constitutes authorized access to a computer.  He doesn’t really offer a reason for treating it as irrelevant.  He just assumes it must be, probably because he also assumes that authorization is an all or nothing concept, so that if the owner has authorization no one else has any, and vice versa.

But Orin's assumption has no basis in the statute that I can see. As my last post says, that’s like assuming that because a trespass statute protects the owners of land, everyone else must be punished as a trespasser, no matter what other rights they have to enter the property.  That would make felons of rescuers, people in hot pursuit of thieves, easement holders, and government officials.  You could come to that conclusion if that’s what the law unequivocally said, but in this case the law only makes felons of people who are not authorized (or not entitled) to access the computer. 

So why would we ignore other claims of entitlement – especially when ignoring those claims makes a felon of someone performing an act with undeniable social value?

Orin’s reluctance to defend his assumption is striking. Maybe he's got a good response; but he hasn't offered it yet.

 2. Should policy influence the interpretation of "authorization"?

 Orin continues to look down his nose at the introduction of policy into the interpretation of this central but undefined term.  He thinks I’m requesting a new statute.  In fact I’m asking the courts to recognize a perfectly plausible reading of “authorization,” in a criminal context where ambiguity would ordinarily be resolved in favor of the defendant.

I agree with Orin that this interpretation requires the courts to decide which entitlements should be recognized and which should not. He thinks that's a role for Congress, not the courts, an argument that might be more persuasive in discussing a civil statute, or a criminal statute that was not deterring companies from responding aggressively to a dangerous intelligence attack on our economy and our society.  

That said, I welcome Orin’s acknowledgement that maybe Congress should permit counterhacking in some circumstances. Though I fear the CCIPS Old Guard lives on in his heart, and that somehow no actual amendment will ever quite pass muster there.

 3. Is necessity a defense for counterhacking?

 Orin suggests that a federal criminal necessity defense might be more apt in this case.  Maybe so, but he acknowledges that it is at best controversial.  At worst, in fact, it doesn’t exist . So, while I won’t spurn even a modest agreement with Orin, the chance to prove an affirmative defense that may not apply isn't likely to offer much comfort for companies that want to gather information about their attackers.

 ***

I don’t want to prolong this debate for readers who have lost interest, so I won’t be making any further posts. If you want to follow it further, check the Volokh Conspiracy for a continuation of the debate in the comments to my post or to Orin Kerr's last post.

The Legality of Counterhacking: Baker Replies to Kerr

Orin Kerr and I agree that “authorization” is the central, and undefined, key to criminal liability under the CFAA. 

In Orin’s view, “authorization” can be determined by asking two questions:  First, does the CFAA protect computers or data? And, second, who controls a computer, the data owner or the computer owner?

It seems to me that the right answer to each question is “both.” The CFAA can and should protect both computers and data stored on computers. Similarly, more than one person can have rights to data on a computer.

In contrast, Orin insists that the CFAA forces a choice.  If it protects computers it can’t protect data.  And the authorization it describes must be binary – you either have full authorization or you have none. But he musters strikingly little support for a point that is so fundamental to his claim.

If anything the statute refutes that argument.  The only textual clue to what the statute means by “authorized” is found in a section that imposes liability on users who exceed their authorized access to a computer; that term is defined as follows: “[T]he term ‘exceeds authorized access’ means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”  Put another way, you exceed authorized access if you obtain or alter information you're not entitled to obtain or alter.

This definition undercuts both of Orin’s assumptions about authority. It blurs his sharp line between machine and information by saying that a user’s access to the computer exceeds authorization if the user exceeds his authorized access to the information. And it treats “authorized” and “entitled” as more or less synonymous, which isn't exactly consistent with the idea that authorization is all-or-nothing.  If I'm attending a demonstration on the Mall, and the Park Police tell me to move on, I’m likely to say, “Sorry, but I’m entitled to be here.”  As I am.  But that doesn’t mean that I can then tell them to move on.  They’re entitled to be there too.  And what if I try to enforce my edict by taking a swing at one of them? He might say, “You're entitled to be here, but you’re not entitled to do that here.” Quite right, too; it’s jail for me. It turns out my entitlement was real, but it was neither exclusive nor unlimited.

So too with computers under the CFAA.  I may be entitled to retrieve my stolen data stolen from a machine without being entitled to take the machine to a pawn shop and sell it, or to tell the innocent owner what he can and can't do with it.

In real life, what I’m entitled to do on a piece of ground depends a lot on who owns it, but it depends also on a host of other rules that limit and define the rights of owners, visitors, trespassers, polluters, police, and even outraged victims in hot pursuit of thieves.   All those players are entitled to do some things but not others on that property. 

There’s no sign in the CFAA that Congress intended to exclude that complexity from its definition of “authorization” and instead to decide criminal liability by simply asking, “Who owns this box?” And what about policy? 

Which reading of the statute produces better results (an argument that Orin, inexplicably channeling early 19th century jurisprudential style, derides as an “I-like-it-and-therefore-it-is-the-law argument”)?

To understand the policy consequences of the choice, let's begin with a reminder of our strategic situation. Right now, every computer and network in the country is vulnerable to intrusion by authoritarian foreign governments if not criminals.  We live, or soon will, in Orwell's world -- surveilled in our homes, at work, and as we form our thoughts, keystroke by keystroke.

The intruders have one clear vulnerability; they collect this stolen data on command-and-control machines, which may in some cases belong to other innocent victims. Victims could gain access to these machines, could render the stolen information worthless, could gather clues about the attackers, and could even identify hundreds of other victims who probably don't yet know they've been compromised. That would be a very good thing.

In Orin's world, though, it's illegal. In his world, the hundreds of victims go unnotified, the evidence goes ungathered, the stolen data goes, well, to China, until law enforcement gets around to the cyber equivalent of stolen-bicycle paperwork.

Why? Well, says Orin, because any other rule would authorize Disney to hack everyone’s computers in pursuit of pirated videos and would license crime victims to hack any computer as long as they had a good faith belief that the hacking might turn up evidence. In full CCIPS Old Guard mode, he insists that because attribution is hard, the right to counterhack is “not a power that we want to give to every person in the U.S. who happens to own or control a computer.”

I can’t help noticing how determinedly Orin trivializes the threat we face:  The counterhackers aren’t  people “who happen to own or control a computer.”  They’re people who are being victimized in a profound and society-changing fashion. Nor are the intruders remotely like a “neighbor [who] borrowed your baseball glove and you want it back.” They're Orwell's nightmare, showing up late and requiring us to buy the gear that spies on us.

And what of all those bad policy outcomes that Orin conjures – the crazed vigilantes and the RIAA rummaging in everyone's computers?  The answer is that we, or at least the courts, don't have to recognize their authority to do that. The courts don’t have to treat “good faith” as creating a counterhacking entitlement; they could as easily insist on a higher standard, such as probable cause.  They could recognize the counterhacker's authority to gather evidence but not to harm innocent third parties, just as they distinguish today between demonstrators who are entitled to throw insults but not punches on park property. They could reject the notion that the copying of 99-cent music files justifies the same response as a campaign to compromise every network in the country. They could distinguish, in short, between baby and bathwater.

It's true that my definition of authorization is more complicated than Orin's, that it requires more line-drawing.  But so does life.  Orin’s alternative is as simple -- and as unjust -- as applying the murder laws equally to serial killers and to homeowners who shoot home invaders.  

Nothing in law or policy requires that we adopt such a reading.

RATs and Poison: Can Cyberespionage Victims Counterhack?

More good news for network security:  It turns out that the tools attackers use to control compromised computers are themselves full of security holes. A couple of undergrads interning for Matasano Security have reverse-engineered the Remote Access Tools (RATs) that attackers use to gain control of compromised machines. 

According to Dark Reading, Jesse Hertz and Shawn Denbow found numerous flaws in commonly used RATs, including SQL injection, arbitrary file reading, and weak encryption.

"This shows that it is possible, and that it's not hard, to pick apart attacker tools and come up with proactive defenses against them," says John Villamil, senior security consultant with Matasano, who served as Denbow and Hertz's adviser for the project. "If nothing else, it can help forensics companies analyzing traffic from compromises ... and help build tools that analyze these Trojans, and provide signatures [to detect them]."

Vulnerability research into attacker tools is rare, but not unheard of. "It's very rare to see this type of research," Villamil says.

RATs, which typically conduct keylogging, screen and camera capture, file management, code execution, and password-sniffing, for example, basically give the attacker a foothold in the infected machine as well as the targeted organization.

This is great news for cybersecurity.  It opens new opportunities for attribution of computer attacks, along lines I’ve suggested before: “The same human flaws that expose our networks to attack will compromise our attackers’ anonymity.”

In this case, the flaws identified by Hertz and Denbow could allow defenders to decrypt stolen documents and even to break into the attacker’s command and control link – while the attacker is still on line. That opens up the possibility of a true counterhack, in which the defender exploits a flawed attack to gain control of the attacker’s machine.

It’s only a matter of time before counterhacks become possible. The real question is whether they’ll ever become legal. Both the reporter and the security researcher agree that, “legally, organizations obviously can't hack back at the attacker.”

I think they're wrong on the law, but first let's explore the policy question.  Should victims be able to poison attackers' RATs and then use the compromised RAT against their attacker?

We'll start with the obvious.  Somebody should be able to do this.  And, indeed, it seems nearly certain that somebody in the U.S. government -- using some combination of law enforcement, intelligence, counterintelligence, and covert action authorities -- can do this.  (I note in passing, though, that there may be no one below the President who has all these authorities, so that as a practical matter RAT poisoning may not happen without years of delay and a convulsive turf fight. That's embarrassing, but beside the point, at least today.)

Asking government to do the job has some drawbacks, though. Counterhacking is likely to work best if the attacker is actually on line, when the defenders can stake out the victim’s system, ready to give the attacker bad files, to monitor the command and control machine, and to copy, corrupt, or modify exfiltrated material.  Defenders may have swing into action with little warning. 

Who is going to do this?  Put aside the turf fight. Does anyone think that NSA or the FBI or the CIA have enough technically savvy counterhackers to stake out the networks of the Fortune 500, waiting for the bad guys to show up?

And even if they do, who wants them there? Privacy campaigners will hate the idea of giving the government that kind of access to private networks, even networks that are under attack. For that matter, businesses holding sensitive data won’t much like the stark choice of either letting foreign governments steal it all or giving the US government wide access to their networks.

From a policy point of view, surely everyone would be happier if businesses could hire their own network defenders to do battle with attackers. Hiring defenders would greatly reinforce the thin ranks of government investigators.  It would make wide-ranging government access to private networks less necessary.  And busting the government monopoly on active defense would probably increase the diversity, imagination, and effectiveness of the counterhacking community.

But, you ask, what about vigilantism, that tired bugaboo of the Justice Department’s Old Guard?

First, as I’ve suggested elsewhere, allowing private counterhacking doesn’t mean reverting to a Hobbesian war of all against all.  Government can set rules and discipline violators, just as it does with other privatized forms of law enforcement, from the securities industry’s FINRA to private investigators.

Second, the "vigilatism" claim depends heavily on sleight of hand.  People who hate this idea invariably call it "hacking back," with the heavy implication that the defenders will blindly fire malware at whoever touches their network, laying indiscriminate waste to large swaths of the Internet. For the record, I'm against that kind of hacking back too.  But RAT poison makes possible a kind of counterhacking that is far more tailored and prudent.  Indeed, with such a tool, trashing the attacker's system is dumb; it is far more valuable as an intelligence tool than for any other purpose.  

Of course, even if they aren't trashing machines, the defenders will be collecting information.  And gathering information from someone else's computer certainly raises moral and legal questions. So let's look at the computers that RAT poisoning might allow investigators to access.  

First, and most exciting, this research could allow us to short-circuit some of the cutouts that attackers use to protect themselves.  I grant that I’m beyond my technical capabilities in saying this, but it seems highly unlikely to me that an attacker can use a RAT effectively without a real-time connection from his machine to the compromised network.  Sure, the attacker can run his commands through onion routers and cutout controllers.  But at the end of all the hops, the attacker is still typing here and causing changes there.  If the software he’s using can be compromised, then it may also be possible to reverse the flow of code inject arbitrary code into his machine and thus compromise both ends of the attacker's communications.  That’s the Holy Grail of attribution, of course. 

Is there a policy problem with allowing private investigators to compromise the attacker's machine for the purpose of gathering attribution information? Give me a break. Surely not even today's ACLU could muster more than a flicker of concern for a thief's right to keep his victim from recovering stolen data.  

The harder question comes when the attacker is using a cutout -- an intermediate command and control computer that actually belongs to someone else.  In theory, gathering information on the intermediate computer intrudes on the privacy of the true owner. But, assuming that he's not a party to the crime, he has already lost control of his computer and his privacy, since the attacker is already using it freely.  What additional harm does the owner suffer if the victim gathers information on his already-compromised machine about the person who attacked them both? Indeed, an intermediate command and control machine is likely to hold evidence about hundreds of other compromised networks.  Most of those victims don't know they've been compromised, but their records are easy to recover from the intermediate machine once it has been accessed.  Surely the social value of identifying and alerting all those victims outweighs the already attenuated privacy interest of the true owner.

In short, there's a strong policy case for letting victims of cybercrime use tools like this to counterhack their attackers. If the law forbids it, then to paraphrase Mr. Bumble, "the law is a ass, a idiot," and Congress should change it.  

But I don't think the law really does prohibit counterhacking of this kind, for reasons I'll offer in a later post.

PHOTO: iStockPhoto

UPDATE: I modified a phrase that turned out to be more colorful than helpful to literal-minded readers.

RATs and Poison II -- The Legal Case for Counterhacking

In an earlier post, I made the policy case for counterhacking, and specifically for exploiting security weaknesses in the Remote Access Tools, or RATs, that hackers use to exploit computer networks. 

Poisoning an attacker's RAT is a good idea for at least three reasons.  First, we can make sure the RAT doesn't work or that it actually tells us what the attackers are doing on our networks.  Second, compromising the RAT can give us access to the command and control machines that serve as waystations that let attackers download stolen data or upload new malware.  Finally, if we're very lucky and very good, we can use the poisoned RAT to compromise the attacker's home machine, directly identifying him and his organization.

The legal case for counterhacking is more problematic, thanks to long-standing opposition from the Justice Department's Computer Crime and Intellectual Property Section, or CCIPS.  Here's what CCIPS says in its Justice Department manual on computer crime:

Although it may be tempting to do so (especially if the attack is ongoing),
the company should not take any offensive measures on its own, such as
“hacking back” into the attacker’s computer—even if such measures could in
theory be characterized as “defensive.” Doing so may be illegal, regardless of
the motive. Further, as most attacks are launched from compromised systems
of unwitting third parties, “hacking back” can damage the system of another
innocent party

This passage is a mix of law and policy. I've already explained why the Justice Department's policy objections -- the risk of damage to innocent parties' systems -- are out of date. 

That leaves the law. Does the Computer Fraud and Abuse Act, or CFAA, foreclose counterhacking?  In fact, the weasel words of the manual -- hacking back "may be illegal," it says, so victims "should not" do it -- are a clue that the law is at best ambiguous.

Really, ambiguity is the heart of the CFAA. To oversimplify a bit, violations of the CFAA depend on "authorization."  If you have authorization, it's nearly impossible to violate the CFAA, no matter what you do to a computer. If you don't, it's nearly impossible to avoid violating the CFAA.

But the CFAA doesn't define "authorization."  It's clear enough that things I do on my own computer or network are authorized. That means that the first step in poisoning a RAT is lawful.  You are "authorized" under the CFAA to modify any code on your network, even if it was installed by a hacker.  (Let's put aside copyright issues; they generally don't enter into CFAA "authorization" analysis, and it's unlikely in any event that a hacker could enforce intellectual property rights against his victim.)

A harder question is whether you're "authorized" to hack into the attacker's machine to extract information about him and to trace your files.  As far as I know, that question has never been litigated, and Congress's silence on the meaning of "authorization" allows both sides to make very different arguments.  The attacker might say, "I have title to this computer; no one else has a right to look at its contents. Therefore you accessed it without authorization." And the victim could say, "Are you kidding?  It may be your computer but it's my data, and I have a right to follow and retrieve stolen data wherever the thief takes it.  Your computer is both a criminal tool and evidence of your crime, so any authorization conveyed by your title must take a back seat to mine."

In a civil suit, Congress's decision to leave undefined the central concept of the statute would make both of those arguments plausible.  Maybe "authorization" under the CFAA is determined solely by title; and maybe it incorporates all the constraints that law and policy put on property rights in other contexts. Personally, I dislike statutory interpretations that fly in the face of good policy, so I think the counterhacker wins that argument.  

But that hardly matters; computer hackers won't be bringing many lawsuits against their victims.  The real question is whether victims can be criminally prosecuted for breaking into their attacker's machine.  

And here the answer is surely not.  

Even if you could find a federal prosecutor wacky enough to bring such a case (and after the Lori Drew case, I'm afraid that's not unthinkable), the ambiguity of the statute makes a successful prosecution nearly impossible; deeply ambiguous criminal laws like this are construed in favor of the defendant.See, e.g.,  McBoyle v. United States, 283 U.S. 25, 27 (1931) ("[I]t is reasonable that a fair warning should be given to the world, in language that the common world will understand, of what the law intends to do if a certain line is passed. To make the warning fair, so far as possible, the line should be clear.") (Holmes, J.).

Much the same analysis applies even to the hardest case, where victims use a compromised RAT to access command and control machines that turn out to be owned by an innocent third party.  An innocent third party is a more appealing witness, but his machine was already compromised by hackers before the counterhacking victim came along, and it was being used as an instrumentality of crime, sufficient in some states to justify its forfeiture. It remains true that the counterhacker is pursuing his own property.

Finally, when he begins his counterhack, the victim does not know whether the intermediate machine is controlled by an attacker or by an innocent third party. Why should the law presume that it is owned by an innocent party -- or force the victim to make that presumption, on pain of criminal liability? (There's room for empirical research here; while a few years ago hackers seemed to favor compromising third-party machines for command and control, the Luckycat study suggests that some attackers now prefer to use machines and domains that they control.  As the latter approach grows more common, a presumption that intermediate machines are owned by innocent third parties will grow even more artificial.)

All told, it seems reasonable to let victims counterhack a command and control machine that is exfiltrating information from the victim's network, at least enough to determine who is in control of the machine, to identify other victims being harmed by the machine, and to follow the attacker back to his origin (or at least his next hop) if the intermediate machine is simply another victim. Requiring the victim not to counterhack if there's uncertainty about the innocence of the machine's owner simply gives an immunity to attackers.

The balance of equities thus seem to me to favor a recognition of the victim's authorization to conduct at least limited surveillance of a machine that is, after all, directly involved in a violation of the victim's rights.  If "authorization" under the CFAA really boils down to a balancing of moral and social rights, and nothing in the law refutes that view, then the counterhacker has at least enough moral and social right on his side to make a criminal prosecution problematic -- unless he damages the third party's machine, in which case all bets are off.

 

 

 

CEO of RSA Discovers Privacy Victims

In a speech to RSA 2012 in Europe, Art Coviello challenged privacy laws as a threat to, well, privacy:

"Intelligence-based security also requires information sharing at scale," said Coviello.

But these changes are held back by a number of things, including current privacy laws.

Coviello recounted a discussion he had with a CIO at a leading European manufacturer. Laws require him to protect personally identifiable information in his company's possession or run the risk of stiff fines and penalties, which is fair enough, the CIO told Coviello.

"However, if he implements the very technologies needed to protect that information, including visibility of traffic on his own network, he can potentially and inadvertently break laws designed to protect workers' privacy. So he can't win, ridiculous but true," said Coviello.

“Where is it written that cyber criminals can steal our identities but any industry action to protect us invites cries of Big Brother,” Coviello asked.

Privacy advocates were quick to attack Coviello.  But his willingness to go public is significant.  Until now, with rare exceptions, no mainstream businessman wanted to take the heat for condemning privacy excesses.  But it looks as though the wall of silence is beginning to break.

RSA is no stranger to the privacy debate.  Indeed, it built its business reputation in the 1990s by leading the fight against NSA's Clipper chip and encryption controls, which RSA saw then as the main enemy of Internet security.  

I was part of that fight, though on the other side, so I find RSA's defection from the privacy camp deliciously symbolic.  

In recognition of the switch, I've taken the liberty of updating RSA's poster from that era.

Huawei, ZTE Hit By House Intelligence Committee

The House Intelligence Committee has issued a detailed report on its investigation of Huawei and ZTE, the Chinese telecom equipment giants. It's a professional and bipartisan piece of work, some 50 densely footnoted pages long.

In 2011, Huawei asked for an investigation so it could answer suspicions that it might enable Chinese interception of US communications. But when the House Intelligence Committee obliged, things quickly went downhill.

As the report makes clear, neither Huawei nor ZTE fully answered the committee's questions or produced internal documents.  ZTE even went so far as to say that its internal documents couldn't be released for fear of violating China's state secrets laws. Predictably, this only confirmed the committee's suspicions:

 "To the extent ZTE cannot provide detailed and supported answers to the Committee because China’s laws treat such information important to the  security of the Chinese regime,  the Committee’s core concern that ZTE’s presence in the U.S. infrastructure represents a national-security concern is enhanced."

But it is Huawei that comes in for the harshest treatment, perhaps because the company was even less cooperative than ZTE.  Although the committee manages to extract more information than anyone else about Huawei's corporate organization, the committee judges Huawei's overall response "obstructionist" and describes some of its witness's testimony as "obviously untrue." Short of a referral for perjury, it's hard to imagine a worse outcome.

The committee does not find a smoking gun showing that Chinese equipment is being used for surveillance, though its report explains why it would be hard to prove such suspicions. What the report does find are some troubling reports by Huawei employees, including a strong suggestion that Huawei is helping the Peoples Liberation Army to launch cyberattacks:

The Committee also received internal Huawei documentation from former Huawei employees showing that Huawei provides special network services to an entity the employee believes to be an elite cyber-warfare unit within the PLA.  The documents appear authentic and official Huawei material, and the former employee stated that he received the material as a Huawei employee. These documents suggest once  again that Huawei officials may not have been forthcoming when describing the company’s R&D or other activities on behalf of the PLA.

The committee also heard from other whistleblowers, and its report refers immigration, corruption, and intellectual property violations to the executive branch for possible prosecution. It's likely that Huawei and ZTE are in for years of additional investigation.  

As if that weren't enough punishment, the committee report comes one day after a harsh 60 Minutes story on Huawei covered much the same ground.

It's been a tough week already for ZTE and Huawei. 

And it's only Monday afternoon.

DISCLOSURE: My law firm currently represents Huawei in a patent dispute.  I have no involvement in the matter.

Cybersecurity and Attribution -- Good News At Last?

No, we’re not suddenly turning into the Huffington Post.  But trust me, this photo is directly relevant to the topic at hand:  How the US should respond to massive state-sponsored cyberespionage.

Right now, policymakers are intent on improving network security, perhaps by pressing the private sector to improve its security, or by waiving outmoded privacy rules that prevent rapid sharing of information about attackers’ tactics and tools.

Those things would improve our network security, but not enough to change our strategic position – which is bad and getting worse.  The hard fact is that we can’t defend our way out of the current security crisis, any more than we can end street crime by requiring pedestrians to wear better and better body armor.

That’s why I’ve been urging a renewed strategic focus on catching attackers and punishing them.  Catching and punishing rulebreakers works for street crime.  It even works for nation states.  So why hasn’t it worked in the realm of network attacks?  Mostly because our intelligence community insists that attribution is just too hard. 

I think that’s wrong, and I’ll spend this post explaining why. 

My theory is simple: The same human flaws that expose our networks to attack will compromise our attackers’ anonymity. Or, as I put it in speeches, “The bad news is that our security sucks.  The good news is that their security sucks too.”

In this post, I’d like to go beyond theory to show how hackers’ human frailties and errors make attribution easier. I’ll start with a groundbreaking investigation by  Nart Villeneuve and a team from Trend Micro. The team was the first to identify by name a hacker taking part in the vast China-based campaigns to steal the secrets of military and aerospace companies as well as Tibetan activists. This particular network campaign, dubbed “Luckycat” by researchers, followed familiar lines: careful social engineering of emails to lure the target into opening a poisoned attachment or link, followed by rapid compromise of the target’s computer, lateral privilege escalation to compromise the entire network, and a  leisurely, months-long strip-mining of the network for information. Dozens of campaigns like this have been spotted in recent years, almost all of them aimed at targets of interest to the Chinese government. But because the attackers use Internet cut-outs – intermediate command-and-control computers and domains located around the world – it has been hard to follow them home.

That’s still true, but it turns out that the attackers are only human.  They make mistakes when they’re in a hurry or overconfident.  They leave bits of code behind on abandoned command-and-control computers. They reuse passwords and email addresses and computers. 

The Trend Micro investigators exploited these errors, tying one of the command-and-control domains to an email address and then to a QQ address. (QQ is China’s enormously popular instant messaging system. Owned by Chinese Internet giant Tencent, it has nearly as many users as Facebook -- 711 million in September 2011, when Facebook had 750 million.)

That QQ address in turn was tied to two online nicknames, “dang0102” and "scuhkr," whose users had posted in a notorious Chinese hacker forum and had “recruited others to join a research project on network attack and defense at the Information Security Institute of the Sichuan University."

The University and its "information security" institute has several ties to the hackers; indeed, the nickname "scuhkr" looks like a tribute to SiChuan University, whose internet domain is scu.edu.cn. The investigators identified a second attacker as someone who, they concluded, “also worked and studied at the Information Security Institute of the Si Chuan University and has published several articles related to “fuzzing” vulnerabilities in 2006.”

Exploiting other mistakes made by the intruder, the investigators found that the Luckycat malware had first been road-tested on a Chinese version of Windows XP. Finally, they were able to establish that tools and tactics used in the Luckycat campaign overlapped with those used in the notorious Shadownet campaign against the Dalai Lama.

That wasn’t the end of Luckycat’s unraveling.  The New York Times was able to put a name to scuhkr: 

“The owner of the alias, according to online records, is Gu Kaiyuan, a former graduate student at Sichuan University, in Chengdu, China, which receives government financing for its research in computer network defense.

Mr. Gu is now apparently an employee at Tencent, China’s leading Internet portal company, also according to online records. According to the report, he may have recruited students to work on the university’s research involving computer attacks and defense.

The researchers did not link the attacks directly to government-employed hackers. But security experts and other researchers say the techniques and the victims point to a state-sponsored campaign.” 

The Times actually spoke to Gu, who knew enough about the Western press to declare  “I have nothing to say.” (A few days later, Gu would claim that the nicknames found by the investigators were used by two different people and deny that he was the hacker.  Tencent and the university similarly denied any knowledge of the attacks.)

This report is entertaining in many ways. And not just the part where we imagine Gu’s face when the New York Times gets him on the line. The investigators deserve great credit for their imaginative and determined exploitation of the digital clues that scuhkr left behind.

That said, there’s nothing inimitable about what they did.  Scuhkr's lapses are typical of an intelligence operative in a hurry and not expecting much scrutiny.  It takes stern discipline never to reuse email addresses, nicknames, domains, and command-and-control machines. Inevitably, some attackers will fail to observe perfect discipline.  And those lapses will be increasingly costly because identifying data is proliferating everywhere; both the Trend Micro researchers and the New York Times used pre-existing databases to crime-scene data to real-world identities.

At last, it looks as though one aspect of computer technology is going to favor the defense. More and more data is being collected about network activities, making it harder for attackers to completely cover their tracks. At the same time, more data is being collected about perfectly innocent activities, and this information, like the university jobs forum used by the New York Times, can provide the crucial link that allows us to locate hackers in the real world. 

That’s where the picture at the top of the story comes in. It’s a visual taunt posted by an Anonymous hacker after he had stolen and disclosed personal data from several US law enforcement agencies.  (Roughly translated, the sign says, “Pwned by Wormer and CabinCrew, Love You Bitches!”) The photo was taken in a suburb of Melbourne with an iPhone. We know that because Apple routinely buries GPS coordinates in each photo it takes, because … well, why not, when bits are free?

So when the FBI was assigned to track down the attacker, it used the coordinates to find the subject of the photo.  Open source map data, plus postings on Twitter and Facebook, led the FBI to an Australian woman. Her boyfriend turned out to be Higinio Ochoa, a Texas programmer whom the FBI promptly arrested.  The courts agreed that it was, er, a righteous bust; Ochoa has been sentenced to 27 months in federal prison for his hacking.

These investigations -- Luckycat and Ochoa -- are leading indicators of a trend that will make attribution easier over time.  “Well, why not?” data will only increase, and attackers will find it harder to avoid leaving bits of it behind.  At the same time, open source databases tied to the real world are also growing rapidly.  Big data tools will make it easier to search and find connections among these vast and mostly open networks. As a result, more and more attackers are someday going to find themselves in the shoes of Higinio Ochoa and Gu Kaiyuan.

That day can’t come fast enough, and US policymakers should be doing all they can to bring it about.  The defensive security tools used by government and private networks should put a premium on forcing network users to leave lots of information in immutable logs as they move through the network. Law enforcement agencies should put be collecting and sharing everything about the tactics, tools, and data lapses of network intruders. And intelligence agencies should be building their own storehouses of identifying information so they can eventually link foreign hackers to particular intrusions.

Of course, attribution is only half the answer.  It won’t deter attacks unless it leads to retribution. But that’s a post for another day …

PHOTO CREDITS: iStockPhoto; Gizmodo; Wikipedia

UPDATE: Corrected photo subject's home town.