{"id":1507,"date":"2012-09-24T18:44:04","date_gmt":"2012-09-24T16:44:04","guid":{"rendered":"http:\/\/www.ofcourseimright.com\/?p=1507"},"modified":"2012-09-24T18:44:04","modified_gmt":"2012-09-24T16:44:04","slug":"should-the-itu-handle-cybersecurity-or-cybercrime","status":"publish","type":"post","link":"https:\/\/ofcourseimright.com\/?p=1507","title":{"rendered":"Should the ITU Handle Cybersecurity or Cybercrime?"},"content":{"rendered":"

\"\"<\/a>Cybercrime and cybersecurity are two very important topics that are largely being lost in the noise around the American elections, the Arab Spring, or the European banking crisis.\u00a0 Nevertheless, there is an attempt by the ITU<\/a> and some governments to take a more active role in this space.<\/p>\n

Roughly defined, cybercrime is a crime that occurs or is facilitated by computers.\u00a0 Cybersecurity is the actions taken to protect against cybercrime.\u00a0 This includes protection of devices so that they don’t get broken into, and remediation.<\/p>\n

Cybercrime itself is a complex issue.\u00a0 It relates to many things, including fraud, data theft, privacy theft, and just about any criminal endeavor that happened before the term \u201ccyber\u201d ever came to be.\u00a0 There’s a great paper<\/a> by a laundry list of Who’s Who in the economics of cybersecurity that proposes methods of estimating actual losses, breaking down crime into various categories.\u00a0 Statistics in this space are remarkably fluid- that is, there are poor standards for data collection.<\/p>\n

As it turns out, there is a treaty on cybercrime, conveniently called The Convention on Cybercrime<\/a>, developed in the Council of Europe.\u00a0 Nearly all of Europe, as well as the U.S. and a number of other countries have ratified this treaty, and there other signatories.\u00a0 Research from the University of Singapore has already shown<\/a> that either accession to the treaty or even becoming congruent with it will reduce a country’s cybercrime rate.\u00a0 While the causalities are not clearly explained in that paper, one part is obvious: the first part of the treaty is what amounts to a best practices document for governments, on how they should develop legislation.<\/p>\n

The treaty itself is fairly involved and took many years to get as many signatures as it did.\u00a0 It has to deal with diverse societies who have differing constitutional views on freedom of speech and expression, as well as on due process.<\/p>\n

The Secretary General of the ITU and his staff, as well as a few governments, have been under the impression that the ITU could do a better job than what was done by the Council of Europe.\u00a0 There is little chance of this happening, and in all likelihood, they would make matters worse, if for no other reason (and there are other reasons) that anyone who already signed the Convention would have to reconcile differences between that and whatever would be created by the ITU.<\/p>\n

There are other reasons the ITU cannot do better, not least of which is that they lack the technical expertise to actively engage in cybersecurity.\u00a0 Part of the problem is that most Internet standards are not ITU standards, but come from elsewhere.\u00a0 While the ITU has any number of standards involving fiber optics management, and good codec support, the computer you’re reading this blog on uses mostly the work of others.\u00a0 Another reason is that the state of the art in both cybercrime and cybersecurity is rapidly moving, beyond the ITU’s capability to adapt.\u00a0 Here’s just one example: contrary to what people had thought, the battle ground for cybercrime has not really moved to mobile devices.\u00a0 As we’ve previously discussed, this has a lot to do with the update mechanisms and business models in play, but the most notable one being that applications on the iPhone in particular are both reviewed by Apple and signed.\u00a0 The only iPhone you hear about being vulnerable is the one that has been cracked by the owner, and that doesn’t account for a whole lot.<\/p>\n

One WCIT proposal<\/a> that refers to spam as a threat demonstrates how far off some governments are on the subject.\u00a0 Spam itself has never really been much of a threat, but more of an annoyance.\u00a0 80-90% of it is never delivered to the end user, and most Evil Doers have moved on to more sophisticated approaches, such as spear phishing.\u00a0 Worse, the ITU-T’s study group 17 had to take years simply to come up with a definition of spam, when it really was<\/strong> a problem.<\/p>\n

This is not to say that the ITU shouldn’t have a role to play with cybersecurity.\u00a0 The ITU has extraordinarily access to governments of developing countries, and can work with them to improve their cybersecurity posture, through training and outreach.\u00a0 In fact they do some of this in their Development or ITU-D Sector.\u00a0 One thing that the D sector has done recently has been to put developing governments in touch with FIRST<\/a>, the organization that coordinates discussion among Computer Incident Response Teams or CIRTs.\u00a0 But the ITU should give up any idea that it can play more of a role than outreach and capacity building, all of which should be done in consultation with actual experts.<\/p>\n","protected":false},"excerpt":{"rendered":"

Cybercrime and cybersecurity are two very important topics that are largely being lost in the noise around the American elections, the Arab Spring, or the European banking crisis.\u00a0 Nevertheless, there is an attempt by the ITU and some governments to take a more active role in this space. Roughly defined, cybercrime is a crime that … Continue reading “Should the ITU Handle Cybersecurity or Cybercrime?”<\/span><\/a><\/p>\n","protected":false},"author":172,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[87,4,9],"tags":[32,404,493,37],"class_list":["post-1507","post","type-post","status-publish","format-standard","hentry","category-internet","category-politics","category-security","tag-cybercrime","tag-itu","tag-politics","tag-privacy"],"_links":{"self":[{"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/posts\/1507","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/users\/172"}],"replies":[{"embeddable":true,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1507"}],"version-history":[{"count":4,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/posts\/1507\/revisions"}],"predecessor-version":[{"id":1514,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/posts\/1507\/revisions\/1514"}],"wp:attachment":[{"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1507"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1507"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1507"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}