NPR is reporting Russia’s “Fancy Bear” cyber operations team has breached German government network assets:

Germany says it managed to fend off a cyberattack against key ministries, but declined to confirm media reports that the culprit was the Russian intelligence operation blamed for interference in U.S. elections.

“We can confirm that the Federal Office for Information Security (BSI) and intelligence services are investigating a cybersecurity incident concerning the federal government’s information technology and networks,” an Interior Ministry spokesman said Wednesday.

“The attack was isolated and brought under control within the federal administration,” which manages government computer networks, the spokesman said in a statement, Reuters reports.

According to Reuters: “Western governments and security experts have linked the hacker group known as APT28 or Fancy Bear to a Russian spy agency, and have blamed it for an attack on the Democratic National Committee ahead of the 2016 U.S. elections.

Welcome to the new normal, where Russia conducts daily cyber operations, gets caught, and periodically publicly reprimanded for their bad behavior. I do not expect anything to change, unless one of the more powerful nation states severely breaches Russian assets. However, with Trump “in charge” in the US, it is doubtful a strong response will ever occur while he is in office.

Germany is exploring the legalities around responses to cyber attacks and is recognizing the country may need to change its constitution to allow for striking back to cyber actors:

Germany may need to change its constitution to allow it to strike back at hackers who target private computer networks and it hopes to complete any legal reforms next year, a top Interior Ministry official said on Monday.

State Secretary Klaus Vitt told Reuters the government believed “Significant legal changes would be needed” to allow such “Hack back” actions.

“A constitutional change may be needed since this is such a critical issue,” Vitt said on the sidelines of a cyber conference organized by the Handelsblatt newspaper.

Vitt said much would depend on the outcome of coalition talks in Germany of which cyber capabilities formed a part.

Top German intelligence officials told parliament last month they needed greater legal authority to strike back in the event of cyber attacks from foreign powers.

We can all thank Russia and Putin for forcing this issue globally. Their exceptional use of cyber attacks coupled with propaganda has changed the conventional approach to using cyber as part of a broader geopolitical strategy.

Additionally, as Japanese Prime Minister Shinzo Abe continues to explore changing Article 9 of the Japanese Constitution, I suspect this will become an issue here in Japan as well. Hacking back against malicious actors is not as cut-and-dry as some would suspect. Specific legal authority is required, otherwise the country could face legal issues and liability, especially if attribution is incorrect and an innocent bystander is attacked.

Germany passed a new cyber security law earlier this summer but it apparently is not working well because of the ambiguity legalese wields (emphasis added):

This summer, Germany adopted a new law, known in German as the IT-Sicherheitsgesetz, to regulate cybersecurity practices in the country. The law requires a range of critical German industries establish a minimal set of security measures, prove they’ve implemented them by conducting security audits, identify a point of contact for IT-security incidents and measures, and report severe hacking incidents to the federal IT-security agency, the BSI (Bundesamt für Sicherheit in der Informationstechnik). Failure to comply will result in sanctions and penalties. Specific regulations apply to the telecommunications sector, which has to deploy state of the art protection technologies and inform their customers if they have been compromised. Other tailored regulations apply to nuclear energy companies, which have to abide by a higher security standard. Roughly 2000 companies are subject to the new law.

The government sought private sector input early on in the process of conceptualizing the law—adhering to the silly idea of multistakeholderism—but it hasn’t been helpful in heading off conflict. German critical infrastructure operators have been very confrontational and offered little support. Despite some compromises from the Ministry of the Interior, which drafted the law, German industry continues to disagree with most of its contents.

First, there are very few details to clarify what is meant by “minimal set of security measures” and “state of the art security technology.” The vagueness of the text is somewhat understandable. Whenever ministries prescribed concrete technologies and detailed standards in the past, they were mostly outdated when the law was finally enacted (or soon after that), so some form of vagueness prevents this. But vagueness is inherently problematic. Having government set open standards limits market innovation as security companies will develop products to narrowly meet the standards without considering alternatives that could improve cybersecurity. Moreover, the IT security industry is still immature. It is impossible to test and verify a product’s ultimate effectiveness and efficiency, leading to vendors promising a broad variety of silver bullet cybersecurity solutions—a promise that hardly lasts longer than the first two hours of deployment.