Cyberattacks against TV5

In the night between April 8 and 9, 2015, TV5 was the target of a large cyberattack.  The channel's emitting capacity was impaired for several hours, and its websites, Facebook and Twitter accounts were also targeted.  The attack is signed by agents claiming affiliation to the Islamic State.  This event, which will necessarily receive wide media coverage, given the nature of the target, calls for several immediate comments.

• The number of cyberattacks hitting various targets in the world has not stopped growing the past decades.  The network implantation accelerated at the turn of the 90s, as society becomes more and more interconnected, computerized and dependant on these systems.  Computerization of our societies has opened breaches hackers haven't stopped using.  The attack suffered by the TV5 channel is therefore surprising, no doubt by its amplitude, its effects, but isn't so much when taken within its context.  Potentially, any connected and computerized system is exposed to such actions. 

• Is it a first? No. Many media have suffered these past few months cyberattacks, claimed by Cyber Caliphate, pro-ISIS hacker groups (Fox, CBS, Newsweek).

• Cyberattacks are rarely improvised.  To attack a system, it must be tested, assayed, and such an attack requires preparation.  Unless all of TV5's systems were so fragile that a lucky find opened all the gates.  If the operation was prepared, it may have included a discrete and undetected intrusion beforehand.  The technical investigation will establish whether the hackers left traces and if these traces can talk, provide sufficient clues to ascertain the modus operandi, or even the authors of the attacks.

• Facing a cyberattack, the stakes are always the same:

• To whom will the attack be attributed, how will the authors be identified?  Claims and messages posted on hacked websites point towards the Islamic State.  But this isn't enough : where did the authors operate from?  Who are they really?  Are these sympathisers, or are we outright dealing with the Islamic State?This phase of the investigation is no doubt the most difficult, because cyberspace allows for track covering, and trace dissimulation.  Several hypotheses will be looked into : did the hackers act from abroad?  From France?  Should the assailants be sought outside the company?  Did they extensively prepare their operation, did they leave traces, clues?
• How will we act, or react?  This is a terrorist act (defined as any action  linked to a terrorist movement): which response is appropriate?
• Which breaches were used by the assailants?  Are there others?  Could the assailants repeat the feat against other media, other companies?  If TV5 was hit, how do we ensure other media aren't hit in hours, days or weeks to come?

• "Cyber" is part of societies, therefore it is also part of conflicts, and a key part at that.  No doubt has the public been made more aware of this with the media coverage given to the Islamic State on social media (execution footage, namely, but also calls for djihad and recruitment).  The phenomenon was broadly visible when thousands of French websites were hacked the day after the Paris terrorist attacks.  But cyberterrorism, agressive cyber-operations, cyberspace exploitation by terrorists, belligerants and fighters, also extends to operations capable of paralysing systems.  Potentially, the number of targets is infinite.  In this case, media were hit, and the action was engineered to carry a message.  But it can be expected that other types of systems, industrial and critical, may be targeted later on.

• In cyberspace, adversaries are the same as in the tangible world.  We are not dealing with two worlds, two disconnected spaces, with each their realities, logics, balances and strength ratios.