A tale of two cybers - how threat reporting by cybersecurity firms systematically underrepresents threats to civil society

References

• Alexander, G., Brooks, M., Crete-Nishihata, M., Maynier, E., Scott-Railton, J., & Deibert (2018). Familiar feeling: A Malware campaign targeting the tibetan diaspora resurfaces. Retrieved from https://citizenlab.ca/2018/08/familiar-feeling-a-malware-campaign-targeting-the-tibetan-diaspora-resurfaces/
   Google Scholar
• Anderson, R., Barton, C., Böhme, R., Clayton, R., van Eeten, M. J. G., Levi, M., … Savage, S. (2013). Measuring the cost of cybercrime. In B. Rainer. (Ed.), The economics of information security and privacy (pp. 265-300). Berlin Heidelberg, Germany: Springer-Verlag. Retrieved from https://www.springer.com/gp/book/9783642394973
   Google Scholar
• Arquilla, J., & Ronfeldt, D. (1993). Cyberwar is coming! Comparative Strategy, 12(2), 141–165. doi:10.1080/01495939308402915
   Web of Science ®Google Scholar
• Bator, F. M. (1958). The anatomy of market failure. The Quarterly Journal of Economics, 72(3), 351–379. doi:10.2307/1882231
   Web of Science ®Google Scholar
• Borghard, E. D., & Lonergan, S. W. (2017). The logic of coercion in cyberspace. Security Studies, 26(3), 452–481. doi:10.1080/09636412.2017.1306396
   Web of Science ®Google Scholar
• Brantly, A. F. (2014). The cyber losers. Democracy and Security, 10(2), 132–155. doi:10.1080/17419166.2014.890520
   Google Scholar
• Brennan, M., Eagen, E., Nunez, B., Scott-Railton, J., & Sears, E. (2017). Digital security and grantcraft guide. Retrieved from https://www.fordfoundation.org/media/3334/digital-security-grantcraft-guide-v10-final-22317.pdf
   Google Scholar
• Burgess, M. (2017). Exposed: How one of Russia’s most sophisticated hacking groups operates. Wired UK. Retrieved from https://www.wired.co.uk/article/how-russian-hackers-work
   Google Scholar
• CLTC. (2018). Center for long-term cybersecurity project on protecting politically vulnerable organizations threat landscape and organizational ecosystem. UC Berkeley.
   Google Scholar
• Crete-Nishihata, Jakub Dalek, Ronald Deibert, Seth Hardy, Katherine Kleemola, Sarah McKune, Irene Poetranto, John Scott-Railton, Adam Senft, Byron Sonne, and Greg Wiseman. ‘Communities @Risk: Targeted Digital Threats Against Civil Society’. Citizen Lab, 11 November 2014. https://targetedthreats.net/.https://targetedthreats.net/media/1-ExecutiveSummary.pdf.
   Google Scholar
• Crete-Nishihata, M., Dalek, J., Maynier, E., & Scott-Railton, J. (2018). Spying on a budget: Inside a phishing operation with targets in the tibetan community. The Citizen Lab. Retrieved from https://citizenlab.ca/2018/01/spying-on-a-budget-inside-a-phishing-operation-with-targets-in-the-tibetan-community/
   Google Scholar
• CrowdStrike. (2016). Bears in the Midst: Intrusion into the democratic national committee ».” Retrieved from https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee
   Google Scholar
• CrowdStrike. (2019). Global threat report. Retrieved from https://www.crowdstrike.com/blog/2019-global-threat-report-shows-it-takes-innovation-and-speed-to-win-against-adversaries/
   Google Scholar
• Deibert (2015). Cyberspace under siege. Journal of Democracy, 26(3), 64–78. doi:10.1353/jod.2015.0051
   Web of Science ®Google Scholar
• Deibert, R., & Rohozinski, R. (2009). Tracking GhostNet: Investigating a cyber espionage network. The Citizen Lab (blog). Retrieved from https://citizenlab.org/2009/03/tracking-ghostnet-investigating-a-cyber-espionage-network/
   Google Scholar
• Deibert. (2003). Black code: Censorship, surveillance, and the militarisation of cyberspace. Millennium - Journal of International Studies, 32(3), 501–530. doi:10.1177/03058298030320030801
   Web of Science ®Google Scholar
• Deibert, Ronald J. ‘Toward a Human-Centric Approach to Cybersecurity’. Ethics & International Affairs 32, no. 4 (ed 2018): 411–24. https://doi.org/10.1017/S0892679418000618.
   Google Scholar
• Dunn Cavelty, M. (2013). From cyber-bombs to political fallout: Threat representations with an impact in the cyber-security discourse. International Studies Review, 15(1), 105–122. doi:10.1111/misr.12023
   Web of Science ®Google Scholar
• Dunn-Cavelty, M. (2008). Cyber-terror—looming threat or phantom menace? The framing of the US cyber-threat debate. Journal of Information Technology & Politics, 4(1), 19–36. doi:10.1300/J516v04n01_03
   Google Scholar
• Egloff, F. J. (2020). Contested public attributions of cyber incidents and the role of academia. Contemporary Security Policy, 41(1), 55–81. doi:10.1080/13523260.2019.1677324
   Web of Science ®Google Scholar
• ESET. (2010). Stuxnet under the microscope.
   Google Scholar
• FireEye. (2014). APT28:Awindow into Russia’s cyber espionage operations?” FireEye. Retrieved from https://www2.fireeye.com/rs/fireye/images/rpt-apt28.pdf
   Google Scholar
• FireEye. (2017). APT28: At the center of the storm. FireEye. Retrieved from https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf
   Google Scholar
• FireEye. (2019). M-Trends. Retrieved from https://content.fireeye.com/m-trends/rpt-m-trends-2019
   Google Scholar
• Fox-Brewster, T. (2017). Russian ‘Fancy Bear’ hackers tainted their huge leaks with fake data. Forbes. Retrieved from https://www.forbes.com/sites/thomasbrewster/2017/05/26/russian-dnc-hackers-planted-leaks-with-fake-data/
   Google Scholar
• Future, R. (2018). RedAlpha: New campaigns discovered targeting the tibetan community. Retrieved from https://www.recordedfuture.com/redalpha-cyber-campaigns/
   Google Scholar
• Gartzke, E. (2013). The myth of cyberwar: Bringing war in cyberspace back down to earth. International Security, 38(2), 41–73. doi:10.1162/ISEC_a_00136
   Web of Science ®Google Scholar
• George, A. L., & Bennett, A. (2005). Case studies and theory development in the social sciences. Cambridge, Mass: MIT Press.
   Google Scholar
• Gioe, D. V., Goodman, M. S., & Wanless, A. (2019). Rebalancing cybersecurity imperatives: patching the social layer. Journal of Cyber Policy, 4(1), 117–137. doi:10.1080/23738871.2019.1604780
   Google Scholar
• Guerrero-Saade, J. A. (2015). The ethics and perils of APT research. Retrieved from https://media.kaspersky.com/pdf/Guerrero-Saade-VB2015.pdf
   Google Scholar
• Hardin, R. (2015). Collective action. RFF Press. doi:10.4324/9781315044330.
   Google Scholar
• HBGary. (2010). Operation Aurora.
   Google Scholar
• Hulcoop, A., Brooks, M., Maynier, E., Scott-Railton, J., & Crete-Nishihata, M. (2016). It’s parliamentary: KeyBoy and the targeting of the tibetan community. Retrieved from https://citizenlab.ca/2016/11/parliament-keyboy/
   Google Scholar
• Hulcoop, A., Scott-Railton, J., Tanchak, P., Brooks, M., & Deibert, R. (2017). Tainted leaks: Disinformation and phishing with a Russian nexus. Retrieved from https://citizenlab.ca/2017/05/tainted-leaks-disinformation-phish/
   Google Scholar
• Isaac, M., & Wakabayashi, D. (2017). Russian influence reached 126 million through facebook alone. The New York Times. sec. Technology. Retrieved from https://www.nytimes.com/2017/10/30/technology/facebook-google-russia.html
   Google Scholar
• Jayamaha, B., & Matisek, F. (2018). Hybrid war: Attacking the ‘Civil’ in civil society. US Army War College War Room (blog). Retrieved from https://warroom.armywarcollege.edu/articles/hybrid-war-attacking-the-civil-in-civil-society/
   Google Scholar
• Jensen, B., Valeriano, B., & Maness, R. (2019). Fancy bears and digital trolls: Cyber strategy with a Russian twist. Journal of Strategic Studies, 42(2), 212–234. doi:10.1080/01402390.2018.1559152
   Web of Science ®Google Scholar
• Kaspersky. (2017). Use of commercial android spyware almost doubled in 2017. Retrieved from https://www.kaspersky.com/about/press-releases/2017_use-of-commercial-android-spyware-almost-doubled-in-2017
   Google Scholar
• Kuerbis, B., & Badiei, F. (2017). Mapping the cybersecurity institutional landscape. Digital Policy, Regulation and Governance, 19(6), 466–492. doi:10.1108/DPRG-05-2017-0024
   Web of Science ®Google Scholar
• Langner, R. (2011). What stuxnet is all about. Langner - Reliable and Safe IIOT (Industrial Internet of Things) (blog). Retrieved from https://www.langner.com/2011/01/what-stuxnet-is-all-about/
   Google Scholar
• Lawson, S. (2013). Beyond cyber-doom: Assessing the limits of hypothetical scenarios in the framing of cyber-threats. Journal of Information Technology & Politics, 10(1), 86–103. doi:10.1080/19331681.2012.759059
   Google Scholar
• Lieberman, E. S. (2005). Nested analysis as a mixed-method strategy for comparative research. American Political Science Review, 99(3), 435–452. doi:10.1017/S0003055405051762
   Web of Science ®Google Scholar
• Lindsay, J. R. (2013). Stuxnet and the limits of cyber warfare. Security Studies, 22(3), 365–404. doi:10.1080/09636412.2013.816122
   Web of Science ®Google Scholar
• Lindsay, J. R. (2014). The impact of China on cybersecurity: Fiction and friction. International Security, 39(3), 7–47. doi:10.1162/ISEC_a_00189
   Web of Science ®Google Scholar
• Lindsay, J. R. (2017). Restrained by design: The political economy of cybersecurity. Digital Policy, Regulation and Governance, 19(6), 493–514. doi:10.1108/DPRG-05-2017-0023
   Web of Science ®Google Scholar
• Lynn, W. J., III (2010). Defending a New Domain. Foreign Affairs. Retrieved from http://www.foreignaffairs.com/articles/66552/william-j-lynn-iii/defending-a-new-domain
   Google Scholar
• Marczak, B., Scott-Railton, J., Senft, A., Poetranto, I., & Sarah, M. (2015). Pay no attention to the server behind the proxy - Mapping FinFisher’s continuing proliferation. The Citizen Lab (blog). Retrieved from https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/
   Google Scholar
• McAfee. (2010). Operation Aurora – post mortem. McAfee Blogs. Retrieved from https://securingtomorrow.mcafee.com/business/security-connected/operation-aurora-%e2%80%93-post-mortem/
   Google Scholar
• Mueller, M., Grindal, K., Kuerbis, B., & Badiei, F. (2019, April). Cyber attribution: Can a new institution achieve transnational credibility? Cyber Defense Review, (pp. 107–121).
   Google Scholar
• Mueller, R. S., III. (2019). Report on the investigation into Russian interference in the 2016 presidential election. Retrieved from https://www.justice.gov/storage/report.pdf
   Google Scholar
• Mukherjee, S. P. (2018). Statistical methods in social science research. New York, NY: Springer Berlin Heidelberg.
   Google Scholar
• Muncaster, P. (2017). Chinese KeyBoy group unlocks more victim networks. Infosecurity Magazine. Retrieved from https://www.infosecurity-magazine.com:443/news/chinese-keyboy-group-unlocks/
   Google Scholar
• NCSC. (2018). Indicators of compromise for malware used by APT28 - NCSC site. Retrieved from https://www.ncsc.gov.uk/alerts/indicators-compromise-malware-used-apt28
   Google Scholar
• Networks Asia Staff. (2015). Philippines, Taiwan are latest targets of ‘operation tropic trooper’ Malware. Networks Asia. Retrieved from https://www.networksasia.net/article/philippines-taiwan-are-latest-targets-operation-tropic-trooper-malware.1432083840
   Google Scholar
• Nye, J. S. (2011). The future of power. 1st ed. New York, USA: PublicAffairs.
   Google Scholar
• ODNI. (2017). ODNI statement on declassified intelligence IC on the record. Retrieved from https://icontherecord.tumblr.com/post/155494946443/odni-statement-on-declassified-intelligence
   Google Scholar
• Olson, M. (1971). The logic of collective action: Public goods and the theory of groups (Revised ed., pp. 124). Cambridge, Massachusetts; London, England: Harvard University Press, Harvard Economic Studies.
   Google Scholar
• Ostrom, V., & Ostrom, E. (1977). Public goods and public choices. Indiana, USA: Indiana University, Workshop in Political Theory and Policy Analysis.
   Google Scholar
• PwC. (2017). The KeyBoys are back in town. Retrieved from https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html
   Google Scholar
• Rapid7. (2013). KeyBoy, targeted attacks against Vietnam and India. Retrieved from https://blog.rapid7.com/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india/
   Google Scholar
• Rattray, G. J. (2009). An environmental approach to understanding cyberpower. In Cyberpower and national security Franklin D. Kramer, Stuart H. Starr, Larry K. Wentz (Eds.), (pp. 253–274). Washington, D.C.: Potomac Books.
   Google Scholar
• Rid, T. (2012). Cyber war will not take place. Journal of Strategic Studies, 35(1), 5–32. doi:10.1080/01402390.2011.608939
   Web of Science ®Google Scholar
• Rid, T., & Buchanan, B. (2015). Attributing cyber attacks. Journal of Strategic Studies, 38(1–2), 4–37. doi:10.1080/01402390.2014.977382
   Web of Science ®Google Scholar
• Rogin, Josh. ‘Opinion | Washington Must Wake up to the Abuse of Software That Kills’. Washington Post, (2018). https://www.washingtonpost.com/opinions/2018/12/12/washington-must-wake-up-abuse-software-that-kills/.
   Google Scholar
• Rosenzweig, P. (2011). Cybersecurity and public goods. Retrieved from http://media.hoover.org/sites/default/files/documents/EmergingThreats_Rosenzweig.pdf
   Google Scholar
• Samuelson, P. A. (1954). The pure theory of public expenditure. The Review of Economics and Statistics, 36(4), 387–389. doi:10.2307/1925895
   Web of Science ®Google Scholar
• Schleifer, T., & Walsh, D. (2017). McCain: Russian cyberintrusions an ‘act of war. CNN. Retrieved from http://www.cnn.com/2016/12/30/politics/mccain-cyber-hearing/index.html
   Google Scholar
• SecureWorks. (2016a). Hillary clinton email targeted by threat group-4127. Retrieved from https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign
   Google Scholar
• SecureWorks. (2016b). Threat group-4127 targets google accounts. Retrieved from https://www.secureworks.com/research/threat-group-4127-targets-google-accounts
   Google Scholar
• Shezaf, Hagar. ‘Snowden: Israeli Firm’s Spyware Was Used to Track Khashoggi - Israel News - Haaretz.Com’, (2018). https://www.haaretz.com/israel-news/.premium-israeli-spyware-was-used-to-track-saudi-journalist-khashoggi-edward-snowden-says-1.6633745.
   Google Scholar
• Slayton, R. (2017). What is the cyber offense-defense balance? Conceptions, causes, and assessment. International Security, 41(3), 72–109. doi:10.1162/ISEC_a_00267
   Web of Science ®Google Scholar
• Smeets, M. (2018). A matter of time: On the transitory nature of cyberweapons. Journal of Strategic Studies, 41(1–2), 6–32. doi:10.1080/01402390.2017.1288107
   Web of Science ®Google Scholar
• Symantec. (2011). W32.Stuxnet Dossier.
   Google Scholar
• Symantec. (2018). APT28: New espionage operations target military and government organizations. Retrieved from https://www.symantec.com/blogs/election-security/apt28-espionage-military-government
   Google Scholar
• Symantec. (2019). Internet security threat report. Retrieved from https://www.symantec.com/content/dam/symantec/docs/reports/istr-24-executive-summary-en.pdf
   Google Scholar
• Threat Intelligence Researcher. (2018) Phone.
   Google Scholar
• TrendMicro. (2015a). Operation tropic trooper: Old Vulnerabilities Still Pack a Punch - TrendLabs Security Intelligence Blog. Retrieved from http://blog.trendmicro.com/trendlabs-security-intelligence/operation-tropic-trooper-old-vulnerabilities-still-pack-a-punch/
   Google Scholar
• TrendMicro. (2015b). Pawn storm’s domestic spying campaign revealed; Ukraine and US top global targets - trendlabs security intelligence blog. Retrieved from https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storms-domestic-spying-campaign-revealed-ukraine-and-us-top-global-targets/
   Google Scholar
• TrendMicro. (2017). Two years of pawn storm. Retrieved from https://documents.trendmicro.com/assets/wp/wp-two-years-of-pawn-storm.pdf
   Google Scholar
• TrendMicro. (2018). Tropic trooper’s new strategy - trendlabs security intelligence blog. Retrieved from https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/
   Google Scholar
• US vs. NETYKSHO et al. (2018). US District Court of District of Columbia.
   Google Scholar
• Van Evera, S. (1997). Guide to methods for students of political science. Ithaca, NY: Cornell University Press.
   Google Scholar
• Work, J. D. (2020). Evaluating commercial cyber intelligence activity. International Journal of Intelligence and CounterIntelligence, 1–31. doi:10.1080/08850607.2019.1690877
   Web of Science ®Google Scholar
• YouGov. (2017). America’s friends and enemies | YouGov. Retrieved from https://today.yougov.com/topics/politics/articles-reports/2017/02/02/americas-friends-and-enemies
   Google Scholar