NATO plans software defences

NATO IS TO start building its own security software to protect against the kind of attacks that had Estonia's national infrastructure on its knees last summer.

But a leading UK security expert has dismissed the initiative as an " ignorant waste of money" that ignores the work already done by national security agencies.

The plan will be proposed as part of a portfolio of responsibilities for cyber security that will be formally adopted by NATO's at its summit in April.

A NATO official told The INQUIRER that it would its cyber security protocols would be software programs.

"If you are facing a cyber attack, no matter how quick you are, it still won't be fast enough because a machine will be quicker", he said.

"So we are talking about designing some defence programs - if you can do that, you win," he said.

Another key component of the proposals will involve NATO-led training exercises that will have NATO members playing war games that simulate cyber attacks.

And it will establish an operations centre that will co-ordinate responses between the national agencies, such as the CNPI and CESG arms of the UK's hi-tech spookshop GCHQ, which have been chiefly responsible for computer defences to date.

The plans illustrate how NATO thinks the significance of cyber attacks for national security has changed. Once a matter of subterfuge handled by security agencies, they are now taken as direct affronts to a nation's sovereignty.

But they cannot be dealt with as direct affronts because of the ethereal nature of cyber attacks. The NATO official said cyber protection and prevention was a crucial branch of the plan because they could never be sure where an attack had come from.

"If you can deal with a problem, it matters less where its coming from," said the official.

The US had blamed Russia for the cyber attacks on Estonia last year. The Ru ssian government denied them. But with state authority fragmenting rapidly around the globe, even if such a well co-ordinated attack had originated in Russia it might not necessarily have had anything to do with the Russian government.

Nevertheless, this might all just be a load of sabre rattling.

Professor Peter Sommer, cyber security expert at the London School of Economics was at a meeting convened on Monday by Security & Defence Agenda, a Brussels think thank, and said the whole idea was rubbish.

"I hadn't realised until Monday the extent of NATO investment in this and the extent to which they are ignorant of the work that's been going on in other agencies for years. The whole thing seems bizarre. This is just a complete waste of time and tax payer's money," he said.

"I don't think the nature of the threat has changed, I just think there are too many NATO generals with too much time on their hands," Sommer added.

The NATO official was keen to point out that it would not "replicate" or " replace" any work already done by national agencies.

"There are proposals to have this new structure which would be a kind of over arching body and primary point of contact, and chief initiating body to all issues relating to cyber defence, because at the moment there are many bodies where these issues are addressed," said the official.

However, NATO did now see matters of civil cyber security as a military threat.

"This policy will address answers to the threats that have become evident with the Estonia case," he said, referring to the attacks that brought Estonia's financial systems down last year.

"Banking systems are of immense importance, but they are a vulnerability. It's become an issue of national security," he said.

Major General Georges D'Hollander, who is leading NATO's cyber defence effort, told EurActiv this week that it was an "Article 4 issue".

In other words a cyber security attack might be a direct affront would not be a matter for Article 5 of the North Atlantic Treaty, by which acts of war are handled. That's just as well, because you need to know who's attacking you to declare war on them. µ