OSCE/FSC: DAY ONE--OSCE WORKSHOP ON A

UNCLAS SECTION 01 OF 07 USOSCE 000064 SENSITIVE SIPDIS STATE FOR VCI/CCA, EUR/RPM, NSA FOR STANAR-JOHNSON, T FOR KATSAPIS, OSD EUR/NATO, OSD/NII FOR HALL, DHS FOR DENNING, NSC FOR HATHAWAY, NSC FOR DONAHUE, NSC FOR CUMMINGS, WINPAC FOR FRITZMEIER, ISN FOR KARTCHNER, NSC FOR HAYES JCS FOR J5/COL NORWOOD OSD FOR ISA (PERENYI) E.O. 12958: N/A TAGS: EINT FR KCFE KHLS OSCE PARM PREL RS KCIP SUBJECT: OSCE/FSC: DAY ONE--OSCE WORKSHOP ON A COMPREHENSIVE OSCE APPROACH TO ENHANCING CYBERSECURITY ¶1. (U) NOTE: This is the first of two cables reporting the March 17-18 OSCE Workshop on a Comprehensive OSCE Approach to Enhancing Cybersecurity. END NOTE. ¶2. (SBU) Summary: More than 200 civil and military representatives gathered in Vienna, March 17 ) 18, in the first wide-scale FSC effort to discuss cybersecurity. This was one of the more broadly attended workshops held under the auspices of the OSCE, with reps in attendance from Egypt, Japan, the Arab League, and NATO, among others. Their key aim was to identify ways to cooperate on enhancing cybersecurity and examine the potential future role of the OSCE in addressing this global problem. Washington reps, led by State/INR Michele Markoff, also consisted of reps from State/EEB, DHS, and DOD. ¶3. (SBU) Initially considered by the U.S. a risky topic for the FSC, the workshop proved a successful endeavor for achieving U.S. objectives, which were to prevent the militarization of cyber security, refrain from engaging in discussions on constraining state capabilities, and keeping the focus on defensive remedies to ensure cyber security. There was much support for the U.S. position to focus on defensive strategies and for a U.S. recommendation that OSCE participating States conduct a self-survey to identify gaps and capacities in order to later devise an approach to cyber resiliency. There was very little support for Russia's description of cyber security as an "information arms race" that required a new international treaty instrument. Russia's proposal to begin by defining relevant terms and concepts also gained little traction. Russia was alone in its opposition to the Council of Europe Convention on Cyber Crime. Turkey reported that inconsistencies with its own national legislation had kept it from adopting the convention, but asked USdel on the margins of the workshop for assistance in reconciling this obstacle. ¶4. (SBU) There was strong support for U.S. expert participation from Washington in the workshop. Several delegations praised the efforts of the U.S. panelists (State/INR, DOD, and DHS reps) and pointed out the U.S. rep's excellent job of summarizing two days of discussion in the last working session. Several delegations were eager to follow up with the U.S. head of del after her presentation. EU reps invited U.S. participation/expertise to an informal ministerial conference on critical information infrastructure protection (CIIP),to be held April 27-28 in Tallinn. A number of possible recommendations for follow-up activities were proposed. We would welcome Washington guidance on how it envisions follow-up activity in Vienna. ¶5. (SBU) COMMENT: If the USG wishes to move forward on cyber security in the OSCE, a new CSBM introduced by the U.S. and close Allies on cyber security may be in U.S. interest for three reasons. First, this could advance the U.S. approach with the 56 participating States (pS),over half of whom are not in NATO. Second, this would proactively offer a positive alternative to displace unhelpful Russian proposals and prevent Russian views from being the center of attention. Third, the U.S. would assert leadership. Such a CSBM could be centered, for instance, around the 6-7 well-received recommendations the USG panelist made at the end of the workshop or the 11 agreed points on cyber security already agreed within the G-8. By moving forward with one of the recommendations that were also proposed in the non-paper authored by Austria, Estonia, and Lithuania, the U.S. could enlist one or all of these countries as co-leads of the action. END COMMENT. END SUMMARY. USOSCE 00000064 002 OF 007 - - - - - - - - - - - - - - - - - - - - - - - - Opening Session: OSCE Takes on Cyber security - - - - - - - - - - - - - - - - - - - - - - - - ¶6. (U) Greek Chairman in Office (Ambassador Mara Marinaki) opened the March 17 -18 OSCE Workshop on a Comprehensive OSCE Approach to Enhancing Cyber Security by saying it was the first wide-scale OSCE effort to discuss cyber security, building on previous OSCE efforts to combat terrorism on the Internet, exchange information, and discuss concrete steps for a way forward. The Greek CiO pointed out, in particular, a jointly sponsored non-paper authored by Austria, Estonia, and Lithuania (FSC.DEL/33/09),which lays out specific concerns related to cyber security and a possible way forward for the OSCE to address those concerns. The OSCE Secretary General Marc Perrin de Brichambaut commented that the holding of this event demonstrated how the OSCE was seeking to remain in step with modern-day challenges. Cyber security as a theme also showed continued relevance of the OSCE's signature concern of "comprehensive security." The SYG hoped the workshop could explore what kind of comprehensive approach the OSCE could craft and how could it help participating States. He said that OSCE pS had been working to create a mandate to enhance cyber security by (1) combating terrorist use of the Internet (MC.DEC/3/04 and MC.DEC/7/06); (2) promoting public-private partnerships (MC.DEC/5/07); and (3) crafting a comprehensive OSCE approach to cyber security (FSC.DEC/10/08). ¶7. (SBU) The Estonian Minister of Defense Jaak Aaviksoo called cyber security an "essential and demanding" topic (FSC.DEL/42/09). He saw the OSCE as an ideal forum for this discussion given the need for "security and cooperation in Europe" on cyber security and also called it a "key forum" for discussing a "true 21st century challenge." Aaviksoo stressed the responsibility of pS to raise awareness and described the OSCE as a large intergovernmental organization with a significant role to play. He said a dual approach that would increase cooperation multilaterally and improve resilience on a national basis was needed. He also stressed the need for States to create the national legal framework necessary for a comprehensive cyber security program, and the need for national Computer Emergency Response Teams. More evenly regulated national cyber environments, he said, would contribute to a better governed international space. Aaviksoo also applauded the Council on Europe Convention on Cybercrime as a great framework for cooperation. The Czech Republic (Reinohlova) on behalf of the European Union said that cyber security was an "important precondition" for defending values. - - - - - - - - - - - - - - - - - - - Session 1: Threats to Cyber security - - - - - - - - - - - - - - - - - - - ¶8. (SBU) The first session addressed attributes and common forms of cyber attacks, cyber crime, defensive strategies for threat mitigation, and consequence management and remediation. Keynote speakers were Captain H.N. Dionisis Antonopolous, Director Cyber Defense Directorate, Hellenic National Defense General Staff; Vladislav Sherstyuk, Deputy Secretary of the Security Council of the Russian Federation; Michele Markoff, Acting Director, Office of Cyber Affairs, Department of State; and Rytis Rainys, Head of Network and Information Security Division of Lithuania. The panel was moderated by Raphael Perl from the Office of the OSCE Secretary General, Action Against Terrorism Unit. - - - - - - - - - - - - - USOSCE 00000064 003 OF 007 Don't Forget the End-User - - - - - - - - - - - - - ¶9. (SBU) Antonopolous' presentation, The Key to an Effective Cyber Defense Strategy, focused on the human factor in cyber security (FSC.DEL/38/09). Due to the nature of cyber attacks the end-user often becomes an unknowing victim. He said that most public and private entities provide high level training for cyber security personnel, but it can never be enough. He stressed that the common end-user has been left out and more education for individuals, who use computers daily at home and work, was needed. - - - - - - - - - - - - - - - - - - - - - Russians Claim New Arms Race Unfolding - - - - - - - - - - - - - - - - - - - - - ¶10. (SBU) Sherstyuk's presentation, Problems of Ensuring International Information Security, made attempts to assert that an "information arms race" was unfolding internationally (FSC.DEL/22/09). He stressed the need for collective action to prevent the "next round of an arms race," claiming that 120 nations had "departments" dealing with cyber warfare. Sherstyuk also believed that it was especially important to draw up a universal document under international law that acknowledged the existence of political-military and criminal threats, including terrorism, to "international information security." He proposed the publication of a dictionary of terms "used in the international information security field." Sherstyuk also mentioned that an international conference on cybercrime jointly sponsored by Russia and Germany would take place on April 18 in Germany. - - - - - - - - - - - U.S. Focus on Defense - - - - - - - - - - - ¶11. (SBU) Markoff's presentation, U.S. Views on National and International Approaches to Information Network Security, focused on securing networks through layered defenses that are effective whatever the source of the attack (FSC.DEL/40/09/Rev.1). Markoff explained that a national review of cyber policy currently was being conducted in Washington and without prejudging the outcome said that the U.S. will continue actively to pursue international collaboration on cyber security in bilateral, multilateral, and international venues. The U.S. would also continue to offer its detailed views of those steps that states, individually and collectively, need to take to enhance cyber security. ¶12. (SBU) Markoff said that cyber security was not inherently political-military in nature, just as information technology is neither inherently civil nor military. Therefore, cyber security was a shared responsibility of government, industry, and individual citizens. Markoff demonstrated that the Russian rep's call for an arms control-like convention that would ban the development or use of a wide range of information technologies was not helpful or effective in addressing the security threats associated with this technology. It also was most likely unenforceable. - - - - - - - - - - - - - - - - - - - - - Lithuania: "Think Globally, Act Locally" - - - - - - - - - - - - - - - - - - - - - ¶13. (SBU) Rainys' presentation, Overview of Cyber-related Security Incidents in 2008, stressed that cyber attacks were becoming massive and well-organized. He stated that most cyber attacks were motivated by financial gain. His message USOSCE 00000064 004 OF 007 was to "think globally, act locally." Rainys said that if each nation could implement an incident management system that would keep its local network as clean as possible, this would, in turn, enhance the security of global networks. Rainys stressed that defensive activities were key. He said that incident management work by CERT groups should be enhanced, technical solutions that could be implemented by network providers would lead to better protection of end-users, and wider cooperation and coordination were important. - - - - - - - - - - - - - Self-Survey As First Step - - - - - - - - - - - - - ¶14. (SBU) In response to questions posed by the audience, Markoff suggested that the OSCE first set up a "self-survey" in order to know the gaps and capacities among OSCE pS. Then, Markoff said, the OSCE could design a program where the first steps would be to develop confidence and trust. She also indicated that this could include identifying points of contact for the first responders of member States. Finland (Kangaste) agreed that cyber security posed challenges to all stakeholders and supported defensive measures as the most concrete way for dealing with cyber attacks. He called the Council of Europe Convention on Cyber Crime "groundbreaking." He also echoed the U.S. (Markoff) point about the need to build a "culture of cyber security" as well as the U.S. recommendation for a self-survey. Kangaste said it was important to ensure that the rules of international humanitarian law apply and said that Sweden, Switzerland, and Finland have an ongoing joint study to define what this means for cyber space. - - - - - - - - - - - - - - - - - - - - U.S. Upholds Principles of Free Speech - - - - - - - - - - - - - - - - - - - - ¶15. (SBU) Cyprus agreed with Rainys, statement, "think globally, act locally," but reordered the priority to acting locally and collaborating internationally. The Cyprus rep stressed the need for a well-defined plan and said "perfect planning prevents pathetic performance." Azerbaijan (Jafarova) noted that networks should not be used for "racism, terrorism, or other phobias, such as Islamaphobia." Jafarova spoke about the potential for a state to develop propaganda against another state and said that Azerbaijan had found websites that challenged its territorial integrity and sovereignty. The U.S. (Markoff) responded that while we may witness speech that is hostile and political on the internet, it remains the U.S. position that one's view of illegitimate speech is another's legitimate political expression. In upholding the right of free speech, Markoff cautioned against "regulating content8 and stressed the importance of maintaining the principles of the Universal Declaration of Human Rights. - - - - - - - - - - - - - - - - - - - - - - - Russia Says It's Misunderstood; Quotes Castro - - - - - - - - - - - - - - - - - - - - - - - ¶16. (SBU) Georgia (Kvanchakhadze) recalled the "most serious attack against (their) infrastructure" in August 2008 and questioned who would be the main international body to fight state sponsored attacks. The U.S. (Markoff) stressed that the unique attributes of this technology made the problem of acting against perceived perpetrators very difficult and that a better understanding of the technical issues in the international environment was essential before strategizing further. Russia (Krutskikh) alleged that there was a problem USOSCE 00000064 005 OF 007 understanding each other because cyber terms had not been defined. He then said Russia was misunderstood as pushing for "disarmament." Krutskikh said we should use the experience we have already acquired but we should be sure we were targeting the right problems, such as crime, terrorism, and armed attack. He quoted Fidel Castro, who said "if you devise an imaginary enemy, you ignore the real enemy that exists." ¶17. (SBU) Antonopolous tried to clarify that cyber meant the "space where we are when we are talking on the phone." In other words, it is "the non-visual space where you can apply visual actions." The U.S. (Markoff) responded that Krutskikh's comments seemed to imply a change in the Russian position that has held for several years that an arms control race in unfolding. Markoff said that the Russian position had been to establish boundaries of sovereignty in cyber space, but if that had changed, the U.S. would welcome hearing more details. - - - - - - - - - - - - - - - Session 2: Government Options - - - - - - - - - - - - - - - ¶18. (U) The second session addressed national and international good practices and legal frameworks and their use to develop policy options for governments. Michele Markoff was the moderator. Keynote speakers included John Denning, Director for External Affairs in the Office of Cyber security and Communications, Department of Homeland Security; Patrick Pailloux, Director of Information Security, French General-Secretariat for National Defense; and, Andrea Servida, Directorate General Information Society of the European Commission. - - - - - - - - - - - - - - - - - - - U.S. Describes Cybersecurity Culture - - - - - - - - - - - - - - - - - - - ¶19. (SBU) Denning (Department of Homeland Security) called for the construction of a culture of cyber security based on shared responsibility (FSC.DEL/44/09/Add.1). Denning described the key elements of a viable cyber security program as: development of national strategy; collaboration between national governments and industry; deterrence of cybercrime; creation of national incident management capabilities; and promotion of a national culture of cyber security. ¶20. (SBU) Denning said governments must provide an example of good cyber security practices in their outreach to the private sector. He noted that government efforts are inherently multi-agency and, in the U.S., include federal, state, and local officials. His own agency, Homeland Security, had developed a National Infrastructure Protection Plan that relied on close relationships between the government and key sectors of the critical infrastructure. Inculcating cyber security awareness in all parts of the society will require constant awareness raising and education. - - - - - - - - - - - - - French National Responses - - - - - - - - - - - - - ¶21. (SBU) Pailloux said that much thinking in the French government on cyber security was captured in its recent white paper on defense (FSC.DEL/45/09). France, noting the 2007 attack on Estonia, estimates a high probability of cyber attack as the technology required is readily available to many and can be employed with minimal risk to the attacker. He noted that critical infrastructures worldwide increasingly USOSCE 00000064 006 OF 007 depend on information technology for effective functioning, increasing the risk cyber attacks could seriously impede delivery of vital services to citizens. Pailloux praised the FSC workshop as a necessary effort to raise awareness of the threats to cyber security. Also needed was international agreement on a minimum level of rules and good practices that system operaters need to follow. He also stressed that security requirements should not hamper innovation and rapid technology development in the IT industry, and said that international cooperation is essential to deter and prosecute cybercrime. He said that the EU must take steps to protect its critical information infrastructure, as it protects its other critical infrastructures. The French government CERT, which Pailloux heads, was able to close down over 2,000 phishing sites with the help of its international partners. - - - - - - - - - - - EU Policy Initiatives - - - - - - - - - - - ¶22. (SBU) Andrea Servida described ongoing EU efforts to enhance cyber security in the EU's Member States and institutions. While EU executive agencies like the European Network and Information Security Agency are raising awareness and fostering dialogue with industry, there was also a need for greater public participation in shaping an enhanced European policy on network and information security. The Commission launched an on-line public consultation in 2008 to which academics, industry experts, and private citizens have contributed. ¶23. (SBU) Noting the increasing number and severity of cyber attacks and their costs to national and regional economies, Servida said the Commission had several policy initiatives designed to ensure the protection and survival of European Critical Information Infrastructure. These would be based on both government and private sector programs and would protect against all threats. Next steps include an informal ministerial meeting on critical information infrastructure protection (CIIP) in Tallinn in late April. He noted that while there are 150 CERTs in the EU, only 15 are national-level, of which seven have standard operating language to communicate with each other. ¶24. (SBU) Italy (Somma),in response, described briefly its MOD cyber defense organization and highlights of a recent cyber exercise ("CYBER SHOT") that involved all the military services, including the Carabinieri or national police, and representatives of civilian government agencies and critical information infrastructure. Somma spoke of the importance of setting up a clear command structure for dealing with incidents as they occur, and situational awareness of the state of network defenses. Another exercise is planned in November in conjunction with a NATO cyber event. The Arab League (Wehbe) said it was taking steps to follow UN measures. Wehbe pointed out that the Arab countries were trying to combat terrorist use of the internet while maintaining respect for human rights. - - - - - - - - - - - - - - - - - - - - - Meridian Process: Connecting Policymakers - - - - - - - - - - - - - - - - - - - - - ¶25. (SBU) The UK (Burnett) described the Meridian Process, which began in 2005 with the support of the EU and G8 for policymakers involved in CIIP. Burnett noted that the Meridian Process is an annual conference, with a rotating presidency, open to any country that wants to join. It had been deemed successful by participants. The presidency was held by the UK (2005),Hungary (2006),Sweden (2007), USOSCE 00000064 007 OF 007 Singapore (2008),this year (November) by the U.S., and in 2010 by Taiwan. The theme of Meridian is "connecting and protecting," and identify points of contacts between participants. Burnett stressed the conference was meant for policymakers, not CERT professionals or technical experts. ¶26. (U) This cable has been cleared by INR/CCT Markoff; OSD/NII; and, OSD/P. NEIGHBOUR