Comment by rickdeckard
5 days ago
I don't know why it should be the governments job to secure private properties of corporations against vandalism/arson. It sounds much more absurd to me.
Starlink providing services to a customer (which made them a target in this case) is not a matter the local government of that site needs to protect them against.
--> Is it a local governments' job to secure the local properties of e.g. Lockheed, or the job of Lockheed as a for-profit supplier to the military?
--
Edit, as I expected this to be much more widely known: If you are operating in the business of critical infrastructure (for which Starlink qualifies, explicitly "digital infrastructure"), you have obligations to protect your facilities against physical and cyber attacks and have resilience and business continuity processes in place.
If you decide to operate in a business segment for critical infrastructure, it is not the governments job to secure your business, YOU have to comply to the requirements of operating in this field, and the government can audit and shut down your business if you're not in compliance.
In the EU, where this incident took place, this is well-defined under the CER-directive, and further extended for IT under NIS2 and CRE.
In the US, it's covered by CISA and CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)
It's absolutely the role of the security agencies to protect against foreign attack. Are Oil tankers and Cargo ships supposed to have air defense? What about the World Trade Centers? Otherwise there is no purpose to having a military if you won't defend your sovereignty.
That doesn't absolve the orgs responsibility, but the questions should be directed at both.
I'm certain there will be investigations from the government, not only due to the suspicion of a foreign state attack but also on the grounds of Starlink not sufficiently securing their premises.
It's not the responsibility of security agencies to prevent two guys from entering the premises of a critical infrastructure provider with gasoline.
They may have prior intelligence to act on this, but it is the operator of that facility who has the responsibility to ensure a certain level of security and resilience of his own premises, and this is strictly defined.
-
> "Are Oil tankers and Cargo ships supposed to have air defense?"
No, this would turn a civilian into a combatant ship, causing it to lose the civilian protections of the UN (The Ocean is governed by conventions of the United Nations, it's a different jurisdiction)
And still, oil tankers and cargo ships have requirements to secure themselves against piracy, terrorism and even warfare, mandated by the international maritime organization.
>I don't know why it should be the governments job to secure private properties of corporations against vandalism/arson.
because this isn't 'vandalism', this is an act of war by a foreign adversary that is now happening on European and NATO soil on a daily basis, and instead of responding accordingly we talk about this as if a drunk kid laid a fire somewhere
> "because this isn't 'vandalism', this is an act of war by a foreign adversary that is now happening on European and NATO soil on a daily basis"
Agree, the government should step in and (finally!!) take actions against those foreign adversaries.
But this doesn't change the fact that it is not the governments role to protect the facilities of a infrastructure provider against sabotage (or even acts of terror), a company providing such services in the EU has to comply to the CER directive and secure its operations.
There is a very basic reason for that: I could undercut every provider on the market by not investing in security and resilience. while everything works well I will beat all my established competitors and gain a significant share of the market.
This creates a risk of critical infrastructure stability for the citizens of that country. So if inevitable issues in resilience arise.....I demand the government to step in and take over my operations...?
It's the government's job to protect both individuals and corporations against foreign attack. It's even the government's job to protect against crime.
> "It's even the government's job to protect against crime"
It's the government's job to protect against crime, but the duty of an individual to take proactive measures against becoming a victim of crime ("Individual Responsibility").
--> They won't put a policeman in front of my house just because I decided to not have a door on my house.
-
Equally, (and MUCH more explicitly), it's the legal duty of corporations to protect themsselves against crime, especially if they provide critical infrastructure.
--> They won't put police all over my facilities just because I didn't invest in access-control.
--> In this case, I am not in compliance with the law and considered to invite(!) crime
It's both/and, not either/or. Yes, I have individual responsibility to have a door on my house, and to be careful about walking in sketchy places. And the government has a responsibility to combat crime. Both.
A critical infrastructure company has an obligation to keep their facilities secure. And the government has a responsibility to prevent attacks by foreign actors on critical infrastructure.
1 reply →
This is not how this works, corporations are not people.
As a provider for digital infrastructure, Starlink is required to comply with the EU Critical Entities Resilience (CER) Directive, which mandates strict physical and digital security as well as business continuity in case of crisis.
The nature of this incident indicates a security issue on the site of Starlink, which is their duty, not the governments.
They may have not been in compliance with this directive, which puts local infrastructure and citizens and risk.
Because internet is a major resource for the population. Its like water or electricity.
Most of those could be easily targeted and taken out by a large organized group but people are generally good and dont do that. If a country's military attacked though you wouldn't blame the water company for someone cutting the locks and destroying the water pumps. Or blowing up an electric facility.
Its not like this is just some random companies headquarters where they have some vehicles and someone broke the gates to spray paint the trucks.
This is an attack on the people of the country as a whole. The attackers are not vandalizing the internet because they dislike starlink they are attacking its people by destroying infrastructure. there is a major difference between the two.
> "Because internet is a major resource for the population. Its like water or electricity."
Yep, the EU classifies this as "critical infrastructure". Operators of such services (including water, electricity and digital infrastructure) have to comply to the highest level of the EU CER-directive for Physical and Cyber Security. This includes physical shielding, strict access controls and resilience against physical sabotage/terrorism as well as natural disasters or severe climate changes
I agree that the government should step up on against the military adversary on a country/regional level, but even then it is not their job to step in and do the job of Starlink as a provider of critical digital infrastructure.
A player in these markets has an obligation to secure his own facilities, otherwise every new market-entrant can undercut all competitors by not investing in security at all, until it's big enough to become a national risk and the government steps in to secure its business.
How is a tax-paying corporation different from a tax-paying person?
It's in the core interest of any government to protect its citizens, including corporate ones.
Both need to act in compliance with local laws and mandates, it's not the job of the government to fill the gaps.
Corporations have more duties of different scale than individuals.
Starlink is a provider of Digital Infrastructure, and is already classified as "Essential Entity" under the EU CER-directive.
As such, it needs to comply with so-called "Physical-Cyber Convergence Requirements", which entails
1. Perimeter and Access Defense
2. All-Hazards Mitigation: Designing infrastructure to resist natural disasters, severe climate changes, or physical sabotage/terrorism.
3. Vetted Personnel: Utilizing mandatory background checks and security clearances for operators working in sensitive zones
Not much is known about this incident at this stage, and I'm sure the government will conduct own investigations. But regardless of the outcome, it will be the duty of Starlink to secure its facilities.
> citizens, including corporate ones
Does any modern body of law consider corporations citizens? They’re national persons. But that’s a separate concept.
Depends on the infra, and the level of anxiety generally and specifically.
Petty vandalism no, but I’ve worked at a few and know more completely non-military business premises that absolutely have “military barricade” or the like quietly in their contingency plans.
Funny thing is, a bit of arson is kind of normal on their estates. But usually it’s just stolen cars.
The EU already classifies digital services like those provided by Starlink as "critical infrastructure".
Operators of such services have to comply to the highest level of the EU CER-directive for Physical and Cyber Security. This includes physical shielding, strict access controls and resilience against physical sabotage/terrorism as well as natural disasters or severe climate changes. This is the duty of every player in this business.
The government has a job to stand up against a potential adversary of the country (be it other countries or local terrorists), and in case of an attack on critical infrastructure the government will also step in to protect it, I agree on that.
But it doesn't have the job to take over Starlink's (or whoever's) business operations and make it secure. That is the job of the company, long before it even appears on any map of a potential adversary...