National Security

Cool War

Could the age of cyberwarfare lead us to a brighter future?

"It is well that war is so terrible," Confederate General Robert E. Lee once said, "lest we should grow too fond of it." For him, and generations of military leaders before and since, the carnage and other costs of war have driven a sense of reluctance to start a conflict, or even to join one already in progress.

Caution about going to war has formed a central aspect of the American public character. George Washington worried about being drawn into foreign wars through what Thomas Jefferson later called "entangling alliances." John Quincy Adams admonished Americans not to "go abroad in search of monsters to destroy." Their advice has generally been followed. Even when it came to helping thwart the adventurer-conquerors who started the twentieth century's world wars, the United States stayed out of both from the outset, entering only when dragged into them.

This pattern briefly changed during the Cold War, with the launching of military interventions in Korea and Vietnam. The former was fought to a bloody draw; the latter turned into a costly debacle. Both were quite "terrible," costing tens of thousands of American lives and untold treasure -- nearly 100,000 lives and trillions of dollars -- reaffirming Lee's reservations.

Operation Desert Storm -- a lopsided win against a weak opponent in Iraq -- seemed to break the pattern, ushering in President George H.W. Bush's "new world order." But the military experiments in regime change begun by his son -- an unexpectedly long and bloody slog through Iraq and Afghanistan -- reawakened traditional concerns about going to war, propelling Barack Obama to the presidency and energizing Ron Paul's support within the GOP.

Even Obama's "intervention-lite" in Libya proved unsatisfying, unleashing much suffering and uncertainty about the future of that sad land. And a furious debate rages about the practical and ethical value of drone bombing campaigns and "targeted killing" of our enemies -- due in part to the deaths of innocents caught up in these attacks, but also because of the possibility of fomenting rabidly anti-American sentiments, perhaps even revolution, in places like nuclear-armed Pakistan.

But now, somehow, it seems that war may no longer seem so terrible.

How has this come to pass? The culprit is the bits and bytes that are the principal weapons of cyberwar. It is now possible to intervene swiftly and secretly anywhere in the world, riding the rails of the global information infrastructure to strike at one's enemies. Such attacks can be mounted with little risk of discovery, as the veil of anonymity that cloaks the virtual domain is hard to pierce. And even when "outed," a lack of convincing forensic evidence to finger the perpetrator makes heated denials hard to disprove.

Beyond secrecy, there is also great economy. The most sophisticated cyber weaponry can be crafted and deployed at a tiny fraction of the cost of other forms of intervention. No aircraft carriers needed, no "boots on the ground" to be shot at or blown up by IEDs. Instead, there is just a dimly lit war room where hacker-soldiers click for their country, and the hum of air conditioners keeping powerful computers from overheating. Cool room, cool war.

The early returns seem to suggest the great efficacy of this new mode of conflict. For example, the Stuxnet worm, a complex program of ones and zeros, infected a sizeable proportion of Iran's several thousand centrifuges, commanding them to run at higher and higher speeds until they broke. All this went on while Iranian technicians tried fruitlessly to stop the attack. The result: a serious disruption of Tehran's nuclear enrichment capabilities -- and possibly of a secret proliferation program.

The sabotage occurred without any missile strikes or commando raids. And, for now, without any open acknowledgment of responsibility, although reporters and others have pointed their fingers at the United States and Israel. It is loose lips in high places, not sophisticated "back hacking," that seem to have divulged the secret of Stuxnet.

Another example of the looming cool war is the malicious software known as Flame, which sought information via cyber snooping from target countries in the Middle East. The code that comprises it seems to make the point that we no longer need physical agents in place if we can now rely on artificially intelligent agents to dredge up the deepest secrets. There will be no new John le Carré to chronicle this era's spies. Not when the closest thing to George Smiley is a few lines of source code.

Beyond Stuxnet-like "cybotage" and software-driven spying, the coming cool war might also influence whether some traditional wars are even going to break out. The good news is that a preemptive cyber attack on the military command-and-control systems of two countries getting ready to fight a "real war" might give each side pause before going into the fight. In this instance, the hackers mounting such attacks should probably publicize their actions -- perhaps even under U.N. auspices --  lest the disputants think it was the enemy who had crippled their forces, deepening their mutual antagonism. There are no doubt some risks in having a third party mount a preemptive cyberattack of this sort -- but the risks are acceptable when weighed against the chance of averting a bloody war.

The other potential upside of cool war capabilities, in addition to tamping down military crises between nations, would lie in multilateral tracking of transnational criminal and terrorist networks. These villains thrive in the virtual wilderness of cyberspace, and it is about time that they were detected, tracked, and disrupted. Think of Interpol, or an international intelligence alliance, using something like Flame to get inside a drug cartel's communications network. Or al Qaeda's. The potential for illuminating these dark networks -- and bringing them to justice -- is great and should not be forgone.

On balance, it seems that cyberwar capabilities have real potential to deal with some of the world's more pernicious problems, from crime and terrorism to nuclear proliferation. In stark contrast to pitched battles that would regularly claim thousands of young soldiers' lives during Robert E. Lee's time, the very nature of conflict may come to be reshaped along more humane lines of operations. War, in this sense, might be "made better" -- think disruption rather than destruction. More decisive, but at the same time less lethal.

Against these potential benefits, one must also weigh the key downside of an era of cyber conflict: the outbreak of a Hobbesian "war of all against all." This possibility was first considered back in 1979 by the great science fiction writer Frederik Pohl, whose dystopian The Cool War -- a descriptor that might end up fitting our world all too well -- envisioned a time when virtually every nation fielded small teams of hit men and women. Their repertoires included launching computer viruses to crash stock markets and other nefarious, disruptive capabilities.

In Pohl's novel, the world system is battered by waves of social distrust, economic malaise and environmental degradation. Only the rebellion of a few cool warriors - some, but not all, were hacker types -- at the end, offers a glimmer of hope for a way out and a way ahead.

The question that confronts us today is whether to yield to the attractions of cyberwar. We have come out of one of mankind's bloodiest centuries, and are already in an era in which wars are smaller -- if still quite nasty. Now we have the chance to make even these conflicts less lethal. And in reality, there may be no option. Once the first network or nation takes this path -- as some observers believe the United States is doing -- others will surely follow, starting a new arms race, this time not in weaponry, but in clandestine and devastating programs like Stuxnet and the Flame virus.

It is a curious irony that the United States, a power traditionally reluctant to go to war but furious in its waging, is now seemingly shifting gears. It is becoming a nation with the capability to go to war easily, while at the same time far less ferociously. Is this an improvement? Perhaps. Delaying Iranian proliferation with bits and bytes seems far superior to the costs and risks that would be incurred, and the human suffering inflicted, by trying to achieve such effects with bombs and bullets.

But looking ahead, how will Americans respond when others begin to employ cyber means to achieve their ends, perhaps even by attacking us? After all, Stuxnet escaped from that Iranian facility into the wild, and is certainly being studied, reverse engineered and tweaked by many around the world. No country may be foolish enough to engage the incomparable U.S. military in open battle, but we seem like fairly easy pickings to the computer mice that may soon roar.

Despite all these concerns, though, a cool war world will be a better place to live in than its Cold War predecessor. Yes, conflict will continue in the years to come, but it will morph in ways that make our self-destruction as a civilization less likely -- even if it means living with occasional disruptions to vulnerable high-tech systems.

The bargain made when "cyber" and "war" came together need not turn out to be Faustian. This story can still have a happy ending: As war becomes "cooler," mankind's future may edge a bit closer to the utopian end that all of us, secretly or not so secretly, truly desire.


National Security

Cyberwar Is Already Upon Us

But can it be controlled?

In the nearly 20 years since David Ronfeldt and I introduced our concept of cyberwar, this new mode of conflict has become a reality. Cyberwar is here, and it is here to stay, despite what Thomas Rid and other skeptics think.

Back then, we emphasized the growing importance of battlefield information systems and the profound impact their disruption would have in wars large and small. It took just a few years to see how vulnerable the U.S. military had become to this threat. Although most information on cyberwar's repercussions -- most notably the 1997 Eligible Receiver exercise -- remains classified, suffice it to say that their effect on U.S. forces would be crippling.

Cyberwar waged against one of America's allies has already proved devastating. When Russian tanks rolled into Georgia in 2008, their advance was greatly eased by cyberattacks on Tbilisi's command, control, and communications systems, which were swiftly and nearly completely disrupted. This was the very sort of online assault Ronfeldt and I had envisioned, with blitzkrieg-style operations on the ground augmented by a virtual "bitskrieg."

In some respects, the Russo-Georgian conflict illuminates the potential of cyberwar in a manner not unlike the way the Spanish Civil War foreshadowed the rising dominance of air power 75 years ago, offering a preview of World War II's deadly aerial bombings. Like air warfare, cyberwar will only become more destructive over time. For that reason, the Pentagon was right last year to formally designate cyberspace as a "warfighting domain."

These developments align closely with our own predictions two decades ago. But another notion arose alongside ours -- that cyberwar is less a way to achieve a winning advantage in battle than a means of covertly attacking the enemy's homeland infrastructure without first having to defeat its land, sea, and air forces in conventional military engagements.

I have been bemused by the high level of attention given to this second mode of "strategic cyberwar." Engaging in disruptive cyberattacks alone is hardly a way to win wars. Think about aerial bombing again: Societies have been standing up to it for the better part of a century, and almost all such campaigns have failed. Civilian populations are just as likely, perhaps even more so, to withstand assaults by bits and bytes. If highly destructive bombing hasn't been able to break the human will, disruptive computer pinging surely won't.

Rid seems especially dubious about the potential for this form of strategic cyberwar. And rightly so. But there is ample evidence that this mode of virtual attack is being employed, and with genuinely damaging effects. The 2007 cyberwar against Estonia, apparently arising out of ethnic Russian anger over removal of a World War II monument, offered a clear example. The attack was initially highly disruptive, forcing the government to take swift, widespread measures to install security patches, improve firewalls, and make strong encryption tools available to the people. Estonia is small, but one of the world's most wired countries; 97 percent of its people do all their banking online. Costs inflicted by the attacks -- from business interruption and disruption to the need to erect new defenses -- are estimated in the many millions of euros. A scaled-up version of this kind of cyberwar, to America-sized attacks, would cause damage in the hundreds of billions of dollars.

The Stuxnet worm, which struck directly at Iranian nuclear-enrichment capabilities, is another example of strategic cyberattack -- what I prefer to call "cybotage." But will it achieve the larger goal of stopping Iranian proliferation efforts? Not on its own, no more than the Israeli air raid on the Osirak nuclear reactor 30 years ago ended the Iraqi nuclear program. Iraq's pursuit of nuclear technology simply became more covert after the Osirak attack, and the same will surely hold true for Iran today.

A key aspect of both Stuxnet and the Estonian cyberattacks is that the identity of the perpetrators, though suspected, cannot be known with certainty. This anonymity is also the case with the extensive cybersnooping campaigns undertaken against sensitive U.S. military systems since the late 1990s -- and against leading companies, too, some of which are seeing their intellectual property hemorrhaging out to hackers. A few of these campaigns have suspected links to China and Russia, but nothing is known for sure. So these actions, which to my mind qualify as a low-intensity form of cyberwar, have gone unpunished. Rid himself acknowledges that these sorts of attacks are ongoing, so it seems we are in agreement, at least about the rise of covert cyberwar.

My deeper concern is that these smaller-scale cyberwar exploits might eventually scale up, given the clear vulnerability of advanced militaries and the various communications systems that cover more of the world every day. This is why I think cyberwar is destined to play an increasingly prominent role in future wars. Yes, some cyberweapons do require substantial investment of resources and manpower, as Rid suggests. But once created, they can be used in ways that easily overcome existing defenses. Even for those exploits that don't require significant resources, like the campaign against Estonia, the lesson remains clear: The advantage lies with those who take the offensive.

The challenge for cyberwarriors today lies in figuring out how to thwart these various cyberoffensives. This won't happen if defenders remain dependent on a cyberspace-based version of the Maginot Line: the "firewalls" designed to detect viruses, worms, and other tools, and to keep attackers from intruding into and roaming about one's systems. Like the original Maginot Line, which failed to protect France in World War II, the firewall is easily outflanked. Sadly, undue faith in this passive mode of defense means that, right now, far too much data can be found in fixed places, "at rest." This results in far too much data remaining at risk, easily located and targeted for extraction, manipulation, or destruction. Far better to move away from dependence on firewalls to the ubiquitous use of strong encryption, which protects data with unbreakable codes, and "the cloud," the vast expanse of cyberspace in whose far reaches data can be safely secreted and then swiftly summoned back when needed.

A final aspect of cyberwar that Ronfeldt and I began contemplating so long ago -- virtual conflict in the form of society-wide ideological strife -- is also coming to pass. Such virtual operations, we wrote back in the early 1990s, would one day extend to "efforts to promote dissident or opposition movements across computer networks." Clearly, we have seen this form of conflict take shape in the "color revolutions" of the past decade and most recently in the Arab Spring; in both cases, the impact of political activism was greatly enhanced by cyber-enabled social networking tools and sites. If there is to be more cyberwar in the future, better it should be what we called "social netwar" than the alternatives.

So, yes, cyberwar has arrived. Instead of debating whether it is real, we need to get down to the serious work of better understanding this new mode of war-fighting, which has been enabled by an information revolution that has brought so much good to the world, but which at the same time heralds an age of perpetual conflict. What we really must ask is: Can cyberwar be controlled? Rid implies that international cooperation to do so is doomed, but I'm not so sure. Pledges not to employ cyberattacks against purely civilian targets, for example, may be genuinely worthwhile -- at least for nations, if not for shadowy networks. But networks, too, may come to follow some kind of code of behavior. Even the loosely linked cybervigilante group Anonymous takes considerable pains to explain the rationales for its actions.

So here's hoping that, amid the looming havoc of cyberwars to come, there will also be prospects for cyberpeace.

4ivers via BigStockPhoto