Thread by @doctorow

"A tale of two cybers - how threat reporting by cybersecurity firms systematically underrepresents threats to civil society," in Journal of Information Technology & Politics by @LenMaschmeyer, @RonDeibert, and @jonrlindsay, reveals a serious problem with infosec research.

1/

The authors document how our dominant narrative of cybersecurity - that it's about cyberterrorists using tech to leverage asymmetric attacks against nations and powerful companies - has skewed how we investigate and report on security incidents.

tandfonline.com/doi/full/10.10…

2/

What's more, since the majority of reporting comes from commercial firms hoping to sell security services to corporations in the global north, "threat reports" are absurdly skewed towards corporate espionage, frauds, and attacks on powerful governments.

3/

But this is completely skewed. Considered by both volume and consequences, the commonest form of hack-attack is corporations and governments attacking poorly resourced civil society groups - it's not David felling Goliath, it's Goliath slaughtering armies of Davids.

4/

"The original cyberwar narrative had things precisely backwards. The information revolution does not portend a new anarchy rife with destructive disruption but rather the encroaching hierarchy of the surveillance state."

5/

"Cyberspace may create asymmetric advantages, but they are advantages of the strong to monitor and enforce the behavior of the weak."

6/

But embattled civil society groups do not procure expensive threat-mitigation contracts from commercial cybersecurity firms, so they are omitted from published case-studies in favor of the rare instance in which companies or governments are the victims, not the aggressors.

7/

This skews the entire cybersecurity narrative: from the scholarship to the news-media's reportage to fictional portrayals, giving us the sense of an invisible threat landscape in which tech acts as a force-multiplier for otherwise lost causes.

8/

But the problem isn't just one of distorted perceptions. Our false conception of cybersecurity threats leads us to develop defenses that benefit the habitual aggressors at the expense of mitigations for their preferred victims.

9/

The authors go to great lengths to quantify this selection bias, and make a very compelling case. More significant are the case studies, which come from the work of the Univerity of Toronto's @citizenlab (with which two of the three authors are affiliated).

10/

Citizen Lab is the most prominent and successful entity when it comes to researching and mitigating threats to journalists, human rights orgs, and other civil society groups who are targeted by powerful corporations and governments, using military-style cyberweapons.

11/

These weapons are so cheap and readily available for the powerful that they are used in INCREDIBLY petty ways.

12/

For example, the Saudi government used the NSO Group's Pegasus malware against Omar Abdulaziz, a Canadian university student who ran a comedic Youtube channel that mocked the Saudi state.

NSO's Pegasus was also implicated in the murder and dismemberment of Jamal Khashoggi.

13/

There is seemingly no pretence so slight, no critic so minor, that the rich and powerful don't sometimes target them with the same weapons that nation-states use to attack each others' national security apparatus.

14/

The authors make a compelling case that this asymmetry feeds on itself. Not only do we have an enormous array of powerful weapons for rich and powerful people (who are supposedly under constant assault from weirdly threatening pipsqueaks)...

15/

...But we have almost NOTHING for the victims of this aggression to use to defend themselves.

Ron Deibert, who runs Citizen Lab, wrote a powerful afterword for ATTACK SURFACE, the forthcoming Little Brother novel.

read.macmillan.com/promo/attacksu…

16/

Attack Surface is about a cybersecurity contractor who can no longer rationalize away her work building cyberweapons to attack dissident movements for corrupt and powerful dictators.

17/

She returns from Eastern Europe to Oakland, only to find the weapons she developed being wielded against the social justice movements her friends have founded, and has to reckon with the full consequences of her actions.

18/

In his afterword, Deibert wrote, "I hope you will be inspired by this book in the same way I have. I hope, like me, it encourages you to question the technologies that you depend on, that you carry with you wherever you go."

19/

"Like Masha, I hope you find a way to turn them to your advantage by knowing them from the inside-out in the way she does.

"Above all, I hope you become inspired to use them to create a better world than the one in which we now live."

eof/