The fireworks weren’t only in the sky this past Fourth of July but were seemingly in the Intertubes, too, when U.S. and South Korean government websites were struck by a series of cyber sorties that knocked a few sites off line and left some people seeing red — as in the crimson Communist hue.
Anonymous South Korean intelligence agents blamed North Korea for the attacks — despite presenting no evidence to back the claim. U.S. Rep. Peter Hoekstra (R-Michigan) even called on the administration to retaliate with a "show of force" against the Communist regime.
The congressman’s extreme reaction to a minor web attack is a stark reminder that we’ve entered the age of the cyber wars. It’s also a reminder that there are numerous questions — ethical, legal and even bureaucratic — that need to be sorted out about the rules of engagement before the U.S. launches any cyber volleys in retaliation for an attack or otherwise. The most basic being, what constitutes an attack, how do we identify its source and what’s an acceptable response?
In a battle where the militarized zone exists solely in the ether(net) and where anyone can wield the cyber-equivalent of a 10-ton bomb, how do we fight, let alone find, the enemy? What standard of proof will be used to determine the origin of an anonymous attack?
And how do we know if the anonymous cyberwarrior attacking us is a soldier from the Red Army or just a Jolt-guzzling teen in his mother’s basement. Or, perhaps, a Jolt-guzzling teen who’s also a covert mercenary for the Red Army. Should the U.S. take action against a band of student hackers in China suspected of working for their government if Chinese authorities deny responsibility for their aggression?
Furthermore, if computers running NASDAQ trades are brought to a halt in a cyber attack, is that a criminal offense for the FBI to investigate or a national security incident worthy of a counterstrike? And how will the U.S. respond to freelance cyber warriors who sell their services to any adversary who pays the highest bid?
If U.S. leaders have pondered any of these questions, there’s little available evidence of it. Last year, President Bush signed the Comprehensive National Cybersecurity Initiative, which reportedly addresses some of these questions, but most of the report is classified.
"The U.S government’s view of this has been completely shrouded in silence, and there has never been any public discussion about this. We think that’s a bad thing," says Herbert Lin, director of a 322-page National Research Council study published in April, which concluded that the current U.S. policy and legal framework addressing cyber warfare is "ill-formed, undeveloped and highly uncertain."
"I think there ought to be congressional hearings on the subject," Lin says.
Marcus Sachs, who helped build the military’s first cyber warfare unit in 1998 and helped produce a report last year with recommendations for the president on cybersecurity, agrees with Lin.
"Since the nuclear age started, we’ve been open to public debate about the use and deployment of our nukes, and that’s the conversation we need to have in the world of cyberspace," he says.
Last month, the Defense Department launched a new unified cyber command center that will reside at the National Security Agency and be headed by NSA director Lt. Gen. Keith Alexander. The command, expected to be in full force by October 2010, won’t only defend military networks from attack but will also advise the government on defending non-military government networks and private-sector critical infrastructures and will be responsible for developing offensive cyber warfare weapons and strategies.
There’s little agreement in cyber security circles about what cyber warfare actually means, but the latter could involve anything from surreptitiously infiltrating adversarial computers to siphon intelligence, to full-on cyber assaults against a power grid or air-traffic control network. It might also involve planting disinformation, manipulating the electronic results of an election or sabotaging financial markets through computer networks.
Lin and his researchers cite a case in 1982 in which a rounding off error in software used in the Vancouver stock exchange resulted in a slight devaluation of the stock index that over many months added up to a 48 percent loss. Instead of the index’s true value of 1009.811, it was calculated as 524.881. The glitch was unintentional, but it’s not hard to imagine an intentional software tweak that could go unnoticed for months and collapse a market already under strain.
But no one should think that a U.S. response to cyber attacks would be limited to an assault on enemy networks. Defense officials told The New York Times earlier this year that the U.S. government reserved the right to respond to a cyber attack in any way it chose, including a nuclear strike, with the caveat that this likely wouldn’t be the optimal choice they’d select.
No one knows to what extent the U.S. has already engaged in cyber offensive attacks. In 2007, the Department of Homeland Security grabbed headlines when it released a video to raise alarm about vulnerabilities in the U.S. power grid. The video showed a simulated remote hacker attack against an electrical turbine which caused the turbine to spin out of control and collapse in a cloud of smoke.
The performance might easily have been inspired by a 1982 incident, in which the U.S. sabotaged the Siberian pipeline. After the U.S. learned from a Russian scientist that the Soviets were stealing data on U.S. technology, the CIA hatched a plot to insert a logic bomb into software it knew was headed to Russia to operate pumps, valves and turbines on the Siberian natural gas pipeline. The equipment worked fine initially, but at a pre-programmed time caused excessive gas pressure to build on the valves. The resulting explosion was captured by orbiting satellites and was "the most monumental non-nuclear explosion and fire ever seen from space," according to a former U.S. official who disclosed the incident in his 2004 memoir. Although there were no human casualties, the story might easily have had a different ending.
The situation raises all kinds of legal questions and concerns, says Sachs. "What is the law of war, and how does the Geneva Convention apply in cyberspace? If we poison some software as part of a conflict, is that [considered] a weapon system?"
The National Research Council argues in its report that without a cyber policy established well before it’s really needed, we’re vulnerable to being swayed by hastily-formed arguments in favor of a counterattack the minute a crisis occurs. The July Fourth finger pointing is a minor illustration of this.
Both Lin and Sachs say that the line between a minor cyber incident and an all-out kinetic war is thin and one that we could easily cross if we don’t tread carefully. The first step, they say, is to open the topic to public debate and establish a clear policy to guide us.
