Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve

51
About the Information Warfare Monitor
http://infowar-monitor.net/
The Information Warfare Monitor is an advanced research activity tracking the emergence of cyberspace
as a strategic domain. We are an independent research effort. Our mission is to build and broaden the
evidence base available to scholars, policymakers, and others. We aim to educate and inform.
The Information Warfare Monitor is a public-private venture between two Canadian institutions: The
SecDev Group, an operational think tank based in Ottawa (Canada), and the Citizen Lab at the Munk
Centre for International Studies, University of Toronto. The Principal Investigators and
co-founders of the Information Warfare Monitor are Rafal Rohozinski (The SecDev Group) and
Ronald Deibert (Citizen Lab).
The Information Warfare Monitor is supported by The SecDev Group which conducts field-based
investigations and data gathering. Our advanced research and analysis facilities are located at the
Citizen Lab. IWM is part of the Citizen Lab’s network of advanced research projects, which include the
OpenNet Initiative and ONI Asia.
The Information Warfare Monitor also benefits from donations from a variety of sponsors including
Psiphon Inc, and Palantir Technologies.
The Information Warfare Monitor engages in three primary activities:
1. Case Studies. We design and carry out active case study research. These are self-generated
activities consistent with our mission.
We employ a rigorous and multidisciplinary approach to all our case studies blending qualitative, technical,
and quantitative methods. As a general rule, our investigations consist of at least two components:
Field-based investigations. We engage in qualitative research among affected
target audiences and employ techniques that include interviews, long-term in situ
interaction with our partners, and extensive technical data collection involving
system monitoring, network reconnaissance, and interrogation. Our field-based teams
are supported by senior analysts and regional specialists, including social scientists,
computer security professionals, policy experts, and linguists, who provide additional
contextual support and substantive back-up.
Technical scouting and laboratory analysis. Data collected in the field is rigorously
analysed using a variety of advanced data fusion and visualization methods. Leads
developed on the basis of infield activities are pursued through “technical scouting,”
including computer network investigations, and the resulting data and analysis
is shared with our infield teams and partners for verification and for generating
additional entry points for follow-on investigations.