The HSE cyberattack should prompt us to join NATO

hmmm

The cyberattack on the HSE is being treated as a criminal matter. The reality is that we are likely dealing with attackers who are operating out of a country which has given them tacit approval for their actions. As someone else said, once you do this as a country you end up with 20 year-olds implementing foreign policy, and I think it is as much of an attack on this country as if it had been a kinetic attack.

If this had happened in a small NATO country you'd have seen some consideration of invoking the mutual protection clause. There's a diplomatic element to this (drawing up the rules of what is acceptable in cyberwarfare) and it also would have given them the ability to draw on the resources of other states.

Unfortunately for us we now have a problem as we've been marked as relatively weak and this will encourage more attacks (that's not to denigrate the hard work being done by people to try and recover from this).

Our fortunate geographical position has largely protected us to date. In cyberspace geography means very little, and we can very rapidly end up on the front line of what will be a new form of warfare. We need to seriously consider whether we have the ability to protect ourselves in this new environment, and if not what we do in response.

lawred2

what would guns and bombs do for us?

Larbre34

I'm inclined to agree.

Make no mistake, if this was a State actor, it would be an act of War. The fact that Russia shelters this activity is almost as bad.

If nothing else, NATO would allow us to access shared resources both to prevent this stuff with greater success and to go after the gangs.

I've said on other fora, there is a two pronged approach to shutting this stuff down. 1) kill cryptocurrency. Undermine it, corrupt it, dump it, close doors to it. 2) the Mossad approach. Start assassinating wizard spider and everybody like them. On the street, in their cars, in their homes. Spread panic, fear, confusion. These ****ers live in far too splendid an isolation in Russia, they want a War by destroying the healthcare support of thousands of people? Well they've got one.

Larbre34

lawred2 wrote: »

what would guns and bombs do for us?

Thats a churlish dumbass question which deliberately ignores the challenge at hand and the capacity of NATO resources. Resources we don't have.

lawred2

Larbre34 wrote: »

I'm inclined to agree.

Make no mistake, if this was a State actor, it would be an act of War. The fact that Russia shelters this activity is almost as bad.

If nothing else, NATO would allow us to access shared resources both to prevent this stuff with greater success and to go after the gangs.

I've said on other fora, there is a two pronged approach to shutting this stuff down. 1) kill cryptocurrency. Undermine it, corrupt it, dump it, close doors to it. 2) the Mossad approach. Start assassinating wizard spider and everybody like them. On the street, in their cars, in their homes. Spread panic, fear, confusion. These ****ers live in far too splendid an isolation in Russia, they want a War by destroying the healthcare support of thousands of people? Well they've got one.

I'd agree this has to happen

Dohvolle

Dohvolle wrote: »

Reasons for cryptocurrency:
Launder money
Buy controlled drugs
Buy guns
Buy child pornography.
Until it is brought into the mainstream it funds the black market in everything. It must be shut down.

You are aware all of that **** occurred before the invention of cryptocurrency.

Larbre34

[Deleted User] wrote: »

You are aware all of that **** occurred before the invention of cryptocurrency.

Certainly.

However the criminal world have become used to it as a medium to transact. If it could be destroyed now, it would both disrupt them and erase a lot of their wealth.

Yes, they would of course revert to sovereign currencies and look for new and more perverted ways to make money but that doesn't add up to a case for not doing it.

lawred2

Larbre34 wrote: »

Thats a churlish dumbass question which deliberately ignores the challenge at hand and the capacity of NATO resources. Resources we don't have.

https://ccdcoe.org/news/2019/nato-cooperative-cyber-defence-centre-of-excellence-grows-to-25-members/

Whatever happened to our application to join ccdcoe?

papu

I don't understand why people are derailing threads about this cyberattack with Crypto nonsense.

To the topic at hand. Cyber attacks have been potentially linked to state actors numerous times, they are not taken as acts of war, far more destructive and damaging attacks have been carried out on far more powerful countries..

I don't see what advantage membership of NATO would give us and if it changes our neutrality I would be opposed. I imagine a referendum would be required.

hmmm

papu wrote: »

I don't see what advantage membership of NATO would give us and if it changes our neutrality I would be opposed. I imagine a referendum would be required.

For me it gives us two things:
1. It gives us access to resources and mutual aid. We hear all about how Interpol are involved, as if that helps. The police know where these people are - one of the leaders of a notorious Ransomware gang drives around Moscow in a Lamborghini. It is being treated as a criminal case when the reality is that this is a verging on a state-level attack.
2. It makes us a more dangerous target if the potential of mutual military aid is available from other NATO countries. I'm not talking drone strikes, but the ability to both provide cyber-defense and offensive capabilities.

There are other cyber-attacks happening against Irish ISPs right now, and the concern is that the country is going to be seen as a soft (and wealthy) target. I wouldn't like to be the person running IT in the HSE, as even when they get the network back up you can't fix years of under-investment leading to security vulnerabilities.

Larbre34

Absolutely, every word correct.

Neutrality is a policy, just like any other competence of the Government of the day and by extension, Oireachtas Éireann. It always amazes me how many default lefty box tickers have no idea about that.

And anyway, neutrality is now a complete misnomer for what we are. As a leading EU member and free and democratic nation of the Western World, there are no doubts as to where our loyalties lie, we are just militarily non-aligned, i.e. we factually do not belong to any specific alliances, yet we are an active member of NATO Partnership for Peace and a non permanent Member of the UN Security Council, so make of that what you will.

If the Government of this State need to take a military or security related action to defend the interests of this State directly, they need only get the ascent of Dáil Éireann. If they want to carry out a black operation on foreign soil, they don't even need that. And in this case we aren't dealing with a Nation, we're dealing with unprincipled criminal scum who should be exterminated.

timmyntc

Surely more cooperation at an EU level would make more sense than joining NATO.

As part of PESCO there is a very large cyber-security contingent, but I'm not sure if Ireland cooperates much on that front.
So instead of joining NATO and all the cons that involves, why not just make use of the organisation we are already in?

Also even if we were in NATO or closely aligned re: PESCO cybersecurity, the HSE attack would still have happened. Its a problem with organisations not taking security seriously. Cyber attacks can and will get through - its not like conventional warfare at all.

hmmm

timmyntc wrote: »

Cyber attacks can and will get through - its not like conventional warfare at all.

I think you're stuck in a guns and bullets mindset - the (in)actions of certain countries is aimed at achieving much the same impact as normal conventional war on those they see as their adversaries/competitors. These ransomware cyber-attacks are on an entirely different level because there is no normal policing response which can combat them when the criminals are protected by a state.

If some other country was firing missiles at our hospitals we'd both criticise our defenders, but also put blame on those firing the missiles. In this case a lot of people seem to think that we only blame the defenders, and we should passively accept cyber-attacks.

Short of perhaps some actions during the troubles, I can't think of a more devastating attack on our country than what we are seeing currently - and certainly not one from another state. And it's a warning for the future - criminals who disable our hospitals would be more than willing to go after our electricity or water systems etc.

sparky42

Membership of NATO is pretty much irrelevant in this, it’s only a couple of weeks since the major disruption in the states due to hacking an oil company, not too mention the massive cyber breach they discovered last year, same for the U.K. with the NHS attack a few years ago.

The issue is as always the Irish people an politicians have feck all interest in funding cyber defence (or any defence), as mentioned the national risk assessment has been highlighting this for years and the situation has only got worse. There’s no way anyone is going to support a 2% spend on defence so forget NATO (hell even 1% is politically impossible), this attack won’t change anything, there will be a few sound bites for effect and then it’s back to “sure we’re Irish, nobody will attack us”.

knucklehead6

Larbre34 wrote: »

I'm inclined to agree.

Make no mistake, if this was a State actor, it would be an act of War. The fact that Russia shelters this activity is almost as bad.

If nothing else, NATO would allow us to access shared resources both to prevent this stuff with greater success and to go after the gangs.

I've said on other fora, there is a two pronged approach to shutting this stuff down. 1) kill cryptocurrency. Undermine it, corrupt it, dump it, close doors to it. 2) the Mossad approach. Start assassinating wizard spider and everybody like them. On the street, in their cars, in their homes. Spread panic, fear, confusion. These ****ers live in far too splendid an isolation in Russia, they want a War by destroying the healthcare support of thousands of people? Well they've got one.

Larbre34, you might want to change your password. I think Johnny Bigwallet got hold of your account

timmyntc

hmmm wrote: »

I think you're stuck in a guns and bullets mindset - the (in)actions of certain countries is aimed at achieving much the same impact as normal conventional war on those they see as their adversaries/competitors. These ransomware cyber-attacks are on an entirely different level because there is no normal policing response which can combat them when the criminals are protected by a state.

If some other country was firing missiles at our hospitals we'd both criticise our defenders, but also put blame on those firing the missiles. In this case a lot of people seem to think that we only blame the defenders, and we should passively accept cyber-attacks.

Short of perhaps some actions during the troubles, I can't think of a more devastating attack on our country than what we are seeing currently - and certainly not one from another state. And it's a warning for the future - criminals who disable our hospitals would be more than willing to go after our electricity or water systems etc.

So you expect us to go to war with the Russians/Chinese/etc based on the actions of some of their citizens?

What happens when attackers start to spoof their IPs or simply operate with VPNs through Russia but theyre really based somewhere else? We still assume its Russia and go to war?

Cyberattacks are a minefield of complexity, the NATO approach would not cut it. At the end of the day it comes down to having the necessary protections in place against various exploits. Whether you get retribution for their actions is irrelevant - the damage will still have been done. Killing people wont remove ransomware.

hmmm

timmyntc wrote: »

What happens when attackers start to spoof their IPs or simply operate with VPNs through Russia but theyre really based somewhere else? We still assume its Russia and go to war?

Attribution is difficult, but in general most of the major ransomware gangs have now been geo-located, particuarly thanks to the work of groups like Mandiant. Some make it easier than others by driving around Moscow in a Lamborgini.

At the end of the day it comes down to having the necessary protections in place against various exploits.

We're heading into a place where simply patching and having protections in place won't stop these gangs. They are wealthy enough to purchase zero-days which will bypass current protections. One group reverse-engineered the code on file-sharing systems used by some major institutions and wrote their own zero-days. We've seen with the Solarwinds attack that these attackers were inside the networks of major institutions and firms for months without being detected - thankfully in this case it was military intelligence and not a ransomware group.

Ireland cannot protect itself in this new world on its own. That will become apparent over the next few years.

timmyntc

hmmm wrote: »

Attribution is difficult, but in general most of the major ransomware gangs have now been geo-located, particuarly thanks to the work of groups like Mandiant. Some make it easier than others by driving around Moscow in a Lamborgini.


We're heading into a place where simply patching and having protections in place won't stop these gangs. They are wealthy enough to purchase zero-days which will bypass current protections. We've seen with the Solarwinds attack that these attackers were inside the networks of major institutions and firms for months without being detected - thankfully in this case it was military intelligence and not a ransomware group.

Ireland cannot protect itself in this new world on its own. That will become apparent over the next few years.

And we are not on our own - we are part of the EU, we have signed up to PESCO. Our govt should cooperate closer on the cybersecurity aspects of PESCO.

There is no need to join NATO. Its not like NATO membership would deter these gangs anyways - didnt they hack a US oil pipeline recently?

hmmm

timmyntc wrote: »

There is no need to join NATO. Its not like NATO membership would deter these gangs anyways - didnt they hack a US oil pipeline recently?

Yep, and the group that did this realised their mistake and have been running ever since (possibly disbanded, claiming to have been attacked in response). The group who hacked the HSE are laughing at us. Biden has been on the phone to Putin as a consequence, and it has been raised in yesterday's US-Russia talks. Russian ransomware hackers will not be deliberately targeting US infrastructure again any time soon.

Jim2007

hmmm wrote: »

If this had happened in a small NATO country you'd have seen some consideration of invoking the mutual protection clause. There's a diplomatic element to this (drawing up the rules of what is acceptable in cyberwarfare) and it also would have given them the ability to draw on the resources of other states.

This is just nonsense. The EU treaties include a similar clause, which could have been invoked and brought most of the NATO countries into the game. But what good would it have done, what resources would they have brought to the table? The only experience most of them have is failure and an ability to pay the ransom quickly.

Unfortunately for us we now have a problem as we've been marked as relatively weak and this will encourage more attacks (that's not to denigrate the hard work being done by people to try and recover from this).

On the contrary Ireland is far from weak when it comes to this kind of stuff, this represents the third failed ransom attempt on public services there are not many public services that have managed to do so well.

We can very rapidly end up on the front line of what will be a new form of warfare. We need to seriously consider whether we have the ability to protect ourselves in this new environment, and if not what we do in response.

We are already on the front line and have been for sometime. And we are actually doing very well as the most recent failed attempt shows. No doubt lessons will be learned and adjustments will be made to improve the defenses.

On average a personal website gets hit 8 to 1o times a week, but there is usually nothing of interest and most owners are not monitoring for it anyway. Our financial institutions are being hit 7x24 and most companies are probably hit a couple of times a day at least.

You need to learn how the game is played and NATO is irrelevant.

Jim2007

hmmm wrote: »

Yep, and the group that did this realised their mistake and have been running ever since (possibly disbanded, claiming to have been attacked in response). The group who hacked the HSE are laughing at us. Biden has been on the phone to Putin as a consequence, and it has been raised in yesterday's US-Russia talks. Russian ransomware hackers will not be deliberately targeting US infrastructure again any time soon.

You have absolutely no idea who this game is played. Every minute of the day hackers around the world are hitting every single company with an internet presence and it does not matter who Putin or Biden speak to.

hmmm

Jim2007 wrote: »

You need to learn how the game is played and NATO is irrelevant.

I know how the actual epidemiologists on the Covid threads feel now. :rolleyes:

timmyntc

hmmm wrote: »

I know how the actual epidemiologists on the Covid threads feel now. :rolleyes:

Are you an actual diplomat? :pac:

sparky42

timmyntc wrote: »

And we are not on our own - we are part of the EU, we have signed up to PESCO. Our govt should cooperate closer on the cybersecurity aspects of PESCO.

There is no need to join NATO. Its not like NATO membership would deter these gangs anyways - didnt they hack a US oil pipeline recently?

Or as I pointed out the U.K. NHS attack a few years ago. Our basic issue is that as with anything defence related we invested feck all in the area on the assumption that nothing bad would happen. Being part of NATO won’t change that unless we change our mindset on defence, I mean hell we’re currently just basically signatures on PESCO projects to be seen to be there, rather than actually engaging with them.

Jim2007

sparky42 wrote: »

Our basic issue is that as with anything defence related we invested feck all in the area on the assumption that nothing bad would happen. Being part of NATO won’t change that unless we change our mindset on defence, I mean hell we’re currently just basically signatures on PESCO projects to be seen to be there, rather than actually engaging with them.

Like every other country, we are spending a very large percentage of IT budgets on this. This is not a military matter it's industrial espionage and it is taken very seriously by us all.

sparky42

Jim2007 wrote: »

Like every other country, we are spending a very large percentage of IT budgets on this. This is not a military matter it's industrial espionage and it is taken very seriously by us all.

Companies are taking it seriously, without question government and its agencies like the HSE are not. The investment at state level just hasn’t happened.

hmmm

Dohvolle wrote: »

Theft of the medical history of the state's citizens is not industrial espionage. Closure of the State's health IT infrastructure is not industrial espionage.
It's a level above that.

I can't believe people are trying to underplay this.

What is the purpose of our defence forces if they were not involved in the defence of the most serious attack on our infrastructure possibly in the history of the state? I'm not criticising them because I agree with everyone else who has said they are not being given the resources or influence. How much support has the talking shop of PESCO provided to us during this?

We don't ask companies or our public services to install anti-air defences to fight off air attacks, but we expect them to fight off cyber-attacks. There is a mentality problem here which has cost us dearly this time.

Estonia and to a lesser extent Ukraine are countries which have had to take this seriously. We've suddenly been catapulted into somewhere close to the front lines and it's a lonely place to be.

sparky42

hmmm wrote: »

I can't believe people are trying to underplay this.

What is the purpose of our defence forces if they were not involved in the defence of the most serious attack on our infrastructure possibly in the history of the state? I'm not criticising them because I agree with everyone else who has said they are not being given the resources or influence. How much support has the talking shop of PESCO provided to us during this?

We don't ask companies or our public services to install anti-air defences to fight off air attacks, but we expect them to fight off cyber-attacks. There is a mentality problem here which has cost us dearly this time.

Estonia and to a lesser extent Ukraine are countries which have had to take this seriously. We've suddenly been catapulted into somewhere close to the front lines and it's a lonely place to be.

PESCO doesn’t operate like that, are we even active in the Cyber projects?
https://eucyberdirect.eu/content_knowledge_hu/cyber-related-pesco-projects/
I mean we are only actively involved in one (maritime surveillance) and just “observer status” in another 8 so that’s not any use to us.

sparky42

RTÉ reporting that they have sent a decryption key, so did the HSE actually pay the ransom?
https://www.rte.ie/news/2021/0520/1222857-hse-weekly-briefing/

Cypher_sounds

sparky42 wrote: »

RTÉ reporting that they have sent a decryption key, so did the HSE actually pay the ransom?
https://www.rte.ie/news/2021/0520/1222857-hse-weekly-briefing/

Nope.

sparky42

Cypher_sounds wrote: »

Nope.

If they did they are never going to admit it, but with nearly a week now being offline I can imagine plenty of pressure to do something.

knucklehead6

Dohvolle wrote: »

Word is the Russian Government gave them an offer they couldn't refuse.

The HSE or the hackers?

tdf7187

Screw NATO. We need an off-the-books special ops department. Find and terminate the perps with extreme prejudice. Obviously this could not be subject to Dail oversight. We don't want the likes of Paul Murphy screeching and wailing about human rights.

irishrgr

It is interesting to watch this play out from the US, although, it's not getting any traction in the US media.

I have to agree, that joining NATO, while it is useful, I don't know that NATO is at a point to conduct offensive cyber operations given it is a consensus based organization. Debating a cyber action would defeat the purpose, unless it was a standing order of some sort. Cyber attacks are very hush hush.

In the policy world, there is a lot of discussion over the question of "does this constitute an act of war?". Given that if another nation state dropped a bomb on a power station, it's clear. If they drop a virus in and cripple the station, is it the same thing? Pundits beat that one to death.

I've probably said this before, Ireland needs to get over it's strategic arrogance about neutrality and wake up to 21st century geopolitics. Ireland has made its position on cyber very clear, the National Cyber Security Center doesn't have a director, (they grade & pay are an insult), it doesn't have a cabinet level position and the DF bodies seconded have been vacant due to shortages. The Natl. Cyber strategy hasn't been updated since 2017, that says it all really. Ireland doesn't have the resources for this sort of thing, so joining alliances and sharing is the only way ahead.

Cyber is hard, most people don't understand it, less so politicians. It's expensive, complex and very dynamic. The US has a CYBERCOM dedicated to it, and we still had the Solar Winds hack of the DoD. I just don't think Irish political leaders understand broad strategic issues like this and there is no lobby for it.

A possible silver lining would be to invest in the DF Cyber capability, especially given the commission is meeting during this.

Or, perhaps Mary Lou could just ring the hackers, and tell them "sure we're neutral" and they'll apologize right away I'm sure. Another positive, seeing as something like one third of the Garda stations are still not connected to the internet, at least they are safe :-)

Don't get me wrong, this sucks, Ireland is in a bad way. And think about what other systems in the country have been infected and are just waiting quietly.

Larbre34

tdf7187 wrote: »

Screw NATO. We need an off-the-books special ops department. Find and terminate the perps with extreme prejudice. Obviously this could not be subject to Dail oversight. We don't want the likes of Paul Murphy screeching and wailing about human rights.

While I agree in principle, one does not simply set up an office and order the headed paper marked Irish Secret Intelligence Service.

We have no assets, we have no contacts, we have no experience in the field. The only way something like that could happen is to have a friendly nation do it our behalf and on our dime. And in all liklihood, not even our closest friends internationally would do it without being in a formal alliance that provided for the sharing of secret intelligence.

Besides, these f***ers pose a grave threat to the State and private ICT systems of every major nation. I suspect if the US or Britain or Israel had been able to pin down who and where they are, they would have eliminated them already.

Larbre34

Dohvolle wrote: »

Word is the Russian Government gave them an offer they couldn't refuse.

Being in debt to Russia as a nation in any sense, but particularly for something like this, is a very very bad situation to be in.

Frankly we'd be better off keeping it between the Government and the hackers.

Listowel Man

the Irish government have until Monday to pay the HSE hackers

Traumadoc

hmmm wrote: »

The cyberattack on the HSE is being treated as a criminal matter. The reality is that we are likely dealing with attackers who are operating out of a country which has given them tacit approval for their actions. As someone else said, once you do this as a country you end up with 20 year-olds implementing foreign policy, and I think it is as much of an attack on this country as if it had been a kinetic attack.

If this had happened in a small NATO country you'd have seen some consideration of invoking the mutual protection clause. There's a diplomatic element to this (drawing up the rules of what is acceptable in cyberwarfare) and it also would have given them the ability to draw on the resources of other states.

Unfortunately for us we now have a problem as we've been marked as relatively weak and this will encourage more attacks (that's not to denigrate the hard work being done by people to try and recover from this).

Our fortunate geographical position has largely protected us to date. In cyberspace geography means very little, and we can very rapidly end up on the front line of what will be a new form of warfare. We need to seriously consider whether we have the ability to protect ourselves in this new environment, and if not what we do in response.

You really think NATO countries are protected or attacked less?

ineedeuro

Maybe instead of joining NATO we just ask our pubic servants to do their jobs?

Swindled

How is paying additional taxes to NATO, in a country with one of the best private sector tech capabilities in the world, going to cure Irish public service mangers incompetence ?

Larbre34

Swindled wrote: »

How is paying additional taxes to NATO going to cure Irish public service mangers incompetence ?

By giving us access to the kind of joint resources our taxes could never pay for in a million years.

Its thinking like yours and your friend above, that has us the way we are.

Relax lads. Our magical shield of neutrality will protect us.

Edit: also something else will go wrong at some other part of the hse in a fortnight, the IT issues will be forgotten and resources are needed on the frontline.

ineedeuro

Larbre34 wrote: »

By giving us access to the kind of joint resources our taxes could never pay for in a million years.

Its thinking like yours and your friend above, that has us the way we are.

What way is that?

Swindled

Larbre34 wrote: »

By giving us access to the kind of joint resources our taxes could never pay for in a million years.

Its thinking like yours and your friend above, that has us the way we are.

Yep, let's treat the symptoms instead of the cause, great idea.
Yep, NATO are so great, they will cure Irish pubic sector management incompetence, and clean up after then every time for us.

Larbre34

ineedeuro wrote: »

What way is that?

Vulnerable, under resourced, behind the curve.

ineedeuro

Swindled wrote: »

Yep, let's treat the symptoms instead of the cause, great idea.
Yep, NATO are so great, they will cure Irish pubic sector management incompetence, and clean up after then every time for us.

We join NATO and then every country has a reason to come after us

Imagine how long it would take the terrible public service down around here? 2 or 3 mins before they cripple the whole place?

A crowd of incompetent clowns in the HSE and suddenly some people are talking about joining NATO and going to war. Baffling

Maybe, just maybe, we should ask people to do the job they are paid to do.

ineedeuro

Larbre34 wrote: »

Vulnerable, under resourced, behind the curve.

We are one of the major IT hubs in the World. We have a terrible public service run by terrible politician who are voted in by the public. People like the two lads from Kerry

What other way do you think it would be when people vote those clowns in? In the last election the biggest party was a crowd who support murders and child abusers.

Maybe we should fix our political system first?

Montage of Feck

We should consider also the Warsaw pact.

Larbre34

ineedeuro wrote: »

We are one of the major IT hubs in the World. We have a terrible public service run by terrible politician who are voted in by the public. People like the two lads from Kerry

What other way do you think it would be when people vote those clowns in? In the last election the biggest party was a crowd who support murders and child abusers.

Maybe we should fix our political system first?

I can't argue with that. But thankfully those you mention have not had influence in Government.

I'm not sure how you intend to "fix" democracy though, other than to put your name forward on a ballot and make an argument that is different to what has gone before.

Fundamentally you're right of course, we elect local politicians to do a national job and it should be a national assembly of policy and not a local talking shop of parish pump. Can't see the Healy Raes or the Shinners vote to change that anytime soon though. Can you?

Montage of Feck

Montage of Feck wrote: »

We should consider also the Warsaw pact.

"You don't join Warsaw pact. Warsaw pact join you." :P

Sonic the Shaghog

Jesus Christ NATO and spec ops teams going around assassinating hackers. They'd be flying to Russia one week to kill a group of scammers, Latvia to riddle a bunch of 17 year olds in their mothers basement the next and off to blow up an office block of scammers in Pakistan or Nigeria the week after, ya that would go well

Lay off the 24 and Strike Back reruns lads ffs