Let me introduce very briefly I'll speak to Graham. In fact, I'm sure everyone is saying to you that he is a former member of the British Army.
He did a lot of work on what I consider to be some rock decent, hard aspects of soldiering.
But he's reinvented himself. And I'm pleased to say that as he nears the completion of his doctorate here at Oxford,
he has transformed from the military mindset, if you like, in some of these,
I think quite deeply about carefully about some issues which are controversial in the very least on not just cyber security,
that quite semantic phrase that seems to sanitise the problem.
It's looking at things like offensive cyber, which is a much more worrying kind of issue for us to sort of contend with.
And Graham, soldiering on has taken this on full forward holds, if you like, say I'm going to tackle this head on, is nearing completion.
And he will explain to you, I'm sure, what he wishes to derive from the session, because this is a two way process, not a lecture, it's a seminar.
We have an option to have things input into the final completed stages of his doctrines conducting.
Graham very much do and I quite I had to follow that whether that sort of means that
my army career was pretty inconsequential as opposed to what I'm doing my life.
I know what I want to talk about today really is one of the central parts of my defence
or my day for really what I wanted to look at was how the states operationalise
their national cybersecurity strategies and what does that mean for the way that
states that act in cyberspace and the diplomatic and at the strategic level,
I think and within that is really one of the other drivers.
Was the emergence over the last five years or so of offensive cyber as a policy toward a state so increasingly
willing or stating that they are willing to use in order to achieve not only that aims in cyberspace,
but their wider national security agendas and intense.
So what am I going to do? And really it also comes from the existing literature in this space,
and that was the good body of cybersecurity literature sort of move from a
bookshelf in black clothes and small bookshelves acquired for almost monthly.
A lot of it are looks very much at strategic theoretical thinking or down in the
tactical weeds of doing what I wanted to try and look at was that space in the middle
of how policy that is stated and put forward by governments and states is actually
turned into effects on the ground of which there isn't very much out there.
There is some work from OECD, there's some work NAITO has done, there is some global forum on cyber expertise is doing in this area,
but most of that is actually wrapped up in the context of of capacity building as opposed to putting policy into action.
The other thing I wanted to do really,
and why the UK's approach is unashamedly I don't mind Black Book that I do call it is the use military to conduct a set of
interviews across the UK cyber security domain and to look at how the UK's approach has approach has changed over the years and how,
as you see I suggest that it is fundamentally different was when they released 2015 strategy for what other states were doing enough the introduction.
What am I going to talk about? I'm going to give you a short little bit on the framework.
I think this is important to place into perspective and context the model that we will discuss later.
My assumptions how I see the strategic cyber ecosystem, UK cyber strategy, some models, some case studies and I'll talk to case studies in particular,
and then some conclusions from you as the audience, what was said sort of sort of what the involvement.
I know many of you will, but I'm very much looking to critique and flaws in what I'm presenting as opposed to saying it's a perfect piece of work.
And here's what dphil, which is the analytical framework I think I take as my starting position conflict really.
And the idea of we are in some sort of revolution in scientific thinking, that we now live in a time we sort of still see that our old models,
our security models that the state has employed over centuries is no longer fit for purpose and security model based very much physical actions,
physical threats and actors who are only empowered to do damage to states at a state level.
I'm suggesting that we live in a world of new threats, new actors.
They have new bases of powers through technology which allows them to move around from way.
And actually the model that we have of national security only answers some of the questions
and some of the challenges in terms of building my model and how to operationalise it,
I believe I borrow from ecological theory and use the analogy to operationalise it
and really three main things zones and I'll explain these in more detail shortly.
Flows and feedback loops and emergent principles in terms of my data, asset evolutions,
views and then document analysis and really in terms of trying to tie them together.
I very much apply a fact based thinking. My focus is on outputs.
It's not the inputs, it's not the technology. And that's even the policy that drives it.
It's what is the effect on the output that is created.
I'm one of these very busy slides, really sort have been to sort of just got four posts and put too many words on it.
Cybersecurity for me is simply a competition for advantage between agents that occurs in cyberspace,
and it's important to strategic level because it destabilises a state's national security balance.
And it's important to see this in the context of national security.
It is not something separate or unique. Massive cyber security strategies seek to redress that balance.
And they do that. And by the sort of phrase in the UK strategy in terms of achieving security and stability in cyberspace.
One of the things I suggest involves for from ecological theory, though, is that security and stability is not a point.
It's not a definitive value or definitive position.
It's a zone that I call zones of cyber security.
And really, you can look at it from a counterfactual point and say that these zones are not necessary areas of security or stability.
They are acceptable spaces of insecurity. They are that space in which the state itself and its population will accept level
of risk of these things achieved and maintained from positive feedback negatively.
Of Diagrammatic we explain that cyber security agents act as if you like.
I use the word agents because that's what this new ecological theory that I operate in cyber domains of influence.
What I'm trying to get across here is that all the time they are operating within the side of the main.
They are doing so with a frame of mind and a frame of reference that is based upon their card intent and the context in which they operate.
And this is fluid and it changes to a CDI.
A cyber domain of influence to the United States in terms of its relationships with Russia is very different
in terms of the actors have lacked in its power to seek to achieve effect than it is with the law.
And you can take that down to any level.
And then the final point really I'm also following from because the theory I draw out of the model, my findings,
what are known as emergent principles and emergent principles really are effects
that are created by the interactions of agents within the model with not obvious.
When you just look at how the agents say all of that and I throughout the day.
Two diagrams on top. One really is how I see the stop the cyber ecosystem at the strategic level.
What we are familiar with in a lot of the literature is we just see the diagram on the left and
you will see people say this is a criminal ecosystem which will talk about the access within it.
It will be and it's a descriptive tool. What I'm suggesting is that actually there's two elements this ecosystem.
There is the state, the national cybersecurity system in my work, and there is the malicious actors cyber domain of interest.
And actually, these two are in constant a state of constant independence between them, and they are in a state of constant competition.
Affects come from the state in the form of security and stability, and they come from this domain of interest in terms of threat and opportunity.
Of course, the malicious actor in this case actually doesn't need to be a malicious actors to make.
It could be any domain that has a cyber purpose or function, offers both threat and opportunity,
and it is as important to recognise opportunities as anything else.
Just to shorten on the zones of security. This is a very traditional view of how what violence looks like in ecosystems and ecology.
And really the idea is that violence or the violence that is enough to keep the system stable and secure exists in
this space here and events we're in it move up or down on the external events as well as depicted by the allies.
And effectively what happens is you affect the movement here, move it back to 2 to 2, that state of violence.
And if the external effects of is an internal effect that is generated, is a significant power effect on a catastrophic a cyber Pearl Harbour,
perhaps it may even change totally where the point of violence is by moving it up to a new state of equilibrium.
Really, that is that is how I conceptualise the model and how it sets in, how I make it work within that framework.
I'll let you read the proposition. What's interesting, I think, is you look at the dates of these this is not new offensive.
Cyber was being talked about in 2011. In fact, it's first use that I can find in terms of policy material was before then was in 1992.
And interestingly enough, there is also a paper that was written in 1970 or Hansol document in 1970 that refers to the fight of computers
and data protection and talks about the CIA's activities in terms of manipulating data and manipulating machines.
It describes as them feeding data into what was nothing more than a kitchen blender.
It's interesting to see how it was viewed at that time in 1971.
And actually the problems are discussed in that work.
Are they still valid? But what I've tried to show by these quotes is a progression.
2011 2013 Osborne's made a sort of very famous speech at his HQ in 2015 and bringing this up to date.
And he tries to do. So let me put some context in trying to prove my proposition.
Traditionally, the UK's approach to looking at a cyber security issue has not been from a national security perspective.
It was driven from the economic prosperity debate,
and this rise came out of Britain's initiatives to deal with the digital economy and
trying to make the UK the leading states in terms of exploiting new technology.
And really it was only in the early 2000. But we 2003 and from the literature in Hansard and also from several of my interviewees,
what really sparked the UK into moving into how the security perspective, the national security perspective was Titan ranked Titan right,
which was an attack that's accredited to the Chinese elements of play,
which is believed to be an espionage attack that certainly was going on in 2003 and widely reported in 2005.
And there were some indications that some of the methods and tools we use then are still actually being used now.
But Tighten Rein was a factor for the UK to change its approach.
And the second one really looks at how it framed it.
Early days, it was all about information security.
It's about framing the machine machine in simple terms, then to threat information assurance, really protecting data.
And then cyber security. And then it's interesting when you look at looks can go back to look at what was being protected because it was focusing.
The government looked at this very widely. Actually, the early years it was about government and about key critical national infrastructure.
Really, that was military intelligence and power in this period have moved really to CNI much more broadly.
And there were another number of initiatives with that.
Until now we get to stage a position where to go on. It's all that government saying I and society, it's about us.
As much as it's about the national infrastructure governance approach to early days,
the government will support that by giving advice and guidance if needed to act, and it would support that need to act.
Didn't do very much in the 2009 cyber security strategy, the one that's always forgotten.
Whenever people talk about the UK, the number of strategies it's had was all of that time forget.
Prepare the ground for the need to act and recognise that something needs to be done.
The 2011 strategy, really the decision was taken in the 911 period that actually the best way to achieve
this was threatening to delay or taking another view that was expressed to me.
It was because there was no money to do anything else apart from the industry.
So the market led and I think probably many of you who read the material now will know that that was not seen as a successful way of doing business.
And the 2015 strategy talks about it in many things in a number of places,
but actually recognises that government has to intervene and it has to intervene in a hallway.
So that's the context for it.
And I think that's important to try to understand how we got to where we are today and how is cybersecurity done across those charts?
Really, this starts to introduce one model which doesn't seem to have survived contact with moving from Mac to Windows.
These are two iterations of one model. No one model really talks about is how I'd find these as effects spaces.
Those faces are defined by the nature of the facts that take place within them
and on the right hand model to use three effects places passive cyber defence,
active cyber defence and defensive side.
And I define these in terms of the nature of the effect, well, that's a hard effect or a soft power effect being very deliberate,
very focussed, usually very short term, a soft effect kind of fun tends to be continuous and widespread.
And then really in terms of is indirect or direct in terms of the adversary, if it's direct,
it's probably hitting the adversary very hard in a physical sense, taking out of their systems, maybe destroying one of their systems.
If it's indirect, they may be educating all of us to recognise that actually some of these paths steal our passwords.
And the two lines really that the one that we just read to you how I define these terms.
First all probably. So I define, first of all, passive,
cyber passive cyber defence as being lawful and critically non cyber effects that are delivered within the state actors cyber domain of influence.
So he's delivering that effect with effects of those effects within his own cyber space.
And they range really from educational talks about standardisation regulation to collaboration,
setting up networks of working and international allies in that active cyber defence.
And I am defining this in a UK sense, not in the American sense,
relates to lawful cyber threats that are delivered within an actors zone, CDI through to get direct engagement with the adversary.
What I'm talking about here is technical, primarily technical activities that engage with the actions of the adversary.
Once again, within the stateside domain.
So DNS blocking the blocking of websites, for example, the blocking of email traffic into your own side of the mind.
I would caution that an effectively in terms of the Pentagon offensive cyber is I
defined as lawful cyber facts delivered within an adversaries cyber domain of interest.
So I am defining this as much upon the geography in terms of whose domain of interest they occur and as as the effects itself.
What I'm suggesting is that until probably 2015, the model that comes out is looking at national cyber security strategies and literature is this one.
And I've read out when I actually did my research into this, there were 81 different national cybersecurity strategies issued,
and I got 75 of the ones that were in English or had English equivalents.
And my getting through them,
that is effectively a model and that is that the key to this is the technical engagement answer to moving from nothing to cyber to do cyber.
And this is the domain. What you also discover there when you look back and you go back beyond cyber
security strategies and develop really from an idea from the 1990s onwards,
there was a parallel system and somebody is in the room. This will be familiar.
And this was going on not in the open space, which is where this model sits, but in the private spaces, secret space.
This is what intelligence agencies and national security agencies know with the large letters of the founder that had been there and they
had been conducting operations in cyberspace through these three expected spaces computer network defence defending their own systems,
computer network attack, getting rid of the adversary systems, putting it crudely,
and computer network exploitation, exploiting what is on the adversary systems.
And I think really until probably 2015, that is what that is.
That is the state of play in terms of how you can model national cyber security strategies.
What I'm saying is when the Brits, when the UK released its 2015 strategy, it actually from next year.
I have not seen this stated as such publicly stated by two or three people I interviewed.
This is the model they created. They interjected in that model a fourth effect space counter cyber.
And really what this allows them to do is to cooperate and conduct all those great activities that we see
associated in offensive in an offensive side of the main outside of conflict and what they want to see.
And here it does really is it separates offensive cyber that is done in peacetime from offensive cyber that is done in wartime.
What that means is it's done under a totally different set of rules, regulations and legislation.
Activities in this area here now governed by the law of armed conflict, Geneva Convention, and other policies related to the fighting wars.
This is all about legislation that is to do with law enforcement and crime, anti-crime and protecting the state.
Now the two effect spaces stay the same. They have, of course developed, but that I think is the model that the UK put forward in 2015.
It is very much the model Australians have just released in their latest national cyber security strategy.
It is the model that I think New Zealanders will put out and I also believe it's a model that the Americans will develop and take forward.
And I'm I'm close to where we are with the US cyber security strategy in terms of whether it's been agreed or whatever.
And it also reflects the French model and to some extent the German model as well as developing it.
So how do I operationalise it and I'll make a few points here, really.
When states undertake their cybersecurity strategies and avoid issuing some framework,
which is how they put it in some discussions we had on this, it's through campaigns at the strategic level.
States achieve their intent in cyberspace through a series of effects, not just one effect.
These campaigns are constructed through the delivery of cyber security effects themselves.
But like cyber domains of interest, these campaigns are unique.
Every one is different, and they themselves are driven,
driven by the intent in the context of the state and the domain in which they're being played into,
and the effects flow between the states and adversaries.
So the main of interest continuously, as we said.
I was talking to Rob before. Before we came in, I sort of had a hope when lacerated last week and the doctrine trying to pull this together.
And it's it's these effects this taxonomy comes from national cyber security strategies.
It comes from policy documents, primarily in English and almost exclusively as in English.
I think maybe I could read the Spanish, but apart from that, and it also comes from reporting on actual cyber events.
So what I've tried to do is analyse all these three, three sources and say, okay,
when you boil it down in each of my four effect spaces, what do they actually seem to achieve?
And in some of them and many of them, you'll see I end up with second order effects that are duplicated.
The point I want to make, though, is that what's duplicated in terms of the effect that they achieve,
the means and the methods to do it are very different. So the means in the methods effect to detect in an offensive cyber posture, hacking in,
hard hacking in and detecting in a passive cyber defence situation where it may
well be when you in a user to recognise something is wrong are very different.
But the overall effect, the final effect, the final output and seeking to achieve is the same.
So this is how it tried to graphically. Operationalise my model and share the flow.
I also use this diagram to explain the model and also just to talk about timeframes, because I think that's also something as well.
So you have a cybersecurity strategy here which moves into a cyber domain of interest for the state.
As I say, let's take for this example some malicious laptop. What the state is trying to do, its full effect spaces.
So on change, what is happening in that cyber domain of interest.
So once again achieves its own security.
It's stable and secure. And of course, that then feeds back to a feedback loop into its cybersecurity strategy and subsequent policy.
Really what I'm saying is that for parts of cyber defence,
it's continuous and it's delivered at scale, educating people about the threats and the challenges.
It's something that is ongoing and it's wide in many ways, although in a technical space as opposed to to the non cyber space,
active cyber defence in terms of the UK's active cyber defence program meets that requirement as well.
Whereas both of these on the offensive side, so operating and when you're operating in the adversaries domain of interest,
either short term and focussed, they are undertaken to deliver a specific effect.
But what asylum signs show with this model is that it has all these effects operating in a domain that lead to the re-establishment of security.
So I take two examples. I take this cyber campaign primarily because it's interesting that it covers the
full spectrum from passive cyber defence all the way through to offensive cyber.
Don't worry too much about whether that is complete in terms of all the actors.
Agents should be in that.
But what I'm trying to show with that, that it is not just one part, it's not just government agents, but involve in terms of the UK, state CBI.
And this is how the UK Government see the cyber domain in which they are operating in that conflict with banks.
And this is a nation's cyber domain of interest,
and that's how they see the cyber domain that they are operating in, in terms of trying to cause an effect here.
I think that sums up and starts to illustrate how these are different perspectives.
In terms of the model and how it's put together with this in terms of context, really in terms of effects,
the operational effects, the offensive side effects, you can look at it from the next slide.
So putting this into the next slide, I'm really looking at the material that's available.
You can see these effects being played out so in the offensive space and perhaps typified most of all by the take down of the UK National in 2015.
Janine, who sound known by threat by American by American munitions in Iraq, really typifies where you can go in this space.
And in order to do that, the information would suggest that there was a lot of detection carried out on bases, networks.
They were the.
There was collection of data undertaken on stations, networks set up was contributing to when you take them out at the other end of the scale,
you have the work done by the counter extremist organisations within the UK.
And in many ways this passive cyber defence piece which will relax mitigating is influence operations.
That was about first of all, regulating it,
putting some laws to Parliament in terms of what is meant by what was meant at the time, what propaganda and how that could be met.
Educating, educating schools, educating them that to get people to recognise that you do something about it,
collaborating with the public and private sector influence in the international domain to do something about it and,
and an act and partnership with, with international allies in terms of delivering an outcome.
In this space.
It was all about disrupting the flow of propaganda and messaging to sympathisers in the UK, doing it by blocking by legal removing of websites,
for example, going down, going to a website supplier, hosting supplier and saying this this website is hosting propaganda.
Please take it down, influencing again and in all of these was sort of influencing the international community's influence.
Actually influencing is also being played back to Daesh.
It's showing Daesh that actually operating within the UK sort of of interest is
difficult and challenging and perhaps you might want to go do it somewhere else.
On a of cynically that ties in with comments that and this has been in the press in the last weeks.
You say that you made the comment that actually one of the fundamental pillars of UK
strategy is to make the UK a hard target outside of the main routes are still operating.
So we have to take this somewhere else and that's in place that's planning for in fact,
my second example really is now getting totally out of of that sort of military space,
getting out of that conflict space and getting out of the threat space in terms of physical threat.
And really this is about how the UK is looking at protecting its brand, which brings a unique set of challenges to it.
In some ways the same actors, but they play different roles and they have different importance within that.
I've used cyber crime just to tie it down to a particular subject matter of interest.
You could move it. Why in that?
And this one though, of course, I'd put the international judicial system in that because actually cybercriminal less so concerned about it.
And we've put his operations in areas where perhaps there is not the judicial oversight and control,
but fundamentally, once again, it's all about delivering effect from here to here to mitigate that.
These ones these are the effects that I have identified by looking at how it's done from the material.
At least you will notice nothing in here.
I would suggest in this situation that we are not in a state of war with any cyber criminal group,
even some of the AP teams that are often noted as operating in this space.
But effectively it's all of our hands of cyber.
So one of the other case studies that I narrowed down is the takedown in 2015 of the Avalanche Criminal Network,
which was responsible for the distribution, I think of 17 very profitable streams of malware on a global basis.
And that was that within the counter cyber space that was taken down by a group of 30 different nations operating through Europol and coordinated.
And that quite clearly involved a lot of operating on the avalanche networks,
own networks within their own cyber domain for intelligence purposes to degrade their capabilities.
I think in one of the US court hearing that that actually as well I got a lot of my information from the avalanche.
They signed off on literally destroying some of their servers and because they that was more effective in trying to save them.
But once again, some say that all of these the force three spaces in this case play a role.
And let's talk about emergent properties.
And really, I've shown you two case studies of the models in action and how it works.
What can you say? Are they in terms of what comes out of it, the properties that you can identify with, the agents working together?
I think Agent Duality and I mean that in terms of some of the agents of both providers of security and targets,
the state obviously for a lot of the private sector fits in for that.
The main telecommunications companies, for example, are frequently targets, but also they all play a very important role in the protection.
Beat, for example, is a very strong pillar of the UK's active cyber defence program and also has established
relationships with Interpol in terms of working partnerships and collaboration,
which shows an interesting dynamic in terms of the private sector and its relationship to such an organisation.
I think I would suggest in the model of what I've taken out of, it really is something that.
Centralised direction, but multi-agency delivery. You're not.
This is not about one agent. It's not even a group of agents per say.
It's multi-agent delivery across a number of spaces.
I think there's collective interdependence.
What I'm trying to get across with that is that the facts delivered through one or my four experts places have consequences elsewhere.
They do not just go across and read directly across the great from themselves second and third order consequences.
Integrated intervention is really getting to the fact that this is a campaign.
I think between the campaigns, unity on the effects basis reinforce the action.
I think it's quite obvious in terms of fact that effects must be delivered to reinforce other effects on a continuous basis.
The balance is dynamic in that the balance itself satisfied their design and security is not static.
It changes and changes in terms of the effects of appropriate in the cyber domains of interest.
And it also changes as the intense in the context of the next agent change dynamic evolution.
It's the whole of the model is constantly evolving and also it's a rather crude one really.
I'm trying to get support that local action, that very specific actions can have truly global effects in the space.
Why it is important is because I think they then provide you a framework place for developing cybersecurity strategies.
One of the things is I think this work is scalable. It also gives you a framework to judge cybersecurity strategies, not based upon input output.
So that's that's that's the UK model. What did the UK actually do?
You can read these, I think the self-explanatory many ways.
The first one is all about bringing together the public and the secret remains.
When I was interviewing people,
it was of interest and lots of people talked about good things going on in open cyberspace and bad things going on in the secret state in cyberspace,
including sort of a number who had worked within within the secret state.
This is all about focus and focus and strategy, which is a problem that other states have got.
The US has got it.
Interestingly enough, Australia is taking a line following in some ways the interest C model and providing focus to a single actor agent.
And I think this is really important. The UK government made a decision for the ownership of the problems in one space.
Okay. So it was not spread between agencies who would act that same role, but they would do so a sort of with guidance.
In real terms.
I'm said that many of these will make the fight between the two traditional national strategy models on integrated offensive cyber as a policy option.
Offensive cyber in terms of using the capabilities that that space offers to deliver.
It was enabled by the establishment DNC.
It was formalised in the 2016 strategy.
What are my conclusions? I think the UK did do something different and this loss of security strategy and I think the saying
that in the way that debates are going on in other parliaments about should they follow the model?
I think it represents a much more realistic description of what is actually going on in the cyber security world.
From a strategic and operational level perspective. I think the model is applicable to different cybersecurity challenges and theoretical models.
Interesting. If I'm using my model to actually write a cyber campaign as an anniversary for some work that I'm doing.
Nathan I want to play right the cyber attack,
but I'm going to use the model and work out how that model allows you to create physical virtual cognitive effects through different effects spaces.
And importantly, for me,
I think one of the things I wanted to do something that may or may not act as an analytical tool to support policy and planning process.
I want what I do to be meaningful and hopefully not set in motion.
And that's it. Thank you, Chris. Thank you very much.