[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[infowar.de] Securityfocus: Why the Dogs of Cyberwar Stay Leashed
Infowar.de, http://userpage.fu-berlin.de/~bendrath/liste.html
-------------------------------------------------------------
http://www.securityfocus.com/columnists/149
Why the Dogs of Cyberwar Stay Leashed
The United States could try out its much-hyped "cyberwarfare"
capabilities in Iraq... but it would probably be illegal.
By Mark Rasch Mar 24, 2003
As the U.S. and U.K. campaign to "shock and awe" the Iraqi leadership
and population continues, as "bunker buster" bombs hit the Iraqi
Presidential palaces and coalition forces attempt to disrupt the command
and control of the Iraqi military, one widely-reported offensive
capability is nowhere in sight: the United States has not yet officially
used the tools of cyberwarfare.
The U.S. military has reportedly developed impressive offensive cyberwar
capabilities, including the ability to use microwave or other electronic
impulses to disrupt or destroy electronic components. If this is true,
why have we not yet seen an all out cyberwar?
That's not to say we haven't seen any action in cyberspace. Sometimes
individual citizens use hacker-style techniques to attack accessible
sites associated with an opposing country's regime -- like "patriotic"
U.S. citizens hacking Iraqi government sites. But a wartime military
cyber attack would look completely different from these amateur efforts,
and may use entirely different tools.
The goal of a cyber attack might be not mere disruption -- but
destruction. It may be massive misinformation. It may be cooption. Thus,
a cyber attack may go after DNS servers and spoof official government
sites, as a propaganda mechanism. It may take the form of the mythic
HERF (High Energy Radio Frequency) guns, or microwave bombs, or truly
malicious polymorphic viruses or worms designed to destroy networks.
Conventional defenses may not prevent such attacks -- although good
backup and disaster recovery practices may minimize damage.
Much of the hand wringing over the legality of these tactics has
revolved around their use in the absence of armed conflict. Is a cyber
attack an act of war? Is cyber espionage likewise an act in violation of
international law? But as the bombs fall, and the shooting war (declared
or undeclared) begins, these questions are ultimately left behind, and
the same rules for armed conflict govern cyber attacks.
These rules are much clearer, but, paradoxically, they probably make
cyber attacks illegal.
This may seem counterintuitive. If it is okay to bomb an infrastructure
into the stone age, why can't you "logic bomb" them out of the
information age? The answer lies in the nature of the targets and the
weapons chosen. Under the law of armed conflict, the use of force -- and
all out cyberwar is likely a "use of force" -- must follow particular
patterns. A warrior may not deliberately target non-combatants for
attack. The use of force must be "proportional" to objectives, and
reasonable efforts must be taken to minimize collateral damage.
Glass Houses
For cyberwar, this presents problems. First, the vast majority of the
vulnerable infrastructure (electrical generation and distribution,
water, transportation, financial services, telecommunications) are
likely owned or operated by the private sector -- noncombatants, by
definition. And the vast majority of this infrastructure is used by
noncombatants as well. The same telecommunications system that carries
military command and control communications probably supports civilian
emergency medical services as well.
It may not be possible to launch cyber attacks that are effective
against the military that don't also have dramatic consequences for
noncombatants. Attacks of so-called "SCADA" systems -- those that
control things like dams, nuclear power plants, air traffic control
systems, and even street traffic lights -- could result in thousands of
deaths to civilians.
There are other reasons why the U.S. may forgo a cyber attack in Iraq.
It probably serves U.S. and U.K. interests to keep as much of the
infrastructure intact for the time being. For tactical reasons, U.S.
forces want to maintain lines of communication, and minimize disruption
of the civilian population in the opening phases of this conflict. And
in the long run, anything that is destroyed will have to be rebuilt.
Finally, it would set a precedent that could come back to haunt the U.S.
The U.S. and Western nations are much more dependent on electronic
infrastructures than lesser developed countries, so they are rightly
reluctant to establish a legal precedent that permits cyberwarfare.
Cyberwar is asymmetric, which means it benefits lesser military powers
as much as, or even more than, military goliaths. Nobody expects Iraqi
B52's to fly over Washington, D.C., but a handful of Iraqi computer
scientists (or scientists bought with Iraqi oil money) could launch a
cyber attack -- at least to some degree -- against U.S. targets.
There is an old saying about a can of worms -- the only way to close it,
is to use a bigger can. Unleashing a cyberwar anywhere would leave us
with a can of worms the size of Texas.
SecurityFocus columnist Mark D. Rasch, J.D., is the Senior Vice
President and Chief Security Counsel at Solutionary Inc. He lives in
McLean, Virginia.
---------------------------------------------------------------
Liste verlassen:
Mail an infowar -
de-request -!
- infopeace -
de mit "unsubscribe" im Text.