PassWord – 24th February 2016

Speaker A: Hello and welcome to Password on Resonance FM in the station’s fundraising month. There’s a range of goodies, books and experiences from the world of the high-tech and art available as part of an auction to help support the station that The Independent called a glorious experiment that everyone in the country deserves to hear. And of course they can, because Resonance FM is available via the web and via DAB, but all of that costs money. Money, which is why we are appealing to you to dig deep into your pockets to fund the station that the BBC says puts the BBC and its vast budgets to shame. Now, we have a packed programme this week. Chi Onwura, the Shadow Digital and Culture Minister, tells us what she is hoping for from Ofcom’s new digital strategy. Alfred de Zayas, appointed by the United Nations Human Rights Council to be its independent expert on the promotion of a democratic and equitable International Order tells us why the UK should accept the United Nations ruling on the unfair detention of Julian Assange. And we have an expert to tell us why we should be worried about the way that politicians in the US are using social media. And despite what the police say, crime is on the up. Cybercrime is hitting new highs as the criminals desert the high streets for the internet. If you’re wondering why, the answer would appear to be simple: there are very few police on the cyber street beat. One of the reasons for that is the crippling recruitment shortage in computer technology, which ironically is even hitting the criminals, who have shown themselves to be very good at recruitment according to research by the police themselves. But first, Ofcom is announcing its findings on what is needed for the digital age, and many are focusing in on whether this will mean that Openreach will be separated from BT., or whether BT needs to be broken up. But Chi-On Wuhrer, Labour’s Shadow Minister for Digital, Culture and Sports, tells us that we should be looking to our digital future. Here she is to tell us why.

Speaker B: Well, Ofcom’s publication is actually entitled the Review of Digital Connectivity. Indeed, I think it might be the strategic review. And as someone who helped write the last strategic review when I worked for Ofcom, 10 years ago now. Yeah, it is a very big, broad, and indeed complex review. It should be, which should be about what we have now, but also forward-looking for the next 5, 10 years to set our direction. And digital is so important to so many aspects of our lives now that I really hope it is going to be central setting out not a vision for where we need to be as well as how to get there and as well as dealing with the issues that we have today.

Speaker D: But I mean BT, in fairness I’ve spoken to them, one of the things that they’re saying is actually they’re quite well advanced in the provision of broadband and so that infrastructure for digital connectivity is sort of there.

Speaker A: They’re saying that some 85-95% of the country has broadband if they want it.

Speaker B: Well, I don’t want to comment directly on what BT says or the statistics they use. Indeed, everyone uses different statistics and figures. But the fact is that we do not have ubiquitous digital infrastructure. And equally importantly, we don’t have the plan, the roadmap to the sort of digital infrastructure. And I am talking super high-speed broadband and ultimately, I believe, fibre to the home that we need, that we need for our economic but also social and cultural future.

Speaker D: A lot of people, it’s claimed, they aren’t actually taking up superfast broadband. They don’t want superfast broadband.

Speaker A: A lot of businesses, it’s apparently available to them and they’re not actually investing in it.

Speaker B: Well, that’s really interesting. I remember sitting around, if you like, in Ofcom and trying to figure out why anybody would ever want more than 10 megabits, given that if you had a family of 5 and a movie was 2 megabits, why would you ever want more than 10? I mean, we see now that take-up is rising, but also the applications, you’ve got an average An average page on the web, I think we looked at, had 3 different video streams in it. So in terms of the demand over time, I’d be surprised if people argue about that. The issues around take-up now are very interesting, and I believe very much lay at the door of this government, because people don’t have the skills to use it often. They don’t always understand why it matters to them, and also they can’t necessarily afford it. I was recently at the launch of, I think it was the city, no it was London, the Greater London Broadband Connectivity Survey, where they found that in London, 30% of businesses have no web presence, and another 15% only have a web presence with their with their address on it. So yeah, we do need more education awareness and critical skills to equip our businesses and our citizens to be fully, to fully take advantage of the benefits that broadband brings.

Speaker D: So in a sense, what you’re saying is this isn’t about reacting to demand as and when it appears. What we have to do is future-proof our economy for the new information age?

Speaker B: What we expect of a government is to look forward, is to look ahead, not only now but in 5 and 10 years’ time. So yes, we need a digital vision and a plan to make sure that we have the skills, the infrastructure, and the competitive model that equips us for the future.

Speaker A: Labour’s shadow for digital culture and sport. Now, Julian Assange is one of the world’s most famous whistleblowers, and he’s still languishing in the Ecuadorian embassy for telling us about how governments really work. According to a human rights lawyer working for the UN, he did nothing wrong and was actually helping people by providing them with the information we should all be entitled to. Here’s Alfred Dziers on why Julian Assange’s imprisonment shames the UK.

Speaker E: The committee, or rather the working group, applied the International Covenant on Civil and Political Rights, and I think applied it correctly in determining that the situation in which Assange has been placed is certainly not voluntary, and There is an obligation under Article 14 of the Covenant on Civil and Political Rights to carry out investigations into whatever allegations of criminal behavior in an expeditious manner. Now, I’m not going to repeat the whole story. The narrative is in in the decision of the Working Group. What is important is that the Working Group conscientiously examined the submissions of the parties, like any court, and it did not agree with the line being argued by the British Foreign Office and by the Swedish government. So they had all of the information, they applied the Covenant on Civil and Political Rights, and I think that they quite correctly determined that there were violations of Articles 9, arbitrary detention, Article 12, freedom of movement, and Article 14, due process. Now, whether or not you agree with the argument, the rationale used by the members of the Working Group. You have to realize this is a body created by the Human Rights Council. This is a body that has many years of experience, is a respected body that has examined cases of arbitrary detention concerning the whole world. So if for once the United Kingdom and Sweden, or for that matter the United States and Germany or France, if, you know, countries from the Western world, countries that see themselves as at the vanguard of human rights, if for once they are being criticized, I think it’s necessary to accept the criticism in good faith and to give good example to the rest of the world. How can we expect that a country in Africa or in Asia or in Central Asia or in Latin America implement the rulings of the Working Group on Arbitrary Detention, for that matter the Working Group on Disappearances, for that matter the Working Group on Persons of African Descent, if the big countries do not implement them. So what I found particularly worrisome was the vigor, if not to say the viciousness, with which the media attacked the members of the working group and tried to discredit them, tried to take away from the credibility of the working group. Now, that doesn’t happen when those who are being criticized are Belarus or Russia or China. But now that those countries that are being criticized are the United Kingdom and Sweden, well, suddenly the working group is no good. So this kind of picking and choosing, what I call human rights à la carte, it’s something that really undermines the entire system. I mean, if we are all believers in human dignity, and believers in the importance of a monitoring system which the Human Rights Council provides, then we have to accept that on occasion we ourselves are going to be on the dock. We ourselves are going to be told, well, think it over. Maybe what you’re doing is not compatible. With your human rights treaty obligations.

Speaker F: And is that what the UN is going to do now? Is that the message that they should think it over, or are there any actions or initiatives that the UN could—

Speaker E: My High Commissioner, Prince Aziz, the High Commissioner for Human Rights, already last week on the Tuesday, he was on mission in Sri Lanka And he already said that the United Kingdom and Sweden should accept the ruling and should implement them. And they both can do it if they want to.

Speaker A: Human rights lawyer Alfred Dreyfus on Julian Assange. Edward Snowden, that other famous whistleblower of our times, warned us that that we were all under surveillance. The intelligence agencies were taking our data from the technology giants and watching us. Not really much of a surprise, but what a lot of people will find a surprise is that politicians in the US presidential elections are also doing exactly the same, buying up the records on what we are thinking on social media so they can fine-tune their messages in pursuit of the White House’s office. Professor Candice Hoak, another lawyer and an election expert from Cleveland University, explains why social media is now an essential part of US elections.

Speaker G: Well, in the US, what’s interesting is that the candidates are using it, the presidential candidates are using it in rather diverse ways, with some of them being rather late to social media. So if you look at the Democratic Party first, Bernie Sanders’ campaign, this insurgent campaign, which is very populist and he calls himself a Democratic Socialist, he’s had a very active social media campaign from the beginning. And their campaign is all over every type of social media with an almost nonstop barrage of information, points of view, ridicule of other candidates. Especially Hillary Clinton. But this is cartoons and comments so that if one is on social media, one ineluctably receives material from the Sanders campaign if you know anybody who’s even slightly related to it. The Hillary Clinton campaign was very late and not very competent and certainly not very broad in the way they were using it. But what Sanders did was to create a sort of bandwagon effect or a sense among particularly the younger electorate that if you were going to be engaged at all, you had to be a Bernie Sanders supporter. It was drowning out anyone else. And similarly, Trump supporters have been very, very effective in social media, and he himself tweets a great deal, as people know, sometimes rather irreverently and obnoxiously. But he is very engaging of the particularly terse form of social media, which is, you know, people scan the stuff very, very quickly, and he’s able to get the sound bites out. Many of the other candidates were not nearly as effective or tried to run the traditional non-social media approach where they were talking to people or sending out flyers or using traditional media like TV and radio, and they were not expending the time on social media, and it cost them.

Speaker D: It’s interesting, isn’t it, because one of the things that’s said about President Obama was that one of the reasons why he won his last campaign was because he was very good at this social media thing.

Speaker A: Do you think that—

Speaker D: That’s right.— that is the key though.

Speaker A: The key is in the terse message.

Speaker D: Is the key something to do with the personality you are and the ability to be able to deliver that through those 140 characters that Twitter unfortunately gives you?

Speaker G: You’re probably right. He was already— Obama was already an engaging personality and novel on numbers of levels. But he’s he started and his campaign started a social media orientation from the beginning. And he also was very big in another area that has become dominant as far as technological breakthroughs, and that is data aggregation about the electorate. So that campaigns in the US right now are buying information from data aggregators who themselves obtain information unlike in Europe where our online tracking is extraordinarily deep and pervasive. And then the information about individuals’ activities on the web including what they’re reading, what sites they’re visiting, what they’re buying, all of that sort of information. Is sometimes able to be aggregated with personal information about their ID, their address, and then also can be connected to their political record, their political party. And so this leads to a kind of data analysis that further leads to highly personalized targeted political ads over the, either through email or over the internet and other ways. And it is quite astounding how this rather broad-based, highly personalized, often individual assessments are generating pointed political—

Speaker A: Now, according to a global crime survey by the accountants PwC, cybercrime against businesses has seen a double-digit rise, and increasingly it’s been carried out by senior executives. Cyber expert Professor Andrew Jones, author of Global Information Warfare and the head of forensics at Hertfordshire University, says that we should not be too surprised by the findings.

Speaker I: I think it highlights some interesting aspects. Disconcerting, certainly, a double-digit rise is, as I say, disconcerting. And some of the issues that the report raises are quite startling.

Speaker J: So for instance, I mean, what do you find— what is it that you find startling? What is it that you find significant?

Speaker I: Well, the shift towards what they call the silver fraudster with— and they are attributing 18% of senior management. Now if this is a rise that is worrying for the future. The question is, is it an actual true rise of 18% or is it that organizations are becoming more aware and more conscious and are looking at their systems in greater detail and so detecting it more?

Speaker J: I mean, that’s the point, isn’t it? Because, you know, for a long time now we’ve been installing technology and organizations are getting better and better and better at using it, and a lot of them are actually beginning to put in place the systems that allow them to understand what is actually happening within their systems.

Speaker I: So that could be having an impact here. Yes, and the report doesn’t actually sort of go into how the figures were derived and what impact that sort of factor has had on them. The sad thing is the numbers are going up. It doesn’t matter which way you look at it, whether it’s the total percentage or the specific sections, and it’s going up more than it’s going up elsewhere. But again, is that because we’re becoming— organizations are becoming more aware and are reporting more?

Speaker J: And there’s also another point which is they say there’s been a huge rise in organizations reporting cybercrime. They could be doing that because they know that mandatory breach reporting is coming, and they say technology is driving almost every other area of economic crime as well. Well, in a sense, we’d expect that because we could be becoming more familiar with technology, so we’re getting better at committing crimes with it.

Speaker I: Yeah, it works both ways. Organizations, as you say, mandatory reporting I think is inevitable and not too far out and quite right, but as the new technologies are adopted they find ways to utilize it to their benefit.

Speaker J: I mean, it’s interesting, isn’t it, because there seems to be one group which is struggling, or which there is a perception from the people who were surveyed for this, which is struggling, which seems to be the police. A lot of these organizations say almost 60% have no confidence in UK law authorities dealing with cybercrime.

Speaker I: How do you feel about that?

Speaker J: Sad.

Speaker I: Sad that there is that perception. Are the police coping? The police are struggling with resources and manpower, in particular on the digital forensics and investigative side, because you need a special well-trained person to be able to undertake it. And there is a market shortage, whether it’s in law enforcement or outside law enforcement, and unfortunately industry pays better. So the police are always going to struggle even if they were given all the resources that they needed, which they are not at the moment. They would always struggle to maintain the level that’s needed.

Speaker J: Now, the final couple of, some other worrying things here. 30% of organizations say they have no cyber response plans. Do you think that that’s worrying?

Speaker I: That at this point with the adoption of technology over the period that we’ve been adopting it that organizations of any size do not have a plan because it’s a business killer. If you fail to restore your systems after an incident, whether it’s a cyberattack or whether it’s a natural disaster, your business is over. In real terms. So 31% of organizations basically have no future if they don’t get their finger out and move forward.

Speaker A: Professor Andrew Jones on the rise of cybercrime. Now, as he mentioned, there is a shortage of cyber talent that is affecting everyone, the cyber criminals included. According to research by the Met Police, And the National Crime Agency, the criminals are headhunting for talent, something that Ian Glover, the head of the UK’s Inspired2 organisation, which aims to encourage talent into the computer sciences, is worried about.

Speaker C: You’ll see that they go from gaming into cheats, and then they go from cheats into modifications. And to facilitate the modification, they start to use extraction tools. And they obtain those extraction tools from the internet, obviously, but also they then start to join some of the gaming and hacking forums.

Speaker A: Right. When you say extraction tools, what do you mean?

Speaker C: So you need to break down the code. So in other words, you need to, if you’re going to do a modification on the game, then you need to extract the code.

Speaker D: Yeah, so basically what they do is they get, they get the kids interested in, um, or they go on talking about cheats and things like that, and then they start saying, do you know you can do some other—

Speaker C: sorry, yeah, yeah, the children become interested. I think that’s, that’s what happens. And then they gradually migrate towards some of the forums where, where those tools and things are discussed, right? And what then happens is is that you’re marginally on the legal side. So at that point, if you are doing modifications to the game, in theory you’re breaking IPR law. In reality, the gaming companies aren’t doing very much about that. And so you’re already starting to move into, well, it’s okay to break code and it’s okay to extract stuff.

Speaker H: And that starts to socialize the idea that that’s an acceptable thing to do, right?

Speaker D: And so then what they’re doing is the, um, they’re looking for particular people, or in a sense it becomes a self-fulfilling system because those people who become the most interested in doing this start to gravitate quite naturally to other forums.

Speaker C: Yes. And if you look at what happens with the social interaction, it moves from a from a face-to-face physical element into a gaming element where they have a lot of international friends and friends from other places, into the hacking forum where we’re getting that extension to their social network and their social standing starts to increase. So what tends to happen is their social standing within their normal community starts to decrease starts to diminish and their social standing in their online presence starts to increase.

Speaker D: And so in a sense, it becomes cultural, doesn’t it? Because, you know, that’s the world they want to inhabit. It’s a bit like people who seem to get sucked into sort of drugs and things like that. They then start to see themselves as a unique group of people with a unique code of conduct, etc., etc., etc., and then they can start to explain away their behavior.

Speaker C: Yeah, and it starts with befriending. So you do befriend people on the social networks, and those people become very real to you. Now whether or not that’s a persona or a real person is often a debatable point, but that befriending starts in that area, and therefore they’re encouraged to be more participative, in those forums, and they’re congratulated and told how clever they are and all of those sorts of things that they probably aren’t getting within their, their physical world.

Speaker D: And so it’s also a socialization and erosion of morality, because what they’re being told is, or if this becomes an acceptable sort of behavior to do something, and they can’t see anything wrong in it, or, and Yes.

Speaker C: So that’s exactly what happens. So what happens is you gradually erode somebody’s view. And it’s exactly the same as if you’re grooming somebody for sex. You know, you gradually persuade them that it’s okay to stand in your wife’s front, in front of a video camera, and then you gradually move that process forward into a lot less inappropriate activity. And it’s the same thing. So you start off by saying, ‘Can you get some credentials in terms of sort of a target?’ That becomes a challenge. These people generally are really bright. They’re really nice people and they like challenges. You give them a few challenges and that again starts to socialize and make acceptable some of those activities. Then you start moving away from credentials to gathering information about either individuals or companies. And it’s a relatively easy thing to say that big business is bad or government is terrible, and if you start to befriend and you have those conversations on a forum, then that move into, yes, we’ll just get some credentials or we’ll gather some information about a specific company or a person, actually becomes quite an easy thing to persuade people to do.

Speaker A: Ian Glover of Inspired2 who is looking to encourage bright youngsters to reject the dark side of the web. You’ve been listening to Password on Resonance FM, and if you’ve just joined us, I’m afraid you’ve missed it, but we’ll be here again next week. Resonance FM’s fundraising spectacular is still going on, so if you log on to the Resonance website, then where you will be able to bid for an incredible range of items ranging records and art to tech that reflects the sheer diversity of the shows that Resonance FM brings to you. Password is a joint production between Future Intelligence and the Cybersecurity Research Institute. If you want to find out more about what we do, then log on to our website at www.futureintelligence.co.uk. Thanks for listening and goodbye.