The NHS ransom shows the problems with GCHQ's approach to hacking and vulnerabilities, and this must be made clear to MPs who have given them sweeping powers in the IP Act that could result in the same problems recurring in the future.
Here are four points that stand out to us. These issues of oversight relating to hacking capabilities are barely examined in the
Investigatory Powers Act , which concentrates oversight and warrantry on the balance to be struck in targeting a particular person or group,
rather than the risks surrounding the capabilities being developed.
GCHQ and the NSA knew about the problem years ago
Vulnerabilities, as we know from the Snowden documents, are shared between the
NSA and GCHQ, as are the tools built that exploit them. These tools are then used to hack into computer equipment, as a stepping stone to getting to other data. These break ins are at all kinds of companies, sites and groups, who may be entirely
innocent, but useful to the security agencies to get closer to their actual targets.
In this case, the exploit, called ETERNALBLUE was leaked
after a break in this April. It affects Windows XP. It has now been exploited by criminals to ransom organisations still running this software.
While GCHQ cannot be blamed for the NHS's reliance on out of date software, the
decision that the NSA and GCHQ have made in keeping this vulnerability secret, rather than trying to get it fixed, means they have a significant share of the blame for the current NHS ransom.
GCHQ are in charge of hacking us
and protecting us from hackers
GCHQ are normally responsible for 'offensive' operations, or hacking and breaking into other networks. They also have a 'defensive' role, at the
National Cyber Security Centre , which is meant to help organisations like the NHS keep their systems safe from these kinds of breakdown.
GCHQ are therefore forced to trade off their use of secret hacking exploits against the risks these exploits pose to organisations like the NHS.
They have a tremendous conflict of interest, which in ORG's
view, ought to be resolved by moving the UK defensive role out of GCHQ's hands.
Government also needs to have a robust means of assessing the risks that GCHQ's use of vulnerabilities might pose to the rest of us. At the moment,
ministers can only turn to GCHQ to ask about the risks, and we assume the same is true in practice of oversight bodies and future Surveillance Commissioners. The obvious way to improve this and get more independent advice is to split National Cyber
Security Centre from GCHQ.
GCHQ's National Cyber Security Centre had no back up plan
We also need to condemn the lack of action from NCSC and others once the exploit was known to be "lost"
this April. Hoarding vulnerabilities is of course inherently dangerous, but then apparently not having a plan to execute when they are lost is inexcusable. This is especially true given that this vulnerability is obviously capable of being used by
self-spreading malware.
GCHQ are not getting the balance between offence and defence right
The bulk of GCHQ's resources go into offensive capabilities, including hoarding data, analytics and
developing hacking methods. There needs to be serious analysis to see whether this is really producing the right results. This imbalance is likely to remain the case while GCHQ is in charge of both offence and defence, who will always prioritise offence.
Offence has also been emphasised by politicians who feel pressure to defend against terrorism, whatever the cost. Defence--such as ensuring critical national infrastructure like the NHS is protected -- is the poor relation of offensive capabilities.
Perhaps the NHS ransom is the result.
