The February 2015 issue (.pdf, in Dutch) of the Dutch government magazine “Nationale Veiligheid en Crisisbeheersing” contains an article about the Joint Sigint Cyber Unit (JSCU). Here is a translation of that article (hyperlinks are mine):

Mid 2014, the Joint Sigint Cyber Unit (JSCU) of the General Intelligence & Security Service (AIVD) and the Military Intelligence & Security Service (MIVD) was officially launched. Through the establishment of the JSCU, the two Dutch intelligence & security services bundle their activities concerning Signals Intelligence (Sigint) and Cyber. Sigint is the collection and processing of intelligence from telecommunications, and Cyber concerns intelligence and security in relation to computer networks. Both fields are, as a consequence of rapid developments in digital information and communication, an increasingly important part of the work of intelligence and security services. Although the AIVD and MIVD both independently have experience in both Sigint and Cyber, the establishment of a joint unit is the only logical step. The increasing threats, the large overlap between Sigint and Cyber, the necessary and high costs of innovation, and the effective use of scarce public means (funding and personnel) necessitate a joint approach by the AIVD and MIVD.

Far-reaching forms of cooperation are typical for the way in which intelligence & security services operate in the current era. During a joint AIVD/MIVD meeting on December 15th 2014, entitled “Beyond cyberhype, partnership in a new reality”, Rob Bertholee, head of the AIVD, expressed the urgency of cooperation as follows: “The continuous technologization and internationalization of our society make threats more diffuse and unpredictable. Combined with the acceleration that ‘cyber’ provides to these developments, the impact of (cyber) threats only increases. The paradox is that an increasing amount of information is making it significantly more complex to identify (yet unknown) threats. Partnerships and other innovative forms of cooperation are the only answer for intelligence & security services to this new reality. Partnerships are not ‘nice to have’, but ‘need to have’.

The JSCU partnership of the AIVD and MIVD is not by itself. Rather, it is the next example in a series of innovative forms of cooperation that both services entered in recent years. Not only with each other, but increasingly often with third parties. A good example is the National Detection Network (NDN). In the NDN, the AIVD and MIVD closely cooperate with, among others, the National Coordinator for Security and Counterterrorism (NCTV), with organizations responsible for critical infrastructure in the Netherlands, and with IT service providers. Together, the NDN partners coordinate the knowledge and efforts to prevent, fight, and learn from cyber threats.

Another example of network-oriented cooperation is the cyber cooperation between the AIVD, MIVD, the National Cyber Security Center (NCSC) and the National Police. Under the working title “Cat5” the partners initiated a pilot for sharing technical and operational information for detecting digital attacks and digital attackers. This way, cyber damage can be prevented at an early stage. Furthermore, the partners make joint analyses to learn from existing casuistry.

[image also available as 1.6MB .pdf here]

An important benefit of the AIVD and MIVD is the exclusive international cooperation between intelligence & security services world-wide. The information that the AIVD and MIVD receive from partner networks, can be used in cooperations such as the NDN or CAT5. Think for instance of secret technical characteristics of a (possible) cyber attack that the AIVD or MIVD obtain via colleagues from the country that was hit by the attack, or that has been able to prevent it. After removal of sources and methods, other participants in the NDN or CAT5 can use these technical characteristics in their advantage to protect Dutch interests against a possible similar cyber attack. The employees of the JSCU are the primary contact on behalf of the Dutch intelligence & security services for anything related to Sigint and Cyber. They thus have an important role in the (national and international) cooperation networks.

During the “Beyond the cyberhype” meeting, Marc Brinkman, head of the JSCU, described the role of the JSCU as follows: “The JSCU provides the AIVD and MIVD insight in known and unknown threats using Sigint and Cyber data traffic. We are continuously looking for the missing insight that contributes to sufficient security. For the question that would be asked the day after tomorrow. We are aware that the day after tomorrow may be the day that a 15-year old builds something that we cannot counter”. According to Brinkman, this role motives his people to go the extra mile. Brinkman: “Our task requires continuous change and cooperation, also with parties that are perhaps not obvious.”

Based on their own experiences, the AIVD and MIVD know that a partnership is more that “just” cooperate. Within the JSCU, the partnership consists of using each others scarce means, sharing the use of these means, providing access (within the legal framework) to each other’s systems, data and relation networks, and joint decision-making on Sigint and Cyber investments on the basis of a jointly developed vision for the future. Success factors that are recognized by both services include mutual understanding, self-awareness about knowledge and expertise, recognition of knowledge and expertise of the other, willingness to cooperate in teams, and taking into account each other’s emotions and interests.

To illustrate these reflections on future-oriented cooperation, Pieter Bindt, head of the MIVD, wrapped up said meeting with the following words: “The cooperation that the AIVD and MIVD show in the JSCU, is bundled force that yields more than the sum of its parts. We make daily progress in our cooperation, but the formation of the JSCU is a leap. I therefore look forward to the next possible leap: when our services, in a few years, will possible cohabit and work from one location. Imagine what that means for the security of the Netherlands. Together we will be able to cope far more effectively with the increasing and complex threats we face.

[image also available as 0.5MB .pdf here]

Related:

• 2015-02-26: “Cyberspace offers huge opportunities” — interview with general and professor Paul Ducheine in Dutch MoD magazine Pijler
• 2015-02-23: Dutch Defense Cyber Strategy — Revised February 2015
• 2015-02-11: Highlights of Dutch parliamentary debate about upcoming bulk interception bill
• 2015-02-26: [Dutch] Convenant tussen AIVD, MIVD, NCTV, Politie en OM inzake de pilot versterkte samenwerking CAT-5 (Jan 2015)
• 2014-07-03: June 15th 2014: Dutch Joint Sigint Cyber Unit (JSCU) officially started
• 2013-09-25: Project Symbolon completed: the Dutch Joint SIGINT Cyber Unit (JSCU) is born

EOF