On Thursday, several media sites where attacked with a DDoS attack, as well as the web-site of the Swedish police. The Swedish Civil Contingencies Agency (Myndigheten för Samhällsskydd och Beredskap) on Thursday announced that as both the police and the media where attacked at the same time, made the attacks more threatening to society and that they where monitoring the events. If it would have been needed they would have stepped in and co-ordinated the response from the authorities.
This statement scares me, shows how broken the planning in Sweden is and irritates me. All at the same time. Let me explain my views on this (if you haven't already heard them....)
Why was there a risk?
The first thing I react on in the comment above is that MSB clearly thinks that loosing access to media and the police at the same time would be critical. Why?
In reality the issue is that we have no, reliable, trusted and well-known communications channel over the Internet from the government to citizens. Yes, MSB runs the crisis information site, www.krisinformation.se, that is supposed to be this channel. The "only" problem with this site is that it's virtually unknown to any citizen. Unless that changes, and the government is prepared to truly do what it takes to make this known, the site is a waste of tax-payers money. I won't comment on wether I actually think the site works. The design is unknown to me, but given that it's not located at one of the major providers, I don't trust the capacity. Further, I am not an expert on web-building or ASP, but the code to me looks like it both have off-site dependencies as well as database calls.
So given the above, citizens today are forced to turn to media, a multitude of agencies etc to get information. Or forced to, it's the most natural thing to do....
What agency should deal with DDoS attacks
DDoS attacks are a crime. Crimes are investigated by the police, in normal order. This DDoS is no different. If MSB would have done their job properly and provided a well-known information channel, this should just have been any other matter for the police. The Swedish police also have very good resources and knowledgeable people, and are fully capable to deal with this (at least as far as I have seen in the past). In addition, there is the Swedish CERT, SITIC operated by the Post and Telecommnications regulator, that are able to provide assistance, knowledge and operational co-ordination between small operators and the larger ones (the larger ones have better direct co-ordination).
Why is this irritating?
MSB lacks operational knowledge and focus. In the quote above, they say their role is to co-ordinate between the authorities. As far as I know we talk about two authorities, the police and the CERT. Both of whom have excellent contacts. Why do we need a third agency for this? More, an agency that have clearly failed one of their most basic tasks.
This is what scares me. On Thursday, the government also gave MSB the task to come with a plan to protect Sweden against attacks over the Internet. Well, a first task would be to complete the work already given to them. What I don't understand is why this was not given to one of the agencies that are already operationally working on these issues. For example the regulator that have done an excellent job on contingency and resilience on telecom networks. My only guess is rivalry. MSB is part of the department of defence, the police part of the department of justice and the regulator part of the department of industry and trade. So the defence department have no role to play currently. At the same time, Internet attacks are becoming more important and I suspect more budgets are allocated to it. So you need to be part of it to get any money. This is what scares me. Instead of minimizing the people (and hence process and confusion involved) to a minimum and keeping the strategic decisions integrated into the operational roles, we are watching a game of rivalry. Sigh.
