Difference between revisions of "Main Page"

From International cyber law: interactive toolkit
Jump to navigation Jump to search
(added the Huawei incident)
Line 46: Line 46:
 
<choose uncached>
 
<choose uncached>
 
<option>
 
<option>
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:NCSC-GRU.png|left|150px]]
+
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:Huawei featured incident - cropped.png|left|150px]]
On 4 October 2018, the UK National Cyber Security Centre issued a [https://www.ncsc.gov.uk/news/reckless-campaign-cyber-attacks-russian-military-intelligence-service-exposed statement] accusing the Russian military intelligence service (generally referred to under its previous abbreviation GRU for ''Glavnoye razvedyvatel'noye upravleniye'') of a series of cyber attacks “conducted in flagrant violation of international law”. These attacks have ranged from [[DNC email leak (2016)|hacking the Democratic National Committee]] in the US and publishing its documents online, to attempting to compromise the UK Foreign and Commonwealth Office systems through a spearphishing attack, to using ransomware to cause disruption to Ukrainian public transport systems. Some of these attacks allegedly attributable to the GRU display factual pattern similar to several of the toolkit scenarios. In particular, [[Scenario 01: Election interference|Scenario 01]] considers the law relevant to electoral interference using cyber means; [[Scenario 02: Cyber espionage against government departments|Scenario 02]] considers the extent to which cyber espionage targeted against another State’s foreign ministry violates international law; and [[Scenario 03: Cyber attack against the power grid|Scenario 03]] looks at the extent to which disruption of public utilities and other critical infrastructure violates international law.</div></option>
+
In September 2019, Huawei released a [https://www.huawei.com/en/facts/voices-of-huawei/media-statement-regarding-reported-us-doj-probes-into-huawei?utm_medium=sm&utm_source=facts_twitter&utm_campaign=WSJOliviera media statement] accusing the US government of “disrupting” Huawei’s business operations with “every tool at its disposal” including the launch of “cyber attacks to infiltrate Huawei's intranet and internal information systems”. The accusation came three days after a [https://www.wsj.com/articles/u-s-prosecutors-probe-huawei-on-new-allegations-of-technology-theft-11567102622?mod=article_inline Wall Street Journal article] which had reported about the US Department of Justice investigations into Huawei for alleged technology theft. In the Toolkit, [[Scenario 09: Economic cyber espionage|Scenario 09]] assesses the lawfulness of economic cyber espionage under international law. In addition, [[Scenario 05: State investigates and responds to cyber operations against private actors in its territory|Scenario 05]] considers the legal limits to the exercise of law enforcement by one State in response to malicious cyber operations from another.</div>
<option>
 
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:IDF_Hamas.png|left|150px]]
 
In early May 2019, hostilities flared up again in the context of the armed conflict between Israel and Palestine. According to [https://www.nytimes.com/2019/05/05/world/middleeast/gaza-rockets-israel-palestinians.html news reports], hundreds of rockets were fired on Israel, while the Israel Defense Forces (IDF) answered with artillery and airstrikes. Remarkably, the Israeli response included also a kinetic attack allegedly aimed at countering a hostile cyber operation conducted by Hamas. In particular, the IDF [https://twitter.com/IDF/status/1125066395010699264 announced on Twitter] that it had “thwarted an attempted Hamas cyber offensive” and subsequently conducted an air strike against the Hamas Cyber Headquarters. The announcement has sparked a [https://www.linkedin.com/pulse/retaliatory-cyber-attacks-legal-precedent-time-israel-singer/ debate] [https://www.lawfareblog.com/crossing-cyber-rubicon-overreactions-idfs-strike-hamas-cyber-facility whether] this operation sets a legal precedent from the perspective of international law. Within the Toolkit, [[Scenario 03: Cyber attack against the power grid|Scenario 03]] considers when a cyber operation may qualify as a use of force under international law and [[Scenario 12: Cyber operations against computer data|Scenario 12]] analyses aspects of the law of targeting with respect to cyber operations.</div>
 
 
</option>
 
</option>
 
<option>
 
<option>
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:SingHealth_logo.jpg|left|150px]]
+
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:NCSC-GRU.png|left|150px]]
In July 2018, Singapore’s health system (SingHealth) was infiltrated by malware and the personal particulars of about 1.5 million people were [https://graphics.straitstimes.com/STI/STIMEDIA/Interactives/2018/07/sg-cyber-breach/index.html stolen]. Among the victims of the hack were some prominent Singaporean politicians, including the prime minister. Only data containing personal information of the patients like name, date of birth, address, gender, etc was taken. However, the records were neither deleted nor edited. According to the [https://www.youtube.com/watch?time_continue=28&v=RsjUUgGpqA8 statement] of the Health Minister Gan Kim Yong, this attack was “unprecedented”. The professionalism with which the attack was conducted and the fact that records of politicians were affected made the Cyber Security Agency of Singapore (CSA) and the government suspect that another State may have been [https://www.straitstimes.com/singapore/top-secret-report-on-singhealth-attack-submitted-to-minister-in-charge-of-cyber-security involved]. Yet, no specific allegations have been made in this regard. Although none of the existing scenarios analyses a cyber incident involving patient records, the cyber operations against SingHealth are related to scenarios [[Scenario 01: Election interference|01]] and [[Scenario 02: Cyber espionage against government departments|02]], which consider whether exfiltration of data amounts to a violation of State sovereignty.</div>
+
On 4 October 2018, the UK National Cyber Security Centre issued a [https://www.ncsc.gov.uk/news/reckless-campaign-cyber-attacks-russian-military-intelligence-service-exposed statement] accusing the Russian military intelligence service (generally referred to under its previous abbreviation GRU for ''Glavnoye razvedyvatel'noye upravleniye'') of a series of cyber attacks “conducted in flagrant violation of international law”. These attacks have ranged from [[DNC email leak (2016)|hacking the Democratic National Committee]] in the US and publishing its documents online, to attempting to compromise the UK Foreign and Commonwealth Office systems through a spearphishing attack, to using ransomware to cause disruption to Ukrainian public transport systems. Some of these attacks allegedly attributable to the GRU display factual pattern similar to several of the toolkit scenarios. In particular, [[Scenario 01: Election interference|Scenario 01]] considers the law relevant to electoral interference using cyber means; [[Scenario 02: Cyber espionage against government departments|Scenario 02]] considers the extent to which cyber espionage targeted against another State’s foreign ministry violates international law; and [[Scenario 03: Cyber attack against the power grid|Scenario 03]] looks at the extent to which disruption of public utilities and other critical infrastructure violates international law.</div>
 
</option>
 
</option>
 
<option>
 
<option>
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:DHS.png|left|150px]]
+
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:CyberCommand.jpg|left|150px]]
On 27 July 2018, the ''New York Times'' [https://www.nytimes.com/2018/07/27/us/politics/russian-hackers-electric-grid-elections-.html reported] a statement from the US Department of Homeland Security (DHS) that a 2017 cyber campaign by Russia had allegedly compromised the networks of several electrical utility companies in the US. The DHS [https://www.bbc.co.uk/news/technology-44937787 linked] the attack to the Russian group known as Dragonfly or Energetic Bear. The DHS [https://www.wsj.com/articles/russian-hackers-reach-u-s-utility-control-rooms-homeland-security-officials-say-1532388110 stated] that the attacks put the infiltrators in a position where they were capable of causing blackouts on the US territory. The department [https://www.wsj.com/articles/russian-hackers-reach-u-s-utility-control-rooms-homeland-security-officials-say-1532388110 cited] "hundreds of victims", greater than previously acknowledged. The statement was preceded by a [https://www.us-cert.gov/ncas/alerts/TA18-074A joint alert] issued by the DHS and the Federal Bureau of Investigation (FBI) in March 2018, warning network defenders of Russian threats to US critical infrastructure sectors including energy, water, and aviation. [[Scenario 03: Cyber attack against the power grid|Scenario 03]] specifically considers and assesses the impact of one State conducting a cyber operation against the electrical grid of another State.</div>
+
Prior to the US midterm elections in 2018, the US Cyber Command implemented a new preventive strategy in order to protect the elections from foreign interference. According to the [https://www.nytimes.com/2018/10/23/us/politics/russian-hacking-usa-cyber-command.html media reports], the strategy was aimed at preventing Russian individuals from engaging in concerted disinformation campaigns. The targeted individuals were informed that their work and online conduct would be surveilled by the US authorities. However, the US officials did not disclose the number of individuals they had contacted nor the method of transferring the warning to the operatives concerned. [[Scenario 01: Election interference|Scenario 01]] of the Toolkit analyses whether specific forms of electoral interference abroad violate rules of international law and [[Scenario 06: Cyber countermeasures against an enabling State|scenario 06]] considers whether the victim State may engage in [[Countermeasures|countermeasures]] against an enabling State.</div>
 
</option>
 
</option>
 
<option>
 
<option>
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:CyberCommand.jpg|left|150px]]
+
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:IDF_Hamas.png|left|150px]]
Prior to the US midterm elections in 2018, the US Cyber Command implemented a new preventive strategy in order to protect the elections from foreign interference. According to the [https://www.nytimes.com/2018/10/23/us/politics/russian-hacking-usa-cyber-command.html media reports], the strategy was aimed at preventing Russian individuals from engaging in concerted disinformation campaigns. The targeted individuals were informed that their work and online conduct would be surveilled by the US authorities. However, the US officials did not disclose the number of individuals they had contacted nor the method of transferring the warning to the operatives concerned. [[Scenario 01: Election interference|Scenario 01]] of the Toolkit analyses whether specific forms of electoral interference abroad violate rules of international law and [[Scenario 06: Cyber countermeasures against an enabling State|scenario 06]] considers whether the victim State may engage in [[Countermeasures|countermeasures]] against an enabling State.</div>
+
In early May 2019, hostilities flared up again in the context of the armed conflict between Israel and Palestine. According to [https://www.nytimes.com/2019/05/05/world/middleeast/gaza-rockets-israel-palestinians.html news reports], hundreds of rockets were fired on Israel, while the Israel Defense Forces (IDF) answered with artillery and airstrikes. Remarkably, the Israeli response included also a kinetic attack allegedly aimed at countering a hostile cyber operation conducted by Hamas. In particular, the IDF [https://twitter.com/IDF/status/1125066395010699264 announced on Twitter] that it had “thwarted an attempted Hamas cyber offensive” and subsequently conducted an air strike against the Hamas Cyber Headquarters. The announcement has sparked a [https://www.linkedin.com/pulse/retaliatory-cyber-attacks-legal-precedent-time-israel-singer/ debate] [https://www.lawfareblog.com/crossing-cyber-rubicon-overreactions-idfs-strike-hamas-cyber-facility whether] this operation sets a legal precedent from the perspective of international law. Within the Toolkit, [[Scenario 03: Cyber attack against the power grid|Scenario 03]] considers when a cyber operation may qualify as a use of force under international law and [[Scenario 12: Cyber operations against computer data|Scenario 12]] analyses aspects of the law of targeting with respect to cyber operations.</div>
 
</option>
 
</option>
 
</choose>
 
</choose>
Line 92: Line 89:
 
</div>
 
</div>
 
...AND THIS LINE -->
 
...AND THIS LINE -->
 
+
<!-- REMOVED OLD INCIDENTS
 +
<option>
 +
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:SingHealth_logo.jpg|left|150px]]
 +
In July 2018, Singapore’s health system (SingHealth) was infiltrated by malware and the personal particulars of about 1.5 million people were [https://graphics.straitstimes.com/STI/STIMEDIA/Interactives/2018/07/sg-cyber-breach/index.html stolen]. Among the victims of the hack were some prominent Singaporean politicians, including the prime minister. Only data containing personal information of the patients like name, date of birth, address, gender, etc was taken. However, the records were neither deleted nor edited. According to the [https://www.youtube.com/watch?time_continue=28&v=RsjUUgGpqA8 statement] of the Health Minister Gan Kim Yong, this attack was “unprecedented”. The professionalism with which the attack was conducted and the fact that records of politicians were affected made the Cyber Security Agency of Singapore (CSA) and the government suspect that another State may have been [https://www.straitstimes.com/singapore/top-secret-report-on-singhealth-attack-submitted-to-minister-in-charge-of-cyber-security involved]. Yet, no specific allegations have been made in this regard. Although none of the existing scenarios analyses a cyber incident involving patient records, the cyber operations against SingHealth are related to scenarios [[Scenario 01: Election interference|01]] and [[Scenario 02: Cyber espionage against government departments|02]], which consider whether exfiltration of data amounts to a violation of State sovereignty.</div>
 +
</option>
 +
<option>
 +
<div id="mp-itn" style="padding:0.1em 0.6em;">[[File:DHS.png|left|150px]]
 +
On 27 July 2018, the ''New York Times'' [https://www.nytimes.com/2018/07/27/us/politics/russian-hackers-electric-grid-elections-.html reported] a statement from the US Department of Homeland Security (DHS) that a 2017 cyber campaign by Russia had allegedly compromised the networks of several electrical utility companies in the US. The DHS [https://www.bbc.co.uk/news/technology-44937787 linked] the attack to the Russian group known as Dragonfly or Energetic Bear. The DHS [https://www.wsj.com/articles/russian-hackers-reach-u-s-utility-control-rooms-homeland-security-officials-say-1532388110 stated] that the attacks put the infiltrators in a position where they were capable of causing blackouts on the US territory. The department [https://www.wsj.com/articles/russian-hackers-reach-u-s-utility-control-rooms-homeland-security-officials-say-1532388110 cited] "hundreds of victims", greater than previously acknowledged. The statement was preceded by a [https://www.us-cert.gov/ncas/alerts/TA18-074A joint alert] issued by the DHS and the Federal Bureau of Investigation (FBI) in March 2018, warning network defenders of Russian threats to US critical infrastructure sectors including energy, water, and aviation. [[Scenario 03: Cyber attack against the power grid|Scenario 03]] specifically considers and assesses the impact of one State conducting a cyber operation against the electrical grid of another State.</div>
 +
</option>
 +
END OF REMOVED INCIDENTS -->
 
<!--          END OF PAGE        -->
 
<!--          END OF PAGE        -->

Revision as of 17:28, 29 January 2020

MainBanner.jpg


Welcome to the Cyber Law Toolkit, an interactive online resource on international law and cyber operations.

Other resources

  • FAQ – Frequently asked questions about the project and the Toolkit.
  • All articles – Updated list of all substantive articles in the Toolkit. In a printed book, this would be the table of contents.
  • Keywords – Overview of all keywords used across the Toolkit content. Serves the same purpose as an index would in a printed book.
  • Examples – List of real-world incidents that have inspired the analysis in the Toolkit.
  • Glossary – Glossary of the technical terms used in the Toolkit.
  • Short form citation – Abbreviated references for the most commonly used citations in the Toolkit.
  • Bibliography – Bibliography of resources used in the creation and development of the Toolkit.
  • People – List of all people involved in the project (including scenario authors, peer reviewers, research assistants...).