Conflict, peace and security practice questions.

The Convention on Cybercrime, opened for signature by the Council of Europe in Budapest in 2001, obliges parties to preserve and share electronic evidence on request. Which is a genuine limitation of the convention for investigators?

• It applies only to operations carried out by a state's armed forces.
• It covers only offences committed against government-owned systems.
• The servers holding the evidence may sit in a state that is not a party.
• It requires the consent of the suspect before any data may be preserved.

Answer: The servers holding the evidence may sit in a state that is not a party.

The convention is a cooperation instrument that binds only its parties, so evidence held on servers in a non-party state lies outside its reach. It is not confined to armed forces or to government-owned systems, and it does not require the suspect's consent to preserve data.

Electronic warfare units jam satellite navigation signals across a conflict area, and the interference extends well beyond the front line. Which stakeholder bears a cost of the jamming while taking no part in the conflict?

• The units operating the jamming equipment on the ground.
• The forces whose guided munitions the jamming is meant to defeat.
• The commanders who authorised the jamming of the area.
• Civil airliners and fishing vessels navigating near the area.

Answer: Civil airliners and fishing vessels navigating near the area.

Interference is not aimed at a single receiver, and civil aviation and shipping depend on the same signals without being able to opt out. Stakeholder analysis in a conflict has to include those who neither operate nor target a system yet carry part of its cost.

Investigators find comments in one language inside a malware sample and note that the operators were active during that country's working hours, and conclude that the state in question directed the operation. Which weakness in that reasoning is most serious?

• Both indicators can be copied or staged by another actor to mislead analysts.
• Malware may lawfully be analysed only by the state whose systems were attacked.
• Working hours cannot be established because servers record time in UTC.
• A state's official working hours are not published and cannot be compared.

Answer: Both indicators can be copied or staged by another actor to mislead analysts.

Language and timing are cheap to imitate and are known to be planted, which is why attribution is argued from many weak indicators at once and stated with a confidence level rather than as a fact. The difficulty is structural, not a shortage of evidence.

The same intrusion product, sold by a private vendor to government agencies, is deployed in one country only on a judge's warrant in serious crime cases and in another against journalists and their relatives. Which contextual condition best explains the difference in outcome?

• Whether the vendor is based in the same country as the purchasing agency.
• Whether an independent authority must approve each deployment and can review it.
• Whether the software is installed on a phone or on a laptop.
• Whether the targets' devices run the most recent operating system version.

Answer: Whether an independent authority must approve each deployment and can review it.

The capability is identical in both cases; what differs is the authorisation and review around it. Reporting on commercial spyware since 2021 has turned on that condition rather than on any technical property of the product.

Intrusion and network surveillance products can serve policing, corporate security and military purposes alike, which is why export control regimes place them on lists of ___ goods. (two words)

Answer: dual use

The label matters because it moves a product from ordinary trade into a licensing regime in which a government decides which buyers may receive it, which is the main lever states hold over the surveillance industry. The trade-off is that the same controls also restrict security researchers who share tools across borders.

Malware that destroys files outright, instead of encrypting them and offering a key in exchange for payment, is classified as a ___. (one word)

Answer: wiper

The distinction decides what a victim can do: with encryption there is at least the possibility of recovery, whereas destruction leaves only backups, so the operation aims at denial rather than at profit. Attackers frequently disguise the second as the first, which delays the response of the organisation attacked.