Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

44 5. CYBER ATTACK AGAINST INTERNAL DISSIDENTSIn Chapter 4, we saw how Israel attempted to use cyber attacks to limit the use of socialmedia by Hamas during their war in 2008. An aspect of this incident that makes it differentfrom other scenarios we discussed so far (e.g., Estonia, Georgia, and Lebanon) is that Hamasis a group whose members live in the Palestinian territories occupied by Israel. a Therefore, wecan look at Israel’s use of cyber attacks against Hamas as a means to quell a dissident groupresiding within the state. This raises an interesting question: Do governments and their ardentsupporters conduct cyber attacks against dissidents outside of civil conflict? It turns out thatdissident groups and independent media outlets are reporting distributed denial of serviceattacks at an alarming rate—particularly in countries known for limiting press freedom.Why should a “cyber warrior” study intrastate cyber attacks against dissident groups? Itmight seem that these attacks would be of lesser importance in a book such as this wherethe primary focus has been on conflict between nation states or conflict against a foreign armednonstate organization such as Hezbollah. How do attacks against independent media residingwithin a state’s territory fit in?First, the tactics, techniques, and procedures (TTPs) used in cyber operations against a dissidentgroup within a state may also be used in an interstate conflict. If a government carriesout a certain type of attack against nonconformists, then they clearly have that capability forconflicts involving external actors. If a certain attack against such a group is carried out by apatriotic pro-regime organization, then perhaps we can expect to see that organization on thecyber battlefield of an interstate conflict. For example, consider the actions of the Russianyouth groups in the 2008 conflict with the Georgia or the Jewish Internet Defense Force describedin Chapter 4—such groups could conceivably conduct cyber attacks against internalas well as external adversaries without discrimination.A second reason to study cyber attacks by dissident groups is to understand the techniquesused to limit the communication within a country. As we saw in Chapter 4, cyber operationscan be a key enabler of information operations (IO) as well as a weapon used to counter them.Further, the use of dissident groups, both for propaganda and operational purposes, is quitecommon in conflict—often these groups tend to continue to exist and operate after a conflict.The rest of the chapter is organized as follows: first, we discuss some general trends in theuse of cyber attacks against dissident groups—in particular distributed denial of serviceattacks (DDoS). We then describe case studies from two nation states where cyber attacksagainst dissident groups are well documented: Russia and Iran.DDoS AS A CENSORSHIP TOOL: WHY DISSIDENT GROUPS AREINHERENTLY VULNERABLE TO CYBER ATTACKSIn 2010, researchers from the Berkman Center for Internet and Society at the HarvardUniversity conducted a study of independent news media and human rights groups that weretargets of DDoS attacks. 1 This section is largely based on their study. Based on a series of Googlesearches and alerts on open-source information, the group found 329 different attacks against815 different sites of this type from 1998 to 2010. However, the trend seemed to accelerate: 140 ofa Gaza and the West Bank are collectively referred to as OPT—Occupied Palestinian Territories.