Combined Cyber Information Warfare Operational Group (Union State)

Combined Cyber Information Warfare Operational Group
Cepan Olochtli Ciberiximachocayaoyotl Tequitiliztli (Nahuatl)
Active	9 March 2002 (2002-03-09)
Countries	Pulacan Zacapican
Allegiance	Union State
Type	Joint military agency
Role	Cyberwarfare, information warfare
Size	est. 3,800
Garrison/HQ	Amatlan, Pulacan
Nickname(s)	Warriors of the Obsidian Mirror

The Combined Cyber Information Warfare Operational Group (Nahuatl: Cepan Olochtli Ciberiximachocayaoyotl Tequitiliztli, COCT) is a cyberwarfare and signals intelligence agency in Zacapican and Pulacan. Tasked during its inception with connecting the various cybersecurity agencies in the two nations, the group's mission has since expanded to facilitating various groups of both defensive and offensive network warfare specialists under a single umbrella.

The COCT is considered to be a core component of the Zacapine-Pulatec cooperation umbrella known as the Union State (Cetliliztli Tlatoloyan). The group's unifying presence has been cited as a major reason for the kickstarting of both Zacapine and Pulatec network security modernization in the 2000s and 2010s.

History

At the dawn of the Internet age, cybersecurity in both Pulacan and Zacapican was often underfunded and poorly-researched. Governments were slow to react to increasingly large threats as viruses and hacking became widespread in the 1990s. Though one of the first documented viruses on the Nahuatl Internet wreaked havoc in 1989, it was not until 1994 that the Pulatec United Legislative Assembly gave clear delineations to government agencies regarding powers of enforcement with cybercrime laws. In Zacapican, software development in general was de-prioritized field largely served by small groups of foreign contractors, and cybersecurity in particular was chronically overlooked even at the highest levels of the state. In both countries, government cybersecurity resources were simply spread too thin, and many private individuals and firms were left to fill the gaps. To compound the problem, both personal computers and the Internet were exponentially increasing in adoption during the late 1990s and early 2000s faster than the nascent cybersecurity field could catch up with.

During Pulacan's 1999 snap elections, a series of cybercrimes targeting the finances of then-candidate Moctezuma Tshireletso and the Nguzo Party highlighted the need for improved cyberdefense at the government level. At this time, Zacapican had been exploring cybersecurity initiatives through Ciberyectzicatica initiative of the Secretariat of Public Safety was established in 2002 after a hacking incident disrupted a nuclear power plant in the Aztaco Republic. This was the Zacapine government's first serious attempt to establish a system of cybersecurity and defense against hacking attacks on its infrastructure. After Nguzo formed a coalition government with the technocratic United in Humanity party, the improvement of Pulacan's government cybersecurity infrastructure was made a priority. As Internet infrastructure is a government-provided utility in Pulacan, Tshireletso established that malware and other forms of cyberattack were to be treated as damaging exploits on government infrastructure. In order to supplement the increased resources towards cyberdefense, Tshireletso proposed the creation of a joint network security agency to the government of Zacapican in May of 2001. After some negotiations, the Combined Cyber Information Warfare Operational Group was formed on March 9th, 2002.

Initially, COCT was intended as a purely defensive cybersecurity agency. Relevant military and civil agencies from both nations were to share known malware and threat data, standardize security infrastructure, and to ensure the continued operation of networked state infrastructure like nuclear power stations and emergency dispatch centers. As the landscape evolved surrounding cybersecurity and acts of cyberwarfare became increasingly prevalent in the late 2000s and early 2010s, however, concerns began to grow about Zacapican and Pulacan maintaining military parity with other nations that were investing in exploring offensive cybernetic capabilities. The potential for a numerically small group of hackers to pose an asymmetrical threat to a state's vital infrastructure, both civilian and military, became increasingly apparent during this time. Though exact information is not publicly available, serious efforts to form offensive network groups under the COCT banner likely began around the year 2013. These groups, supposedly known as the Tezcatlipoca Corps internally, were tasked with the creation of worms, Illene horse programs and other forms of malware. These programs were tailor-made to target a state's major economic and governmental institutions, as well as infrastructure pieces like power stations, natural gas pipelines and military installations. It is believed that three of these groups were initially recruited, though around six or seven are believed to exist today.

The first instance of offensive cyberwarfare conducted by a COCT operative was the Poliworm exploit of 2014 in Belfras. Bravis, a company based in Orestes, was primarily responsible for providing information security for several large banks within the Federation, such as the Bank of Clastis. The exploit, a worm, successfully infiltrated the main computer system at the Bravis' offices responsible for on-site storage of the information in supposedly secure hard drives. The worm's propagation allowed the so-called 'payload' to locate and exfiltrate several highly confidential files.

Structure and function

The COCT works partly to oversee defensive cybersecurity work and research and partly to either pre-emptively strike or retaliate hostile cybernetworks. In order to accomplish this, the COCT is structured similarly to a calpolli, or Nahua economic cooperative. Four sections are oveseen by the Cyber-Information Directorate. The Directorate's members are equal-parts Zacapine and Pulatec, appointed for staggered five-year terms; Directors are usually military cyberwarfare experts. The structure of the organization encourages cooperation between the sections, encouraging them to cooperate in shared venues as their skillsets and focus areas frequently overlap. During crisis situations or even for strenuous projects, it is not only common but encouraged for members of multiple sections to autonomously form "cells" for the nature of comprehensively tackling various issues.

Name	Role
Section 1: Center for Communications Security	SIGINT/Communications encryption
Section 2: Center for Digital Safety Assessment	Anti-malware, systems analysis, pen testing
Section 3: Center for Informational Integrity	Internet communications monitoring
Section 4: Center for the Cyberinformation Library	Malware data collation+distribution, inter-agency coordinating

Part of Section 4's responsibility is the upkeep of the Cyberinformation Library. The Library is a central repository of information surrounding various types of malware that can be accessed by both private security researchers and other government agencies. Samples of malware may be submitted to the COCT by outside researchers through the library for sandbox testing or for mere cataloguing. In addition, many antivirus programs utilize the Library as a source of information when scanning. It is rumored, though not confirmed, that the actual offensive cyberwarfare team is known as the Tezcatlipoca Corps, and answers directly to the directorial board as a secretive, non-disclosed fifth section of the agency. Though its existence has never been confirmed, it is suspected that the Corps is responsible for the Poliworm exploit, as well as some other subsequent worm attacks. The Corps would likely function much less like a delineated, centralized section and more like a decentralized, loose network of autonomous cells.