The challenges of defining “war” in the digital realm. Plans for digital euro legislation published.

At a glance.

• The challenges of defining “war” in the digital realm.
• Plans for digital euro legislation published. 
• Who wants to be a multi-millionaire? 
• CyberCom plans to expand private partnership.

The challenges of defining “war” in the digital realm.

What, exactly, constitutes an act of cyberwar? Security Week attempts to define the term – perhaps a seemingly simple endeavor, but as the cyber battleground has grown larger and more complex, the definition has become more ambiguous. The recent NotPetya verdict – in which Merck won its lawsuit against cyber insurers when the court determined the cyberattack was not an act of war – has some experts questioning what counts as war in cyberspace. The term “war” is typically defined as kinetic military action between two nations, but as Kevin Tierney, VP of global cybersecurity at General Motors and a member of the CISA cybersecurity Advisory committee (CSAC), points out, cyberwar is not always kinetic, but economic. “If you disrupt large parts of the operational system of the target country, disrupt the financial systems, have a country lose trust in its information, lose governmental data, halt transportation or damage energy or water supplies, you can win a war without killing each other,” Tierney explains. Most definitions of cyberwar stem from the NATO’s Tallinn Manual, which says cyberwar is limited to cyber activity that causes, or can be expected to cause, death or destruction. Tom Kellermann, senior VP of cyber strategy at Contrast Security, agrees. “Cyberwarfare is when a nation state launches a destructive cyberattack against a critical infrastructure.” Anything that falls short of death is considered cyberespionage. However, Incrypteon founder Helder Figueira notes that attribution can be difficult in the digital sphere, explaining that “a cyberattack by a sovereign state is hard to prove or identify. To complicate identification further, such activities are usually outsourced to independent contractors – which leads to the incidence of these activities increasing, since there are no actual diplomatic repercussions.” 

Plans for digital euro legislation published. 

As experts debate the potential benefits of a central bank digital currency (CBDC) in the EU, CoinDesk reports that the European Commission yesterday issued its legislative plans for the digital euro. A post on the EU’s executive website and co-authored by the commission’s Executive Vice President Valdis Dombrovskis and the European Central Bank’s (ECB) Executive Board Member Fabio Panetta stated a CBDC would bring “strategic advances,” and “also enhance the integrity and safety of the European payment system at a time when growing geopolitical tensions make us more vulnerable to attacks to our critical infrastructure.” While the legislation would support the implementation of the CBDC, it is up to the ECB to determine whether to issue the digital euro. In a statement to the press, the ECB applauded the commission's plans, saying the bank will decide in the fall whether to enter the next phase in developing the currency. “The euro is the most tangible symbol of European integration,” ECB President Christine Lagarde stated. "We look forward to continuing working together with other EU institutions towards a digital euro to ensure our currency is fit for the digital age.”

Who wants to be a multi-millionaire? 

As the list of organizations impacted by the exploitation of the zero-day vulnerability discovered within the widely-used MOVEit file transfer application continues to grow, the US Department of State is asking the public for any information on the Cl0P ransomware gang, the threat group believed to be behind the attacks. As Naked Security reports, the State Department’s Rewards for Justice (RFJ) team tweeted yesterday, “Do you have info linking CL0P Ransomware Gang or any other malicious cyber actors targeting U.S. critical infrastructure to a foreign government? Send us a tip. You could be eligible for a reward.” Indeed, the RJF website states that individuals could receive a reward of up to $10 million “for information leading to the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in malicious cyber activities against US critical infrastructure in violation of the Computer Fraud and Abuse Act (CFAA).” Whether anyone is able to cash in remains to be seen.

CyberCom plans to expand private partnership.

Army Lieutenant Colonel Jason Seales, US Cyber Command’s chief of private sector partnerships, says a special group of military and civilian digital experts will grow two-fold over the next year. Speaking at a recent interview at the NSA’s Cybersecurity Collaboration Center (CCC), Seales stated, “We need to make sure that we have additional resources and capabilities available … and not put the burden so much on the small handful of folks that we have now — kind of spread that wealth out.” Dubbed “Under Advisement,” the group was established in 2020, fueled by concerns about foreign interference in the presidential election, to help ease the workload of the Cyber National Mission Force (CNMF). “When you look at all the big companies, they get hit by all the same cyber actors as anyone else does,” Seales told the Record. “So the thought was, ‘Well, why don't we start partnering with them? Why don't we start sharing some of this information back and forth — obviously at the unclassified level — that they have on malicious cyber actors so the command can then go out into foreign space and go hunt for them?’” Since then, the team has offered expertise on high-profile cyberincidents like the Colonial Pipeline ransomware attack and the China-linked Hafnium cyber espionage operation. Outgoing Cyber Command and National Security Agency chief General Paul Nakasone last month described the group as “our canary in the coal mine,” sharing intel on suspicious cyberactivity with companies and government agencies. Seales predicts Under Advisement will grow from one dozen to two dozen members over the next year.