Staying ahead of cyber crooks and terrorists

How much harm can a terrorist do using technology? In today's hyper-connected world, the short answer is: immense.

Imagine a cyber terrorist who kills someone by altering the digital information in a pacemaker.

Or introduces an electronic worm into a nuclear plant that initiates a series of actions that results in disaster.

These forms of cyber attack are possible as long as devices have e-connections.

And the worst of it all is that the virtual attackers are invisible. They can be located anywhere in the world. They can steal data and sell it to people, organisations or even states that have a hostile agenda.

Worst-case scenarios such as those described above are hot topics at security conferences. They also keep executives like Ms Jacqueline Poh, 39, very occupied.

The managing director of the Infocomm Development Authority (IDA) reveals that the Singapore Government faces millions of attempted cyber intrusions every day.

"We must deal with serious breaches and always be alert. In cyber security, if we are more prepared, there's less room for alarm," says Ms Poh.

Sifting through these cyber attempts to attack government websites is a 24/7 job for the IDA's team of security consultants. These full-time employees are the agency's cybercops. They distil the data on the attacks and identify those that are serious and malicious in nature.

Once website defacement is identified, the IDA officers alert the relevant ministries or departments to take action. This can include removing malicious content or taking down the site for rectification.

Spikes in cyber intrusions into government websites often occur when a geo-political issue surfaces in the region. For example, when the haze problem worsened last year, intrusions into public sector websites went up.

Last year, Singapore had a high-profile encounter with cyber attackers when the web pages of the Prime Minister's Office and the Istana were defaced.

In the following weeks, the websites of 13 schools were defaced.

The Singapore Art Museum also reported that data thieves had stolen 4,000 records of people from its database and illegally published the information on a New Zealand-based server.

These attacks prompted Law Minister K. Shanmugam to describe website hacking as "nothing short of terrorism" if lives are endangered. This could happen if hackers target the power grid or disrupt emergency surgery in hospitals, he said.

But, in fact, experts have said those attacks may just be the tip of the iceberg.

Tough to block

There is no guarantee that online assets and information can be protected all the time, says Ms Poh.

"There is a saying that there are only two groups of organisations - those that have been breached and are aware of it, and those who have been breached but are not aware of it," says the petite-sized senior IDA executive.

Her key responsibilities include enhancing cyber security, regulating the telecom market and developing infocomm policies for the Government.

She has more than 14 years' experience in the Administrative Service, having served in the Prime Minister's Office and the ministries of Finance, Defence and Manpower.

Cyber terrorism

Experts say that dealing with the threat of cybercrime is a top priority, and that such crime is potentially as serious as international terrorism or military crises.

Today, terrorists prefer the mass publicity they get when they blow up buildings or people. But security experts stress that it is only a matter of time before they operate anonymously in cyber warfare and attempt to destroy a country's financial, political or defence systems.

The United States Department of Homeland Security has advised the government that US networks should be secured against Al-Qaeda hackers.

Developments in cyber terrorism in Indonesia and elsewhere worry security expert Rohan Gunaratna at the S. Rajaratnam School of International Studies.

In the past two years, terrorists have become very interested in attacking the websites of banks and government departments, he discloses. Cybertheft has become a means of raising money for their cause.

Ms Poh adds that there have also been cyber attacks involving state players.

In 2007, the tiny Baltic state of Estonia, an Internet-savvy country in the European Union, was almost crippled by e-attackers, allegedly orchestrated by Russia. The Russian government denied the charges.

Deluged by a tidal wave of spam, the websites of government ministries, political parties, newspapers, banks and companies were shut down.

"Estonia's online services were disrupted intermittently over a period of three weeks," says Ms Poh.

South Korea has alleged that its neighbour in the North launched more than 6,000 cyber attacks between 2010 and 2013. The economic damage to South Korea was estimated last year at $1.06 billion.

Fixing weak links

To counter cyber attacks and secure the country's cyber environment, the Singapore Government committed $23 million to roll out programmes under a five-year National Cyber Security Masterplan 2018. It was launched last year.

Last month, plans to boost Singapore's pool of infocomm security experts got under way with the launch of a Centre of Excellence by global cyber security firm FireEye. Under an agreement with the IDA, the centre will train and hire more than 100 cyber security professionals over the next two years.

"Holistic solutions to cybercrime are the responsibility of individuals just as much as they are the responsibility of governments and large companies," says Ms Poh.

Simple steps taken by individuals can protect their data. Just as people should lock their houses and cars when they leave them, digital citizens should protect their data by using hard-to-crack passwords. Passwords should be long with unique words and should be changed regularly.

"If you leave your car window open, thieves will steal your cash card or other valuables," she says.

It is a good analogy - for both countries and individuals.

mnirmala@sph.com.sg

This is a weekly series featuring people in the fight against terror.

Get a copy of The Straits Times or go to straitstimes.com for more stories.