68 comments

[ 0.15 ms ] story [ 139 ms ] thread
This is a strange title. Why did they use the word 'citizens' rather than just 'people'? Does it imply something important? As opposed to what else? Foreign mercenaries of some kind? Or was it mistranslated and it's actually 'civilians' and the news is they're using non-military personnel for this?

And isn't this a really small appointment? Is the story actually that the MoD has created a cyber reserve force? It's a very small one if it's just a company's worth of people.

They’re loosening the physical fitness requirements for cyber-reservists who will never be sent out on a mission.

Idea is that that will make it easier to find such reservists. That seems to be the case.

(comment deleted)
Not every person in Netherlands is a citizen? Many only have allowances, I'm pretty sure they mean owners of citizenship
> I'm pretty sure they mean owners of citizenship

I know what the word 'citizen' means. I was saying I think it's the wrong word because it's redundant. Of course they're hiring citizens - almost no military recruits anything else (except for commonwealth issues).

(comment deleted)
The US Armed Forces allow enlisting as a permanent resident: https://www.usa.gov/join-military

There are quite a few exceptions to "militaries don't recruit non-citizens": https://en.wikipedia.org/wiki/List_of_militaries_that_recrui...

Most relevant to the case at hand, a number of EU countries allow EU citizens to serve in their militaries: Belgium, Denmark, Ireland and Luxembourg

But I mean it’s not what the story is about - the story is about them being a new class of non-deployable soldiers - them being citizens or not is unchanged and orthogonal. So why’s it in the title as if it’s party of what’s newsworthy?
Deplorable? Deployable maybe?
Is that true? According to this, in the US at least, "Roughly 35,000 non-citizens are serving in active duty military and about 8,000 join each year."[1] The US government also deports some of its honorably discharged veterans.[2]

[1] https://www.military.com/join-armed-forces/eligibility-requi...

[2] https://www.militarytimes.com/news/your-military/2019/06/12/...

Yes the US and UK are notable examples of exceptions. But in most countries it’s the case.
That list includes, US, UK, France, Russia, Australia, New Zealand, and Israel. Further, many EU countries accept EU citizenship rather than limit things to their own countries citizens.

So, it’s reasonably common among western countries.

https://en.m.wikipedia.org/wiki/List_of_militaries_that_recr...

It’s common across big countries. Lot of that list contains things like from specific area only.

Rare amongst smaller countries. For me it sounds odd to serve in a military without citizenship. Finland even allows some men to skip the conscription if they do not live in Finland and have dual citizenship.

You cannot just be resident in the Netherlands; you need to be a citizen. The whole point here is that you get to work 'in the army' while you do not have to be physically fit to do so, so basically any citizen (but not residents) with relevant knowledge & experience can apply for some of these positions (the ones that are non combat and do not require physical training or fitness).
(comment deleted)
What if I'm Romanian and move permanently to the Netherlands with my job, family, house, etc, as I can under UE law?

I would be a resident, but not a citizen, correct?

Correct. for a quick run-down of Dutch immigration law see: https://www.iamexpat.nl/expat-info/dutch-expat-news/how-beco...

I suspect op refers to a requirement to be a citizen to join the military, but can't be sure.

The terminology was specific mentioning 'citizen' which is because you cannot join any of the state security positions, including military, if you are not a citizen but 'only resident'. The letter written by the secretary of defence notes specifically that they are looking for people in the corporate world to join but that these people must be citizens.
Dank je wel voor de verklaaring! (gosh my dutch is rusty!)
No you need to be a Dutch national (as in having, or being able to claim a Dutch passport), it's the same with Romanian army, you have to be Romanian to join.

EU Law doesn't prevent EU members from discriminating against EU Nationals unless it explicitly discriminates against them, for example you can't disallow specific employment under the freedom of movement if it's allowed under a non-EU work visa (there are few exemptions when it comes nationals of "EU" territories which have various ties to specific EU member states and may or maynot be EU nationals on their own right), if you look at national level government employment as a whole across the EU they either limit employment of EU nationals (sometimes with caveats such as unless they lived in the host nation for a certain period of time) or set quotas on how many EU nationals you can employ in any given agency or institution.

This is because many government institutions and agencies while not being elected officials do affect and even set policy all the time. The EU "officially" isn't set to supercede national sovereignty of its member states so it's not really surprising why France might not want the majority of its foreign service employees to be German or why Germany might not want a bunch of Polish prosecutors and judges mucking with its legal system.

Also don't forget that being an EU national while grants you the right to vote in another member state, you are only allowed to vote for the EU elections in that state. Whether member states allow EU nationals to vote in local, or general elections is up to the individual member state, most of them disallow it, the same thing goes for running for office in some places you can run for local elections but even in those nations many of the party bylaws disallow foreign membership so you have to run as an independant.

https://en.wikipedia.org/wiki/List_of_militaries_that_recrui...

I think the OP meant civilians
(comment deleted)
Civilians is a closer translation. Civilians can't normally participate in Dutch military and defense programs. This pilot seeks to change that and set up a reserve force to enhance existing security expertise from the Dutch military and police forces.

Here's the full translated text from the docx:

~~~

During the General Personnel Consultation on 11 September this year, I undertook to inform your House of Representatives about the cyber reservists pilot in which the selection process deviates from the physical requirements that apply regularly for appointment as a soldier. I will discuss the principles that apply, the appointment process and the first results.

Starting points for different requirements

The Ministry of Defense is increasingly in need of cyber professionals: civilian employees, professional soldiers and reservists. Under the humanitarian law of war (HOR) only soldiers are allowed to participate in the fight. In or from the Netherlands only soldiers and the police have powers of violence. The use of civilian employees for performing acts of violence is not permitted; professional soldiers or reservists are required for this. A number of cyber activities also fall under the practice of acts of violence.

To be able to recruit more cyber reserves, the cyber reserves pilot was launched on 6 November 2018. The Defense organization organizes so-called Matching Days (M-Days) several times a year with the aim of identifying suitable cyber reservists. In addition, candidates are approached who must be (partially) exempted from certain physical and medical requirements as included in the CDS instruction "Preparation of individual soldiers". These are the candidates who are ultimately classified in the category "not broadcastable, but employable."

Appointment process

The Ministry of Defense organizes the above-mentioned M-days about nine times a year. Candidates for these days are largely recruited via the cyber professionals' own network. The Defense organization is also actively seeking contact with the business community for potential candidates. When a candidate shows an interest, a short matching procedure is started based on his or her Curriculum Vitae (CV). As soon as there is interest in the candidate from the Ministry of Defense, he is asked to fill in an (online) personality questionnaire and to take a cyber substantive test prior to the M-day. The candidate is then invited for an M-day.

During this day, applicants are selected for a position as a cyber reservist based on various tests, (group) assignments and interviews. A maximum of fifteen candidates are present per M-day, of which ten were able to continue the appointment process last year. Applicants who, after an M-day, do not appear to have the required competencies and therefore do not qualify for a position as a cyber reservist, can, if they wish, follow the regular appointment, selection and testing process for other (reserve) positions.

Applicants for whom it has been established on M-day that they have sufficient potential for a cyber reserve position, are offered the choice between the regular appointment process or the deviating process. If they opt for the latter, they will be appointed as a non-transferable reservist without a further medical or sporting examination, after issuing a Declaration of No Objection (VGB). Applicants who opt for the regular procedure go through the inspection process at the Personnel Logistics Service Center (DCPL) in two days. In the event of a positive result of these tests, these applicants are appointed, after issuing a VGB, as a reservist without restrictions on deployment. Applicants who drop out during this follow-up process can still be appointed as a non-broadcast cyber reservist.

First results

The pilot has been running for almost a year and the first results are positive. At the start of the pilot, the Ministry of Defense had thirty cyber reserves. In the meantime, 72 have actually been appointed (of which nine with the special form of appoint...

It might be because for highly sensitive security roles, each government usually only allows citizens to participate, as opposed to resident immigrants that where not born in that country.
(comment deleted)
(comment deleted)
Service guarantees citizenship.

Would you like to know more?

There are no dangerous weapons; there are only dangerous men.
Men with weapons are more dangerous than men without therefore weapons are dangerous.
It's a quote by Robert Heinlein from Starship Troopers (https://www.goodreads.com/quotes/141333-there-are-no-dangero...). I don't agree with your reasoning either by the way.

Men with pencils are more dangerous than men without therefore pencils are dangerous.

When wielded properly pencils are indeed dangerous, even more dangerous than swords in some cases. But less dangerous - in the general case - than say a gun or a knife which is why we call those weapons in the first place.

Note that according to the definition of a weapon ("a thing designed or used for inflicting bodily harm or physical damage") a pencil can be classed as a weapon due to its use. Which is a perfect illustration of why men with pencils (used as weapons) are more dangerous than men without.

So thank you for making my point.

I think you actually made mine which was that anything can be classed as a weapon therefore the object in question isn't as relevant as the person wielding it. Yes, you can put them on a continuum, but I'd still rather not be in an elevator with a person intent on doing me harm regardless of the object they are holding.

"There are no dangerous weapons; there are only dangerous men."

Security Clearances
Don't know about the Dutch military, but the vast majority of US soldiers don't have any kind of security clearance, just a background check.
Basic Squaddies maybe but these are senior NCO and Officer level roles which do require Security clearance.
Because if it just said 'people', someone else would ask, "are they allowing _anyone_ from _any country_ to join, or residents, or citizens?"

You're assuming that the wording of 'people' should be obvious, and other people will find it non-obvious. They just picked one.

Yeah, the correct term is civilian or more commonly known as civvy. Error, in translation? Or they may need to be a Dutch citizen for security clearance, which would make sense.

It does sound similar to the UK's version, and I'm sure most countries have some sort of cyber division by now. Plus there's suppliers and consultants, like traditional forensics and computer forensics/ data retrieval e.g.

I think a clearer title would be "Dutch pilot project waves military physical requirements for cyber-military roles in reserve force" Whether the aspirant reservists are citizens is not relevant to the article and the moment they join the reserve force they would not be civilians anymore.
Thank you. The title alone made me wonder if they perhaps drafted a bunch of appropriately qualified civilians into that role, perhaps on basis of some ancient law that has never been enacted so far but it's technically still on the books. Because who knows how exactly "reservist" is defined in the Netherlands. (and if it meant, in the context of "cyber-military", that they might occasionally come for you at weird hours with requests for consulting, it might not even be all that terrible)
If you are Dutch civilian train at hackthebox and apply :)
You may want to think twice before showing off your skills here. Keep in mind that there are a ton of unsolved cybercrime cases and if your skills happen to match an unsolved case you should not be surprised to find yourself added to a list of suspects. If you're unlucky there are no other suspects...
Luckily in free areas of the world you don't get imprisoned based on process of elimination.
But you can be extradited to countries that do.
Hah. You'd be surprised how often 'anonymous tips' end up implicating people that otherwise were not on the roll at all.

Welcome to the very slippery slope.

https://en.wikipedia.org/wiki/Parallel_construction

I would not at all be surprised to see equivalents in other jurisdictions.

The idea here is not that the tip is evidence, but that the tip leads to an investigation focused on an individual that was otherwise not a suspect. Given how hacking computers often leaves no suspects having any suspect is already a step up from having none. Motive, means and opportunity right? Means -> you are able to hack, we found your application to this ultra elite hacking thingy the good government put out, you aced it, therefore you have the means. You're a competent hacker, you were near a computer the night this stuff went down that gives opportunity. Which leaves motive, and it won't take much to tag some hacker type with any motive you care about maladjusted miscreants that they are.

(comment deleted)
This is a totally pedantic meta comment but I think you mean motive here, not Motif. In English, motif typically means more like a design pattern or theme, which is confusing since it’s so similar to motief in Nederlands.
Ah sorry, you are right, will edit.
This is great. When German, English, French and Dutch go through a tumbler and no easy logic can be seen explaining the different uses and spellings. Motief, motive, motiv, motif.

So motif [Eng] is based on motive [Fr] for repetitive (something). And motive [Eng] is similar in meaning to motief [NL], motive [Fr] and motiv [De]. All based on the same root in Latin.

Agreed - so interesting to see which words now have meanings tied to certain contexts in different languages (well, mostly English probably since it makes little sense at times!) over time. It was an interesting exploration.
Isn’t it common for prosecutors to use circumstantial evidence?
You don't get imprisoned but subjected to a brutal police stalking regime in the "free" Netherlands.
Especially in the Netherlands with its extrajudicial pre-crime punishments and the fascist "burgerwacht".

The friendly image from the 90s no longer applies.

I think you're taking it a bit too far. The friendly image from the 90's applies just as much today as it did in the 90's, it is just that we know a lot more about how the whole machine works because of various publications and parliamentary questions and answer sessions.

We don't have fascist 'burgerwacht' controlled by the government, if anything they are the opposite, operating outside of government oversight and control and considerable manpower and expense goes into keeping track of these groups.

The reason I'm concerned with the linked article is because it might cause 'off the books' characters to reveal themselves and if they have been near the periphery of something illegal even if they themselves were not part of it or if their skills are judged unique enough that those skills themselves start counting as a fingerprint of sorts that it might get people in trouble who do not deserve that.

As far as government programs go, now THIS is a good idea!
A Word document? Are you kidding me? Would a truly cyber-security conscious (i.e.: slightly paranoid) citizen download and open that, from the open internet, with a nation-state actor behind it?
It's docx. You can just unzip it to get a horribly XML but plaintext representation of the document.
Which format would you have preferred?
Plaintext would have sufficed
how can you inject an exploit from a plaintext file?
Didn't someone do that with notepad.exe recently? The demo spawned calc.exe from notepad.exe.
Anyone worth their grain of salt would download and analyze in a vm before executing on their own personal machine... I know I would. Didier Stevens[0] has a ton of tools for static analysis of these file types.

[0] https://blog.didierstevens.com/

What's the novelty here? There is a cyber-defence reserve in French army since a few years, and quoting Wikipedia, its composed of 4000 citizens reservists, 400 operational reservists and 40 soldiers.

https://fr.wikipedia.org/wiki/R%C3%A9serve_op%C3%A9rationnel...

The novelty here is that they are waving the physical requirements of military personnel while still enlisting them as military allowing them to engage into certain offensive actions that would, under dutch law, be prohibited to civilian personnel. I have no idea whether that is at all unique in europe or globally.