Transcript of a podcast in conjunction with The Open Group Conference in San Francisco on how foreign governments and criminal gangs are colluding to attack governments and businesses for profit and politics.

1. Interview with Joseph Menn on Cyber Security, Cyber
Warfare, and the Growing Threat to the Integrity of the
Internet
Transcript of a podcast in conjunction with The Open Group Conference in San Francisco on
how foreign governments and criminal gangs are colluding to attack governments and
businesses for profit and politics.
Listen to the podcast. Find it on iTunes/iPod. Sponsor: The Open Group
To register for The Open Group Conference in San Francisco,
January 30 - February 3, click here.
Dana Gardner: Hello, and welcome to a special BriefingsDirect Thought Leadership interview
series coming to you in conjunction with The Open Group Conference this
January in San Francisco. I'm Dana Gardner, Principal Analyst at Interarbor
Solutions and I will be your host throughout these discussions.
The conference will focus on how IT and enterprise architecture support
enterprise transformation. Speakers in conference events will also explore the
latest in service oriented architecture (SOA), cloud computing, and security.
[Disclosure: The Open Group is a sponsor of BriefingsDirect podcasts.]
Today, we’re here with one of the main speakers of the conference, Joseph Menn, Cyber Security
Correspondent for the Financial Times and author of Fatal System Error: The Hunt for the New
Crime Lords Who are Bringing Down the Internet.
Joe has covered security since 1999 for both The Financial Times and then before that, for the
Los Angeles Times. Fatal System Error is his third book, he also wrote All the Rave: The Rise
and Fall of Shawn Fanning's Napster.
As a lead in to his Open Group presentation entitled "What You're Up Against: Mobsters,
Nation-States, and Blurry Lines," Joe and I are now going to explore the current cyber-crime
landscape, the underground cyber-gang movement, and the motive behind governments
collaborating with organized crime in cyber space. So please join me now in welcoming Joe
Menn to BriefingsDirect.
Joseph Menn: Hi. How are you?
Gardner: I'm great. You know, just starting off our discussion, it seems to me that there had
been some conventional wisdom about cyber crime and security that if there wasn’t much profit

2. or if there was some risk and cost associated with it, and you could escalate the cost, then there
was self-regulation in place and the cost of cyber crime would outweigh the payoffs, and it
stayed manageable.
Has that changed? Have we entered a new period where just balancing risks and costs isn't a
sufficient bulwark against burgeoning crime and risk?
Menn: I'm not sure that that was ever true, not after cyber crime metastasized beginning in 2003,
when the bad-guy spammers in Russia wanted more IP addresses to send mail
from after the blacklisting got effective. But, it's increasingly less true than it
ever was.
Maybe you can make your enterprise little trickier to get into than the other
guy’s enterprise, but crime pays very, very well, and in the big picture, their
ecosystem is better than ours. They do capitalism better than we do. They
specialize to a great extent. They reinvest in R&D.
On our end, on the good guys’ side, it's hard if you're a chief information security officer (CISO)
or a chief security officer (CSO) to convince the top brass to pay more. You don’t really know
what's working and what isn't. You don’t know if you've really been had by something that we
call advanced persistent threat (APT). Even the top security minds in the country can't be sure
whether they’ve been had or not. So it's hard to know what to spend on.
More efficient
The other side doesn’t have that problem. They’re getting more efficient in the same way that
they used to lead technical innovation. They're leading economic innovation. The freemium
model is best evidenced by crimeware kits like ZeuS, where you can get versions that are pretty
effective and will help you steal a bunch of money for free. Then if you like that, you have the
add-on to pay extra for -- the latest and greatest that are sure to get through the antivirus systems.
Gardner: When you say "they," who you are really talking about?
Menn: They the bad guys. It's largely Eastern European organized crime.
In some countries, they can be caught. In other countries they can't be
caught, and there really isn't any point in trying.
It's a geopolitical issue, which is something that is not widely understood, because in general,
officials don’t talk about it. Working on my book, and in reporting for the newspaper, I've met
really good cyber investigators for the Secret Service and the FBI, but I’m yet to meet one that
thinks he's going to get promoted for calling a press conference and announcing that they can’t
catch anyone.

3. So the State Department, meanwhile, keeps hoping that the other side is going to turn a new leaf,
but they’ve been hoping that for 10 or more years, and it hasn’t happened. So it's incumbent
upon the rest of us to call a spade a spade here. What's really going on is that Russian
intelligence and, depending on who is in office at a given time, Ukrainian authorities are
knowingly protecting some of the worst and most effective cyber criminals on the planet.
Gardner: And what would be their motivation? In heaven’s name, why would a sovereign
power or an agency therein want to protect cyber criminals?
Menn: As a starting point, the level of garden-variety corruption over there is absolutely mind-
blowing. More than 50 percent of Russian citizens responding to the survey say that they had
paid a bribe to somebody in the past 12 months. But it's gone well beyond that.
The same resources, human and technical, that are used to rob us blind are also being used in
what is fairly called cyber war. The same criminal networks that are after our bank accounts
were, for example, used in denial-of-service (DOS) attacks on Georgia and Estonian websites
belonging to government, major media, and Estonia banks.
It's the same guy, and it's a "look-the-other-way" thing. You can do whatever crime you want,
and when we call upon you to serve Mother Russia, you will do so. And that has accelerated. Just
in the past couple of weeks, with the disputed elections in Russia, you've seen mass DOS attacks
against opposition websites, mainstream media websites, and live journals. It's a pretty handy
tool to have at your disposal. I provide all the evidence that would be needed to convince the
reasonable people in my book.
Gardner: In your book you use the terms "Bringing Down the Internet." I suppose another
conventional thought around security is that there is a sort of mutual assured destruction effect
where bringing down the Internet would hurt everyone. Is that not the case? Are they really just
looking for people’s credit card numbers and petty crime or is this really a threat to the integrity
of the Internet in general?
Menn: Well integrity is the keyword there. No, I don’t think anybody is about to stop us all from
the privilege of watching skateboarding dogs on YouTube. What I mean by that is the higher trust
on Internet in the way it's come to be used, not the way it was designed, but the way it is used
now for online banking, ecommerce, and for increasingly storing corporate -- and heaven help us
government secrets -- in the cloud. That is in very, very great trouble.
Not a prayer
I don’t think that now you can even trust transactions not to be monitored and pilfered. The
latest, greatest versions of ZeuS get past multi-factor authentication and are not detected by any
antivirus that’s out there. So consumers don’t have a prayer, in the words of Art Coviello, CEO
of RSA, and corporations aren’t doing much better.

4. So the way the Internet is being used now is in very, very grave trouble and not reliable. That’s
what I mean by it. If they turned all the botnets in the world on a given target, that target is gone.
For multiple root servers and DNS, they could do some serious damage. I don’t know if they
could stop the whole thing, but you're right, they don’t want to kill the golden goose. I don’t see
a motivation for that.
Gardner: I guess if we look at organized crime in historical context, we found that there is a lot
of innovation over the decades, over the generations, about how to shake people down, create
rackets, protection scams, and so forth. Is that playing out on the Internet as well? Is there some
continuity around what organized crime tends to do in the physical world to what they're now
attempting to do in the virtual world?
Menn: Sure. The mob does well in any place where there is a market for something, and there
isn’t an effective regulatory framework that sustains it -- prohibition back in the day, prostitution,
gambling, and that sort of thing. One of the things that’s interesting about the core narrative in
my book is that prostitution doesn’t travel very well. Liquor is pretty well legal in most of the
country, but gambling travels very well.
So the traditional five families Gambino-type mobs gravitated towards Internet gambling and
they run some very large enterprises that are offshore. And if you don't pay off, then yeah,
somebody actually shows up and breaks your legs. Old school.
The Russian and Ukrainian gangs went to extortion as an early model, and ironically, some of the
first websites that they extorted with the threat were the offshore gambling firms. They were cash
rich, they had pretty weak infrastructure, and they were wary about to go to the FBI. They started
by attacking those sites in 2003-04 and then they moved on to more garden-variety companies.
Some of them paid off and some said, "This is going to look little awkward in our SEC filings"
and they didn’t pay off.
There are some people who say organized crime and the Internet don't really mix and don't know
how it happened. I've just told you how it happened in the US. Overseas it's not like the mob had
a meeting one day and said, "Bob, I think, this Internet thing shows promise. I want you to open
a cyber division for it."
The way things work in Russia is that even legitimate businesses have a local patron mobster that
they pay tribute to. It's not so much because he is going to shut them down, but because you want
one guy to deal with all the other people that are going to shake you down -- other mobsters and
cops who are on the take.
Once the cyber gang got big enough, sooner or later, they also wanted the protection of
traditional organized crime, because those people had better connections inside the intelligence
agencies and the police force and could get them protection. That's the way it worked. It was sort
of an organic alliance, rather than "Let’s develop this promising area."

5. Gardner: Just as in past eras and with the need for protection, these cyber criminals look for a
safe haven and perhaps pay off those people, whether it's physical or virtual to protect that
environment, and then perhaps there is some added collusion along the way.
Have we moved now beyond this "let's just get safe and payoff some people for protection," or is
there a two-way street where these cyber criminals are being contracted by some state agencies.
How does this further collusion sort of come about?
Proving their worth
Menn: Exactly. That is what happens. Initially it was garden-variety payoffs and protection.
Then, around 2007, with the attack on Estonia, these guys started proving their worth to the
Kremlin, and others saw that with the attacks that ran through their system.
This has continued to evolve very rapidly. Now the DOS attacks are routinely used as the tool for
political repression all around the world --Vietnam, Iran and everywhere you’ll see critics that
are silent from DOS Attacks. In most cases, it's not the spy agencies or whoever themselves, but
it's their contract agent. They just go to their friends and the similar gangs and say, "Hey do this."
What's interesting is that they are both in this gray area now, both Russia and China, which we
haven't talked about as much.
In China, hacking really started out as an expression of patriotism. Some of the biggest attacks,
Code Red being one of them, were against targets in countries that were perceived to have
slighted China or had run into some sort of territorial flap with China, and, lo and behold, they
got hacked.
In the past several years, with this sort of patriotic hacking, the anti-defense establishment
hacking in the West that we are reading a lot about finally, those same guys have gone off and
decided to enrich themselves as well. There were actually disputes in some of the major Chinese
hacking groups. Some people said it was unethical to just go after money, and some of these
early groups split over that.
In Russia, it went the other way. It started out with just a bunch of greedy criminals and then they
said, "Hey. We can do even better and be protected. You have better protection if you do some
hacking for the motherland." In China, it's the other way. They started out hacking for the
motherland and then added, "Hey. We can get rich while serving our country."
So they're both sort of in the same place, and unfortunately it makes it pretty close to impossible
for law enforcement in this country to do anything about it, because it gets into political
protection. What you really need is White House-level dealing with this stuff. If Obama is going
to talk to his opposite numbers about Chinese currency, Russian support of something we don’t
like, or oil policy, this has got to be right up there or nothing is going to happen at all.
Gardner: I suppose there's a difference between political gain by shutting down the opposition
or having political motives for undertaking these sorts of activities, but what about the pure

6. capitalism side, intellectual property (IP), taking over products in markets with the aid of these
nefarious means? I guess it's hard to know. A lot of companies won't want to share details about
this, but how big a deal is this now for strictly enterprise and commercial organizations?
Menn: It is much, much worse than anybody realizes. The US counterintelligence a few weeks
ago finally put out a report saying that Russia and China are deliberately stealing our IP, the IP of
our companies. That's an open secret. It's been happening for years. You're right. The man in the
street doesn’t realize this, because companies aren’t used to fessing up. Therefore, there is little
outrage and little pressure for retaliation or diplomatic engagement on these issues.
I'm cautiously optimistic that that is going to change a little bit. This year the Securities and
Exchange Commission (SEC) gave very detailed guidance about when you have to disclose
when you’ve been hacked. If there is a material impact to your company, you have to disclose it
here and there, even if it's unknown.
Can't be boilerplate
If it might have, or is reasonably likely to have, a material impact, you have to spell it out. And
it can't be boiler plate. It can't just be, "We are an Internet retailer and therefore we are target of
hackers and therefore people’s credit cards might get out." No, without divulging what your
weaknesses are you have to say, "We have detected hacks in the past and we don’t know but our
source code might be gone."
You have to be a little more explicit, and so far, it's basically Google that has really spelled out
how badly they got hit. We're going to see a lot more companies say that, and I think that will
help wake up Congress and the general public.
Gardner: So the old adage of shining light on this probably is in the best interest of everyone. Is
tthe message that you take to corporate America or even global corporations that keeping this
quiet isn’t necessarily the right way to go?
To register for The Open Group Conference in San Francisco,
January 30 - February 3, click here.
Menn: Not only is it not the right way to go, but it's safer to come out of the woods and fess up
now. The stigma is almost gone. If you really blow the PR like Sony, then you're going to suffer
some, but I haven’t heard a lot of people say, "Boy, Google is run by a bunch of stupid idiots.
They got hacked by the Chinese."
It's the definition of an asymmetrical fight here. There is no company that's going to stand up
against the might of the Chinese military, and nobody is going to fault them for getting nailed.
Where we should fault them is for covering it up.

7. I think you should give the American people some credit. They realize that you're not the bad
guy, if you get nailed. As I said, nobody thinks that Google has a bunch of stupid engineers. It is
somewhere between extremely difficult to impossible to ward off against "zero-days" and the
dedicated teams working on social engineering, because the TCP/IP is fundamentally broken and
it ain't your fault.
Gardner: Let's say that I'm a leadership individual at a corporation, a Global 500 organization,
and I am wondering to what extent this is a risk. Is this something that’s going to be an
acceptable cost of doing business? Is this just something I have to deal with when I go to
different markets around the world, or is this an existential threat?
We're still seeing record profits by many companies. Google is certainly not hurting. This hasn’t
necessarily attacked their bottom line in the same way it attacked their firewall. How serious is
this? How serious should it be considered?
Menn: It's an existential threat not only to your company, but to our country and to our way of
life. It is that bad. One of the problems is that in the US, executives tend to think a quarter or two
ahead. If your source code gets stolen, your blue prints get taken, nobody might know that for a
few years, and heck, by then you're retired.
With the new SEC guidelines and some national plans in the UK and in the US, that’s not going
to cut it anymore. Executives will be held accountable. This is some pretty drastic stuff. The
things that you should be thinking about, if you’re in an IT-based business, include figuring out
the absolutely critical crown jewel one, two, or three percent of your stuff, and keeping it off
network machines.
Short-term price
Yes, that is a current cost to doing things that might well make you less efficient and that’s a
short-term price you have to pay to ensure long-term survival. You have to do that, and there are
some creative things that could be done.
For example, say you've got a blueprint for the next widget that is absolutely going to smoke the
competition, and it has got to be on a computer that other people can access for some reason. I
would make 100 different similar blueprints of the next generation widget, and only a handful of
people you trust know which is the right one, and all the others are hooey.
Therefore, if everything gets stolen, they're going to waste a lot of cycles building the wrong
widget. That’s the sort of strategic spy-type thinking that I think garden-variety CEOs have got to
start engaging it.
Gardner: That’s interesting. So we have to think differently, don’t we?
Menn: Basically, regular companies have to start thinking like banks, and banks have to start
thinking like intelligence agencies. Everybody has to level up here.

8. Gardner: What do the intelligence agencies have to start thinking about?
Menn: The discussions that are going on now obviously include greatly increased monitoring,
pushing responsibility for seeing suspicious stuff down to private enterprise, and obviously
greater information sharing between private enterprise, and government officials.
But, there's some pretty outlandish stuff that’s getting kicked around, including looking the other
way if you, as a company, sniff something out in another country and decide to take retaliatory
action on your own. There’s some pretty sea-change stuff that’s going on.
Gardner: So that would be playing offense as well as defense?
Menn: In the Defense Authorization Act that just passed, for the first time, Congress officially
blesses offensive cyber-warfare, which is something we’ve already been doing just quietly.
We’re entering some pretty new areas here, and one of the things that’s going on is that the cyber
warfare stuff, which is happening, is basically run by intelligence folks, rather by a bunch of
lawyers worrying about collateral damage and the like, and there's almost no oversight because
intelligence agencies in general get low oversight.
We’re probably also buying a whole bunch of cyber stuff, which is a waste. I mean, they're going
to be equivalent of $500 toilet seats, and we’re not going to know about it, because this stuff
doesn’t get disclosed.
Gardner: I know that we could go on to this separate subject for hours, but just very briefly how
about the area of governance? We know who's in charge when it comes to interstate commerce.
We know who is in charge when it comes to managing the monetary system and protecting
against counterfeit bills?
Do we really have anyone who is officially in charge of protecting let's say, in this case, US
companies, but it could vary of course from country to county, from outside cyber warfare? Is
there a defense, legal, or other framework under which the responsibility for protection falls.
It's a mess
Menn: The short answer is it's a mess. The Department of Homeland Security (DHS) is
officially in charge of protecting the civilian-owned stuff with the assistance of the Department
of Defense (DoD) and the National Security Agency (NSA). The bottom line is that this makes it
very tricky, because there's different frameworks involved.
For example, the FBI gets called in to investigate a hack and they discover it's criminal gang X,
but that criminal gang may have been motivated to steal defense secrets more than the money.
Then, they're supposed to kick it over to the intelligence community, but it's the same people. So
we're a lot more handcuffed in all this than our adversaries are.

9. Gardner: So it's hard to say whose jurisdiction it is, under what circumstances, for how long,
and then who gets the ultimate blame if things go right or wrong. I guess criminals would love to
see that, right?
Menn: Yup.
Gardner: Okay, we have to wrap up. It's a very fascinating subject obviously. Just quickly
looking to the future, we have some major trends. We have an increased movement towards
mobility. People using public networks through their mobile carriers increasingly for work and
more business-sensitive activities.
We have the drive towards cloud computing. We’ll be putting more of your assets, data,
processes, perhaps even IP in a third-party data center known as a cloud. We’re also seeing the
movement towards outsourcing more IT and outsourcing applications in a software-as-a-service
(SaaS) field.
Are these good, bad, indifferent? How does this set of big shifts in IT impact this whole cyber
security issue?
Menn: Well, there are some that are clearly dangerous, and there are some things that are a
mixed bag. Certainly, the inroads of social networking into the workplace are bad from a security
point of view. Perhaps worse is the consumerization of IT, the bring-your-own-device trend,
which isn't going to go away. That’s bad, although there are obviously mitigating things you can
do.
The cloud itself is a mixed bag. Certainly, in theory, it could be made more secure than what you
have on premise. If you’re turning it over to the very best of the very best, they can do a lot more
things than you can in terms of protecting it, particularly if you’re a smaller business.
If you look to the large scale banks and people with health records and that sort of thing that
really have to be ultra-secure, they're not going to do this yet, because the procedures are not
really set up to their specs yet. That may likely come in the future. But, cloud security, in my
opinion, is not there yet. So that’s a mixed blessing.
Gardner: Before we close out, it sounds as if it's important for companies to educate themselves
on what the real threats are, consider what to do if they are a victim, try to figure out who are
their friends in government, and of the security of third-party private security organizations.
Anything else that you think is important, Joe, in terms of getting started in moving towards both
defense and offense in anticipating that these issues as you say are potentially existential?

10. Radical steps
Menn: As I said, you need to think strategically about this, and that includes some pretty
radical steps. There are those who say there are two types of companies out there -- those that
have been hacked and those that don’t know that they’ve been hacked.
Everybody needs to take a look at this stuff beyond their immediate corporate needs and think
about where we’re heading as a society and to the extent that people are already expert in the
stuff or can become expert in this stuff. They need to share that knowledge, and that will often
mean, saying "Yes, we got hacked" publicly, but it also means educating those around them
about the severity of the threat.
One of the reasons I wrote my book, and spent years doing it, is not because I felt that I could tell
every senior executive what they needed to do. I wanted to educate a broader audience, because
there are some pretty smart people, even in Washington who have known about this for years and
have been unable to do anything about it. We haven't really passed anything that's substantial in
terms of legislation.
As a matter of political philosophy, I feel that if enough people on the street realize what's going
on, then quite often leaders will get in front of them and at least attempt to do the right thing.
Senior executives should be thinking about educating their customers, their peers, the general
public, and Washington to make sure that the stuff that passes isn't as bad as it might otherwise
be.
Gardner: Very good. We have been talking with Joseph Menn, Cyber Security Correspondent
for The Financial Times and author of Fatal System Error: The Hunt for the New Crime Lords
Who are Bringing Down the Internet.
As a lead up to his Open Group presentation on, "What You're Up Against: Mobsters, Nation-
States and Blurry Lines," Joe and I have been exploring here the current cyber crime landscape,
what can be done to better understand the threat and perhaps begin to work against it.
This special BriefingsDirect discussion comes to you in conjunction with The Open Group
Conference from January 30-February 3 in San Francisco. You'll hear more from Joe and many
other global leaders on the ways that IT and enterprise architecture support enterprise
transformation.
So thanks to you Joe Menn for a very fascinating discussion, and I look forward to your
presentation in San Francisco. I also encourage our readers and listeners to attend the conference
to learn more. Thanks, Joe.
Menn: Thanks very much.

11. Gardner: This is Dana Gardner, Principal Analyst at Interarbor Solutions, your host and
moderator through these thought leader interviews. Thanks again for listening, and come back
next time.
Listen to the podcast. Find it on iTunes/iPod. Sponsor: The Open Group
Transcript of a podcast in conjunction with The Open Group Conference in San Francisco on
how foreign governments and criminal gangs are colluding to attack governments and
businesses for profit and politics. Copyright Interarbor Solutions, LLC, 2005-2011. All rights
reserved.
To register for The Open Group Conference in San Francisco,
January 30 - February 3, click here.
You may also be interested in:
• Exploring Business-IT Alignment: A 20-Year Struggle Culminating in the Role and
Impact of Business Architecture
• Enterprise Architects Increasingly Leverage Advanced TOGAF 9 for Innovation, Market
Response, and Governance Benefits
• Open Group Cloud Panel Forecasts Cloud s Spurring Useful Transition Phase for
Enterprise Architecture
• The Open Group's Cloud Work Group Advances Understanding of Cloud-Use Benefits
for Enterprises
• Exploring the Role and Impact of the Open Trusted Technology Forum to Ensure Secure
IT Products in Global Supply Chains