Paz Esteban, Director of the CNI: "The struggle to obtain the vaccine is a great incentive for cyber-attackers"

Unlike the natural spaces of war: land, sea and air, cyberspace is not a physical place, but a virtual one, which opens up a host of new challenges and challenges that are difficult to control. From the three dimensions of classical space as defined by Euclid, we have moved on to multidimensional space.
In recent years, units specialising in cyber warfare have been created within the armed forces. The mission of these troops is to develop the capabilities needed to fight in a new dimension of war, where the main objective is to penetrate the enemy's computers and networks to cause damage and alter their computer systems.

Is there a specific military dimension to cyberspace, what are the threats from cyberspace, what is cyber defence and what are the special strategies to combat these attacks? These are some of the questions that the XXXII International Seminar on Security and Defence, which takes place this Thursday 17 and will close on Friday 18 and is organised by the Association of European Journalists (APE), and is presented under the name 'Threats from Cyberspace'. The Secretary General of Defence Policy (SEGENPOL), Admiral Juan Francisco Martínez Núñez, the director of the National Intelligence Centre (CNI), Paz Esteban López, the former director of the same centre, General Félix Sanz Roldán, and the director of the National Security department, General Miguel Ángel Ballesteros, were responsible for opening the seminar by taking a look at terms such as cyber defence and intelligence in cyberspace.

The Seminar, born in 1983, attempted to reconvert the abysmal relationship between the Armed Forces and the press, recalls Miguel Ángel Aguilar, Secretary General of the APE, "the general idea among journalists was that all the military were coup leaders" and the Armed Forces also had a abysmal view of journalistic work. "That's why we are thinking of establishing an area of proximity to try to defuse these misgivings," Aguilar points out..

The new reality society is facing is set in an abstract entity, which we do not see, but which is there: cyberspace, where aggressions can be very serious, without their consequences being visible. It has been thanks to the technological revolution that in recent decades the scenario has undergone radical changes and international conflicts are developing on new battlefields.

Many of the cyber-threats to democracies are sponsored by terrorist groups or state actors whose ultimate aim is to destabilise their adversaries, be they public administration, critical infrastructure or other types of targets. "Cyberspace is the new world of the 21st century", Martínez Núñez points out. "Technology floods us in an almost imperceptible, and at the same time indispensable, way. One of the experiences derived from COVID-19 was to see how our country continued to work (...), and a large part of the country continued to telework and tele-relate," says SEGENPOL.

Although this contribution of technology has been seen in a positive light, the other side of the coin is to be found in the cyber attacks that companies, hospitals and the administration have suffered. "The COVID-19 pandemic has not generated new risks, but rather has accelerated them," points out the Director of the CNI, Paz Esteban, who has defined the pandemic as a case of the 'black swan', "an event which occurs by surprise, but which has a great impact".

The challenges generated by cyberspace are many and the difficulties varied, such as establishing a clear attribution of attacks, which makes it difficult for traditional defence instruments such as deterrence to function.  During her intervention, Esteban López assured that during the pandemic the most worrying thing has been the attacks against vulnerable targets such as the health sector, the pharmaceutical industry and research centres. "The struggle to obtain the vaccine is a great incentive for the cyber-attackers".
One example of this approach has been cyber-spy on the national organisations and institutions that are developing the vaccine. "Since March, we have focused our efforts on achieving security in the health sector and also, from the CNI, we have made an effort to detect activities that could affect the productive sector".

On this point, the director of the intelligence centre pointed out the important work of the National Cryptology Centre (CCN), whose function has been to respond to and draw up ad hoc plans to mitigate the efforts of cyber-attacks against government bodies, companies and citizens. The NCC counted 42,997 attacks, of which more than 3,000 were classified as very important and 37 as critical, that is, they are passed on to the citizen and are not easy to resolve automatically, with most of them focused on the public administra.

Another point of concern within the intelligence organisations is what are known as "weapons of mass confusion", that is, the disinformation and propaganda that have been at the centre of electoral processes in recent years. "Cyberspace is used to disseminate content for a specific purpose," Esteban López said. There are, for example, the bots that lead to cano those disinformation campaigns that cause a distortion of reality, - what we know as post-truth -, with the aim of influencing public opinion.

The need to protect against undetectable threats from the web is therefore vital for organisations, institutions and companies alike. "Democratic states are more vulnerable than non-democratic states because: we do not censor social network and media content and because we do not pollute with propaganda. In return we have freedom of expression and of the press," concluded Paz Esteban..

It is at this point that we must ask ourselves whether we are talking about cyber security or cyber defence," points out the former director of the CNI and JEMAD between 2004 and 2008, General Félix Sanz Roldán. Both concepts have become key areas of strategic studies. "Security is the state from which it is not convenient to leave, and defence is the state that must be abandoned as soon as possible", Sanz Roldán recalls. Therefore, at present, where aggressions in cyberspace are continuous, a response to these attacks is needed through 'cyber security'.

"We lack legislation, we lack order in the order," says Sanz Roldán, "we no longer live in the concepts that were turned over in Westphalia of borders and the right to respond to invasions. We are now in another order that comes from the network". To put this order in place, the former Chief Executive points to three solutions: a specific new regulation and specific international law; education; and taking into account "digital nationalism", which the General defined as "no state should get to the point of deciding who it wants to occupy its sovereignty".

The strategies promoted by the executive command are very important here. From 2013, Sanz Roldán recalls, there is a cybersecurity strategy and a council on the subject, where all related activities could be discussed.  "The national security strategy must have a multi-faceted approach. If there is one thing that cuts across all threats, it is cyber threats. The Armed Forces have to protect their own networks, design operations that overlap with military operations and be able to reach places where the instruments of the state cannot," says Miguen Angel Ballesteros, director of the Department of Homeland Security.

But the lack of agreement on the State's General Budget has paralysed the creation of a National Security Centre for Cyber Defence, a key centre in the fight against cyber-crime and cyber-attacks, something that both Sanz Roldán and Ballesteros have referred to. Cyber espionage, 5G, propaganda and hybrid warfare, where disinformation and cyber defence are the key elements, are presented as the threats faced by the security centres and where good journalism is necessary to combat these conflicts.