CyberWar Blog

On January 3, a Saudi hacker group claimed that it had stolen half a million Israeli credit cards. The Bank of Israel claims their exposure is information on only 15,000 credit cards, all of which were immediately blocked. The hacker group’s stated purpose was to see Israeli cards fall into disrepute, “like the Nigerian cards.” The cracker, “0xOmar” is identified as the individual performing the hack, and says he plans to publish information on an additional 200 cards per day.

In response to the Saudi hack release of user credit information, an Israeli hacker going by the name of “OxOmer” (“O” instead of zero, “e” instead of “a”), aka Omer Cohen, has published the information on hundreds of Saudi credit cards. Cohen, a soldier in the Israeli Defense Force (IDF), says he published the information as a “deterrent.” The card info was apparently used to purchase goods on Saudi websites, thereby ratcheting things up a little by not just releasing information, but stealing funds.

Cohen believes his government has not responded quickly nor strongly enough. This “deterrent” language, of course, mirrors the military language of providing overwhelming negative consequences to keep an opponent from acting in the future. The news of the world does indeed talk up electronic hacking and cracking though the use of military terms, but there are those who argue that cyberwar doesn’t really exist – at least not yet.

I would expect that none of the credit card information released belonged to either of the hackers, but rather to “innocent bystanders.” Cohen apologized if any innocent people were hurt by his actions.

In this sense, at least, this small conflict mirrors (however weakly) the world’s real wars with their “collateral damage.”

A columnist in the conservative Jerusalem Post says that the credit cards really belong to users living in the United States, but that in any case, this kind of cyber-fighting is better than fighting by using objects of the material world, such as bullets or missiles.

And really, who’s to say he doesn’t make a very good point?

As the United States (and the world) prepare for the possibility of Cyber War, it seems that there’s little agreement on what the term means. Merriam-Webster defines it as “of, relating to, or involving computers or computer networks (as the Internet).” Yet we have a government Cyber Command and reports are full of military metaphors. Plug the term into the DOD’s public website, and you will be treated to 1270 articles. One such article had 77 references and included the following: cyberwarfare, cyberattacks, cyberwarriors, cyberstrategy, cyberthreat, cyberdefense, cyberspace (of course), cybersecurity, Army Forces Cyber Command, Marine Forces Cyberspace Command, National Cyber Range (Really? You shoot electrons at targets, maybe?), cyberweapons, cybersecurity professionals.

The United States Government Accounting Office (GAO) issued the July 2011 report “DOD Faces Challenges in its Cyber Activities,” wherein it expresses the same concern: definitions and responsibilities are literally all over the map. Different organizations within Defense are not coordinating their efforts and don’t even agree on some basic definitions.

So perhaps it’s not surprising that Senator Kirsten Gillibrand of New York is demanding clarification about who or what “cyber” really means.
Gillibrand wrote to Defense Secretary Leon Panetta to say “I continue to be concerned that the lack of cross-cutting, clear definitions of cyber personnel throughout the Defense Department is a significant hindrance to your ability to carry out this significant mission.” Among her complaints are that the DOD has 90,000 people working on cyber issues, but many are basic computer maintenance workers, rather than actual military cyber experts. It’s not that “just IT guys fixing hard drives” (some of which the author does himself) aren’t important, but that they’d be there in a similar capacity whether there were concerns about military cyberthreats or not. These guys, she thinks, shouldn’t be classified under the “cyber” moniker.

The lack of a cohesive response and adequate security has resulted in multiple large-scale data breaches. According to Deputy Defense Secretary Willam J. Lynn, foreign crackers stole 24,000 military files in March 2011. Lynn said “It is a significant concern that, over the past decade, terabytes of data have been extracted by foreign intruders from corporate networks of defense companies.” The DOD believes that “more than 100 foreign intelligence organizations are trying to break into U.S. network.”

Given that there are about 195 countries in the world, that’s a significant number.

Continuing from the DOD document, “Whereas a missile comes with a return address, a computer virus generally does not. The forensic work necessary to identify an attacker may take months, if identification is possible at all. And even when the attacker is identified, if it is a nonstate actor, such as a terrorist group, it may have no assets against which the United States can retaliate. Furthermore, what constitutes an attack is not always clear. In fact, many of today’s intrusions are closer to espionage than to acts of war…Given these circumstances, deterrence will necessarily be based more on denying any benefit to attackers than on imposing costs through retaliation.”

Gillibrand believes the threat to be significant. Honoring the new tradition of using military terms for threats on government networks, Gillibrand in June called for the creation of a “Cyber ROTC.” She believes that government needs to draw off some of the talent in the private sector to become cyberwarriors and that a CyberROTC could become the farm team in developing new talent.

Did I say “CyberWarriors?” I did.

Are we jumping too fast and too far into the military classification of what until now has been largely the domain of Silicon Valley and Route 128? We seem to be calling for the creation of organizations and personnel based around concepts that are not yet fully defined. This author thinks it would behoove us to understand what we are doing before we do it. I echo Senator Gillibrand’s call for common definitions. But I do believe we need definitions and accountable responsibilities in place before we jump wholeheartedly into shoveling Treasury funds into amorphous plans – solutions for problems we don’t yet understand

Contrary to my earlier posting regarding what Cyberwar is, a recent article in Slate online magazine asserts that We don’t really know how to define an act of cyberwar. That’s “We,” the international community, We the U.S. Senate, We the Department of Defense.

Currently, NATO’s Cooperative Cyber Defence Centre, one of NATO’s fifteen Centers of Excellence says that cyber aggression rises to the level of an act of cyberwar only if it is done in conjunction with a physical attack AND can be attributed to a specific government AND if it can be shown that the attack caused injury. Otherwise, there is no legal basis on which to use force against an aggressor – that is, counterattack. This opinion dates from 2008, in the absence of other international treaties on the subject. Furthermore, in a 2010 Wired interview the US cyberczar, Howard Schmidt, famously said, “There is no Cyberwar.” Only online crime and espionage.

By both of these perspectives, the 2009/10 Stuxnet worm that damaged Iran’s nuclear centrifuges and set back that country’s uranium enrichment efforts was an act of sabotage, not cyberwar. The 2008 Russian military attack on Georgia that coincided with a seemingly Russian-coordinated cyber attack (for while there may not be an agreed-upon definition of cyberwar, there clearly are cyberattacks) wasn’t an act of cyberwar because it couldn’t be proved that Russia carried out the cyber portion of the attack, nor could it be shown that the cyber part cause injury.

The news has been full of stories about the many attacks and acts of espionage against targets in the USA originating from IP addresses in China. But apparently no one can adequately prove that the Chinese government was the entity that carried out these attacks.

So, what does what does describe an actionable act of War By Computer? If millions of dollars, hundreds of companies and governments can’t place the cyberfinger on a given government with the resources at their cybercommands, what will it take?

Could it be a good thing that no act of war is legally actionable against a cyberattack? Or does a lack of definition or agreement make damaging attacks by state actors more likely? What do you think, dear reader?

Internet in a Suitcase to Foil Censorship, by Steve Burgess

Richard Clarke, advisor to multiple presidents and former National Coordinator for Security, Infrastructure Protection, and Counter-terrorism said both that the United States is able to black out other countries’ power grids, and that it does not have a plan that will keep the same from happening in America. Until this summer, the concern was academic – no one was known to have the capability to halt industrial capabilities through the use of malware. But this summer’s Stuxnet changed the equation. With the advent of a worm that is capable of sabotaging industrial facilities, Clarke advises that the U.S. needs to prioritize designing a defense against efforts to damage the infrastructure at home. More here.

What is Cyberwar?

Richard Clarke, former Special Advisor to the President on cybersecurity defined cyberwarfare as “actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption.”

For the purpose of this blog, we wish to expand the discussion to include such cross-border attacks perpetrated by non-state actors. After all, we often can’t conclusively say if a given attack’s source was a government or an individual.
Wikipedia has several thousand words on the subject here.

In a highly networked/connected culture such as in the United States, cyberattacks on individual and corporate computers and networks are a matter of daily irritation that sometimes escalate into much lost work time. Imagine the disruption if control mechanisms for energy distribution, dams, water supplies or nuclear weapons were compromised, and you can see why such issues are of concern.

They are of concern to Cybercom, an entity set up to protect cyberspace operations of the United States. They are also of concern to business and to you and me, dependent as we are on an Internet that works, dependent as we are on many services such as water and power, and on the safety of facilities such as nuclear power plants and dams – facilities whose failures could cause widespread damage and death.

Cyberwar is a reality in the world. From low-end hacking and kiddiescripts to attacks and penetration  of actual facilities in the bricks-and-mortar world, we’re living in a time of cyberwar. We hope to bring together news, essays, comments regarding concerns, actions, and ethics of attacks in the cyberworld. We hope you join us.