Rid seems especially dubious about the potential for this form of strategic cyberwar. And rightly so. But there is ample evidence that this mode of virtual attack is being employed, and with genuinely damaging effects. The 2007 cyberwar against Estonia, apparently arising out of ethnic Russian anger over removal of a World War II monument, offered a clear example. The attack was initially highly disruptive, forcing the government to take swift, widespread measures to install security patches, improve firewalls, and make strong encryption tools available to the people. Estonia is small, but one of the world's most wired countries; 97 percent of its people do all their banking online. Costs inflicted by the attacks -- from business interruption and disruption to the need to erect new defenses -- are estimated in the many millions of euros. A scaled-up version of this kind of cyberwar, to America-sized attacks, would cause damage in the hundreds of billions of dollars.

The Stuxnet worm, which struck directly at Iranian nuclear-enrichment capabilities, is another example of strategic cyberattack -- what I prefer to call "cybotage." But will it achieve the larger goal of stopping Iranian proliferation efforts? Not on its own, no more than the Israeli air raid on the Osirak nuclear reactor 30 years ago ended the Iraqi nuclear program. Iraq's pursuit of nuclear technology simply became more covert after the Osirak attack, and the same will surely hold true for Iran today.

A key aspect of both Stuxnet and the Estonian cyberattacks is that the identity of the perpetrators, though suspected, cannot be known with certainty. This anonymity is also the case with the extensive cybersnooping campaigns undertaken against sensitive U.S. military systems since the late 1990s -- and against leading companies, too, some of which are seeing their intellectual property hemorrhaging out to hackers. A few of these campaigns have suspected links to China and Russia, but nothing is known for sure. So these actions, which to my mind qualify as a low-intensity form of cyberwar, have gone unpunished. Rid himself acknowledges that these sorts of attacks are ongoing, so it seems we are in agreement, at least about the rise of covert cyberwar.

My deeper concern is that these smaller-scale cyberwar exploits might eventually scale up, given the clear vulnerability of advanced militaries and the various communications systems that cover more of the world every day. This is why I think cyberwar is destined to play an increasingly prominent role in future wars. Yes, some cyberweapons do require substantial investment of resources and manpower, as Rid suggests. But once created, they can be used in ways that easily overcome existing defenses. Even for those exploits that don't require significant resources, like the campaign against Estonia, the lesson remains clear: The advantage lies with those who take the offensive.

4ivers via BigStockPhoto

 SUBJECTS: NATIONAL SECURITY
 

John Arquilla is chairman of the U.S. Naval Postgraduate School defense analysis department.

IAN J. GOLDIN

1:27 PM ET

February 27, 2012

Maginot Line

The only reason the Maginot Line failed to protect France in World War II was because the French were naive enough to believe that the Germans wouldn't violate the neutrality of Belgium, Luxembourg and the Netherlands. Obviously they were wrong, and the Germans marched right through the neutral countries, going right around the line and flanking the French defenses.

Your analogy is a bit off, then, but another one applies: we can't expect cyber actors to adhere to the "laws of war." The anonymity of cyberspace makes this possible, especially for non-state actors such as Anonymous, etc. Just like the Germans ignored neutrality, our enemies in cyberspace will likely ignore "pledges not to employ cyberattacks against purely civilian targets."

You are absolutely right about encryption at rest -- although given enough time and resources, anything can be hacked. We need to be thinking within a framework of risk management.

 

INFOSECURITYMASTER

1:35 PM ET

February 28, 2012

Not War, let alone cyberwar

It doesn’t appear that a cohesive definition of cyberwar exists, at least in this article. Several examples are given, but none are seemingly interrelated. According to this article, cyberwar is at best a covert means of attack – so is that really espionage, crime, or pirating? And a significant fact lost here is that the Spanish Civil War’s air attacks were largely conducted against civilian populations. That type of aggression has been contradicted by Geneva Convention, hasn’t it? In regards to the Estonian episode, while it may be true that the infrastructure was significantly impacted, the very developed and resilient nature of that infrastructure minimized the strategic importance of the Denial of Service (DoS) attacks. And, as a side note, DoS attacks are the least advanced methodology, requiring little technical or intellectual investment, and are usually only of short term, tactical benefit. And also note the “extensive cybersnooping campaigns undertaken against sensitive U.S. military systems since the late 1990s -- and against leading companies, too, some of which are seeing their intellectual property hemorrhaging out to hackers.” This is also NOT warfare. It would be espionage or criminal thefts. I will agree minimally that the advantage lies with the offense – but only for moments. The advantage lies not with the attacker, but with the speed and originality that the attack is conducted. In Information Security, the common term is “Day Zero attack” – something original and heretofore unknown in technique and/or technology. The draw an allusion, the September 11 aircraft attacks were a “Day Zero” attack – they worked fantastically, horrifically. But they only worked on September 11 and will probably never again be repeated. Yes, InfoSec may have its own Maginot Line in the Firewall. But Infosec is more than firewalls. We have dozens of disciplines and thousands of technologies. Encryption is one, but there are a multitude more. But back to the core discussion of cyberwar, before we discuss whether or not it is presently here, we should define it. Until we define and bound the problem, we can’t begin to resolve. International agreement has been made on war if we are to accept the Geneva Conventions (and Hague, as well as Westphalia and several others). Perhaps we can take the principals of the Conventions and apply to the Cyber dominion. Based on the Conventions, if we look at aggression in Cyber, we mostly realize crimes, piracy and espionage. And that should be our goal – demilitarize the cyber dominions. Otherwise we will only continue on a path of escalations that doesn’t benefit anything or anyone.

 

ALANCHRISTOPHER

2:03 PM ET

March 3, 2012

Cyberwar

The US is far behind China in cyberwar. After the 1991 Gulf War, China examined the West's new capabilities and concluded that the West had a major vulnerability: the West depended on computer systems that could be hacked. The US looks at its war machines and says, "Wow!" The Chinese look at the West's war machines, smile, and type in codes to make US war machines into China's war machines awaiting China's orders. That is a simplification, but it describes the essential plan. An Iranian hacking program, developed with China, brought down the US RQ-170 drone over Iran by telling it to land in Kandahar when it was actually landing in Iran.

China has had several cyber regiments for land, sea, and air cyber operations since the 1990's, but the US Cyber Command was set up in 2011. The NSA listens but does not fight wars.The US buys robots with no plan for their use, but China has a comprehensive, coordinated, tactical doctrine for the integrated use of land, sea, and air human and robotic forces. The key is computers to control radio bandwidths for all machines and human communications.

That brings the main US difficulty. US computers still use 2 dimensional architecture and 2 dimensional programming: 0's and 1's, yes and no. In 1959, Richard Feynman pointed out there was room at the bottom, but the limit is being reached. IBM is working to develop qubits into a quantum machine, but there is an ultimate limit in the size of an atom. Smashing atoms leads to particles that last for nanoseconds, but no one can build a computer, program it, send it to a store and sell it in nanoseconds.

The Chinese have newer computers that use a base other than base two to allow three dimensional architecture and four dimensional programming: front/back, right/left, up/down, time. These machines attain speeds in exaflops while the US struggles to reach three petaflops. China is working on three dimensional, multi-planar architecture with four dimensional programming for newer machines. The US has no defenses against the current Chinese machines because they can use base two programs, but US base two computers cannot hack into the advanced Chinese machines.