Since 2010, dozens of friendly nations have engaged in a cyber-war, combining resources to help an overwhelmed country defend its infrastructure against a hostile, well-equipped and persistent adversary.

While coordinated cyber-attacks are very real occurrences, this cyber-war is a simulation designed to help military and civilian experts work together more effectively across international borders.

Known as Locked Shields, the annual exercise is organized by the NATO Cooperative Cyber Defence Centre of Excellence (CCDOE) in Tallinn, Estonia.

During the multi-day event, a “red team” representing the make-believe nation of Crimsonia launches a series of cyber-attacks against another fictional country, Berylia, while international “blue teams” come to their defence. The attacks simulate strikes against critical infrastructure, communications and other military and civilian targets. Blue teams work alone or in cooperation to defend these targets and fortify networks.

This year, Locked Shields was held May 5-8, and included approximately 4,000 participants representing 41 nations. A Canadian contingent of 11 cybersecurity professionals from the Canadian Armed Forces Cybercommand (CAFCYBERCOM), the Department of National Defence, the RCMP and several other government agencies worked in coordination with a team of experts from the Republic of Korea.

Organized by NATO, the perception of Locked Shields is that it is a military exercise, said Lt.-Col. Ben Lacey of CAFCYBERCOM and Canadian team leader. “The reality is that cyber-defence is not primarily military,” said Lacey, who spoke to Canadian Security during the competition from the Canadian-Korean team’s headquarters in Seoul. “I would argue it’s a civilian and military problem.”

Lacey, who participated in his first Locked Shields this year, said the Canadian contingent spent more than six months in preparation for the competition with their Korean counterparts. “One of the key value propositions of Locked Shields for Canada is the opportunity to work with our international partners,” he explained.

“When we think of cyber-defence, we think about a technical operator on a computer trying to defend the network. But in the context of nations and industry, we need to coordinate across communities, we need to coordinate across government officials, and really make those decisions. That’s what really adds complexity to this exercise. It’s hard to replicate almost anywhere else,” added Lacey.

On the Korean team, Sojeung Kim is a Locked Shields veteran, having participated in the last five competitions.

Kim, director of emerging security studies and senior research fellow at the Institute for National Security Strategy of the Republic of Korea, says Korea was the first nation from the Asia-Pacific region to participate in Locked Shields. The exercise is a test not only of cyber-readiness but of the capacity of international participants to work together effectively.

“There are no universally accepted international laws governing cyberspace right now. Through this exercise, we are able to compare decision-making procedures and policies with our allies and partners — and more importantly, collaborate to enhance interoperability,” said Kim. “Domestically, one of the key takeaways from Locked Shields is that cyber-defence activities involve not only technical operations but also policy and strategy viewpoints. This multi-dimensional approach offers important lessons for Koreans.”

The Locked Shields exercise demands long hours — it observes official Tallinn time (GMT +3) — and an intense workload, but the relationships built during the competition persist long after the cyber-exercise is over and team scores are tallied.

The rehearsal aspect of Locked Shields means those relationships can be quickly revived in the event of a real emergency. “It gives us a good opportunity to exchange best practices and to learn how our Korean counterparts navigate across departments,” said Lacey. “Our participation in Locked Shields underscores our commitment to national cyber-defence.”

Kim, who has worked with several other international teams at previous Locked Shields, praised the Canadians for their diligence. “With my Canadian counterparts, I am always impressed by their well-organized way of working.”

Images courtesy CAFCYBERCOM