Wednesday, June 13, 2012

Cyberwar in the Babylon?

Cyberwarfare refers to politically motivated hacking to conduct sabotage and espionage. It is a form of information warfare sometimes seen as analogous to conventional warfare[1] although this analogy is controversial for both its accuracy and its political motivation.

U.S. government security expert Richard A. Clarke, in his book Cyber War (May 2010), defines "cyberwarfare" as "actions by a nation-state to penetrate another nation's computers or networks for the purposes of causing damage or disruption."[2]:6 The Economist describes cyberspace as "the fifth domain of warfare,"[3] and William J. Lynn, U.S. Deputy Secretary of Defense, states that "as a doctrinal matter, the Pentagon has formally recognized cyberspace as a new domain in warfare . . . [which] has become just as critical to military operations as land, sea, air, and space."[4]


  1. ^ a b DOD – Cyberspace. Retrieved on 2011-11-08.
  2. ^ a b Clarke, Richard A. Cyber War, HarperCollins (2010)
  3. ^ a b c "Cyberwar: War in the Fifth Domain" Economist, July 1, 2010
  4. ^ Lynn, William J. III. "Defending a New Domain: The Pentagon's Cyberstrategy", Foreign Affairs, Sept/Oct. 2010, pp. 97–108
  5. ^ a b The Lipman Report, Oct. 15, 2010
  6. ^ Clarke, Richard. "China's Cyberassault on America", Wall Street Journal, June 15, 2011
  7. ^ "Cyberwarrior Shortage Threatens U.S. Security" NPR, July 19, 2010
  8. ^ "U.S. military cyberwar: What's off-limits?" CNET, July 29, 2010
  9. ^ Cyberspace and the changing nature of warfare. Strategists must be aware that part of every political and military conflict will take place on the internet, says Kenneth Geers.
  10. ^ a b "Clarke: More defense needed in cyberspace", Sept. 24, 2010
  11. ^ "Malware Hits Computerized Industrial Equipment" New York Times, Sept. 24, 2010
  12. ^ Shiels, Maggie. (2009-04-09) BBC: Spies 'infiltrate US power grid'. BBC News. Retrieved on 2011-11-08.
  13. ^ Video. CNN (2009-04-08). Retrieved on 2011-11-08.
  14. ^ Reuters: US concerned power grid vulnerable to cyber-attack. (2009-04-09). Retrieved on 2011-11-08.
  15. ^ Gorman, Siobhan. (2009-04-08) Electricity Grid in U.S. Penetrated By Spies. Retrieved on 2011-11-08.
  16. ^ Video. Fox News (2011-05-01). Retrieved on 2011-11-08.
  17. ^ NERC Public Notice. (PDF) . Retrieved on 2011-11-08.
  18. ^ Xinhua: China denies intruding into the U.S. electrical grid. 9 April 2009
  19. ^ 'China threat' theory rejected. China Daily (2009-04-09). Retrieved on 2011-11-08.
  20. ^ ABC News: Video. (2009-04-20). Retrieved on 2011-11-08.
  21. ^ Disconnect electrical grid from Internet, former terror czar Clarke warns. The Raw Story (2009-04-08). Retrieved on 2011-11-08.
  22. ^ a b "White House Cyber Czar: ‘There Is No Cyberwar’" Wired magazine, March 4, 2010
  23. ^ a b "Cyber-War Nominee Sees Gaps in Law", New York Times, April 14, 2010
  24. ^ Cyber ShockWave Shows U.S. Unprepared For Cyber Threats. Retrieved on 2011-11-08.
  25. ^ Drogin, Bob (February 17, 2010). "In a doomsday cyber attack scenario, answers are unsettling". The Los Angeles Times.
  26. ^ Ali, Sarmad (February 16, 2010). "Washington Group Tests Security in ‘Cyber ShockWave'". The Wall Street Journal.
  27. ^ Cyber ShockWave CNN/BPC wargame: was it a failure? – Computerworld Blogs. (2010-02-17). Retrieved on 2011-11-08.
  28. ^ Steve Ragan Report: The Cyber ShockWave event and its aftermath. The Tech Herald. February 16 2010
  29. ^ "Google Attack Is Tip Of Iceberg", McAfee Security Insights, January 13, 2010
  30. ^ Government-sponsored cyberattacks on the rise, McAfee says. (2007-11-29). Retrieved on 2011-11-08.
  31. ^ American Forces Press Service: Lynn Explains U.S. Cybersecurity Strategy. Retrieved on 2011-11-08.
  32. ^ Pentagon to Consider Cyberattacks Acts of War. New York Times. 31 May 2006
  33. ^ Russia Today, 26 Jan. 2012, "US Launched Cyber Attacks on Other Nations,"
  34. ^ Russia Today, 26 Jan. 2012, "US Launched Cyber Attacks on Other Nations,"
  35. ^ Sanger, David E. "Obama Order Sped Up Wave of Cyberattacks Against Iran." New York Times, June 1, 2012.
  36. ^ ANNUAL REPORT TO CONGRESS Military and Security Developments Involving the People’s Republic of China 2010. (PDF) . Retrieved on 2011-11-08.
  37. ^ AP: Pentagon takes aim at China cyber threat[dead link]
  38. ^ a b "The Joint Operating Environment", Report released, Feb. 18, 2010, pp. 34–36
  39. ^ A Bill. To amend the Homeland Security Act of 2002 and other laws to enhance the security and resiliency of the cyber and communications infrastructure of the United States.. 111th Congress 2D Session
  40. ^ Senators Say Cybersecurity Bill Has No 'Kill Switch',, June 24, 2010. Retrieved on June 25, 2010.
  41. ^ "US embassy cables: China uses access to Microsoft source code to help plot cyber warfare, US fears". London: The Guardian. 2010-12-04. Retrieved 31 December 2010.
  42. ^
  43. ^ DOD – Cyber Counterintelligence. Retrieved on 2011-11-08.
  44. ^ Pentagon Bill To Fix Cyber Attacks: $100M. CBS News. Retrieved on 2011-11-08.
  45. ^ Senate Legislation Would Federalize Cybersecurity. Retrieved on 2011-11-08.
  46. ^ White House Eyes Cyber Security Plan. CBS News (2009-02-10). Retrieved on 2011-11-08.
  47. ^ CCD COE – Cyber Defence. Retrieved on 2011-11-08.
  48. ^ Press, Associated. (2009-05-11) FBI to station cybercrime expert in Estonia. Retrieved on 2011-11-08.
  49. ^ Rid, Thomas (October 2011). "Cyber War Will Not Take Place". Journal of Strategic Studies. DOI:10.1080/01402390.2011.608939. Retrieved 21 October 2011.
  50. ^ Deibert, Ron (2011). "Tracking the emerging arms race in cyberspace". Bulletin of the Atomic Scientists 67 (1). DOI:10.1177/0096340210393703.
  51. ^ Sommer, Peter (January 2011). "Reducing Systemic Cybersecurity Risk". OECD Multi-Displinary Issues. Retrieved 21 May 2012.
  52. ^ Gaycken, Sandro (2010). Cyberwar - Das Internet als Kriegsschauplatz.
  53. ^ [1] accessdate=10 Jan, 2012
  54. ^ Mathew J. Schwartz (November 21, 2011). "Hacker Apparently Triggers Illinois Water Pump Burnout". Information Week.
  55. ^ Kim Zetter (November 30, 2011). "Exclusive: Comedy of Errors Led to False ‘Water-Pump Hack’ Report".
  56. ^ U.S. drone and predator fleet is being keylogged accessdate=2011-10-06
  57. ^ Hennigan, W.J. "Air Force says drone computer virus poses 'no threat'." LA Times, 13 October 2011.
  58. ^ "SK Hack by an Advanced Persistent Threat". Command Five Pty Ltd. Retrieved 2011-09-24.
  59. ^ Jim Finkle (2011-08-03). "State actor seen in "enormous" range of cyber attacks". Reuters. Retrieved 2011-08-03.
  60. ^ Hacked by 'Pakistan cyber army', CBI website still not restored. (2010-12-04). Retrieved on 2011-11-08.
  61. ^ 36 government sites hacked by ‘Indian Cyber Army’ – The Express Tribune. Retrieved on 2011-11-08.
  62. ^ Britain faces serious cyber threat, spy agency head warns. The Globe and Mail (2010-10-13). Retrieved on 2011-11-08.
  63. ^ AFP: Stuxnet worm brings cyber warfare out of virtual world. (2010-10-01). Retrieved on 2011-11-08.
  64. ^ Ralph Langner: Cracking Stuxnet, a 21st-century cyber weapon | Video on. Retrieved on 2011-11-08.
  65. ^ Sudworth, John. (2009-07-09) New cyberattacks hit South Korea. BBC News. Retrieved on 2011-11-08.
  66. ^ Williams, Martin. UK, Not North Korea, Source of DDOS Attacks, Researcher Says. PC World.
  67. ^ Danchev, Dancho (2008-08-11). "Coordinated Russia vs Georgia cyberattack". ZDnet. Retrieved 2008-11-25.
  68. ^ Website of Kyrgyz Central Election Commission hacked by Estonian hackers, Regnum, 14 December 2007
  69. ^ Fulghum, David A. "Why Syria's Air Defenses Failed to Detect Israelis", Aviation Week & Space Technology, 2007-10-03. Retrieved on 2007-10-03.
  70. ^ Fulghum, David A. "Israel used electronic attack in air strike against Syrian mystery target", Aviation Week & Space Technology, 2007-10-08. Retrieved on 2007-10-08.
  71. ^ "War in the fifth domain. Are the mouse and keyboard the new weapons of conflict?". The Economist. July 1, 2010. Retrieved 2010-07-02. "Important thinking about the tactical and legal concepts of cyber-warfare is taking place in a former Soviet barracks in Estonia, now home to NATO’s "centre of excellence" for cyber-defence. It was established in response to what has become known as "Web War 1", a concerted denial-of-service attack on Estonian government, media and bank web servers that was precipitated by the decision to move a Soviet-era war memorial in central Tallinn in 2007."
  72. ^ Estonia accuses Russia of 'cyber attack'. (2007-05-17). Retrieved on 2011-11-08.
  73. ^ Ian Traynor, 'Russia accused of unleashing cyberwar to disable Estonia", The Guardian, May 17, 2007
  74. ^ Boyd, Clark. (2010-06-17) BBC: Cyber-war a growing threat warn experts. BBC News. Retrieved on 2011-11-08.
  75. ^ "Israel Adds Cyber-Attack to IDF",, Feb. 10, 2010
  76. ^ Russian Embassy to the UK [2]. Retrieved on 2012-05-25.
  77. ^ Tom Gjelten (September 23, 2010). "Seeing The Internet As An 'Information Weapon'". National Public Radio. Retrieved September 23, 2010.
  78. ^ Gorman, Siobhan. (2010-06-04) WSJ: U.S. Backs Talks on Cyber Warfare. Retrieved on 2011-11-08.
  79. ^ Український центр політичного менеджменту – Зміст публікації – Конвенция о запрещении использования кибервойны. Retrieved on 2011-11-08.

"June 7, 2012

The Rewards (and Risks) of Cyber War

The militarization of cyberspace has been under way for more than a decade, but only in the last few years have the telltale signs appeared suggesting that the United States is erecting a new digital wing of its permanent national-security state. Three years ago, for example, came the birth of the 24th Air Force, at Lackland Air Force Base, Texas, and Robins Air Force Base, Georgia. The 24th claims to be “the newest numbered air force,” as well as “the first-ever unit designated for the sole purpose of cyberspace operations.” According to its fact sheet,

Over 5,400 men and women conduct or support 24-hour operations … including 3,339 military, 2,975 civilian, and 1,364 contractor personnel.
There is less public information about the work of these seven thousand digital warriors than about the supposedly top secret, yet hiding-in-plain-sight, lethal drone program, about which my colleague Amy Davidson recently wrote, in response to a revelatory Times story about President Obama’s personal engagement with “kill lists” of terrorist suspects.
And yet armed drones and cyber war are of a piece. They have evolved opaquely from syntheses of new technologies and military imaginations. The laws governing them are secret, as are the mechanisms of Presidential decision-making and field command.
Last week, the Times shed more light, by publishing an excerpt of David Sanger’s new book, “Confront and Conceal,” which describes a joint American-Israeli offensive cyber-attack operation in 2010 against Iran’s nuclear industry. The existence of the weapon used against Iran—a piece of malware called Stuxnet—was previously known, and there was rough knowledge of the authorship. Sanger, though, describes both—and President Obama’s hands-on role—more fully than any previous account. The attack was designed to disable Iranian centrifuges that enrich uranium. (The enriched uranium could ultimately be used to make nuclear bombs.) Cyber Command and the 24th Air Force presumably played at least a supporting role, along with the National Security Agency, although it remains unclear exactly who did what in the operation, which may be continuing.
The operation’s code name—“Olympic Games”—suggests some of the complacency and self-satisfaction among the President’s advisers. The malware was built, for example, to convince the Iranians that the sabotage of their centrifuges was a result of their own incompetence. “The intent was that the failures should make them feel they were stupid, which is what happened,” one participant boasted.
“Olympic Games” seems to be, so far as is known, the first formal offensive act of pure cyber sabotage by the United States against another country, if you do not count electronic penetrations that have preceded conventional military attacks, such as that of Iraq’s military computers before the invasion of 2003. The N.S.A. routinely penetrates foreign computer systems to collect intelligence, as do the intelligence agencies of China, Russia, and other countries. Generally, however, these operations have involved passive information collection, not sabotage. More provocatively, a cyber spy may leave behind a dormant piece of malware, to signal a warning to the targeted country or institution, or to create offensive options in the future.
The legal justifications for the covert attack on Iran’s nuclear centrifuges remains secret, but it is easy to imagine how both Presidents Bush and Obama approved the operation—it was probably sold as novel, exciting, non-lethal, covert, and effective in ways that nothing else could be. It might delay Iran’s nuclear-weapons capability by a significant number of months, to give diplomacy and sanctions more time. (Stuxnet may have achieved this goal.)
These attractions apparently were great enough to overcome the obvious downsides: “Olympic Games” will invite imitation and retaliation in kind, and it has established new and disturbing norms for state aggression on the Internet and in its side-channels. American and Israeli official action now stands available as a justification for others.
In national security as in much else, what goes around often comes around. Presidents Clinton and Bush reportedly both declined to use cyber attacks to manipulate data and drain bank accounts whose balances supported Al Qaeda and Saddam Hussein. Their reasoning was that the American economy depends to a great degree on the integrity of the international banking system; cyber sabotage would invite other states to try similar attacks; and the protective defenses of America’s own banks were weak.
The problem with “Olympic Games” is that all of these risks and vulnerabilities are still present for the United States—only here the field is nuclear and electric infrastructure.
In June, 1999, the failure of computer control systems caused a gasoline pipeline rupture in Bellingham, in Washington State; the leaking gasoline ignited into a fireball, killing three people. Why the computer control systems failed remains something of a mystery, but cyber-war specialists have cited the incident as an example of what an intruder into American industrial infrastructure might attempt.
Iran is one of two-dozen-plus countries believed to possess an explicit cyber-warfare capability, akin to America’s Cyber Command. Russia is highly effective; China is active and capable. Specialists do not rate the United States as especially dominant on offense, but the country looks strikingly weak on defense.
“Because of its greater dependence on cyber-controlled systems and its inability thus far to create national cyber defenses, the United States is currently far more vulnerable to cyber war than Russia or China,” write Richard A. Clarke and Robert K. Knake in their book, “Cyber War: The Next Threat to National Security and What to Do About It.”
America is also more at risk to attack than North Korea or Iran because those countries are, relatively speaking, off the grid. Clarke, who presciently warned about Al Qaeda while in the Clinton and Bush White Houses, therefore counsels caution about provocative offensive attacks and much greater concentration on improving American defenses.
Clarke and Sanger both compare the chaotic, poorly considered state of cyber warfare today to the wild early days of nuclear arms, when the U.S. made backpack-sized portable nuclear bombs and artillery shells and spread them out all over Western Europe, daring the Soviet Union to invade. The comparison is imperfect—but some of the differences between now and then are cause for even greater worry.
To this day, nuclear weaponry has proved to be so complicated and expensive that only states have been able to manufacture and manage bombs. In cyberspace, criminal organizations, activists such as Anonymous and other private groups, as well as the odd lone hacker, have already displayed disruptive power. Terrorist groups are surely not far behind.
The United States thought it would monopolize nuclear weaponry for a lot longer than it did; the Soviets tested their first atomic bomb just four years after Nagasaki. It already seems evident that in the future, both lethal drone technology and the ability to conduct cyber attacks will be very broadly distributed—not just among governments, but among individuals, corporations, and terrorists.
Nick Paumgarten recently wrote about the spread of drone technology, and how local law enforcement might deploy a drone for, say, a dispute about missing cattle. Some of my technology-minded colleagues at the New America Foundation recently built a small drone with a cell-phone-enabled camera in it; they buzz it around our office, peeking at people. They do not regard this as a noteworthy technical feat. When will the first private murder by a drone equipped with a swivelling automatic rifle be committed in the United States?
In the field of cyber sabotage, the barriers to entry are even lower, given the amount of mischief, phishing, theft, and vandalism that already takes place daily online.
Common sense argues for caution, especially by the President of the United States. It also argues for strong defenses, and the pursuit of global laws and norms to contain the military use of these technologies before they cause chaos and destruction.
During the nineteen-fifties, a shocking number of American generals believed that a nuclear war could be won. “Olympic Games” suggests a comparably self-aggrandizing strain among our new class of digital fighters. Here the comparison to the early nuclear era does seem apt. As a citizen, will it once again seem tempting to buy land, guns, gold, and bottled water?
Illustration by Maximilian Bode.

No comments:

Post a Comment