2016 8th International Conference on Cyber Conflict: Cyber Power N.Pissanidis, H.Rõigas, M.Veenendaal (Eds.) 31 MAY - 03 JUNE 2016, TALLINN, ESTONIA 2016 8TH International ConFerence on CYBER ConFlict: CYBER POWER Copyright © 2016 by NATO CCD COE Publications. All rights reserved. IEEE Catalog Number: CFP1626N-PRT ISBN (print): 978-9949-9544-8-3 ISBN (pdf): 978-9949-9544-9-0 CopyriGHT AND Reprint Permissions No part of this publication may be reprinted, reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of the NATO Cooperative Cyber Defence Centre of Excellence ([email protected]). This restriction does not apply to making digital or hard copies of this publication for internal use within NATO, and for personal or educational use when for non-profit or non-commercial purposes, providing that copies bear this notice and a full citation on the first page as follows: [Article author(s)], [full article title] 2016 8th International Conference on Cyber Conflict: Cyber Power N.Pissanidis, H.Rõigas, M.Veenendaal (Eds.) 2016 © NATO CCD COE Publications PrinteD copies OF THIS PUBlication are availaBLE From: NATO CCD COE Publications Filtri tee 12, 10132 Tallinn, Estonia Phone: +372 717 6800 Fax: +372 717 6308 E-mail: [email protected] Web: www.ccdcoe.org Head of publishing: Jaanika Rannu Layout: Jaakko Matsalu LEGAL NOTICE: This publication contains opinions of the respective authors only. They do not necessarily reflect the policy or the opinion of NATO CCD COE, NATO, or any agency or any government. NATO CCD COE may not be held responsible for any loss or harm arising from the use of information contained in this book and is not responsible for the content of the external sources, including external websites referenced in this publication. NATO Cooperative CYBER DeFence Centre OF EXcellence The Tallinn-based NATO Cooperative Cyber Defence Centre of Excellence (NATO CCD COE) is a NATO-accredited knowledge hub, think-tank and training facility. The international military organisation focuses on interdisciplinary applied research and development, as well as consultations, trainings and exercises in the field of cyber security. The Centre’s mission is to enhance capability, cooperation and information-sharing between NATO, Allies and partners in cyber defence. The heart of the NATO Cooperative Cyber Defence Centre of Excellence is a diverse group of international experts on cyber security. They include legal scholars, policy and strategy experts as well as technology researchers with military, government and industry backgrounds. Membership of the Centre is open to all Allies. Currently, the Czech Republic, Estonia, France, Germany, Greece, Hungary, Italy, Latvia, Lithuania, the Netherlands, Poland, Slovakia, Spain, Turkey, the United Kingdom and the United States have signed on as Sponsoring Nations of the Centre. Austria and Finland have become Contributing Participants – the status available for non-NATO nations. Furthermore, Sweden and Belgium have announced their intent to join the Centre and the respective negotiations are ongoing. The Centre is staffed and financed by its sponsoring nations and contributing participants. The Centre is not part of NATO command or force structure, nor is it funded from the NATO budget. Many of the Centre’s publications, as well as a number of interactive databases, are accessible through www.ccdcoe.org. CYCON 2016 Sponsors ForeWorD This is the eighth time that the annual International Conference on Cyber Conflict (CyCon 2016), organised by the NATO Cooperative Cyber Defence Centre of Excellence, is held in the historic city of Tallinn, the capital of Estonia. Over the years the CyCon conferences have proved to be world-recognised forums addressing cyber conflict and security and their implications for society, business and world affairs. Every year the CyCon conference focusses on a specific aspect of cyber conflict. In 2013, the conference discussed the roles and methods of automated cyber defence and in 2014, it concentrated on active cyber defence. The focus of CyCon 2015 was on architectural aspects of cyberspace. CyCon 2016 concentrates its attention on ‘Cyber Power’, which can be viewed from very different angles. One might look at it as the ability to exert one’s will over the adversary via cyber operations while maintaining the security of one’s own systems; or through the perspective of controlling the development and production of software and hardware; or as the issue of trying to make oneself impervious to cyberattack by severely limiting one’s dependency on information technology. The possible viewpoints are as different as the actors that discuss them. As is true for all CyCon conferences, the notion of ‘Cyber Power’ is examined from information technology, strategic, legal, and policy perspectives, in order to provide a comprehensive and well-informed view. We would like to thank the members of the CyCon 2016 Academic Review Committee and the distinguished peer reviewers for their tireless work in identifying papers for presentation at the conference and for publication in this book. Last, but not least, we are delighted to congratulate the dedicated editors of this volume. Dr Gabriel Jakobson Chief Scientist CyberGem Consulting USA Dr Rain Ottis Associate Professor Tallinn University of Technology Estonia Brookline, Tallinn, April 2016 TABLE OF Contents Introduction 1 Assessing Cyber Power 7 Jelle van Haaster Hard Power in Cyberspace: CNA as a Political Means 23 Ragnhild Endresen Siedler Winning and Losing in Cyberspace 37 Jason Healey Towards a Theory of Cyber Power: The Israeli 51 Experience with Innovation and Strategy Lior Tabansky The Cyber-Doom Effect: The Impact 65 of Fear Appeals in the US Cyber Security Debate Sean T. Lawson, Sara K. Yeo, Haoran Yu, Ethan Greene Determining Extremist Organisations’ 81 Likelihood of Conducting Cyber Attacks Steve S. Sin, Laura A. Blackerby, Elvis Asiamah, Rhyner Washburn The Social Side of ‘Cyber Power’? Social Media and Cyber Operations 99 Drew Herrick Influence Cyber Operations: The Use of 113 Cyberattacks in Support of Influence Operations Pascal Brangetto, Matthijs A. Veenendaal Is the International Law of Cyber Security in Crisis? 127 Kubo Mačák Conceptualising Cyber Arms Races 141 Anthony Craig, Brandon Valeriano Arms Control in Cyberspace – Architecture for a 159 Trust-Based Implementation Framework Based on Conventional Arms Control Methods Markus Maybaum, Jens Tölle ii Malware Counter-Proliferation and the Wassenaar Arrangement 175 Trey Herr Weapons Systems and Cyber Security – A Challenging Union 191 Robert Koch, Mario Golling UAV Exploitation: A New Domain for Cyber Power 205 Kim Hartmann, Keir Giles Assessing the Impact of Aviation Security on Cyber Power 223 Martin Strohmeier, Matthias Schäfer, Matt Smith, Vincent Lenders, Ivan Martinovic Countering Advanced Persistent Threats through 243 Security Intelligence and Big Data Analytics Mirco Marchetti, Fabio Pierazzi, Alessandro Guido, Michele Colajanni Anonymity Networks and Access to Information 263 During Conflicts: Towards a Distributed Network Organisation Paolo Palmieri We Know Where You Are! 277 Siddharth Prakash Rao, Silke Holtmanns, Ian Oliver, Tuomas Aura Biographies 295 iii INTRODUCTION For the eighth consecutive year, the NATO Cooperative Cyber Defence Centre of Excellence (NATO CCD COE) is proud to host the International Conference on Cyber Conflict (CyCon), which gathers experts from the government, military, academia and private sector to discuss the most pressing issues related to cyber defence. Once again CyCon serves as an interdisciplinary platform for networking and sharing knowledge, bringing together the cyber security community’s technical experts, strategic thinkers, political scientists and lawyers. CyCon 2016 focuses on understanding the many aspects of ‘cyber power’ and aims to analyse how new digital technologies are affecting the traditional social, political, and technical foundations of defence and security. Power can be seen as the capacity, ability and willingness to act and is a central element of almost every form of social interaction, be it on the individual or the international level. The rapid development of the digital domain has had a substantial impact on all aspects of society but many questions about how actors can exert power through cyberspace remain unanswered. For instance, how has the rapid rise of information technologies changed the way in which different actors project their influence? How can the strategic and technical aspects of cyber power be measured? Who are the actors seeking cyber power? How do organisations achieve effective defences in cyberspace? What technical, political and legal frameworks are necessary in regard of the build-up of cyber capabilities? How will cyber power impact future military operations? These and many other questions will be addressed during the conference’s sessions and workshops, as well as in the papers that have been selected for the conference proceedings. This publication, comprising 18 articles, spans a wide spectrum of topics. It starts by focusing on the conceptual issues and asks how the phenomenon of cyber power can be defined and assessed. This is first done by Jelle van Haaster who, based on a comparative analysis of traditional approaches to power in international relations, presents a comprehensive methodology for measuring the different