Raphael John-Lall

The con­flict be­tween the US and Venezuela may not on­ly erupt in­to a tra­di­tion­al war with sol­diers and ri­fles, but there could be cy­ber­war which can im­pact T&T’s busi­ness­es and the na­tion­al econ­o­my.

Busi­ness lead­ers and ex­perts in cy­ber­se­cu­ri­ty ex­pressed the view that cy­ber­war­fare is just a new face in mod­ern war­fare, at the sec­ond part of the Caribbean Cor­po­rate Gov­er­nance In­sti­tute’s (CC­GI) we­bi­nar en­ti­tled “Im­pact of Ris­ing US/Venezue­lan ten­sions” on Thurs­day.

The theme was “Cy­ber Threats, Busi­ness Re­silience and the US Venezuela Stand­off.”

Co-founder of Orb­tron­ics, a com­pa­ny based in St Lu­cia, Keeghan Patrick gave the ex­am­ple of the cy­ber­at­tack on Venezuela’s state-owned oil com­pa­ny PDVSA last Mon­day.

Reuters re­port­ed Venezuela’s state-run oil com­pa­ny PDVSA had been sub­ject to a cy­ber­at­tack, adding its op­er­a­tions were un­af­fect­ed, even though four sources said sys­tems re­mained down and oil car­go de­liv­er­ies were sus­pend­ed.

“Just re­cent­ly, four days ago, the Venezue­lan Oil Se­cu­ri­ty Ad­min­is­tra­tion Sys­tems was paral­ysed from a cy­ber at­tack. Their da­ta was frozen. The oil was still there but it se­vere­ly im­pact­ed their op­er­a­tions. This is one of the world’s largest oil com­pa­nies and they were forced to use pen and pa­per and they are in the mid­dle of this stand off and con­flict with the Unit­ed States,” he said.

He en­cour­aged the busi­ness com­mu­ni­ty to de­vel­op strate­gies and con­tin­gency plans in the event of a cy­ber­at­tack if the con­flict in­ten­si­fies.

“As busi­ness and pri­vate sec­tor ex­ec­u­tives, we need to be think­ing about what are our key points of at­tack, what is the risk ex­po­sure if those key points go down and how can we mit­i­gate those. If a con­flict breaks out be­tween the Unit­ed States and Venezuela, I think that we should be think­ing about if our net­work goes down. If we don’t have in­ter­net ac­cess, what is the ana­logue min­i­mum? What we are go­ing to be do­ing to al­low our busi­ness­es to con­tin­ue/”

He asked busi­nes­sown­ers what would they do if the sys­tems for their pay­ment plans or their com­pa­ny emails go down.

“In the worse case sce­nario, there are so­lu­tions to the prob­lem but some of those so­lu­tions can on­ly be done over a num­ber of years and might on­ly be able to im­ple­ment for the next cy­ber­war that we might face. So, we have to think about near-term so­lu­tions and we should be think­ing about how to keep busi­ness run­ning, if I don’t have email, if I don’t have pay­ment sys­tems, if I don’t have oth­er sys­tems.”

He al­so spoke about cy­ber es­pi­onage and de­vel­op­ing sys­tems to pro­tect busi­ness­es.

“In the sce­nario of a stand­off, we have more of this da­ta theft and In­tel­lec­tu­al Prop­er­ty (IP) es­pi­onage type of thing hap­pen­ing with­in this type of ten­sion and Cold War type of stand­off. Our teams set up our back­up sys­tems and we must en­sure if this type of in­for­ma­tion is stolen that we do have a back­up where we can ac­cess it. Maybe it is on a dif­fer­ent serv­er and dif­fer­ent lo­ca­tion.”

He ar­gued that even if Venezuela and the US were to come to a peace­ful set­tle­ment to­mor­row, busi­ness­es in T&T and the re­gion must con­tin­ue to de­vel­op con­tin­gency plans for sim­i­lar sce­nar­ios in the fu­ture.

“Even if to­mor­row, Venezuela and the US strike a deal of some sort, we still need to be op­er­at­ing in the mode of a pos­si­ble stand­off. I don’t think it will be a time to low­er our guard. I think this is a time where ac­tors, ei­ther na­tion­al­ists or out­side, use it as the ‘chaos of peace’ and this is an­oth­er op­por­tu­ni­ty for them to at­tack. It could be Unit­ed States’ ac­tors, Venezue­lans ac­tors or Caribbean ac­tors and we find our­selves in the mid­dle.”

He en­cour­aged re­gion­al com­pa­nies to come to­geth­er to see how they can share da­ta and goods as well as im­prove the move­ment of peo­ple. Patrick not­ed that un­for­tu­nate­ly the re­gion is still far away from this re­al­i­ty.

“Any state-spon­sored at­tacks on US in­fra­struc­ture, the Caribbean and oth­er places of the world be­come nat­ur­al col­lat­er­al dam­age. The so­lu­tion to that is more long term and I don’t think we can solve it in the near term. But I do think it is a warn­ing sig­nal that our in­ter-sov­er­eign­ty and how we can im­prove our da­ta, crit­i­cal in­fra­struc­ture with­in the Caribbean where it is owned un­der our geopo­lit­i­cal en­vi­ron­ment.”

Fi­nal­ly, he said re­gion­al uni­ty is im­por­tant to face these types of threats.

“We need to build a Caribbean where we can keep the lights on re­gard­less of what hap­pens be­tween Wash­ing­ton DC and Cara­cas or the Wash­ing­ton DC and some oth­er part of the world... and to keep it as a peace­ful Caribbean.”

Dis­in­for­ma­tion

cam­paign

IT Con­sul­tant Kris­t­ian Bainey, who is based in Cana­da, ad­vis­es busi­ness own­ers to pre­pare for the next wave of cy­ber­war­fare.

“Cy­ber­se­cu­ri­ty on­ly looks like an IT is­sue re­al­ly when there is noth­ing go­ing wrong. The mo­ment the risk en­vi­ron­ment shifts, it be­comes a cash flow is­sue, a trust is­sue, a sur­vival is­sue. So, these geopo­lit­i­cal ten­sions with the US and Venezuela and oth­er coun­tries that have been through these cy­ber­at­tacks have not been ran­dom. Peo­ple have to know it’s not ran­dom. And it is ac­tu­al­ly ex­pect­ed be­cause it has been done be­fore in the past.”

He said when ten­sions rise, there is an in­crease of cy­ber­se­cu­ri­ty and cy­berthreat ac­tiv­i­ty.

“So, busi­ness­es get hit be­cause they move mon­ey and de­liv­er ser­vices and hold pub­lic trust of­ten too much with less pro­tec­tion than what the Gov­ern­ment stan­dards give. So, the ques­tions lead­ers should be ask­ing is not how se­cure are we when the en­vi­ron­ments shift overnight. Do we know what to do in the first 48 hours which is crit­i­cal to keep the busi­ness­es stand­ing? As sta­tis­ti­cal­ly proven, with­in the first 48 hours and even 24 hours, you must have con­ti­nu­ity risk man­age­ment plans at that point to start to man­age the is­sues that come with most com­pa­nies like back­ups, vi­rals and an­tivirus­es.”

He pre­dicts that the next ma­jor threat will be AI-dri­ven dis­in­for­ma­tion.

“There is AI gen­er­at­ed au­dio, videos and mes­sages. We have all seen and you’ve heard about it on the news on CNN, and on 60 Min­utes. How con­vinc­ing­ly it im­per­son­ates peo­ple, ex­ec­u­tives. They are try­ing to get in­for­ma­tion. This is break­ing the de­ci­sion mak­ing of the peo­ple who make the de­ci­sions. A fake CEO’s call trig­gers ur­gent wire trans­fers. Deep fake videos trig­gers pan­ic faster than facts and ac­cel­er­ates na­tion­al se­cu­ri­ty risks. I think this is to­tal­ly true.”

He hopes busi­ness own­ers and cor­po­rate lead­ers use this sit­u­a­tion with Venezuela and the US to de­vel­op plans for sim­i­lar sce­nar­ios in the fu­ture.

“Af­ter every­thing sta­bilis­es with Venezuela, you should use this event to jus­ti­fy re­silience spend­ing. What were the lessons learned? Do a stress test on your re­sponse be­fore the next shock hap­pens and treat cloud telecom­mu­ni­ca­tions and da­ta providers like a crit­i­cal in­fra­struc­ture be­cause it re­al­ly is. At the end of the day, the next na­tion­al, big at­tack would be dis­in­for­ma­tion be­cause of Ar­ti­fi­cial In­tel­li­gence.”