At the Virus Bulletin conference last month, Andrew Lee from ESET gave a talk entitled “Cyberwar: Reality or Weapon of Mass Distraction?”
In it, Lee talks about how the term “cyberwar” is thrown around a lot these days. However, he disagreed with the use of the term because it uses inflationary language and overstates the case; today’s “cyberwar” is not the same as a conventional ware. We read in the newspapers things like “Stuxnet is the new face of 21-st century warfare: invisible, anonymous, and devastating” and “Very respected scientists have compared nuclear arms race to cyber arms race.” Really? Is it really a cyber arms race?
The Path to Cyberwar started with Kosovo in the late 1990’s. It was the first war where information and disinformation over the Internet became very important. NATO forces were often fooled by this information. They were so reliant on aerial surveillance that the Serbs put up fake tanks, fake heat sources so as to divert campaigns.
But are these examples of cyber warfare?
While Stuxnet was called a “Digital Apocalypse” it was really “just” a DOS attack. Iran possesses weapons grade reactors, and that's what Stuxnet damaged. No people were injured. It was not even close to a digital Hiroshima. The fallout of nuclear weapons is much, much worse than cyber weapons. Terms like these seriously devalue what real war looks like. A real act of war has to be violent, purposeful and political. Stuxnet does not meet this criteria. It’s as if we in the security industry have been talking about viruses that could destroy hard drives for years. Now that we finally got one, we cry “APT!”
Below is what real warfare looks like:
(The aftermath of Hiroshima, Japan in 1945)
(Fallujah during the War in Iraq)
All of this matters for multiple reasons:
Who are the possible targets in “cyberwar”?
The US has more to lose than anyone else because of the way its economy is linked to the online world. If you have the widest attack surface, your opponent’s strength lies in your weakness. People with no reliance on cyber are the biggest threats because they don't need to worry about defense. They also don't worry about the threat of retaliation because they don't care about the loss of human life.
There is also the problem of “attribution pollution.” What happens when you don't know who the enemy is? Is it civilian? Military? False flag (i.e., a diversion to make it look like it came from someone else)? Furthermore, there is implausible deniability - if you did it, why would you ever admit it? Unless you are declaring war? Ultimately, we must reduce the hype and increase our knowledge, and take responsibility for our own cyber hygiene: harden and strengthen defenses, include code review and test processes, educate people to the risks they face but with a practical slant that they can use.
Those are my notes from Lee’s session at VB. I thought it was a good talk with plenty to think about.