Abstract:

This scenario is designed to explore the issues of national indications and warnings against Cyber Attack. The main objective of this scenario is to explore the space of possibilities for Indications and Warnings on a national scale against a wide range of threats with implications ranging from embarrassment to collapse of national governments and economies from around the globe. Time is limited to allow the game to proceed and prevent paralysis by analysis.

Outline

• Roles and Responsibilities
• Background
• Historical Events
• Recent Events
• Over the Last Two Weeks

Roles and Responsibilities

This scenario is played out with two groups in the same room:

• A national command authority / policy group is given one hour to advise the President on what to do.
• A technology advisory group given one hour to decide how to act - if at all - from a technical standpoint.

One point-of-contact person from each group may ask questions and provide answers to the other group.

Groups timeshare in 10-minute slices - on the clock - and all sit together at separate tables in the same room.

Everything is done in front of all participants - so that everyone can listen and take notes in the other team's time slices

Background

Hearth Throb (HT) was founded in 1985 as a secret society dedicated to total freedom of all individuals all around the world.

HT's declared goals are to eliminate the burden of government on the peoples of the world and to distribute total power to the people through the creation of global electronic democracy.

HT has been growing as a secret society over 20 years and has embedded its members in key jobs worldwide.

HT has surreptitiously gathered financial support under religious group and non-profit organizational covers worldwide.

HT was believed to be involved in recent unrest in EU member-states but no firm link has been made to the group

Historical Events

The financial crisis resulting from loss of confidence surrounding the Y2K impact on infrastructures has resulting in a limited global business slow-down and reversed many of the major advances of the late 1990s.

In the 2003 US elections, business-backed political forces gained enough control to start to enact the few last reforms that heavily favored business use of personal information and eliminated the few remaining personal privacy protections in American society.

Similar events took place at different paces in EU and pacific rim countries, particularly those who decided to align with Chinese interests in order to benefit from their emerging economic explosion.

With these outcome, an increasingly disenfranchised group of fringe political organizations have started to express disgruntlement in more vocal, aggressive, and confrontational tactics worldwide.

Recent Events

• Humint from joint intelligence reports around the world indicate that HT is on the verge of a major operation.
• Recent changes in HT message traffic patterns is indicated by technical surveillance, but their use of widely available high-quality cryptosystems has limited available detailed signals intelligence.
• A small number of experimental classified intrusion detection and analysis systems (IDSs) have started to indicate behavioral changes in critical network traffic and usage, but no commercial (COTS) detection systems have sounded alarms or identified changes.
• Based on a hunch, two intelligence analysts started to investigate further and detected some suspicious program codes in one of the COTS IDS systems. One of them was killed in a car accident, and the other has now disappeared from site.

Over the Last Two Weeks

Based on the information provided above - a small group of elder analysts formed an unauthorized cell across several government agencies in several nations, created this roll-up report, and anonymously sent it to the national security council (NSC) or equivalent group in their nation under eyes-only classification.

They conclude that:

• A potentially devastating cyber-attack is imminent.
• Deep moles exist in many global intelligence and key infrastructure roles.
• The potential exists for devastating harm, mass deaths, and anarchy.
• Immediate action is required to address this situation.

Enough detail, supporting information, and independent verification was obtained and included to believe that all of the facts are credible and that these conclusions have merit.

And then...