The Land Of I Know Not What And I Know Not Where

But what, one may legitimately ask, has any of this to do with cyber-crime?

The threats in cyberspace are real and dangerous. Ideally, a democratic state would ensure that this critical technology should benefit, not ruin, the lives of its citizens. Equally, the state should resist the temptation to infringe our rights and privacy. Allowing the military to assume a lead role in defence of civilian networks is most unwise. Yet given that cyber weapons have the potential to cripple a country's Critical National Infrastructure (and ruin people's lives in the process), there must be provision for the military to intervene in extreme situations. Those circumstances should be both exceptional and verifiable.

Separate agencies should be responsible for policing the three separate threats - cybercrime, cyber industrial espionage and cyber warfare. Recognised police agencies like the FBI or the US Secret Service should assume responsibility for cybercrime. Corporations and companies should either develop their own network security system or pay a company specialising in cyber security to do it. Civilian government should establish its own network defence, while the military should protect its systems.

On the surface that seems straightforward enough. But in the real world the edges are already blurred, encouraged by the interconnectivity of the Web. Then there is the hitherto insoluble two-part conundrum at the heart of the cyber security: what does a cyber attack look like?

To answer this, a cyber defender requires two vital pieces of knowledge. From where does this attack originate? And what is the attacker's motive? Faced with a skilled cyber aggressor, not even the best defender can answer these questions. One may only calculate and - acting on a supposition - this can lead to wrong decisions, misunderstandings and, eventually, conflict.

Let us assume that our police agency, the corporate sector and the military dutifully stick to their task of protecting the state against their designated perils. There are still two actors who are ever present across the spectrum of threats: the spook and the hacker. The former seeks to crack the conundrum (although not necessarily to share the resulting knowledge); the latter is actually responsible for formulating the conundrum precisely in such a way as to render it insoluble.

The intelligence agency sniffs around the Web like a black cat against a dark background, never making a sound and socialising only when