Trends and Tactics in Cyber-Terrorism

Presented byLi JingjingInformation Security Supervision Bureau (ISSB)Ministry of Public Security (MPS)China

OutlineWhat’s Cyber-Terrorism?Crime Types and Trends of Cyber-Terrorism Tactics and Countermeasures on Cyber-Terrorism Proposals

What’s Cyber-Terrorism?

What’s Cyber-TerrorismAccording to criminal law of China, terrorism is

attributed to the crime endangering public security. So is cyber-terrorism.

We can define it by two aspects :Intention

mass loss of lives severe economic damageto generate public panic comparable to that from a

physical act of terrorism.to disturb social and public order

The intention of cyber-terrorism is the same as that of traditional crime.

What’s Cyber-Terrorism

Result The object of damage is unspecified.

To be as one of endangering public security crimes, cyber-terrorism usually imperils public lives and property.

The result of damage is uncertain.The scope affected and harm degree of crime result is out of the criminal’s expectation and control.

What’s Cyber-Terrorism

The difference between Hacking and cyber-terrorism

characteristics Hacking Cyber –terrorism

IntentionAim to cause lesser disruption would not result in severe economic

damage or loss of life.Not want to generate social panic Not intending to disturb public order

Aim to cause mass loss of lives or severe damage of economy

Want to generate social panic Intend to disturb public order

Result

The object of damage is specified ----usually imperial the information system of certain subject.

The result of damage is certain----control the result at the certain scope and degree.

The object of damage is unspecified

The result of damage is uncertain

Crime Types and Trends of Cyber-Terrorism

Crime Types and Trends of Cyber-Terrorism

Crime typesCyber as object: Terrorist attacks critical information infrastructure to cause mass loss of lives, severe damage of property or disorder of society.Cyber as tool: Terrorist tend to facilitate traditional forms of terrorism by using Internet to:

organize and command on internet communicate with each otherthreaten the victimsdistribute terror information or rumors.recruit supporters.impart the method of terrorism.acquire intelligence in support of physical violence.

Crime Types and Trends of Cyber-TerrorismTrends

Due to being the vitals of homeland security, economic development and public order, the critical information infrastructure has become the main target of cyber-terrorism. Therefore, it is necessary to reinforce the security of the critical information infrastructure.With the rapidly development of internet industry, internet is exploited as important tool and channel by terrorists.Owing to application of divers information technology, the targets of cyber-terrorism will include not only computer network but also other digital devices.

Crime Types and Trends of Cyber-Terrorism

Trends Compare with traditional crimes, cyber-terrorists are more easier to disguise their identities and the damage is more severe. So both investigation and information security safeguard will confront with new challenges. Cyber-terrorism often involves multiple places or countries, so it is essential to establish efficient mechanism of intelligence sharing and legal assistance between different countries or regions.

Tactics and Countermeasures onCyber-Terrorism

Protection

Investigation

prevention

Emergency response And recovery

Tactics and Countermeasures on Cyber-Terrorism

Organ organ of information security safeguard

State Informatization Leadership Group

State Council of China

The National Network and Information Security Coordination Team

Different departments of government

Tactics and Countermeasures on Cyber-Terrorism

organ of information security safeguard 2000, Chinese government established State InformatizationLeadership Group (SILG ) which included the National Network and Information Security Coordination Team (NNISCT ).NNISCT is in charge of :

researching and enacting strategy and policy of national information security safeguard.organizing and coordinating related departments of government toprotect critical information infrastructure.mobilizing and directing computer emergency response. improving information sharing and notification.

Tactics and Countermeasures on Cyber-Terrorism

organ of law enforcement Organizational structure

Information Security Supervisory Bureau (ISSB) of Ministry of Public Security (MPS )

Provincial Information Security Supervisory Department

Regional Information Security Supervisory Department

Tactics and Countermeasures on Cyber-Terrorism

Legislation 1: Cyber as objectThe legislation of China emphasizes the protection of critical information infrastructure.

Article 285, Criminal Law——Whoever intrudes into information systems concerning state affairs, construction of defense facilities, or sophisticated science and technology will be sentenced no more than three years in jail.——For those who intrude into the information systems related to critical infrastructure, no matter the systems were damaged or not, the intruders will be punished.

Tactics and Countermeasures on Cyber-Terrorism1: Cyber as object

Article 124, Criminal Law——Whoever sabotages radio and television broadcasting facilities, public telecommunication facilities, and endangers public safety is to be sentenced a maximum imprisonment of seven years.——Only the public telecommunication facilitieswere mentioned in this article, however, it would be better to include all the critical information infrastructure.

Tactics and Countermeasures on Cyber-Terrorism1: Cyber as object

Modification Act Ⅲ of Criminal Law ——In Dec. 2001, the criminal law was amended to combat

terrorism. Several articles related to terrorism were renewed.Administrative Penalties Law for Public Security

——In Aug. 2005, National People’s Congress enacted Administrative Penalties Law for Public Security. It provides that whoever illegally intrude or impair general information system, which is not serious enough to be a crime, he will be gotten administrative penalty.

Tactics and Countermeasures on Cyber-Terrorism

2: Cyber as toolModification Act Ⅲ of Criminal Law——Any person who seriously disturbs social order byknowingly disseminating terror information of a fabricated fact will be punished with a maximum imprisonment of five years. ——Most of this kind of cases were committed through Internet.Administrative Penalties Law for Public Security——If a person disturbs social order by distributing rumor related to danger, plague or others, and it generate public panic, he will be gotten administrative penalty.

Tactics and Countermeasures on Cyber-Terrorism

Policies Chinese government constitutes many policies to

protect critical information infrastructure, such as: national information security strategy——It confirms the goal, tactics, measures and safeguard-supporting works of protection for critical information infrastructure safeguard.regulation and standard of grading protection of information securityother policies of information security industry.

Tactics and Countermeasures on Cyber-Terrorism

Prevention and ManagementCarry out the system of grading protection of information security.

All the critical information systems are asked to be evaluated by third party and divided into 5 grades.According to the regulation and standard, the critical information system with specified grade should be taken corresponding safeguards and supervised by government.

Adopt crisis evaluation of information system in order to reinforce crisis management for critical information infrastructure.

Tactics and Countermeasures on Cyber-Terrorism

Prevention and ManagementConstruct and implement notification system of network and information security.

In 2004, The National Network and Information Security Coordination Team (NNISCT) established National Notification Center for Network and Information Security (NNCNIS ).NNCNIS is responsible for aggregating, analyzing, assessing, notifying and early warning information concerning network and information security.

Tactics and Countermeasures on Cyber-Terrorism

Prevention and Managementset up and execute classified response system of cyber-emergency, so as to enhance capability of response for critical information infrastructure on

preventingpreparingrespondingrecovering.

Supervise ISP and ICP fulfill the following legal responsibilities:Inform users of their legal burden when they apply Internet services. Report offences or crimes to police in time. Assist police to investigate cyber-terrorism or other cyber-crimes. Provide related data according as legislation.

Tactics and Countermeasures on Cyber-TerrorismCrime Striking

Fast crime detecting, reporting and responding mechanism are essential to combat cyber-terrorism.

Set up online cyber-crime reporting website in each province.www.Cyber-police.cnBeijing: http://bj.cyber-police.cnShanghai: http://sh.cyber-police.cn

established 24/7 contact mechanism among administrators of critical information infrastructure, ISP, ICP and Cyber-police in order to efficiently deal with information security incidents occurred in critical information systems.

Tactics and Countermeasures on Cyber-TerrorismCrime Striking

Enhance digital forensic technology and train staff regularly.Regulate investigation procedure for assuring the admissibility of electronic evidence.Seek technology supporting by

Cooperating with institutes, information technology enterprises, ISP, ICP and other organizations.

Improve cooperation and coordination with other countries and regions by

Participating the international training of technology relatedto cyber-terrorism or other cyber-crimes. Supplying legal assistance for Japan, Korea, Hongkong of China, etc. Promoting intercourse and collaborate on legislation, computer forensic, staff training etc.

Proposals

Proposals Reinforce cooperation and coordination among the members of ARF for combating cyber-terrorism:

Take effort to unify the definition of cyber-terrorism so as to guide legislations of the members. Establish Point-of-contact on 24/7 basis between our law enforcement agencies.Set up efficient and effective intelligence sharing mechanism.

Cyber-terrorismAn regional security Let’s work together

Thanks a lot