French Defense Secretary Says Country Is Willing To Fire First In Cyber Wars

from the only-good-things-can-come-of-this dept

Over the past few years, politicians and intelligence officials have floated the idea of hacking back. When not pushing the idea of treating cyber wars like declarations of actual war, these officials have seen nothing wrong with hacking back against cyberattackers or allowing private companies to do the same.

It may seem like there's nothing wrong with a "best defense is a good offense" theory of deterrence, but it's not that simple. First of all, attribution is often more difficult than these officials imagine. Hacking back against the wrong party is only going to escalate tensions. At worst, it could result in international incidents where those hacking back have broken laws in other countries. At best, it will just become another forever war countries throw money at -- one that's sure to result in expanded government power at the expense of the taxpayers, both in terms of tax dollars and civil liberties.

France has been scratching its itchy trigger finger for awhile now. Roughly a year ago, the government shot down a proposal giving private companies the right to retaliate against cyberattacks. It felt doing so would only lead to further "instability in cyberspace." That assessment is likely correct. But the French government apparently only felt private hack backs would lead to instability. If the government did it, no such instability should occur… apparently.

As far as offensive actions are concerned, the [Strategic Review of Cyberdefense] may not want companies to unleash hack-backs after an online attack, but it does want to keep that option open for the French authorities.

Not sure how a government-run cyberattack would lead to greater stability, but there you have it. The French government is apparently so confident in its ability to carry out non-destabilizing cyberattacks that it's not even going to wait around to get hacked first. Defense Secretary Florence Parly had this to say at a recent cybersecurity forum:

“The cyber weapon is not only for our enemies,” said France’s defence secretary this afternoon, speaking through a translator. “No. It’s also, in France, a tool to defend ourselves. To respond and attack.”

Her remarks will be seen as moving the debate about offensive cyber capabilities – not just so-called “active defence” but using infosec techniques as another weapon in the arsenal of state-on-state warfare – to a new level. Coming from a prominent NATO member and EU country, it could set the tone for future discussion of nation states' offensive cyber doctrines.

If France is going to start a cyberwar, it's not going to do it alone. Parly also called for "more cooperation and partnerships" from other European governments, suggesting their asses will also be on the line if France kicks off WWIII/CyberWar I with a misdirected cybersortie. While Parly is correct in her assessment that cyber threats are border-less, it seems a little audacious to suggest everyone else is obligated to bail you out if you take the lead in hacking forward.

Filed Under: cyberattacks, first strike, france, hack back

Reader Comments

Subscribe: RSS

View by: Time | Thread

  1. icon
    ECA (profile), 25 Jan 2019 @ 1:19pm

    In the USA

    Its always been against the law, unless they changed in the last few years..
    But there is something to think about.
    There is security, that requires the user to LET a small program to Run a verify WHO is connecting. There are a couple of other parts to this..
    But IF the hacker knows HOW it works, or captures the Checker, they can see what is needed to FAKE what is needed to verify.

    Another think, comes with a few tricks, like a honey pot(look it up) where it seems the person has gotten into the system. But its a trap to TRY and locate them, they can wonder around and do just about anything..but it only Seems that way.

    You can also setup a verification, that only Fits on the REQUIRED system to work. A small little program is set inthe computer that allows you to connect..

    There are many tricks that can be done..but your BIGGEST defense, seems to be the human Watching the servers.
    Its the idea that transferring 1 Tarabyte of data files IS A LONG PROCESS.
    Having a REAL person there as Sysop/admin you can watch and ASK the person to ID themselves, or just Disco the person..

    There is 1 things I keep saying and that is...IMPORTANT DATA is not allowed a direct connection to the INTERNET... you would need to signin on the internet connection, then SIGNIN to another system inside...And each system has its own verification..

    So Which will it be..
    Pay a corp to do this..
    Hire a person Permanent..that does all this and keeps things up to date.
    Believing your IT dept when it tells you WE NEED BETTER..
    Do it yourself, and Fail, because you are not Old hat, or upto date on current protection.

    I have a friend with an interesting job...he has been setup to Play games and do anything he wants, but a side computer sits and watches other machines around the country...and if they ever turn off, or sound an alarm he is to call the cops..

Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here

Subscribe to the Techdirt Daily newsletter

Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Follow Techdirt
Techdirt Gear
Shop Now: Techdirt Logo Gear
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Report this ad  |  Hide Techdirt ads
Recent Stories
Report this ad  |  Hide Techdirt ads


Email This

This feature is only available to registered users. Register or sign in to use it.