Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-17 Thread Chris Buckridge
Hi Bill, This is perhaps going off on something of a tangent, but I’m curious where you see this work fitting with the “Digital Geneva Convention” barrow that Microsoft have been pushing for the past few months (since February, I think?). From your description it sounds like it’s at least very

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-16 Thread Nick Hilliard
Malcolm Hutty wrote: > I'm not going to judge the specific work Bill's Working Group is doing, > as I'm not sufficiently sighted. But on the broader issue of whether > this /type/ of engagement is advisable, and Nick's challenge to it, I > would give a qualified "Yes": of course I recognise the ris

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-16 Thread Malcolm Hutty
On 16/11/2017 12:27, Sascha Luck [ml] wrote: > Perhaps, but international law of this type usually speaks to > behaviour in *international* conflicts and completely ignores > 'internal' matters (cf the Hague and Geneva treaties). Oh absolutely. It would have had absolutely zero legal weight in the

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-16 Thread Sascha Luck [ml]
On Thu, Nov 16, 2017 at 12:04:31PM +, Malcolm Hutty wrote: On Nov 15, 2017, at 12:33, Mark Blackman Had there been an international agreement or declaration, of the type that Bill is negotiating, to which the UK was signed up, I would certainly have used it when lobbying that point, and it m

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-16 Thread Malcolm Hutty
> On Nov 15, 2017, at 12:33, Mark Blackman > Are the sort of people who would consider attacking private-sector >> infrastructure the sort of people who will pay any attention to any >> form of globally managed legislation, policy or regulation? Maybe >> you’re proposing this would be a mechanism

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-16 Thread Malcolm Hutty
On 15/11/2017 12:18, Nick Hilliard wrote: > - regarding IXPs specifically, there is little to no basis for > categorising them the vast majority of them as "critical" on the basis > that if you turn an IXP off, or if it fails due to technical or > administrative reasons, traffic will generally re-r

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-16 Thread Johnston, Matt, Vodafone Group
ssage- From: uknof [mailto:uknof-boun...@lists.uknof.org.uk] On Behalf Of Kurt Erik Lindqvist Sent: 16 November 2017 08:05 To: Bill Woodcock Cc: uknof@lists.uknof.org.uk; Nick Hilliard Subject: Re: [uknof] GCSC critical infrastructure protection questions: your input needed. > On 15 Nov 2017,

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-16 Thread Kurt Erik Lindqvist
> On 15 Nov 2017, at 12:22, Bill Woodcock wrote: > > Uh, none of that is relevant to the discussion. Call it pretty > infrastructure or tasty infrastructure or whatever pleases you. > > The question is what types of private-sector infrastructure you most strongly > feel should not be subjec

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Denesh Bhabuta
> On 15 Nov 2017, at 20:03, Mark Blackman wrote: >> On 15 Nov 2017, at 17:10, Bill Woodcock wrote: >>> On Nov 15, 2017, at 1:34 PM, Mark Blackman wrote: >>> Would you say that the current administrations of China, the US and Russia >>> observe diplomatic norms in general? >> Yes, certainly. I

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Mark Blackman
> On 15 Nov 2017, at 17:10, Bill Woodcock wrote: > > > >> On Nov 15, 2017, at 1:34 PM, Mark Blackman wrote: >> Would you say that the current administrations of China, the US and Russia >> observe diplomatic norms in general? > > Yes, certainly. It’s the exceptions that draw attention. W

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Bill Woodcock
> On Nov 15, 2017, at 1:34 PM, Mark Blackman wrote: > Would you say that the current administrations of China, the US and Russia > observe diplomatic norms in general? Yes, certainly. It’s the exceptions that draw attention. Which is exactly the purpose of the norm: to make exceptions notab

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Mark Blackman
> On 15 Nov 2017, at 12:51, Bill Woodcock wrote: > > Not exactly... a diplomatic norm is a commonly-accepted agreement as to > expected behavior. It’s essentially a step short of a treaty. > > The problem here is that the US, Russia, and China all want to preserve their > “right” to cond

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Bill Woodcock
Not exactly... a diplomatic norm is a commonly-accepted agreement as to expected behavior. It’s essentially a step short of a treaty. The problem here is that the US, Russia, and China all want to preserve their “right” to conduct offensive cyber operations against anyone they want, any tim

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Ronan Mullally
On 15 November 2017 at 12:32, Mark Blackman wrote: > > Are the sort of people who would consider attacking private-sector > infrastructure the sort of people who will pay any attention to any form of > globally managed legislation, policy or regulation? Maybe you’re proposing > this would be a

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Mark Blackman
> On 15 Nov 2017, at 12:22, Bill Woodcock wrote: > > Uh, none of that is relevant to the discussion. Call it pretty > infrastructure or tasty infrastructure or whatever pleases you. > > The question is what types of private-sector infrastructure you most strongly > feel should not be subje

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Bill Woodcock
Uh, none of that is relevant to the discussion. Call it pretty infrastructure or tasty infrastructure or whatever pleases you. The question is what types of private-sector infrastructure you most strongly feel should not be subject to governmental cyber attacks. -Bill >

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Nick Hilliard
Bill Woodcock wrote: > One of PCH’s long-term efforts has been to encourage governments to > restrict their use of offensive cyber attacks against civilian > networks. We've successfully gotten that effort out of the U.N., > where it was floundering, and into a well-supported stand-alone > comm

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Bill Woodcock
The norm would say, for instance, “hospitals.” It would be up to the parties involved whether they wanted to try to avail themselves of protection. But that’s a distraction from the issue: do we think [hospitals|schools|the power grid|IXPs|root servers|whatever] should not be cyber-attacked by

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-15 Thread Bill Woodcock
> On Nov 14, 2017, at 10:22 PM, Matthew Ford wrote: > > Bill, > > Presumably the results of this survey will show that, depending on the > ‘sector’ or ‘system’, the degree to which respondents believe they should be > protected varies. How does that help those who might prefer a simpler > a

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-14 Thread Clive D.W. Feather
Matthew Ford said: > Presumably the results of this survey will show that, depending on the > ???sector??? or ???system???, the degree to which respondents believe they > should be protected varies. How does that help those who might prefer a > simpler approach that says that civilian infrastruc

Re: [uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-14 Thread Matthew Ford
Bill, Presumably the results of this survey will show that, depending on the ‘sector’ or ‘system’, the degree to which respondents believe they should be protected varies. How does that help those who might prefer a simpler approach that says that civilian infrastructure should be protected ful

[uknof] GCSC critical infrastructure protection questions: your input needed.

2017-11-14 Thread Bill Woodcock
One of PCH’s long-term efforts has been to encourage governments to restrict their use of offensive cyber attacks against civilian networks. We've successfully gotten that effort out of the U.N., where it was floundering, and into a well-supported stand-alone commission. It’s being taken seriou