What Do We Know About Cyber Conflict? Scope, Impact, and Restraint in Cyberspace
Total Page:16
File Type:pdf, Size:1020Kb
What Do We Know about Cyber Conflict? Scope, Impact, and Restraint in Cyberspace Brandon Valeriano University of Glasgow and Ryan C. Maness University of Illinois at Chicago Abstract: This paper summarizes and connects our various divergent cyber conflict research projects to present a complete picture of the dynamics, theories, and scope of cyber operations in the digital age. We first examine the scope of cyber operations and who uses the tactic against whom. We then study the impact of cyber operations on conflict and cooperation dynamics with a goal of understanding the foreign policy dynamics of cyber conflict. Finally, we contrast a system of justice in cyber operations where the continued limited use of the tactic is the goal with divergent notions of offensive cyber actions. This paper will provide a comprehensive investigation of cyber conflict, a tactic some suggest will change the future of international interactions. We are much more measured in our reactions to the tactic and suggest while it will be an important tool, it will be restrained in its use by states and more likely represent method of information warfare rather than direct combat. *As this is a multiyear project that seems to have taken over our lives and professional outputs, there are too many to thank here. Suffice to say our acknowledgments list will be extensive in the book. Key people to thank are Sam Bassett who was with us in the beginning in the early coding of the dataset and the students at UIC and the University of Glasgow for listening to early presentations of these projects. 1 Introduction This paper will be a bit different than the norm; the goal here is to summarize and evaluate our entire research programme on cyber conflict analysis. Our project is focused on using social science methods to evaluate cyber security questions. By knowing the past history of cyber interactions and deducing a theory of future cyber operations, we can illustrate how cyber tactics will be used in the future. Here we cover the major parts of our study, present some of our analysis, and suggest future directions. Our style here is a bit irreverent. Here we create a top ten list of the major points we wish to cover in order to facilitate public consumption and presentation. In some ways this is an executive summary of our entire research efforts so far. The Importance of Cyber Conflict In 2011, the United States government declared a cyber attack similar to an act of war, punishable with conventional military means (White House 2011, Schmitt 2013).1 This is a significant step because it allows the response to a non-physical attack in cyberspace to be in the physical, kinetic form. Conflict then shifts from cyberspace to conventional forms. Rarely have we seen non-physical threats become the source of physical counter threats. This represents a new direction of how threats and actions are taken in the international sphere. Cyber operations, cyber crime, and other forms of cyber activities directed by one state against another are now considered part of the normal relations range of combat and conflict. It is now acceptable to respond to an attack in one domain, cyberspace, through another domain, the physical and conventional layer. Although the difference between the layers can be blurred, this is still an important and critical development. Perhaps there has been no greater shift in international dynamics since the end of the Cold War. The barriers between the hypothetical and the abstract have broken down due to the fears of the costs the cyber world imposes in the physical world. As Clark and Knake (2010: xiii) argue, “cyber war may actually increase the likelihood of the more traditional combat with explosives, bullets, and missiles.” Cyberspace represents a new potential path to conflict. The rising fear of cyber combat and threats has brought about a perceived reorientation of military affairs. Clark and Knake (2010: 32) frame the debate as transformational, stating, “there is a credible possibility that such conflict [cyber] may have the potential to change the world military balance and thereby fundamentally alter political and economic relations.” The question we have is what is the reality of this threat and prospect? The hope is for this research to return the debate on cyber conflict to a more nuanced approach of the actual dangers of cyber combat. While there is a real danger of cyber combat, one must remain prudent in relation to the actual threat, and not the inflated threat presented by the imagination. Data and analysis can tell us how to react based on the current state of relations. Often, cyber policy is made based on worst case scenario analyses. Analysts, the media, and governments ask what the worst that can happen is and what can be done to respond to these situations? This is the issue brought up in allowing corporations and individuals to respond to cyber conflict through their own international actions, removing the state from the process due to the perceived extreme nature of the threat. Others point to the threat of a “Cyber Pearl Harbor”, which was given serious weight when mentioned by U.S. Secretary of Defense Leon Panetta.2 2 At the time of this writing the term results in 1.3 million hits on Google, which reveals the attention that cyber conflict was receiving at the time. The Research Programme Basing policy and strategic advice on the worst possible case utilizes the straw man approach to design responses and capacity. A straw man argument is making a point based on a perceived extreme example of an event that usually has little connection to the actual debate at hand, and, in many cases, reality. Here we see the same process in that international cyber interactions are typically benign communications removed from the security discourse. By securitizing cyberspace we make the worst case the reality and the norm. To move beyond this process we must examine how states actually interact in cyberspace. We must examine the worst cases of abuse, the typical cases of abuse, and the normal day to day interactions that are devoid of security contexts. Through this process we can describe, shape, and develop arguments about cyber political interactions based on reality and fact, rather than hyperbole and fear. To this point, studies about the impact of cyber-technologies on foreign relations are purely speculative; no one has yet has examined the shape and consequences of cyber operations. Pundits and scholars have not been limited by the lack of analysis from fear-mongering and inflated threats. As Lynch (2010) puts it, “a dozen determined computer programmers can, if they find a vulnerability to exploit, threaten the United States’ global logistics network, steal its operational plans, blind its intelligence capabilities, or hinder its ability to deliver weapons on target.” It is quotes like these that could lead to an increase in defense spending on cyber- defense that might be disproportionate to the threat exhibited. Rather than suggesting that the nature of combat has changed, we are interested in measuring if, how, and why it has changed. The shift towards the knowable rather than “unknown unknowns” of the cyber domain is important in scholarly discourse and could perhaps lead to a more proportional means of defense for governments involved in rivalries or on the cyber battlefield, this is an important point since deterrence is unlikely to work in the cyber arena. This leads us to our current position. Not much is actually know about cyber conflict in the macro sense. We know about individual attacks and that the tactic is being developed by militaries around the world, but this does not describe or predict how the tactic will be used in the future. Ten Facts about Cyber Conflict 1 Terminology is Important 2 We Need Cyber Theories and Data 3 Low Rate of Usage for Cyber Tactics 4 The Actions We Have Seen Have Been Low in Severity 5 Most Cyber Incidents are Regional 6 There Has Been Little Reaction to the Cyber Operations 7 Many Cyber Incidents would be Espionage 8 Cyber Terrorism is an Inflated Threat 9 Cyber Hygiene is Important 10 There is a Taboo Developing Against Cyber Tactics 3 Cyber Terminology Our first key observation is that terminology is important. Rid’s (2013) work is important in that he is able to argue that cyber war will not happen due to the way the term war is defined. We also note that the term cyber attack (and hack) is virtually useless analytically since they are devoid of value. Almost anything is now termed as a cyber attack. There is very little distinction between a single interaction at the cyber level and a long term operation containing thousands, if not millions of interactions. To date, many cyber scholars have been sloppy in their usage of terms. 1. Terminology is Important Predicting the amount, level, and context of cyber conflict is dependent on how the term is defined, framed, and engaged. For us, the prefix cyber simply means computer or digital interactions.3 To understand the shape of cyber interactions, we must define what we (and others) mean by cyberspace, cyberpower, cyber war, and cyber conflict. Once this task is done, we can move on to predicting and explaining the domain of our analysis. Nye (2011) defines cyberspace as “the cyber domain includes the Internet of networked computers but also intranets, cellular technologies, fiber-optic cables, and space-based communications. Cyberspace has a physical infrastructure layer that follows the economic laws of rival resources and the political laws of sovereign justification and control” (Nye 2011: 19).