George Kerevan: Is that lone hacker the new Red under the bed?

Published on Wednesday 27 July 2011 15:06

MY EARS pricked up when I heard that an 18-year-old computer hacker had been arrested in Shetland - not by local bobbies but by the plods of the London Metropolitan Police.

The same Met that ignores genuine phone hacking plots and shoots innocent subway commuters. For the Met to be in Shetland arresting "cyber terrorists" suggests a not too subtle attempt to divert attention away from its own internal problems.

The hapless Shetland nerd was instantly whisked off to a cell in London, a display of energy we don't normally associate with Boris Johnson's finest. They've also arrested a 17-year-old in … er, Lincolnshire, citing a global conspiracy to launch debilitating cyber attacks on multinationals and Western intelligence agencies. Move over, al-Qaeda.

Should we be worried by the rise of the teenage hacker? Clearly they are a damned nuisance, especially when they co-ordinate to disrupt credit card payment systems. They did so last year, attacking companies that supposedly had refused services to WikiLeaks, following the latter's publishing of secret US diplomatic cables. Such service denials are gaining in frequency. US authorities arrested 16 people earlier this month following an attack on the PayPal website by a hacking group called (with no originality) Anonymous.

This kind of activity, even if meant as a protest, has results that go beyond the mere prank. Another hacker group, Lulz Security (as in LOL, or "lots of love") thinks of itself as an internet prankster. LulzSec claims to be interested in exposing security flaws in big computer systems. However, it does so by hacking personal data and passwords, and publishing these. Not only is that an assault on individual privacy, it could lead to this information falling into the hands of genuine criminals and fraudsters.

For that reason, it is absolutely necessary to stop the internet being vandalised by hackers. But at the same time, we need to keep a sense of perspective. For a start, the individuals composing groups such as Anonymous and LulzSec are few in number. LulzSec is said to have only six core members. There is no vast conspiracy of nerds tapping away in the wee small hours to bring down civilisation. Mostly, they're too busy playing computer games sold by the sort of global multinational company hackers claim to despise.

It is also important to note that most hackers are not lonely geniuses with an IQ of 170. Hacking is a fairly routine business to learn - just Google "how to hack". You can even do a BSc in hacking at Northumbria University. The ultimate solution to this nuisance is better internet security.Just taking more care with passwords would, say the experts, eliminate 80 per cent of successful hacks.

There is a more strategic threat from interference with the internet, but it does not come from nerds in Shetland. Contrary to the Hollywood myth of a lone hacker in a baseball cap effortlessly accessing America's nuclear arsenal, modern computer systems are too complicated to be taken over by a lone wolf. The threat comes, rather, from those with access to massive electronic and human resources. That means the power of a nation state, not a lone al-Qaeda terrorist in Pakistan.

Despite shrill warnings from Western politicians, there is only one recorded incident of a Jihadist cyber attack, which took place last year. This involved the so-called "here you have" virus, responsibility for which was claimed by the Tariq bin Ziyad Brigades for Electronic Jihad. This unsophisticated software was used to corrupt corporate e-mail systems. For Jihadists, the internet is a recruitment tool more than anything. The real cyber threat comes from China - as a spy tool. On 8 April last year, internet traffic equivalent to as much as 15 per cent of the world's websites was suddenly rerouted via China, when state-owned China Telecom tricked relays from around the globe into routing traffic through its servers for 18 minutes. China is now using hacking on an industrial scale as a cheap way to gather business and intelligence data.

Witness: American military computer networks were hacked six million times in 2006, according to the US National Security Agency. By 2010, there were six million attacks each day. That said, I'm not sure how you could read six million internet documents every day. True, there is evidence of Chinese hacking of specific US military contractors, such as Lockheed Martin last month. But that attack was foiled.

Again, a pinch of sanity is needed. As far as I know, China is not planning to invade London or New York, so does not need to shut down computer-controlled traffic lights in those cities. It is the West that has been using cyber attacks as an offensive weapon. Witness Stuxnet, the planted software worm that instructed uranium centrifuges in Iran to spin out of control and disintegrate.

The potential for cyber warfare - nation to nation - is very real. But we should not allow the politicians to exaggerate its immediate threat. I remain suspicious that the arrest of teenage hackers is a way of creating a climate of political hysteria akin to the Cold War habit of seeing Reds under every bed.

Despite defence cuts, the UK is pumping resources into cyber warfare. Last year's strategic defence review allocated an extra 650million for that purpose. The MoD has created a new Defence Cyber Operations Group, while the Cabinet Office has established an Office of Cyber Security to run the civilian intelligence side.The coalition has also resurrected Labour's Interception Modernisation Programme - a 2billion project to allow GCHQ, our electronic eavesdroppers, to monitor all internet traffic in real time, including Skype.

Last month, David Cameron met with big UK firms including British Airways and BT to persuade them to let GCHQ monitor their systems for hackers. The reassuring message was that GCHQ would look out for unusual network traffic. Big Brother is watching you. Even in Shetland.