Hi everyone, Ed Amoroso here. And in this video, I want to talk to you about a really consequential attack that occurred in June of 2015 here in the United States. It occurred to a government agency called the Office of Personnel Management, OPM. So a group that keeps track of personal records of a lot of U.S. citizens and in particular, keeps track of clearance information. Clearance being the kinds of designation that's assigned to an individual based on a background check and provides determination as to whether the individual should have access to classified information. So, high officials and people working in national intelligence or defense applications or anybody doing sort of really sensitive critical work for government, would have a clearance, would have information involved in the obtaining of that clearance filling out forms and a little bit of your background and what you've done. All that would be documented and kept in records by OPM. Well, in 2015 we found out that some nation-state staff came in and snarfed up all those records and carried them away. It raises some interesting questions. The most important of which is this question of whether a nation-state attacking an agency is an act of war. Is it? I guess it's a question we're all going to have to grapple with. If a country does this sort of thing, let's say it did it by flying a plane in, bombing the building, running in, ransacking all the rooms, coming out with arms full of papers, running out, getting on their helicopter and flying out, we would certainly call that an act of war. But when we do it with electrons and do with networks, and do the kinds of attacks that if you've been with me for other videos, you've been learning how you do it and how you protect it. Is that warfare or is that something else? Hard to say. Certainly, the consequential discussion here that I think has to happen across all of our nations, I think there's a concept called norm or norms, that really needs more emphasis across the international community; where we come to some agreement on what types of things nations should be doing to each other. We all know that nations spy. That's not a big surprise. They just do. But we've all sort of accepted that as part of the nature of military and intelligence work. But, what happens when it sort of transcends that? What happens when they're doing that sort of work to a business? Are they doing it for economic purpose? They meaning some nation-state. This attack in June 2015 really got a lot of people thinking, and for those of you are studying cyber security and trying to grapple with these issues, I use this as a good case study in this question of, whether when you're doing IT system security for a company, are you doing civil defense or are you protecting your country? Wherever you're working, wherever you live, if you are doing cyber security for your company, in whatever country you're living in, are you providing civil defense for that country? Yes or no. I don't think there is a yes or no but you should have a opinion about that. And when a nation-state should successfully breach whatever defenses you've put in place, is that an act of war? Yes or no. And again, there's no real answer to that. But it's something that I'd like you to ponder. I want you to think about these things. As a professional cyber security expert, you should have an opinion about this. And you'll find that if you get 10 experts together, you'll get some different opinions. I'll tell you my opinion is that yes you are doing civil defense and yes it is an act of war. That's my personal opinion. You might get someone standing here next to me, who has equal or greater credentials than me who might say no that's not civil defense and no that's not an act of war. These are the kinds of things that we're going to have to deal with. If you're say under the age of 30 watching this, then my suspicion is your generation will figure this out. I'm over the age of 50. So, my generation perhaps has had its shot at doing this and I think we've failed in coming up with good answers to these questions. But they're going to have to be solved. And as a international community, we're going to need better norms accepted, agreed upon procedures by which we all operate. And I think we're just going to have to get to the point where more and more people agree, that if somebody comes in and nation-state comes in and steals all your stuff, whether they do that with computers or do that with helicopters and guns, to me seems like no distinction there. So, I'll let you ponder that as part of your additional sort of thinking about this video and I will see you on the next video. Thanks.
