Cyber combat plays a massive role in the political sphere and countries are increasingly investing in more advanced technology to get ahead, says information security expert and CEO of 4Di Privaca, Drew van Vuuren.
"There are well documented instances of nation states sponsoring teams of hackers, investing in technology to intercept communications, creating malware and viruses to disrupt operations of critical national infrastructures, and generally conducting a virtual war online to try and get the upper hand," he says.
In the most recent cyber security scandal, the UK has come under fire for allegedly spying on foreign delegates, including SA, at the 2009 G20 summit, in London. Former American spy Edward Snowden leaked documents showing British agents hacked into foreign diplomats' phones and e-mails using state of the art surveillance equipment.
Bringing an extra twist to the scandal, reports surfaced over the weekend that the South African government was well aware delegates were being spied on, but chose to deal with the matter privately to avoid being embarrassed.
Department of International Relations and Co-Operation spokesperson Clayson Monyela refused to comment on the allegations, saying "no country anywhere in the world will be willing to discuss security issues".
Professor Jane Duncan, Highway Africa chair of Media and Information Society at Rhodes University, notes the problem of cyber breaching has already been escalated to a national security threat - the government's cyber security policy framework has been transferred from the Department of Communications to that of state security.
She says, however, it is an open question of how big the problem of cyber espionage is. "It is impossible to assess whether there's an actual threat, as Cabinet's strategic intelligence priorities, which I assume would be based on some sort of threat assessment, are secret," says Duncan. "My suspicion is that the threat of espionage is being hyped to justify the Protection of State Information Bill."
Van Vuuren says the surfacing of these reports only highlights the important role that such activities play in the political processes.
"It is not mandatory to release information about security breaches, so any successful hack against government information systems will likely not be publicised by the government. The only time the man on the street would find out about it would be either through a notification from the hackers themselves, or by an insider who is attempting to highlight the fallibility of the systems in place, such as Snowden," he says.
Secure systems?
Another cyber breach of government information occurred a few weeks ago, when the South African Police Service Web site was targeted by a hack attack that saw the names and personal details of some 16 000 whistle-blowers and victims of crime being mined from www.saps.gov.za, and made publicly available via a bulletproof site.
Security experts slammed the hacking of the Web site, saying it spelled gross negligence on the part of the SAPS and raises questions around the police's IT systems and security.
System breaches at government entities, such as the South African Revenue Service, Postbank and the Alfred Ndzo District Municipality have also raised widespread concern that the institutions being targeted are those that hold acutely sensitive information about citizens.
Numerous government Web sites have become hacking victims in the past year, including the Administrative Adjudication of Road Traffic Offences, the Department of Social Development, the Presidential National Commission, the National Population Unit and the Mangaung Metro Municipality.
These cyber attacks continue to fuel accusations of incompetence and negligence aimed at the State IT Agency, which is in charge of government IT systems.
Running with the big dogs
As to whether SA is able to withstand cyber breaches from countries such as the UK and US, Van Vuuren says: "The short answer is no.
"These governments have huge resources at their disposal and would employ some of the best hackers in the world to perform cyber espionage on their behalf. If there was a determined effort by these governments to access South African information systems, then it is entirely possible that they would succeed."
Van Vuuren notes SA is not completely ignorant to the threat of cyber war, but says the country's available information security skills are largely concentrated in the private sector.
According to Van Vuuren, there are not many well-educated and experienced cyber defence experts employed by government, as the remuneration and rewards aren't as lucrative as those offered in the private sector.
He says it is not unrealistic to expect government to be well informed and well prepared when it comes to information security.
"We should be asking the hard questions of our own government about how they conduct themselves when handling information that directly affects the state and by extension its citizens," he says. "In doing so, we ensure that when another nation attempts to gain access to information, there are specific security protocols and systems in place that can thwart those attempts."
Share