With all the talk about war in cyberspace, the question is....what is it and what does it encompass?
Before we get to that, there's a clue in the spelling of the word: cyberwar instead of cyber war. The U.S. Defense Department has determined that cyber is a fifth domain after air, land, sea, and space. We wouldn't call the World War II battle for domain of the skies an "airwar," or the showdowns over North African terrain "landwar." Yet somehow cyberwar has become the preferred term. The oddity of the convention reflects the fact that cyberwar is not quite "war," not quite "cyber," yet it is so palpably real that most developed and developing nations are standing up their own cyber commands to engage in it.
The problem, of course, is that no one can agree on what constitutes an act of cyberwar. There is as yet no international treaty in place that establishes a legal definition for an act of cyber aggression. In May, the Pentagon released a cyber strategy, but U.S. senators have complained recently that there's still no clarity on what, exactly, would be considered an act of cyberwar. The United States is not alone here: The entire field of international cyber law is still murky.
For a look at this confusing space, let us consider three examples of cyber attacks that may or may not be considered cyberwar.
One cyberwar scenario played out between June 2009 and July 2010, when Iran discovered it was the target of the most sophisticated cyber attack on record, known as Stuxnet. Iran suffered tangible losses of up to 1,000 P-1 centrifuges and experienced a slowdown in its uranium enrichment process. The damages, however, were minimal, and that appeared to be by design. The Stuxnet code specified that only a certain number of centrifuges were to be affected and that the damage was to be done slowly, over a period of months. It was clearly an act of sabotage—but was it an act of war?
Just this past week, McAfee released a white paper describing a very large cyber espionage operation, which the firm dubbed Shady RAT. The ring appears to have been in operation for five years and may have hit up to 70 global companies, governments, and nonprofit organizations. Shady RAT may or may not be all that McAfee claims; its competitors Symantec and Kaspersky have criticized it. However, it does serve to demonstrate the scope and scale of one type of cyber espionage operation that targets intellectual property. While espionage between nation states has never been considered grounds for going to war, it has also never occurred at this scale. And if a country's national objectives of accumulating power, influence, and resources can be done virtually instead of on the battlefield, then should cyber espionage be considered a new type of warfare?"
Comments