Cyber Conflicts and Small States

Lech J. Janczewski, William Caelli

• Publisher: Routledge
• Year: 2016
• Print ISBN: 9780367597269
• eBook ISBN: 9781317155379
• Edition: 1
• Topic: Ciencias sociales
• Subtopic: Paz y desarrollo global

The probability of a world-wide cyber conflict is small. Yet the probability of forms of cyber conflict, regional or even global, could be argued as being very high. Small countries are usually signatories to military and economic alliances with major world powers but rely heavily on the technical ability of these powers in protecting their own national interests. They may be considered to be IT 'technology colonies'. Their cyber infrastructure is usually fully imported and their ability to assess it is limited. This book poses the question: to what extent should, or can, a small country prepare itself for handling the broad range of cyber threats? Looking at cyber-warfare, cyber-terrorism, cyber-crime and associated concerns, national experts from New Zealand, Australia, The Netherlands, and Poland present analyses of cyber-defence realities, priorities and options for smaller countries. They show that what is needed is the ability of small nations to be able to define and prepare appropriate responses such as the role of military/law enforcement/business entities, continuity and resilience strategies, incident response and business continuity plans and more for handing nationally-aimed cyber-attacks particularly where these address national critical infrastructures.

Chapter 1
Introduction

Lech J. Janczewski and William Caelli

Up until the late 1980s the political structure of the world appeared to be well defined. There were essentially two centres or foci of military and economic power: the so called Capitalist West (grouped around USA which had taken dominance after World War II) and the Communist East (grouped around the Soviet Union and China with a vague association with India). These centres appeared to be strongly opposed to each other and were doing everything possible to neutralise or damage the international influence of the other side. Cooperation between the two groups was fairly limited. Defence attention was concentrated on this perceived binary divide.

Four developments destroyed this 'perfect' world:

1. Towards the end of the 1980s the east European block of communist countries, including Russia, disintegrated completely while China underwent a dramatic economic transformation substantially eroding and changing the foundations of their original strict communist doctrine.
2. Rapid development of connections to the global Internet from the mid-1990s, based around easy-to-use computer interfaces, resulted in making the Earth appear as one big village where everybody talks to everybody, and what is even more important, every organisation or individual became able to trade with any other located anywhere on the globe making global free markets possible.
3. Protection of the now critical information infrastructure rapidly became a national factor in defence policy while at the same time it became an increasing object of attack for varying purposes including terrorist, criminal, political and allied reasons.
4. The rise of Asian and Southeast Asian nations and economies, particularly China, as major factors internationally and the move to manufacture ICT products in China as well as to develop and support information systems and software services in India.

Information systems (IS) technology, with associated low cost, commodity level products, systems and services offered new methods of putting pressure on or of attacking an opposing country in any national interest. As a result many governments added to their military commands (like earlier army, navy and air forces, etc.) a new entity dimension, a cyber-force while at the same time deploying commercial-off-the-shelf or COTS products into critical national defence networks and systems. These new military entities, along with their logistic supports, prepared many policy documents outlining their conditions of involvement and modus operandi in the case of a cyber-threat to their countries which were, in turn, studied and expanded by global think tanks such as the USA's Rand Corporation, and others. These documents proposed totally new foundations for defence in the cyber-realm involving a partnership with the private/commercial sector.

There is another aspect of mass deployment of these low-cost, commodity level and largely unprotected information systems technologies and products, namely the growth of cyber-related crime and even so-called cyber-terrorism and cyber warfare. John Arquilla, a pioneer in the analysis of such cyber conflict, has characterised this situation as being comprised of three overlapping aspects as follows:

There are three basic domains: the military, where armed forces clash; the social, in which ideas are used to motivate action; and the economic, where infrastructure, commerce and intellectual property are the targets. These categories may overlap a bit at the edges; nevertheless, they are still quite useful for thinking about the world's cyber wars. (Arquilla 1997)

This clearly follows on from Arquilla's early work in the 1990s at Rand Corporation in the USA (Arquilla and Ronfeldt 1997).

It could be argued that robbing a bank at gun point or throwing a bomb is gradually being replaced by the launch of a malware element against that global information infrastructure, bringing cash to the attacker or destroying an opponent's vital national information infrastructure or even the critical infrastructure it controls. Moreover, the attacker could be safely located on the opposing side of the planet! As a result many nations and regional groupings have prepared policies on how to deal with such threats. Such policies are generally known as cyber-strategies, or digital policies and they largely relate to so-called digital economies, a term and concept now being understood and embraced by politicians and governments worldwide.

A review of major publications related to such cyber-threats, like war, terrorism and crime shows an interesting fact. These publications are written from the perspective of major world powers. The most characteristic example of such an emphasis can be seen in the book Cyber War: The Next Threat to National Security and What to Do About It, written in 2010 by Richard A. Clarke and Robert K. Knake. In practical terms their book presents considerations about the possible development of a conflict between the USA and China or Russia (Clarke and Knake 2010).

It can be argued that the probability of a worldwide cyber conflict is very small. On the contrary, however, the probability of local cyber conflict (in a form of regional cyber warfare or cyber-attack) could be argued as being very high. As a matter of fact such attacks have already been widely reported as having taken place, e.g. in Estonia. Georgia and Iran. Small countries usually are signatories to military and economic alliances with major world powers (USA, Russia, China, etc.) and rely heavily on the technical ability and products of these powers in protecting their national interests, e.g. the UKUSA agreement, now over 50 years old, involving the USA, UK, Canada, Australia and New Zealand.

A popular statement says the best form of defence is attack. Hence to defend themselves a small country may ask its 'big brothers' for help. This attack sentiment was echoed on 19 March 2015 with the following reported statement made to the USA's Senate Armed Services Committee (Lyngaas) by the US Cyber Command commander. Admiral Michael Rogers:

We focused primarily on the defensive piece initially |...| but I think now we're at a tipping point, where more attention needs to be paid to offensive capabilities [...] think about how can we increase our capacity on the offensive side [...]?

An open question could be that, despite existing treaties, the extent to which world powers would be interested in helping launch counter-offensive attacks in defence of the associated cyber-mouse? Going further, the next question could be. to what extent should, or can each small country prepare itself for handing cyber conflict, cyber-war, cyber-terrorism and cyber-crime issues? At the same time, responses by small countries may not occur through normal and traditional organs of state or defence entities but rather through the uncoordinated actions of sympathetic citizens and private enterprises. There is already strong evidence of this phenomenon. At the same time, as discussed later, cyber conflict may be inherently highly asymmetric with less cost to mount an attack versus much higher costs to defend particularly where the defender has minimal understanding and capabilities in relation to the information technologies employed.

A review of current literature in the area shows that there are many publications dealing with various aspects of cyber-war, cyber-terrorism and cyber-crime problems. The majority of these publications present issues from the perspective of the world's major powers. However, we could find only a very few publications dealing with the overall problem of managing cyber threats against vital interest of smaller countries or even smaller regions, states or even cities.

'National Cyber Strategy'. 'National Digital Strategy', 'Digital Economy' and so on are the titles of various examples of general policy documents. But what is really needed is the ability for small nations to go one step down, that is. to be able to prepare documents/procedures, such as continuity and resilience strategies, including business impact analyses, incident response plans and business continuity plans for handing nationally-aimed cyber-attacks particularly addressing national critical infrastructure. This may even involve mandatory hardening of critical national information infrastructure against increasingly sophisticated attack. At the same time small countries usually do not have homegrown information and communications technology industries, in the specific sense of R&D, manufacture, marketing and support of actual computers and data network equipment. They depend upon imports in toto and in most cases may be unfamiliar with the actual security status of such equipment. In this other world there is a notable lack of publications outlining a systems approach to a small nation's cyber security.

For the purpose of this book we define a small country as a country which is not a member of the G20 nation's forum. The G20 members are: Argentina. Australia, Brazil, Canada, China, France, Germany, India, Indonesia, Italy, Japan, the Republic of Korea, Mexico, Russia, Saudi Arabia, South Africa, Turkey, United Kingdom and United States of America. However, policy documents from some of these, particularly smaller members such as Australia, which mirror that total ICT product and system import dependence, need to be examined as exemplars.

Within the world society of the twenty-first century we are facing a new phenomenon: cyber-wars or cyber conflicts. Every country should be prepared to handle these. But, as a new phenomenon, it cannot be handled using a piecemeal approach Piecemeal denotes something being done piece by piece or one stage at a time with little to no coordination; in other words, search and execution of a part of a problem occurs most likely without understanding all possible aspects.

Cyber-attacks on a wider scale are a relatively young phenomenon, practically not much older than about 20 years. As a result of hackers' activities, major world powers launched strategic studies in this field. One of the first publications about this topic was the Rand Institute Report from 1996 (Mollander 1996). Many-publications followed, but most of them were and are written from the perspective of major world powers.

All countries could be subjects of cyber-attacks: world powers and small countries alike. The intention of this book is to present a set of issues related to the problem of small countries handling cyber-threats and actual cyber-attack, both failed and successful.

As a new problem, we took a systems approach to discussing this. This means that apart from showing possible practical defences (outlined in the final two chapters) we presented wider aspects of the problem. The reader may find justification of this approach in Chapter 7.

The book contains the following parts:

Chapter 2: Information Technology’s Cultural Setting: Some Considerations

This chapter sets out to raise some considerations concerning the cultural and technological settings of cyber security. Cyber security is. after all. based on computers and the products of information and communications technologies (ICT). ICT technologies and products are made by a few companies and in a few nation states but are used by people all over the world and in a great variety of cultural milieu. Technical solutions must consider the many different cultural settings in a sociologically sympathetic manner.

Chapter 3: Small States in the Cyber Age: Swimming Safely in the Ocean of Data

The global Internet changes the way we need to think about the way states relate to each other, and to the world around them. For small states, the impact may well be very significant, depending on events and circumstances facing any state, and on the way each deals with the threats and opportunities it faces on the Internet, and its changing wider place in the world. There are strategies open to small states to meet the new environment as best they can. but nonetheless small states face real challenges from the Internet and the data revolution, which are likely to lead to significant change in states' roles and relationships as this century unfolds.

Chapter 4: An Overview of the Unique ICT Situation of Small States

This chapter presents an overview of the position of the ICT industry and market in small countries in the second decade of the twenty-first century. This is carried out by way of the description of the current situation of this industry in these countries and by looking at this issue from the world's perspective and in the function of time. In this way the major trends could be defined, allowing not only understanding the current situation but what would, even more importantly, provide help for development of a prognosis for the future.

Chapter 5: Current Cyber Wars

With the cyber landscape being seen as a theatre for war, countries are increasingly developing new military branches focused on cyber warfare. No longer is the focus just on the warfare realms of land, sea and air; space and cyber realms are now considered the fourth and fifth arenas. While countries have had cyber warfare capabilities for some time, the increasing number of countries establishing formal cyber warfare capabilities brings cyber warfare further into the open and highlights the growing threat. Most notably, cyber warfare units now form part of the military of the United States, United Kingdom. North Korea, Israel, China, India and Russia, among others. This chapter presents example of more known cyber-based attacks on a greater scale in recent years.

Chapter 6: National Cyber Security Organisation (Parts I-IV)

This chapter focuses on reviews of cyber-security arrangements undertaken by several small countries: the Netherlands, New Zealand, Australia and Poland.

Chapter 7: Security of Small Countries: Summary and Model

One of two summary chapters of the book, this chapter covers all issues facing small countries' cyber-defences. The problems are collected here and relations between them presented in the form of a model.

Chapter 8: Prognosis and Countermeasures

This is the final chapter of the book. On the basis of all the collected information we present our assessments of the future development in the domain of cyber-attacks against small countries. Also we list a number of recommended steps which these countries could consider to apply to strengthen their resistance against cyber-attacks.

References

Arquilla. J., The Three Faces of Cyber War, http://cacm.acm....

Table of contents

• Cover
• Half Title
• Title
• Copyright
• Contents
• List of Figures
• List of Tables
• Notes on Contributors
• Acknowledgements
• 1 Introduction
• 2 Information Technology’s Cultural Setting: Some Considerations
• 3 Small States in the Cyber Age: Swimming Safely in the Ocean of Data
• 4 An Overview of the Unique ICT Situation of Small States
• 5 Current Cyber Wars
• 6 National Cyber Security Organisation
• 7 Security of Small Countries: Summary and Model
• 8 Prognosis and Countermeasures
• Index