On Cyberwar Hype
Good article by Thomas Rid on the hype surrounding cyberwar. It’s well worth reading.
And in a more academic paper, published in the RUSI Journal, Thomas Rid and Peter McBurney argue that cyber-weapons aren’t all that destructive and that we’ve been misled by some bad metaphors.
Some fundamental questions on the use of force in cyberspace are still unanswered. Worse, they are still unexplored: What are cyber ‘weapons’ in the first place? How is weaponised code different from physical weaponry? What are the differences between various cyber-attack tools? And do the same dynamics and norms that govern the use of weapons on the conventional battlefield apply in cyberspace?
Cyber-weapons span a wide spectrum. That spectrum, we argue, reaches from generic but low-potential tools to specific but high-potential weaponry. To illustrate this polarity, we use a didactically helpful comparison. Low-potential ‘cyber-weapons’ resemble paintball guns: they may be mistaken for real weapons, are easily and commercially available, used by many to ‘play,’ and getting hit is highly visible—but at closer inspection these ‘weapons’ will lose some of their threatening character. High-potential cyber-weapons could be compared with sophisticated fire-and-forget weapon systems such as modern anti-radiation missiles: they require specific target intelligence that is programmed into the weapon system itself, major investments for R&D, significant lead-time, and they open up entirely new tactics but also novel limitations. This distinction brings into relief a two-pronged hypothesis that stands in stark contrast to some of the debate’s received wisdoms. Maximising the destructive potential of a cyber-weapon is likely to come with a double effect: it will significantly increase the resources, intelligence and time required to build and to deploy such weapons—and more destructive potential will significantly decrease the number of targets, the risk of collateral damage and the coercive utility of cyber-weapons.
And from the conclusion:
Two findings contravene the debate’s received wisdom. One insight concerns the dominance of the offence. Most weapons may be used defensively and offensively. But the information age, the argument goes since at least 1996, has ‘offence-dominant attributes.’ A 2011 Pentagon report on cyberspace again stressed ‘the advantage currently enjoyed by the offense in cyberwarfare.’ But when it comes to cyber-weapons, the offence has higher costs, a shorter shelf-life than the defence, and a very limited target set. All this drastically reduces the coercive utility of cyber-attacks. Any threat relies on the offender’s credibility to attack, or to repeat a successful attack. Even if a potent cyber-weapon could be launched successfully once, it would be highly questionable if an attack, or even a salvo, could be repeated in order to achieve a political goal. At closer inspection cyber-weapons do not seem to favour the offence.
A second insight concerns the risk of electronic arms markets. One concern is that sophisticated malicious actors could resort to asymmetric methods, such as employing the services of criminal groups, rousing patriotic hackers, and potentially redeploying generic elements of known attack tools. Worse, more complex malware is likely to be structured in a modular fashion. Modular design could open up new business models for malware developers. In the car industry, for instance, modularity translates into a possibility of a more sophisticated division of labour. Competitors can work simultaneously on different parts of a more complex system. Modules could be sold on underground markets. But if our analysis is correct, potential arms markets pose a more limited risk: the highly specific target information and programming design needed for potent weapons is unlikely to be traded generically. To go back to our imperfect analogy: paintball pistols will continue to be commercially available, but probably not pre-programmed warheads of smart missiles.
The use of this weapon analogy points to a larger and dangerous problem: the militarisation of cyber-security. William J Lynn, the Pentagon’s number two, responded to critics by pointing out that the Department of Defense would not ‘militarise’ cyberspace. ‘Indeed,’ Lynn wrote, ‘establishing robust cyberdefenses no more militarizes cyberspace than having a navy militarizes the ocean.’ Lynn may be right that the Pentagon is not militarising cyberspace—but his agency is unwittingly militarising the ideas and concepts to analyse security in cyberspace. We hope that this article, by focusing not on war but on weapons, will help bring into relief the narrow limits and the distractive quality of most martial analogies.
Here’s an article on the paper.
One final paper by Rid: “Cyber-War Will Not Take Place” (2012), Journal of Strategic Studies. I have not read it yet.
Subscribe to comments on this entry
Peter Austin • March 14, 2012 8:21 AM
Patents seem to be effective cyberwar weapons. See e.g. Oracle vs Google, Yahoo vs Facebook, Apple vs Android.
E.g. in the case of drug patents that block the availability of medicines in poorer countries, it is difficult to argue that they have not caused the loss of any hman lives.