Cyberspaces and Global Affairs

Sean S. Costigan, Jake Perry

• Publisher: Taylor & Francis
• Year: 2016
• Print ISBN: 9781409427544
• eBook ISBN: 9781317155195
• Edition: 1
• Topic: Politics & International Relations
• Subtopic: Globalisation
• Index: Politics & International Relations

From the "Facebook" revolutions in the Arab world to the use of social networking in the aftermath of disasters in Japan and Haiti, to the spread of mobile telephony throughout the developing world: all of these developments are part of how information and communication technologies are altering global affairs. With the rise of the social web and applications like Facebook, YouTube and Twitter, scholars and practitioners of international affairs are adapting to this new information space across a wide scale of issue areas. In conflict resolution, dialogues and communication are taking the form of open social networks, while in the legal realm, where cyberspace is largely lawless space, states are stepping up policing efforts to combat online criminality and hackers are finding new ways around increasingly sophisticated censorship. Militaries are moving to deeply incorporate information technologies into their doctrines, and protesters are developing innovative uses of technology to keep one step ahead of the authorities. The essays and topical cases in this book explore such issues as networks and networked thinking, information ownership, censorship, neutrality, cyberwars, humanitarian needs, terrorism, privacy and rebellion, giving a comprehensive overview of the core issues in the field, complemented by real world examples.

PART I

Chapter 1
Cyberwar: A Real and Growing Threat

Nat Katin-Borland

Major cyberspace vulnerabilities will be used against us. For many, the cyber threat is hard to understand. They think that these cyber attacks are unfortunate, but are just a cost of doing business, just a minor nuisance … No one has ever died in a cyber attack, after all, there has never been a smoking ruin for cameras to see. Such reasoning is dangerous. Implicit in such thinking is the unarticulated notion that the only cyber attacks that can happen in the future are those similar to what has happened in the past. (Clarke 2003: 1–2)

Richard Clarke, former Counter-Terrorism Official, U.S. National Security Council

Like nuclear radiation, cyberwar doesn’t make you bleed, but it can destroy everything. (cited by Davis 2007)

Ene Ergma, Speaker of the Estonian Parliament

Introduction

Cyberspace is an ever-expanding global digital network that links many aspects of life, including social, business and military communications. The Internet has collapsed boundaries and empowered individuals in previously unimaginable ways. While new technologies allow for enormous gains in efficiency, productivity and communications, they also create new vulnerabilities and threats for technologically advanced nations and their citizens. Many computer systems around the world are interconnected through mostly public telecommunications infrastructure. Thus, the digital tools used by individuals, companies and states are vulnerable to infiltration by groups seeking to compromise the security of computerized systems. The modern global computer networks that enable instant communication and rapid digital transactions also present a back door into the inner workings of state activities. To penetrate the network of another state is to unlock its secrets and control its critical infrastructure. Today, cyberspace is rapidly becoming both the new battleground for conflicts between states and the next frontier that needs to be secured in the name of national security.

The U.S. military and security services have long incorporated notions of “information warfare” into military doctrine and operational planning. John Alger, a former dean of the School of Information Warfare and Strategy at National Defense University, has written that information warfare “consists of those actions intended to protect, exploit, corrupt, deny, or destroy information or information resources in order to achieve a significant advantage, objective, or victory over an adversary” (Schwartua 1996: 12). An August 2006 directive from the Secretary of Defense (Department of Defense Directive S-3600.1: 3) argues that information warfare “contributes to information superiority by both defending military decision-making from adversary attacks and by influencing and degrading an adversary’s decision-making capability, thereby producing an information advantage. [Information Operations] contributes directly to the national security strategy, which uses all elements of national power in a synchronized and coordinated manner to influence adversary perceptions and behavior.” The directive continues:

In peacetime, IO supports national objectives primarily by influencing adversary perceptions and decision-making. In crises short of hostilities, IO can be used as a flexible deterrent option to demonstrate resolve and communicate national interest to affect adversary decision-making. In conflict IO may be applied to achieve physical and psychological results in support of military objectives. During post conflict or stability operations, IO continues to support national objectives and influence foreign perceptions. (DOD Directive S-3600.1: 3)

For the purposes of this chapter, these definitions are rather unhelpful. To begin with, they assume that information operations take place against a specific adversary, in a definable battle space and in conjunction with on-the-ground operations in an actual war. Furthermore, these conceptions of information warfare assume that a clear line can be drawn between wartime and peacetime. I prefer John Arquilla and David Ronfeldt’s more fluid notions of cyberwar and netwar: “Netwar refers to information-related conflict at a grand level between nations or societies. It means trying to disrupt or damage what a target population knows or thinks it knows about itself and the world around it. A netwar may focus on public or elite opinion … It may involve, diplomacy, propaganda and psychological campaigns … or infiltration of computer networks and databases” and cyberwar “refers to conducting military operations according to information-related principles. It means disrupting or destroying information and communications systems. It means trying to know everything about an adversary while keeping the adversary from knowing much about oneself. It means turning the ‘balance of information and knowledge’ in one’s favor, especially if the balance of forces is not” (Arquilla and Ronfeldt 1995). Cyberwar and netwar are as much intellectual challenges as they are military classifications. In a cyberwar, success comes to those who embrace the decentralized power of the Internet, challenge existing command hierarchies and “redraw the boundaries around which institutions and their offices are normally built” (Arquilla and Ronfeldt 1995). These terms also imply that, in the digital wars of the future, many conflicts may fall short of actual armies meeting on the battlefield.

In reality, a cyber attack can occur at any time and may not always be associated with political or economic activities or any actual military operations. Additionally, because identity can be concealed so easily online, it is unlikely that the source of an attack will be readily apparent. That being said, as recent U.S. action in Iraq and Russian action in Georgia have demonstrated, it is now common practice to bring down the network of a country prior to invasion with actual ground troops (McWilliams 2003; Danchev 2008). Still, the primary concern of this chapter is cyberwar— actions that use computers and computer networks to inflict damage against the recipient. This is not to imply that causalities cannot occur in a cyberwar. On the contrary, one can imagine a scenario where an attack takes place against a hospital’s computer network, for example, and in the resulting chaos patients die as heart monitors go offline and medical records disappear. In a cyberwar, the traditional dichotomies of wartime and peacetime, civilian and military, and battlefield and home front are collapsed. When cyberspace is the battlefield, all members of society can potentially be drawn in. These primarily web-based actions can be perpetrated by a variety of actors—including individual hackers, terrorists, criminal syndicates and states, just to name a few—for a variety of reasons. This chapter focuses primarily on state-centric cyber actions, that is, cyber attacks perpetrated by one state against another.

Unfortunately, it is not a question of if a serious cyber attack will occur in the U.S., but a question of when. Estonia, for example, has already experienced a mild cyberwar. Each year, the Pentagon fends off tens of thousands of hackers (in 2007, 43,880 “malicious incidents” were reported; Wagley 2008). Even if the vast majority of these incidents were the work of amateur hackers and not foreign governments, there is clearly a vulnerability of crucial digital infrastructure in the U.S. The time to act is now, before the network is seriously attacked. In 1996, the President’s Commission on Critical Infrastructure Protection warned,

In the past we have been protected from hostile attacks on the infrastructures by broad oceans and friendly neighbors. Today, the evolution of cyber threats has changed the situation dramatically. In cyberspace, national borders are no longer relevant. Electrons don’t stop to show passports. Potentially serious cyber attacks can be conceived and planned without detectable logistic preparation. They can be invisibly reconnoitered, clandestinely rehearsed, and then mounted in a matter of minutes or even seconds without revealing the identity and location of the attacker. (Denning 1999: 75)

Similar to terrorism, the threat has long been identified, but clear action on cyber security has yet to take place.

This chapter proceeds by first identifying instances of cyberwar, with a focus on the 2007 attacks against Estonia. Then, to emphasize the potential threat of cyberwar, state-sponsored cyber actions against the U.S. will be reviewed. The third section will document how the U.S. has handled cyber security in the past and will discuss new changes by the Obama administration on the cyber security front. Finally, by way of a conclusion, an international cyber security regime will be discussed as a possible way forward for the U.S. and its allies to shore up cyber security and prepare for a potential cyber attack.

From Cyber Protests to Cyberwar

Advanced, post-industrial societies and economies are critically dependent on networked computer information and communication systems. This information infrastructure helps to drive globalization and knit various states together within a globally interdependent economic system (Castells 1999: 10). This economic and social interconnectedness probably acts as a deterrent against more widespread use of cyberwar tactics since bringing down the network of a trade partner does not make good economic sense. The sophistication and importance of the IT infrastructure that modern society rests upon has itself become a form of vulnerability. Disruption of civilian or government infrastructures is an attractive option for countries that want to engage in asymmetric warfare and lack the capacity to compete with larger powers on the traditional battlefield, or for more powerful countries that want to intimidate weaker competitors. Indeed, so important are information infrastructures in the twenty-first century that an attack against them is at minimum considered a strategic strike and potentially an act of war (DeCenso 2000).

To date, many incidents labeled as cyberwar are better characterized as cyber harassment, cyber graffiti or cyber protests. Cyberwar, however, goes beyond the defacement of websites owned by a rival nation or political movement. Instances of website defacement are probably the work of hacktivists (i.e. overzealous hackers responding to political events) and do not necessarily indicate the involvement of government forces. For example, during the Taiwanese presidential elections in August and September of 1999, pro-Chinese hacktivists defaced approximately 165 Taiwanese websites (Jame 1999). Another example is India and Pakistan engaging in cyber protests caused by national and ethnic differences. After a 2000 ceasefire in the Kashmir Valley, hacktivists took it upon themselves to continue the hostilities and pro-Pakistani hackers defaced more than 500 Indian websites (Wallia 2001). A similar flare-up between nationalist hackers from both countries occurred in 2008, with Indian hacktivists actually taking over several low-level Indian government sites, demanding that the sites be made more secure (Barak 2008).

In October 2000, Israeli and Palestinian hackers engaged in adversarial hacking when the prolonged peace talks between the two groups broke down. During this difficult time, hackers from each side seized the opportunity to attack websites belonging to the opposition. Beginning on 6 October 2000, 166 Israeli websites and at least 15 Palestinian websites suffered defacements at the hands of opposing hackers. In this case, the cyber harassment coincided with physical violence in the region, but there is no evidence that governments were behind the actions (Israeli–Palestinian Cyber Conflict 2001: 9). A similar pattern repeated itself with hostilities in 2006 and 2009 (Harwood 2009).

In the past few years, Japan has been targeted several times in online protests. During the first week of April 2001, pro-Korean hackers attacked Japanese organizations responsible for the approval of a new history textbook. The textbook glossed over atrocities committed by Japan during World War II and the occupation of China and South Korea. The perceived reluctance of Japan to accept responsibility for its actions triggered the protests. The main participants in this incident were Korean university students, who used email bombs in a denial of service (DOS) attack. A DOS attack is designed to bring a network to its knees with an overwhelming amount of traffic. The students crashed several websites, including that of Japan’s Education Ministry and that of the controversial textbook’s publishing company (McMillan 2001). These attacks were neither long-lasting nor organized. In 2001, 2004 and 2008, pro-Chinese hackers targeted Japanese websites after Japan’s Prime Minister visited a controversial war memorial (Heike 2009). The worst attacks occurred in 2001, when hackers defaced several websites belonging mostly to Japanese companies and research institutes. Pro-Chinese hackers have become adept at using cyberspace as a platform for protests and cyber civil disobedience, as well as for displaying a strong sense of patriotic nationalism, but these examples do not necessarily point to Chinese government involvement.

In 2007, Russian-sponsored agents began what has been widely called the first “real” cyberwar against Estonia (Farivar 2007). Starting in late April, websites of various Estonian government entities, the nation’s largest bank and several media outlets were targeted with heavy DOS attacks, grinding traffic on their network to a halt. The attack was in response to the removal of a bronze statue of a World War II-era Soviet soldier from a public park. Estonian authorities were expecting street protests by citizens of Russian descent, but they were not prepared for sustained cyber attacks against their critical network infrastructure. Attribution for the Estonian attacks was made difficult by the fact that a large “botnet” (short for robotic network) was utilized for the attacks, harnessing the power of thousands of computers located around the world. Eventually, Estonian authorities traced the attacks to various rogue Russian nationalist hackers and several computers inside the Kremlin, pointing to Russian government involvement in the attacks (Farivar 2007). Russian officials quickly denied any role in the cyber attacks against Estonia and warned the Estonian government “to be extremely careful when making accusations” (Landler and Markoff 2007). The use of a botnet and the sustained nature of the attacks against Estonia (they peaked on 9 May, Victory Day in Russia, but continued until 18 May), place the incident several degrees of severity above the cyber protests and cyber vandalism described in other contexts. Botnets are also expensive, making it likely that, even if Russian agents did not participate directly in the attacks, they at least provided financial backing. In addition, there was evidence that Russian agents visited chat rooms frequented by nationalist hackers to incite anger against the Estonian government. These forums contained clear instructions on how to send a DOS attack and which Estonian websites to target (Landler and Markoff 2007). Denis Bilunov, executive director of the United Civil Front, a Russian opposition party, confirmed Estonian suspicions of Russian involvement, “There is a specific department with the FSB—the successor to the KGB—that specializes in coordinating Internet campaigns against those they consider a threat. They have attacked Chechen rebel sites, us, and now it appears they have attacked Estonia” (Davis 2007).

Another reason why the cyber attacks against Estonia are unique is because of the role the Internet plays in Estonian life. Estonia, or “eStonia” as some citizens prefer, is known as the most “wired” nation in Europe. All citizens have access to free Wi-Fi, voting in national elections happens online and parliamentary and cabinet-level discussions sometimes take place in Internet chat rooms (Davis 2007). Disabling websites in Estonia is not simply a matter of slowing down networks or blocking access to email, but more like a digital invasion that threatens the government’s ability to provide essential services to its citizens. Estonian Defense Minister Jaak Aaviksoo explained, “The attacks were aimed at the essential electronic infrastructure … All major commercial banks, telcos, media outlets, and name servers—the phone books of the Internet—felt the impact, and this affected the majority of the Estonian population. This was the first time that a botnet threatened the national security of an entire nation” (Davis 2007). Journalist Tuuli Aug reports the loss of control she felt when the attacks started, “It was extremely frightening and uncontrollable because we are used to having Internet all the time and then suddenly it wasn’t...

Table of contents

• Cover Page
• Half Title Page
• Title Page
• Copyright Page
• Contents
• List of Figures
• List of Tables
• Notes on Contributors
• Foreword by Kenneth H. Keller
• Preface
• Acknowledgments
• Glossary
• Part I
• Part II
• Part III
• Index