UK will retaliate against state-sponsored cyber attacks, Chancellor warns

Britain will strike back against nations launching cyber attacks on the UK’s critical national infrastructure. Chancellor Philip Hammond promised retaliatory measures against state-sponsored hackers while unveiling an expanded $1.9bn, five-year national cyber security strategy. Crucially this isn’t new money - Hammond’s …

[nuked]

Who gets the retaliation?

The difficulty of course is that a lot of these hacking groups are international and also, inconveniently, 'for hire' by practically anyone. Identifying the enemy is largely in the hands of the enemy as to who they want the finger pointed at.

[HmmmYes]

Re: Who gets the retaliation?

Smersh?

[Robert Carnegie]

Who do you want to get the retaliation?

In WarGames you "retaliate" against whichever target you prefer to attack, it doesn't have to be the enemy that actually hit you. Example: invading Iraq as retaliation for 9/11 when Iraq and the terrorists were each other's enemies. I expect this to be the same.

[Duffy Moon]

Re: Who do you want to get the retaliation?

Or indeed Libya - who were blamed for all sorts of things (at least according to Adam Curtis).

[Tom Paine]

Re: Who do you want to get the retaliation?

Not really the same thing; Libya (or rather the Gaddafi regime) was attacked because they were massacring the civilian population. Shame we didn't apply the same standard to Assad, but that's a rant for another day.

[allthecoolshortnamesweretaken]

"... the ability to trace and retaliate in kind ..."

Tricky with cyberattacks on national infrastructure that are traced to North Korea - nothing much really worth to counter-attack...

[Andy The Hat]

Scary

The option to 'retaliate' against cyber attacks, state sponsored, state enabled or with no relation to the source state at all whilst not in a state of war is downright scary.

Defend all you like.

Investigate and subject perpetrators to the law.

Threatening 'retaliatory measures' against a state, that may not actually have sponsored anything but had a rogue actor or hacker spoofing sources, by bricking their power grid for instance is Trumping at its worst.

It sounds like Theresa May's glove puppet speaking ...

[HmmmYes]

How?

Send all that Huawei kit bck to the Reed Army and ask for a refund?

[Anonymous Coward]

Send all that Huawei kit bck to the Reed Army and ask for a refund?

Is that the army of temps from Reed the employment agency, or the army of shop assistants at Austin Reed?

[Anonymous Coward]

I think that blaming the Reed Army is a rather dry Straw Man argument.

[David 132]

I think that blaming the Reed Army is a rather dry Straw Man argument.

It's so called because it always rushes into battle (with a cry of "wa-Hay!")

[Anonymous Coward]

"or the army of shop assistants at Austin Reed" .. are there any of these any more?

[Warm Braw]

are there any of these any more?

If you press your ear to the door of the nearest JobCentre, I believe you can hear the plaintive cries of "I'm free" falling on the deaf ears of the declining retail sector. Perhaps GCHQ should retrain them - if you've taken an inside leg measurement you should be familiar with sticking your nose into private areas.

[HmmmYes]

Hmm.

Each time I type R e d Army the computer software changes it:

'Beloved protectors of the country'

'Brave heroes of the revolution'

'Huawei is great!'

[Mahhn]

Maybe a hack by the Red Ribbon army?

[0laf]

No doubt we'll send stern letters which will then be swiftly retracted at the return threat of not buying something expensive made by a mate of a cabinet minister.

Or the Chinese will just turn off all our Huawei kit to stop us being naughty.

[allthecoolshortnamesweretaken]

"Unless you'll agree to cease these actions forthwith, your ticket allocation for the next Gilbert & Sullivan production shall be severely reduced."

[Alan J. Wylie]

SPF, DKIM and DMARC - better late than never

He pointed to the recent rollout of software to cut to zero an estimated 50,000 fraudulent emails a day from hackers purporting to be from HMRC offering tax refunds in order to obtain people's bank details.

This blog post from February details the government's move to SPF/DKIM/DMARC. I assume this is what the chancellor is referring to. Since SPF has been generally adopted since about 2009 and DKIM since at least 2012, what on earth have civil servants been doing all that time?

[Anonymous Coward]

Re: SPF, DKIM and DMARC - better late than never

what on earth have civil servants been doing all that time?

Some things even mind bleach won't erase.

[Commswonk]

Oh no...

Moments before Hammond, who chairs the Cabinet’s cross-department cyber-security committee, had listed high-profile cyber attacks against other nation’s critical infrastructure.

I'd have more confidence in this committee if it was chaired by a cyber security expert, not the Bean - Counter - in - Chief.

In October defence secretary Sir Michael Fallon said Britain had used cyber warfare against ISIS as part of the bid to retake the Iraqi city of Mosul.

And telling the world and his dog about it helps how, exactly? He would have done better if he'd kept completely schtum. His announcement is, IMHO, a breach of basic security.

[Doctor Syntax]

Re: Oh no...

"I'd have more confidence in this committee if it was chaired by a cyber security expert, not the Bean - Counter - in - Chief."

Chancellors of the Exchequer aren't generally bean counters. In Hammond's case he's been both Defence and Foreign Secs. But the most impressive thing about him was what happened when he was first appointed to the cabinet as Transport minister. He announced "the war on the motorist stops here". Can you imagine the consternation in the DoT? He was promoted to Defence PDQ. That's a politician who really knows how to get the Civil Service to take action.

[Tom Paine]

Re: Oh no...

FUD (by the UK, against ISIS.) They're already paranoid about agents in the ranks and regularly bump off insiders accused of spying for the US / NATO / Iraq / etc, and they know not to use mobile phones. If they're too scared to use computers or the Internet, that reduces their operational effectiveness. Hopefully they'll turn on each other as their claimed "caliphate" inexorably unravels.

[amanfromMars 1]

Snake oil salesperson on a suicide mission? Hammond on a Ego ACID* Trip

“We will deter those who seek to steal from us, or harm our interests,”

Define more specifically the "we" and "us" and the "interests" please, Mr Hammond, if you dare to care and share and reveal what you fear being exposed to attack and take over/assault and destruction.

Methinks you dare and care not to share the truth of those enterprises and thus be you destined to fail spectacularly with a winning lead program and will deter no one and nothing from doing whatever is needed for a better future.

*ACID ..... https://en.wikipedia.org/wiki/ACID

[valer555]

England will be forced to surrender

Surprisingly, a herd of criminals and morons - hackers attacked the prim aristocrats. Yes, I think it is humiliating for MI5.

If it will be professionals, England will be forced to surrender.

[Anonymous Coward]

Re: England will be forced to surrender

England will be forced to surrender

A popular thought amongst short-arse po-faced dictators throughout history (Napoleon, Hitler, Putin, Sturgeon to name a few).

But here we are, still bobbing along quite merrily.

[Tom Paine]

Re: England will be forced to surrender

Is that supposed to be a cryptic crossword clue?

[Anonymous Coward]

And what is the retaliation method going to be?

Refuse to sign trade deals with said States?

[tr1ck5t3r]

Re: And what is the retaliation method going to be?

"In October defence secretary Sir Michael Fallon said Britain had used cyber warfare against ISIS as part of the bid to retake the Iraqi city of Mosul."

Locking mobile phones as if they have been stolen & getting Vodafone to switch off some cell masts in the area as if there is a London 2011 riot going off is hardly retaliatory, but it just about counts as "cyber warfare".

[Anonymous Coward]

Respond with what, umbrellas and rolled up copies of the Telegraph ?

[JaitcH]

Great Britain’s empire began to disintegrate after World War Two, it was forced to ...

face the diminished influence and power of the country, only the Tories refuse to accept it. All those smoke filled clubs in London where aged, shriveled and wrinkled, former military types are still regaling each other with their fast fading memories of battles won long ago.

Likewise, Britain does not rule the InterNet and, factually, some of the greatest hackers are to be found far, far, to the East of the country. Britain can't even prosecute hackers based in this country and rely on others to do so.

Perhaps they will have GCHQ turn off the power to all the cables they are hooked into in the West country. But even that scheme is about to be thwarted as some countries plan new cable configurations that circumvent the UK.

And what of the War of the IoT Bots? Has GCHQ even figured that one out yet?

The only thing the government can lay claim to is that they were the first, and therefore the oldest, communications hackers in history. Britain, and the USA, have to accept their prowess is no longer what it was and that many other countries have superior skills to them.

[Olius]

Send people to kill them (and be killed) with guns and bombs, or deface their websites and point and laugh. It's a tough call.

[tiggity]

Retaliation

I can see an upside here...

The UK gov retailates against the IoT botnet army taking down vital infrastructure by destroying pwned CCTV cameras & so making a small but welcome dent in the oppressive UK surveillance state.

Not to mention nobbling hipsters thermostats, webcams etc, etc.

Win Win situation.

[Tom Paine]

Britain will strike back against nations launching cyber attacks on the UK’s critical national infrastructure

Hard to imagine a bigger invitation for false flag attacks. With attribution methods widely disclosed in many, many research papers from the AV vendors, Crowdstrike, Mandiant and all the rest, I would be absolutely astonished if no state actors had yet tried to include some subtle misdirection in their TTPs, IOCs and whatnot. And if the only person your misdirection has to convince is President Trump, well,.. this is just asking for it.