미국-이란 전쟁, 상업적 위치 데이터로 미군 추적…국가안보 취약점 노출
Iran War Shows Adversaries Can Exploit Big Data, Too - Lawfare
이란과의 전쟁에서 상업용 위치 데이터가 악용될 수 있다는 사실이 드러나며, 미국군의 취약점이 노출되었습니다. 이는 데이터 보안에 대한 재고가 필요함을 강조하지만, 특정 종목에 대한 명확한 방향성을 제시하지는 않습니다. 따라서 중립적인 입장을 취하는 것이 적합합니다.
핵심 요약
이란이 상업용 위치 데이터를 활용해 미군 추적한 사례가 보고되며 디지털 보안 취약점이 노출됨(1건).
핵심요약
- 미국 중앙사령부(CENTCOM)가 적대국이 상업용 위치 데이터를 활용해 미군 추적한 사례를 보고받음(1건)
- 데이터는 광고 기술이나 데이터 판매 시스템을 통해 수집된 특정 모바일 기기의 위도, 경도, 식별 정보 포함
- 미국 디지털 발자취의 주요 취약점 드러남
- 결정자들이 데이터 보안 사고를 방지하기 위해 새로운 전략 수립 필요
도입
이번 기사는 국가안보와 디지털 보안의 새로운 위협을 보여주는 중요한 사례입니다. 특히 상업용 데이터를 악용해 군부대를 타겟팅한 사례는 기존의 사이버 보안 위협과 차별화된 접근 방식을 요구합니다. 투자자들은 데이터 보안 관련 기업의 성장 가능성과 함께, 국가안보와 관련된 기술 개발의 중요성을 재평가해야 할 때입니다.
데이터 악용의 새로운 위협: 상업용 데이터의 군사적 활용
상업용 위치 데이터가 군사적 목적으로 악용된 사례는 이번이 처음입니다. 이 데이터는 광고 기술이나 데이터 판매 시스템을 통해 수집되며, 위도, 경도, 식별 정보를 포함합니다. 이 같은 데이터가 적대국에 의해 활용될 경우, 군부대의 위치가 노출되어 치명적인 결과를 초래할 수 있습니다. 이는 데이터 보안의 중요성을 다시 한번 강조하며, 기업들은 더 엄격한 데이터 관리 시스템을 도입해야 할 필요성이 있습니다. 특히 데이터 수집 및 판매와 관련된 기업들은 이 같은 위협에 대한 대응 방안을 마련해야 합니다.
국가안보와 데이터 보안의 새로운 패러다임
이번 사건은 국가안보와 데이터 보안의 새로운 패러다임을 요구합니다. 지금까지는 주로 사이버 보안에 집중해 왔지만, 상업용 데이터를 악용한 새로운 위협에 대응하기 위해 더 포괄적인 접근이 필요합니다. 이는 데이터 보안 관련 기업들의 성장 가능성을 높일 수 있는 기회로 작용할 수 있습니다. 또한, 정부와 기업 간의 협력이 강화되어 데이터 보안 표준이 마련되어야 할 것입니다. 이는 장기적으로 데이터 보안 시장의 확대에 기여할 수 있을 것입니다.
결론
이번 사건은 상업용 데이터를 악용한 새로운 위협의 등장으로, 데이터 보안의 중요성이 다시 한번 강조되었습니다. 투자자들은 데이터 보안 관련 기업들의 성장 가능성과 함께, 국가안보와 관련된 기술 개발의 중요성을 재평가해야 할 때입니다. 또한, 정부는 더 엄격한 데이터 관리 시스템을 도입하고, 기업들은 이 같은 위협에 대한 대응 방안을 마련해야 할 것입니다. 이는 장기적으로 데이터 보안 시장의 확대에 기여할 수 있을 것입니다.
Original Article
Iran War Shows Adversaries Can Exploit Big Data, Too - Lawfare
As the war between the United States and Iran reaches a ceasefire, U.S. Central Command (CENTCOM) has received reports of an alarming activity, the first known of its kind: a U.S. adversary using commercial location data to track and target U.S. forces in the Middle East. This likely refers to data on the latitude, longitude, and identifiers of a specific mobile device, obtained via advertising technology, data-selling, or other systems. It is far more than an isolated incident in one region. An adversary, likely Iran, using commercial location data in this fashion—tapping into the sea of commercial data to enable military or intelligence operations—spotlights a major vulnerability in the United States’ digital footprint.
Some in the U.S. government may view the availability of open-source and commercial data as wholly advantageous to U.S. national security, thinking only about how open data could be used for U.S. missions. But the Iran war has exposed just how easily U.S. foreign adversaries can access much of the same data for their own ends—including tracking and targeting military service members. Decision-makers must overhaul their data security thinking to plug current gaps and mitigate these risks in future security and warfare.
Open-source information has absolutely exploded online in the past few decades. This data, accessible without a paywall to anyone with an internet connection, spans websites, public-facing social media sites, free commercial satellite imagery platforms, and even artificial intelligence (AI) models that let users query them, for free, without an account. Some open information sources are global in reach and coverage, such as Meta’s Facebook or Google’s free Google Earth. Other sources are more region specific, such as the social media platforms VK in Russia and Weibo in China (even though their “open” nature is variable if you are not within the country in question).
Beyond what anyone with an internet connection can view, thousands of data brokers operate businesses focused on collecting, inferring, packaging, and selling people’s data. The data broker industry collectively aggregates and sells information about people’s marital status, religious beliefs, sexual orientation, income, debts, health conditions, prescriptions, medical procedures, IP addresses, devices used, travels, and even real-time GPS locations from smartphones. Some data brokers sell thousands of data points on a single person, often with horrendously weak background checks and vetting—almost always without any semblance of consumer consent. Bad actors can outright or deceptively purchase this data.
The Iran war has further exposed how naive it would be to assume that only the U.S. government can leverage this open and commercial data explosion for military and other ends.
Before the recent allegations about Iran came to light, private-sector firms in China were exploiting this current state of affairs on the open-source information side. As the U.S. struck Iran in March and the war erupted, a number of Chinese companies, including some with ties to China’s People’s Liberation Army, began marketing capabilities purporting to “expose” U.S. military movements in the Middle East. For example, as the Washington Post described it , the firm MizarVision uses “a mix of Western and Chinese data filtered through AI to catalogue activity at U.S. bases in the Middle East, track naval movements, and identify the position and number of specific aircraft and missile defense systems.” This represented the fusion of AI technologies, open-source information, and privately marketed analysis into a capability that China’s military could ostensibly use—including, if it wanted, to share insights with other adversarial governments.
More recently, a bipartisan letter from two senators publicized reports to CENTCOM about the adversarial use of commercial location data in the Middle East. CENTCOM said it “has received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil US personnel in theater.” While CENTCOM did not name the country, it is fair to assume it is probably Iran, because it is the one involved in the war, and if not, then China or Russia, because they are technologically sophisticated and interested in the war. Calling the location data “commercial,” though, clearly refers to the exploitation of U.S.-related data that could be transmitted through advertising technology systems, sold by data brokers, and more.
To better protect their personnel and missions in future conflicts and intelligence activity, Western military, intelligence, and national security decision-makers must address three pressing shifts in big data: the interplay of privacy and security, adversaries’ comparative advantages in exploiting big data, and how data exposure can shape security planning.
The first shift centers the privacy-national security intersection. Gaps in consumer privacy laws, including those left in for national security reasons, can backfire on governments and become national security threats. For example, many countries, even in Europe, have failed to strongly regulate data brokers trafficking in people’s data (which can itself then impact U.S. national security, too). Such a failure enhances the targeting risk that a U.S. adversary (again, ostensibly Iran) allegedly demonstrated against U.S. forces. More data can be collected, inferred, bought, and sold about populations, locations, and activities, including those in the national security sphere. When the commercial data ecosystem is so expansive and porous, engaged in so many data sales every single day, it is even easier for adversaries to slip in under the radar.
Second, U.S. decision-makers must recognize that the actors who can do the most national security damage with open and commercial data are sophisticated foreign adversaries. Having access to open-source information and commercial data is one thing. But having the money and data storage to acquire it, computing power to process it, knowledge to contextualize it, and rigorous analytical processes to turn it into decision-enabling intelligence—that is an entirely different animal.
In this data-pervasive world, organizations with advanced military and intelligence capabilities, such as Iran, China, Russia, and the like, are best positioned to acquire, process, and use open and commercial data to recruit Western spies, analyze Western government facilities, profile key decision-makers, and even track and target armed forces. Policies to reduce open-source data exposure, restrict data brokers’ data sales, and limit data collection at the source will fail in the national security arena if the main and only threat actors in mind are ill-intentioned hobbyists or meandering cybercriminals. Systemic risk mitigations for the open and commercial data explosion must focus on sophisticated nation-states, too, and their persistent interests in government personnel, locations, and activities.
Third, the United States will need to account for this reality in any future strategic or operational planning. Cybersecurity experts, counterintelligence professionals, and war planners cannot assume that the adversary only has access to data and information it has hacked (as prolific as its hacking may be). Indeed, MizarVision in China said it “quickly identified” the locations of U.S. equipment and weapons in the lead-up to the war as well as U.S. carrier groups’ refueling patterns. Understanding what governments in Iran, China, and Russia, among others, can know about U.S. military deployments, security experts, or government facilities through open-source information and commercial data will be vital to developing mitigations. It will also be essential for the United States (and its key allies and partners) to not botch a covert or surprise action.
Even if the U.S.-Iran war has reached a ceasefire for now, the connection between data privacy and national security—even operational security for deployed military personnel—persists. Any future military action will feel its impact. What matters now is whether U.S. decision-makers will act to plug the many gaps that still threaten national security.