"Cyber
security has become Washington's new growth industry," two of my CNAS colleagues, Kristin
Lord and Travis Sharp, commented
the other day. They warn especially against billion dollar solutions to million
dollar problems. They're right. Everyone's hyperventilating about cyber-this
and cyber-that, so we dispatched one of our cyber-reporters, Zach Keck (real
name) across the real river to see what up.
By Zach Keck
Best Defense
cyberwar bureau
The Stuxnet
virus isn't as big a deal as people think and only worked because the Iranians
weren't practicing safe computing, Martin Libicki of the
Rand Corporation said at his packed briefing on "Cyber-security
and Cyber-deterrence," in Pentagon City the other night.
Dr. Libicki began the night by noting that his
definition of cyber-warfare only considers conflict between states. More
specifically, he defined cyberwar as one state using information to attack
another state's information by attacking the other's information system. This
definition excludes many of the closely related concepts such as cyber-espionage,
electronic warfare,
or even attacking
prominent public websites. Still, this somewhat limited definition proved
robust enough to facilitate some interesting discussion, particularly with
regard to Stuxnet
and for the purposes cyber-warfare best lent itself too.
The presentation challenged the conventional
wisdom on the significance of Stuxnet.
To begin with, the virus was only effective because the Iranian regime
disregarded some commonsense safeguards that would have immediately alerted
them that their systems had been corrupted. Moreover, another crucial aspect to
Stuxnet's
success was Iranian inexperience with spinning centrifuges as any mature
nuclear state, even if it too disregarded these simple safeguards, would have
been able to quickly recognize that system was not running properly.
Libicki used Stuxnet to illustrate an
important insight into the nature of cyberwar in general. In direct contrast to
senior advisor for
cyber-security in the Department of Energy Bill Hunteman, who
has predicted that Stuxnet will set off a chain of copycats, Dr. Libicki
argued that we were unlikely to see a sequel to Stuxnet. Cyber attacks
exploit a hole in the program which, consequentially, brings the glitch to the
attention of the victim government and others monitoring the situation, who
will then patch it up rendering that particular cyber capability useless.
This point had interesting implications when the subject turned to the ends
that cyber attacks were best suited towards. Specifically, he argued that cyber
attacks were unlikely to be effective for coercive purposes. Libicki noted that attacking a country simultaneously
produces feelings of anger, for being attacked in the first place, as well as
fear of being attacked again. Since
a second cyber- attack will not be nearly as effective as the first one,
however, a country's anger will likely overpower the fear making the victim
country prone to retaliate.
Nonetheless, cyber-war tactics may be useful
when integrated with other military capabilities. The example Libicki used to
demonstrate this point to the audience if China, while
still much weaker militarily than the United States, decided to take Taiwan
by force. In such a scenario, China could launch a cyber attack on the U.S. Navy's
7th Fleet, which, if the attack were successful, could render the fleet
incapable of responding for up to 48 hours. At this point, however, China may
already control the island, and the United States would have to consider
acquiescing to this reality. While I tend to doubt the likelihood of the United
States doing this, it could be a powerful argument that could be used by the hardliners
in China to convince their country to take action against Taiwan. In this sense
at least, cyber-warfare capabilities may increase the probability of war by
miscalculation.
The briefing stood on less solid ground when
turning to the topic of cyber-deterrence. After noting the important, if
somewhat apparent problems of recognizing the system had been infiltrated, and
attributing the source of the attack, the briefing discussed problems related
to whether the country would want to respond to the attack, and even whether
the government would want to make it publicly known that it had been attacked
at all. It wasn't clear to me, however, whether these points were made to
convey the sense that deterrence, at least as the concept is commonly used with regard to
nuclear weapons, wouldn't work in cyberspace because countries wouldn't
fear retaliation; or, alternatively, if the briefing were using deterrence in
the sense of responding in ways that will deter future attacks.
This point got murkier when the first person
during Q&A reasonably asked: "why would the victim of a cyber attack
have to respond in kind?" Dr. Libicki at first fumbled around with this
question, by discussing the uses of sanctions and that of armed force, before
finally acknowledging that the state could respond in whichever manner it
chose. "This becomes a strategic question" Libicki noted, before
moving on to the new question.
To me, this point is worth dwelling on as it
potentially has significant strategic importance for U.S. cyber-strategy moving
forward. For instance, it suggests that even though the United States will
probably develop the capabilities to institute a "Flexible Response"
strategy in the mold of JFK, it would be prudent to follow the precedent of
President Eisenhower's "New Look" by reserving to itself the right to
respond asymmetrically to cyber attacks. Although we may rely more heavily on
the internet and related infrastructure than some of our potential adversaries
such as Venezuela or Iran, we also maintain a military that can destroy the
very things that these regimes hold dear. This would seem to be the best way to
establish an effective cyber-deterrent, at least against weak non-nuclear
states. On the other hand, because of the inherent plausible deniability of
cyber attacks, limited uses of them may come to be an important aspect of
conflict between nuclear armed adversaries, much as the use of terrorism and
proxies was during the Cold War, and continues to be in the Indo-Pakistani
conflict.
Read More
(12)
HIDE COMMENTS LOGIN OR REGISTER REPORT ABUSE