This summer, the Singapore government fought off cyberattacks on essential services, including ransomware, distributed denial of services (DDoS) attacks, web defacement, data exfiltration and malware infections. With the deputy prime minister and minister for national security observing, more than 200 people from key sectors took part in complex scenario planning sessions, workshops and discussions before the final exercise – Cyber Star – which was a whole-of-government effort to stress test Singapore’s cyber incident management and emergency response plans. Following a similar exercise in 2016, this event incorporated all sectors identified as covering the country’s critical national infrastructure for the first time.
Cyberattacks and cyber warfare can cripple financial systems, disrupt services, disable websites, switch off official networks and steal or alter classified data. They can be perpetrated by terrorists, criminal gangs and hacktivists as well as nation states.
Sophisticated cyber weapons can be used offensively to target major economic and infrastructure targets. Sabotaging internet access, for example, can perhaps shut down more commerce than a naval blockade. Electronically tampering with power grids, subway systems or nuclear reactors might now do more damage than a physical attack.
In 2014, for example, North Korea’s internet access went down for about 10 hours just days after US president Barack Obama warned that the US would launch a “proportional response” to the hack that brought down the Sony Pictures Entertainment computer network. That attack cost Sony hundreds of millions of dollars and was purportedly North Korea’s response to The Interview, a comedy about the assassination of its leader.
These attacks have a huge potential impact. An attack on the Ukrainian power grid in 2015 cut power in 103 cities and towns. In 2013, South Korea was hit by a coordinated attack on its broadcasters and banks that stopped ATMs from dispensing cash, crashed computer networks and wiped clean 32,000 computers. In the US, it is claimed that hackers influenced the outcome of the last presidential election. The US Office of Personnel Management suffered two breaches, one affecting 4.2 million individuals and another affecting 21.5 million federal workers. It included the files of staff who had applied for top-secret security clearance.
The cost of mounting a cyberattack is small compared to the economic and physical damage it can generate, and poses little immediate physical danger to the perpetrators. Cyberattacks are therefore increasingly attractive to adversaries small and large, seen as useful weapons in “sending messages”, softening targets and collecting intelligence. Many countries now have dedicated groups focused on cyber defences and, in many cases, “offensive” activities.
These are some of the reasons why the UK’s National Security Strategy categorises cyberattacks as a Tier One threat to national security, alongside international terrorism, major national crises and international military crises, and why the UK is investing heavily in its cyber defences and capabilities – as well as working more closely with allies that include NATO and Singapore.
