Category Archives: China Internet Soverignty

中華人民共和國國家信息與情報法草案 // People’s Republic of China DRAFT National Information & Intelligence Law

中華人民共和國國家信息與情報法草案

People’s Republic of China DRAFT National Information & Intelligence Law

A Note on the “National Information Law of the People ‘s Republic of China (Draft)”

First, the general idea of ​​legislation
First, under the guidance of the overall national security concept, adhere to the principle of socialist rule of law, focus on strengthening and safeguarding national intelligence work, respecting and safeguarding human rights, providing basic legal principles and legal basis for national intelligence work.
The second is to sum up the successful experience of China’s national intelligence work, based on the current and future period to carry out the actual needs of national intelligence work, provides the national intelligence work system mechanism, the national intelligence work agency’s authority and national intelligence work and so on.
The third is to deal with the national security law, anti-espionage law, anti-terrorism law and other legal relations, do with these laws convergence.

Second, the main content of the draft
(A) clear the national intelligence work tasks and institutional mechanisms. The draft stipulates that the national intelligence work should adhere to the overall national security concept and provide information for the major national decision-making, provide intelligence support for the prevention and mitigation of the risks that endanger national security, safeguard national power, sovereignty, unity, independence and territorial integrity, people’s well-being and economy Social sustainable development and other significant national interests (Article 2). Establish a sound national reunification, division of labor, scientific and efficient national intelligence system (Article 3). National security organs and public security organs intelligence agencies, military intelligence agencies in accordance with the division of responsibilities, with each other, do intelligence work, carry out intelligence action (Article 5).
(2) to clarify the powers of the State Intelligence Working Party. The drafting regulations stipulate that the national intelligence work agencies shall collect and deal with the organs of foreign institutions, organizations, individuals or implement or direct the financing of others, or the harm that the domestic institutions, organizations and individuals collusion with the overseas institutions, organizations and individuals of the People’s Republic of China Information on interests (Article 10). The national intelligence work agency shall provide information reference or basis (Article 11) for the prevention, suppression and punishment of foreign institutions, organizations and individuals in China to carry out acts that endanger our national security and interests in China. When the staff of the State Intelligence Working Party carry out their tasks according to law, they may go to the relevant authorities, organizations, enterprises and organizations and individuals to understand and inquire about the relevant circumstances, inspect or retrieve the relevant files, materials and articles; enter the relevant areas and places that restrict access; Enjoy the convenience of accommodation (Article 15, Article 16).
(3) to clarify the protection of national intelligence work. The drafting stipulates that the state shall strengthen the construction of the national intelligence work organization and carry out special management of its institutions, personnel, establishment, funds and assets; establish a management system for personnel recruitment, selection, assessment, training, treatment and withdrawal of personnel Nineteen). (Article 21) shall be protected by the staff of the national intelligence working agency and the personnel of the cooperative relationship and their close relatives. For those who contribute to the national intelligence work and need to be resettled, the relevant departments shall assist the national intelligence work agencies to properly resettle (Article 22). The draft also provides for the support and cooperation of citizens and organizations (Article 6, Article 13). Provides for the imposition of national intelligence work, disclosure of legal responsibility for state secrets related to national intelligence work (Article 25, Article 26).
(4) to clarify the norms and supervision of national intelligence work. The draft stipulates that national intelligence work should be carried out in accordance with the law, respect and protect human rights (Article VII). The national intelligence working agencies and their staff shall not go beyond their powers, abuse their power and engage in malpractices for personal gains, and shall not violate the lawful rights and interests of citizens and organizations and shall not disclose state secrets, trade secrets and personal privacy (Article 18). The State Intelligence Working Party shall abide by the relevant provisions of the State when using the necessary means, means and channels (Article 14, Article 15, Article 16 and Article 17). The national intelligence working agency shall establish a supervision and safety review system (Article 23). The draft also stipulates that any individual and organization shall have the right to report to the higher authorities or relevant departments for the violation of the powers, abuse of power, malpractice for personal gains and other offenses against the national intelligence working agencies and their staff members (Article 24).

Original Mandarin Chinese:

關於《中華人民共和國國家情報法(草案)》的說明

一、立法的總體思路
一是以總體國家安全觀為指導,堅持社會主義法治原則,著眼於加強和保障國家情報工作,尊重和保障人權,為國家情報工作提供基本的法律原則和法律依據。
二是總結我國國家情報工作的成功經驗,立足於當前和今後一段時期開展國家情報工作的實際需要,規定了國家情報工作的體制機制、國家情報工作機構的職權以及國家情報工作保障等內容。
三是處理好與國家安全法、反間諜法、反恐怖主義法等法律的關係,做好與這些法律的銜接。
二、草案的主要內容
(一)明確國家情報工作的任務和體制機制。草案規定,國家情報工作堅持總體國家安全觀,為國家重大決策提供情報參考,為防範和化解危害國家安全的風險提供情報支持,維護國家政權、主權、統一、獨立和領土完整、人民福祉、經濟社會可持續發展和國家其他重大利益(第二條)。建立健全集中統一、分工協作、科學高效的國家情報體制(第三條)。國家安全機關和公安機關情報機構、軍隊情報機構按照職責分工,相互配合,做好情報工作、開展情報行動(第五條)。
(二)明確國家情報工作機構的職權。草案規定,國家情報工作機構應當依法蒐集、處理境外機構、組織、個人實施或者指使、資助他人實施,或者境內機構、組織、個人與境外機構、組織、個人相勾結實施的危害中華人民共和國國家安全、利益的相關信息(第十條)。國家情報工作機構應當為防範、制止和懲治境外機構、組織、個人在中國境內實施的危害我國國家安全、利益的行為提供情報參考或依據(第十一條)。國家情報工作機構工作人員依法執行任務時,可以向有關機關、團體、企業事業組織和個人了解、詢問有關情況,查閱或者調取有關的檔案、資料、物品;進入限制進入的有關地區、場所;享受通行便利等(第十五條、第十六條)。
(三)明確國家情報工作保障。草案規定,國家加強國家情報工作機構建設,對其機構設置、人員、編制、經費、資產實行特殊管理;建立適應情報工作需要的人員錄用、選調、考核、培訓、待遇、退出等管理制度(第十九條)。對國家情報工作機構工作人員和有合作關係人員及其近親屬人身安全予以保護(第二十一條)。對為國家情報工作作出貢獻並需要安置的人員,有關部門應當協助國家情報工作機構妥善安置(第二十二條)。草案還規定了公民和組織的支持、配合義務(第六條、第十三條)。規定了阻礙國家情報工作、洩露與國家情報工作有關的國家秘密的法律責任(第二十五條、第二十六條)。
(四)明確對國家情報工作的規範和監督。草案規定,國家情報工作應當依法進行,尊重和保障人權(第七條)。國家情報工作機構及其工作人員不得超越職權、濫用職權、徇私舞弊,不得侵犯公民和組織的合法權益,不得洩露國家秘密、商業秘密和個人隱私(第十八條)。國家情報工作機構使用必要的方式、手段和渠道開展工作時,應當遵守國家有關規定(第十四條、第十五條、第十六條、第十七條)。國家情報工作機構應當建立監督和安全審查制度(第二十三條)。草案還規定了任何個人和組織對國家情報工作機構及其工作人員超越職權、濫用職權、徇私舞弊和其他違法行為,有權向上級機關或者有關部門檢舉、控告(第二十四條)。

 

Original Communist Chinese Government Source:

http://www.npc.gov.cn/COBRS_LFYJNEW/user/UserIndex.jsp?ID=8289337

Full Text of China’s National Cyberspace Security Strategy // 國家網絡空間安全戰略全文

Full Text of China’s National Cyberspace Security Strategy

國家網絡空間安全戰略全文

Beijing,People’s Republic of China

27 DEC 2017

December 27, approved by the Central Network Security and Information Technology Leading Group, the National Internet Information Office released the “national cyberspace security strategy”, the full text is as follows.

The extensive application of information technology and the rise and development of cyberspace have greatly promoted the economic and social prosperity and progress, but also brought new security risks and challenges. Cyberspace security (hereinafter referred to as cybersecurity) concerns the common interests of mankind, related to world peace and development, and national security. Safeguarding China’s network security is an important measure to coordinate and promote the comprehensive construction of a well-off society, comprehensively deepen reform, comprehensively administer the country according to law, and strictly pursue the strategic layout of the party, and realize the goal of “two hundred years” and realize the great rejuvenation of the Chinese nation An important guarantee. In order to implement the “four principles” of promoting the transformation of the global Internet governance system and the “five-point proposition” to build the cyberspace destiny community, we have clarified China’s important position on cyberspace development and security, guided China’s network security work, The state in the cyberspace of sovereignty, security, development interests, the development of this strategy.

First, opportunities and challenges

(A) a major opportunity

With the rapid development of information revolution, Internet, communication network, computer system, automation control system, digital equipment and its application, service and data, such as the network space, is a comprehensive change in people’s production and lifestyle, profound impact on human society Development process.

New channels for information dissemination. The development of network technology, breaking the time and space constraints, expanding the scope of communication, innovative means of communication, triggering a fundamental change in the pattern of communication. The network has become a new channel for people to access information and learn to communicate, and become a new carrier of human knowledge transmission.

Production and life of the new space. In today’s world, the depth of the network into people’s learning, life, work and other aspects of online education, entrepreneurship, health care, shopping, finance and other increasingly popular, more and more people through the network exchange ideas, achievements and dreams.

The new engine of economic development. The Internet is becoming the leading force of innovation-driven development. Information technology is widely used in all sectors of the national economy. It has promoted the upgrading of traditional industries, promoted new technologies, new forms, new industries and new models, promoted the adjustment of economic structure and economic development , For economic and social development has injected new impetus.

Cultural prosperity of the new carrier. The network promotes the cultural exchange and the popularization of knowledge, the release of cultural development vitality, the promotion of cultural innovation creation, the enrichment of people’s spiritual and cultural life, has become a new way to spread culture, provide a new means of public cultural services. Network culture has become an important part of cultural construction.

A new platform for social governance. The role of the network in advancing the national governance system and the modernization of the governance capability has become increasingly prominent. The application of e-government has been deepened, and the government information has been shared and publicized. The government has made scientific decision-making, democratization and rule of law, and has smoothed the channels of citizens’ participation in social governance. An important way to protect citizens’ right to know, to participate, to express and to supervise.

Exchange and cooperation of the new link. The development of information and globalization has promoted the global flow of information, capital, technology, talent and other elements, and promoted the integration of different civilizations. Network to the world into a global village, the international community more and more you have me, I have your fate in the community.

National sovereignty of the new territory. Cyber ​​space has become an important part of human activity with land, sea, sky and space. National sovereignty extension extends to cyberspace, and cyberspace sovereignty becomes an important part of national sovereignty. Respect for cyberspace sovereignty, safeguard network security, seek co-governance, achieve win-win situation, is becoming the international community consensus.

(B) severe challenges

The security situation of the network is becoming more and more serious, the national politics, economy, culture, society, national defense security and the legitimate rights and interests of citizens in cyberspace are facing severe risks and challenges.

Network penetration threatens political security. Political stability is the basic prerequisite for national development and people’s happiness. The use of the network to interfere in the internal affairs of other countries, to attack other countries political system, incite social unrest, subversion of other countries, as well as large-scale network monitoring, network theft and other activities seriously endanger the national political security and user information security.

Network attacks threaten economic security. Network and information systems have become the key infrastructure and the entire economic and social center of the nerve, suffered damage, a major security incident, will lead to energy, transportation, communications, financial and other infrastructure paralysis, resulting in catastrophic consequences, seriously endangering national economic security And public interest.

Network Harmful Information Erosion Cultural Security. Various ideological and cultural networks on the network agitation, confrontation, excellent traditional culture and mainstream values ​​facing the impact. Network rumors, decadent culture and obscenity, violence, superstition and other harmful information contrary to the socialist core values ​​erode the physical and mental health of young people, corrupt the social atmosphere, misleading the value orientation, endangering cultural security. Online moral anomie, the phenomenon of lack of integrity frequent, the degree of network civilization need to be improved.

Network terror and criminals undermine social security. Terrorism, separatism, extremism and other forces to use the network to incite, plan, organize and implement violent terrorist activities, a direct threat to people’s lives and property security, social order. Computer viruses, Trojans and other cyberspace spread spread, cyber-fraud, hacking, infringement of intellectual property rights, abuse of personal information and other illegal acts exist, some organizations want to steal user information, transaction data, location information and business secrets, serious damage to the country , Business and personal interests, affecting social harmony and stability.

The international competition in cyberspace is in the ascendant. International competition and control of cyberspace strategic resources, to seize the right to formulate rules and strategic high ground, to seek strategic competition in the increasingly fierce. Individual countries to strengthen the network deterrence strategy, intensify the cyberspace arms race, world peace by new challenges.

Cyberspace opportunities and challenges coexist, opportunities are greater than challenges. We must insist on active use, scientific development, management according to law, ensure safety, resolutely safeguard network security, make maximum use of cyberspace development potential, and benefit more than 1.3 billion Chinese people for the benefit of all mankind and firm maintenance of world peace.

Second, the goal

With the overall national security concept as the guide, implement the innovation, coordination, green, open and shared development concept, enhance the sense of risk and crisis awareness, the overall situation of domestic and international, overall development of security two major events, active defense, effective response, Promote network space peace, security, openness, cooperation and orderly, safeguard national sovereignty, security, development interests, and realize the strategic goal of building a network power.

Peace: the abuse of information technology has been effectively curbed, cyberspace arms race and other activities threatening international peace have been effectively controlled, cyberspace conflict has been effectively prevented.

Security: network security risks are effectively controlled, the national network security system is sound and perfect, the core technology and equipment are safe and controllable, and the network and information system are stable and reliable. Network security personnel to meet the needs of the whole society of network security awareness, basic protection skills and the use of network confidence greatly improved.

Open: Information technology standards, policies and markets open, transparent, product circulation and information dissemination more smoothly, the digital divide is increasingly bridging. Regardless of size, strength, rich and poor, countries around the world, especially developing countries can share development opportunities, share the fruits of development, fair participation in cyberspace governance.

Cooperation: the world in the technical exchanges, the fight against cyber terrorist and cyber crime and other areas of cooperation more closely, multilateral, democratic and transparent Internet governance system sound and perfect, win-win cooperation as the core of the network space fate community gradually formed.

Order: public interest in the cyberspace, participation, expression, supervision and other legitimate rights and interests are fully protected, cyberspace personal privacy is effectively protected, human rights are fully respected. The network environment of the domestic and international legal system, the standard norms gradually established, the network space to achieve effective management according to law, network environment integrity, civilization, health, freedom of information flow and safeguard national security, public interests to achieve organic unity.

Third, the principle

A safe, stable and prosperous cyberspace is of great significance to all countries and the world. China is willing to work with all countries to strengthen communication, expand consensus, deepen cooperation, and actively promote the global Internet governance system changes, and jointly safeguard the peace and security of cyberspace.

(A) respect for the maintenance of cyberspace sovereignty

Cyberspace sovereignty is inviolable, respect for the independent choice of development path, network management model, Internet public policy and equal participation in international network space management rights. The network affairs within the sovereign scope of each country are made by the people of each country, and each country has the right to take the necessary measures to manage the network activities of its own information system and its own territory according to its own national conditions and draw lessons from international experience, formulate laws and regulations on cyberspace, National information systems and information resources from intrusion, interference, attack and destruction, to protect the legitimate rights and interests of citizens in cyberspace; to prevent, prevent and punish harmful information harmful to national security and interests in the national network to disseminate and maintain cyberspace order. Any country does not engage in network hegemony, do not engage in double standards, do not use the network to interfere in the internal affairs of other countries, do not engage in, condone or support national activities against national security.

(B) the peaceful use of cyberspace

Peaceful use of cyberspace is in the common interest of mankind. States should abide by the principles of the Charter of the United Nations concerning the non-use or threat of use of force and prevent the use of information technology in the context of the maintenance of international security and stability, to boycott cyberspace arms races and prevent cyberspace conflicts. Adhere to mutual respect, equal treatment, seeking common ground while reserving differences, tolerance and mutual trust, respect for each other in cyberspace security interests and major concerns, to promote the construction of a harmonious network world. Against the use of national security as an excuse to use technological advantages to control other countries network and information systems, to collect and steal other countries data, but can not sacrifice the security of other countries to seek their own so-called absolute security.

(C) to manage cyberspace according to law

Comprehensively promote the legalization of cyberspace, adhere to the rule of law network, according to the law network, according to the Internet, so that the Internet in the rule of law on the healthy operation of the track. According to the law to build a good network order, the protection of cyber space information according to the law of free flow, protection of personal privacy, protection of intellectual property rights. Any organization and individual in the cyberspace to enjoy freedom, exercise the rights at the same time, to comply with the law, respect for the rights of others, their own words and deeds on the network.

(4) co-ordinate network security and development

There is no national security without national security, there is no information without modernization. Network security and information is one of the two wings, driven by the two wheels. Correctly handle the development and security of the relationship, adhere to the security development, to promote the development of security. Security is the prerequisite for development, and any development at the expense of security is difficult to sustain. Development is the foundation of security, and development is not the greatest insecurity. No information development, network security is not guaranteed, the existing security and even lost.

Fourth, strategic tasks

China’s Internet users and network size of the world’s first, to maintain China’s network security, not only their own needs, for the maintenance of global network security and world peace are of great significance. China is committed to safeguarding the national cyberspace sovereignty, security, development interests, promote the Internet for the benefit of mankind, and promote the peaceful use of cyberspace and co-governance.

(A) firmly defended cyberspace sovereignty

According to the Constitution and laws and regulations to manage China’s sovereignty within the network activities to protect China’s information facilities and information resources security, including economic, administrative, scientific and technological, legal, diplomatic, military and other measures, unswervingly maintain China’s cyberspace sovereignty. Resolutely oppose all the acts of subverting China’s state power through the Internet and undermining our national sovereignty.

(B) firmly uphold national security

To prevent, stop and punish any act of using the Internet for treason, secession, incitement to rebellion, subversion or incitement to subdue the people’s democratic dictatorship; to prevent, stop and punish the use of the Internet to steal, to disclose state secrets and other acts endangering national security; Prevent, stop and punish foreign forces to use the network to penetrate, destroy, subvert, split the activities.

(Iii) Protection of critical information infrastructures

The key information infrastructure of the country refers to the information facilities that are related to national security, national economy and people’s livelihood, which have been damaged, destroyed or lost, which may seriously endanger the national security and public interests, including but not limited to the provision of public communication, radio and television transmission Information network, energy, finance, transportation, education, scientific research, water conservancy, industrial manufacturing, health care, social security, public utilities and other areas of important information systems, important Internet applications. Take all necessary measures to protect critical information infrastructures and their important data from attack damage. Adhere to the combination of technology and management, protection and deterrence simultaneously, focus on identification, protection, detection, early warning, response, disposal and other aspects, the establishment of the implementation of key information infrastructure protection system, from management, technology, personnel, Comprehensive measures to effectively strengthen the key information infrastructure security protection.

Key information infrastructure protection is the common responsibility of the government, enterprises and society as a whole. The supervisors, the operating units and organizations shall take the necessary measures to ensure the safety of the key information infrastructure in accordance with the requirements of laws, regulations and system standards. Strengthen critical information infrastructure risk assessment. Strengthen the party and government organs and key areas of the site security protection, grassroots party and government organs to build an intensive mode of operation and management. The establishment of government, industry and business network security information orderly sharing mechanism, give full play to enterprises in the protection of key information infrastructure in the important role.

Adhere to open to the outside world, based on open environment to maintain network security. Establish and implement the network security review system, strengthen the supply chain security management, the party and government organs, key industries procurement and use of important information technology products and services to carry out security review, improve product and service security and control, to prevent product service providers And other organizations use information technology to implement unfair competition or harm the interests of users.

(D) to strengthen the construction of network culture

Strengthen the construction of online ideological and cultural positions, vigorously cultivate and practice the socialist core values, the implementation of network content construction projects, the development of a positive network culture, the dissemination of positive energy, gather a strong spiritual strength, and create a good network atmosphere. Encourage the development of new business, create new products, to create the spirit of the times reflect the network culture brand, and constantly improve the network culture industry scale. The implementation of the outstanding culture of Chinese online communication project, and actively promote the excellent traditional culture and contemporary culture of digital, network production and dissemination. Play the advantages of Internet communication platform, promote the excellent cultural exchange between China and foreign countries, so that people understand the Chinese culture, so that the Chinese people understand the excellent culture of all countries, and jointly promote the prosperity and development of network culture, enrich people’s spiritual world and promote the progress of human civilization.

Strengthen the network ethics, network civilization construction, play moral education guide role, with human civilization excellent results nourish network space, repair network ecology. The construction of civilized integrity of the network environment, advocate civilization network, civilized Internet, the formation of safe, civilized and orderly information dissemination order. Resolutely crack down on rumors, obscenity, violence, superstition, cults and other harmful information spread in cyberspace spread. Improve the youth network literacy literacy, strengthen the protection of minors online, through the government, social organizations, communities, schools, families and other aspects of the joint efforts for the healthy growth of young people to create a good network environment.

(5) to combat cyber terror and crime

Strengthen the network anti-terrorism, anti-spy, anti-stealing capacity building, crack down on cyber terror and cyber espionage.

Adhere to comprehensive management, source control, according to the law to prevent, crack down on cyber fraud, Internet theft, trafficking in drug trafficking, infringement of personal information, dissemination of pornography, hacking, infringement of intellectual property rights and other criminal acts.

(6) improve the network management system

Adhere to the law, open, transparent network management network, and effectively do law, according to law, law enforcement must be strict, illegal research. Improve the network security laws and regulations system, enacted network security law, minor network protection regulations and other laws and regulations, a clear social responsibility and obligations, a clear network security management requirements. To speed up the revision and interpretation of existing laws, so that it applies to cyberspace. Improve the network security related system, establish a network trust system, improve the network security management of the scientific standardization level.

Speed ​​up the construction of legal norms, administrative supervision, industry self-discipline, technical support, public supervision, social education, a combination of network governance system to promote the network of social organization and management innovation, improve the basic management, content management, industry management and network crime prevention and combat Work linkage mechanism. Strengthen the cyberspace communication secrets, freedom of speech, trade secrets, as well as the right to reputation, property rights and other legitimate rights and interests of protection.

Encourage social organizations to participate in network governance, the development of network public welfare undertakings, strengthen the new network of social organization. Encourage Internet users to report network violations and bad information.

(7) reinforce the network security foundation

Adhere to innovation-driven development, and actively create a policy environment conducive to technological innovation, co-ordinate resources and strength to enterprises as the main body, combining production and research, collaborative research to point to the surface, the overall advance, as soon as possible in the core technology breakthrough. Attention to software security, accelerate the application of secure and credible products. The development of network infrastructure, rich network space information content. The implementation of “Internet +” action, vigorously develop the network economy. The implementation of national large data strategy, the establishment of large data security management system to support large data, cloud computing and other new generation of information technology innovation and application. Optimize the market environment, encourage network security enterprises bigger and stronger, to protect the national network security and consolidate the industrial base.

Establish and improve the national network security technology support system. Strengthening the basic theory and major problems of network security. Strengthen the network security standardization and certification work, more use of standard norms cyberspace behavior. Do a good job of level protection, risk assessment, vulnerability discovery and other basic work, improve the network security monitoring and early warning and network security emergency response mechanism.

The implementation of network security personnel projects, strengthen the network security professional construction, build first-class network security college and innovation park, the formation of personnel training and innovation and entrepreneurship of the ecological environment. Run the network security publicity week activities, vigorously carry out the national network security publicity and education. Promote the network security education into the teaching materials, into the school, into the classroom, improve the network media literacy, enhance the whole society network security awareness and protection skills, improve the network of Internet users harmful information, network fraud and other illegal and criminal activities identification and resistance.

(8) to enhance the ability of network space protection

Cyberspace is the new territory of national sovereignty. Construction and international status commensurate with the network power to adapt to the network space protection, and vigorously develop the network security and defense means to detect and resist the network invasion, casting and maintenance of national network security strong backing.

(9) to strengthen international cooperation in cyberspace

On the basis of mutual respect and mutual trust, strengthen cooperation in international cyberspace dialogue and promote the transformation of the global governance system of the Internet. Deepen cooperation with the bilateral and multilateral network security dialogue and information communication, effective control of differences, and actively participate in global and regional organizations, network security cooperation, to promote the Internet address, root domain name servers and other basic resource management internationalization.

Support the United Nations to play a leading role in promoting the development of international agreements on cyberspace, international cyberspace international anti-terrorism conventions, and sound legal mechanisms to combat cybercrime, deepening policy and legal, technical innovation, standards, emergency response, critical information infrastructure Protection and other fields of international cooperation.

Strengthen support for assistance in the development of Internet technologies and infrastructure in developing and backward regions, and strive to bridge the digital divide. To promote “along the way” building, improve the level of international communication interoperability, smooth information Silk Road. To build the World Internet Conference and other global Internet sharing system, and jointly promote the healthy development of the Internet. We will build a multilateral, democratic and transparent international Internet governance system through active and effective international cooperation to build a peaceful, safe, open, cooperative and orderly cyberspace.

Original Mandarin Chinese:

12月27日,經中央網絡安全和信息化領導小組批准,國家互聯網信息辦公室發布《國家網絡空間安全戰略》,全文如下。

信息技術廣泛應用和網絡空間興起發展,極大促進了經濟社會繁榮進步,同時也帶來了新的安全風險和挑戰。網絡空間安全(以下稱網絡安全)事關人類共同利益,事關世界和平與發展,事關各國國家安全。維護我國網絡安全是協調推進全面建成小康社會、全面深化改革、全面依法治國、全面從嚴治黨戰略佈局的重要舉措,是實現“兩個一百年”奮鬥目標、實現中華民族偉大復興中國夢的重要保障。為貫徹落實習近平主席關於推進全球互聯網治理體系變革的“四項原則”和構建網絡空間命運共同體的“五點主張”,闡明中國關於網絡空間發展和安全的重大立場,指導中國網絡安全工作,維護國家在網絡空間的主權、安全、發展利益,制定本戰略。

一、機遇和挑戰

(一)重大機遇

伴隨信息革命的飛速發展,互聯網、通信網、計算機系統、自動化控制系統、數字設備及其承載的應用、服務和數據等組成的網絡空間,正在全面改變人們的生產生活方式,深刻影響人類社會歷史發展進程。

信息傳播的新渠道。網絡技術的發展,突破了時空限制,拓展了傳播範圍,創新了傳播手段,引發了傳播格局的根本性變革。網絡已成為人們獲取信息、學習交流的新渠道,成為人類知識傳播的新載體。

生產生活的新空間。當今世界,網絡深度融入人們的學習、生活、工作等方方面面,網絡教育、創業、醫療、購物、金融等日益普及,越來越多的人通過網絡交流思想、成就事業、實現夢想。

經濟發展的新引擎。互聯網日益成為創新驅動發展的先導力量,信息技術在國民經濟各行業廣泛應用,推動傳統產業改造升級,催生了新技術、新業態、新產業、新模式,促進了經濟結構調整和經濟發展方式轉變,為經濟社會發展注入了新的動力。

文化繁榮的新載體。網絡促進了文化交流和知識普及,釋放了文化發展活力,推動了文化創新創造,豐富了人們精神文化生活,已經成為傳播文化的新途徑、提供公共文化服務的新手段。網絡文化已成為文化建設的重要組成部分。

社會治理的新平台。網絡在推進國家治理體系和治理能力現代化方面的作用日益凸顯,電子政務應用走向深入,政府信息公開共享,推動了政府決策科學化、民主化、法治化,暢通了公民​​參與社會治理的渠道,成為保障公民知情權、參與權、表達權、監督權的重要途徑。

交流合作的新紐帶。信息化與全球化交織發展,促進了信息、資金、技術、人才等要素的全球流動,增進了不同文明交流融合。網絡讓世界變成了地球村,國際社會越來越成為你中有我、我中有你的命運共同體。

國家主權的新疆域。網絡空間已經成為與陸地、海洋、天空、太空同等重要的人類活動新領域,國家主權拓展延伸到網絡空間,網絡空間主權成為國家主權的重要組成部分。尊重網絡空間主權,維護網絡安全,謀求共治,實現共贏,正在成為國際社會共識。

(二)嚴峻挑戰

網絡安全形勢日益嚴峻,國家政治、經濟、文化、社會、國防安全及公民在網絡空間的合法權益面臨嚴峻風險與挑戰。

網絡滲透危害政治安全。政治穩定是國家發展、人民幸福的基本前提。利用網絡干涉他國內政、攻擊他國政治制度、煽動社會動亂、顛覆他國政權,以及大規模網絡監控、網絡竊密等活動嚴重危害國家政治安全和用戶信息安全。

網絡攻擊威脅經濟安全。網絡和信息系統已經成為關鍵基礎設施乃至整個經濟社會的神經中樞,遭受攻擊破壞、發生重大安全事件,將導致能源、交通、通信、金融等基礎設施癱瘓,造成災難性後果,嚴重危害國家經濟安全和公共利益。

網絡有害信息侵蝕文化安全。網絡上各種思想文化相互激盪、交鋒,優秀傳統文化和主流價值觀面臨衝擊。網絡謠言、頹廢文化和淫穢、暴力、迷信等違背社會主義核心價值觀的有害信息侵蝕青少年身心健康,敗壞社會風氣,誤導價值取向,危害文化安全。網上道德失範、誠信缺失現象頻發,網絡文明程度亟待提高。

網絡恐怖和違法犯罪破壞社會安全。恐怖主義、分裂主義、極端主義等勢力利用網絡煽動、策劃、組織和實施暴力恐怖活動,直接威脅人民生命財產安全、社會秩序。計算機病毒、木馬等在網絡空間傳播蔓延,網絡欺詐、黑客攻擊、侵犯知識產權、濫用個人信息等不法行為大量存在,一些組織肆意竊取用戶信息、交易數據、位置信息以及企業商業秘密,嚴重損害國家、企業和個人利益,影響社會和諧穩定。

網絡空間的國際競爭方興未艾。國際上爭奪和控製網絡空間戰略資源、搶占規則制定權和戰略制高點、謀求戰略主動權的競爭日趨激烈。個別國家強化網絡威懾戰略,加劇網絡空間軍備競賽,世界和平受到新的挑戰。

網絡空間機遇和挑戰並存,機遇大於挑戰。必須堅持積極利用、科學發展、依法管理、確保安全,堅決維護網絡安全,最大限度利用網絡空間發展潛力,更好惠及13億多中國人民,造福全人類,堅定維護世界和平。

二、目標

以總體國家安全觀為指導,貫徹落實創新、協調、綠色、開放、共享的發展理念,增強風險意識和危機意識,統籌國內國際兩個大局,統籌發展安全兩件大事,積極防禦、有效應對,推進網絡空間和平、安全、開放、合作、有序,維護國家主權、安全、發展利益,實現建設網絡強國的戰略目標。

和平:信息技術濫用得到有效遏制,網絡空間軍備競賽等威脅國際和平的活動得到有效控制,網絡空間衝突得到有效防範。

安全:網絡安全風險得到有效控制,國家網絡安全保障體系健全完善,核心技術裝備安全可控,網絡和信息系統運行穩定可靠。網絡安全人才滿足需求,全社會的網絡安全意識、基本防護技能和利用網絡的信心大幅提升。

開放:信息技術標準、政策和市場開放、透明,產品流通和信息傳播更加順暢,數字鴻溝日益彌合。不分大小、強弱、貧富,世界各國特別是發展中國家都能分享發展機遇、共享發展成果、公平參與網絡空間治理。

合作:世界各國在技術交流、打擊網絡恐怖和網絡犯罪等領域的合作更加密切,多邊、民主、透明的國際互聯網治理體系健全完善,以合作共贏為核心的網絡空間命運共同體逐步形成。

有序:公眾在網絡空間的知情權、參與權、表達權、監督權等合法權益得到充分保障,網絡空間個人隱私獲得有效保護,人權受到充分尊重。網絡空間的國內和國際法律體系、標準規範逐步建立,網絡空間實現依法有效治理,網絡環境誠信、文明、健康,信息自由流動與維護國家安全、公共利益實現有機統一。

三、原則

一個安全穩定繁榮的網絡空間,對各國乃至世界都具有重大意義。中國願與各國一道,加強溝通、擴大共識、深化合作,積極推進全球互聯網治理體系變革,共同維護網絡空間和平安全。

(一)尊重維護網絡空間主權

網絡空間主權不容侵犯,尊重各國自主選擇發展道路、網絡管理模式、互聯網公共政策和平等參與國際網絡空間治理的權利。各國主權範圍內的網絡事務由各國人民自己做主,各國有權根據本國國情,借鑒國際經驗,制定有關網絡空間的法律法規,依法採取必要措施,管理本國信息系統及本國疆域上的網絡活動;保護本國信息系統和信息資源免受侵入、干擾、攻擊和破壞,保障公民在網絡空間的合法權益;防範、阻止和懲治危害國家安全和利益的有害信息在本國網絡傳播,維護網絡空間秩序。任何國家都不搞網絡霸權、不搞雙重標準,不利用網絡干涉他國內政,不從事、縱容或支持危害他國國家安全的網絡活動。

(二)和平利用網絡空間

和平利用網絡空間符合人類的共同利益。各國應遵守《聯合國憲章》關於不得使用或威脅使用武力的原則,防止信息技術被用於與維護國際安全與穩定相悖的目的,共同抵製網絡空間軍備競賽、防範網絡空間衝突。堅持相互尊重、平等相待,求同存異、包容互信,尊重彼此在網絡空間的安全利益和重大關切,推動構建和諧網絡世界。反對以國家安全為藉口,利用技術優勢控制他國網絡和信息系統、收集和竊取他國數據,更不能以犧牲別國安全謀求自身所謂絕對安全。

(三)依法治理網絡空間

全面推進網絡空間法治化,堅持依法治網、依法辦網、依法上網,讓互聯網在法治軌道上健康運行。依法構建良好網絡秩序,保護網絡空間信息依法有序自由流動,保護個人隱私,保護知識產權。任何組織和個人在網絡空間享有自由、行使權利的同時,須遵守法律,尊重他人權利,對自己在網絡上的言行負責。

(四)統籌網絡安全與發展

沒有網絡安全就沒有國家安全,沒有信息化就沒有現代化。網絡安全和信息化是一體之兩翼、驅動之雙輪。正確處理髮展和安全的關係,堅持以安全保發展,以發展促安全。安全是發展的前提,任何以犧牲安全為代價的發展都難以持續。發展是安全的基礎,不發展是最大的不安全。沒有信息化發展,網絡安全也沒有保障,已有的安全甚至會喪失。

四、戰略任務

中國的網民數量和網絡規模世界第一,維護好中國網絡安全,不僅是自身需要,對於維護全球網絡安全乃至世界和平都具有重大意義。中國致力於維護國家網絡空間主權、安全、發展利益,推動互聯網造福人類,推動網絡空間和平利用和共同治理。

(一)堅定捍衛網絡空間主權

根據憲法和法律法規管理我國主權範圍內的網絡活動,保護我國信息設施和信息資源安全,採取包括經濟、行政、科技、法律、外交、軍事等一切措施,堅定不移地維護我國網絡空間主權。堅決反對通過網絡顛覆我國國家政權、破壞我國國家主權的一切行為。

(二)堅決維護國家安全

防範、制止和依法懲治任何利用網絡進行叛國、分裂國家、煽動叛亂、顛覆或者煽動顛覆人民民主專政政權的行為;防範、制止和依法懲治利用網絡進行竊取、洩露國家秘密等危害國家安全的行為;防範、制止和依法懲治境外勢力利用網絡進行滲透、破壞、顛覆、分裂活動。

(三)保護關鍵信息基礎設施

國家關鍵信息基礎設施是指關係國家安全、國計民生,一旦數據洩露、遭到破壞或者喪失功能可能嚴重危害國家安全、公共利益的信息設施,包括但不限於提供公共通信、廣播電視傳輸等服務的基礎信息網絡,能源、金融、交通、教育、科研、水利、工業製造、醫療衛生、社會保障、公用事業等領域和國家機關的重要信息系統,重要互聯網應用系統等。採取一切必要措施保護關鍵信息基礎設施及其重要數據不受攻擊破壞。堅持技術和管理並重、保護和震懾並舉,著眼識別、防護、檢測、預警、響應、處置等環節,建立實施關鍵信息基礎設施保護製度,從管理、技術、人才、資金等方面加大投入,依法綜合施策,切實加強關鍵信息基礎設施安全防護。

關鍵信息基礎設施保護是政府、企業和全社會的共同責任,主管、運營單位和組織要按照法律法規、制度標準的要求,採取必要措施保障關鍵信息基礎設施安全,逐步實現先評估後使用。加強關鍵信息基礎設施風險評估。加強黨政機關以及重點領域網站的安全防護,基層黨政機關網站要按集約化模式建設運行和管理。建立政府、行業與企業的網絡安全信息有序共享機制,充分發揮企業在保護關鍵信息基礎設施中的重要作用。

堅持對外開放,立足開放環境下維護網絡安全。建立實施網絡安全審查制度,加強供應鏈安全管理,對黨政機關、重點行業採購使用的重要信息技術產品和服務開展安全審查,提高產品和服務的安全性和可控性,防止產品服務提供者和其他組織利用信息技術優勢實施不正當競爭或損害用戶利益。

(四)統籌網絡安全與發展

沒有網絡安全就沒有國家安全,沒有信息化就沒有現代化。網絡安全和信息化是一體之兩翼、驅動之雙輪。正確處理髮展和安全的關係,堅持以安全保發展,以發展促安全。安全是發展的前提,任何以犧牲安全為代價的發展都難以持續。發展是安全的基礎,不發展是最大的不安全。沒有信息化發展,網絡安全也沒有保障,已有的安全甚至會喪失。

四、戰略任務

中國的網民數量和網絡規模世界第一,維護好中國網絡安全,不僅是自身需要,對於維護全球網絡安全乃至世界和平都具有重大意義。中國致力於維護國家網絡空間主權、安全、發展利益,推動互聯網造福人類,推動網絡空間和平利用和共同治理。

(一)堅定捍衛網絡空間主權

根據憲法和法律法規管理我國主權範圍內的網絡活動,保護我國信息設施和信息資源安全,採取包括經濟、行政、科技、法律、外交、軍事等一切措施,堅定不移地維護我國網絡空間主權。堅決反對通過網絡顛覆我國國家政權、破壞我國國家主權的一切行為。

(二)堅決維護國家安全

防範、制止和依法懲治任何利用網絡進行叛國、分裂國家、煽動叛亂、顛覆或者煽動顛覆人民民主專政政權的行為;防範、制止和依法懲治利用網絡進行竊取、洩露國家秘密等危害國家安全的行為;防範、制止和依法懲治境外勢力利用網絡進行滲透、破壞、顛覆、分裂活動。

(三)保護關鍵信息基礎設施

國家關鍵信息基礎設施是指關係國家安全、國計民生,一旦數據洩露、遭到破壞或者喪失功能可能嚴重危害國家安全、公共利益的信息設施,包括但不限於提供公共通信、廣播電視傳輸等服務的基礎信息網絡,能源、金融、交通、教育、科研、水利、工業製造、醫療衛生、社會保障、公用事業等領域和國家機關的重要信息系統,重要互聯網應用系統等。採取一切必要措施保護關鍵信息基礎設施及其重要數據不受攻擊破壞。堅持技術和管理並重、保護和震懾並舉,著眼識別、防護、檢測、預警、響應、處置等環節,建立實施關鍵信息基礎設施保護製度,從管理、技術、人才、資金等方面加大投入,依法綜合施策,切實加強關鍵信息基礎設施安全防護。

關鍵信息基礎設施保護是政府、企業和全社會的共同責任,主管、運營單位和組織要按照法律法規、制度標準的要求,採取必要措施保障關鍵信息基礎設施安全,逐步實現先評估後使用。加強關鍵信息基礎設施風險評估。加強黨政機關以及重點領域網站的安全防護,基層黨政機關網站要按集約化模式建設運行和管理。建立政府、行業與企業的網絡安全信息有序共享機制,充分發揮企業在保護關鍵信息基礎設施中的重要作用。

堅持對外開放,立足開放環境下維護網絡安全。建立實施網絡安全審查制度,加強供應鏈安全管理,對黨政機關、重點行業採購使用的重要信息技術產品和服務開展安全審查,提高產品和服務的安全性和可控性,防止產品服務提供者和其他組織利用信息技術優勢實施不正當競爭或損害用戶利益。

(四)加強網絡文化建設

加強網上思想文化陣地建設,大力培育和踐行社會主義核心價值觀,實施網絡內容建設工程,發展積極向上的網絡文化,傳播正能量,凝聚強大精神力量,營造良好網絡氛圍。鼓勵拓展新業務、創作新產品,打造體現時代精神的網絡文化品牌,不斷提高網絡文化產業規模水平。實施中華優秀文化網上傳播工程,積極推動優秀傳統文化和當代文化精品的數字化、網絡化製作和傳播。發揮互聯網傳播平台優勢,推動中外優秀文化交流互鑑,讓各國人民了解中華優秀文化,讓中國人民了解各國優秀文化,共同推動網絡文化繁榮發展,豐富人們精神世界,促進人類文明進步。

加強網絡倫理、網絡文明建設,發揮道德教化引導作用,用人類文明優秀成果滋養網絡空間、修復網絡生態。建設文明誠信的網絡環境,倡導文明辦網、文明上網,形成安全、文明、有序的信息傳播秩序。堅決打擊謠言、淫穢、暴力、迷信、邪教等違法有害信息在網絡空間傳播蔓延。提高青少年網絡文明素養,加強對未成年人上網保護,通過政府、社會組織、社區、學校、家庭等方面的共同努力,為青少年健康成長創造良好的網絡環境。

(五)打擊網絡恐怖和違法犯罪

加強網絡反恐、反間諜、反竊密能力建設,嚴厲打擊網絡恐怖和網絡間諜活動。

堅持綜合治理、源頭控制、依法防範,嚴厲打擊網絡詐騙、網絡盜竊、販槍販毒、侵害公民個人信息、傳播淫穢色情、黑客攻擊、侵犯知識產權等違法犯罪行為。

(六)完善網絡治理體系

堅持依法、公開、透明管網治網,切實做到有法可依、有法必依、執法必嚴、違法必究。健全網絡安全法律法規體系,制定出台網絡安全法、未成年人網絡保護條例等法律法規,明確社會各方面的責任和義務,明確網絡安全管理要求。加快對現行法律的修訂和解釋,使之適用於網絡空間。完善網絡安全相關製度,建立網絡信任體系,提高網絡安全管理的科學化規範化水平。

加快構建法律規範、行政監管、行業自律、技術保障、公眾監督、社會教育相結合的網絡治理體系,推進網絡社會組織管理創新,健全基礎管理、內容管理、行業管理以及網絡違法犯罪防範和打擊等工作聯動機制。加強網絡空間通信秘密、言論自由、商業秘密,以及名譽權、財產權等合法權益的保護。

鼓勵社會組織等參與網絡治理,發展網絡公益事業,加強新型網絡社會組織建設。鼓勵網民舉報網絡違法行為和不良信息。

(七)夯實網絡安全基礎

堅持創新驅動發展,積極創造有利於技術創新的政策環境,統籌資源和力量,以企業為主體,產學研用相結合,協同攻關、以點帶面、整體推進,盡快在核心技術上取得突破。重視軟件安全,加快安全可信產品推廣應用。發展網絡基礎設施,豐富網絡空間信息內容。實施“互聯網+”行動,大力發展網絡經濟。實施國家大數據戰略,建立大數據安全管理制度,支持大數據、雲計算等新一代信息技術創新和應用。優化市場環境,鼓勵網絡安全企業做大做強,為保障國家網絡安全夯實產業基礎。

建立完善國家網絡安全技術支撐體系。加強網絡安全基礎理論和重大問題研究。加強網絡安全標準化和認證認可工作,更多地利用標準規範網絡空間行為。做好等級保護、風險評估、漏洞發現等基礎性工作,完善網絡安全監測預警和網絡安全重大事件應急處置機制。

實施網絡安全人才工程,加強網絡安全學科專業建設,打造一流網絡安全學院和創新園區,形成有利於人才培養和創新創業的生態環境。辦好網絡安全宣傳周活動,大力開展全民網絡安全宣傳教育。推動網絡安全教育進教材、進學校、進課堂,提高網絡媒介素養,增強全社會網絡安全意識和防護技能,提高廣大網民對網絡違法有害信息、網絡欺詐等違法犯罪活動的辨識和抵禦能力。

(八)提升網絡空間防護能力

網絡空間是國家主權的新疆域。建設與我國國際地位相稱、與網絡強國相適應的網絡空間防護力量,大力發展網絡安全防御手段,及時發現和抵禦網絡入侵,鑄造維護國家網絡安全的堅強後盾。

(九)強化網絡空間國際合作

在相互尊重、相互信任的基礎上,加強國際網絡空間對話合作,推動互聯網全球治理體系變革。深化同各國的雙邊、多邊網絡安全對話交流和信息溝通,有效管控分歧,積極參與全球和區域組織網絡安全合作,推動互聯網地址、根域名服務器等基礎資源管理國際化。

支持聯合國發揮主導作用,推動制定各方普遍接受的網絡空間國際規則、網絡空間國際反恐公約,健全打擊網絡犯罪司法協助機制,深化在政策法律、技術創新、標準規範、應急響應、關鍵信息基礎設施保護等領域的國際合作。

加強對發展中國家和落後地區互聯網技術普及和基礎設施建設的支持援助,努力彌合數字鴻溝。推動“一帶一路”建設,提高國際通信互聯互通水平,暢通信息絲綢之路。搭建世界互聯網大會等全球互聯網共享共治平台,共同推動互聯網健康發展。通過積極有效的國際合作,建立多邊、民主、透明的國際互聯網治理體系,共同構建和平、安全、開放、合作、有序的網絡空間。

Original Source: http://politics.people.com.cn/n1/2016/1227/c1001-28980829.html

 

A Summary of China ‘s Internet Security Situation in China in 2016 // 2016年中國中國互聯網安全形勢總結

A Summary of China ‘s Internet Security Situation in China in 2016

2016年中國中國互聯網安全形勢總結

19 APRIL 2017 BEIJING, People’s Republic of China

April 19, the National Computer Network Emergency Technology Processing Coordination Center (referred to as “National Internet Emergency Response Center”, the English referred to as “CNCERT”) released “China’s Internet security situation in 2016,” a review of China’s Internet macro security situation monitoring On the basis of the combination of network security warning and emergency response work, the paper focuses on analyzing and summarizing the Internet security situation of China in 2016 and predicting the hotspot of network security in 2017.

Analysis of Internet Security Monitoring Data in China in 2016

CNCs continued to monitor the macroeconomic situation of China’s cybersecurity. In 2016, the number of mobile Internet malicious programs was captured, the number of backdoor attacks and the number of security vulnerabilities were increased compared with 2015, and the number of Trojans and botnets was denied. Quantity, phishing and page tampering the number of pages have declined.

According to the sampling monitoring, about 70,000 Trojans and botnet control servers in 2016 control 1699 million hosts in our country, the number of control servers decreased by 8.0% compared with 2015, the number of domestic infection host decreased by 14.1% compared with 2015. The Among them, about 48,000 from outside the control server control of China’s 1499 million units in the host, from the United States the number of control servers in the first place, followed by Hong Kong, China and Japan.

In the botnet found in the detection of malicious programs and the formation of botnets, the size of more than 100 hosts in the number of botnets 4896, of which the size of more than 100,000 units in the number of botnets 52. According to the quantitative analysis of the distribution of Trojans and botnets in China, the top three were Guangdong Province (13.4% of the total number of infections in China), Jiangsu Province (9.2%) and Shandong Province (8.3 %). In order to effectively control the damage caused by the host of Trojans and botnets, in 2016, under the guidance of the Ministry of Industry and Information Technology, under the guidance of “Trojan and botnet monitoring and disposal mechanism”, CNCERT organization basic telecommunications companies, domain name service agencies, etc. successfully closed 1011 Control the larger botnets.

In 2016, CNCERT received more than 205 million mobile Internet malpractions through autonomous capture and vendor switching, an increase of 39.0% over 2015, and continued to maintain rapid growth in the past seven years. According to their malicious behavior classification, the top three were hooliganism, malicious deductions and tariff consumption class 1, accounting for 61.1%, respectively, 18.2% and 13.6%. CNCERT found that mobile Internet malicious program download links nearly 670,000, an increase of nearly 1.2 times compared with 2015, involving more than 22 million source of the source, IP address of more than 30,000, the number of malicious programs spread to 124 million times.

In 2016, CNCERT focused on the “album” category 2 Andrews and malicious pornographic software with malicious deductions and maliciously disseminated attributes that were spread by SMS and had malicious behavior such as stealing user messages and correspondence, and coordinated work The A total of 47,316 cases of such malicious programs were found in the year, and more than 1.01 million were collected, and 6045 domain names were used to disseminate malicious programs. 7645 malicious mailbox accounts for receiving user’s text messages and contacts were used to receive user text messages Malicious mobile phone number 6616, leaked users SMS and address book mail 222 million, seriously endangering the user’s personal information security and property security. Under the guidance of the Ministry of Industry and Information Technology, according to the “mobile Internet malicious program monitoring and disposal mechanism”, CNCERT organization of e-mail service providers, domain name registrar and other active coordination work to find the malicious mailbox account, malicious domain name, etc. Dispose of.

Second, 2016 China’s Internet security situation

In recent years, with China’s network security laws and regulations, management system of continuous improvement, China’s network security technology strength, personnel, international cooperation, and achieved remarkable results. In 2016, China’s Internet security situation is generally stable, the rapid development of network security industry, network security and protection capabilities have been improved, international cooperation to further strengthen the network security. But with cyberspace strategically

The increasing number of countries, the world’s major countries have set up cyberspace attack capability, the growing national network conflict, China’s cyberspace security challenges facing increasingly complex.

Domain name system security in good condition, anti-attack ability increased significantly. In 2016, China’s domain name service system security in good condition, no major security incidents. According to the sampling monitoring, 2016 years for China’s domain name system traffic scale of more than 1Gpbs DDoS attacks on the daily average of about 32 cases, did not affect the domain name resolution services in China, the basic telecommunications companies have not seriously affected the success rate of analysis Attack events, mainly with the domain name system to strengthen security measures, anti-DDoS attack ability significantly improved related. In June 2016, there were large-scale DDoS attacks against the global root domain name servers and their mirrors. Most of the root domain servers were affected to varying degrees. The domain name mirroring servers in China also suffered large-scale network traffic attacks at the same time. Due to emergency treatment in a timely manner, and the root zone top-level domain cache expiration time is often more than 1 day, the attack did not affect the domain name system network security.

For the industrial control system of network security attacks increasing, many important industrial control system security incidents should pay attention. In 2016, the world occurred more than the major areas of industrial accidents worthy of our country wake up. In August, Kaspersky Security Laboratories exposed the “ghoul” network attack against the industrial sector, which focused on the Middle East and other countries’ Industrial enterprises launched a targeted network intrusion; in December, the Ukrainian power grid once again experienced a power supply failure, according to the analysis of the origin of this malpractice “dark forces” variants.

China’s industrial control system is huge, security vulnerabilities, malicious detection, etc. to our industrial control system to bring some security risks. As of the end of 2016, CNVD included 1036 industrial malpractices, of which 173 were included in 2016, an increase of 38.4% over 2015. Industrial control system mainly exists buffer overflow, lack of access control mechanism, weak password, directory traversal and other loopholes risk. Through the analysis of network traffic, 2016 CNCERT cumulative monitoring to the network of industrial equipment fingerprint detection event more than 880,000 times, and found 60 countries from outside the 1610 IP address of China’s network of industrial equipment for fingerprint detection.

High-level persistent threat normalization, China’s attack is particularly serious threat. As of the end of 2016, domestic enterprises issued a senior Sustainability Threat (APT) study reported a total of 43 APT organizations, including targeted targets for China’s APT organizations have 36 4. From the attack to achieve the point of view, more APT attacks using engineering to achieve, that is, relying on commercial attack platform and the Internet black industry

Chain data and other mature resources to achieve APT attacks. This kind of attack not only reduces the technical and resource threshold of initiating APT attack, but also increases the difficulty of traceability analysis. In 2016, many of the important information system for the implementation of the APT attacks were exposed, including “white elephant action 5”, “Man Linghua attack action”, mainly in China’s education, energy, military and scientific research as the main target The In August 2016, the hacker organization “Shadow Brokers” published the Formula Organization 6 frequently used toolkits, including various firewall exploits, hacking tools and scripts involving Juniper, Flying Tower, Cisco, and Financial letter, Huawei and other manufacturers products. CNCERT released 11 software vulnerabilities (there are four suspected 0day vulnerability) for census analysis and found that the world has about 120,000 IP addresses carrying the relevant products of network equipment, of which China’s IP address of about 33,000, accounting for 27.8% of all IP addresses poses a serious potential threat to cyberspace security in China. In November 2016, the hacker organization “shadow broker” also announced a group has been attacked by the National Security Agency network control and IP address and domain name data, China is the most attacked countries, involving at least nine universities in China, 12 Energy, aviation, telecommunications and other important information systems departments and two government information centers.

A large number of networked smart devices were attacked by malicious programs to form botnets, which were used to initiate large traffic DDoS attacks. In recent years, with the intelligent wearable equipment, intelligent home, intelligent routers and other terminal equipment and network equipment, the rapid development and popularization, for the Internet of intelligent devices, the proportion of network attacks increased, the attackers use the Internet of things intelligent device vulnerabilities Access to device control rights, or other hacker underground transactions for user information data theft, network traffic hijacking, or for controlling the formation of large-scale botnets. CNCERT on-line monitoring of vehicle network security system analysis and found that some car network information service providers and related products, security vulnerabilities can lead to vehicle, location and vehicle owners information disclosure and vehicle remote control and other security risks. At the end of 2016, Mirai malicious programs were widely watched as a result of large-scale off-site events on the east coast of the United States and a large number of users of Deutsche Telekom visited Internet anomalies. Mirai is a typical use of Internet of things intelligent device vulnerabilities to penetrate infiltration to achieve the control of the device malicious code, the number of charged devices accumulated to a certain extent will form a huge “botnet”, known as “Mirai botnet.” And because of Internet of things intelligent devices are generally 24 hours online, infected with malicious programs are not easily perceived by the user, forming a “stable” attack source. CNC inspections of the Mirai botnet show that by the end of 2016, a total of 2526 control servers were deployed to control 125.4 million devices, which posed a serious potential security threat to the stable operation of the Internet. In addition, CNCERT also analyzed the Gafgyt botnet sampling analysis. In the fourth quarter of 2016, a total of 817 control servers were selected to control 425,000 devices, and more than 18,000 DDoS attacks were initiated, with peak traffic 5Gpbs more than 72 times the number of attacks.

Web site data and personal information leak is not uncommon, “derivative disaster” serious. Due to the disappearance of the traditional boundaries of the Internet, all kinds of data spread across the terminal, network, mobile phone and cloud, coupled with the interests of the Internet black industry chain driven by data leakage threats are increasing. In 2016, the domestic and international website data and personal information leakage incidents frequently, the political, economic and social impact gradually deepened, and even personal life safety has also been violated. In the United States, the United States election candidate Hillary’s mail leak, directly affect the US election process; Yahoo two account information disclosure involving about 1.5 billion personal accounts, resulting in US telecom operators Verizon $ 4.8 billion acquisition of Yahoo plans to shelve May even be canceled. In the country, China’s immune planning system network was malicious invasion, 200,000 children’s information was stolen and publicly sold online; information leakage led to frequent fraud cases, college entrance examination information leaks to take away the university students will soon enter the life of Xu Yuyu ; 2016 public security organs were detected more than 1,800 cases of infringement of personal information, seized 30 million pieces of personal information of various types of citizens. In addition, according to the news media reported that Russia, Mexico, Turkey, the Philippines, Syria, Kenya and other countries of the government website data leaked.

Mobile Internet malicious program more profitable, mobile Internet black industry chain has matured. In 2016, CNCERT received more than 205 million mobile Internet malpractions through autonomous capture and vendor exchange, up 39.0% from 2015 and continued to grow at a high rate in the past six years. Through malware behavior analysis, it was found that the number of applications for fraudulent, malicious deductions, lockdowns and other economic interests was 59.6% of the total number of malicious programs, nearly three times over 2015. From the spread of malicious programs found that fraudulent acts of fraudulent procedures mainly through SMS, advertising and network disk and other specific communication channels to spread, the number of infected users reached 24.93 million, causing significant economic losses. From the attack mode of malicious programs, it is found that the number of malicious programs that steal SMS verification codes is larger than that of SMS, and 10845 samples are obtained in the whole year. It shows the characteristics of simple production, fixed attack mode and huge profits. The mobile Internet industry Mature.

Extortion software raging, a serious threat to local data and intelligent equipment security. According to CNCERT monitoring found in 2016 in the traditional PC side, to capture extortion class malicious program sample of about 19,000, the number of a record high in recent years. Analysis of extortion software attack object found that extortion software has been gradually extended from the individual terminal equipment to business users, especially for high-value target blackmail situation

Heavy. For enterprise users, blackmail software exploits security vulnerabilities to attack, the enterprise database encryption and extortion, the end of 2016 open source MongoDB database was a blackmail software attacks, a large number of users affected. For personal terminal equipment, extortion software malicious behavior in the traditional PC and mobile terminals show obvious different characteristics: in the traditional PC side, mainly through the “encrypted data” to blackmail, that is, the user’s computer file encryption, stress users Purchase the decryption key; on the mobile side, mainly through the “encryption device” to blackmail, that is, remote lock the user mobile devices, so that users can not use the device, and to coerce users to pay the cost of unlocking. However, from the extortion of software transmission point of view, the traditional PC and mobile side show a common, mainly through e-mail, counterfeit normal application, QQ group, network disk, paste it, victims and other spread.

Three, 2017 worthy of attention to the hot spots

According to the analysis of the characteristics of China’s Internet security situation in 2016, CNCERT predicts that the hot spots that are worthy of attention in 2017 are as follows.

(A) cyberspace according to the law of governance more clear. On November 7, 2016, the Twenty-fourth Session of the Standing Committee of the 12th National People’s Congress passed the “Network Security Law” and came into effect on June 1, 2017. The Act has 7 chapters and 79 articles on cyberspace sovereignty, network products and service providers ‘security obligations, network operators’ safety obligations, personal information protection rules, critical information infrastructure security protection systems and important data cross-border transmission rules, etc. Has been clearly defined. It is expected that the departments will pay more attention to the propaganda and interpretation work of the “Network Security Law” in 2017, compile relevant supporting policies and regulations, implement various supporting measures, and make cyberspace according to law more clear.

(B) the use of Internet of things intelligent device network attacks will continue to increase. 2016 CNVD collection of intelligent networking equipment vulnerabilities 1117, mainly related to web cameras, intelligent routers, smart appliances, intelligent gateway and other equipment. The vulnerability type is mainly privilege to bypass, information disclosure, command execution, etc., which weak password (or built-in default password) vulnerability is easy to be used, the actual impact is very extensive, malicious code attack to use an important risk point. With the development of unmanned aerial vehicles, autopilot vehicles, the popularity of smart home appliances and the development of smart cities, the number of vulnerabilities in networked smart devices will increase significantly, and network attacks against or using intelligent networking devices will be more frequent.

(C) the Internet and the traditional industry integration caused by the security threat is more complex. With the deepening of China’s “Internet +” and “Made in China 2025” action plan, almost all traditional industries, traditional applications and services in China are being changed by the Internet, bringing innovation and development opportunities to various industries. In the process of integration innovation and development, the traditional industry closed mode gradually changed to open mode, but also the future of the Internet virtual network security events into real-world security threats. Internet finance, industrial Internet and other emerging industries rapid development, but triggered a new network security threats can not be ignored, the Internet financial integration of information flow and capital flow, the risk of information flow is likely to lead to loss of capital flow; industrial control system more For the intelligent, network, open Internet brings malicious sniffing behavior increased, the risk of malicious attacks continue to increase. Traditional Internet security and real-world security issues intertwined with the security threat is more complex, the consequences are more serious.

(D) personal information and important data protection will be more attention. In recent years, the development of Internet technology is extremely convenient and rich in our lives and work, online shopping, online job search, social platform, government services and other platforms are filled with a large number of personal detailed privacy information. Since 2011, China’s serious personal information on the leak of the event, especially in recent years, the case of network fraud, the victim’s details have been grasped by fraud, to social stability and serious harm. 2013 “Snowdon incident” and the follow-up of the US government has been a large-scale monitoring of the project, to stimulate countries to strengthen the protection of important data measures, strict norms of Internet data collection, use, storage and so on. China in the “Network Security Law” on the personal information protection rules, important data cross-border transmission has been clearly defined, is expected on personal information and important data protection of the detailed regulatory documents will be enacted, and effectively implement the protection measures.

(5) Network security threats Information sharing has attracted the attention of all parties. Timely comprehensive access to and analysis of network security threats, ahead of network security early warning and deployment of emergency response measures, fully embodies a national network security comprehensive defense capabilities. Through the network security threat information sharing, the use of collective knowledge and technical ability, is to achieve a comprehensive grasp of the network security threats an effective way. The United States as early as 1998 in the Clinton administration signed a presidential decree to encourage the government and enterprises to carry out network security information sharing, to the Obama administration is the network security information sharing is written into the government bill. In recent years, China attaches great importance to the work of network security information sharing, in the “Network Security Law” clearly put forward to promote the relevant departments, key information infrastructure operators and the relevant research institutions, network security services and other network security information sharing The However, in the face of complex and multi-dimensional data source information, how to carry out sharing and in-depth analysis efficiently, we need to establish a set of information security standards for network security threats based on large data analysis. At present, many organizations in our country have been engaged in the exploration and practice of information sharing of network security threats. The relevant national standards and industry standards have been formulated. CNCERT has also established a network security threat information sharing platform for sharing in the communication industry and security industry. jobs.

(6) the background of the network disputes will continue to heat up the degree of concern. At present, China’s Internet penetration rate has reached 53.2% 7, the public through the Internet to get the news more and more fast and convenient, people concerned about the global political hot spots are also rising. 2016 US presidential election “mail door” incident, the Russian hacker exposure of the World Anti-Doping Agency scandal, etc., allow netizens to feel organized, purposeful careful network attacks can have a serious impact on the politics of other countries, Will have a national background of the network disputes from the perspective of industry concerns extended to all Internet users. With a large number of countries continue to strengthen the network space military capacity building, there are national background of the network dispute event will be hot, the crisis frequently, the trend of popular discussion will continue to heat up.

(7) based on artificial intelligence network security technology research in full swing. In the third World Internet Conference, “World Internet leading technology results release activities” site, Microsoft, IBM, Google three major international technology giants show machine learning based on artificial intelligence technology, for us to describe a beautiful future of artificial intelligence. At present, the network attack events are endless, the means are complex, the purpose is complex, the shortage of network security personnel is difficult to cope with the rapid changes in the network security situation, and machine learning in the field of data analysis outstanding performance, artificial intelligence is considered in the network security will “Great as”. There are statistical agencies found that the 2016 “network security” and “artificial intelligence” co-appeared in the article the frequency of rapid rise, indicating that more and more discussions will be linked together with the two together. Based on the large data related to network security, artificial intelligence technology such as machine learning can make breakthrough progress in unknown threat discovery, network behavior analysis and network security warning.

Original Mandarin Chinese:

4月19日消息,國家計算機網絡應急技術處理協調中心(簡稱“國家互聯網應急中心”,英文簡稱“CNCERT”)發布《2016年我國互聯網網絡安全態勢綜述》,在對我國互聯網宏觀安全態勢監測的基礎上,結合網絡安全預警通報、應急處置工作實踐成果,著重分析和總結了2016年我國互聯網網絡安全狀況,並預測2017年網絡安全熱點問題。
一、2016年我國互聯網網絡安全監測數據分析
CNCERT持續對我國網絡安全宏觀狀況開展抽樣監測,2016年,移動互聯網惡意程序捕獲數量、網站後門攻擊數量以及安全漏洞收錄數量較2015年有所上升,而木馬和殭屍網絡感染數量、拒絕服務攻擊事件數量、網頁仿冒和網頁篡改頁面數量等均有所下降。
據抽樣監測,2016年約9.7萬個木馬和殭屍網絡控制服務器控制了我國境內1699萬餘台主機,控制服務器數量較2015年下降8.0%,境內感染主機數量較2015年下降了14.1%。 。其中,來自境外的約4.8萬個控制服務器控制了我國境內1499萬餘台主機,來自美國的控制服務器數量居首位,其次是中國香港和日本。
在監測發現的因感染惡意程序而形成的殭屍網絡中,規模在100台主機以上的殭屍網絡數量4896個,其中規模在10萬台以上的殭屍網絡數量52個。從我國境內感染木馬和殭屍網絡主機按地區分佈數量分析來看,排名前三位的分別是廣東省(占我國境內感染數量的13.4%)、江蘇省(佔9.2%)和山東省(佔8.3 %)。為有效控制木馬和殭屍網絡感染主機引發的危害,2016年,在工業和信息化部指導下,根據《木馬和殭屍網絡監測與處置機制》,CNCERT組織基礎電信企業、域名服務機構等成功關閉1011個控制規模較大的殭屍網絡。
2016年,CNCERT通過自主捕獲和廠商交換獲得移動互聯網惡意程序數量205萬餘個,較2015年增長39.0%,近7年來持續保持高速增長趨勢。按其惡意行為進行分類,前三位分別是流氓行為類、惡意扣費類和資費消耗類1,佔比分別為61.1%、18.2%和13.6%。 CNCERT發現移動互聯網惡意程序下載鏈接近67萬條,較2015年增長近1.2倍,涉及的傳播源域名22萬餘個、IP地址3萬餘個,惡意程序傳播次數達1.24億次。
2016年,CNCERT重點對通過短信傳播,且具有竊取用戶短信和通信錄等惡意行為的“相冊”類2安卓惡意程序及具有惡意扣費、惡意傳播屬性的色情軟件進行監測,並開展協調處置工作。全年共發現此類惡意程序47316個,累計感染用戶超過101萬人,用於傳播惡意程序的域名6045個,用於接收用戶短信和通訊錄的惡意郵箱賬戶7645個,用於接收用戶短信的惡意手機號6616個,洩露用戶短信和通訊錄的郵件222萬封,嚴重危害用戶個人信息安全和財產安全。在工業和信息化部指導下,根據《移動互聯網惡意程序監測與處置機制》,CNCERT組織郵箱服務商、域名註冊商等積極開展協調處置工作,對發現的惡意郵箱賬號、惡意域名等進行關停處置。
二、2016年我國互聯網網絡安全狀況
近年來,隨著我國網絡安全法律法規、管理制度的不斷完善,我國在網絡安全技術實力、人才隊伍、國際合作等方面取得了明顯的成效。 2016年,我國互聯網網絡安全狀況總體平穩,網絡安全產業快速發展,網絡安全防護能力得到提升,網絡安全國際合作進一步加強。但隨著網絡空間戰略地
位的日益提升,世界主要國家紛紛建立網絡空間攻擊能力,國家級網絡衝突日益增多,我國網絡空間面臨的安全挑戰日益複雜。
域名系統安全狀況良好,防攻擊能力明顯上升。 2016年,我國域名服務系統安全狀況良好,無重大安全事件發生。據抽樣監測,2016年針對我國域名系統的流量規模達1Gpbs以上的DDoS攻擊事件日均約32起,均未對我國域名解析服務造成影響,在基礎電信企業側也未發生嚴重影響解析成功率的攻擊事件,主要與域名系統普遍加強安全防護措施,抗DDoS攻擊能力顯著提升相關。 2016年6月,發生針對全球根域名服務器及其鏡像的大規模DDoS攻擊,大部分根域名服務器受到不同程度的影響,位於我國的域名根鏡像服務器也在同時段遭受大規模網絡流量攻擊。因應急處置及時,且根區頂級域緩存過期時間往往超過1天,此次攻擊未對我國域名系統網絡安全造成影響。
針對工業控制系統的網絡安全攻擊日益增多,多起重要工控系統安全事件應引起重視。 2016年,全球發生的多起工控領域重大事件值得我國警醒。 3月,美國紐約鮑曼水壩的一個小型防洪控制系統遭攻擊;8月,卡巴斯基安全實驗室揭露了針對工控行業的“食屍鬼”網絡攻擊活動,該攻擊主要對中東和其他國家的工業企業發起定向網絡入侵;12月,烏克蘭電網再一次經歷了供電故障,據分析本次故障緣起惡意程序“黑暗勢力”的變種。
我國工控系統規模巨大,安全漏洞、惡意探測等均給我國工控系統帶來一定安全隱患。截至2016年年底,CNVD共收錄工控漏洞1036條,其中2016年收錄了173個,較2015年增長了38.4%。工控系統主要存在緩衝區溢出、缺乏訪問控制機制、弱口令、目錄遍歷等漏洞風險。通過對網絡流量分析發現,2016年度CNCERT累計監測到聯網工控設備指紋探測事件88萬餘次,並發現來自境外60個國家的1610個IP地址對我國聯網工控設備進行了指紋探測。
高級持續性威脅常態化,我國面臨的攻擊威脅尤為嚴重。截止到2016年底,國內企業發布高級持續性威脅(APT)研究報告共提及43個APT組織,其中針對我國境內目標發動攻擊的APT組織有36個4。從攻擊實現方式來看,更多APT攻擊採用工程化實現,即依托商業攻擊平台和互聯網黑色產業
鏈數據等成熟資源實現 APT攻擊。這類攻擊不僅降低了發起APT攻擊的技術和資源門檻,而且加大了受害方溯源分析的難度。 2016年,多起針對我國重要信息系統實施的APT攻擊事件被曝光,包括“白象行動5”、“蔓靈花攻擊行動”等,主要以我國教育、能源、軍事和科研領域為主要攻擊目標。 2016年8月,黑客組織“影子經紀人(Shadow Brokers)”公佈了方程式組織6經常使用的工具包,包含各種防火牆的漏洞利用代碼、黑客工具和腳本,涉及Juniper、飛塔、思科、天融信、華為等廠商產品。 CNCERT對公佈的11個產品漏洞(有4個疑似為0day漏洞)進行普查分析,發現全球有約12萬個IP地址承載了相關產品的網絡設備,其中我國境內IP地址有約3.3萬個,佔全部IP地址的27.8%,對我國網絡空間安全造成嚴重的潛在威脅。 2016年11月,黑客組織“影子經紀人”又公佈一組曾受美國國家安全局網絡攻擊與控制的IP地址和域名數據,中國是被攻擊最多的國家,涉及我國至少9所高校,12家能源、航空、電信等重要信息系統部門和2個政府部門信息中心。
大量聯網智能設備遭惡意程序攻擊形成殭屍網絡,被用於發起大流量DDoS攻擊。近年來,隨著智能可穿戴設備、智能家居、智能路由器等終端設備和網絡設備的迅速發展和普及利用,針對物聯網智能設備的網絡攻擊事件比例呈上升趨勢,攻擊者利用物聯網智能設備漏洞可獲取設備控制權限,或用於用戶信息數據竊取、網絡流量劫持等其他黑客地下產業交易,或用於被控制形成大規模殭屍網絡。 CNCERT對車聯網系統安全性進行在線監測分析,發現部分車聯網信息服務商及相關產品存在安全漏洞,可導致車輛、位置及車主信息洩露和車輛被遠程控制等安全風險。 2016年底,因美國東海岸大規模斷網事件和德國電信大量用戶訪問網絡異常事件,Mirai惡意程序受到廣泛關注。 Mirai是一款典型的利用物聯網智能設備漏洞進行入侵滲透以實現對設備控制的惡意代碼,被控設備數量積累到一定程度將形成一個龐大的“殭屍網絡”,稱為“Mirai殭屍網絡”。又因物聯網智能設備普遍是24小時在線,感染惡意程序後也不易被用戶察覺,形成了“穩定”的攻擊源。 CNCERT對Mirai殭屍網絡進行抽樣監測顯示,截至2016年年底,共發現2526台控制服務器控制了125.4萬餘台物聯網智能設備,對互聯網的穩定運行形成了嚴重的潛在安全威脅。此外,CNCERT還對Gafgyt殭屍網絡進行抽樣檢測分析,在2016年第四季度,共發現817台控制服務器控制了42.5萬台物聯網智能設備,累計發起超過1.8萬次的DDoS攻擊,其中峰值流量在5Gpbs以上的攻擊次數高達72次。
網站數據和個人信息洩露屢見不鮮,“衍生災害”嚴重。由於互聯網傳統邊界的消失,各種數據遍布終端、網絡、手機和雲上,加上互聯網黑色產業鏈的利益驅動,數據洩露威脅日益加劇。 2016年,國內外網站數據和個人信息洩露事件頻發,對政治、經濟、社會的影響逐步加深,甚至個人生命安全也受到侵犯。在國外,美國大選候選人希拉里的郵件洩露,直接影響到美國大選的進程;雅虎兩次賬戶信息洩露涉及約15億的個人賬戶,致使美國電信運營商威瑞森48億美元收購雅虎計劃擱置甚至可能取消。在國內,我國免疫規劃系統網絡被惡意入侵,20萬兒童信息被竊取並在網上公開售賣;信息洩露導致精準詐騙案件頻發,高考考生信息洩露間接奪去即將步入大學的女學生徐玉玉的生命;2016年公安機關共偵破侵犯個人信息案件1800餘起,查獲各類公民個人信息300億餘條。此外,據新聞媒體報導,俄羅斯、墨西哥、土耳其、菲律賓、敘利亞、肯尼亞等多個國家政府的網站數據發生了洩漏。
移動互聯網惡意程序趨利性更加明確,移動互聯網黑色產業鏈已經成熟。 2016年,CNCERT通過自主捕獲和廠商交換獲得移動互聯網惡意程序數量205萬餘個,較2015年增長39.0%,近6年來持續保持高速增長趨勢。通過惡意程序行為分析發現,以誘騙欺詐、惡意扣費、鎖屏勒索等攫取經濟利益為目的的應用程序驟增,佔惡意程序總數的59.6%,較2015年增長了近三倍。從惡意程序傳播途徑發現,誘騙欺詐行為的惡意程序主要通過短信、廣告和網盤等特定傳播渠道進行傳播,感染用戶數達到2493萬人,造成重大經濟損失。從惡意程序的攻擊模式發現,通過短信方式傳播竊取短信驗證碼的惡意程序數量佔比較大,全年獲得相關樣本10845個,表現出製作簡單、攻擊模式固定、暴利等特點,移動互聯網黑色產業鏈已經成熟。
敲詐勒索軟件肆虐,嚴重威脅本地數據和智能設備安全。根據CNCERT監測發現,2016年在傳統PC端,捕獲敲詐勒索類惡意程序樣本約1.9萬個,數量創近年來新高。對敲詐勒索軟件攻擊對象分析發現,勒索軟件已逐漸由針對個人終端設備延伸至企業用戶,特別是針對高價值目標的勒索情況嚴
重。針對企業用戶方面,勒索軟件利用安全漏洞發起攻擊,對企業數據庫進行加密勒索,2016年底開源MongoDB數據庫遭一輪勒索軟件攻擊,大量的用戶受到影響。針對個人終端設備方面,敲詐勒索軟件惡意行為在傳統PC端和移動端表現出明顯的不同特點:在傳統PC端,主要通過“加密數據”進行勒索,即對用戶電腦中的文件加密,脅迫用戶購買解密密鑰;在移動端,主要通過“加密設備”進行勒索,即遠程鎖住用戶移動設備,使用戶無法正常使用設備,並以此脅迫用戶支付解鎖費用。但從敲詐勒索軟件傳播方式來看,傳統PC端和移動端表現出共性,主要是通過郵件、仿冒正常應用、QQ群、網盤、貼吧、受害者等傳播。
三、2017年值得關注的熱點
根據對2016年我國互聯網網絡安全形勢特點的分析,CNCERT預測2017年值得關注的熱點方向主要如下。
(一)網絡空間依法治理脈絡更為清晰。 2016年11月7日第十二屆全國人大常委會第二十四次會議表決通過《網絡安全法》,並將於2017年6月1日起施行。該法有7章79條,對網絡空間主權、網絡產品和服務提供者的安全義務、網絡運營者的安全義務、個人信息保護規則、關鍵信息基礎設施安全保護製度和重要數據跨境傳輸規則等進行了明確規定。預計2017年各部門將更加重視《網絡安全法》的宣傳和解讀工作,編制出台相關配套政策法規,落實各項配套措施,網絡空間依法治理脈絡將更為清晰。
(二)利用物聯網智能設備的網絡攻擊事件將繼續增多。 2016年CNVD收錄物聯網智能設備漏洞1117個,

(三)互聯網與傳統產業融合引發的安全威脅更為複雜。隨著我國“互聯網+”、“中國製造2025”行動計劃的深入推進,我國幾乎所有的傳統行業、傳統應用與服務都在被互聯網改變,給各個行業帶來了創新和發展機會。在融合創新發展的過程中,傳統產業封閉的模式逐漸轉變為開放模式,也將以往互聯網上虛擬的網絡安全事件轉變為現實世界安全威脅。互聯網金融、工業互聯網等融合的新興行業快速發展,但引發的新的網絡安全威脅也不容忽略,互聯網金融整合了信息流和資金流,信息流的風險很可能引發資金流損失;工業控制系統更為智能化、網絡化,開放互聯帶來的惡意嗅探行為增多,被惡意攻擊的風險不斷加大。傳統互聯網安全與現實世界安全問題相交織引發的安全威脅更為複雜,產生的後果也更為嚴重。
(四)個人信息和重要數據保護將更受重視。近年來,互聯網技術的發展極大的方便和豐富了我們的生活和工作,網上購物、網上求職、社交平台、政府服務等平台上充斥著大量的個人詳細隱私信息。自2011年以來我國關於嚴重個人信息洩露的事件不絕於耳,特別是近年來的網絡詐騙案件中,受害人的詳細信息都被詐騙分子所掌握,給社會安定帶來嚴重危害。 2013年 “斯諾登事件”及後續相繼爆出的美國政府大範圍監聽項目,刺激著各國加強重要數據的保護措施,嚴格規範互聯網數據的收集、使用、存儲等。我國在《網絡安全法》中對個人信息保護規則、重要數據跨境傳輸進行了明確規定,預計關於個人信息和重要數據信息保護的詳細規範性文件將製定出台,切實落實保護措施。
(五)網絡安全威脅信息共享工作備受各方關注。及時全面獲取和分析網絡安全威脅,提前做好網絡安全預警和部署應急響應措施,充分體現了一個國家網絡安全綜合防禦能力。通過網絡安全威脅信息共享,利用集體的知識和技術能力,是實現全面掌握網絡安全威脅情況的有效途徑。美國早在1998年的克林頓政府時期就簽署了總統令,鼓勵政府與企業開展網絡安全信息共享,到奧巴馬政府時期更是將網絡安全信息共享寫入了政府法案。近年來,我國高度重視網絡安全信息共享工作,在《網絡安全法》中明確提出了促進有關部門、關鍵信息基礎設施的運營者以及有關研究機構、網絡安全服務機構等之間的網絡安全信息共享。但面對紛繁複雜的、多維度的數據源信息,如何高效地開展共享和深入分析,需建立一套基於大數據分析的網絡安全威脅信息共享標準。目前,我國很多機構已經在開展網絡安全威脅信息共享的探索與實踐,相關國家標準和行業標準已在製定中,CNCERT也建立了網絡安全威脅信息共享平台,在通信行業和安全行業內進行相關共享工作。
(六)有國家背景的網絡爭端受關注度將繼續升溫。目前,我國互聯網普及率已經達到53.2%7,民眾通過互聯網獲得的新聞資訊越來越快捷方便,民眾關注全球政治熱點的熱度也不斷高漲。 2016年美國總統大選“郵件門”事件、俄羅斯黑客曝光世界反興奮劑機構醜聞事件等,都讓網民真切感受到有組織、有目的的一場縝密的網絡攻擊可以對他國政治產生嚴重的影響,將有國家背景的網絡爭端從行業領域關注視角延伸到了全體網民。隨著大量的國家不斷強化網絡空間軍事能力建設,有國家背景的網絡爭端事件將會熱點不斷、危機頻出,全民討論的趨勢將會持續升溫。
(七)基於人工智能的網絡安全技術研究全面鋪開。在第三屆世界互聯網大會“世界互聯網領先科技成果發布活動”現場,微軟、IBM、谷歌三大國際科技巨頭展示了基於機器學習的人工智能技術,為我們描繪了人工智能美好的未來。目前,網絡攻擊事件層出不窮、手段多樣、目的複雜,較為短缺的網絡安全人才難以應對變化過快的網絡安全形勢,而機器學習在數據分析領域的出色表現,人工智能被認為在網絡安全方面將會“大有作為”。有研究機構8統計發現,2016年“網絡安全”與“人工智能”兩詞共同出現在文章中的頻率快速上升,表明越來越多的討論將二者聯繫在一起共同關注。以網絡安全相關的大數據為基礎,利用機器學習等人工智能技術,能夠在未知威脅發現、網絡行為分析、網絡安全預警等方面取得突破性進展。

中國軍事戰雲 ~ Chinese Military Use of the Battle Cloud

中國軍事戰雲 ~ Chinese Military Use of the Battle Cloud

“Cloud” is a metaphor of the network, the Internet, “cloud concept” is one of the hottest high-tech concept in recent years, its Internet, efficient, shared and other characteristics, not only profound impact and change our lives, Is also promoting major changes in the military field. In 2013, the US Air Force for the first time the “cloud concept” into the field of operations, put forward the “operational cloud” concept, and quickly get the US Department of Defense, Navy and other military recognition, and gradually become the US military response to the 21st century, a new information war Strategy.

Why –

Intended to build the new US military superiority

In the 21st century, the US military has launched a number of wars in Afghanistan, Iraq, Libya and Syria in the name of anti-terrorism and the suppression of the proliferation of weapons of mass destruction. Every time the war is almost entirely dominated by powerful information and firepower, Quickly won the war. But the US military has a clear sense of this: the above war a few US military did not encounter a truly strong opponent, the war in the United States to grasp the absolute air power and the right to information under the low confrontation environment, the future if the loss of absolute space and information advantages , The US military will be difficult to maintain control of the battlefield. The US military believes that if you want to maintain a sustained battlefield advantage in future wars, facing an unprecedented “threat and challenge”:

Rival strong “anti-entry / regional denial” threat. The US military believes that its information in previous local wars, the advantages of firepower, mainly rely on a strong space-based information systems, large-scale maritime combat platform, joint command and control center, etc., and in the “opponents into the area and the ability to continue Enhance the “background, especially in the face of a large number of” precision-guided long-range cruise missiles and ballistic missiles “threat, these traditional strengths and the strength of the US military to rely on these forces formed by the combat style” will not be renewed, “” opponents Can be a small number of key nodes through the attack quickly paralyzed US military combat power system.

The Challenges of Advanced Combat Weapons and Backward Combat. In the new century, after a large number of equipment F-22 advanced stealth fighters, the US military has ushered in F-35 fighters, DDG-1000 missile destroyers, Ford-class aircraft carrier and other highly informative weapons and equipment. But the appearance of the US military command and control, but also remain in the 2003 “free Iraq” action, highly dependent on satellite, early warning aircraft and other core equipment platform “network-centric war” era. Former US Air Force Secretary Mike Wayne exclaimed: “Just as the use of the 20th century mechanized forces in the First World War was fighting in the 19th century, we now have the danger of fighting in the twentieth century in the twentieth century. “The US military in urgent need of new operational theory to activate the new information technology equipment combat potential,” to regain the US military and rival superiority. ”

Combat power to maintain the challenges with the defense budget tightening. In the United States “financial crisis” “debt crisis” and “national security needs continue to grow” and other factors, the US military arms are also caught in financial dilemma. In the same report, the US Air Force is mainly from the old A-10, F-15/16, B-1, B-1, the first deputy chief of staff, 52 aircraft and B-2 and a small number of F-22, F-35, not enough to meet the opponent’s “anti-entry and regional denial” capabilities, and called to “change strategy” to deal with “available for defense resources The proportion of decline “challenge.

These “threats and challenges” that the US military consider themselves are the context of the concept of “operational cloud”.

Core concept –

To achieve a variety of platforms cross-domain joint operations

In the face of these new “threats and challenges”, in January 2013, the US Air Force Air Combat Command Commander Michael Ostić first proposed the “operational cloud” concept program. In 2014, David de Putura on its basis, the “operational cloud” concept of a comprehensive program, pointed out: “similar to the way cloud computing, ‘combat cloud’ is a kind of military air force use Decentralized air combat, in the evolution of the data chain, anti-jamming communication systems and new targeting tools to support the realization of the air, ground, sea and space field information sharing capabilities jump, and thus maximize the stealth aircraft, accurate Combat weapons, advanced command and control systems, and the combined use of unmanned systems to create large, modular and flexible combat capabilities to ensure that enemies’ attacks on single combat units will not paralyze US operations.

In the same year, the United States “Aviation Week” released a “operational cloud” concept map, described by the orbital space reconnaissance / communications / navigation satellites, airborne early warning aircraft, F-15/16 fighter, maritime aviation battle group, and in-depth integrated air defense system F-22/35 stealth fighter, RQ-180 unmanned reconnaissance aircraft, new long-range bomber (LRS-B) and other multi-dimensional combat unit, jointly build the “air superiority cloud” development prospects, more clearly show the US military “combat Cloud “concept of the whole picture.

From the above US military interpretation and description of the concept of “operational cloud”, we can roughly analyze the characteristics of the US military “operational cloud” and its basic ideas to deal with “threats and challenges”

Battlefield information cross – domain integration. “Combat cloud” relying on “evolving data link, anti-jamming communication system” and other advanced battlefield information network, and “new targeting tool” and other new battlefield sensor system, large data and cloud computing and other information network technology support , Will be widely distributed in space, near the space, air, ground, sea and underwater combat platform of the battlefield intelligence information integration, and real-time seamless operation in the various areas of the platform on-demand distribution. “Combat cloud” formed by the “information sharing capabilities”, both to ensure that the US military on the battlefield on demand is highly transparent, but also to avoid the “anti-entry / regional denial” ability of opponents, its space-based information system , Large-scale maritime combat platform, joint command and control center and other key information nodes “break a little, paralysis of a” situation. The US military envisages that in the “battle cloud” system, the absence of any one or more battlefield nodes will not decisively influence the sharing and distribution of information on the unity of its battlefield.

Group strength distribution operations. With the traditional combat forces of the air forces according to the platform attribute classification allocation, according to the administrative means of combining different ways, “combat cloud” through the “continuous evolution of the data chain, anti-jamming communication system”, the arms of the air force to ” Decentralized air combat form “, according to real-time task requirements, online optimization configuration combination, the formation of” modular “group strength. Each group of forces in a highly integrated cross-domain integration of information support, through the “operational cloud” system of efficient scheduling and control, distribution operations. This group of forces distribution mode of operation, not only inherited the “network-centric war” to obtain the advantages of information, and further developed from the information to the fire distribution, target damage transformation advantages, significantly reduced the combat ” – Review “cycle chain, comprehensively enhance the combat effectiveness of US military information equipment.

Cross – platform platform synergies. Through the “battle cloud” battlefield information cross-domain integration capabilities, three generations of four generations of combat platform to gain dive into the enemy of the five generations of stealth combat platform, unmanned combat platform target information, to achieve an effective blow to the depth of the battlefield; But also to get three generations of four generations of combat platform for long-range fire support, to make up for their own lack of volatility. “Combat cloud” of this inter-generation platform synergies, is considered the US military to deal with “power and financial dilemma” an important means. In September 2014, the outgoing Michael Ostić at the annual meeting of the American Air Force Association made it clear that the US Air Force did not have enough budget to form a full five fleet, to fulfill the role of the Air Force, the highest priority The task is to achieve the “four generations and five generations” of information fusion, collaborative operations.

Development status –

Is changing from concept to actual action

As soon as possible to the “operational cloud” concept program into a practical state, in the United States Department of Defense co-ordination and traction, the US military arms and arms are in line with their own military functions and equipment characteristics, to promote their own “combat cloud” project construction and experiment verification.

Ministry of Defense steadily traction “cloud” infrastructure and conceptual improvement. As early as 2009, the US Department of Defense proposed a concept of data sharing at sea, air and space, and tried to apply the increasingly sophisticated Internet technology to tactical intelligence. In July 2012, the US Department of Defense Chief Information Officer signed the “Ministry of Defense cloud computing strategy” to the military strategy in the form of advancing the process, and continued to carry out “cloud” related storage facilities, computing platform and software services. At present, the US Department of Defense has identified this concept as a “war cloud”, and from the arms and arms, industrial sector and academia deployed personnel, work together to create a perfect “combat cloud” concept program, the ultimate goal is to form an arch Data network, expansion and upgrading of the existing “global information grid” to achieve the maritime warships, combat aircraft, space satellite real-time data sharing.

Each army and arms competing to carry out “combat cloud” project construction. The Air Force is the pioneer of the concept of “operational cloud”, which argues that the key to achieving the “operational cloud” is information fusion and the focus of the “Sky Advantage Cloud” on F-15/16 and F-22/35 Five generations of information on the exchange of information. In 2014, the “Multi-Domain Adaptive System (MAPS) Program” was launched to attempt to integrate the F16-16 Link16 data link, the F-22 IFDL data link, and the F-35’s MADL data link to achieve battlefield data Real-time exchange. US Navy also through the “Naval Integrated Fire Control and Air Defense (NIFC-CA) program” to achieve its use of air E-2D early warning aircraft or sea “Aegis” ship and other combat platforms for the F / A-18E / F and F- 35C and other carrier-based aircraft and the “standard” series of ship-to-air missiles to provide targeted information, and even command the future of the sixth generation F / A-XX multi-purpose fighter aircraft to launch weapons vision. Although the Navy project is not called “combat cloud” due to military interests, the project emphasizes multi-platform information cross-domain integration has a typical “cloud” features. In addition, the US Marine Corps also launched the implementation of its “expeditionary combat sea tactical cloud” project construction.

“Combat cloud” combat mode test verification has been in full swing. September 23, 2014, the US Air Force F-22 for the first time led the joint air raid fleet, the Syrian territory of the “Islamic countries” extreme organizational goals of air strikes. After the completion of the task, when the US Air Operations Commander Mike Hustage in an interview with “defense headlines”, said, “generally believed that stealth is a symbol of the five generations of machines, in fact, the focus is on ‘integration’,” Fusion “makes the F-22 fundamentally different from other platforms,” ​​”Fusion” is the fundamental feature of the five generations of machines, “” Five generations of machines in front of reconnaissance detection targets, and then let four generations of machines in the area to fight it, you must have ‘combat Cloud ‘, which has the ability to transfer data back and forth. ” The position, but also directly proved that the US Air Force is actively against the “combat cloud” combat mode to carry out actual test verification.

(Author: Air Force Military Theory Institute)

Edit comments

Jump on the “cloud” end of the wind and thunder

Huyongbo

When we shop online, the website will be based on the previous shopping records to determine our purchase preferences, push a lot of commodity information; when we browse the news, the software will be based on our reading habits, “good” Directional push content topic … … these phenomena are that we have come to a cloud computing era.

“Combat cloud” reason to enter our topic vision, not only because it frequently appeared in the latest US combat theory, everywhere revealed against the “system of combat” thinking, more importantly, it represents the US military cloud computing used in the field of military the latest achievements, reflecting the US military use of scientific and technological achievements to maximize the effectiveness of combat a train of thought.

Like many high-tech, cloud computing first appeared in the commercial field. In August 2006, Google CEO Eric Schmidt first proposed the “cloud computing” concept. Soon, the US military on this new technology showed a strong interest. In 2008, the US Department of Defense and Hewlett-Packard Company to establish a cloud computing infrastructure. Then, the United States air, sea, land and other military services are signed with commercial companies related to cloud computing systems. The US military’s passion for cloud computing has a strong background in the field of information technology, but it also reflects their keen sense of smell and rapid transformation of the latest cutting-edge technology.

In attending the plenary session of the PLA delegation at the Second Session of the 12th National People’s Congress, the Chairman stressed that “it is necessary to take the initiative to discover, cultivate and use the cutting-edge technology that can serve the national defense and army building to capture the potential growth point of military capability development”. Obviously, to promote the field of cloud computing military and civilian collaboration innovation, we are promising. Because, compared to the United States and other developed countries in the field of cloud computing development, China is not backward, some domestic companies have a more mature use of experience. The key is how to combine our military reality, to achieve the transformation of cloud computing technology in the military field.

Of course, we develop the use of cloud computing technology, we must learn from the experience of foreign troops, but not step by step also cloning. The practice of the US military is only to provide a model used. In the era of information revolution boom, through the core key technological breakthrough is possible to achieve “corner overtaking”. Dare to hit the water flow, Fang Xian hero character.

Original Mandarin Chinese:

“雲”是對網絡、互聯網的一種比喻說法,“雲概念”則是近年來最火的高科技概念之一,其互聯、高效、共享等特質,不但深刻影響和改變著我們的生活,也正在推動軍事領域的重大變革。 2013年,美空軍首次將“雲概念”引入作戰領域,提出“作戰雲”概念,並迅速得到美國防部、海軍及其他軍種的認可,逐漸成為美軍應對21世紀下一場信息化戰爭的新方略。

緣何提出——

意在打造美軍新的跨代優勢

進入21世紀,美軍先後以反恐和製止大規模殺傷性武器擴散等名義在阿富汗、伊拉克、利比亞和敘利亞發動多場戰爭,每次戰爭美國幾乎都憑藉強大的信息、火力優勢,完全掌控戰場局面,快速取得戰爭勝利。但美軍高層對此有著清醒意識:以上幾場戰爭美軍並未遇到真正強大的對手,戰爭在美軍掌握絕對製空權和製信息權的低對抗環境下進行,未來倘若喪失絕對的空天和信息優勢,美軍將很難保持對戰場的控制。美軍認為,若想在未來戰爭中保持持續的戰場優勢,面臨著前所未有的“威脅和挑戰”:

對手強大“反進入/區域拒止”能力的威脅。美軍認為,其在歷次局部戰爭中所仰仗的信息、火力優勢,主要依托強大的天基信息系統、大型海上作戰平台、聯合指揮控制中心等獲得,而在“對手反進入與區域拒止能力不斷提升”的背景下,尤其是面對大量“精確制導遠程巡航導彈和彈道導彈”威脅,這些傳統的優勢力量,以及美軍依托這些優勢力量所形成的作戰樣式“都將不可續存”,“對手可以通過對少數關鍵節點的攻擊迅速癱瘓美軍的作戰力量體系”。

先進作戰武器與落後作戰方式的挑戰。進入新世紀,在大量裝備F-22先進隱身戰機後,美軍又先後迎來F-35戰機、DDG-1000導彈驅逐艦、福特級航母等高度信息化武器裝備。但綜觀美軍的作戰指揮與控制,還停留在2003年“自由伊拉克”行動時,高度依賴衛星、預警機等核心裝備平台的“網絡中心戰”時代。美國前空軍部長麥克·韋恩就驚呼:“正如第一次世界大戰使用20世紀的機械化部隊卻在以19世紀的方式作戰,我們現在同樣存在以20世紀的方式在21世紀作戰的危險。 ”美軍急需新的作戰理論來激活新型信息化裝備的作戰潛能,“重拾美​​軍與對手的跨代優勢”。

作戰力量保持與國防預算緊縮的挑戰。在美國“金融危機”“債務危機”和“國家安全需求不斷增長”等多重因素影響下,美軍各軍兵種也陷入財政窘境。美空軍前情報主管、第一副參謀長大衛·德普圖拉在一份報告中指出,目前美軍空中力量主要由老舊的A-10、F-15/16、B-1、B- 52飛機和B-2以及少量的F-22、F-35組成,不足以應對21世紀對手的“反進入與區域拒止”能力,並呼籲要“改變方略”以應對“可用於國防的資源比重下降”的挑戰。

美軍自認為的這些“威脅和挑戰”,正是其提出“作戰雲”概念的背景。

核心理念——

實現多種平台跨域聯合作戰

面對這些新的“威脅和挑戰”,2013年1月,美空軍空中作戰司令部司令邁克爾·奧斯蒂奇首次提出“作戰雲”概念方案。 2014年,大衛·德普圖拉在其基礎上,對“作戰雲”概念方案進行了全面闡述,指出:“類似於雲計算的方式,’作戰雲’是一種各軍種的空中力量採用分散的空中作戰形式,在不斷進化的數據鏈、抗干擾通信系統和新的瞄準工具等支持下,實現空中、地面、海上和太空領域信息共享能力的躍升,進而最大程度地發揮隱身飛機、精確打擊武器、先進指揮與控制系統以及有人與無人系統結合的優勢,創造出規模化、模塊化的靈活作戰能力,並以此確保敵人對單一作戰單元的攻擊不會癱瘓美軍的作戰行動。”

同年,美國《航空周刊》發布了“作戰雲”構想圖,描述了由在軌太空偵察/通信/導航衛星,空中預警機、F-15/16戰鬥機,海上航空戰鬥群,與深入對方綜合防空系統區的F-22/35隱身戰機、RQ-180無人偵察機、新型遠程轟炸機(LRS-B)等多維作戰單元,共同構建的“空中優勢雲”發展遠景,更加清晰地展現了美軍“作戰雲”概念全貌。

從以上美軍對於“作戰雲”概念的闡釋和描述,我們可以粗略探析美軍“作戰雲”的特徵和其應對“威脅和挑戰”的基本思路:

戰場信息跨域融合。 “作戰雲”依托“不斷進化的數據鏈、抗干擾通信系統”等先進的戰場信息網絡,和“新的瞄準工具”等新型戰場傳感系統,在大數據和雲計算等信息網絡技術的支撐下,將廣泛分佈於太空、臨近空間、空中、地面、海上和水下各域作戰平台的戰場情報信息一體融合,並實時無縫地在各域作戰平台按需分發。 “作戰雲”所形成的這種“信息共享能力”,既保證了美軍對戰場的按需高度透明,同時也避免了具備“反進入/區域拒止”能力的對手,對其天基信息系統、大型海上作戰平台、聯合指揮控制中心等關鍵信息節點“破一點、癱一片”的局面。美軍設想,在“作戰雲”體系中,任何一個和多個戰場節點的缺失,都不會決定性地影響其戰場統一態勢信息的共享和分發。

群組力量分佈作戰。與傳統作戰各軍兵種空中力量按平台屬性分類編配、按行政手段組合的方式不同,“作戰雲”通過“不斷進化的數據鏈、抗干擾通信系統”,將各軍兵種的空中力量以“分散的空中作戰形式”,根據實時任務需求,在線優化配置組合,形成“模塊化”的群組力量。各群組力量在高度一體跨域融合的信息支撐下,通過“作戰雲”體系的高效調度和管控,分佈實施作戰。這種群組力量分佈作戰的模式,既繼承了“網絡中心戰”獲取信息的優勢,又進一步發展了從信息向火力分配、目標毀傷轉化的優勢,大幅縮減了作戰的“偵-控-打-評”週期鏈,全面提升了美軍信息化裝備的作戰效能。

跨代平台協同增效。通過“作戰雲”的戰場信息跨域融合能力,三代四代作戰平台能夠獲得潛入敵縱深的五代隱身作戰平台、無人作戰平台的目標指示信息,實現對縱深戰場的有效打擊;五代隱身作戰平台也能夠獲得三代四代作戰平台的遠程火力支援,彌補自身載彈量不足的劣勢。 “作戰雲”的這種跨代平台協同增效,被認為是美軍應對“力量與財務困局”的重要手段。 2014年9月,即將離任的邁克爾·奧斯蒂奇在美國空軍協會年會上明確表示,美國空軍沒有足夠的預算來組建一支全五代機隊,要履行好空軍的職能,最優先的任務是實現“四代與五代”的信息融合、協同作戰。

發展現狀——

正在由概念向實戰行動轉變

為盡快地將“作戰雲”概念方案轉化到實用狀態,在美國防部的統籌和牽引下,美軍各軍兵種都在結合自身軍種職能和裝備特色,推進自己的“作戰雲”項目建設和實驗驗證。

國防部穩步牽引“雲”基礎建設和概念完善。早在2009年,美國防部就提出了覆蓋海上、空中、太空的數據共享概念,嘗試將日益成熟的互聯網技術應用到戰術情報領域。 2012年7月,美國防部首席信息官簽署了《國防部雲計算戰略》,以軍隊戰略的形式推進這一進程,並持續穩步開展“雲”相關的存儲設施、計算平台和軟件服務建設。目前,美國防部已將這一概念確定為“作戰雲”,並分別從各軍兵種、工業部門和學術界抽調人員,共同著力塑造完善“作戰雲”概念方案,最終目標是要形成一個拱形數據網絡,擴展升級現有“全球信息柵格”,實現海上戰艦、作戰飛機、空間衛星的實時數據共享。

各軍兵種爭相開展“作戰雲”項目建設。美空軍是“作戰雲”概念的先行者,其認為實現“作戰雲”的關鍵是信息融合,並將“空中優勢雲”的重點放在F-15/16等四代機與F-22/35五代機的信息互通上。 2014年啟動了“多域自適應系統(MAPS)計劃”,企圖將F-15/16的Link16數據鏈、F-22的IFDL數據鏈、F-35的MADL數據鏈有機融合,實現戰場數據的實時交換。美海軍也在通過“海軍綜合火控與防空(NIFC-CA)計劃”,實現其用空中E-2D預警機或海上“宙斯盾”艦等作戰平台,為F/A-18E/F和F- 35C等艦載機及“標準”系列艦空導彈提供瞄准信息,甚至指揮未來第六代F/A-XX多用途戰鬥機發射武器的願景。雖然由於軍種利益,海軍項目並不叫“作戰雲”,但其項目強調的多平台信息跨域融合具有典型的“雲”特徵。此外,美海軍陸戰隊也啟動實施了其“遠征作戰海上戰術雲”項目建設。

“作戰雲”作戰模式檢驗驗證已經全面展開。 2014年9月23日,美空軍F-22首次率領聯合空襲機群,對敘利亞境內的“伊斯蘭國”極端組織目標實施空襲作戰。任務完成後,時任美軍空中作戰司令部司令麥克·侯斯塔奇在接受《防務頭條》採訪時,表示“一般認為隱身是五代機的標誌,其實不然,重點在於’融合’”,“’融合’使得F-22與其他平台根本不同”,“’融合’是五代機的根本特徵”,“五代機在前方偵察探測目標,然後讓四代機在防區外打擊它,你必須擁有’作戰雲’,其擁有將數據來回傳輸的能力”。這次表態,也直接證明了美空軍正在積極針對“作戰雲”作戰模式開展實戰性檢驗驗證。

(作者單位:空軍軍事理論研究所)

編輯點評

躍上“雲”端觀風雷

侯永波

當我們在網上購物時,網站會根據以往的購物記錄來判斷我們的購買偏好,推送大量的商品信息;當我們在瀏覽新聞時,軟件同樣會根據我們的閱讀習慣,“投其所好”地定向推送內容話題……這些現像都說明,我們已經來到了一個雲計算時代。

“作戰雲”之所以進入我們的選題視野,不僅僅是因為它頻繁地出現於美軍最新的作戰理論中,處處透露著對抗消解“體系破擊戰”的思維,更重要的是它代表著美軍把雲計算運用於軍事領域的最新成果,反映出美軍運用科技成果最大限度提高作戰效能的一種思路。
像很多高新技術一樣,雲計算最早出現在民用商業領域。 2006年8月,谷歌首席執行官埃里克·施密特首次提出“雲計算”概念。很快,美軍就對這種新技術表現出濃厚興趣。 2008年,美國防部與惠普公司合作建立了一個雲計算基礎設施。緊接著,美國空、海、陸等各軍種都與商業公司簽約設計相關雲計算系統。美軍對雲計算技術的熱情擁抱,有其在信息技術領域處於領先地位的大背景,但同時也反映了他們對最新前沿科技的敏銳嗅覺以及迅速的轉化運用能力。

習主席在出席十二屆全國人大五次會議解放軍代表團全體會議時強調,“要主動發現、培育、運用可服務於國防和軍隊建設的前沿尖端技術,捕捉軍事能力發展的潛在增長點”。顯然,推進云計算領域的軍民協同創新,我們是大有可為的。因為,相比美國等發達國家在雲計算領域的發展,我國並不落後,國內一些公司已經有著較為成熟的運用經驗。關鍵是如何結合我軍實際,來實現雲計算技術在軍事領域的轉化運用。

當然,我們發展運用雲計算技術,須藉鑑外軍的經驗,但絕非亦步亦趨克隆。美軍的做法只是提供了運用的一種模式。在信息革命大潮雲湧的時代,通過核心關鍵性技術突破是有可能實現“彎道超車”的。敢於擊水中流,方顯英雄本色。

Original Source:

2017年03月21日09:52  来源:解放军报

美國陸軍網空作戰力量演變與歷史 – US Army cyberspace combat force evolution & history

美國陸軍網空作戰力量演變與歷史 –

US Army cyberspace combat force evolution & history

With the rapid development of the global information grid system of the US military, the conceptual research based on the information technology system is becoming more and more thorough. Finally, the American combat theory establishes the cyberspace as a combat domain with land, sea, air and sky. In this context, the US Army will be the construction of cyberspace as a key factor in promoting the process of modernization of the army, determined to follow the formal militarization of the organization’s standards and structure of high-quality network combat forces. Since the establishment of the Army Network Command in 2010, the US Army has established a comprehensive network of operational forces based on the goal of combating the military forces of cyberspace through new means such as new construction, adjustment, transformation and integration.

The basic organizational structure under the guidance of the concept of network operations

From the 90s of the 20th century, in order to ensure the US military information grid system in the army part of the efficient and safe operation, the US Army under the guidance of the joint army, around the concept of network operations carried out a series of organizational restructuring, the dissolution of the information system commander And has set up the Army Signal Command and the network enterprise technology command and other institutions, and gradually formed based on technology, defense, focusing on the basic network of emergency operations organizational structure.

In 2005, the US Strategic Command issued the “Global Information Grid Collaborative Combat Concept”, which elaborated on the organizational structure of the US Army’s cyberspace forces during this period, dividing the Army’s network operations system into three Level: At the first level, under the command of the Army Space and Missile Defense Command / Army Strategic Command, the Army’s Global Network Operations and Security Center is responsible for situational awareness and command coordination as the only governing body for Army operations, In the US Army Joint Force Network Power System, the agency functions as a global network of operations and security centers. At the second level, the Theater Network Operations and Security Center is the supporting element of the operational headquarters, which is responsible for “guiding network operations, managing and defending the global information grid elements that are part of the Army’s jurisdiction.” The regional network operations and security centers in the theater constitute the third dimension of the Army’s network operations system. In addition, the Army Computer Emergency Response Unit is the disposal of the network emergency response, in the emergency can accept the global network operations task force tactical control, each theater network operations and security center also established a computer emergency response unit.

New Universal Military

Global military clean sweep, do in the public micro-signal “new global military”

Long press the next two-dimensional code can be concerned about

Set up Army Network Command

With the US military for the degree of dependence on cyberspace, control and weaken the threat of the Internet has continued to become the focus of US military tasks, the establishment of an independent network of space operations command of the voice of the growing US military. In 2008, “Yankee deer bomb action” directly under the impetus, the US military decided to end the unit of independent decentralization of the development of network combat capability of the situation, through the withdrawal, transfer, change and other measures to reorganize the relevant institutions, the establishment of a comprehensive network Space operations of the joint command agencies, the US Army network power organization construction has entered a stage of rapid development.

Through the global deployment of decentralized development of the formation of cyberspace combat organization of the backbone. As the awareness of the network operations will have a far-reaching impact on the military field, the US Army in the combat force level into a lot of resources, and gradually establish the backbone of the network operations. For example, the Army launched its first cyber warfare in July 2008, which provides tactical support, brigade combatant support, and strategic support to other service units, joint forces and even cross-agency partners; the Army also operates on cyber operations The upper-level command system to implement the adjustment, so that the relevant action to be appropriate authority to monitor. During this period, the Army’s future network combat forces were integrated in the form of units in the military and joint forces within the combat unit, including from the Defense Information Systems Agency, the global network operations joint contingent, the National Security Agency to the brigade combat team and other Level of strategic and tactical institutions.
The new core coordination agencies, straighten out the headquarters to the unit level of the command relationship. In June 2009, the US Department of Defense announced the establishment of the US Internet Command in the form of a memorandum to consolidate and promote the construction of cyberspace military forces through a dedicated subordinate joint command. At the same time, as a transitional measure for the formation of the Army Force Network Command in the future, the Army decided to retain the organizational structure of the Army Space and Missile Defense Command / Army Strategic Command and rename it as Army Force Network Command. February 2010, the US Army announced on this basis, the formal formation of the Army Network Force Command, its formation and initial construction phase of the work mainly around the three tasks: to achieve cyber space military forces combat, increase the Army network combat power Capacity and scale, the development of the Army network space professionals team. As the previous command system was disrupted, the newly established Army Network Space Operations and Integration Center under the Cyber ​​Command actually played a central role in command control and coordinated synchronization. The agency is similar to the previous Army Global Network Operations and Security Center, but in addition to “providing clear, concise and timely guidance in the implementation of full spectrum cyberspace operations,” the organization is also responsible for “with the Army’s other headquarters, Other units in the same type of institutions, the United States cyberspace joint operations center to share information. ” At the beginning of the establishment of the organization, some members of the cyberspace operations and integration center also joined the US Department of Network Command staff to better promote the unity of command and operation of the joint force and service units.

US Army Network Space Force Organizational Structure, 2005

The transformation of combat forces functions, to promote the traditional ability to network space combat capability development. At the level of the combat force construction, the field signal force as the main body of the network Enterprise Technology Command / 9 signal command to the Army Network Force Command, the Army Intelligence and Security Command of the cyberspace combat forces combat command by the army Network command. Through this organizational adjustment, the Army Network Command for the first time mastered the forefront of the deployment of combat forces, to form a global presence and have the expedition, you can combat commander to provide more comprehensive combat support capabilities. It is noteworthy that the network enterprise technology command and the intelligence and security commander in the Army Network Command as deputy commander, respectively, responsible for different types of network operations mission, the basic formation of the original signal forces in charge of network defense, the original military Intelligence forces in charge of the network attack mode, which will be previously discrete deployment, loosely combined network space related organizations into a complete army network strength. In addition, the Army Network Command in 2011 was also given the task of carrying out information operations, master the first information combat command of the operational command, intelligence and security headquarters under the 780 military intelligence brigade will also be transformed into Army Network Command Direct command of the network brigade.

Continuously optimize the Army cyberspace forces

After the establishment of the Army Network Command, cyber space military forces combat is always the center of its work, which in the Army Network Power Organization continue to optimize the integration process has been highlighted. For the current network operations have been formed, electronic warfare, information operations, military intelligence and even space combat capability, the US Army in the network of military organizational structure design also reflects the integration of a variety of capacity trends. The US Army is also actively promoting the overall military model in the construction of network forces, highlighting the development of the national guards and reserve forces. After years of construction, the US Army network power organization has been basically formed.
Army Network Combat Force Organizational Structure, 2011

Optimize the combat strength of the organizational structure, to adapt to operational support needs. At the headquarters level, in order to further improve the command and implementation of cyberspace operations, the Army approved the Network Command in March 2014 as the headquarters of the Army Force, and designated the 2nd Army as its immediate unit, and the network enterprise technology Command to become the second army direct command of the network combat troops, network enterprise technology command commander of the second group army deputy commander. And the previous year, the network command has been under the guidance of the US Internet Command and Army headquarters began to form a joint force network headquarters, which will be the implementation of the network space combat command command, and have direct support to the combat command of the network combat capability The At the combat forces and theater levels, the network command is trying to improve the global network defense situation through regional network centers. Based on the strength of the original Theater Network Operations and Security Center and Regional Computer Emergency Response Center, these regional cybersecurity centers streamline the operational plan of the network operations, and can play a strong planning, coordination and synchronization function to more effectively support geography Operation of the Combat Command.

To determine the development of the responsible institutions, improve the network to build military theory guidance. As the US Army Network Command merged with the original network operations, information operations and the strength of the signal forces, a large number of signal forces combat theory urgent need to be revised and translated into the network combat theory, in order to achieve a unified operational capability development model, to avoid the concept of guidance On the chaos. In March 2014, the US Training and Command Command, on the basis of the Center for Excellence, integrated other relevant professional elements to form the Army Network Center of Excellence, with the goal of providing guidance, network and signal The full ability of training. The cyberspace promotion office under the Cyber ​​Command is also incorporated into the Network Excellence Center to further enhance the advantages of the Network Excellence Center in summing up lessons learned from the construction of network forces. Through the implementation of the Ordinance to publish the project, the Network Excellence Center tried to merge the original signal and electronic warfare forces regulations, according to the Army “2015 order system” related requirements to develop new cyberspace operations, electronic warfare and signal forces regulations. At present, the Army has completed the revision of the field command FM6-02 “signal force support operations” to guide the signal forces to the network forces for functional transformation; the first release of the field order FM3-38 “network electromagnetic action”, clear “Army in the unified ground action to integrate the overall principles of network electromagnetic activity, tactics and procedures”; as the Army network army building a basic guidance document, field command FM3-12 “cyberspace combat” also basically completed the final approval process, Officially distributed within the Army in 2015. With the above documents as the main body, the Network Excellence Center will continue to improve the publication of dozens of related military ordinances publications, build a complete Army cyber space combat technology, tactics and procedures for the Army network forces to provide comprehensive theoretical guidance.
Army Network Combat Force Organizational Structure, 2015

Integration of cyberspace education and training strength, and promote the regular development of network forces. The US Army will promote the development of formal training as a fundamental way to improve the level of network operations and combat readiness. In the Army Network Center of excellence at the same time, the Army Network School as its affiliated institutions in the original electronic warfare school set up on the basis of the Army Signal School is also under the network center of excellence will continue to be retained, the Army on the regularization of the construction of cyberspace “Regulations – Organization – Training – Resources – Leadership and Education – Personnel – Facilities” model has been further refined. With the establishment of the Army Network Arsenal (“17-Series” Career Management), the Army requested new staff members to enter the network career field to complete the school’s school training program, from signal, intelligence and information operations forces and other units to the Corresponding to a large number of network operations staff also need to carry out new vocational education and training, the two schools will jointly set up the new Army network arms units officers, warrant officers and noncommissioned officers for individual personnel skills training. For example, the Army Leadership Foundation Training Program was officially launched at the online school in August 2015, and the 14-week Senior Officer Training Program was implemented in May 2016. For the first batch of network combatants recruited by the Army in October 2015, the senior personal training program that must be attended by the Army began in February 2016. As the cyberspace operations essentially have the characteristics of joint operations, the first phase of the 22-week training program will be the Naval Joint Network Analyst Course, the second phase of training for the same 22 weeks, training venues from the Navy The facility is transferred to the Army Network School.

Attention to the National Guard and reserve network strength, highlighting the support and coordination functions. In view of the development of the network combat force, the Army believes that the reserve department can assist the active forces to share some of the tasks and be able to provide reinforcements with high levels of training as quickly as necessary. Because of its unique dual legal position, the Army National Guard can play the role of state and federal government agencies, civil and military organizations, private and public sector convergence, “with the development of cyberspace capabilities of the natural advantages.” Therefore, the Army in the development of network combat forces also pay attention to the construction of the relevant reserve organizations. For example, the First Information Operations Command also includes four reserve forces theater information operations brigade, which has the ability to provide information operations and cyberspace planning, analysis and technical support. According to a memorandum signed by the Army National Guard in June 2014 with the Army Network Command, the Army National Guard transferred one of its network defenses in the previous year to the Army Network Command / 2nd Army. The cyber force, known as the 1636th Network Defense Unit, will be in Service No. 10 of the United States Code, which is a full-time service and will receive the same standard training with other active forces of the Army Network Command and jointly All types of tasks.

This article from the “Military Digest” December Editor: Zhang Chuanliang

Original Mandarin Chinese:

伴隨著美軍全球信息柵格系統的高速發展,基於信息技術系統作戰的概念研究不斷走向深入,最終美軍作戰理論將網絡空間確立為一種與陸、海、空、天並列的作戰域。在這種背景下,美國陸軍將網絡空間力量建設作為推進陸軍現代化進程的關鍵因素,決心按照正規軍事化組織的標準和結構高質量建設網絡作戰部隊。自陸軍網絡司令部於2010年成立以來,美國陸軍圍繞網絡空間軍事力量作戰化的目標,通過新建、調整、轉型和融合等手段逐步建立起完善的網絡作戰力量組織結構。

網絡作戰概念指導下的基本組織結構

從20世紀90年代開始,為確保美軍全球信息柵格系統中的陸軍部分高效安全運行,美國陸軍在聯合軍隊的指導下,圍繞網絡作戰行動概念進行了一系列組織結構調整,解散了信息系統司令部,並先後組建了陸軍信號司令部以及網絡企業技術司令部等機構,逐步形成基於技術、防禦為主、重在應急的網絡作戰基本組織架構。

2005年,美國戰略司令部發布了《全球信息柵格網絡作戰聯合作戰概念》,對這一時期美國陸軍網絡空間力量建設的組織結構進行了詳細說明,將陸軍網絡作戰體系組織架構劃分為三個層次:在第一個層面,在陸軍太空和導彈防禦司令部/陸軍戰略司令部的指揮下,作為陸軍網絡作戰行動唯一的領導機構,陸軍全球網絡行動和安全中心負責態勢感知和指揮協調工作,在美軍聯合部隊網絡力量體系中,該機構發揮軍種全球網絡作戰與安全中心的功能。在第二個層面,戰區網絡行動和安全中心是各作戰司令部的支持元素,負責“指導網絡作戰行動,管理和防禦屬於陸軍管轄的全球信息柵格元素”。戰區內各地區網絡行動和安全中心構成了陸軍網絡作戰體系的第三個層面。此外,陸軍計算機應急響應分隊是應對網絡突發事件的處置力量,在緊急情況下可以接受全球網絡作戰特遣部隊的戰術控制,每個戰區網絡行動和安全中心也都建立了計算機應急響應分隊。

新環球軍事

全球軍事一網打盡,盡在公眾微信號“新環球軍事”

長按下方二維碼即可關注

成立陸軍網絡司令部

隨著美軍對於網絡空間依賴程度的加深,控制和削弱網絡威脅持續成為美軍關注的重點任務,組建獨立負責網絡空間作戰指揮機構的呼聲在美軍內部日益高漲。在2008年“揚基鹿彈行動”的直接推動下,美軍決定結束軍種單位獨立分散發展網絡作戰能力的局面,通過並、撤、轉、改等措施對相關機構進行結構重組,成立全面負責網絡空間作戰的聯合指揮機構,美國陸軍網絡力量組織建設也進入快速發展階段。

通過全球部署分散發展的方式形成網絡空間作戰組織的基幹力量。由於意識到網絡作戰行動將對軍事領域產生更加深遠的影響,美國陸軍在作戰部隊層面投入大量資源,逐步建立起網絡作戰行動的基幹力量。例如,陸軍在2008年7月啟動了第一支網絡戰營,其能夠提供戰術支持、旅戰鬥隊支援以及向其他軍種單位、聯合部隊甚至跨機構夥伴提供戰略支援;陸軍還對網絡作戰行動的上層指揮體系實施調整,從而使相關行動得到適度權限的監管。在這個時期,陸軍未來網絡作戰力量都以分隊形式整合在軍種和聯合部隊架構下作戰單位的內部,包括從國防信息系統局、全球網絡作戰聯合特遣隊、國家安全局到旅戰鬥隊等各個級別的戰略和戰術機構。
新建核心協調機構,理順總部到分隊層面的指揮關係。 2009年6月,美國國防部通過發表備忘錄的形式宣佈建立美國網絡司令部,旨在通過一個專門的次級聯合司令部集中統籌和推進網絡空間軍事力量建設。與此同時,作為日後組建陸軍部隊網絡司令部的過渡性措施,陸軍決定保留陸軍太空和導彈防禦司令部/陸軍戰略司令部的組織架構,並將其重新命名為陸軍部隊網絡司令部。 2010年2月,美國陸軍宣佈在此基礎上正式組建陸軍網絡部隊司令部,其在組建和初始建設階段的工作主要圍繞三項任務展開:實現網絡空間軍事力量作戰化、增加陸軍網絡作戰力量的能力和規模、發展陸軍網絡空間專業人才隊伍。由於以往的指揮體係被打亂,網絡司令部下新成立的陸軍網絡空間作戰與整合中心實際上發揮了指揮控制和協調同步的核心作用。該機構與此前的陸軍全球網絡行動和安全中心功能類似,但是除了“在執行全譜網絡空間作戰行動過程中提供清晰、簡潔、及時的指導”以外,該組織還負責“與陸軍其他司令部、其他軍種單位中的同類機構、美國網絡空間聯合作戰中心共享信息”。在機構建立之初,網絡空間作戰與整合中心的部分人員還直接加入美國網絡司令部參謀機構,從而更好地促進實現聯合部隊與軍種單位網絡作戰行動的指揮統一。

美國陸軍網絡空間力量組織結構,2005年

轉型作戰部隊職能,促進傳統能力向網絡空間作戰能力發展。在作戰部隊建設層面,以野戰信號部隊為主體的網絡企業技術司令部/第9信號司令部轉隸陸軍網絡部隊司令部,陸軍情報和安全司令部所屬網絡空間作戰部隊的作戰指揮權也由陸軍網絡司令部掌握。通過這種組織調整,陸軍網絡司令部第一次掌握了前沿部署作戰力量,能夠形成全球存在態勢並具備遠征能力,可以向作戰指揮官提供更加全面的戰鬥支援能力。值得注意的是,網絡企業技術司令部以及情報和安全司令部指揮官都在陸軍網絡司令部擔任副司令,分別負責不同類型的網絡作戰行動任務,基本形成了原信號部隊主管網絡防禦、原軍事情報部隊主管網絡進攻的模式,從而將此前離散部署、鬆散聯合的網絡空間相關組織整合為一支完備的陸軍網絡力量。此外,陸軍網絡司令部在2011年還被賦予執行信息作戰的任務,掌握第1信息作戰司令部的作戰指揮權,情報和安全司令部下屬的第780軍事情報旅也將轉型為陸軍網絡司令部直接指揮的網絡旅。

持續優化陸軍網絡空間部隊

陸軍網絡司令部成立後,網絡空間軍事力量作戰化始終是其中心工作,這一點在陸軍網絡力量組織不斷優化整合的過程中得到突出體現。對於當前已經形成的網絡作戰、電子戰、信息作戰、軍事情報甚至太空作戰能力,美軍陸軍在進行網絡軍隊組織結構設計時也體現出融合多種能力的趨勢。美國陸軍還在網絡部隊建設中積極推進整體型軍隊模式,突出國民警衛隊和預備役網絡力量的發展。經過多年建設,美國陸軍網絡力量組織結構已經基本形成。
陸軍網絡作戰力量組織結構,2011年

優化戰鬥力量組織結構,適應作戰行動支援需求。在總部機構層面,為了進一步完善網絡空間作戰行動的指揮程序並實現意圖統一,陸軍在2014年3月批准網絡司令部為陸軍部隊組成總部,同時指定第2集團軍為其直屬單位,而網絡企業技術司令部成為第2集團軍直接指揮的網絡作戰部隊,網絡企業技術司令部指揮官兼任第2集團軍副軍長。而且在前一年,網絡司令部已經在美國網絡司令部和陸軍總部的指導下開始組建聯合部隊網絡總部,其將對網絡空間作戰部隊實施任務指揮,並且具備直接支持作戰司令部的網絡作戰能力。在作戰部隊和戰區層面,網絡司令部試圖通過地區網絡中心改善全球網絡防禦態勢。在原有戰區網絡作戰和安全中心、地區計算機應急響應中心力量基礎上,這些地區網絡安全中心對網絡作戰行動指揮程序進行精簡,能夠發揮較強的計劃、協調和同步功能,從而更加高效地支援地理作戰司令部的行動。

確定條令開發負責機構,完善網絡建軍理論指導。由於美國陸軍網絡司令部合併了原網絡作戰、信息作戰和信號部隊的力量,信號部隊的大量作戰理論迫切需要修訂並轉化為網絡作戰理論,從而實現協調統一的作戰能力發展模式,避免出現概念指導上的混亂。 2014年3月,美國訓練和條令司令部在原信號卓越中心的基礎上,整合其他相關專業力量元素,組建了陸軍網絡卓越中心,目標在2015年10月使其具備指導網絡、信號和電子戰部隊訓練的全面能力。網絡司令部下屬的網絡空間促進辦公室也被合併入網絡卓越中心,從而進一步增強網絡卓越中心在總結網絡部隊建設經驗教訓方面的優勢。通過實施條令出版項目,網絡卓越中心試圖合併原有的信號和電子戰部隊條令,根據陸軍“2015條令體系”的相關要求開發全新的網絡空間作戰、電子戰以及信號部隊條令。目前,陸軍已經完成了對野戰條令FM6-02《信號部隊支持作戰行動》的修訂,指導信號部隊向網絡部隊進行職能轉型;第一次發布了野戰條令FM3-38《網絡電磁行動》,明確了“陸軍在統一地面行動中整合網絡電磁活動的總體原則、戰術和規程”;作為陸軍網絡軍隊建設的根本性指導文件,野戰條令FM3-12《網絡空間作戰》也基本完成了最後的批准程序,於2015年正式在陸軍內部發行。以上述條令文件為主體,網絡卓越中心將繼續完善數十種相關陸軍條令出版物的編撰發布工作,構建完整的陸軍網絡空間作戰技術、戰術和規程體系,為陸軍網絡部隊建設提供全面理論指導。
陸軍網絡作戰力量組織結構,2015年

整合網絡空間教育訓練力量,促進網絡部隊正規化發展。美國陸軍將推進網絡訓練正規化發展視為提高網絡作戰和戰備水平的根本途徑。在陸軍網絡卓越中心組建的同時,陸軍網絡學校作為其下屬機構在原電子戰學校的基礎上成立,而且陸軍信號學校也在網絡卓越中心的建制下繼續得以保留,陸軍關於網絡空間力量正規化建設的“條令-組織-訓練-資源-領導力和教育-人員-設施”模型得到進一步完善。隨著陸軍網絡兵種(“17-系列”職業管理領域)的設立,陸軍要求進入網絡職業領域的新任職人員必須完成網絡學校的駐校訓練項目,從信號、情報和信息作戰部隊等單位調動到相應網絡作戰崗位的大量人員也需要進行新的職業教育訓練,上述兩所學校將共同對新成立的陸軍網絡兵種單位的軍官、準尉和士官進行單個人員技能訓練。例如,軍官領導力基礎訓練課程於2015年8月在網絡學校正式啟動,為期14週的準尉軍官高級訓練項目則在2016年5月開始實施。對於陸軍在2015年10月徵募的第一批網絡作戰士兵,其必須參加的高級個人訓練項目則在2016年2月開始。由於網絡空間作戰行動本質上具有聯合作戰的屬性,高級個人訓練項目為期22週的第一階段訓練內容將是海軍聯合網絡分析師課程,第二階段訓練同樣持續22週,訓練場地也會從海軍設施轉移到陸軍網絡學校。

重視國民警衛隊和預備役網絡力量,突出支援和協調功能。針對網絡作戰力量的發展問題,陸軍認為預備役部門可以協助現役部隊分擔部分任務,能夠在必要時迅速提供具備較高訓練水平的增援力量。因其獨特的雙重法律定位,陸軍國民警衛隊可以發揮各州與聯邦政府機構、民事與軍事組織、私營與公共部門之間的銜接作用,“具備發展網絡空間能力的天然優勢”。因此,陸軍在網絡作戰力量發展過程中也注重相關預備役組織的建設。例如,第1信息作戰司令部還包含4支預備役部隊戰區信息作戰大隊,其都具備提供信息作戰和網絡空間計劃、分析、技術支持能力。根據陸軍國民警衛隊2014年6月與陸軍網絡司令部簽署的一份備忘錄,陸軍國民警衛隊將其在此前一年組建的1支網絡防禦分隊轉隸於陸軍網絡司令部/第2集團軍。這支被稱為第1636網絡防禦分隊的網絡部隊將處於《美國法典》第10卷服役狀態,即全時服役狀態,將與陸軍網絡司令部其他現役部隊共同接受同等標準的訓練,並共同執行所有類型的任務。

本文轉自《軍事文摘》12月刊 責任編輯:張傳良

中國軍隊戰略層面的網絡空間特種作戰 China’s Strategic Level of Cyberspace Special Operations

战略层面的网络空间特种作战 –

China’s Strategic level of Cyberspace Special Operations

Editor’s Note: US Army Lieutenant Colonel Patrick Mitchell Dugen at the US Army War College during the fourth quarter of 2015, “Joint Force Quarterly” published “strategic level of cyberspace special operations,” a paper, the article was Chairman of the Association of the United Nations in 2008 Strategic Papers Competition Strategy Research Award.

In this paper, by reviewing the cyberspace special operations cases, this paper analyzes the potential power of using network tools in asymmetric conflicts, and points out that cyberspace special operations have become an effective strategic tool to achieve national goals. Become a regional power to avoid the US military dominance and to ensure that their strategic interests of the unconventional path. The author proposes three new options for integrating emerging technologies and special operations: “cloud-driven” foreign defense, network counter-insurgency and unconventional cyber warfare advance team. Designed to maintain the US network technology advantages, and to build an important partnership, shaping the full spectrum of the conflict environment has a revolutionary impact. Iran and Russia and other regional forces of cyberspace special combat readiness why more than the United States? How does Iran and Russia strengthen its power at the tactical level while the United States has assembled its network and network capabilities at the strategic level? The United States in more than 20 years ago issued a network of special operations related documents, but why the network of special operations policies, departments and regulations are still not mature enough? For the US military, the most basic question is: how will the United States build a strategic level of network special combat capability?

As early as 1993, Internet technology theorists John Achilla and David Lennfield in his book “cyber war is coming” a book has predicted the recent Iran and Russia to implement the cyberspace special operations. “A large number of scattered small groups around the use of the latest communications technology coordinated” control network, to obtain the decisive advantage of the opponent. In reality this scene has been staged again and again. “We are using the information and the more information we have, and the less demand for traditional weapons,” says Achilla and Lunfield. US military executives have also realized that with asymmetric network tools, unconventional tactics and a large number of false information armed, a small amount of special combatants can form a certain strategic impact. There is news that both Iran and Russia have succeeded in using cyberspace special operations as a strategic tool to achieve their national goals. Both countries have an integrated network of special operations forces that know how to exploit the potential power of network tools in asymmetric conflicts. The asymmetric approach of the two countries has become a strong and unconventional path for regional powers to circumvent US military superiority and to ensure their strategic interests. Low price Of the network of high-tech allows potential rivals can develop a strong network warfare capabilities. Therefore, the United States urgently need to make strategic choices, the development of cyberspace special operations, as a tool for the protection and projection of national interests.

Low-cost network of high-tech technology allows potential rivals to develop a strong network warfare capabilities In February 2013, the Russian chief of staff Grazimov in the Russian “military messenger” magazine published “science in the forecast value” article. In the paper, Gracimov predicted a new generation of war that could “change the rules of the game”, whose strategic value would exceed “the effectiveness of weapon forces.” He called for universal asymmetric action to counter the enemy’s strengths and create a permanent frontier in the territory of the enemy through “special forces and internal confrontation and continuous improvement of information operations, equipment and means.” In the spring of 2014, Western media reported that in the eastern part of Ukraine, a casual special operations squad from Russia through the Ukrainian border, occupation of government buildings and arsenal and transferred to the separatist armed. At the same time, the Ukrainian authorities claim that their digital, telephone and cyber communications are cut off, interfered or attacked. The Ukrainian government attributed the cyber attacks on information and logistics infrastructure, including Internet servers and railroad control systems, to the destruction of Russia, and argued that the implementation of information fraud in Russia was costly in important social media, blogs, and News website published 50 pro-Russian comments every day, inside and outside Ukraine to form a large number of false information flow, on the one hand to cover up its non-traditional military operations in cyberspace, on the other hand to create a political illusion. “Russia is not doing the usual information warfare about false information, lies, leaks or cyber sabotage, it reshapes reality, creates public illusions, and then translates them into political action,” said senior government officials. To this end, in September 2014 at the NATO security summit, the NATO Allied Supreme Commander, US Air Force Admiral Philip Bride Leaf pointed out that Russia in East Ukraine to implement the “mixed” non-traditional operations on behalf of the war The most amazing information in history is Blitzkrieg. Bride Leaf urges the Allies to immediately develop the ability to counter the Russian non-traditional warfare, propaganda and cyber attacks. Russia’s use of the “non-traditional Western as a war” non-traditional means to achieve its political purpose, which makes the Western and NATO countries by surprise. Russia is not a fragmented way to use special forces, information operations or network capabilities.

On the contrary, as General Glashimov said, “the war does not need to be publicly announced, when the special forces with advanced technology and a lot of information for the traditional forces in the maintenance of peace and crisis under the cover of strategic objectives to create good conditions, the war on “Cybercrime deception and cyber attacks are special forces in” war and peace ”

Network information spoofing and cyber attack action for special combat forces in the “war and peace” between the implementation of non-traditional warfare to win the time and space lessons learned from the Russian case can draw four major experience, for the United States special operations Action and network capacity integration to provide a viable theoretical framework. First, there are tactical and strategic differences in the offensive network tools used by the Russian Special Forces, targeting tactical “closed networks”, such as local communications, social media, regional networks and logistics infrastructure, while retaining Its more advanced open network tools as a backup. Second, the network special operations are primarily an agent behavior, emphasizing the minimization of the source tracking. As Gracimov described, “the long-distance, non-contact action against the enemy is becoming the primary means of the tactical battle.” Network special operations usually avoid direct contact with people, but in peace and war in the gray area to start action. Third, information and communication technology, network attacks and information operations in the network to form a non-conventional warfare play an important role. As long as the appropriate implementation, the traditional special operations can go far beyond its original function, “which involves the comprehensive application of a wide range of capabilities to achieve policy objectives.” To be effective, it must also be integrated to synchronize other areas of expertise. Fourth, the network special operations can both deter the conflict, can also be used to deal with the whole spectrum of conflict, because “it is suitable for all stages of action, from shaping the environment to the intense war to post-war reconstruction.” Although the network war to destroy the original intention, but also has a constructive side. The widespread dissemination of low-cost information and communication technologies is conducive to strengthening the security of partner countries and thus helping to prevent the occurrence of conflicts.

“‘Foreign help defense’ (FID) under ‘cloud drive’ is both a concept of cloud computing and a metaphorical description of partnering and trust through virtual means. “The concept of” cloud-driven “FID” has not yet been clearly defined, but it can be integrated into an interdisciplinary field to better understand people, geography and virtual worlds and to act together on related goals. Technically, the “cloud-driven” FID “strengthens the partnership, consolidates data through the federated facilities, enhances automation, and disseminates the analysis process. “Cloud-driven” is flexible and can be developed in private, public, community, or mixed form, using different software, platforms, and infrastructure. Security personnel use intelligent technology to drive confidential mobile applications, analyze tools and share data through “cloud-driven” FIDs. Although the data associated with the virtual cloud, but its real value is to make the timely dissemination of information to the hands of tactics. “The cloud-driven” FID “can also be likened to a persistent, active partnership, the data never stops, the network has been busy. Technology is only a tool to drive deeper, extensive socio-cultural, political and historical factors that are often prone to conflict. “Cloud-driven” FID “can build more sustainable competencies and trust with partner countries. “The cloud-driven” FID “lay a virtual foundation for the future establishment of various institutions, centers and laboratories to bridge the benefits of inter-agency across the United States. From the strategic point of view of the US government, “cloud-driven” FID “is a pragmatic” partnership-centered approach designed to target the core interests of partner countries rather than to Way to change the partner country “. “The cloud-driven” FID “is also a prudent strategic move to” prevent the US partner countries from becoming a public relations crisis due to domestic political problems. ” “The cloud drive ‘FID’ also offers other opportunities. The technology and networks it forms can react quickly to emergencies, such as humanitarian relief or relief operations, prevent mass killings, or evacuate personnel from non-combatants. This saves time, money and manpower by providing information for the decision-making process. For the construction of the partnership, the cloud-driven FID can store local non-US social media information, rich social network analysis, social network maps, and behavioral and opinion trends analysis. Most importantly, the “cloud drive ‘FID” builds trust in an innovative and extremely powerful way to build lasting influence on allies and partners.

Today’s global environment drives the United States to use cyber special operations as a strategic tool network for national military strategies Anti-riot counterintelligence network Anti-riot operations (CNCOIN) aims to use social media networks to achieve the purpose of rebellion. To break the asymmetric information superiority of the enemy, CNCOIN uses non-technical means to combat the relevant crowd and control its perception, behavior and action. It adds a military color to the cyber space’s ubiquitous anti-social network. Although these means are not clearly defined, this article believes that it actually refers to the manipulation of social media, cover up the true identity, to achieve ulterior motives. While social media provides a wide range of opportunities for anti-social networks, such as malicious use, intentional misconduct, but from the military point of view, social media provides a wealth of information resources to affect the psychological vulnerability, but also an ideal attack platform. There are several technologies that contribute to its implementation in each functional category. The scope of action includes, but is not limited to, cyber-pseudo operation and cyber-herding operation. Network fraud is a classic counter-insurgency strategy, “government forces and technical staff will pretend to be insurgents, into the enemy network after the use of advanced intelligence technology in the network within the implementation of the destruction.” Internet expulsion means that “individuals, groups, or organizations deport other individuals, groups, or organizations to the default network area.” The magic of the two technologies is the expulsion of insurgents in the virtual network by exploiting the inherent flaws of the communication technology and communication platform. The two tactics are aimed at rebel activist online communities, manipulating or disrupting them, and ultimately providing more opportunities for cyberbullying. The virtual world magnifies the environmental factors, because the characters in the network are more difficult to determine their authenticity. Planning command control, communication frequency and equipment platform and other elements will become the key to the implementation of network fraud or network expulsion operations to manipulate, mislead or expel the target group to the desired results. The scope of information includes, but is not limited to, Crowdsourcing and Social Networking Analysis, SNA). Crowdsourcing is the use of large-scale knowledge base, provided by the participants voluntarily, to solve the problem to provide new ideas, services or observation, you can quickly expand the organizers of the field of vision. Social network analysis depicts and measures the relationships, strengths, and cores of social links in a visual way to illustrate the social network structure. Social network visualization or social networking maps can provide a unique window for assessing, depicting and even predicting the intensity, time, space, and relationship dimensions of relationship events. In September 2013, during the crisis in the Philippines, the anti-government armed Moro National Liberation Front (hereinafter referred to as “the dismount”) was dissatisfied with the situation of national reconciliation, hijacked more than 200 civilians as hostages, attacked commercial shops and burned urban buildings. Throughout the crisis, crowdsourcing and social network analysis are very successful non-traditional tactical means. The Philippine security forces use crowdsourcing tactics to encourage Zamboang residents to discover and report on the “melodic” members of the hiding place. FEI security forces, together with crowdsourcing information and intelligence analysis, provide information for security operations and humanitarian operations. The use of social network analysis to assess the “Mobility” of the public support, and in the social media against the “interpretation” declaration, to ban the violation of social media user agreement propaganda site, but also the use of crowds of information blockade ” Troops, attacking their temporary command post. The Philippine security forces used solid media to track the key information and lead the use of social media, and then use the solid forces to defeat the “interpretation” of the asymmetric advantage. The information warfare category includes but is not limited to cyber intrusion (cyber Aggression, forum vest (sock-puppeting), astro-turfing and so on. Three tactics are anonymous use of social media to implement misleading, false information to manipulate behavior, public opinion and action. The cyber-invasion is proposed by Teanna Felmyr, which refers to “an electronic or online act that is intended to cause psychological harm to others or damage its reputation by using e-mail, instant messaging, cell phones, digital information, chat rooms

As well as social media, video, game sites, etc. “. It is much broader than the range of ordinary cyber-aggressive behavior. Its anonymity may cause substantial psychological harm and negative consequences, as the relevant information will be repeatedly sent to the target or published in the social media. Its value to CNCOIN is that it can use sensitive digital information to humiliate, defame or hurt the target, causing psychological barriers. This powerful cyber-invading action can reduce the credibility, influence and power of the target, and ultimately lose the power of the target or other insurgents. The other two tactics, the forum vest and the fake are all fictitious online propaganda tools used to spread distorted views to create a wider range of support or opposition to the illusion. In fact, with the forum vest is the same concept, but more complex, more organized, larger. Both tactics use virtual characters to distribute false information in cyberspace, with the aim of initiating group reactions or actions. Combining massive amounts of text, images, and video with a planned misleading network activity will significantly enhance the effectiveness of CNCOIN’s action. The third way to advance the US network’s special operations is the unconventional cyber warfare team (cyber-UW Pilot Team, using social media networks to shape the physical environment, the establishment of regional mechanisms, in the implementation of non – conventional war before the regional connectivity. The core of the unconventional network warfare team is the special forces, with a number of professional organizations to provide technical support, its task is in the field of network security for the preparation of unconventional operations. The penetration of the traditional advance team is the target of enemy territory, military facilities and other entities, rather than the conventional advance team is through the virtual means of infiltration, and then into the sensitive, hostile or refused to area. Through the virtual means, can reduce the United States and partner countries armed forces in time, risk, equipment and other aspects of the loss and risk. Conceptually, unconventional cyber warfare teams use web tools and advanced technology to build people, entities, intelligence, and information infrastructures on social media. While deepening understanding of the local human terrain, the team can strengthen its local language and cultural skills, as well as identify resistance leaders, assess motivation and resistance, and overall support for US government goals, while at the same time understanding Informal hierarchical distribution, psychology and behavior. In addition, you can also incorporate the Internet’s white noise into the social media network to “improve the cultural understanding of potential collaborators in the United States and the local situation before action.” While the US national security strategy has long recognized the strategy of cyber warfare Role, but this understanding is not fully translated into a clear strategic level of thinking and combat capability. For example, the US Department of Defense cyberspace action strategy did not give much solution or specific measures, only from five aspects of the previous repeated network ideas. Lack of clear ideas lead to our network strategy is flawed, making the United States advanced network technology advantages to hand over to the potential rival risk. In contrast, Iran and Russia’s asymmetric innovation modeled other regions and global forces, trying to circumvent the US military advantage by unconventional means to ensure their strategic interests. Cyberspace special operations are a must to fill the strategic level of the blank. Obviously, the United States must actively seek a tactical level of unconventional combat into the cyber space operations in the form of special operations. Rand’s recent study of special operations concluded that “the United States needs to use a more advanced form of special operations to ensure national interests, taking into account the recent US and its interests facing the security threat situation, special operations

Become the most appropriate form of ensuring national interests “. In an increasingly interconnected global environment, the physical infrastructure is quickly allocated Internet protocol addresses, accessory networking. By 2020, there will be 50 billion “machine-to-machine” equipment (currently 1 3 billion units) will be through the “embedded computer, sensor and Internet capabilities” access to network space. Cyberspace special operations Unicom virtual and reality, through the modern information network and with the traditional face-to-face combination of special operations partnership. Today’s global environment has prompted the United States to use cyber special operations as a strategic tool for national military strategies. Potential rivals combine offensive network capabilities with unconventional tactics to set a terrible example for other enemies in the United States, and they will follow suit quickly. This paper presents three new options for integrating emerging technologies and special operations: foreign-assisted defense under “cloud-driven”, anti-riot operations in the network, and non-conventional cyber warfare advance teams. Full play of these three tactics will not only maintain the advantages of the US network technology, but also to build an important partnership, shaping the whole spectrum of combat environment have a revolutionary impact. If successful implementation, network special operations will become the United States a strong new strategic options

Original Mandarin Chinese:

编者按:美国陆军中校帕特里克·米歇尔·杜根在美陆军战争学院就读期间,于2015年第4季度《联合部队季刊》发表《战略层面的网络空间特种作战》一文,该文曾获得2015年度参联会主席战略论文竞赛战略研究类奖。本文通过回顾网络空间特种作战案例,分析了在非对称性冲突中利用网络工具的潜在力量,指出网络空间特种作战已经成为达成国家目标的有效战略工具。成为地区强国用以规避美国军事主导权以及确保本国战略利益的非常规性路径。作者提出了融合新兴技术与特种作战的三种新选项:“云驱动”下的国外协助防御,网络反暴乱平叛行动与非常规网络战先遣队。旨在维持美国的网络技术优势,并对构建重要伙伴关系、塑造全频谱冲突环境产生革命性影响。伊朗和俄罗斯等地区力量的网络空间特种作战战备为何比美国更为充分?

美国在战略层面集结其网络部门和网络能力的同时,伊朗和俄罗斯又是如何在战术层面强化其力量的呢?美国在20多年前就发布了网络特种作战的相关文件,但为何其网络特种作战的政策、部门和条令仍然不够成熟呢?对于美军而言,最基本的问题是:美国将如何打造战略层面的网络特种作战能力?早在1993年,互联网技术理论家约翰·阿奇拉和大卫·伦菲尔德在其著作《网络战争即将来临》一书中就已经预言了最近伊朗和俄罗斯所实施的网络空间特种作战行动。“大量分散各地的小规模团体利用最新的通信技术协调一致”控制网络,取得对对手的决定性优势。现实中这一情景一再上演。阿奇拉和伦菲尔德认为,“战争中我们投向敌人的不再是质量和能量;如今我们使用的是信息,掌握的信息越多,对传统武器的需求就越少”。

美军高层也已经意识到,有了非对称性网络工具、非常规战术以及大量虚假信息的武装,少量的特种作战人员就可以形成一定的战略影响。目前有消息表明,伊朗和俄罗斯均已成功地将网络空间特种作战作为一种战略工具来达成其国家目标。两国都拥有一体化的网络特种作战部队,知道如何在非对称性冲突中利用网络工具的潜在力量。两国的非对称性手段成为地区强国用以规避美国军事优势以及确保本国战略利益的强大非常规性路径。价格低廉的网络高新技术使得潜在对手可以发展出强大的网络战能力。因此,美国亟需做出战略选择,发展网络空间特种作战,作为保护和投射国家利益的工具。

价格低廉的网络高新技术使得潜在对手可以发展出强大的网络战能力2013年2月,俄罗斯总参谋长格拉西莫夫在俄《军工信使》杂志发表了《科学在预测中的价值》一文。文中,格拉西莫夫预测了能够“改变游戏规则”的新一代战争,其战略价值将超过“武器力量的效能”。他号召普遍开展非对称性行动,以抵消敌方的优势,通过“特种作战力量和内部对抗以及不断完善的信息行动、装备和手段,在敌国的领土中创造一个永久活动的前线”。2014年春,有西方媒体报道,在乌克兰东部的乱局中,一支便装的特种作战小分队从俄罗斯境内穿越乌克兰边界,占领政府建筑和武器库并转交给分裂主义武装。与此同时,乌克兰当局声称,其全境的数字、电话及网络通信均遭到切断、干扰或攻击活动。乌克兰政府将信息和物流基础设施(包括互联网服务器和铁路控制系统)遭受的网络攻击归因于俄方的破坏,同时还认为,俄罗斯实施信息欺骗行动,花费巨资在重要的社交媒体、博客以及新闻网站每天发布50条亲俄评论,在乌克兰内外形成大量的虚假信息流,一方面掩盖其在网络空间的非传统军事行动,另一方面制造了政治假象。乌政府高级官员表示,“俄罗斯所做的并不是通常的信息作战所涉及的虚假信息、谎言、泄漏机密或网络破坏活动,它重新塑造现实,造成大众幻象,然后将之转化为政治行动”。为此,在2014年9月召开的北约安全峰会上,北约盟军最高司令、美国空军上将菲利普·布里德莱弗指出,俄罗斯在东乌克兰实施的“混合型”非传统作战代表了战争史上最惊人的信息闪电战。布里德莱弗敦促盟军立即发展相应的能力以反制俄罗斯的非传统战、宣传战及网络攻击行动。俄罗斯使用“根本不被西方视为战争的”非传统手段达成其政治目的,这使得西方及北约国家措手不及。俄罗斯并不是以碎片化的方式来使用特种力量、信息作战或网络能力。相反,正如格拉西莫夫将军所言,“发动战争不再需要公开宣布,当配备先进技术和大量信息的特种力量为传统部队在维持和平与危机的掩护下达成战略目标创造好条件,战争就发生了。”言外之意,网络信息欺骗和网络攻击行动为特种作战力量在“战争与和平之间”实施非传统战赢得了时间和空间。俄罗斯的网络赋能非传统战极为成功,不仅是其网络特种力量的混成,而且还成功地侵入欧盟成员国,甚至没有引起西方有效的军事反应。

网络信息欺骗和网络攻击行动为特种作战力量在“战争与和平之间”实施非传统战赢得了时间和空间 经验教训从俄罗斯的案例中可以得出四个方面的主要经验,可为美国特种作战行动与网络能力整合提供一个可行的理论框架。第一,俄罗斯特种部队所使用的进攻性网络工具存在战术和战略层面的差别,主要以战术层面的“封闭网络”为目标,如本地通讯、社交媒体、区域网络和后勤基础设施等,同时保留其更为先进的开放网络工具作为备用。第二,网络特种作战主要是一种代理人行为,强调最小化的来源跟踪。正如格拉西莫夫所描述的那样,“对敌方的远距离、无接触行动正在成为战术战役目标的主要手段”。网络特种作战通常避免人员的直接接触,而是在和平与战争的灰色地带展开行动。第三,信息与通信技术、网络攻击及信息作战等在网络赋能的非常规战中发挥着重要作用。只要恰当的实施,传统的特种作战可以远远超出其原有的功能,“这涉及到对广泛能力的综合运用,以达成政策目标”。要发挥效能,还必须整合同步其他领域的专门知识。第四,网络特种作战既可以慑止冲突,也可用于应对全频谱冲突,因为“它适合行动的各个阶段,从塑造环境到剧烈战争再到战后重建等”。虽然网络战以破坏为初衷,但也具有建设性的一面。低成本的信息和通信技术的广泛传播有利于强化伙伴国安全,从而有助于阻止冲突的发生。

网络空间特种作战是一种必须填补的战略层面的能力空白,美国必须积极寻求一种在战术层面的非常规作战中融入网络空间作战的特种作战形式 “‘云驱动’下的‘国外协助防御’(FID)”既是一种云计算概念,也是通过虚拟手段增强伙伴能力和信任的一种比喻性描述。“‘云驱动’FID”概念虽然还未经明确界定,但是它却可以联接整合跨学科领域,以更好地理解人员、地理及虚拟世界,并对相关目标展开共同行动。从技术上而言,“‘云驱动’FID”可以强化伙伴关系,通过联合设施,实时共享数据,增强自动化,传播分析过程。“云驱动”是灵活多变的,能够以私人、公共、社区或混合形式出现,各自使用不同的软件、平台和基础设施等。安全人员通过“‘云驱动’FID”使用智能技术驱动保密的移动应用软件、分析工具和共享数据。虽然数据与虚拟云相联,但其真正价值在于使信息及时传播到战术人员手中。“‘云驱动’FID”也可比喻为一种持续的、活跃的伙伴关系,数据永不停止,网络一直忙碌。技术仅仅是一种工具,用以驱动更深入、广泛的社会文化、政治和历史因素的理解,这些往往是容易造成冲突的因素。“‘云驱动’FID”可以与伙伴国构建更具持续性的能力和信任。“‘云驱动’FID”为未来建立各种机构、中心和实验室弥合美国各跨机构间的利益打下一个虚拟的基础。从美国政府的战略视角而言,“‘云驱动’FID”是一种实用主义的“以伙伴国为中心的方式,旨在围绕伙伴国的核心利益设计行动,而不是寄希望于以短视的方式来改变伙伴国”。“‘云驱动’FID”还是一种审慎的战略举措,“以防美国的伙伴国由于国内政治问题出现公共关系危机”。“‘云驱动’FID”也提供了其他的机会。它所形成的技术和关系网络可以迅速对紧急事件做出反应,如人道主义救援或救灾行动、阻止大规模屠杀,或者非战斗人员撤离任务等。这样可以通过为决策过程提供信息而节约时间、金钱和人力等。对于伙伴关系的构建而言,“‘云驱动’FID”可以存储当地的非美国社交媒体信息、丰富的社交网络分析、社会网络地图以及行为和舆论趋势分析等信息。最为重要的是,“‘云驱动’FID”以富有创新性和极为有力的方式构建信任,打造对盟友及伙伴国的持久影响力。

当今的全球环境促使美国采用网络特种作战作为国家军事战略的战略性工具 网络反暴乱平叛行动网络反暴乱平叛行动(CNCOIN)旨在利用社交媒体网络达成平叛的目的。为打破敌人的非对称性信息优势,CNCOIN使用非技术手段打击相关人群,控制其感知、行为和行动。它为网络空间无处不在的反社交网络手段增添了军事色彩。虽然这些手段没有明确界定,本文认为,它实际上就是指操纵社交媒体,掩盖真实身份,达成不可告人的目的。虽然社交媒体为反社交网络提供了广泛的机会,如恶意利用、有意误导等,但从军事角度而言,社交媒体提供了丰富的信息资源以影响心理脆弱性,也是一个理想的攻击平台。每种功能性范畴中都有几种有助于其实施的技术。行动范畴包括但不局限于网络欺骗行动(cyber-pseudo operation)和网络驱逐行动(cyber-herding operation)。网络欺骗行动是一种经典的平叛策略,“政府军和技术人员将自己假扮为叛乱分子,渗入敌方网络后使用先进的谍报技术在该网络内部实施破坏”。网络驱逐行动就是指,“个人、团体或组织把其他的个人、团体或组织驱逐到预设的网络区域”。两种技术的奇妙之处在于,通过利用通信技术与通信平台的内在缺陷来驱逐虚拟网络中的叛乱分子。两种战术以叛乱分子活跃的网络社群为目标,对其进行操控或者瓦解,最终为网络平叛提供更多的机会。虚拟世界放大了环境因素,因为网络中的人物更难确定其真实性。规划指挥控制、通信频率以及设备平台等要素将成为网络欺骗行动或网络驱逐行动实施的关键点,用以操纵、误导或者驱逐目标群走向预想的结果。情报范畴包括但不局限于众包(Crowdsourcing)和社交网络分析技术(Social Networking Analysis, SNA)。众包就是利用大规模的知识库,由参与者自愿提供的,为解决问题提供新思路、服务或观察,可以迅速扩展组织者的视野。社交网络分析以可视的方式描绘和测量社交链接的关系、强度及核心性以说明社会网络结构。社交网络可视化或者社网图可以提供独特的窗口用以评估、描绘甚至预测关系事件的强度、时间、空间和关系维度。2013年9月,菲律宾三宝颜危机期间,反政府武装摩洛民族解放阵线(以下简称“摩解”)对民族和解状况感到不满,挟持200多名平民为人质,袭击商业店铺,烧毁城市建筑。整个危机期间,众包和社交网络分析都是非常成功的非传统战术手段。菲律宾安全部队使用众包战术鼓励三宝颜居民发现并报告“摩解”成员的藏身地点。菲安全部队结合众包信息和情报分析,为安全行动和人道主义行动提供信息。使用社交网络分析来评估“摩解”的民众支持度,并在社交媒体上反制“摩解”宣言,封禁违反社交媒体用户协议的宣传网站,还使用众包信息封锁“摩解”小股部队,攻击其临时指挥哨所。菲安全部队通过使用社交媒体跟踪关键信息和领导节点,随后使用实体部队挫败了“摩解”的非对称性优势。信息作战范畴包括但不局限于网络入侵(cyber aggression)、论坛马甲(袜子手偶sock-puppeting)、以假乱真(Astro-turfing)等。三种战术都是匿名利用社交媒体实施误导、假信息等来操纵行为、舆论及行动。网络入侵是由蒂安娜·菲尔姆利提出,是指“一种电子或在线行为,旨在对他人实施心理伤害或损毁其名誉,通过使用电子邮件、即时信息、手机、数字信息、聊天室以及社交媒体、视频、游戏网站等”。它比普通的网络攻击性行为的范围要广泛得多。它的匿名性可能会引起实质性的心理伤害和负面后果,因为相关信息会被重复发送给目标或者在社交媒体发布。它对CNCOIN的价值在于,可以利用敏感的数字信息来羞辱、诽谤或伤害目标,造成心理障碍行为。这种强大的网络入侵行动可以降低目标的可信度、影响力和权力,最终使目标或其它叛乱分子丧失实力。其它两种战术,论坛马甲和以假乱真都是虚构的在线宣传工具,用来散布扭曲的观点,以制造更广范围的支持或者反对的假象。以假乱真实际上跟论坛马甲是同一个概念,只不过更为复杂、更有组织、规模更大。两种战术都使用虚拟人物在网络空间散布虚假信息,目的是引发群体反应或行动。以假乱真的网络信息作战行动包含海量文字、图片和视频,与有计划的误导性网络活动相结合,将显著增强CNCOIN行动的效果。 非常规网络战先遣队推进美国网络特种作战的第三种方式是非常规网络战先遣队(cyber-UW Pilot Team),利用社交媒体网络塑造实体环境,建立区域机制,在实施非常规战之前将各区域联通起来。非常规网络战先遣队的核心是特种部队,拥有多个专业机构提供的技术支持,其任务是在网络安全领域进行非常规作战的准备。传统先遣队的渗透目标是敌方领土、军事设施等实体目标,而非常规先遣队则是通过虚拟手段进行渗透,再潜入敏感、敌对或拒止区域。通过虚拟手段,可以减少美国及伙伴国武装力量在时间、风险、装备等方面的损失和风险。从概念上讲,非常规网络战先遣队利用网络工具和先进技术在社交媒体上打造人员、实体、情报以及信息基础设施。在加深对当地人文地形理解的同时,小组可以强化其本地语言和文化技能,还可识别抵抗活动领导者、评估动机和抵抗能力以及对美国政府目标的总体支持度,与此同时,还可以了解非正式的层级分布、心理及行为等。此外,还可以通过接入社交媒体网络混入互联网白噪音,以“提高美国对潜在合作者的文化理解以及在采取行动之前的当地形势。”虽然美国国家安全战略中早就承认了网络作战的战略作用,但是这种认识并没有完全转化成明晰的战略层面的思维和作战能力。例如,美国《国防部网络空间行动战略》中并没有给出多少解决方案或具体措施,仅仅从五个方面重复了先前的网络思路。缺乏明确的思路导致我们的网络战略存在缺陷,使得美国先进的网络技术优势有拱手让给潜在对手的风险。对比之下,伊朗和俄罗斯的非对称性创新为其他地区和全球力量树立了模仿的样板,都试图以非常规手段规避美国的军事优势,确保各自的战略利益。网络空间特种作战是一种必须填补的战略层面的能力空白。很显然,美国必须积极寻求一种在战术层面的非常规作战中融入网络空间作战的特种作战形式。兰德公司最近的一份研究特种作战的报告得出结论,称“美国需要运用一种更为先进的特种作战形式来确保国家利益,考虑到近来美国及其利益面临的安全威胁形势,特种作战成为确保国家利益的最合适的形式”。在一个日益互联的全球环境中,实体性基础设施快速被分配互联网协议地址,接入物联网。到2020年,将有500亿台“机器对机器”设备(目前为130亿台)会通过“嵌入计算机、传感器和互联网能力”接入网络空间。网络空间特种作战联通了虚拟与现实,通过现代的信息网络并与传统的面对面的特种作战伙伴关系相结合。当今的全球环境促使美国采用网络特种作战作为国家军事战略的战略性工具。潜在对手将进攻性网络能力与非常规战术相结合为美国的其他敌人树立了可怕的榜样,他们必将快速跟进。本文提出了融合新兴技术与特种作战的三种新选项:“云驱动”下的国外协助防御、网络反暴乱平叛行动以及非常规网络战先遣队。充分发挥这三种战术将不仅仅能维持美国的网络技术优势,还可对构建重要伙伴关系、塑造全频谱作战环境产生革命性影响。如果能成功实施,网络特种作战必将成为美国强有力的新战略选项。

 

2016-08-22 17:42现代军事

中國的網絡空間治理或衝突的困境選擇 – China’s Dilemma Choice of Cyberspace Governance or Conflict

中國的網絡空間治理或衝突的困境選擇 –

China’s Dilemma Choice of Cyberspace Governance or Conflict

Introduction
The problem of cyberspace security governance is attracting more and more attention from the international community. Among them, the problem of cyberspace conflict management is more and more concerned. Compared with the physical space conflict, the cyber space conflict has the characteristics of diversification of the actors, rapid updating of the attack means and unpredictability of the conflict. This leads to the reality that the cyberspace conflict management is faced with serious challenges such as serious cognitive differences, difficult to effectively govern, deterrence and “structural problems”. Therefore, the network space conflict governance needs to change the governance concept, through the pragmatic cooperation between countries, the integration of all the advantages of resources, to build a global network of governance mechanisms, and cultivate cooperation and sharing of governance culture. As a global network of countries, China has been actively advocating the establishment of multilateral, democratic and transparent global governance system. At the same time, China will make a positive contribution to the construction of international rules of cyberspace and the global network governance mechanism in the areas of innovation governance, bridging the digital divide, carrying out bilateral and multilateral international cooperation.
text
With the extensive application and rapid development of network information technology in the world, the relationship between network and national security is becoming more and more closely. Among the security issues, the most interesting is cyberspace conflict. Cyberspace is called “next battlespace” by military strategists and futurists. The primary objective of governments in cyberspace is to ensure that their core interests are not compromised and that nationals are protected from cyber attacks. But the reality is that the vast majority of cyber attacks are not directly initiated and implemented by the government, but are operated directly by non-state actors. Moreover, the cost of launching a network attack is low, action is hidden, and can cause serious consequences. This also causes cyberspace to burst out of clashes or even cyber warfare (cyber warfare). Once the cyberspace conflict or war, its size and scope of influence will be difficult to estimate. Cyber ​​space conflicts can also lead to direct hostility and conflict among nations in the real world. In addition, due to the lack of necessary international legal jurisdiction and norms, cyber conflict management is also facing serious challenges. Effective control of the intensity of cyberspace conflict, the development of cyberspace national code of conduct, will be the international community to explore new issues of cyber conflict.

First, the changes and challenges of

cyberspace conflict Network space conflict from the behavior of the network threat to the perception and the resulting response. Network threats can be broadly divided into two categories: one is called cyber attacks, is deliberately destroying the behavior of the network system; the other is called cyber exploitation (cyber exploitation), that is, the use of network infrastructure to achieve illegal purposes, but Will not harm the network system itself. [1] The target of cyber attacks is aimed at national and non-state actors, including sovereign states, organizations and individuals, which can disrupt both hardware and software and other aspects of the computer, or by improperly invasive computer operating systems Information or implement remote control. Network attacks can cause network conflicts, and network conflicts can be upgraded to cyber warfare. A cyber war generally refers to the destruction and disruption of a nation or nation that infiltrates another country’s computer or network. [2] cyber war can seriously endanger the country’s political, economic and social security and stability, is the highest form of network conflict. <A I = 3> Network information technology has the immediacy, convenience, cheap nature, so that conflict and war becomes easy to operate and implement. Network information technology to the traditional conflict and war has undergone a subversive change. As long as there is a network of computers, a few people can implement a network attack, launched a small-scale war without smoke. Network space weapons development costs are very low, as long as there are one or two computers, and can achieve network connectivity, and then equipped with several high-level hackers, is enough to create a very lethal network weapons. [3] Therefore, the impact of the Internet on national security will be comprehensive, thorough and unprecedented. Network information technology from the continuous innovation and development of communication technology. The emergence and continuous updating of instant messaging technology has enhanced the efficiency of political decision-making on the battlefield. Network information technology for the innovation of weapons technology has an important role in promoting, especially in the era of nuclear weapons, computer technology to make nuclear weapons more accurate, reliable and high speed. During the Cold War, the United States and the Soviet Union attached great importance to the development of information processing technology. With the comprehensive development of computer technology, the United States first proposed the “information warfare doctrine” (information warfare doctrine), that is, the use of information technology, tactics and means beyond the opponent. Western scholars said that the current international society is no greater risk of weapons of mass destruction, but large-scale destructive weapons (weapons of mass disruption). [4] In the technical breakthrough, cyber space conflict and war more profound changes reflected in the behavior of the main, means of attack and the consequences of conflict and so on. (I) Increasing diversity of actors The cyberspace provides a broader platform for non-State actors to move beyond the limits of territory and sovereignty and to play a greater role in reality and in the virtual world. Traditional conflicts and wars occur between different groups, generally monopolized by powerful states, and individual individuals are difficult to attack groups. Network information technology has greatly enlarged the power of relatively weak behavior. With the help of a network information platform, small countries can challenge the hegemonic countries, small groups can attack the powerful sovereign states, individuals can also attack the group. The United States has always regarded North Korea as a threat in cyberspace. According to the US Fox News Network reported that the beginning of 2010, the report shows that North Korea has trained thousands of top computer students to become excellent “cyber warrior” (cyber Warrior), whose operational targets are locked for the United States and South Korea. [⑤] In recent years, terrorism has also gained the “new life” with the help of network carrier and information tools. Al Qaeda uses Internet technology to promote its extreme ideas, and use the network platform to implement member recruitment, online training, fund raising, remote command and other activities. It can be said that the cyber space of the hidden and open features to increase the international community to prevent and combat the difficulty of terrorism. [⑥] In 2008, a 14-year-old boy in Poland, through the invasion and control of the Lodz tram system, caused confusion, resulting in four trams derailed, 12 people were injured, the accident did not cause death. [⑦] for the increasingly diverse network attackers, the US Strategic Command Command Kevin Hilton (Gen. Kevin P. Chilton) vividly believes that “our enemy range, including not only the boring young hackers, but also criminal organizations, but also related to national actors.” [ 2] Attack means to constantly update the original intention of the development of the Internet is to facilitate the effective flow of information to achieve resource sharing, interoperability. Open environment will often bring more risks and challenges to security, cyberspace and thus appeared in the “offensive and defensive imbalance” problem. This structural imbalance triggers cyber malicious attacks, thereby reducing confidence in deterrence and effective defense. [⑨] static defense in cyberspace (static defenses), that is, passive defense, refers to the most powerful hackers as a new challenge or to be resolved. [⑩] Skilled cyber attackers can easily find network vulnerabilities and successfully bypass security defense software. Compared with the traditional conflict, cyber space in the attackers in a shelter, and specifically attack the target of the weak links. In the “offensive side of the defensive side” in the context of the network of offensive weapons has become very common. The general network of offensive weapons, including computer viruses, malware, logic bombs (logic bombs, denial of service (denial of service) and so on. Low-end network weapons, the goal is simply to steal information, access to passwords, modify the program, generally do not produce significant harm. By contrast, high-end network weapons can cause data or critical facilities to be interrupted or severely damaged. A series of cyber attacks can evolve into major emergencies, breaking critical services over a period of time, including disrupting military command or information systems, shutting down power supply or oil pipelines, and stopping financial services. In 2008, the US Department of Defense to store encrypted military information on the computer network had infected with malicious code. Malicious code diffuses to encrypted and unencrypted file systems without being perceived. Although it was found in time, but the US military is very scared that such an event may make its military confidential documents are uploaded to foreign intelligence agencies, and even unknown hostile forces, the consequences will be disastrous. [11] Complex high-end malicious code has a strong self-camouflage ability, it is difficult to be found, often has been caused after serious injury will be found. In 2010, Iran’s nuclear facilities were attacked by “Stuxnet” (Stuxnet), making Iran’s Natanz uranium enrichment plant 1 More than 1,000 IR-1 centrifuges have to be replaced due to abnormal operation and damage. The fact that the “shock virus” attack target is very accurate or single, that is, the German Siemens control system (SIMATIC WinCC). This is a data acquisition and monitoring (SCADA) system, widely used by Iran in the defense of basic industrial facilities. “Seismic virus” in the invasion of a computer, it will automatically find the Siemens software to confirm the software found, the virus will be unaware of the state control of industrial computer systems, and control the computer software to other factories on the computer Issue a given order. Network security experts believe that the “earthquake network virus” is the first physical world infrastructure for the target “precision guidance” worm. [12] As the first disclosure of “shock virus” German well-known network security experts, Ralph Langner (Ralph Langner) through systematic analysis, that “shock network virus” structure than imagined even more complex , Including two different “digital warhead” (digital warhead), respectively, for different offensive targets, uranium enrichment facilities and Bushehr nuclear power plant external turbine. He believes that the power of the second warhead is equivalent to the Bushehr nuclear power plant for a precise air strike. [13] US information security expert Kevin Clayman (Kevin Coleman) 2010 in the United States National Defense Science and Technology published an article that the number of network attacks will be a sharp upgrade. To support this assertion, he mentioned that the number of malware in 2009 reached the highest level in the past 20 years, with multiple reports showing that more than 25 million malware was confirmed, and that growth would continue. [14] Through the above examples, it is easy to see the cyber space in the offensive weapon technology content is high and has a strong pertinence. Such weapons are more subtle, more precise, more offensive and destructive than conventional weapons. At the same time, network offensive weapons can not be reused, must be constantly upgrading. Matin Libici, a digital warfare expert at the famous American think tank, argues that it is no longer a weapon once someone knows how the cyber warfare works. The best weapon is the enemy does not know, but they already have. [15] (c) the consequences of conflict unpredictable <a I = 11> opponents in traditional conflicts are clearly visible, and the results of the conflict are predictable. In the conflict of cyberspace, once the offensive weapon is in power, the damage scale and influence caused by it are constantly copied and disseminated, and it is difficult to get effective control as the traditional conflict. More seriously, cyber attacks can bring serious panic to society, which is more serious than traditional wars. All kinds of infrastructure in modern society are controlled by computer and Internet systems. Once the network attacks are affected by water, electricity and financial control systems, the losses will be immeasurable and may even cause serious social unrest. American scholars envisioned the serious consequences of cyber attacks: no air control system or airport security system, no electronic control of rail traffic, no reliance on electronic computer day and night delivery of parcels or e-mails, no employer through payment software to pay workers wages Check, no electronic withdrawal record, no automatic teller machine, hospital or health center No reliable digital record, no electricity leads no light, no heat, no refueling system or fuel, petrol, no traffic lights, no phone, no internet service , There is no police effective security management, this series of problems will make the American society into a short-term paralysis. [16] According to the CIA revealed that the number of cyber attacks against the US public utility network in 2007 showed that the person in charge of the power company was even reluctant to talk about the risk of these events because of fear of serious social panic. In addition, the openness of cyberspace makes the network attacks happen and its scope of influence will be diffuse. In April 2013, hackers stole the Associated Press’s Twitter account and posted a false message that US President Barack Obama was injured in an explosion at the White House. A few minutes later, the Associated Press official used another Twitter account before the account was stolen. White House spokesman also clarified by President Obama did not hurt the radio. But many people have seen the news of the stolen Twitter account, the event led to the Dow Jones Industrial Average and S & P500 index both fell, after the two trading index and rapid rebound. Alert alleged that the Twitter account has 2 million audiences, the release of instant messaging is very influential. [17] The incident also sounded the alarm to the US government, with a simple account stolen event is likely to trigger a financial panic, which seriously disrupt the social order. The above new features of cyber conflict governance have had serious consequences. The diversity of the behavior makes it difficult to change the concept in a short time to overcome the differences and differences of cognition. The continuous innovation of the network attack means makes the international legal system and deterrence difficult to play the role. The unpredictable consequence is aggravating the inter- Mutual suspicion. These factors will seriously hinder the formation of cyberspace conflict management mechanism and play a role. Second, the network space conflict governance mechanism of the plight of cyberspace conflict and the traditional sense of the international conflict is very different. The main actors in the current global governance mechanism are sovereign states, who propose a series of rules and regulations on the basis of understanding and understanding of traditional armed conflicts. But in cyberspace, the effective regulation of the behavior of non-State actors is a matter of law and morality. And “structural dilemma” and other practical problems also exacerbated the difficulty of cyber conflict. (A) cognitive differences hinder effective governance At present, countries on the core concept of network security understanding of the network security events and their attribution (attribution) and identified there are deep differences. For example, the United States, Britain, Japan, Germany, France and the European Union have developed a network security strategy, through comparison can be found, the parties to “cyberspace”, “network security”, “network war” and other core concepts defined difference. [18] In cyberspace, how to determine that some of the acts have violated the basic norms of international law and can be used to combat Can individuals and organizations become the target of a national network attack? How do you define the national sovereignty of cyberspace? For these questions, the current international legal system has no ready answers. The United Nations, as a broadly representative international organization for the maintenance of international peace and security, has its own limitations, highlighting the development of the Charter of the United Nations much earlier than the arrival of the cyber-information age and therefore does not take into account the issue of cyber attacks. It is difficult to define cyber attacks as the use of force in accordance with prevailing norms of international law. During the three weeks before the 2008 Russian-Russian war, Unknown Acts used a commercial IP address to launch a decentralized denial service in several countries to attack the Georgian president’s website. The outside world believes that the relevant malware (named MachBo) was written in Russia and used by Russian hackers, although there is no definite proof that the Russian government has planned and implemented cyber attacks. Another dilemma faced by current international legal norms is the blurring boundary between cybercrime and cyber warfare. Realistic disagreement is manifested in the fact that the attacked state considers cybercrime to be a cybercrime and encourages implementation or support in the back of the country that cyber attacks are a cyber warfare for the maintenance of national interests. It can be seen that the lack of unified cognitive standards and operational guidelines make cyberspace conflict management difficult to carry out. In general, cyberspace behavior can be divided into three categories, one is legal (recognized is legal); the second is crime (illegal, the current legal norms that it is a crime); three is not legal (by the state and Non-state actors are found to be malicious, but the existing legal framework is not clearly defined). To be sure, cyber attacks should first fall within the jurisdiction of domestic law. If the attacker violates domestic law, the government of the host country is bound to enforce the jurisdiction. If the attacker attacked the target of another country, and the relationship between the target country and the host country is not friendly, there is a realistic problem. Especially for intelligence gathering, disruption of communications, or network behavior such as issuing erroneous directives to the enemy, it is easy for the implementer to be deemed to be a cyber attack because of being favored by the host country, So that it will not be punished. [19] (b) difficult to effectively govern international legal norms <a There are indeed many problems with the current international legal system and governance mechanisms. First, the existence of existing rules on armed conflict applied to cyberspace issues; second, the existing international rules can be applied to cyberspace governance, the majority of international rules focus on inter-State conflict, and cyberspace in the unconventional conflict But the more and more; third, the lack of legal experts; Fourth, the current rules focus on how to limit the network war, but the physical and collateral damage and other potential issues less concerned. [20] These problems make the existing international legal system not only effective control of cybercrime behavior, nor can it provide legal protection for civilian infrastructure and ordinary civilians. The Law of War and Armed Conflict (“the Law of Armed Conflict”) originated in the mid-19th century and is a humanitarian norm that regulates violence and conflict. The law of armed conflict applies exclusively to the conflict between the regular forces of the state. Countries in 1864 on the “Geneva Convention” to reach a consensus in 1868 in St. Petersburg officially signed. But the law of armed conflict, the Charter of the United Nations in the legal control of the war and wartime war behavior constraints are not applicable to cyberspace. And the existing legal norms do not clearly define the “war behavior” (war of act) concept. In general, war refers to the legal consequences of the use of force between States. The law of armed conflict is based on the use of force and aggression. In cyberspace, there is a great deal of controversy over whether cyber attacks are equal to the use of force and should be governed by the law of armed conflict. On the one hand, although not explicitly defined, it is generally believed that cyber attacks are hostile in cyberspace using network and information technology to achieve a certain purpose or effect; on the other hand, whether a cyber attack can be called For the conflict or war, still need the international community generally recognized. [21] There are gaps in the existing international legal norms for the control network space conflict. Within the existing international legal framework, the international legal norms governing conflict are the law of armed conflict, whose main legal sources are international treaties and international customs. It is the sum of binding principles, rules and regulations, and systems that adjust the relations between the warring parties and the warring parties and the neutral States in war and armed conflict. [twenty two] The subject of the law of armed conflict rests with the State and does not involve the question of the exercise of jurisdiction over individuals and international organizations. In addition, in the network attack, how to effectively distinguish between military and non-military objectives is also a real challenge. In the field of traditional warfare, military and non-military objectives are clearly defined, just as green tanks carry soldiers, and yellow cars carry students. But in the absence of clear boundaries in the cyberspace, the boundaries of the two are vague. The blurring of boundaries will lead to bias and shift of offensive targets, such as the blow to a country’s military facilities likely to shift to civilian infrastructure targets. In the network war, for the commander, it is difficult to distinguish which networks have military strategic objectives, which goals are civil. The more difficult problem is that it is difficult to determine the attacker’s long-range attack. Even if it is possible to determine the presence of the attacker and the attack itself, it is difficult to determine the identity of the attacker. Cyber ​​space conflict also exists on the application of the right of self-defense in traditional war. If a cyber attack against a country has occurred, the State under attack has the right to self-defense in accordance with the provisions of the Charter of the United Nations. But how to determine the implementation of the main body to determine whether the attack on the country’s attack, to define the extent of the attack, there is no uniform standard. Although the existing international legal system clearly stipulates that conventional wars can not use weapons of mass destruction, they are almost equivalent to the use of weapons of mass destruction if they are likely to be devastated by malicious code and malware. If this assumption is true, it will pose a serious challenge to the above principles. And if the network army in the public website embedded malicious code, and the infection code of the non-military system than the military system, which should be considered a violation of the principle of abuse of weapons. Whether there is a “network of weapons of mass destruction” in cyberspace, and the international community has not reached a consensus on the use and co-operation of these weapons that can cause serious consequences. In addition, the development of network information technology in the 21st century makes the soldiers separated from their war behavior. The closer the separation of the acts of war, the harder it is to preserve the humanitarian spirit implicit in the law of armed conflict. At the same time, the openness of cyberspace makes the public and private, government and private network mutual penetration, overlap each other. This will result in a joint attack on the consequences of a network attack and may cause physical damage and injury. (C) the network deterrence lost utility <a I = 25> cyberspace The international legal system is not yet sound is an existing fact, then can the cyber deterrence strategy be effectively implemented and achieve the intended purpose? The deterrence strategy emphasizes the strength and the will of the contest. Deterance refers to the strength of one party is strong enough to make its opponents can not attack, otherwise it will pay a significant price. The prerequisite for deterrence is the possibility and credibility: the possibility that one party has the absolute ability to launch retaliation and counterattack, credible means that at the crucial moment one party decides to impose the necessary blow to its opponent. To achieve the purpose of affecting the opponent’s decision-making, you need to let the opponent clearly understand and perceive the deterrent implementation of the absolute strength and revenge. In reality, there are serious limitations in the use of deterrence strategies in cyberspace: first, deterrence theory is generally applied between two powerful opponents, the deterrent can be effective to assume that the other is rational, can not bear the cost of attack. But in cyberspace, there may be a serious asymmetry between the attacking entity and the attacked object, and even if effective retaliation is implemented, the purpose of deterrence can not be achieved. Second, the asymmetry of retaliatory means would disrupt the existing international rules. If the network attacker only launched a general decentralized denial of attack, only led to the attacking country network system paralysis, if the attacking countries using conventional military and nuclear forces to fight back, will cause a lot of economic losses and casualties, which will Deviation from the “principle of proportionality” in international law, the return action will be the loss of legal legitimacy. Finally, cyber attacks are instantaneous, one-off, successful, or failing only in the twinkling of an eye. Successful attacks can cause harm, and the victim is retaliated after being attacked, and deterrence will be completely lost because the injury has arisen. In a cyber environment, a party that initiates a cyber attack usually attacks an attack through a “zombie computer” (a computer that has been hijacked after it invades), which adds significant difficulty to the attacker’s determination of the attacker. In addition, the process of determining the identity of the attacker takes a long time, after the confirmation is correct, the loss has been generated and irreversible. Re-implementation of such retaliation under such conditions would challenge the “self-defense principle” under international law, since Article 51 of the Charter of the United Nations clearly stipulates that “self-defense” is prerequisite for action against force. The more challenging issue is that if the attackers are identified as being an organization or an individual, the various norms of international law will not work. Former deputy secretary of the United States Department of Defense William Lynn Lynn) also mentioned the difficulty of the network deterrent, “deterrence credible prerequisite for the identity of the adversaries to confirm no doubt, but in the cyberspace almost no such case.” [23] (d) “structural problems” threat to international cooperation and the real world, cyberspace is also in anarchy. In this state, there is no absolute authority, so the relationship between the cyberspace state is facing a “structural problem.” This is highlighted as two aspects: First, the network developed countries and emerging network power between the competitive relationship, which is reflected in the network security issues on the two camps, “different voices.” The first camp is the United States led the Western countries group, they have introduced the corresponding national network security strategy, and put forward the values ​​of Western countries to reflect the cooperation and governance philosophy. In March 2014, the United States stated that it had strengthened bilateral and multilateral coordination and cooperation with the EU in matters related to the Internet. The United States made it clear that US-European cooperation is based on shared values, common interests, multi-stake governance concepts, cyber freedom and the protection of cyberspace human rights. [24] Early 2015, the United States and the United Kingdom expressed the need to protect key infrastructure, strengthen network defense, support network academic research and other aspects of pragmatic cooperation. [25] In June the same year, the United States and Japan to enhance network deterrence and strengthen information and intelligence sharing agreement. [26] It is not difficult to find that the first camp headed by the United States places more emphasis on the values ​​of freedom and democracy in cyberspace and strengthens its own network deterrent. The second camp is China, Russia and other emerging countries group. “Prism door incident” occurred, China and Russia and other countries are very concerned about maintaining the network of national sovereignty, called on the international community to pay attention to the United States to cyberspace open, free in the name of the actual violation of the sovereignty of other countries. At the BRICS National Summit in Brazil in 2014, Russia proposed strengthening the BRIC network security cooperation. [27] Russia and China as the representative of the BRIC countries that “WikiLeaks” and “prism door incident” shows that the United States and other Western countries in the network security issues on the implementation of double standards: on the one hand advocate the so-called absolute freedom of cyberspace, On the other hand use the network to steal other countries information. One of the two camps advocated “network freedom first”, the other side advocated “network sovereignty first”, the two sides views obvious and difficult to eliminate. <A I = 32> Second is the inequality between developed and developing countries. Developed countries because of the advantages of early development, has been in the network information technology has the initiative; and the majority of developing countries due to historical, economic development and technical conditions and other factors, network information technology has long been lagging behind. According to the statistics of the International Telecommunication Union and other relevant agencies, the number of online online users has reached 2.3 billion by 2011, the Internet penetration rate in developing countries is about 25%, the penetration of the Internet in developed countries is 70%, and the per capita Internet users in Europe Bandwidth is equivalent to 25 times the bandwidth of Africa’s per capita. [28] Inequality in status will allow the vast majority of developing countries to remain marginal and passive. Although the United States and other Western countries put forward on the network security issues to the vast number of developing countries to provide the necessary assistance, but because they are in the implementation of assistance along with the concept of Western values, in fact, the majority of developing countries, “value output.” The majority of developing countries are very worried about the United States and other Western countries to form a network security technology level of “dependency”, the network space conflict governance North-South cooperation is also difficult to achieve. Third, the network space conflict mechanism of governance mechanism to explore the war has entered the information age, the existing international law should be necessary to improve and upgrade. The diversity of actors, the escalating offensive technology, and the uncertainty of the consequences call global governance of cyberspace conflicts. People are aware that cybercrime, cybercriminals, and cyber-terrorism have become global problems that can not be solved by the power of individual countries alone. Thus, the issue of cybersecurity is not just the domestic security of individual countries, but it is necessary to carry out long-term, extensive and in-depth international cooperation. At the same time, the existing international legal norms need to be updated and perfected. In the case of international legal norms governing the international conflict, prevention and control of cyberspace conflicts should be increased. At the same time, cyberspace cooperation requires the cultivation of peace and cooperation, development and win-win governance philosophy. Only the concept of governance enjoys popular support, international cyberspace conflict governance action will be concerned about, but also in the international community is widely recognized. (A) the transformation of global governance awareness Although there are Estonia, the Georgia network attack and “earthquake network virus” on Iran’s nuclear facilities caused serious damage and other typical cases, but so far there has been no large-scale inter-country network conflict. Nevertheless, people are still highly concerned about the cyberspace conflict, the urgent need to change the corresponding sense of governance. <A First, the most important subject involved in the management of cyberspace conflict is still the sovereign state. Although the role of individuals and groups is magnified by cyberspace, their power is still limited. Individuals and groups lead to large-scale network conflict and even the possibility of war is still minimal. Therefore, the focus on the network conflict should still be the country. Only countries in accordance with the law to effectively manage and regulate their own and their domestic organizations, individual behavior, cooperation between countries can play a role. Second, to coordinate and integrate the power and resources. Need to pay special attention to is that cyberspace itself beyond the borders, can not fully rely on government and national power. The United States and Europe and other Western countries in the network defense is the most worth learning experience is the full integration of civil resources, to achieve effective interaction between the official and civil. Should be aware of non-state actors in the field of cybersecurity in the important role, rather than national actors also hope to cooperate with the government to reduce network risk. [29] In 2010, the National Security Agency (NSA) in the Google company suffered high persistence attacks (Advanced Persistent Threat, APT), to provide information and technical assistance. [30] The basic elements of cyberspace are individuals and social groups, only to stimulate the vitality of individuals and social organizations, to enhance their network security and cooperation awareness, cyberspace will be more secure. In the government’s active promotion, the integration of technical personnel, experts and scholars, social groups, enterprises, government and other resources in order to effectively eliminate all kinds of cyberspace threats. In some cases, the need to deal with cyberspace problems also need to find answers in the network. In reality, the use of “white off” is an important strategic choice. In January 2014, the Russian Federation Committee proposed the use of “white off” (no criminal criminal record, can find a system of loopholes and experienced network of experts) services to deal with complex and volatile network attacks. [31] US network security software vendor experts also stressed that should be concerned about the “white” group, can not let it be tempted by the dark forces or even use. [32] Third, the implementation of hierarchical management of network behavior. The biggest challenge facing the international community is that countries can not agree on many cyberspace governance issues. From the point of view of harm, low to high behavior includes cyber vandalism, cyber espionage and cybercrime, denial of service, cyber attacks and large-scale cyber attacks. The first three categories already exist, and network attacks and large-scale network attacks have not yet occurred, although it is the most concern, but also the most likely to lead to network conflict behavior. Because cyber attacks and large-scale cyber attacks are targeted at key infrastructure, it can lead to serious social unrest in the attacked countries. Thus, such acts are almost intolerable and can cause reprisals by the injured State. For the first three categories of relatively light sabotage, the parties can be resolved through consultation and cooperation; for possible serious consequences of network attacks and large-scale attacks, countries should be through consultation to achieve a clear ban on such acts of cyberspace international code of conduct The (B) to cultivate the concept of cooperation in cyberspace “attack side overwhelming” reality makes cyberspace deterrence difficult to achieve, which will encourage the network intruder from another direction, eventually leading to network arms race. On the surface, the attack can bring some benefits and produce a sense of security, but the consequences will be cyberspace behavior between the competition, mutual hostility. Therefore, in the Internet, open network space is impossible to obtain absolute security. <A I = 42> On the contrary, if the defensive side is dominant, the behavior is more inclined to cooperate. Any threatened intrusion is carried out on the basis of successful defensive measures. Therefore, to enhance the defense capacity in order to obtain positive and lasting security. This requires the establishment of two types of mechanisms: one is the early warning mechanism, so that the attacked countries can early detection and take the necessary preventive measures. From the “network virus” attacks can be seen in the case, the virus invasion must bypass the victim’s security firewall. If you take a security defense measures, “earthquake network virus” is unable to implement the damage. Second, the information sharing mechanism, the parties to coordinate and cooperate with each other will help to achieve common security. This first requires the sharing of information between countries, which can increase mutual trust, is conducive to pragmatic and effective cooperation to achieve mutually beneficial win-win goal. Second, the sharing of information between government and private enterprises is also necessary. In many cases, the country’s infrastructure is operated by private enterprises, but there are obvious shortcomings in the information and intelligence collection channels, quantity and quality compared with the country. Third, in the network space conflict management should also focus on cultivating the “humanitarian” spirit, in the physical space to attack the party has the obligation to minimize the harm of civilians. Any country with strong technical capacity must also consider minimizing civilian damage when using cyber weapons. Some scholars even believe that the degree of damage caused by network weapons should be limited to less than a bomb damage. [33] (c) the establishment of conflict governance mechanism The international community has been advocating the creation of international mechanisms for conflict resolution, its purpose is through the policy coordination between countries, on the basis of consensus on the formation of network conflict management mechanism, and gradually establish cyberspace International order, and thus cultivate a global network of space management culture. [34] The international community attaches great importance to the inconceivable destructive power and influence of cyber space conflicts. In practice, attempts are made to bilateral and multilateral cooperation and have achieved some results, which can provide the necessary reference for the construction of global cyberspace governance mechanism. As the most influential intergovernmental organization, the United Nations should play a leading role in the governance of cyberspace conflict. The United Nations cyberspace conflict management mechanism is not widely represented and is not universally recognized by the international community. As early as 2006, the United Nations set up an open Internet Governance Forum (Internet Governance Forum, IGF). [35] As of 2014, the Internet Governance Forum has been held for nine consecutive sessions. In April 2015, the United Nations launched a dialogue with Russia on the International Convention on Cybercrime, but there was no consensus on the serious differences between developed countries and developed countries and organizations such as the United States, Canada and the European Union. This shows that countries have opened the door to dialogue for a global agreement. [36] As a specialized agency of the United Nations, the International Telecommunication Union (ITU) has also played an important role, actively advocating the “stakeholder” (stakeholder) concept, called on countries around the world to participate in the process of safeguarding the international community network security. The exploration and attempt of the international community shows that cyberspace governance itself is part of global governance. Every country faces the threat of cyber attacks, network conflicts and even cyber warfare. Participation in multilateral cooperation is the best choice for all countries to safeguard their own interests. At the same time, regional international organizations are also exploring new models of cyberspace governance. The 7th SCO Council of the Shanghai Cooperation Organization (SCO), held in 2007, proposed the Action Plan for information security, emphasizing the state’s control over the network system and information content. At the beginning of 2008, NATO convened an emergency meeting of the North Atlantic Council for the Estonian incident and introduced a cyber-defense policy, which for the first time established cyber security issues as the content of its collective defense obligations. NATO claims that if its member countries are subjected to catastrophic cyber attacks, the new cybersecurity policy will provide an effective counterattack tool. In April, NATO Cyber ​​Defense Management Authority (CDMA) was established to form a unified deployment of allied network action capabilities. In May, the Cooperative Cyber ​​Defense Center of Excellence, CCS COE) was formally established in Tallinn to strengthen the comprehensive capabilities of NATO’s network defense, and the establishment of the two institutions became a symbol of NATO’s network defense. [37] NATO officials also expressed their intention to cooperate safely with cyberspace in South Korea and other East Asian countries. In the current global governance mechanism, the success of cyberspace conflict management is the Mutual Legal Assistance Treaties (MLATs). It is aimed at nationally recognized cybercrime, which stipulates that participating countries share information, evidence and other forms of cooperation. The treaty is mainly applicable to the use of the network system to implement the crime. The Council of Europe Convention on Cybercrime (CEC) was signed by the Council of Europe in 2001 to define and punish the deterrence of cybercrime. The Cybercrime Convention is the most important multilateral cooperation agreement against cyber attacks and the world’s first international convention against cybercrime, which will have a significant impact on the legislation of many countries. Some scholars have suggested that international justice cooperation in the fight against cybercrime be carried out in accordance with the Convention. [38] Joseph Chennai believes that restricting all cybercrime is impossible, but it can be done from combating cybercrime and cyber-terrorism, and the great powers have many common interests on these issues. [39] Whether it is the United Nations or other regional international organizations, through their own practice to explore the global model of cyberspace governance. These practices will greatly enrich the theoretical basis and practical experience of cyberspace conflict management, which is of great significance to promote the international community to construct the relevant governance mechanism. The ultimate goal of cyberspace conflict management is to break through the differences of ideas, on the basis of common interests, to achieve beyond the borders, areas, levels of all-round, three-dimensional cooperation, and ultimately clean up the network space, to good governance. This process may take a long time and requires the joint efforts of the international community. China’s role and contribution in cyberspace conflict management According to China’s Internet Center (CNNIC) released the 36th “China Network Development Statistics Report” shows that by June 2015, the number of Internet users in China has reached 668 million, the Internet Penetration rate of 48%. 4%. This shows that China is already the largest number of Internet users in the country, but also shows that the Chinese people’s production and life, economic growth and innovation are closely related with the network, China has become a veritable global network power. As a global power, China has always positioned itself as a participant, builder and practitioner in cyberspace security governance. China’s national strategy is to develop from a network of major powers as a network power, and to promote the development of balanced development, sound rules and reasonable order of the global network space and make unremitting efforts. As the largest developing country, China has long been committed to the struggle for the vast number of developing countries, and actively participate in the construction of peace, security, openness and cooperation of cyberspace, and promote the establishment of multilateral, democratic and transparent global Internet governance system. At the same time, the Chinese government has put forward the principle of network governance with Chinese characteristics on the basis of the existing experience of governance, such as the rule of law, the order priority and the positive integration, which is similar to those of China. Furniture has important reference value and reference significance. [41] In September 2015, when the Chinese President visited the United States, he said in a written interview with The Wall Street Journal that China was a strong defender of cybersecurity. On the one hand, China will strengthen cooperation with the United States, the European Union, Russia, through the establishment of bilateral and multilateral cooperation mechanism to increase mutual trust, and is committed to building network security code of conduct. On the other hand, China will be more active in cyberspace global governance, and strive to incorporate the concept of safeguarding network sovereignty, network fairness and pragmatic cooperation advocated by China into cyberspace international standards. At the same time, China will also fulfill its commitments to actively promote the construction of cyberspace global order. In addition, China is working on the development of national network security for the relevant legal norms. In June 2015, the National People’s Congress for the first time considered the “People’s Republic of China Network Security Law (Draft)”. Article 5 of the General Regulations clearly states that “China will actively strengthen international exchanges and cooperation in the areas of cyberspace governance, network technology research and development and standard setting, and crack down on crimes against the Internet, and promote the construction of peaceful, safe, open and cooperative cyberspace. [42] This shows that China is committed to the law through the definition of network security, safeguarding network sovereignty, standardize network behavior, promote international cooperation in cyberspace. At the same time, China is also actively advocated in cyberspace governance to play the leading role of the United Nations. In 2011, China and Russia jointly submitted the International Code of Conduct for Information Security to the 66th Session of the General Assembly, put forward a series of basic principles of national conduct on the maintenance of information and cybersecurity, and called on countries to carry out further discussions within the framework of the United Nations. [43] In June 2013, China and the United States and other 15 countries in the United Nations network security dialogue, clearly advocated the “United Nations Charter” applies to cyberspace. [44] In 2014, China and the United Nations jointly organized the International Symposium on Information and Internet Security, which is an important manifestation of China’s international rules for promoting cyberspace. In December 2015, Chinese President Xi Jinping delivered a speech at the Second World Internet Conference to elaborate on China’s basic position on cyberspace development and security, demonstrating China’s forward-looking thinking about the future development of cyberspace and calling for Countries around the world should strengthen communication, expand consensus, deepen cooperation, and jointly build the network space fate community. [45] In addition, China is also actively safeguarding the cyberspace interests of developing countries and “network sovereignty”. China advocates bridging the digital divide on multiple international occasions. Cyber ​​space threat is no border, its impact is transnational. Network vulnerabilities in many developing countries will be targets of attack, and they may also be manipulated into “bonnet” (bonnet) to attack other countries. In the field of Internet technology applications and development, there is a clear gap between China and Western countries. China advocates that the network is primarily used for commercial purposes and not for political and military purposes. In the future, China will continue to carry out independent research and development and innovation in network security technology. These network security technologies can become an important part of China’s foreign technical assistance. At present, China is promoting the “one way along the road” construction, which focus on cooperation, including the promotion of national and regional network infrastructure. At the same time, China is also willing to assume more responsibility and play an active role in cyberspace cooperation. In 2014, China and the United Nations jointly organized the International Symposium on Information and Internet Security, which is an important manifestation of China’s international rules for promoting cyberspace. In December 2015, Chinese President Xi Jinping delivered a speech at the Second World Internet Conference to elaborate on China’s basic position on cyberspace development and security, demonstrating China’s forward-looking thinking about the future development of cyberspace and calling for Countries around the world should strengthen communication, expand consensus, deepen cooperation, and jointly build the network space fate community. [45] In addition, China is also actively safeguarding the cyberspace interests of developing countries and “network sovereignty”. China advocates bridging the digital divide on multiple international occasions. Cyber ​​space threat is no border, its impact is transnational. Network vulnerabilities in many developing countries will be targets of attack, and they may also be manipulated into “bonnet” (bonnet) to attack other countries. In the field of Internet technology applications and development, there is a clear gap between China and Western countries. China advocates that the network is primarily used for commercial purposes and not for political and military purposes. In the future, China will continue to carry out independent research and development and innovation in network security technology. These network security technologies can become an important part of China’s foreign technical assistance. At present, China is promoting the “one way along the road” construction, which focus on cooperation, including the promotion of national and regional network infrastructure. At the same time, China is also willing to assume more responsibility and play an active role in cyberspace cooperation. In 2014, China and the United Nations jointly organized the International Symposium on Information and Internet Security, which is an important manifestation of China’s international rules for promoting cyberspace. In December 2015, Chinese President Xi Jinping delivered a speech at the Second World Internet Conference to elaborate on China’s basic position on cyberspace development and security, demonstrating China’s forward-looking thinking about the future development of cyberspace and calling for Countries around the world should strengthen communication, expand consensus, deepen cooperation, and jointly build the network space fate community. [45] In addition, China is also actively safeguarding the cyberspace interests of developing countries and “network sovereignty”. China advocates bridging the digital divide on multiple international occasions. Cyber ​​space threat is no border, its impact is transnational. Network vulnerabilities in many developing countries will be targets of attack, and they may also be manipulated into “bonnet” (bonnet) to attack other countries. In the field of Internet technology applications and development, there is a clear gap between China and Western countries. China advocates that the network is primarily used for commercial purposes and not for political and military purposes. In the future, China will continue to carry out independent research and development and innovation in network security technology. These network security technologies can become an important part of China’s foreign technical assistance. At present, China is promoting the “one way along the road” construction, which focus on cooperation, including the promotion of national and regional network infrastructure. At the same time, China is also willing to assume more responsibility and play an active role in cyberspace cooperation. The focus will include advancing national and regional network infrastructure. At the same time, China is also willing to assume more responsibility and play an active role in cyberspace cooperation. The focus will include advancing national and regional network infrastructure. At the same time, China is also willing to assume more responsibility and play an active role in cyberspace cooperation.

 

Original Mandarin Chinese:

簡介
網絡空間安全治理問題正日益引起國際社會的普遍關注;其中,網絡空間衝突治理問題更是備受關注。與現實的物理空間衝突相比,網絡空間衝突具有行為體多元化、進攻手段快速更新、衝突後果不可預知等新特點。這導致網絡空間衝突治理面臨認知分歧嚴重、規範難以有效管轄、威懾無效和“結構性難題”等現實挑戰。因而,網絡空間衝突治理需要轉變治理理念,通過國家間務實合作,整合各方優勢資源,構建網絡空間全球治理機制,並培育合作、共享的治理文化。作為全球網絡大國,中國一直以來都積極倡導建立多邊、民主、透明的全球治理體系。同時中國將在創新治理理念,彌合數字鴻溝,開展雙邊、多邊國際合作等方面,為構建網絡空間國際規則和全球網絡治理機製作出積極貢獻。
正文
隨著網絡信息技術在全球範圍內的廣泛應用和快速發展,網絡與國家安全的關係日趨緊密且受到各國高度重視。在安全議題中,最引人關注的是網絡空間衝突。網絡空間被軍事戰略學家和未來學家稱為“下一個戰爭空間”(next battlespace)。各國政府在網絡空間中的首要目標是確保本國的核心利益不受損害,保障國民免受網絡襲擊的侵擾。但現實情況是絕大多數網絡襲擊並非由政府直接發動和實施,而是由非國家行為體直接策劃操作。而且,發動網絡襲擊的成本低廉、行動隱蔽,且能引發嚴重後果。這也造成網絡空間容易爆發衝突甚至網絡戰爭(cyber warfare)。一旦網絡空間發生衝突或戰爭,其規模和影響範圍將難以估量。網絡空間衝突也可能導致國家間在現實世界中的直接敵對與衝突。此外,由於缺乏必要的國際法律管轄與規範,網絡空間衝突治理也面臨著嚴峻挑戰。有效控製網絡空間衝突的烈度,制定網絡空間國家行為準則,將是國際社會探索網絡空間衝突治理的新課題。

一、網絡空間衝突的變化與挑戰

網絡空間衝突源於行為體對網絡威脅的感知和由此作出的反應。網絡威脅大致可分為兩類:一類被稱為網絡襲擊,是指蓄意破壞網絡系統的行為;另一類被稱為網絡牟利(cyber exploitation),即利用網絡基礎設施來達到非法目的,但不會對網絡系統本身造成傷害的行為。 [①] 網絡襲擊針對的目標是國家和非國家行為體,包括主權國家、組織和個人,既可以破壞軟硬件和計算機的其他方面,也可以通過非法入侵計算機操作系統,運用不正當的手段獲取信息或實施遠程控制。網絡襲擊可能引發網絡衝突,而網絡衝突又可能升級為網絡戰爭。網絡戰爭一般是指一個民族國家為滲入另一個國家的計算機或網絡所進行的破壞和擾亂行為。 [②] 網絡戰爭可能嚴重危害國家的政治、經濟和社會安全與穩定,是網絡衝突的最高形式。
網絡信息技術所具備的即時性、便捷性、廉價性特質,使衝突和戰爭變得易於操作和實施。網絡信息技術使傳統的衝突與戰爭發生了顛覆性變革。只要有一台聯網的計算機,少數人就可以實施網絡攻擊,發動一場沒有硝煙的小規模戰爭。網絡空間的武器開發成本極低,只要有一兩台計算機,且能夠實現網絡連接,再配備幾名高水平的黑客,就足以製造極具殺傷力的網絡武器。 [③] 因此,互聯網對國家安全的影響都將是全面的、徹底的和前所未有的。網絡信息技術源自通訊技術的不斷創新與發展。即時通訊技術的出現和不斷更新,提升了戰場上的政治決策效率。網絡信息技術對於武器技術的革新具有重要推動作用,尤其是在核武器時代,計算機技術使核武器更加精準、可靠和高速。冷戰時期,美、蘇兩國十分重視發展信息處理技術。隨著計算機技術的全面發展,美國率先提出了“信息戰理念”(information warfare doctrine),也就是利用信息技術力量,在策略和手段方面超越對手。西方學者表示,目前國際社會最大的隱患不再是大規模殺傷性武器,而是大規模破壞性武器(weapons of mass disruption)。 [④] 在技術突破之外,網絡空間衝突與戰爭更深刻的變革體現在行為主體、攻擊手段和衝突後果等方面。
(一)行為主體日益多元化
網絡空間為非國家行為體提供了更加廣闊的活動平台,使其可以超越領土和主權的限制,在現實和虛擬世界發揮更大的作用。傳統的衝突與戰爭發生在不同群體之間,一般被實力強大的國家所壟斷,而單獨個體難於發動對群體的攻擊。網絡信息技術極度放大了相對弱小行為體的力量。借助於網絡信息平台,小國可以向霸權國發起挑戰,規模小的群體可以向實力強大的主權國家發動襲擊,個人也可以發動對群體的攻擊。美國一直以來都將朝鮮視為網絡空間中的威脅。據美國福克斯新聞網透露,2010年年初的報告顯示,朝鮮已經培訓了數千名頂級的計算機專業學生成為出色的“網絡戰士”(cyber warrior),其行動目標鎖定為美國和韓國。 [⑤] 近年來,恐怖主義也藉助網絡載體和信息工具獲得了“新生”。基地組織利用互聯網技術宣傳其極端理念,並利用網絡平台實施成員招募、在線培訓、資金募集、遠程指揮等活動。可以說,網絡空間的隱蔽性和開放性特徵加大了國際社會防範和打擊恐怖主義的難度。 [⑥] 2008年,波蘭一名14歲少年通過入侵並控制洛茲市(Lodz)的有軌電車系統,從而引發混亂,導致4輛電車脫軌,12人受傷,所幸事故未造成人員死亡。 [⑦] 對於日益多元化的網絡襲擊者,美國戰略司令部司令凱文·希爾頓(Gen. Kevin P. Chilton)曾形像地認為,“我們的敵人范圍,不僅包括令人厭煩的年輕黑客,也包括犯罪組織,還涉及國家行為體”。 [⑧]
(二)攻擊手段不斷更新
互聯網發展的初衷是便於信息的有效流動,實現資源共享、互聯互通。開放的環境往往會給安全防禦帶來更多風險和挑戰,網絡空間中因而出現了“攻守不平衡”問題。這種結構上的不平衡會激發網絡惡意攻擊,從而降低對威懾和有效防禦的信心。 [⑨] 網絡空間中的簡單靜態防禦(static defenses),即被動防禦,是指最多被強大的黑客視為一個新挑戰或待解決的問題。 [⑩] 技術嫻熟的網絡襲擊者能夠輕鬆找到網絡漏洞並成功繞開安全防禦軟件。與傳統的衝突相比,網絡空間中的襲擊者處於隱蔽處,並專門攻擊目標的薄弱環節。在“攻方壓倒守方”的背景下,網絡進攻性武器變得十分普遍。一般的網絡進攻武器,包括計算機病毒、惡意軟件、邏輯炸彈(logic bomb)、拒絕式服務(denial of service)等。低端網絡武器的目標只是簡單的竊取信息、獲取密碼、修改程序等,一般不會產生重大危害。相比較而言,高端網絡武器能夠造成數據和關鍵設施的中斷或嚴重受損。一系列的網絡攻擊能夠演變為重大突發事件,在一段時期內中斷關鍵服務,包括破壞軍事指揮或信息系統,關閉電力供應或石油管道,停止金融服務等。 2008年,美國國防部儲存加密軍事信息的電腦網絡就曾感染惡意代碼。惡意代碼在未被察覺的情況下擴散到加密和未加密文件系統。雖然被及時發現,但美國軍方對此十分恐慌,認為此類事件可能會使其軍事機密文件被上傳給國外情報機構,甚至是未知的敵對勢力,後果將不堪設想。 [11]
複雜高端的惡意代碼具有很強的自我偽裝能力,很難被發現,往往是在已經造成嚴重傷害後才會被發現。 2010年,伊朗核設施受到“震網病毒”(Stuxnet)的攻擊,使伊朗納坦茲鈾濃縮工廠的1 000多台IR-1型離心機由於非正常運轉並遭到破壞而不得不更換。事實表明,“震網病毒”的攻擊目標非常精確或單一,即德國西門子公司控制系統(SIMATIC WinCC)。這是一款數據採集與監視控制(SCADA)系統,被伊朗廣泛使用於國防基礎工業設施。 “震網病毒”在入侵一台電腦後,就會自動尋找西門子軟件,確認找到軟件後,這種病毒會在無人察覺的狀態下控制工業用的電腦系統,並控制電腦軟件對工廠其他電腦發出既定指令。網絡安全專家認為,“震網病毒”是第一個以物理世界基礎設施為攻擊目標的“精確制導”蠕蟲病毒。 [12] 作為第一個披露“震網病毒”的德國著名網絡安全問題專家,拉爾夫·朗納(Ralph Langner)經過系統分析,認為“震網病毒”的結構比想像中的還要復雜,包含兩個不同的“數字彈頭”(digital warhead),分別針對不同的進攻目標,鈾濃縮設施和布什爾核電站的外部渦輪機。他認為第二個彈頭的威力相當於對布什爾核電站進行一次精確的空中打擊。 [13] 美國信息安全問題專家凱文·克萊曼(Kevin Coleman)2010年在美國國防科技網上發表的文章認為,網絡襲擊的數量將會急劇升級。為支持這一論斷,他提到2009年惡意軟件的數量達到了此前20年來的最高水平,多份報告顯示超過2 500萬個惡意軟件被確認,而且這種增長趨勢還將繼續。 [14]
通過以上事例,不難看出網絡空間中的進攻武器技術含量高且具有極強的針對性。這樣的武器比常規武器更隱蔽、更精準、更具進攻性和破壞性。與此同時,網絡進攻性武器不能重複使用,必須不斷升級換代。美國著名智庫蘭德公司的數字戰專家馬丁·利比奇(Matin Libici)認為,一旦有人了解了網絡戰武器的工作原理,它就不再是一種武器了。最好的武器是敵人所不知,但自己卻已擁有的。 [15]
(三)衝突後果不可預知
傳統衝突中的對手是清晰可見的,衝突的結果也是可以預測的。在網絡空間的衝突中,進攻武器一旦發揮威力,所造成的破壞規模和影響力一般都會不斷地複制和散播,很難像傳統衝突那樣能夠得到有效控制。更為嚴重的是,網絡襲擊會給社會帶來嚴重恐慌,其後果比傳統戰爭更為嚴重。現代社會中的各類基礎設施都是由計算機和互聯網系統控制,一旦網絡襲擊波及水、電、金融控制系統,帶來的損失將是無法估量的,甚至可能造成嚴重的社會動盪。美國學者設想了網絡攻擊可能引發的嚴重後果:沒有航空控制系統或者機場安監系統,沒有電子管控的鐵路交通,沒有依賴電子計算機日夜投遞的包裹或郵件,沒有雇主通過支付軟件支付工人工資的電子支票,沒有電子取款記錄,沒有自動取款機,醫院或者健康中心沒有可信賴的數字記錄,沒有電力導致沒有燈光,沒有熱力,沒有加油系統或者燃料、汽油,沒有交通信號燈,沒有電話,沒有網絡服務,沒有警察有效的治安管理,這一系列問題將使美國社會陷入短時癱瘓。 [16] 據美國中央情報局透露的發生在2007年針對美國公用電力網的多起網絡襲擊事件表明,由於擔心會造成嚴重的社會恐慌,電力公司的負責人甚至不願談及這些事件的風險。
此外,網絡空間的開放性特徵使網絡襲擊一旦發生,其影響範圍將具有擴散性。 2013年4月,黑客竊取了美聯社的推特賬號,發布了美國總統奧巴馬在白宮的一次爆炸中受傷的虛假消息。幾分鐘後,美聯社官方使用另一個推特賬號聲明之前的賬戶已被盜。白宮發言人也通過廣播澄清奧巴馬總統沒有受傷。但已有很多人看到了被盜推特賬號發布的消息,該事件導致道瓊斯工業指數和S&P500指數雙雙下挫,之後兩個交易指數又快速反彈。據稱美聯社的推特賬號有200萬受眾,其發布的即時消息影響力十分巨大。 [17] 這一事件也給美國政府敲響了警鐘,一起簡單的賬戶被盜事件很可能引發一場金融恐慌,從而嚴重擾亂社會秩序。
網絡衝突治理的上述新特點產生了嚴重的後果。行為體的多樣性使人們很難在短時間內轉變觀念,克服認知差異與分歧;網絡攻擊手段的不斷革新使國際法律制度和威懾很難發揮作用;而後果的難以預測則加重了國家間的相互猜疑。這些因素將嚴重阻礙網絡空間衝突治理機制的形成並發揮作用。

二、網絡空間衝突治理機制的困境

網絡空間衝突與傳統意義上的國際衝突有很大差異。現行全球治理機制的主要行為體是主權國家,它們在對傳統武裝衝突理解和認知的基礎上提出一系列管控規則。但在網絡空間中,對非國家行為體的行為進行有效規範在法律和道德方面是一個空白。而“結構性困境”等現實問題也加劇了網絡空間衝突治理的難度。
(一)認知分歧阻礙有效治理
當前,各國對網絡安全核心概念的理解以及對網絡安全事件的歸因(attribution)和認定都存在深刻分歧。例如,美、英、日、德、法和歐盟等都制定了網絡安全戰略,通過對比可以發現,各方對“網絡空間”、“網絡安全”、“網絡戰爭”等核心概念的界定存在明顯差別。 [18] 在網絡空間中,如何確定一些行為已經違反了國際法基本準則,並可以實施武力打擊?個人和組織是否可以成為國家發動網絡進攻的目標?如何界定網絡空間的國家主權?對

注释:

[①] Abraham D. Sofaer, David Clark, Whitfield Diffie, “Cyber Security and International Agreements,” in Proceedings of a Workshop on Deterring Cyberattacks: Informing Strategies and Developing Options for U.S. Policy, Washington, D.C.: The National Academies Press, 2010, pp. 179-180.
[②] Richard A. Clarke and Robert Knake, Cyber War: The Next Threat to National Security and What to Do about It, New York: Harper Collins, 2010, p. 10.
[③] 樊高月、赵力昌主编:《不流血的战争:网络攻防经典之战》,解放军出版社2014年版,第117页。
[④] Craig B. Greathouse, “Cyber War and Strategic Thought: Do the Classic Theorists Still Matter?” in Jan-Frederik Kremer and Benedikt Muller, eds, Cyberspace and International Relations: Theory, Prospects and Challenges, Verlag Berlin and Heidelberg: Spinger, 2014, p. 23.
[⑤] Kelley Beaucar Vlahos, “Special Report: The Cyberwar Threat from North Korea,” Fox News, February 14, 2014, http://www.foxnews.com/tech/2014/02/14/cyberwar-experts-question– north-korea-cyber-capabilities.
[⑥] 丛培影、黄日涵:《网络恐怖主义对国家安全的新挑战》,载《江南社会学院学报》2012年第2期,第2页。
[⑦] John Leyden, “Polish Teen Derails Tram after Hacking Train Network,” The Register, January 11, 2008, http://www.theregister.co.uk/2008/01/11/tram_hack/.
[⑧] Kelvin P. Chilton, “Cyberspace Leadership Towards New Culture, Conduct and Capabilities,” Air & Space Power Journal, Fall 2009, p. 7.
[⑨] Kenneth Lieberthal and Peter W. Singer, “Cybersecurity and U.S.-China Relations,” Brookings Institution, February 23, 2012, http://www.brookings.edu/~/media/research/files/papers/ 2012/2/23 cybersecurity china us singer lieberthal/0223_cybersecurity_china_us_lieberthal_singer_pdf_english.pdf.
[⑩] Erik M. Mudrinich, “Cyber 3.0: The Department of Defense Strategy for Operating in Cyberspace and Attribution Problem,” The Air Force Law Review, Vol. 68, p. 181.
[11] William J. Lynn, “Defending a New Domain: The Pentagon’s Cyber Strategy,” Foreign Affairs, September/October 2010, Vol. 89, No. 5, p. 97.
[12] 樊高月、赵力昌主编:《不流血的战争:网络攻防经典之战》,第123页。
[13] Jerusalem Post, “Stuxnet Specifically Targeted Iranian Nuclear Program,” The Jerusalem Post, November 20, 2010, http://www.jpost.com/Iranian-Threat/News/Stuxnet-specifically– targeted-Iranian-nuclear-program.
[14] Paul A. Matus, “Strategic Impact of Cyber Warfare Rules for the United States,” Homeland Security Digital Library, March 23, 2010, http://www.handle.dtic.mil/100.2/ADA522001.
[15] 《源代码之战》,载《国际金融报》2011年8月1日,第4版,http://paper.people.com.cn/ gjjrb/html/2011-08/01/content_885812.htm?div=-1。
[16] Michael J. Glennon, “State-level Cybersecurity,” Policy Review, February/March, 2012, p. 85.
[17] “Hacked AP Twitter Account Sends Dow Jones Down,” Southern California Public Radio, April 24, 2013, http://www.scpr.org/programs/airtalk/2013/04/23/31465/hacked-ap-twitter-account -sends-dow-jones-down/.
[18] 蒋丽、张晓兰、徐飞彪:《国际网络安全合作的困境与出路》,载《现代国际关系》2013年第9期,第56页。
[19] Yoram Dinstein, “Cyber War and International Law: Concluding Remarks at the 2012 Naval War College International Law Conference,” International Law Studies, Vol. 89, 2013, p. 284.
[20] Duncan B. Hollis, “Why States Need an International Law for Information Operations,” Lewis & Clark Law Review, Vol. 11, No. 4, 2007, pp. 1023-1024.
[21] Scott W. Beidleman, “Defining and Deterring Cyber War,” Military Technology, Vol. 11, 2011, p. 60.
[22] 顾德欣编:《战争法概论》,国防大学出版社1991年版,第9页。
[23] William Lynn, “Cyber Security,” Speech at the Center for Strategic and International Studies, June 15, 2009.
[24] “Fact Sheet: U.S.-EU Cyber Cooperation,” The White House Office of the Press Secretary, March 26, 2014, https://www.whitehouse.gov/the-press-office/2014/03/26/fact-sheet-us-eu-cyber– cooperation.
[25] “Fact Sheet: U.S.-United Kingdom Cybersecurity Cooperation,” The White House Office of the Press Secretary, January 16, 2015, https://www.whitehouse.gov/the-press-office/2015/01/16/ fact-sheet-us-united-kingdom-cybersecurity-cooperation.
[26] Franz-Stefan Gady, “Japan and the United States to Deepen Cybersecurity Cooperation,” The Diplomat, June 2, 2015, http://thediplomat.com/2015/06/japan-and-the-united-states-to– deepen-cybersecurity-cooperation.
[27]“China, Russia to Sign Information Security Pact: Report,” The Brics Post, October 21, 2014, http://thebricspost.com/china-russia-to-sign-information-security-pact-report/#.Vg4sYi-hdMs.
[28] 复旦国务智库编:《增量改进——全球治理体系的改进和升级》,复旦全球治理报告2014,复旦大学国际关系与公共事务学院,2014年,http://www.sirpa.fudan.edu.cn/_upload/arti cle/8e/7e/f72c6ae04f998c052fe4230493c5/b3ef8190-df38-40fb-829f-1a0c6f6f49a5.pdf,第36页。
[29] Salma Shaheen: “Offense-Defense Balance in Cyber Warfare,” in Jan-Frederik Kremer and Benedikt Muller, eds., Cyberspace and International Relations, Berlin: Springer, 2014, p. 91.
[30] Jon R. Lindsay: “The Impact of China on Cybersecurity,” International Security, Vol. 39, No. 3, 2014, p. 27.
[31] 《俄联邦委员会拟利用“白色黑客”应对网络攻击》,人民网,2014年1月26日,http://world.people.com.cn/n/2014/0126/c157278-24226902.html
[32] “The Chinese Cyber Threat: Challenges and Solutions,” AEI, July 22, 2015, http://www.aei.org/events/the-chinese-cyber-threat-challenges-and-sollutions/.
[33] “Cyber Security and International Law,” Chatham House, May 29, 2012, https://www. chathamhouse.org/sites/files/chathamhouse/public/Research/International Law/290512summary.pdf.
[34] 黄日涵:《网络战山雨欲来 安全困境亟须破局》,载《中国社会科学报》2014年12月10日,第B02版。
[35] 《联合国互联网治理论坛(IGF)简介》,国家工信部网站,2008年2月21日,http://www.miit.gov.cn/n11293472/n11295361/n11296722/11642344.html
[36] Mark Ballard, “UN Rejects International Cybercrime Treaty,” ComputerWeekly.com, April 20, 2010, http://www.computerweekly.com/news/1280092617/UN-rejects-international-cyber crime-treaty.
[37] 毛雨:《北约网络安全战略及其启示》,载《国际安全研究》2014年第4期,第112页。
[38] 王孔祥:《网络安全的国际合作机制探析》,载《国际论坛》2013年第5期,第4页。
[39] Joseph S. Nye, Jr, “From Bombs to Bytes: Can Our Nuclear History Inform Our Cyber Future?” Bulletin of the Atomic Scientists, 2013, Vol. 69, No. 5, p. 13.
[40] 《共同构建和平、安全、开放、合作的网络空间  建立多边、民主、透明的国际互联网治理体系》,人民网,2014年11月20日,http://politics.people.com.cn/n/2014/1120/c1024– 26057363.html。
[41] 丛培影、黄日涵:《中国网络治理模式的世界意义》,光明网,2014年12月15日,http://theory.gmw.cn/2015-12/15/content_18098761.htm
[42] 《中华人民共和国网络安全法(草案)》,中国人大网,2015年7月6日,http://www.npc. gov.cn/npc/xinwen/lfgz/flca/2015-07/06/content_1940614.htm。
[43] 《中俄等国向联合国提交“信息安全国际行为准则”文件》,新华网,2011年9月13日,http://news.xinhuanet.com/2011-09/13/c_122022390.htm
[44] Patrick Goodenough, “U.S., China Among 15 Countries Agreeing U.N. Charter Applies in Cyberspace,” CNS News, June 10, 2013, http://cnsnews.com/news/article/us-china-among-15– countries-agreeing-un-charter-applies-cyberspace.
[45] 《习近平在第二届世界互联网大会开幕式上的讲话》,新华网,2015年12月17日,http://news.xinhuanet.com/zgjx/2015-12/17/c_134925295.htm

China Military Theater System Reform Era of Information Warfare //中國軍事戰區制改革信息化戰爭時代中國軍隊應對新安全形勢的重大保障

China Military Theater System Reform Era of Information Warfare 

中國軍事戰區制改革信息化戰爭時代中國軍隊應對新安全形勢的重大保障

習近平中國軍事改革

習近平中國軍事改革

February 1, the PLA theater inaugural meeting held in Beijing. CPC Central Committee General Secretary and State President and CMC Chairman Xi Jinping granted flag to the theater and five issued a bull. Theater set up joint operations command structure, the CPC Central Committee and the Central Military Commission in accordance with domestic major strategic decision, made ​​by the international situation changes, China will further promote the reform process in military forces, and greatly enhance the combat capability of the PLA.

Substantive reform: the military establishment system to adapt to new forms of information warfare needs

Military technology, military and military establishment system are the three basic elements of the new military revolution. Mankind has experienced a long weapon cold and hot steel age after the war and military technical thinking in the era of rapid development of mechanized warfare. The late 1970s, the Soviet Chief of Staff, Marshal of the Soviet Ogarkov Given the rapid development of military technology, forward-looking put forward the idea of ​​military technological revolution, which started a new military revolution sweeping the globe; 1997 , the US military put forward the “network-centric warfare” concepts, theories began to appear new military revolution prototype – each a full revolution in military affairs, the military establishment were to promote institutional change by a large development of military technology and weaponry – it by military personnel and weaponry so that the army can be effectively combined to form an overall combat power key.

In 1998, China put forward the “information warfare” concept, explicitly stated that mankind is the fourth military revolution of information technology revolution in military affairs, marking the technical form of human warfare into the information age warfare from mechanized war era. Against this background, the PLA is to follow the above rules, after weapons and equipment technology has made rapid progress, the military regime began vigorously to prepare a series of reforms: December 31, 2015, the armed services mechanism reform is completed, set up a new army, rocket forces, strategic support of three services – army, navy and air force combined with the previous, form a pattern of five armed services; January 11, 2016, to complete the formation of organs of the Central military Commission departments, from the previous four general headquarters, JMC became 15 functional departments; February 1, 2016, five theater adjustment is completed, the previous seven military regions, adjusted to five theater.

The main reason: “military” system become shackles China Military Revolution and the development of military

Original seven military system schematic

Original seven military system schematic

From the founding of the early century, by the comprehensive national strength and defense spending restrictions, military equipment levels remained low, failed to achieve the goal of complete mechanization construction; and, when low domestic railway, highway construction level, under difficult conditions in a nuclear war support large formation in the territory of strategic mobility. By the above two limitations, only the army at the time of partition of defense, so that each major military all have independent ability to respond to a threat of strategic direction.

Nearly 15 years, accumulated through investment in national defense and army reform, China’s transport network has been done, “accessible”, the level of military equipment have been greatly improved – Preliminary mechanization and mobility of fighting units sharply higher, with the from “area defensive shift basis “to” trans-regional mobility. “After greatly improved mobility, combat troops in wartime may implement in different zones under the command of, and therefore no longer need to implement the military management by a specific military.

Also, in the “military” system, military and navy and air force the same level, but also under the jurisdiction of the military air force, and even the fleet, in fact, is the embodiment of “Continental Army” thought, there are some drawbacks: military orders, regardless of military inefficient. This system has become the shackles of China Military Revolution and the development of the armed forces, can not effectively respond to security threats or China is likely to face.

Perimeter security situation and the international situation changes, “theater” made a timely decision.

Theater, from a geographic dimension in terms of a multi-dimensional space, including a broad front, greater depth and possible operational target, it is mainly based on strategic and operational tasks delineated strategic and operational activities of the regional corps with the leadership and command bodies, forces have on the area command, the command level is between the high command and strategic battle between the Legion.The main basis for division of the theater, including changes in the international pattern of perimeter security situation, military strategy, political, economic, military status and geographical characteristics of the country, and many other aspects.

Since the reform and opening up, China’s economic construction has made remarkable achievements in comprehensive national strength rising rapidly driven by changes in national strategy occurred; the Soviet Union, China land border security threat disappeared, and security threats from maritime direction is upward trend, originally established military regime on the basis of the Continental Army can not adapt to the new international situation and the security situation in neighboring China, thereby theater system came into being. In the People’s Liberation Army is divided into five theater, theater should correspond to the east of Japan and the East China Sea direction, corresponding to the western Central Asia and India theater direction, mainly the southern theater direction corresponding to the South China Sea, the northern war zone corresponds to the direction of Russia and Mongolia, as the central theater centered coordinate strategic reserve corps.

Officers appointed theater: Theater five display a mission and future trends

Five theater and officers appointed

Five theater and officers appointed

Officers from the theater can be seen in the appointment of some common: theater five ten military officers are “50,” so relatively young; most of them have experience working at the grassroots level, the so-called “starting in Reggie died five”, which two military officers have battlefield experience; most have received training integrated joint operations command. This shows the five main tasks entrusted to the theater and future trends:

First, combat and theater become the main task is to deter. Eastern theater commanderLiu PLA and western theater commander Zhao Zongqi are returning heroes from the battlefield, with actual combat experience, which is a valuable asset, but also the implementation of the “Military Commission to total, theater battle, armed services main building” in the implementation of the “theater of battle “organizational guarantee.

Second, the integrated joint operations will be the main model for future combat theater. The so-called “integrated joint operations” around unified combat purposes to the combat units, combat elements of highly integrated combat system as the main body, give full play to the overall combat effectiveness, in a multidimensional space combat or fight against the enemy’s fighting style. And the appointment of military officers have a theater at the National Defense University and other institutions of military education integrated joint operations experience.

Third, the theater system will be in constant development and improvement. The theater is a relatively young officers will and individual will, visionary, to accept new things, strong ability; In addition, the relatively young military officers also means working for a long time, can ensure coherence of policy implementation.

With the deepening of Chinese People’s Liberation Army to change the implementation of the system, this massive military force after the founding of foreign unbeaten mighty will rapidly improve combat effectiveness. This not only has a positive significance for peace and stability in the region and the world, but also for the new military revolution on a global scale provides a theoretical and practical aspects of the double “template.”

Original Mandarin Chinese:

习近平向五大战区授予军旗

习近平向五大战区授予军旗

2月1日,中国人民解放军战区成立大会在北京举行。中共中央总书记、国家主席、中央军委主席习近平向五大战区授予军旗并发布训令。组建战区联合作战指挥机构,是党中央和中央军委根据国内、国际形势变化做出的重大战略决策,将进一步推动中国部队军事改革进程,并大大提升中国人民解放军的作战能力。

改革实质:使军队编制体制适应信息化战争形态新需要

军事技术、军事力量和军队编制体制是新军事革命的三个基本要素。人类经历了漫长的冷兵器和热兵器时代之后,战争技术与军事思想在机械化战争时代迅猛发展。20世纪70年代末,苏军总参谋长、苏联元帅奥加尔科夫鉴于军事技术的飞速发展,富有前瞻性的提出了军事技术革命的设想,由此展开一场席卷全球的新军事革命;1997年,美军提出“网络中心战”概念,新军事革命的理论开始出现雏形——在每一场全面的军事革命中,均是由军事技术和武器装备的大发展推动军队编制体制变革——它是通过保证军队人员和武器装备有效结合从而使军队能够形成整体作战力量的关键。

1998年,中国提出“信息战”概念,直接指出人类第四次军事革命就是信息化的军事革命,标志着人类战争的技术形态从机械化战争时代迈向信息化战争时代。在此种背景下,中国人民解放军正是遵循着上述规律,在武器装备技术水平得到长足发展后,开始着手大力对军事体制编制进行一系列改革:2015年12月31日,军种改革机制完成,新组建了陆军、火箭军、战略支援部队三个军种,加上此前的海军和空军,形成5个军种的格局;2016年1月11日,军委机关各部门组建完成,从以前的四总部,变成了15个军委职能部门;2016年2月1日,五大战区调整完毕,以前的七大军区,调整为五大战区。

主要原因:“军区”制成为中国军事革命与军队发展的桎梏

原有七大军区制示意图

原有七大军区制示意图

从建国初到上世纪末,受综合国力和国防投入限制,我军装备水平始终较低,未能实现完成机械化建设的目标;并且,当时国内铁路、公路建设水平较低,难以在核战争条件下支持大兵团在境内实施战略机动。受以上两点限制,我军在当时只能进行分区防御,使每个大军区都具备独立应对一个战略方向威胁的能力。

近15年以来,通过国防投入积累和军队体制改革,我国交通网络已经做到“四通八达”,我军装备水平已经得到大幅改善——初步实现机械化,部队机动作战能力大幅高,具备了从“区域防卫型”向“全域机动型”转变的基础。在机动性大大提高之后,部队在战时可能在不同区指挥下实施作战,因此就不再需要由特定的军区实施军政管理。

并且,在“军区”制度下,军区与海空军平级,又下辖军区空军,甚至是舰队,实际上是“大陆军”思想的体现,存在一定弊端:军政军令不分导致效率低下。这种体制已经成为中国军事革命与军队发展的桎梏,不能有效应对中国正在或可能面临的安全威胁。

国际格局和周边安全形势发生变化,“战区”制应时而生

战区,从地理层面来讲是一个多维空间,包括宽阔的正面、较大的纵深和可能的作战对象,它主要是根据战略战役任务而划定的战略战役军团活动区域,设有领导指挥机构,拥有对辖区部队的指挥权,是介于统帅部与战略战役军团之间的指挥层次。划分战区的主要依据包括国际格局的变化,周边安全形势,国家的军事战略,政治、经济、军事力量状况和地理环境特征等诸多方面。

改革开放以来,我国经济建设取得了举世瞩目的成就,综合国力迅速攀升带动国家战略发生变化;苏联解体后,中国陆地边境安全威胁基本消失,而来自海洋方向的安全威胁则呈上升趋势,原先建立在大陆军基础上的军区制度已经不能适应新的国际格局和中国周边安全形势,由此,战区制度应运而生。在此次解放军划分的五大战区之中,东部战区应该对应日本和东海方向,西部战区对应中亚和印度方向,南部战区则主要对应南海方向,北部战区则对应俄罗斯和蒙古方向,中部战区则作为战略预备总队居中策应。

战区主官任命:显示五大战区肩负使命与未来发展趋势

五大战区及主官任命

五大战区及主官任命

从此次任命的各战区主官中可以看到一些共性:五大战区的十位军政主官都是“50后”,相对年轻;大多有在基层任职经历,所谓“猛将起于卒伍”,其中有两位军事主官具有战场经历;大多接受过一体化联合作战的指挥训练。由此可见五大战区肩负的主要任务与未来发展趋势:

第一,作战和是威慑成为战区主要任务。东部战区司令员刘粤军和西部战区司令员赵宗岐都是从战场凯旋的英雄,具有实战经验,这是宝贵的财富,也是落实“军委管总、战区主战、军种主建”中落实“战区主战”的组织保证。

第二,一体化联合作战将成为未来战区的主要作战模式。所谓“一体化联合作战“,是围绕统一的作战目的,以各作战单元、作战要素高度融合的作战体系为主体,充分发挥整体作战效能,在多维作战空间打击或抗击敌方的作战样式。而此次任命的战区军事主官都有在国防大学等军事院校进修一体化联合作战的经历。

第三,战区制度还将处于不断的发展和完善中。此次战区主官都是相对年轻的上将和个别中将,思维开阔、接受新事物能力强;另外,军政主官相对年轻也意味着任职时间长,可以保证政策实施的连贯性。

随着中国人民解放军军改制度的不断深入实施,这支建国后对外大规模用兵保持全胜的威武之师将会快速提高战斗力。这不仅对于地区及世界的和平与稳定具有积极意义,也为全球范围内的新军事革命提供了理论与实践方面的双重“范本”。

Original Source: China MOD

China Cyberspace Security Strategy and Implications // 中國網絡空間安全戰略思考與啟示

China Cyberspace Security Strategy and Implications  //

中國網絡空間安全戰略思考與啟示

習近平

General Secretary Xi pointed out that no network security is no national security, no information will be no modernization. Internationally, the United States on security in cyberspace absolute dominance, they establish hegemony, rules, seeking advantage to control the world, to China’s cyberspace poses a severe challenge.
A US cyberspace security strategy revelation
(a) by the US cyberspace security “policy”, “plan” a national strategy to enhance
the United States in cyberspace is a strategic understanding of the development process. First released in 1998, Presidential Decree No. 63 (PDD63) “Clinton administration policy on critical infrastructure protection,” followed in 2000 issued a “national plan for the protection of information system v1.0”. The Bush administration immediately after the September 11, 2001 issued Executive Order No. 13231 “Information Age critical infrastructure protection,” and announced the establishment of “President Critical Infrastructure Protection Committee” on behalf of its government fully responsible for national security in cyberspace . And to study the drafting of a national strategy, in February 2003 formally issued “to protect cyberspace national strategy”, and posting confidential level No. 54 National Security Presidential Decree in 2008, set up a “comprehensive national cybersecurity plan,” the plan in the “Manhattan” (World War II atomic bomb) name, the specific content of the “Einstein” one, two, three composition, aimed at building the federal government and major information systems engineering protection, the establishment of a unified national security posture information sharing and command system.
(Ii) US cyberspace security strategy to further improve
in April 2008, President Bush issued a “44th president submitted the report to protect the network security space,” suggesting how the next US government to strengthen security in cyberspace.
February 2009, the Obama administration after a comprehensive demonstration, announced the “Cyberspace Policy Assessment – Ensuring credible and robust information and communications infrastructure,” the report, the cyberspace security threats as “the most serious faced by the national economy nationwide one of the challenges and safe country “and declared that” digital infrastructure will be considered national strategic asset, the protection of this infrastructure will be a priority of national security “, a comprehensive plan of strategic measures to defend cyberspace.
June 2009, US Defense Secretary Robert Gates issued an order formally establishing the United States “Cyberspace Command” to the harmonization of network security and protection of US forces to carry out cyber warfare and other military operations. The command part of the US Strategic Command, the preparation of one thousand, in May 2010, the US Cyber ​​Command officially start work.
(C) international and cyberspace war strategy
in May 2011, the White House cybersecurity coordinator Schmidt released in the United States “cyberspace international strategy”, its strategic intentions clear, namely to establish hegemony, rules, seeking advantage, control the world ; in July, the US Department of Defense released “cyberspace operations strategy” put forward five strategic measures for defending US interests in cyberspace, making the United States and its allies and international partners can continue to obtain from the innovation in the information age beneficial.
October 2012, Obama signed the “American Action Network Policy” (PDD21), the law gives the US military has carried out non-traditional combat power, clearly spread from network-centric warfare to cyberspace operations and the like.
In February 2013, Obama published Executive Order No. 13636 “Enhanced network security of critical infrastructure,” clearly states that the policy action to enhance the nation’s critical infrastructure and maintain environmental security and resilience.
In April 2013, Obama Ma Xiangguo submit “fiscal year 2014 defense budget priorities and select” proposed to 2016 reorganized into 133 network forces, including the national task force 68, combat task force 25, the network defense forces 40.
February 2014, the US National Institute for Standards and Technology “to enhance critical infrastructure cybersecurity” that “the United States critical infrastructure to enhance network security framework” (V1.0), emphasizing the use of business-driven network security operations guide, and four levels, the organization’s risk management process. According to different levels of network security risk points
of April 23, 2015, the Pentagon released a new version of network security strategy summary, the first public should cyberwarfare as a future military conflict tactical options, an explicit proposal to increase the US military deterrence in cyberspace and offensive capability.
Not only the United States in full swing and the implementation of international cyberspace war strategy, NATO cyberspace security framework, issued recently shows that there are currently more than one hundred countries in the world have a certain network warfare capabilities, the National Cyber ​​Security Strategy published up to as many as 56.
Thus, cyberspace has become after land, sea, air, space is the fifth largest sovereign area of space, but also the evolution of the international strategy in the military field, which is China’s network security posed a severe challenge, we should actively respond, accelerate the construction of network security system, to defend our national sovereignty cybersecurity.
Second, build the active defense technology security system
(a) immunity trusted computing architecture
computer architecture now used in the design calculation when only the pursuit of speed and no safety factor, such as the difficult task of isolating the system, no memory protection, cross-border, this led directly to the presence service network computing environment, a large number of security issues, such as source configuration can be tampered with, it is implanted malicious programs executed by using a buffer (stack) overflow attacks, illegally take over the system administrator permissions.
Trusted Computing is the result of the development of information science, is a novel immune trusted computing model.Trusted computing using parallel computing and defense dual architecture, at the same time to obtain the computation of security protection, so that the calculation result is always as expected, can be measured to calculate the full control, it is not disturbed.
Compare current most network security system, which is mainly by a firewall, intrusion detection and virus prevention and other components, known as the “third kind.” The image of that, these passive blocking killing is a temporary solution, and trusted computing to achieve active immunization computer architecture, and human immunodeficiency as timely identify “self” and “non-self” ingredients, thereby undermining and exclusion of harmful substances into the body, so that there are shortcomings and gaps being exploited by attackers. .
Cloud computing, big data application of new information technology, networking, industrial systems, mobile Internet, virtual dynamic heterogeneous computing environment requires credible immune system as its base support. Construction of triple protection framework trusted security management center security system can be supported by the structure, to ensure operation behavior, resource allocation, data storage cartridge policy management credibility, the attacker reached the entrance, an unauthorized person can not get vital information, theft Confidential information can not read, can not tamper with systems and information system paralysis not work and can not afford to rely on aggressive behavior of protective effect, if there is credible mechanism, “shock web”, “flame”, “heart blood” and other malicious code may since kill off.
(Ii) China Trusted Computing technology innovation
China Trusted Computing in 1992 and officially approved research and large-scale application early (TCG, established in 2000) in the international Trusted Computing Group.
TCG Trusted Computing research program found that the system problems are: (1) the limitations of cryptography: TCG public key cryptography algorithm using only the RSA, SHA1 hash algorithm only supports series, avoided symmetric cryptography, the resulting key design management, key migration and complicated licensing agreement, but also a direct threat to the security of passwords; (2) the system structure is irrational: TPM calls TCG plug is a passive architecture, dynamic initiative measure can not be performed.
China Trusted Computing over a long period of research, not only to solve the above problems TCG, but also the formation of independent innovation system, its innovative points include:
(1) Trusted Computing Platform password innovative programs
using national self-designed algorithm, credible computing a cryptographic module (TCM), with symmetric cipher and asymmetric cryptography combined system, improve the safety and efficiency; dual certificate structure, simplify certificate management, improved usability and manageability of.
(2) trusted platform control module innovation
presented trusted platform control module (TPCM), TPCM self-control as a trusted root node implant trusted source, be trusted root control functions on the basis of TCM, realized with a password based active control and measurement; TPCM prior to startup of the CPU and BIOS to verify, thereby changing the TPM as the traditional idea of passive devices, to achieve TPCM active control of the whole platform.
(3) a credible innovation board
increase in the amount of confidence in the board trusted platform node (TPCM + TCM), plus a host constitutes a credible two-node, to achieve trust transfer of the operating system, providing reliable hardware environment for the upper platform ; implementation of hardware control bus credible level of peripheral resources, power on the CPU front of the Boot ROM TPCM initiative to measure, so that in the chain of trust “powered first time” to start building; and the use of multi-metric agent establishes a chain of trust for dynamic and virtual measures to provide support.
(4) a credible basis to support innovative software
using host-based software system + double trusted software system architecture ,, trustworthy software group is the Trusted Computing Platform Trusted capabilities to achieve the credibility of all software elements, the host software The system provides active protection of the credibility of the amount of storage, and reporting.
(5) Trusted Network Connect innovation
based on three ternary and other trusted connection architecture, access requester, triple control and identification and access control policies arbiter between; ternary centralized management, improve infrastructure security and manageability; and access requester and the access controller to achieve a unified policy management, improve the system overall credibility.
(Iii) core technology controlled by others to solve the problem
(1) China Trusted Computing industrialization conditions are met. “Long-term Scientific and Technological Development (2006-2020)” made ​​it clear “to the development of high trusted network focusing on the development of network security technology and related products, the establishment of network security technology security system”, “five” plan works trusted computing project regarded as the focus of development, the trusted computing standard series of progressive development, and study of more than 40 units, more than 400 participants, the standard of innovation have made ​​technology validation, to declare more than 40 patents. Many units and departments have developed a chip, machine, software, and network connections and other trusted components and equipment in accordance with relevant standards, and has been effectively used in critical systems in the national grid scheduling. April 16, 2014, established the Zhongguancun Trusted Computing Industry Alliance, and vigorously promote the industrialization and marketization.
(2) laying the foundation for the comprehensive alternative to foreign products. April 2014, Microsoft stopped support for Windows XP Service country about 200 million running XP operating system, the terminal will face a situation of no service; and Windows 8 and Vista (2006 Government procurement is not clear) is the same architecture, Windows8 upgrade is not only costly, but also lose control over security and the secondary development rights. Trusted computing innovation reinforcement XP system can easily upgrade existing equipment as a trusted computer system, a credible alternative service patching services, applications do not change the system, to facilitate the application.
Based on open source technology to develop independent operating system is a realistic option. After 20 years of research, we have accumulated considerable reserves in the operating system and key technologies, which is a breakthrough in technology accumulation mainly based on the open source operating system made. From the perspective of inheritance, we need to select the source as a technical route; from a development perspective, the current is too late to re-encode the formation of a completely new operating system, you want to share the wealth of human knowledge, open source is still a realistic option. Independent innovation is not blocking them out safe, but to fully inherited and developed.
To achieve the “five may” “have a”:
understood: open source system to fully grasp the details, there can be confusion unknown code;
editable: should be based on open source code understood completely customize the code;
Reconfigurable: for specific application scenarios and security requirements, based on open source code refactoring, forming a customized new architecture;
credible: to strengthen the independent operating system immunity with trusted computing technology to prevent autonomous system vulnerability system security;
available: applications and operating system to do the adaptation, ensuring independent operating system to replace foreign products.
We have independent intellectual property rights: to own intellectual property rights on the final autonomous operating system, and deal with intellectual property issues are using open source technologies. GPL open source technology to be bound by the agreement, our country based on existing open source operating system has not encountered significant intellectual property disputes, but just because there is no large-scale application of these systems, once I customize the operating system form a climate, will face challenges in this regard.
Meanwhile, in the process of implementation of the localization of alternative strategies, the trusted protection system fully supports localization of hardware, software, although there are more domestic product defects and loopholes can make credible security flaws and vulnerabilities will not be attacked use ensure more secure than foreign products, localization is self-controlled, safe and reliable escort.
  Faced with increasingly severe international cyberspace situation, we should be based on national conditions, innovation-driven, solving the kinds of problems. Adhere to defense in depth, to build a strong network security system, to build China into a world power network security and work hard!

Original Mandarin Chinese:

習近平

習總書記指出,沒有網絡安全就沒有國家安全,沒有信息化就沒有現代化。國際上,美國在網絡空間安全上佔據絕對優勢,他們確立霸主,制定規則,謀求優勢來控制世界,給我國的網絡空間安全提出了嚴峻的挑戰。
一、美國網絡空間安全戰略啟示
(一)美國將網絡空間安全由“政策”、“計劃”提升為國家戰略
美國在網絡空間戰略是一個認識發展的過程。首先是1998年發布的第63號總統令(PDD63)《克林頓政府對關鍵基礎設施保護的政策》,緊接著2000年發布了《信息系統保護國家計劃v1.0》。布什政府在2001年911事件後馬上發布的第13231號行政令《信息時代的關鍵基礎設施保護》,並宣布成立“總統關鍵基礎設施保護委員會”,由其代表政府全面負責國家的網絡空間安全工作。並研究起草國家戰略,於2003年2月正式發布《保護網絡空間的國家戰略》,又於2008年發布機密級的第54號國家安全總統令,設立“綜合性國家網絡安全計劃”,該計劃以“曼哈頓”(二戰研製原子彈)命名,具體內容以“愛因斯坦”一、二、三組成,目的是全面建設聯邦政府和主要信息系統的防護工程,建立全國統一的安全態勢信息共享和指揮系統。
(二)美國網絡空間安全戰略進一步完善
2008年4月,布什總統發布了《提交第44屆總統的保護網絡空間安全的報告》,建議美國下一屆政府如何加強網絡空間安全。
2009年2月,奧巴馬政府經過全面論證後,公佈了《網絡空間政策評估——保障可信和強健的信息和通信基礎設施》報告,將網絡空間安全威脅定位為“舉國面臨的最嚴重的國家經濟和國家安全挑戰之一”,並宣布“數字基礎設施將被視為國家戰略資產,保護這一基礎設施將成為國家安全的優先事項”,全面規劃了保衛網絡空間的戰略措施。
2009年6月,美國國防部長羅伯特.蓋茨正式發布命令建立美國“網絡空間司令部”以統一協調保障美軍網絡安全和開展網絡戰等軍事行動。該司令部隸屬於美國戰略司令部,編制近千人, 2010年5月,美國網絡司令部正式啟動工作。
(三)網絡空間國際和戰爭戰略
2011年5月,美國白宮網絡安全協調員施密特發布了美國《網絡空間國際戰略》,其戰略意圖明顯,即確立霸主,制定規則,謀求優勢,控制世界;同年7月,美國國防部發布《網絡空間行動戰略》,提出5大戰略措施,用於捍衛美國在網絡空間的利益,使得美國及其盟國和國際合作夥伴可以繼續從信息時代的創新中獲益。
2012年10月,奧巴馬簽署《美國網絡行動政策》(PDD21),在法律上賦予美軍具有進行非傳統作戰權力,明確從網絡中心戰擴展到網絡空間作戰行動等。
2013年2月,奧巴馬發布第13636號行政命令《增強關鍵基礎設施網絡安全》,明確指出該政策作用為提升國家關鍵基礎設施並維護環境安全與恢復能力。
2013年4月,奧巴馬向國會提交《2014財年國防預算優​​先項和選擇》提出至2016年整編成133支網絡部隊,其中國家任務部隊68支,作戰任務部隊25支 ,網絡防禦部隊40支。
2014年2月,美國國家標準與技術研究所針對《增強關鍵基礎設施網絡安全》提出《美國增強關鍵基礎設施網絡安全框架》(V1.0),強調利用業務驅動指導網絡安全行動,並為四個等級,組織風險管理進程。按網絡安全風險程度不同分
2015年4月23日,美國五角大樓發布新版網絡安全戰略概要,首次公開要把網絡戰作為今後軍事衝突的戰術選項之一,明確提出要提高美軍在網絡空間的威懾和進攻能力。
不僅美國緊鑼密鼓執行網絡空間國際和戰爭戰略,最近頒布的北約網絡空間安全框架表明,目前世界上有一百多個國家具備一定的網絡戰能力,公開發表網絡安全戰略的國家達56家之多。
由此可見,網絡空間已經成為繼陸、海、空、天之後的第五大主權領域空間,也是國際戰略在軍事領域的演進,這對我國網絡安全提出了嚴峻的挑戰,我們應積極應對,加快建設我國網絡安全保障體系,捍衛我國網絡安全國家主權。
二、構建主動防禦的技術保障體系
(一)可信免疫的計算體系結構
現在使用的計算機體系結構在設計時只追求計算速度並沒有考慮安全因素,如係統任務難以隔離、內存無越界保護等,這直接導致了網絡化環境下的計算服務存在大量安全問題,如源配置可被篡改、惡意程序被植入執行、利用緩衝區(棧)溢出攻擊、非法接管系統管理員權限等。
可信計算是信息科學發展的結果,是一種新的可信免疫計算模式。可信計算採用運算和防禦並行的雙體系架構,在計算運算的同時進行安全防護,使計算結果總是與預期一樣,計算全程可測可控,不被干擾。
對比當前大部分網絡安全系統,其主要是由防火牆、入侵監測和病毒防範等組成,稱為“老三樣”。形象的說,這些消極被動的封堵查殺是治標不治本,而可信計算實現了計算機體系結構的主動免疫,與人體免疫一樣,能及時識別“自己”和“非己”成份,從而破壞與排斥進入機體的有害物質,使有缺陷和漏洞不被攻擊者利用。 。
雲計算、大數據、物聯網、工業系統移動互聯網、虛擬動態異構計算環境等新型信息技術應用都需要可信免疫體係作為其基礎支撐。構建可信安全管理中心支持下的三重防護框架能夠保障體系結構,確保操作行為、資源配置、數據存儲盒策略管理的可信,達到攻擊者進不去、非授權者重要信息拿不到、竊取保密信息看不懂、系統和信息篡改不了、系統工作癱不成和攻擊行為賴不掉的防護效果,如果有可信機制,“震網”、“火焰”、“心臟滴血”等惡意代碼可不殺自滅。
(二)中國可信計算技術創新
中國可信計算於1992年正式立項研究並規模應用,早於國際可信計算組織(TCG,2000年成立)。
研究TCG可信計算方案發現其體系存在的問題有:(1)密碼體制的局限性:TCG公鑰密碼算法只採用了RSA,雜湊算法只支持SHA1系列,迴避了對稱密碼,由此導緻密鑰管理、密鑰遷移和授權協議的設計複雜化,也直接威脅著密碼的安全;(2)體系結構不合理:TCG的TPM外掛調用是一種被動體系結構,無法執行動態主動度量。
中國可信計算經過長期攻關,不僅解決了TCG的上述問題,還形成了自主創新的體系,其創新點包括:
(1)可信計算平台密碼方案創新
採用國家自主設計的算法,提出了可信計算密碼模塊(TCM),以對稱密碼與非對稱密碼相結合體制,提高了安全性和效率;採用雙證書結構,簡化證書管理,提高了可用性和可管性。
(2)可信平台控制模塊創新
提出了可信平台控制模塊(TPCM),TPCM作為自主可控的可信節點植入可信源根,在TCM基礎上加以信任根控制功能,實現了以密碼為基礎的主動控制和度量;TPCM先於CPU啟動並對BIOS進行驗證,由此改變了TPM作為被動設備的傳統思路,實現了TPCM對整個平台的主動控制。
(3)可信主板創新
在可信平台主板中增加可信度量節點(TPCM+TCM),構成了宿主加可信的雙節點,實現到操作系統的信任傳遞,為上層提供可信硬件環境平台;對外設資源實行總線級的硬件可信控制,在CPU上電前TPCM主動對Boot ROM進行度量,使得信任鏈在“加電第一時刻”開始建立;並利用多度量代理建立信任鏈,為動態和虛擬度量提供支撐。
(4)可信基礎支撐軟件創新
採用宿主軟件系統+可信軟件基的雙系統體系結構,,可信軟件基是可信計算平台中實現可信功能的可信軟件元件的全體,對宿主軟件系統提供主動可信度量、存儲、報告等保障。
(5)可信網絡連接創新
採用基於三層三元對等的可信連接架構,進行訪問請求者、訪問控制者和策略仲裁者之間的三重控制和鑑別;對三元集中控管,提高架構的安全性和可管理性;並對訪問請求者和訪問控制者實現統一的策略管理,提高系統整體的可信性。
(三)解決核心技術受制於人問題
(1)中國可信計算產業化條件具備。 《國家中長期科學技術發展(2006-2020年)》明確提出“以發展高可信網絡為重點,開發網絡安全技術及相關產品,建立網絡安全技術保障體系”,“十二五”規劃有關工程項目都把可信計算列為發展重點,可信計算標準系列逐步製定,研究制定單位達40多家,參加人員達400多,標準的創新點都作了技術驗證,申報專利達40多項。不少單位和部門已按有關標準研製了芯片、整機、軟件和網絡連接等可信部件和設備,並在國家電網調度等重要係統中得到了有效的應用。 2014年4月16日,成立了中關村可信計算產業聯盟,大力推進產業化、市場化。
(2)為全面替代國外產品打基礎。 2014年4月微軟公司停止對Windows XP的服務支持,全國約2億台運行XP操作系統的終端將面臨無人服務的局面;​​而Windows 8和Vista(2006年政府明確不採購)是同類架構,升級為Windows8不僅耗費巨資,還會失去安全控制權和二次開發權。利用自主創新的可信計算加固XP系統可以方便的把現有設備升級為可信計算機系統,以可信服務替代打補丁服務,應用系統不用改動,便於推廣應用。
基於開源技術發展自主操作系統是現實選擇。經過20多年的攻關,我們在操作系統關鍵技術上有相當的積累和儲備,這些技術積累主要是在開源操作系統基礎上取得的突破。從繼承的角度,我們需要選擇開源作為技術路線;從發展的角度,目前也來不及重新編碼形成一套完全新的操作系統,要共享人類知識財富,開源依然是現實選擇。自主創新不是封閉起來搞安全,而是要充分繼承和發展。
要做到“五可”“一有”:
可知:對開源系統完全掌握其細節,不能有不可知代碼的困惑;
可編:要基於對開源代​​碼的理解,完全自主編寫代碼;
可重構:面向具體的應用場景和安全需求,對基於開源技術的代碼進行重構,形成定制化的新的體系結構;
可信:通過可信計算技術增強自主操作系統免疫性,防範自主系統中的漏洞影響系統安全性;
可用:做好應用程序與操作系統的適配工作,確保自主操作系統能夠替代國外產品。
有自主知識產權:要對最終的自主操作系統擁有自主知識產權,並處理好所使用的開源技術的知識產權問題。開源技術要受到GPL協議的約束,目前我國現有基於開源的操作系統尚未遇到知識產權方面的明顯糾紛,但這僅僅因為這些系統尚無規模應用,一旦我自主操作系統形成氣候,必然會面臨這方面的挑戰。
同時,在我國實施國產化替代戰略的過程中,可信防護體系全面支持國產化的硬件、軟件,儘管國產化產品存在更多的缺陷和漏洞,可信保障能使得缺陷和漏洞不被攻擊利用,確保比國外產品更安全,為國產化自主可控、安全可信保駕護航。
面對日益嚴峻的國際網絡空間形勢,我們要立足國情,創新驅動,解決受制於人的問題。堅持縱深防禦,構建牢固的網絡安全保障體系,為我國建設成為世界網絡安全強國而努力奮鬥!

Original Source: X

 

US Cyber ​​Command established to respond to future cyber war // 美軍建立網絡司令部應對未來網絡戰爭

US Cyber ​​Command established to respond to future cyber war //

美軍建立網絡司令部應對未來網絡戰爭

四星上将基斯·亚历山大将出任美国网络司令部的首位司令员

From Zhuhai Security Bureau, People’s Republic of China

May 21, 2010, the US Department of Defense announced that in order to fight hostile countries and hacker attacks, the US Cyber ​​Command was officially launched. The US Air Force Combat Command and the same level of the unit by a former intelligence officer Alexander Keith four-star general in charge. As early as June last month, US Defense Secretary Robert Gates ordered the formation of Cyber ​​Command, after a year of preparation, Cyber ​​Command is now fully operational. This initiative of the US, indicating that the network will be an important piece of the future war position, “cyberwarfare” This unconventional war will be inevitable.

US forces have been brewing for a long time

  The United States as a global network of organizers, was the first country to apply real network, the establishment and operation of its network warfare units already brewing for some time, media reports from the outside world can be roughly about 12.

  First, conventional offensive and defensive team growing. According to the US cyber war years of defense experts Joel Harding assessment, the US Department of Defense has more than 15,000 computer networks in more than 4,000 military bases in 88 countries and regions, a total of more than 5,000 information warfare specialists, 5 ~ 70,000 soldiers involved in cyber warfare, coupled with the original electronic warfare officer, the number of American combat troops should be in the network of about 88700 people, which means that the number of US network warfare units have been the equivalent of 7 101 airborne division, as the network commander establishing unit, I believe that this figure will surge. This force must not only bear the task of network defense, other countries will also network and electronic systems for covert attacks, the United States access to a variety of intelligence information needed, and can quickly invade the enemy in wartime network system paralyzed the enemy command networks and electronic weapons systems.

Second, the unified command superior forces continue to integrate. Currently, the US network warfare units formed by relatively scattered, the armed forces have a certain strength, and has long competition for the services network warfare dominance, competition has been fierce. Such as: in 2002 in Virginia, Naval Network Warfare Command was established, the preparation of 60 people, the Navy Fleet Command Information Warfare Center worldwide, Navy networks and space operations and the Navy Command, computer network defense commando teams cyber warfare units 7,000 officers and men. US Air Force Network Warfare Command Territories 4 NWW, including the famous 67th NWW. The wing has five intelligence brigade, 35 Intelligence Squadron, a total of more than 8000 soldiers, resident in more than 100 locations worldwide, personnel and equipment throughout the “other continents except Antarctica.” US Army from July 2008 officially launched the construction of army battalions network, currently distributed network operations personnel in Iraq, Afghanistan and other places, to assist the local US network warfare activities, cyber warfare experts have thousands of people. Now, the formal establishment of Network Warfare Command, these advantages is to be effective and reasonable integration of forces, the US network warfare units to improve the organizational system, to achieve a high degree of unity of command and management, improve the operational effectiveness.

The third is capable of practical tactics and equipment continue to improve. US troops have been developed more than 2,000 kinds of computer viruses weapons, such as “logic bombs” and “trap door”, etc., hardware, electromagnetic pulse bombs, infrasound weapon system, the kinetic energy interceptor and high-power microwave weapons, other countries can network physical attack vector. According to reports, the US military in 2008 bombed a facility in Syria, on the use of an airborne system, airborne invasion by the enemy and operate network sensors, so that the loss of the enemy early warning function. Over the years, the US military cyber warfare tactics and constantly enrich and improve, from the media point of view, the early offensive tactics “backdoor”, “bomb attack”, in recent years has studied the “botnet”, “cast a wide net” and other . Thus, it is easy to see the US network warfare units “tip of the iceberg”, and its emphasis on cyberwarfare.

Inspiration

US Cyber ​​Command to build us a profound revelation. We should speed up the pace of global military development to adapt to, and actively play and use network advantages, strengthen the network supervision and active defense, to build a network can attack and defend the shield.

A revelation: to clarify understanding. In recent years, not only the United States established a Cyber ​​Command, several countries Israel, Russia, Britain, Germany, France, Japan, South Korea and India have been established or are planning to set up a network command system and mechanisms of war. Allegedly, Taiwan in early 2001 formally established what is known as “Tiger Force” network information warfare units, the main task is to sneak through the network related sites, to collect all kinds of confidential information and intelligence collection and development of various secret computer virus, to create “electronic bomb” attack the target network. Faced with serious challenges, we can only turn pressure into motivation, the real renew our concept, calm response, rapid response, to explore with Chinese characteristics cyberspace to victory as soon as possible.”Scholars Sushi, fitters who cares Junjie,” the army as mighty undefeated division, should be thought of cyberwarfare have a clear understanding of height, to a set of effective countermeasures, have a professional reliable team to adapt to new changes in the new military confrontation in the new situation.

Revelation II: build a strong foundation. Anti-sense of confidentiality between laws and regulations and information security officers are doing the work of the foundation. Really good job between anti-army under the condition of information security work, and the headquarters of the Central Military Commission has formulated a series of laws and regulations of confidentiality from the “People’s Liberation Army Secrets Act” and “the rule of confidentiality ’10 allowed ” to ‘prevention crime Ordinance, “” military computers connected Internet regulations, “and” military regulations on the Internet, “and” strictly guard against network leak ‘ten ban,’ “and so on. Currently, the regulations should integrate our military resources, to build full list of information security regulations, while increasing by between anti-secrecy, to guide the officers and men “correct knowledge network, regulate online” really lay a solid foundation of information security from the end.

Revelation 3: Aggregate talent. In recent years, the CIA and the military attaches great importance to cultivate high-tech talent, and even recruit hackers for their own use, constantly stealing his country’s secret and are ready to do the vanguard of conventional forces, to combat damage other network systems. US National Defense University military historian Daniel Kool noted that the Pentagon’s interest in cyber warfare has reached a degree of “religious fanaticism” in this frenzy, groups of hackers amnesty, are trained to the new professional military hackers. Reserve personnel is a necessary condition to deal with high-tech development, at present, we should actively search for network technicians to build a formal, professional, the strength of the team to respond to current and future needs of the network security cyber war.

Inspiration Four: to strengthen the defense. “Art of War” said: “No it does not rely just sit on there is also pending; it does not rely attack, something I can not rely attack also.” Strong defense against foreign invasion is the most effective means of building a solid sturdy defense can keep the enemy thousands of miles away, which rely on the continuous development of network technology and improve. We should therefore innovation in the development of advanced and useful technology network protection efforts, as I hold up an umbrella network system to ensure the safety and combat consolidated.

Revelation five: as active. Although the US Department of Defense stressed that the main task of Cyber ​​Command is defensive operations, but its covert intelligence to steal his country under the surface rhetoric, his country’s intention to attack the essence of network information system, has long been self-evident. During the Iraq war, Iraq top-level domain “.iq” application and analytical work is terminated America, all URLs with “.iq” suffix from the Internet site all evaporated in the Internet can not see any information from Iraq, which the US military quickly and efficiently to win the war in Iraq provides an important prerequisite. Information age, cyber warfare has become a “bear the brunt, full use” in the true sense of the style of warfare, to national security has brought new and unprecedented challenges, we want to provide intellectual support for the safe and stable development of the country and the army, in order to conventional war wartime to provide “security win” a prerequisite for the battle ill-prepared to deal with future networks.

Original Mandarin Chinese:

四星上将基斯·亚历山大将出任美国网络司令部的首位司令员

2010年5月21日,美國國防部對外宣布,為了打擊敵對國家和黑客的網絡攻擊,美軍網絡司令部正式啟動。這一與美空軍作戰司令部平級的單位,由情報軍官出身的四星上將基斯·亞歷山大執掌。早在去年6月,美國防部長羅伯特·蓋茨就下令組建網絡司令部,歷經一年的籌備,網絡司令部現已全面開始運轉。美軍的這一舉措,預示著網絡將是未來戰爭中的一塊重要陣地,“網絡戰”這種非常規戰爭將在所難免。

美軍此舉已醞釀多時

美國作為全球網絡化的組織者,是最早將網絡運用於實戰的國家,其網絡戰部隊的建立與運轉早已醞釀多時,從外界媒體的報導大致能夠了解一二。
一是攻守兼備的常規隊伍不斷增強。根據研究美軍網絡戰多年的防務專家喬爾·哈丁評估,美國國防部在全球88個國家和地區的4000多個軍事基地內擁有超過1.5萬個電腦網絡,共有5000餘名信息戰專家,5 ~7萬名士兵涉足網絡戰,再加上原有的電子戰人員,美軍網絡戰部隊人數應該在88700人左右,這意味著美軍網絡戰部隊人數已相當於7個101空降師,隨著網絡司令部的建立,相信這個數字還將激增。這支部隊不但要承擔網絡防禦的任務,還將對別國的網絡和電子系統進行秘密攻擊,獲取美國所需要的各種情報信息,並能在戰時迅速侵入敵方網絡系統,癱瘓敵方的指揮網絡和電子武器系統。
二是統一指揮的優勢力量不斷整合。當前,美軍所形成的網絡戰部隊相對比較分散,在海陸空三軍都有一定的力量,而且長期以來各軍種為爭奪網絡戰的主導權,一直競爭激烈。如:於2002年在弗吉尼亞州成立的海軍網絡戰司令部,編制60人,指揮全球範圍內的海軍艦隊信息戰中心、海軍網絡和太空行動司令部及海軍計算機網絡防禦特攻隊等網絡戰單位的7000名官兵。美空軍網絡戰司令部管轄4個網絡戰聯隊,包括大名鼎鼎的第67網絡戰聯隊。該聯隊有5個情報大隊、35個情報中隊,總計超過8000名官兵,駐地分佈在全球100多個地點,人員和裝備遍及“除南極洲之外的其他大陸”。美陸軍從2008年7月正式啟動陸軍網絡作戰營建設,目前網絡戰人員分佈在伊拉克、阿富汗等地,協助當地美軍進行網絡戰活動,擁有的網絡戰專家也達數千人。現在,正式成立網絡戰司令部,就是要將這些優勢力量進行有效合理的整合,來完善美軍網絡戰部隊的建制,實現指揮和管理的高度統一,提高作戰效能。
三是精幹實用的裝備戰法不斷完善。美軍現已研製出2000多種計算機病毒武器,如“邏輯炸彈”和“陷阱門”等,硬件方面,有電磁脈衝彈、次聲波武器系統、動能攔截彈和高功率微波武器,可對別國網絡的物理載體進行攻擊。據報導,美軍在2008年轟炸敘利亞某設施時,就使用了一種機載系統,通過空降侵入並操作敵方網絡傳感器,使敵方喪失預警功能。這些年,美軍網絡戰戰術不斷豐富和完善,從媒體報導來看,早期的進攻戰術有“後門程序”、“炸彈攻擊”等,近年來又研究了“殭屍網絡”、“廣泛撒網”等。由此,不難看出美軍網絡戰部隊的“冰山一角”,及其對網絡戰的重視程度。

幾點啟示

美軍建立網絡司令部給我們帶來了深刻的啟示。我們應加快適應世界軍事發展的步伐,積極發揮和利用網絡優勢,加強對網絡的監管和主動防禦,構建可攻可守的網絡盾牌。
啟示一:釐清認識。近年來,不僅美國建立了網絡司令部,以色列、俄羅斯、英國、德國、法國、日本、韓國、印度等多個國家都已經建立或正在籌劃建立網絡戰爭的指揮體系和機制。據稱,台灣也早在2001年就正式建立了被稱為“老虎部隊”的網絡信息戰部隊,主要任務就是通過網絡潛入相關網站,蒐集各種機密信息與情報,秘密收集與研發各種電腦病毒,製造“電子炸彈”攻擊目標網絡系統。面對嚴峻挑戰,我們唯有變壓力為動力,真正解放思想、更新觀念、冷靜應對、迅速反應,盡快探索出有中國特色的網絡空間制勝之道。 “儒生俗士,識時務者,在乎俊傑”,我軍作為威武不敗之師,應從思想上對網絡戰有高度清晰的認識,要有一套行之有效的應對之策,要有一支專業的可靠隊伍,以適應新軍事對抗中的新情況新變化。
啟示二:築牢根基。法規制度和官兵的防間保密意識是做好信息安全工作的根基。為切實做好信息化條件下我軍防間保密工作,軍委和總部先後製定出台了一系列保密法規制度,從《中國人民解放軍保密條例》及“保密守則’十不准’”,到《預防犯罪工作條例》、《軍隊計算機連接國際互聯網管理規定》以及“軍人上互聯網的規定”,再到“嚴密防範網絡洩密’十條禁令’”等。當前,應當整合我軍法規資源,構建完整齊備的信息安全保密法規體系,同時通過加大防間保密教育,引導官兵“正確識網、規範上網”,真正從末端打牢信息安全的根基。
啟示三:聚合人才。近年來,美國中央情報局及軍方非常注重培養高科技人才,甚至招募黑客為自己所用,不斷竊取他國秘密並隨時準備為常規部隊做好先鋒隊,打擊破壞對方網絡系統。美國國防大學軍事史專家丹尼爾·庫爾指出,五角大樓對於網絡戰的興趣已經達到了“宗教狂熱”的程度,在這種狂熱下,一批批黑客被招安,被訓練成新的專業軍事黑客。人才的儲備是應對高科技發展的必要條件,當前,我們應積極搜尋網絡技術人才,構建一支正規、專業、有實力的隊伍,以應對現在網絡安全防範和未來網絡戰爭的需求。
啟示四:加強防禦。 《孫子兵法》曰:“無恃其不來,恃吾有以待也;無恃其不攻,恃吾有所不可攻也。”堅強的防範是抵禦外侵最有效的手段,築實一條堅固的防線可以御敵於千里之外,這就要靠網絡技術的不斷發展和提高。因此,我們應當在自主創新研發先進、有用的網絡防護技術上下功夫,為我網絡系統撐起一把保護傘,確保安全和戰鬥力鞏固。
啟示五:主動作為。雖然美國防部強調網絡司令部的主要任務是防禦作戰,但是其隱蔽於表面辭藻之下的竊取他國情報、攻擊他國網絡信息系統的實質意圖,早已不言自明。伊拉克戰爭期間,伊拉克頂級域名“.iq”的申請和解析工作被美國終止,所有網址以“.iq”為後綴的網站全部從互聯網蒸發,在互聯網無法看到來自伊拉克的任何信息,這為美軍迅速高效打贏伊戰提供了重要前提。信息化時代,網絡戰已經成為真正意義上的“首當其衝、全程使用”的作戰樣式,給國家安全帶來了嶄新的、空前的挑戰,我們要為國家和軍隊的安全穩定發展提供智力支撐,為戰時的常規戰爭提供“保打贏”的先決條件,為應對未來網絡攻防戰做足準備。

 

Original Source X