Cybercrime debate on China TV

Hello and welcome to World Insight, coming to you live from Beijing on CCTV News. I'm your host, Tian Wei. On today's show— and computerized combat. With major hacking incidents becoming more and more widespread, are we seeing the emergence of warfare of the future? Warfare 2.0. With major hacking incidents becoming increasingly common, Are we witnessing the emergence of a new kind of warfare? Welcome back. Once the stuff of paranoid conspiracy thrillers, cyberattacks now are a fact of modern life. Some insiders even say that there are only two kinds of big companies inside the United States: Those who have been hacked and those who don't know they've been hacked. And the internet is also becoming battlefield with governments facing off in the war over cyberspace. Today's policymakers are faced with a range of challenges, from combating cybercrime to even just defining what a cybercrime is. Most important of all is how to get governments working together to contain the threat. Let's take a look.

Invisible enemies becoming ever stronger and more destructive. Sony is the latest victim of a high-profile cyberattack. On November 24th, 2014, their systems were hacked. Employees were locked out their network and glowing red skeletons appeared on their screens.

The reality is that the attack that was conducted on Sony can be done against any other company. Everyone's gonna be vulnerable to the same techniques, whether you're a government agency, whether you're a financial institution, a defense contractor, or an organization in any other industry.

2014 is being seen as a breakthrough year for cyber incidents. In September, 5 million Gmail usernames and passwords were reported compromised. Early in the year, an attack on investment bank JPMorgan Chase in June wasn't noticed until August. The contact information for 76 million households and 7 million small businesses were compromised. And in April, AT&T was hacked for 2 weeks from inside. Personal access to wealth of user information, including social security numbers. But cyberattacks are not only rampant in the commercial world. The U.S. National Security Agency has been engaged in electronic spying and hacking into foreign computer systems and networks around the world on a vast scale. At the same time, the U.S. government has accused the DPRK of being behind the Sony hack. And Russians are said to be the perpetrators of the Google incident last year.

It's not like there's a demarcation line. That exists in some sort of fixed space on what is or isn't.

The cyber domain remains challenging. It remains very fluid. Part of the reason why it's such a challenging domain for us is because there aren't internationally accepted norms and protocols.

As early as 2009, the U.S. established a Cyber Command to counteract both criminal and espionage activity online. Following suit, South Korea announced the creation of its own cyber warfare command in December 2009. In 2010, China introduced its first department dedicated to defensive cyber warfare and information security. And in 2013, the UK government set up a cyber reserve force to deal with security threats posed by computer crime. But questions still remain as to whether the world is truly ready as cyberspace emerges as the new battlefield of the postmodern era.

All right, very exciting issue I guess we're facing right now. Cyberattack, what's behind it and what is ahead? With us in the studio, we have Mr. Yang Mingjie, who is the Vice President of the China Institute of Contemporary International Relations. Welcome, sir. Meanwhile, joining us from Washington, we have Alan Friedman, a research scientist at the Cybersecurity Policy and Research Institute at George Washington University. Welcome. And meanwhile, from Boston, We have Robert Siciliano, an identity theft expert and consultant to Hotspot Shield. Gentlemen, happy New Year to the three of you. We're in the new year and cyberattack is just going to be unavoidable. Let me begin by asking you and also sharing with you some numbers. 2014 was a banner year for cyber incidents. Millions of cyberattacks take place every day globally. This fascinating interactive map would from security firm Norse shows just how dangerous the web can be. And according to Internet Security Threat Report by Symantec, more than 592 million identities were exposed last year. There are also grave cases— increasing cases in targeted hack campaigns and number of breaches compared to the year 2014. 35% of all data breaches that is coming from cyber attacks. What kind of world, gentlemen, are we facing right now? Mr. Siciliano, you are dealing with it every day. What is your assessment?

Well, certainly it's the conveniences of all the technology at our fingertips, including our mobile phones, our laptops, our tablets, and of course our desktops, that is what is making us vulnerable. The internet itself, the World Wide Web as we know it, is around 20 or so years old, so it's still relatively young. And over the past 10 years is when criminal hackers have taken hold and they have figured out how to compromise all of these conveniences.

Is that going to change? Are we going to have some wonderful and magical tools for this year, for example, to revise what happened last year? Mr. Friedman, any new ideas?

I don't think there's any— I don't think there's any going to be any magical thing, but I think it's important to look at these numbers with a grain of salt. So 500 million identities stolen? No, of course not. It just means that credit card numbers are stolen, and the credit card companies are going to get better at preventing fraud. We have all these attacks going around, but it's not clear what the harm is. We need to look at the harms rather than focusing companies seeing these big numbers and running around panicking.

Right, it is not just companies, it is also between governments or between individuals and governments. And Mr. Yang, you know very well recently there's a movie called The Interview, and as a result of that, there seems to be allegations coming from Washington about DPRK hacking or attempting to hack the Sony Pictures, which is the producer of this movie. But eventually there are also inside the United States debates about whether really DPRK is behind this. What do you think about that hacking is becoming such a weapon between governments, between individual and governments, and among individuals?

For me, I don't think it's a new thing for government to use cyber. It's not. And even some nasty actors to make use of the cyber or internet as a weapon to make attack against the government or not government targets. Even 20 years ago, There is some people reported that there's some kind of— they use the word cyber warfare, not only between the governments, but also maybe from the companies and even from some hackers.

So your point is nothing new. No, nothing new, but maybe more widespread.

But widespread. I think last year there are two events maybe to show the new things. One is that come from the United States. As the Snowden case showed, that United States can make use of the cyber as some kind of spy tools against other countries. Other thing is, I think that DPRK issues, the Inter Room case, show that some government want to make use of the hack, no matter who make the attack, to make use of that to make some traditional measures, such as sanctions or something like that. That is combination between from the cyber warfare and the traditional warfare.

Of course, we all understand there is— last year there was also the accusation coming from the U.S. side about the Chinese, I mean, individuals doing hacking against the U.S. government websites. Of course, China disputed that. But in the future, is there some rules that we can follow? Is there any methods that governments can follow to resolve issues like this? Because identity theft can be very easily stolen. And as we all know, it looks like coming from one country is not necessarily coming from that specific country.

Mr. Yang, I think that we need some, some kind of mechanism. The first one, I call it a bilateral mechanism, which means that some countries like China, United States, we can share some information, we can establish IBMs, CBMs. But the other mechanism we can call multilateral mechanism. That's why we want to emphasize the role of United Nations and also the information summit, something like that, to enhance the cooperation.

Is it possible cooperation? That seems to be a magic word. Mr. Siciliano, is it possible? Because this is a new frontier. Governments seem to have their own secretive agenda against one another. Is there ever a possibility of cooperation? For example, U.S.-China?

You know, difficult to say. I would side on that above board, in public, that there may be some agreements had, but behind the scenes there are just so many ways to obscure identities, to hack essentially under the radar. And while governments might outwardly agree to things. They could easily employ or deploy hackers to subvert systems, uh, even while agreements are in place.

So your suggestion is there's no way there's any cooperation, real sense cooperation, what you're saying?

Yeah, I tend to believe that, um, going forward, there will always be subversion No matter what public agreements are being made, there's just too many opportunities to gather data, to gather intelligence, that it's just too attractive to be a hands-off agreement.

I see. Before I go to Mr. Yang here in Beijing, let me just follow up one bit with you, Mr. Siciliano. Are you trying to find excuses for the U.S. government or the U.S. side to do to do, let's say, spying on the others through hacking?

Well, spying has been going on forever, and it's something that will continue. It's just not going to stop. All right. You know, information essentially, we've heard, is power, and it always will be. And so gathering that type of data through computer systems is not something that's going to curtail via any type of a verbal or even written agreement.

Uh-huh.

Also, meanwhile, Mr. Friedman, what do you think? Government cooperation, is it possible? Let me just throw in an example of U.S. and China on anti-hacking and anti-cyber war potential. Is it possible?

Mm-hmm.

I think there's certainly great grounds you made. The important thing first is to take the word cyber off whatever you're talking about and see if it still makes sense. I don't think anyone credibly thinks that the United States and China are going to war. I had a chance to sit down with Minister Lu Wei when he was in Washington a few months ago, and he said that, listen, we agree on 90% of the issues. It's that last 10% that's going to be the real hard part.

Shall we, shall we, Mr. Yang, scrap off the so-called cyber part and only leave the other parts in the discussion? Is it possible?

I think it's possible because we have established some mechanism. Also, it's a suspended game.

What kind of mechanism? Tell us about it.

For example, there are some more— before last year, some Americans want to make use of the Times Square A-Man, but we have established some kind of a working level, so-called dialogue on working level. We have working teams to exchange our views on cybersecurity issues, and we also have We have some track 1.5 dialogue on that issues. For me, I think maybe in current time, we need some challenge, but I am some optimistic about future because we have shared the common interest on cyberspace. Cyberspace is not dominated by any country, so we share the interest means we share the destiny.

Well, Mr. Yang, let me just ask you this because you say the cyberspace is not dominated by any country. That's interesting. Interesting because there were accusations coming from China and other countries that previously the United States is playing a dominant role in the content of the cyberspace. Has that situation according to you now changed? Is that what you're saying?

For example, last year, United States, ICANN, who issues IP address, want to make some reform and held a world summit discussing about that. Also, so far there's no result, but I think the future they will thinking how to change the ICANN's role and how to change America's role in the cyberspace itself.

Well, they do now have a different president coming from a different country, certainly, with ICANN. Mr. Friedman, empty talk or real progress are we talking about? What can be the barometers we bear in mind if we're talking about real progress?

Sure. I think a lot of them are pretty small. They're the technical details. Are companies investing in cybersecurity responsibly? Are we seeing the criminals move? Because again, the bad guys are always going to try to keep pace with the defenders. So if you want to know the progress the defenders are making, you look how hard you make the bad guys work. Are there fewer and fewer countries that are engaging with so-called bulletproof hosting, where content can stay up online even though it's clearly criminal in the international eyes?

Right.

Lot of work we can make. The other question is we still don't have common definitions. We don't have a clear understanding of what a cyberattack means. And so we have people running around saying, "This is cyberwar," when really all you've done is take a website offline.

All right.

So I think, for me, the most important progress we made in 2014 is it was the first time an American politician didn't suggest that we should just remake the internet and make it secure this Well, that's your politics back at home.

Mr. Siciliano, before we go, very briefly from you, what can be your input? One sentence or two. Thank you.

Oh, certainly, you know, in the end, governments and corporations need to continue to beef up their technology, their security technology, and deploy penetration testers at every level. To make sure that systems are both safe and secure for the public and for government and corporations.

All right, that's a lot of tasks you're talking about, but we want to thank the three of you for putting out your suggestions. Mr. Yang Mingjie here in Beijing, meanwhile we have in the United States Alan Friedman and Robert Siciliano. Once again, Happy New Year to the three of you. We hope it's a better year for the cyberspace. Thank you, gentlemen, for being with us. And that is all we have for Today, we'd like to know what you think about anything you've seen on our program. You can certainly email us your thoughts at worldinside@cctv.com. I'm Tian Wei. From myself and the World Insight team, thanks for watching, and join us again tomorrow for more global perspectives and stories from across China and certainly from around the world. Goodbye.