AS a starting point, a key principle in a democratic state is that the public should participate in the determination of public policy, and be kept informed of how that policy is being implemented. In other words, taxpayers are entitled to know what their taxes are buying, and to have some say in how their taxes are being spent. They should also be able to know how well their taxes are being spent, and to know if and how their taxes have been wasted. After all, in a democracy, the state exists to serve the people. Of course, in populous democracies such as India and the United States, pure democracy is logistically unfeasible. Democratic institutions such as legislatures and courts exist to overcome these logistical impediments. In addition to these institutions of the state, a free and robust press can play an important role in ensuring that governments are accountable for their actions.

But even a democracy requires a degree of secrecy. The secret ballot is, after all, the bedrock of democratic elections. Many governmental processes, and details of public policy, are best shielded from public view. In the Westminster system, cabinet deliberations are arguably best undertaken in confidence, in order to encourage open and robust discussion. This essay discusses the place of transparency in the development and implementation of national cyber security policy in democratic states. Examples are mostly drawn from recent US history, largely because of recent events that have shed considerable light on cyber security issues in that country.

Most if not all organizations, whether public or private, have three basic goals. One is to increase their resources, the other is to maximize their power, and the third, somewhat related, is to be shielded from external scrutiny of their internal dynamics. It should come as no surprise that some of the most powerful organizations of the 21st century are those dealing with national defence and intelligence. In many countries their aversion to transparency and accountability is evident on a daily basis.

Clearly, not all of the public’s defence and intelligence business can be placed on full display. Complete transparency would be self-defeating. There are, quite simply, some things that must be concealed from one’s adversary. For example, it would be unwise to publicize one’s own vulnerabilities. Nor would it be appropriate to divulge the location and timing of a planned attack, or to reveal the true identity of an undercover agent. Conversely, total opacity may also be counter-productive. When one’s capabilities are completely invisible to an adversary, that adversary may be tempted to try its luck; when one’s capabilities are hidden from one’s own citizens, opacity may induce either unwarranted anxiety or a false sense of security, depending upon the individual’s mindset. Either way, opacity, by definition, limits the information available to the citizens of a democracy to make informed decisions.

The decision to go to war in the absence of an actual or imminent attack by an adversary is arguably a violation of international law and is, therefore, one that requires significant public consultation. Paradoxically, this cannot be based on complete information, as details of war plans, targets, specifics of one’s own military capabilities, and one’s knowledge of the adversary’s capacities are often appropriately concealed. Cyber espionage and cyber war depend even more on stealth (not to mention deception), and are areas of activity that have revived the discussion of just how much a citizen should know.

 

The term legitimacy refers to public acceptance – the extent to which the citizenry regards an institution, a law, or a policy as rightful and appropriate. The tension between legitimacy and opacity is immediately apparent; the public cannot regard as appropriate something of which it is unaware. There are nevertheless circumstances in which opacity does not negate legitimacy. Trust in an institution or a policy may be so great that one may not wish to question it. There are those citizens who trust their government to do the right thing and would prefer not to know the details of how policies are implemented. So it is that many matters of national security are placed in the hands of defence and intelligence agencies with ‘no questions asked’. This involves what might be called a willing suspension of inquisitiveness, where citizens place themselves as beneficiaries of a national security ‘blind trust’.

Unfortunately, fiduciaries in matters of security, no less than of finance, may abuse the trust bestowed upon them. The eventual exposure of their abuses may lead to an erosion, if not a crisis, of legitimacy.

This cautionary note must not be interpreted as a mandate for cover-up. All citizens, concerned or not, have a right to know about the harm committed by their government on their behalf. And prospectively, it is important for citizens to be informed about whether a policy is misguided or not. Turning a blind eye to the less pleasant aspects of security and intelligence may be a source of comfort in the short-term, but it can lead to future headaches.

 

Depending upon the extent to which surveillance impacts the rights and liberties of one’s citizens, or those of foreign states, some form of formal authorization and oversight may be appropriate. In many common law countries, for example, the interception of one’s telecommunications requires prior judicial authorization.

When the state exercises its power, four questions arise: (i) Whether the state should have the power in the first place; (ii) Whether there is oversight and supervision over how that power is exercised; (iii) What response is appropriate when this power is abused; and (iv) Whether and if so, how much the citizenry should be made aware of the above.

Democratic states that intercept telecommunications for purposes of law enforcement or national security are usually bound by strict legislative and procedural requirements often requiring judicial oversight. The same should apply when Internet Service Providers are compelled to disclose telecommunications content or meta-data. The fact that there is a legislative basis for such activity makes it public knowledge. Any abuses of these practices should be dealt with in open court.

 

Unilateral surveillance of telecommunications content, such as that reportedly practised by the US National Security Agency, tends to occur outside of the public gaze. Although there may be a basis in law for such activity, the circumstances of its implementation are often invisible, as are responses to the abuse of such power. Countries such as the United States distinguish between their own citizens, and those of other countries. The latter are accorded less protection.

The interception of communications of friendly governments and their leaders as well as those of one’s adversaries, tends to be concealed from public view because of the very great potential for embarrassment and loss of legitimacy of the eavesdropping nation. The loci of decision making and supervision/authorization tend to be cloaked in secrecy. Whilst an outright renunciation of such power may be desirable, one can imagine exigent circumstances when such practices may be necessary to prevent widespread loss of life and/or property damage. There may be merit in disclosing the general outlines of such a policy without identifying target individuals or jurisdictions.

While governments are disinclined to publicize such activities, if they are to be undertaken at all, they should be governed by strict guidelines, with accountability residing at the highest level of government. The decision to engage in spying on one’s friends should not be taken lightly, and should weigh the potential knowledge gain and its strategic value against the obvious risks that would arise from its disclosure.¹

 

It has been reported that over a hundred states around the world have, or are developing, offensive cyber capabilities. Presumably, a comparable number have also invested in cyber defence. By what principles have these capabilities been developed? What degree of public consultation or legislative deliberation has been undertaken as a basis for these practices? To what kind of oversight (if any) are they subject? One suspects that most governments would be unwilling to reply to these questions, simply stating that they, as a matter of policy, do not comment on matters of intelligence. The tension with democracy is self-evident.

There are established principles in international law regarding when and how a state may resort to the use of force.² Their direct application to cyber warfare does not make for a perfect fit; for example, the appropriate response to an electronic levée en masse, or popular uprising in response to a cyber attack may differ from that occurring in physical space.³

But the principles of necessity and proportionality are more robust. One should not use force unless it is essential to achieve an objective. If less intrusive means of attaining the objective are available, they should be used. If force must be employed, one should not use more than is required. And steps should be taken to avoid collateral damage.

 

Determining necessity and proportionality often requires judgment calls. Circumstances that underlie a conflict are not always crystal clear, and perceptions and interpretations of reality may be flawed. One may recall the weapons of mass destruction said to have been at the disposal of Saddam Hussein. Actions undertaken in pre-emptive self-defence may be based on hasty judgment; the line between a potential threat and an imminent threat may be obscure. Dealing with these difficulties in physical space is hard enough. In the cyber domain, they are hardly conducive to public deliberation.

If momentous decisions are delegated to officials to deal with, beyond the public gaze, one would hope that certain mechanisms of accountability might be available to ensure the public’s business is conducted with integrity.⁴ An agency established for the purpose of offensive or defensive cyber operations, including surveillance, should operate under the rule of law. Ideally, there would be a legislative basis for the agency’s activity. This should clearly prescribe the agency’s roles, and should specify the limitations on its powers.⁵

Moving from the realm of abstraction and generalization to the real world, here is a case of offensive cyber operations which resulted in the infliction of actual physical damage, Operation Olympic Games.

The tension between secrecy and transparency in the domains of offensive and defensive cyber operations is boldly apparent. Consider the example of recent attempts to disrupt the enrichment of uranium by the Iranian state. Assuming the description of The New York Times correspondent David Sanger regarding a joint US-Israeli cyber attack on Iran’s Natanz nuclear enrichment facility is correct and sufficiently comprehensive, how much of this might have been appropriately disclosed to the public?⁶

 

Here is a reconstruction of the background to the activity that Sanger has described; the code name for the operation was Olympic Games. The Government of Iran had publicly and repeatedly called for the annihilation of the state of Israel. Meanwhile, Iran began enriching uranium, ostensibly for the purpose of peaceful use in electric power generation. Concerns on the part of Israel that Iran had the ulterior motive of developing nuclear weapons led it to threaten pre-emptive action – preferably in partnership with the United States, though if not, then unilaterally.

The possibility of a unilateral attack was real, given Israel’s 2007 attack on a nuclear facility in Syria. The G.W. Bush administration, preferring alternatives to the overt use of force, undertook a top secret cyber operation based on the insertion of complex malicious software in the Natanz facility’s systems. This operation, reportedly undertaken in collaboration with Israel, was continued by the Obama Administration after the 2008 US presidential election and substantially slowed Iranian enrichment processes. Only the subsequent escape of the so-called Stuxnet virus, central to this operation, revealed that someone had been interfering with Iranian nuclear enrichment activities. Sanger’s disclosures in June 2012 transformed what had been a top secret into public knowledge.

Despite its untimely disclosure, the operation not only served to delay the Iranian enrichment process, it may have prevented or postponed an Israeli attack and allowed the political processes in both Iran and Israel to cool off somewhat. The recent leadership change in Iran appears to have been accompanied by a relaxation of tensions.

 

The full consequences of Operation Olympic Games are uncertain, as neither the victims nor the perpetrators are inclined to discuss it. The apparent success of the operation came at the cost of the escape of a very sophisticated piece of malware into the public domain. With knowledge of the operation now widespread, there are individuals and states who may follow the example of perpetrators and engage in cyber attacks for their own purposes. The ultimate consequences of this potential turn of events are unpredictable. One has seen apparent Iranian retaliation in the form of cyber attacks against US financial institutions and Saudi oil facilities.⁷ The violation of Iran’s sovereignty was also regarded by some as wrong (the operation, after all, entailed criminal activity), despite the higher purpose of the undertaking of trying to prevent even greater harm.

 

Was the decision by President Bush to launch Olympic Games (and its continuation by President Obama) an appropriate one? Based on the words and deeds of the Iranian government, it would seem so. To do nothing would have allowed the enrichment process to proceed, and Iran had done little to dispel suspicions that their activities were aimed at weapons development. Israel seemed intent on stopping the Iranian programme, with or without US assistance. Armed intervention, whether unilateral or as part of a joint US-Israeli attack, would risk collateral damage to innocent Iranian civilians, and the real possibility of an escalation of conflict. However, the threat of attack by Iran was not imminent, although, ironically, the threat of attack by Israel may have been.

Was the secrecy surrounding the operation justified? Probably so. Such an operation could never have been the subject of widespread public debate. Simply stating that ‘all options were on the table’ to discourage Iran’s uranium enrichment was sufficient; specifying that a cyber attack was imminent or indeed, in progress, would have enabled Iran to enhance its cyber defences and possibly thwart the operation.

Was the eventual disclosure of the operation (apparently by a knowledgeable insider) also appropriate? The United States Government apparently thinks not; the matter remains the subject of a criminal investigation. The revelation of US capacity for offensive cyber operations may encourage potential adversaries to redouble their efforts at cyber security. It does not appear that Operation Olympic Games resulted in any significant damage to the legitimacy of the United States and its agencies, except perhaps in Iran.

 

One should be cautious about uncritically accepting government pronouncements relating to security. Historically, many governments, democratic and otherwise, have invoked national security as a justification for domestic surveillance and political repression, to freeze democratic political debate, to shield shortcomings in governance from public and media attention, and for the inappropriate use of armed force. History is riddled with examples where national security justifications have been fabricated outright, or where underlying circumstances have been grossly exaggerated in order to meet the requirements of an extraordinary response.⁸ More recently, national security concerns in the United States have served to obscure the contours of (and thereby inhibit debate on) the massive electronic surveillance programme undertaken by the National Security Agency.⁹ The publication of a recent report by a Presidential Review Group,¹⁰ instigated by the Snowden disclosures,¹¹ may herald a refreshing departure from previous patterns, at least in the United States.

Some of the more significant cyber threats to national security are self-inflicted. States that commit cyber crime may themselves be weakened as a result, especially when their activities come to public attention. States that present themselves as paragons of virtue, only to be found to have been engaged in criminal activities, may see their moral authority eroded. Hypocrisy tends to be inconsistent with leadership. The state that does not practice what it preaches may lose legitimacy, both domestically and internationally. When hypocrisy is masked by secrecy, ultimate disclosure can be painful. One could perhaps suggest that the state which reveals its own transgressions is better off than the state whose transgressions are revealed by an independent team of cyber forensics investigators, or by a whistle-blower. It would appear that more public discussion of cyber security issues would be beneficial.

 

Footnotes:

1. United States, President’s Review Group on Intelligence and Communications Technologies, Liberty and Security in a Changing World. The White House, Washington, 2013. http://www.whitehouse.gov/sites/default/files/docs/2013-12-12_rg_final_report.pdf (accessed 8 January 2014).

2. Dorothy Denning, ‘The Ethics of Cyber Conflict’, in Himma and Tivani (eds.), The Handbook of Information and Computer Ethics. John Wiley and Sons, New York, 2008, pp. 407-428.

3. David Wallace and Shane Reeves, The Law of Armed Conflict’s "Wicked" Problem: Levée en Masse in Cyber Warfare’, International Law Studies 89, 2013, pp. 646-668; Michael Schmitt (ed.), Tallinn Manual on the International Law Applicable to Cyber Warfare. Cambridge University Press, Cambridge, 2013.

4. Institute for Defence Studies and Analyses, India’s Cyber Security Challenges. Institute for Defence Studies and Analyses, New Delhi, 2012.

5. Pranesh Prakash, ‘How Surveillance Works in India’, The New York Times, 10 July 2013. http://india.blogs.nytimes.com/2013/07/10/how-surveillance-works-in-india/ (accessed 8 January 2014).

6. David Sanger, Confront and Conceal: Obama’s Secret Wars and Surprising Use of American Power. Crown Publishers, New York, 2012.

7. N. Perlroth, ‘In Cyberattack on Saudi Firm, U.S. Sees Iran Firing Back’, The New York Times, 23 October 2012. http://www.nytimes. com/2012/10/24/business/global/cyberattack-on-saudi-oil-firm-disquiets-us.html?page wanted=all (accessed 8 January 2014); N. Perlroth and Q. Hardy, ‘Bank Hacking was the Work of Iranians, Officials Say’, The New York Times, 8 January 2013. http://www. nytimes.com/2013/01/09/technology/online-banking-attacks-were-work-of-iran-us-officials-say.html (accessed 8 January 2014); Tom Groenfelt, ‘Did U.S. Cyberattacks on Iran Backfire on American Banks?’ Forbes, 6 August 2013. http://www.forbes.com/sites/tomgroenfeldt/2013/06/08/did-u-s-cyberattacks-on-iran-backfire-on-american-banks/(accessed 8 January 2014).

8. Robert J. Hanyok, ‘Skunks, Bogies, Silent Hounds, and the Flying Fish: The Gulf of Tonkin Mystery, 2-4 August 1964’, Cryptologic Quarterly 19(4)/20(1), 2001, pp. 1-55. http://www.gwu.edu/~nsarchiv/NSAEBB/NSAEBB132/relea00012.pdf (accessed 8 January 2014); James Bamford, The Shadow Factory: The NSA from 9/11 to the Eavesdropping on America. Random House, New York, 2008.

9. The New York Times, ‘More Fog from the Spy Agencies’ NYT, 31 July 2013. http://www.nytimes.com/2013/08/01/opinion/more-fog-from-the-spy-agencies.html?emc =edit_tnt_20130731&tntemail0=y (accessed 8 January 2014).

10. United States, 2013, op cit.

11. Miren Gidda, ‘Edward Snowden and the NSA Files – Timeline’, The Guardian, 26 July 2013. http://www.theguardian.com/world/2013/jun/23/edward-snowden-nsa-files-timeline?INTCMP=SRCH (accessed 8 January 2014).

 

References

Glenn Greenwald, ‘XKeyscore: NSA Tool Collects "Nearly Everything a User Does on the Internet"’, theguardian.com, 31 July 2013. http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-data (accessed 8 January 2014).

Glenn Greenwald and Ewen MacAskill, ‘Obama Orders US to Draw Up Overseas Target List for Cyber-attacks’, The Guardian, 8 June 2013. http://www.theguardian. com/world/2013/jun/07/obama-china-targets-cyber-overseas (accessed 8 January 2014).

Glenn Greenwald and Ewen MacAskill, ‘NSA Prism Program Taps in to User Data of Apple, Google and Others’, The Guardian, 7 June 2013. http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data (accessed 8 January 2014).

Tim Weiner, Enemies: A History of the FBI. Random House, New York, 2012.