mais ce n’est pas la guerre.
This is what I was thinking as I read John Arquilla’s intriguing article on cyberwar at Foreign Policy, “Cool War: Could the age of cyberwarfare lead us to a brighter future?”
Here’s his thesis:
On balance, it seems that cyberwar capabilities have real potential to deal with some of the world’s more pernicious problems, from crime and terrorism to nuclear proliferation. In stark contrast to pitched battles that would regularly claim thousands of young soldiers’ lives during Robert E. Lee’s time, the very nature of conflict may come to be reshaped along more humane lines of operations. War, in this sense, might be “made better” — think disruption rather than destruction. More decisive, but at the same time less lethal.
To which one can only add, “I hope so.” But one is reminded of Clausewitz’s warning that once you unleash the dogs of war, it’s hard to know where the escalation of violence will stop: “War is an act of violence pushed to its utmost bounds.” The side that holds back, loses.
So either cyberwar is not real war, or, which may be saying the same thing, it won’t replace violence but be merely an adjunct to it.
Slightly East of New 
I contend that many of the cyberwarfare techniques are the same as used for other kinds of attacks and compromises … especially those financially motivated … and have been around for decades or more. A recent long-winded rant in linkedin “Financial Crime Risk, Fraud and Security” discussion: http://www.garlic.com/~lynn/2012i.html#18 about latest Zeus/Spyeye fraudulent financial transfers. Pieces from the post:
mid-90s, industry conferences would have presentations by consumer dial-up online banking operations about why they were moving to internet; in large part the expense of supporting proprietary dial-up operations and customer support issues with serial-port modems … which effectively are offloaded to the customers’ ISP. However, the commerical/business dialup online banking/cash-management operations claimed that they would *NEVER* move to the internet … for a long list of security&exploit reasons … all of which have been seen in the period since then. More recent, there have been various recommendations for businesses to have a dedicated PC that is *NEVER* used for anything else but online banking … as a countermeasure to many of the exploits (and semi-partial simulation of days of dialup online banking before the internet).
….
I’ve periodically made the analogy of retargeting the safe, closed, private local lan support to the wild anarchy of the internet, to shoving somebody out an airlock in open space w/o a spacesuit.
…
Trivial analogy is being in a valley with no cover, being surrounding on all sides by the enemy holding the high ground.
That’s a rather rose-colored view of things. I think John Robb over at Global Guerillas has a more sober understanding of where we are headed with this, and it doesn’t seem nearly as pretty:
http://globalguerrillas.typepad.com/globalguerrillas/2012/06/the-us-started-a-new-arms-race-everyone-is-invited-to-join.html
I think Robb is of the “an adjunct” to it, especially when combined with the evolution of drones and bots, except that this adjunct is no longer the soul province of the State, which makes things infinitely messier.
a little recent followup on previous post
The Intersection Between Cyberespionage And Cybercrime; Chinese cyberspies and traditional cybercriminals are relying on some of the same malware tools — and some cyberspies even appear to be moonlighting
http://www.darkreading.com/threat-intelligence/167901121/security/attacks-breaches/240002514/the-intersection-between-cyberespionage-and-cybercrime.html
lhw0,
You know, I’ve always wondered how effective “soldier hackers” would be. Perhaps its just my warped orientation from The Girl With the Dragon Tattoo, but how many people who would be good at hacking will also subject themselves to military discipline, including all the bureaucratic BS that goes along with it? This is a problem that the special ops community has grappled continuously with since its modern inception.
Cyberware provides an enemy with the fortuity to CTRL-C, CTRL-V your weapons and utilize them right back against the original intruder.
Thanks, hauta. I’m sure we’ll get more comments on that.
I wonder if the more we add something that acts like intelligence to our weapons, the more we make them susceptible to the weaknesses of sentience — deception, ambiguity, fast transients, etc. For all of its other shortcomings, it’s pretty hard to confuse or deceive a bullet or an iron bomb.
I posted a recent comment over in the USNI blog … I’ve participated in some sessions about cybersecurity graduate programs. A major issue is that students want to spend all their time attacking & looking for exploits … it is peer-group thing garnering points for discovering the latest exploit. It was very difficult to motivate them to work on designing secure systems and exploit countermeasures. The annual (old timers) hackers conference is mostly white hats and those that build stuff … as opposed to black hats and attackers (although the white hats having built a lot of stuff, have the necessary knowledge to attack if required). Late 80s CBS 60 mins wanted to do a segment … there was several months of negotiations that they promised not to sensationalize the conference. When the segment appeared … it was about secret group in the santa cruz mountains plotting to take over the world. Later, the producer made some comment about “we’re 60 mins, you believed us?”.
Gov. service tends to result in looking at defenses from a relatively narrow perspective. Significant number of attacks are “out-of-the-box”, I’ve heard info assurance people effectively say that it wasn’t fair … they hadn’t been asked to consider such attacks. There are also lots of infrastructure with vested interest in preserving status quo … even if there are lots of vulnerabilities. I’ve done a number where nearly all vulnerabilities were eliminated by slightly tweaking the paradigm but it would have required lots of stakeholders giving up something and they wouldn’t make the change.
As I said, hauta, it won’t be long.
another followup:
Malware Gets Snoopy
http://www.pcworld.com/article/258245/malware_gets_snoopy.html
from above:
The world of malware has, over the last couple of decades, morphed to become not just a mechanism with which to subvert people’s computers and steal money, but also a way for corporations and sovereign states to conduct cyber espionage.
… snip …
not only have the exploit techniques been known for decades … but the necessary countermeasures have also