Zero Days Negative mi 7

nato counterplan

1nc nato counterplan

The United States federal government should propose the development of a zero-day vulnerability and exploit threat sharing program to the North Atlantic Treaty Organization. The United States federal government should disclose zero-day vulnerabilities and exploits to the North Atlantic Treaty Organization.

The counterplan solves the aff and reinvigorates NATO --- bolsters international cyberdefense capabilities while maintaining strategic use of offensive cyber operations

Fidler 15 -- Marshall Scholar, Department of Politics and International Relations, University of Oxford (Mailyn, Summer 2015, REGULATING THE ZERO-DAY VULNERABILITY TRADE: A PRELIMINARY ANALYSIS, http://moritzlaw.osu.edu/students/groups/is/files/2015/06/Fidler-Second-Review-Changes-Made.pdf, pg. 72-74) /AMarb

NATO is an influential body, and, if it addressed trade in zero-days, its policies would have global importance. NATO has been relatively successful in addressing new collective defense challenges, so it may have the institutional flexibility to take on zero-days. NATO membership maps well with participants in the zero-day market, including countries with notable buyers and sellers. Additionally, because NATO is a collective defense organization for allies, conceptions of the underlying security problem and opinions about approach may be more aligned than among states not engaged in collective defense. Given the difficulties of other forms of international cooperation, achieving consensus among allies might be strategically attractive. NATO has developed a focus on cyber defense, and zero-days are relevant to that agenda. Not only could trade in zero-days facilitate attacks against NATO networks, but the stockpiling behavior of member states also leaves other members vulnerable. Key NATO members, such as the United States and United Kingdom, are purchasers of zero-days.327 NATO’s commitment to cyber defense has resulted in the development of a cyber policy- and decision-making structure and processes that could also be used to address the zero-day issue without significant alteration. Despite this institutional base, NATO would have to experience a policy shift before addressing zero-days. Zero-days are inherently exploitable: although they have significant implications for cyber defense, they are also closely tied with offensive capabilities of member states and the potential for NATO offensive capabilities. NATO, as an organization, is currently not positioned to discuss offensive cyber issues and has demonstrated wariness of an expanded cyber mandate. Still, as demonstrated by Libya and Russia’s actions in Crimea, cyber is an increasing reality of security threats facing NATO. NATO must address cyber capabilities, not just passive cyber defense. Zero-days, as a technology that overlaps both categories, could be a useful place to start this shift. If this shift occurred, NATO could use its existing structure to foster guidelines for addressing zero-days. The Cyber Defense Management Board (CDMB), which implemented the 2011 Action Plan, could be a starting place for discussions about zero-day policy. NATO could do this in several ways, including using CDMB to increase transparency and information sharing about zero-day issues within member states. For instance, NATO could establish a zero-day threat-sharing program, in which governments share information about the nature of the zero-day threats they face. This kind of program would probably be least resisted by member states, but NATO could go further. NATO could institute a group disclosure program: when one member stockpiles a vulnerability, it could also disclose the vulnerability to a NATO clearinghouse. NATO members could then protect themselves against that vulnerability or make use of it. NATO could also push for harmonized purchasing policies, perhaps agreeing that NATO members will only purchase or stockpile certain vulnerabilities from certain countries or suppliers. However, given NATO’s lack of appetite for discussing offensive capabilities, NATO can, at best, function as a place to start a conversation among likeminded states. For instance, the CDMB could facilitate discussion of the zero-day issue at the next NATO defense ministers meeting. But even that, as demonstrated, may be a difficult topic to broach. NATO simply may not be ready to address something as complex and controversial as the zero-day trade. NATO is also not an entity designed for addressing trade in dual-use technologies. It could discuss zero-days, particularly government use and purchasing of zero-days, but it is not designed to influence global trade. NATO has only 28 members; even though many members are active buyers or host active sellers, and may share enough interests to come to consensus, an agreement among a limited group could only produce governance of limited global effect.

The plan and permutation disrupt the counterplan’s process for handling zero-day vulnerabilities by unilaterally disclosing all of them to vendors --- that endangers the national security of allies

Zetter 14 –award-winning reporter at Wired covering cybercrime, privacy, and security (Kim, 4/15/14, “Obama: NSA must reveal bugs like Heartbleed, unless they help the NSA,” Wired, http://www.wired.com/2014/04/obama-zero-day/) /AMarb

Rogers said that within the NSA “there is a mature and efficient equities resolution process for handling ‘0-day’ vulnerabilities discovered in any commercial product or system (not just software) utilized by the U.S. and its allies.” The policy and process, he said, ensures that “all vulnerabilities discovered by NSA in the conduct of its lawful missions are documented, subject to full analysis, and acted upon promptly.” He noted that the NSA is “now working with the White House to put into place an interagency process for adjudication of 0-day vulnerabilities.” He also said that “the balance must be tipped toward mitigating any serious risks posed to the U.S. and allied networks” and that he intended to “sustain the emphasis on risk mitigation and defense” over offensive use of zero days. Rogers noted that when the NSA discovers a vulnerability, “Technical experts document the vulnerability in full classified detail, options to mitigate the vulnerability, and a proposal for how to disclose it.” The default is to disclose vulnerabilities in products and systems used by the U.S. and its allies, said Rogers, who was confirmed by the Senate and took command of the NSA and US Cyber Command in March. “When NSA decides to withhold a vulnerability for purposes of foreign intelligence, then the process of mitigating risks to US and allied systems is more complex. NSA will attempt to find other ways to mitigate the risks to national security systems and other US systems, working with stakeholders like CYBERCOM, DISA, DHS, and others, or by issuing guidance which mitigates the risk.”

That alienates NATO allies --- they don’t want to be treated as junior partners

Keohane et al 14 (Daniel (Research director in NATO), Stefan Lehne (MA in IR), Ulrich Speck (PhD at University of Frankfurt), and Jan Techau (Director of Carnegie Europe which works on EU integration and foreign policy), Oct. 28,2014, A New Ambition for Europe: A Memo to the European Union Foreign Policy Chief, Carnegie Europe, http://carnegieeurope.eu/publications/?fa=57044) /AMarb

Clarify the EU’s partnership with the United States on security challenges. The EU should not play the role of an American junior partner nor automatically side with the United States. But it should cooperate and coordinate with Washington whenever possible, as not only do interests on many issues converge but the United States is also the EU’s closest international partner. The EU should define its own positions on Asian security challenges based on international law (such as the UN Convention on the Law of the Sea) and communicate these positions to all sides. Militarily, the EU cannot do much, but it can help build a multilateral order and security architecture in the region to the extent that governments in the region are interested. ASEAN, although a Southeast Asian grouping, could be the nucleus of a new Asia-Pacific rules-based order, for instance via the ASEAN-affiliated East Asia Summits, and the EU should support such efforts. There may also be potential for offering EU experience with nonmilitary approaches to security, such as mediation, crisis management, confidence building, and application of the rule of law, to help reduce geopolitical tensions.

Preventing NATO fragmentation crucial to curbing Russian aggression

Stewart 14 (Brian, 3-28-14, "Ukraine crisis: Can a weakened NATO stand up to Putin?" CBC News) www.cbc.ca/news/world/ukraine-crisis-can-a-weakened-nato-stand-up-to-putin-1.2589288)

Even leaving Ukraine aside, NATO has other potential crises on its flanks, where it is obliged by treaty to protect increasingly nervous NATO members who are also neighbours of Russia. These include the three former Soviet Union satellites, Estonia, Latvia and Lithuania, all with fragile economies and significant Russian minorities; as well as the much larger Poland, a former member of the Soviet Union's Warsaw Pact military alliance. Including Estonia, Latvia and Lithuania was always controversial within NATO because they are so far east and so difficult to defend. Still, they made it in and now demand NATO show it would be ready to honour its famous (Article 5) guarantee that an attack on one member involves an attack on all. In recent weeks, the U.S., with U.K. support to come, has rushed in limited fighter plane and other air support for the Baltic members, as well as 300 support staff and some naval units. UKRAINE-CRISIS/ Russian sailors mill about onboard the Suzdalets at the Crimean port of Sevastopol earlier this week. As many as 150,000 Russian troops are also taking part in exercises along Ukraine's eastern boundary. (Reuters) But so cautious a response has not eased the nervousness in the region, which has been warning NATO for years about Russian ambitions. Some of their fears stem from the large military exercises Moscow has run in the Baltic region in recent years, including some that simulate attacks on Lithuania and Poland. NATO, it should be noted, also exercises units in the Baltic region, while Poland has recently launched a substantial arms buildup of its own in response to Russia's. These days, NATO is also hearing rising security concerns and demands for reassurance from nations such as Hungary, Romania and Bulgaria , as well as both the Czech and Slovak Republics. Here, NATO's worries are not limited to military pressure-tactics, but encompass the deep political crises and anti-democratic trends in some of these Eastern Europe countries, where crony-capitalism and the leverage of Russian gas supplies open new doors to Putin's influence. No, this is not the old Cold War. Today's Russia is weaker than the West, even with few European powers ready for yet another arms race with Moscow. But if Putin's regime really does feel that NATO's once triumphant march to the east is at least in part reversible, given the right pressure points, then NATO's very credibility is about to be severely tested, yet again.

The impact is global nuclear war

Fisher 14 (Max, Political Analyst @ Vox, 9/3/14 "Obama's Russia paradox: Why he just threatened WWIII in order to prevent it," http://www.vox.com/2014/9/3/6101507/obama-just-committed-the-us-to-war-against-russia-if-it-invades)

President Obama gave a speech on Wednesday, in a city most Americans have never heard of, committing the United States to possible war against Russia. He said that the North Atlantic Treaty Organization, a Western military alliance better known as NATO, would fight to defend eastern European members like Estonia against any foreign aggression. In other words, if Russian President Vladimir Putin invades Estonia or Latvia as he invaded Ukraine, then Putin would trigger war with the US and most of Europe. Obama's speech from the Estonian capital of Tallinn, though just a speech, may well be America's most important and aggressive step yet against Russia for its invasion of Ukraine. While the speech will do nothing for Ukraine, it is meant to stop Russia from invading, or perhaps from sponsoring rebellions in, other European countries — so long as those European countries are part of NATO, as most are. "We'll be here for Estonia. We will be here for Latvia. We will be here for Lithuania," President Obama said from the capital of Estonia, one of the three Baltic states that were once part of the Soviet Union but now are members of NATO. "You lost your independence once before. With NATO, you will never lose it again." Obama was making a promise, and a very public one meant to reverberate not just in European capitals but in Moscow as well: If Russia invades any member of NATO, even these small Baltic states on the alliance's far periphery, then it will be at war with all of them — including the United States. "The defense of Tallinn and Riga and Vilnius is just as important as the defense of Berlin and Paris and London," Obama said. To be really clear: that defense means war with Russia, which has the world's second-largest military and second-largest nuclear arsenal, a prospect so dangerous that even during the angriest moments of the Cold War, the world managed to avoid it. The idea, though, is not that Obama wants to go to war with Russia, it's that he wants to avoid war with Russia — this is also why the US and Europe are not intervening militarily in Ukraine to push back the Russian tanks — but that avoiding war with Russia means deterring Russian President Vladimir Putin from invading these Baltic states in the first place by scaring him off. The risk of such an invasion, by the way, is real: these countries are about one-quarter ethnic Russian, and Ukraine's own Russian minority which was Putin's excuse for invading Crimea in March. Putin also clearly sees former Soviet states as fair game; he has invaded Ukraine and Georgia, both marked in red on the above map. So the Baltic states are rightly terrified that they are next. Here is Obama's dilemma, and Europe's: They want to prove to Putin that they will definitely defend Estonia and Latvia and other eastern European NATO members as if they were American or British or German soil, so that Putin will not invade those countries as he did in Ukraine. But the entire world, including Putin, is suspicious as to whether or not this threat is a bluff. And the worst possible thing that could happen, the thing that could legitimately lead to World War Three and global nuclear war, is for Putin to call Obama's bluff, invade Estonia, and have Obama's bluff turn out to not be a bluff.

2nc nato cp solvency

NATO is key to solve cyberattacks – the counterplan produces cooperation with companies at the discretion of NATO allies

Thompson 14 -- writes about national security (Loren, 9/19/14, Cyber Alliances: Collective Defense Becomes Central To Securing Networks, Data, Forbes, http://www.forbes.com/sites/lorenthompson/2014/09/19/cyber-alliances-collective-defense-becomes-central-to-securing-networks-data/) /AMarb

When the North Atlantic Treaty Organization — NATO — wrapped up its summit in Wales earlier this month, the member-states issued a lengthy communique expressing solidarity on major defense challenges. One of the challenges mentioned was cybersecurity. The alliance stated that “cyber defence is part of NATO’s core task of collective defence,” presenting concerns so severe that they might lead to invocation of Article Five of the North Atlantic Treaty — the article calling on all members to come to the defense of a threatened nation. The communique went on to stress that “strong partnerships play a key role in addressing cyber threats and risks,” and committed alliance members to intensified cooperation in pursuit of integrated solutions. It isn’t hard to see why NATO is worried about threats in cyberspace, given Russia’s recent use of on-line attacks against Ukraine and other countries in a style of combat that has come to be called “hybrid warfare.” However, a report by the Pentagon’s prestigious Defense Science Board released last year suggests that the cyber challenge reaches far beyond the use of botnets and distributed denial-of-service tactics. Describing the extensive vulnerability of U.S. military forces to cyber assault, the report then observed, The impact of a destructive cyber attack on the civilian population would be even greater with no electricity, money, communications, TV, radio or fuel (electrically pumped). In a short time, food and medicine distribution systems would be ineffective; transportation would fail or become so chaotic as to be useless. Law enforcement, medical staff, and emergency personnel capabilities could be expected to be barely functional in the short term and dysfunctional over sustained periods. These sustained periods, the science board stated, might last “months or years” as government and industry sought to rebuild damaged infrastructure — a possibility that led the panel to compare the specter of state-sponsored cyber attacks to the threat of nuclear war. So if you think that 56 million payment cards being compromised atHome Depot HD +0.3% is about as bad as cyber threats can get, think again. Civilians and soldiers alike have hardly begun to experience how destructive the coming age of information warfare is going to be. But like NATO, private industry is beginning to grasp the challenge. And also like NATO, industry has begun to embrace the value of collective defense in meeting that challenge. Earlier this month, McAfee and Symantec SYMC -1.57% — the nation’s two biggest cybersecurity firms — agreed to join a Cyber Threat Alliance founded in May by Fortinet and Palo Alto Networks PANW -1.5%. The goal of the new consortium, quoting a white paper it issued, is “to disperse threat intelligence on advanced adversaries across all member organizations to raise the overall situational awareness in order to better protect their organizations and their customers.” What that rather bland formulation indicates is that even the biggest players in cybersecurity have come to doubt that the kind of “advanced persistent threats” they are now encountering can be defeated unless industry emulates NATO in embracing some form of collective defense. In the past, companies like McAfee and Symantec would have resisted the kind of deep collaboration now being proposed for fear of losing competitive advantage. But attacks on networks and data repositories have become so pervasive and clever that collective defense — the one-for-all and all-for-one approach — may be crucial to averting castastrophe. Under this emerging construct, the industry alliance will focus on generating actionable intelligence about zero-day exploits and other dangers that can be quickly disseminated to members. Zero-day exploits are attack vectors and methods not previously observed for which no off-the-shelf solution currently exists. They may require drastic action like shutting down a network before it can be thoroughly compromised, and because time is of the essence the dissemination of threat details will probably have to be automated. Over time, the Cyber Threat Alliance will generate standards spelling out how this should be done, presumably using software such as the Trusted Automated Exchange of Indicator Information (TAXII) framework developed by MITRE and the Department of Homeland Security. Industry’s bid for greater collaboration in meeting the cyber challenge has been matched by efforts at broader cooperation by the government. For instance, during the first Obama Administration, former Deputy Secretary of Defense Bill Lynn drove efforts to forge a cybersecurity alliance between his department and its contractors, which now has blossomed into the Defense Industrial Base Cybersecurity/Information Assurance Program. Under that program, industry and the military share information about cyber threats that is quickly analyzed and disseminated to counter emerging dangers. A broader effort managed in conjunction with the Department of Homeland Security provides similar support to companies operating critical infrastructure — including sometimes sharing highly classified threat indications. However, a well-known federal advisor in such matters told me this week that the government unwittingly creates disincentives for industry to cooperate, for example by failing to protect sensitive information provided by companies that have experienced cyber attacks. McAfee president Gert-Jan Schenk has cited the absence of legislation promoting cross-national collaboration on cyber threats as one area where industry has to work harder to make up for government’s failure to act. His enterprise, which has invested heavily in cybersecurity research since being acquired by Intel in 2011, has become a leading proponent of collaborative efforts at closing the seams between organizations and domains that on-line criminals exploit. So it seems that collective defense is no longer solely the province of diplomats and military allies. Companies, even when they are competing in the same markets, increasingly see the advantages of working together to counter shared threats. Some will say this demonstrates the ability of market forces to encourage enlightened behavior even when government does not intervene. However, a more sobering interpretation is that cyber threats are becoming so sophisticated and alarming they are forcing changes in the way people behave. Whichever interpretation you favor, it’s clear that collective defense is becoming an organizing principle for global cybersecurity efforts.

EU can aid in solving cybersecurity

Keohane et al 14 (Daniel (Research director in NATO), Stefan Lehne (MA in IR), Ulrich Speck (PhD at University of Frankfurt), and Jan Techau (Director of Carnegie Europe which works on EU integration and foreign policy), Oct. 28,2014, A New Ambition for Europe: A Memo to the European Union Foreign Policy Chief, Carnegie Europe, http://carnegieeurope.eu/publications/?fa=57044) /AMarb

Make cybersecurity a priority. The EU has a major stake in and role to play on global security challenges, such as maritime security and the potential security impact of climate change. But cybersecurity deserves particular attention since it will bring about a revolution in security thinking. Protecting the globally integrated information infrastructure from intrusion and disruption will bring together homeland security authorities, the military, and the private sector in a hitherto unknown alliance. Because of the EU’s deep collaboration with the various national ministries invested in protecting cybernetworks, the union is better suited than any other international organization to develop and implement a proactive crossborder strategy for this part of the global commons. The EU foreign policy chief should dedicate considerable internal resources to staying on top of this fast-developing area and to becoming a valuable resource for EU member states.

NATO has experience with responses to cyberattacks – solves the advantage

Fidler 15 -- Marshall Scholar, Department of Politics and International Relations, University of Oxford (Mailyn, Summer 2015, REGULATING THE ZERO-DAY VULNERABILITY TRADE: A PRELIMINARY ANALYSIS, http://moritzlaw.osu.edu/students/groups/is/files/2015/06/Fidler-Second-Review-Changes-Made.pdf, pg. 69-70) /AMarb

The 2007 Estonia attacks were NATO’s cyber awakening. In this incident, Estonian government, commercial, and news web capabilities were taken down by cyber attacks in response to controversy about moving a Soviet-era war memorial in Tallinn. The Estonia attacks demonstrated to NATO the“technical scale and political implications of potential cyber attacks.”307 The 2008 Bucharest Summit addressed these implications. NATO established two institutions: the Cyber Defense Management Authority (CDMA) and the Cooperative Cyber Defense Center of Excellence (CCDCOE).308 The CDMA helps coordinate member state cyber defense, reviews capabilities, and conducts risk management. The CCDCOE helps improve cyber defense cooperation through research, information sharing, and convening thought leaders. For instance, in 2009, the CCDCOE requested that experts analyze how international law applies to cyber warfare.309 Although the resulting 2013 report is not official doctrine, it provides important analysis about how NATO members might think about international law, conflict, and cyberspace.310 In June 2011, NATO adopted the Cyber Defense Policy and Action Plan, the most advanced step in the maturation of NATO’s cyber capabilities.311 The document enumerated steps to enhance the political and operational readiness of NATO to respond to cyber incidents, including defining minimum requirements for the security of national networks critical to NATO’s operations.312 The CDMA transitioned to a group called the Cyber Defense Management Board, which has been carrying out the Action Plan. 313 The 2012 Chicago Summit reaffirmed these efforts, and NATO Defense Ministers met for the first time in 2013 to focus exclusively on cyber defense.314

2nc nato impact

The dilapidation of NATO shatters global economic structures and seriously threatens international security and agriculture.

Ahmed 11/25/9

Nafeez Mosaddeq Ahmed uthor and political scientist specialising in interdisciplinary security studies. He teaches International Relations at the School of Social Sciences and Cultural Studies, University of Sussex, Brighton, where he recently completed Doctoral research on European imperial genocides from the 15th to the 19th centuries. http://www.mediamonitors.net/mosaddeq12.html 11/25/9

For this reason, according to Robert J. Art - a research associate at the Olin Institute at Harvard, and Herter Professor of International Relations at Brandeis University - America’s “overarching stake” in Europe consists partly of “the valuable investment the United States has to protect [which] is the politico-economic cohesion of Western Europe”, the objective being to “produce an outward-looking, liberal trading community, not an inward-looking protectionist one”,[65] thus maintaining the integration of the whole of Europe under the “stability” a US-dominated international economic system. It is in this context that we may note the particular objective of eradicating socialism in the Balkans and throughout the region in general, to enforce and secure US corporate economic interests.[66] The inseparable linkage between US/Western militarism and US/Western corporate economic interests is thus absolutely clear.[67] One high-ranking and experienced Western European diplomat put it succintly: “The United States presence in Europe is crucial. The role of the United States goes beyond balancing the Soviet Union. The United States keeps our national rivalries down. We are now faced with the emergence of a friendly local superpower - Germany. Our chances of succeeding are greater if the United States stays. If it goes, however, the effects will be felt way beyond the security field - in GATT, agriculture, and so forth. If NATO breaks up, our economic structures are threatened also.”[68] By strengthening NATO and expanding US military hegemony over Europe through NATO, not only does the US manage to prevent the arisal of an independent European security apparatus that may rival NATO, but furthermore, all European nations become subordinate within the US-dominated NATO alliance, thus once more eliminating the possibility of any significant rivalry. In this way, US economic hegemony is maintained within the global “economic structures” of the international system, protected under a military hegemony dominated by American leadership.

Without NATO, free Europe doesn’t exist. Enemies from the East would move in for the attack, and the world would be plunged into global war.

Steingart 10/20/06

Spiegel Online 10/20/6 Gabor Steingart chief editor of Handelsblatt, Germany's leading economic newspaper. http://www.spiegel.de/international/0,1518,443306,00.html

For 50 years it was a highly controversial institution. Today, though, every schoolchild knows that without the North Atlantic Treaty Organization, free Europe wouldn't exist. If the Western alliance hadn’t ostentatiously demonstrated its power -- with its fighter jets, tank divisions and continually updated weaponry -- Soviet communism would have expanded westward instead of imploding as it did. By the end of the Cold War, even NATO’s fiercest critics had learned their lesson: The dove of peace could only survive because the hawk was ready on his perch. The world war for wealth calls for a different, but every bit as contradictory, solution. Alas, once again many lack the imagination to see that the aims of our economic opponents are far from peaceful. Yet what sets this situation apart from what we usually call a conflict -- what paralyzes the West -- is how quietly the enemy is advancing. The two camps are divided between Europe and America on the one side and Asia on the other. But so far there has been no shouting, no bluster and no shooting. Nor have there been any threats, demands or accusations. On the contrary, there is an atmosphere of complete amiability wherever our politicians and business executives might travel in Asia. At airports in Beijing, Jakarta, Singapore and New Delhi red carpets lie ready, Western national anthems can be played flawlessly on cue -- and they even parry Western complaints about intellectual property theft, environmental damage and human rights abuses with a polite patience that can only be admired. The Asians are the friendliest conquerors the world has ever seen

2nc russia cyberwar impact

Russia is using zero-days to intercept NATO data about Ukraine --- cooperative threat reduction key to solve

Rashid 14 – writes about security and core internet infrastructure (Fahmida, October 14, 2014, SecurityWeek, Russia-linked Hackers Exploited Windows Zero-day to Spy on NATO, EU, Others, http://www.securityweek.com/russian-hackers-exploited-windows-zero-day-spy-nato-eu-other-high-profile-targets) /AMarb

Attackers exploited a zero-day vulnerability in Windows to spy on NATO, the European Union, Poland, Ukraine, private energy organizations, and European telecommunications companies, according to cyber-intelligence firm iSight Partners.

Microsoft is expected to patch the flaw today as part of October's Patch Tuesday release.

The espionage campaign began five years ago and is still in progress, iSight said in its advisory. It has evolved several times over the years to adopt new attack methods, and only began targeting the Windows zero-day with malicious PowerPoint files in August, according to the company. iSight analysts have named the operation "Sandworm Team" because the attackers included several references to Frank Herbert's Dune in the code.

"It is critical to note that visibility is limited and that there is a potential for broader targeting from this group (and potentially other threat actors) using this zero-day," iSight warned.

Sandworm targeted victims with malicious PowerPoint documents which, when opened, triggered the zero-day bug in all supported versions of Windows, including Windows Vista, 7, or 8, Windows Server 2008 and 2012, iSight said. The exploit installed another executable file onto the infected machine to open a backdoor, thus giving remote access to attackers.

The zero-day itself may not be as scary as it sounds, according to one security expert. “People shouldn’t panic about Sandworm," Ross Barrett, senior manager of security engineering at Rapid7, said over email. Even though the vulnerability is present in all supported operating systems, it is a local file format exploit, which are fairly common and routinely patched by Microsoft. While the bug can give attackers complete control of the compromised system, attackers need to launch a multi-stage attack in order to exploit this flaw. "The steps required to get there limit the impact of this vulnerability," he said.

While Microsoft has patched the flaw, iSight also provided some workarounds, such as disabling the WebClient Service to prevent Web Disributed Authoring and Versioning (WebDAV) requests from being transmitted, blocking TCP ports 139 and 445, and preventing executables from being launched by setup .inf files.

It's not known at this point what kind of information the attackers were after. Considering the list of victims, it's likely the attackers were looking for information regarding the Ukraine crisis, diplomatic communications, and sensitive documents related to the energy and telecomm industries. Sandworm also attempts to steal SSL keys and code-signing certificates, which may be used in future attacks.

iSight believes the attackers are Russian because analysts found Russian-language files on the command server used by Sandworm. The list of victims was another clue, since they are all strategically related to the Ukrainian conflict. While researchers haven't found technical indicators linking the attackers to the Russian government, the fact that the campaign focused on cyber-espionage and not cybercrime meant nation-state involvement was highly likely, according to the company. It's also expensive and time-consuming to look for security flaws in the operating system, making it quite possible the group had nation-state funding and support.

For example, the group targeted NATO computers with emails with a malicious document claiming to have information on European diplomacy back in December. An American academic with a focus on Ukraine and several Ukrainian regional government officials received spear-phishing messages just before a NATO summit over the summer. The malicious messages claimed to have information gathered by Ukrainian security services on Russian sympathizers, such as a list of pro-Russian extremists, iSight said.

It’s interesting that iSight found the zero-day flaw "being used in Russian cyber espionage attacks in the wild, targeting NATO, the European Union, and the telecommunications and energy sectors, but that’s probably the most interesting aspect of it," Barrett said.

Previous Sandworm attacks exploited older vulnerabilities to install the BlackEnergy exploit kit. BlackEnergy was used to create botnets with launched distributed denial-of-serve attacks against computers in Georgia during the country's conflict with Russia back in 2008. Originally a DDoS tool, BlackEnergy evolved to steal banking credentials and other information.

Sandworm was previously identified by F-Secure researchers in a whitepaper on a group they called Quedach released last month. "In the summer of 2014, we noted that certain samples of BlackEnergy malware began targeting Ukranian government organizations for information harvesting," F-Secure researchers wrote at the time.

iSight is sharing the detailed report with its customers but warned that malware and indicator data could be potentially misused to create "copycat exploits."

US-Russia nuclear war risks extinction – huge risk of miscalc and escalation

Starr 14 (Steven, Senior Scientist for Physicians for Social Responsibility and Director of the Clinical Laboratory Science Program @ University of Missouri, “Ukraine + NATO = Nuclear War,”, 11 March 2014 13:03 pg. http://tinyurl.com/ohgfk5p)

Furthermore, US/NATO naval forces should not be deployed in the Black Sea, where they would be in close proximity to Russian naval forces. In the event of a war in which Russian forces were actively engaged, the presence of US forces nearby would create a significant chance for a mistake in which US or Russian forces would fire upon each other. Supersonic fighters traveling at more than 1,000 mph can easily overfly national boundaries or "hostile" military forces. If NATO and Russian forces to come into direct military conflict, then the possibility of nuclear conflict increases exponentially. NATO cannot send in its 25,000 man Response Force and expect to defeat 150,000 Russian troops (or more) in a fight at the Russian border. In a NATO-Russian conventional conflict, in which Russian forces were prevailing, NATO would have the choice of withdrawing, calling for a ceasefire, or using its nuclear weapons against Russian forces. NATO has at least a couple hundred US B61 nuclear weapons forward deployed in Belgium, Germany, Italy, the Netherlands, and Turkey. The B61 is a "variable yield" weapon; the two models currently forward-based in Europe, the B61-3 and B61-4 both can be set to have an explosive yield of 300 tons of TNT (0.3 kilotons). In other words, the B61 is designed to be "useable" nuclear weapon, beginning with a "small" detonation that is roughly 20-30 times larger than our largest conventional weapon. However, the B61-4 can also be set to have an explosive power as much as 50,000 tons of TNT (50 kilotons), and the B61-3 as much as 170,000 tons of TNT (170 kilotons) – which is 70% greater than many of the strategic nuclear warheads carried by US nuclear subs. Even if NATO could manage to use its conventional forces to defeat Russian conventional forces, Russia would *not* allow such a defeat upon its very border. Russia would certainly use nuclear weapons to stop NATO. Russia has for some time adopted the policy of "nuclear de-escalation": "In order to maintain a credible nuclear deterrence effect under the conditions of a regional war, Russia believes it should not rely on strategic nuclear forces, or on them only, but must maintain a range of options for the limited or selective use of nuclear weapons in order to be able to inflict a precisely set level of damage to the enemy sufficient to convince him to terminate military confrontation by exposing him to the danger of further nuclear escalation . . . When introducing the concept of "nuclear de-escalation" in the late 1990s, the Russian defence establishment was obsessed with the possibility of a Kosovo-type US/NATO intervention in the war ("armed conflict") in Chechnya, which resumed in 1999. It did not exclude the possibility that, in the event of such a case, Russia would be forced to resort to nuclear weapons." In a NATO-Russian conflict, in which Russia introduced nuclear weapons, NATO would be fully capable of responding in a tit-for-tat fashion. This would be the same pattern as was seen in the NATO war games of the Cold War. Once the nuclear "firebreak" is crossed, once nuclear weapons are introduced into a military conflict in which *both sides have nuclear weapons*, there would likely be an almost inevitable escalation of conflict, a progressive use of nuclear weapons by both sides, with progressively larger targets being taken out. Peer-reviewed scientific studies predict that a war fought with hundreds or thousands of US and Russian strategic nuclear weapons would ignite nuclear firestorms over tens of thousands of square miles. These mass fires would produce between 50 million to 150 million tons of smoke, which would quickly rise above cloud level in to the stratosphere, where winds would carry it around the Earth. In a matter of weeks or months, a global stratospheric smoke layer would form, which would block up to 70% of warming sunlight, quickly producing Ice Age weather conditions in the Northern Hemisphere. The scientists predict that temperatures in the central US and Eurasia would fall below freezing every day for about three years. The smoke, the darkness, and extreme cold weather would last for ten years or longer, eliminating growing seasons, making it impossible to grow food. Most people and animals would perish from nuclear famine. Nuclear war is suicide for the human race.

at: permutation

Perm fails – NATO is fragmented amongst members

Fidler 15 -- Marshall Scholar, Department of Politics and International Relations, University of Oxford (Mailyn, Summer 2015, REGULATING THE ZERO-DAY VULNERABILITY TRADE: A PRELIMINARY ANALYSIS, http://moritzlaw.osu.edu/students/groups/is/files/2015/06/Fidler-Second-Review-Changes-Made.pdf, pg. 74) /AMarb

Moreover, despite being composed of allies, NATO faces fragmentation of member policies and opinions. NATO members sometimes have domestic political or legal constraints affecting NATO decisions, and the complicated legal ecosystem affecting NATO, made up of national law, transnational law, and international law, creates legal divergence.328 As indicated by post-Snowden wariness, NATO members do not always share consensus on what activities, particularly in cyberspace, are permissible under international law, especially when activities touch sovereignty and non-intervention issues.329 Last, in 2014, NATO has been preoccupied with the Ukrainian crisis. Even though cyber played a role in the Ukrainian crisis, the cyber threats are marginal compared to the kinetic, territorial, and political security threats posed by Russian behavior.

Empirics prove perm will only harm relations

Serafty, PhD 8 – PhD in polisci at Johns Hopkins (Simon, 2008, The pressures for a new Euro-Atlantic security strategy, Europe’s World, http://www.europesworld.org/NewEnglish/Home/Article/tabid/191/ArticleType/articleview/ArticleID/21138/Default.aspx) /AMarb

To some extent, these questions are not new. They were first raised, though in a highly different institutional and geopolitical context, over the failed Anglo-French intervention in Suez more than half a century ago. Ever since, European allies have often questioned what they see as an American tendency to misrepresent the diplomatic procedures for providing information about a decision, and to ignore the institutional processes that ensure genuine consultation beforehand. During the Cuban missile crisis, President Kennedy turned to the allies only after a careful internal review of the options he faced, so they were informed rather than consulted. That the Bush administration returned to the 1962 crisis to justify its approach to Iraq is not surprising: under what they saw as similarly existential conditions, the president and his advisors found the threat to be so high and so unpredictable as to be “imminent”. As Secretary of State Colin Powell, hardly the allies’ bête noire, put it at the time, the United States “tries to persuade others why this is the correct position. When it does not work, then we will take the position we believe is correct.”

Genuine high-level dialogue necessary to preserve relations.

Hass, President of Council on Foreign Relations, 2004 (Richard N. July President of the Council on Foreign Relations, http://www.cfr.org/publication/8049/marriage_counseling_for_america_and_europe.html) /AMarb

Americans, for their part, must accept that a strong Europe will not be content to simply do America’s bidding. The US should support European integration, because a strong Europe is at least a potential strategic partner, whereas a weak Europe is not. Indeed, the sort of troop-intensive nation-building exercises taking place in Iraq and Afghanistan are hardly unique; they are sure to be repeated, and European contributions will be required. That American troops are being withdrawn from Korea and sent to Iraq is both unfortunate and revealing. But genuine consultation will be necessary. Consultation cannot consist of simply informing others of what has already been decided, not adapting policies, and yet still expecting support. Nor can consultations on how to deal with today’s central global challenges wait until a crisis. Most importantly, the US and Europe must learn how to disagree. The best guideline is to not permit disagreements to spill over and complicate or infect the relationship. Such “compartmentalization” is as essential now as it was during the Cold War. In order to limit the consequences of disagreement, Americans should explain their position and offer alternatives when a proposed international arrangement is deemed undesirable.

politics links

1nc politics link

Plan not popular – no work can be done in congress to disclose zero days

Fidler, 15

Jun 6, 2015, Mailyn Fidler is a Marshall Scholar, Department of Politics and International Relations, University of Oxford “Regulating the Zero-day Vulnerability Trade: a Preliminary Analysis” http://moritzlaw.osu.edu/students/groups/is/files/2015/06/Fidler-Second-Review-Changes-Made.pdf

It has taken recent steps to strengthen internal checks and balances in the intelligence community, including establishing the Office of the Intelligence Community Inspector General (IG) in the Office of Director of National Intelligence (ODNI) in 2010.167 In light of the Snowden disclosures, many questioned whether congressional oversight of intelligence community (IC) activities is effective. The House attempted to prohibit the NSA’s phone records collection program in July 2013, but the bill was narrowly defeated. 168 The House approved a similar bill in 2014, but the Senate failed to secure enough votes to bring its version to a floor debate, leaving the path to legislative NSA reform highly unlikely. 169 Many proposals have been made to address this sense of failure of congressional oversight of intelligence. For instance, Fred Cate, a privacy and cybersecurity expert, suggests creating an independent agency separate from both Congress and the executive branch to provide stronger oversight. 170

Congress could impose limits on purchase, use, and disclosure of zero-days. As it has done with intelligence activities and covert actions, it could require reporting from agencies and/or Inspector Generals to relevant congressional committees when a zero-day is purchased, used, disclosed, and/or not disclosed. Such requirements could be accompanied by the threat of withheld appropriations if the executive branch fails to follow oversight rules. However, congressional oversight is likely politically difficult to achieve. Snowden has made cyber topics politically fraught, and Congress is perceived as dysfunctional. Congressional oversight has also traditionally applied to broad programs, such as foreign intelligence activities within the United States or covert operations overseas, not a specific means of accomplishing law enforcement, intelligence, or military objectives.

tpa solves ip theft

TPA will guarantee IP theft isn’t a threat.

Hendrie, 15

(June 6, 2015 “Free Trade Agreements Will Encourage Stronger Intellectual Property Rights” http://dailycaller.com/2015/06/05/free-trade-agreements-will-encourage-stronger-intellectual-property-rights/ Alexander Hendrie is an Associate at Property Rights Alliance (PRA), an advocacy group affiliated with Americans for Tax Reform.)

The U.S. House of Representatives will soon vote on Trade Promotion Authority (TPA), legislation that outlines congressional objectives and prerogatives the president must follow when negotiating trade agreements. While TPA encompasses a diverse and comprehensive range of guidelines and objectives, perhaps most importantly it is an opportunity to strengthen global protections of intellectual property (IP). TPA includes almost 150 objectives related to agriculture, investment, labor, state-owned enterprises, currency manipulation, and more. In addition, TPA contains strong oversight provisions that give Congress the final say so that any agreement is in the best interest of the American people. In regards to intellectual property, TPA will ensure that American companies receive fair and equitable market opportunities when operating overseas. The legislation requires any trade agreement to “promote adequate and effective protection of intellectual property rights” and encourages trade partners to adopt many of the strong IP protections that are found in U.S. law. Stronger IP protections will be beneficial to all economies. IP-intensive industries are defined as any business that relies on trademarks, copyrights, or patents. This includes pharmaceuticals, automobile manufactures, film and music industries, and tech firms.