C-522

CYBERSECURITY AND CYBERWAR WHAT EVERYONE NEEDS TO KNOW ®

oxfordhb-9780199918096.indd ioxfordhb-9780199918096.indd i 21-10-2013 22:38:1221-10-2013 22:38:12

“In our digital age, the issues of cybersecurity are no longer just for the technology crowd; they matter to us all. Whether you work in business or politics, the military or the media—or are simply an ordinary citizen—this is an essential read.”

—Eric Schmidt, Executive Chairman, Google

“This is the most approachable and readable book ever written on the cyber world. The authors have distilled the key facts and policy, provided sensible recommendations, and opened the debate generally to any informed citizen: a singular achievement. A must read for practitioners and scholars alike.”

—Admiral James Stavridis, US Navy (Ret), former NATO Supreme Allied Commander

“In confronting the cybersecurity problem, it’s important for all of us to become knowl- edgeable and involved. This book makes that possible—and also fascinating. It’s every- thing you need to know about cybersecurity, wonderfully presented in a clear and smart way.”

—Walter Isaacson, author of Steve Jobs

“If you read only one book about ‘all this cyberstuff,’ make it this one. Singer and Friedman know how to make even the most complicated material accessible and even entertaining, while at the same time making a powerful case for why all of us need to know more and think harder about the (cyber)world we know live in.“

—Anne-Marie Slaughter, President, the New America Foundation

“Singer and Friedman blend a wonderfully easy to follow FAQ format with engaging prose, weaving explanations of the elements of cybersecurity with revealing anecdotes. From the fundamentals of Internet architecture to the topical intrigue of recent security leaks, this book provides an accessible and enjoyable analysis of the current cybersecurity landscape and what it could look like in the future.”

—Jonathan Zittrain, Professor of Law and Professor of Computer Science at Harvard University, and author of The Future of the

Internet—And How to Stop It

“Singer and Friedman do a highly credible job of documenting the present and likely future risky state of cyber-affairs. This is a clarion call.”

—Vint Cerf, “Father of the Internet,” Presidential Medal of Freedom winner

“I loved this book. Wow. Until I read this astonishing and important book, I didn’t know how much I didn’t know about the hidden world of cybersecurity and cyberwar. Singer and Friedman make comprehensible an impossibly complex subject, and expose the frightening truth of just how vulnerable we are. Understanding these often-invisible threats to our personal and national security is a necessary fi rst step toward defending ourselves against them. This is an essential read.”

—Howard Gordon, Executive Producer of 24 and co-creator of Homeland

oxfordhb-9780199918096.indd iioxfordhb-9780199918096.indd ii 21-10-2013 22:38:1321-10-2013 22:38:13

1

CYBERSECURITY AND

CYBERWAR WHAT EVERYONE NEEDS TO KNOW ®

P. W.   SINGER AND ALLAN FRIEDMAN

oxfordhb-9780199918096.indd iiioxfordhb-9780199918096.indd iii 21-10-2013 22:38:1321-10-2013 22:38:13

3 Oxford University Press is a department of the University of Oxford.

It furthers the University’s objective of excellence in research, scholarship, and education by publishing worldwide.

Oxford New York Auckland Cape Town Dar es Salaam Hong Kong Karachi Kuala Lumpur Madrid Melbourne Mexico City Nairobi

New Delhi Shanghai Taipei Toronto

With offi ces in Argentina Austria Brazil Chile Czech Republic France Greece

Guatemala Hungary Italy Japan Poland Portugal Singapore South Korea Switzerland Thailand Turkey Ukraine Vietnam

Oxford is a registered trademark of Oxford University Press in the UK and certain other countries.

“What Everyone Needs to Know” is a registered trademark of Oxford University Press.

Published in the United States of America by Oxford University Press 198 Madison Avenue, New York, NY 10016

© P. W. Singer and Allan Friedman 2014

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, without the prior

permission in writing of Oxford University Press, or as expressly permitted by law, by license, or under terms agreed with the appropriate reproduction rights

organization. Inquiries concerning reproduction outside the scope of the above should be sent to the Rights Department, Oxford University Press, at the

address above.

You must not circulate this work in any other form and you must impose this same condition on any acquirer.

Library of Congress Cataloging-in-Publication Data Singer, P. W. (Peter Warren)

Cybersecurity and cyberwar : what everyone needs to know / Peter W. Singer, Allan Friedman.

ISBN 978–0–19–991809–6 (hardback)—ISBN 978–0–19–991811–9 (paperback) 1. Computer security—United States 2. Computer networks—Security

measures—United States. 3. Cyberspace—Security measures—United States. 4. Cyberterrorism—United States—Prevention. 5. Information warfare—United

States—Prevention. I. Title. QA76.9.A25S562 2014

005.8—dc23 2013028127

1 3 5 7 9 8 6 4 2 Printed in the United States of America

on acid-free paper

oxfordhb-9780199918096.indd ivoxfordhb-9780199918096.indd iv 21-10-2013 22:38:1321-10-2013 22:38:13

CONTENTS

INTRODUCTION 1

Why Write a Book about Cybersecurity and Cyberwar? 1

Why Is There a Cybersecurity Knowledge Gap, and Why Does It Matter? 4

How Did You Write the Book and What Do You Hope to Accomplish? 8

PART I HOW IT ALL WORKS 12

The World Wide What? Defi ning Cyberspace 12

Where Did This “Cyber Stuff” Come from Anyway? A Short History of the Internet 16

How Does the Internet Actually Work? 21

Who Runs It? Understanding Internet Governance 26

On the Internet, How Do They Know Whether You Are a Dog? Identity and Authentication 31

What Do We Mean by “Security” Anyway? 34

What Are the Threats? 36

One Phish, Two Phish, Red Phish, Cyber Phish: What Are Vulnerabilities? 39

How Do We Trust in Cyberspace? 45

Focus: What Happened in WikiLeaks? 51

oxfordhb-9780199918096.indd voxfordhb-9780199918096.indd v 21-10-2013 22:38:1321-10-2013 22:38:13

vi Contents

What Is an Advanced Persistent Threat (APT)? 55

How Do We Keep the Bad Guys Out? The Basics of Computer Defense 60

Who Is the Weakest Link? Human Factors 64

PART II WHY IT MATTERS 67

What Is the Meaning of Cyberattack? The Importance of Terms and Frameworks 67

Whodunit? The Problem of Attribution 72

What Is Hactivism? 77

Focus: Who Is Anonymous? 80

The Crimes of Tomorrow, Today: What Is Cybercrime? 85

Shady RATs and Cyberspies: What Is Cyber Espionage? 91

How Afraid Should We Be of Cyberterrorism? 96

So How Do Terrorists Actually Use the Web? 99

What about Cyber Counterterrorism? 103

Security Risk or Human Right? Foreign Policy and the Internet 106

Focus: What Is Tor and Why Does Peeling Back the Onion Matter? 108

Who Are Patriotic Hackers? 110

Focus: What Was Stuxnet? 114

What Is the Hidden Lesson of Stuxnet? The Ethics of Cyberweapons 118

“Cyberwar, Ugh, What Are Zeros and Ones Good For?”: Defi ning Cyberwar 120

A War by Any Other Name? The Legal Side of Cyber Confl ict 122

What Might a “Cyberwar” Actually Look Like? Computer Network Operations 126

Focus: What Is the US Military Approach to Cyberwar? 133

Focus: What Is the Chinese Approach to Cyberwar? 138

What about Deterrence in an Era of Cyberwar? 144

Why Is Threat Assessment So Hard in Cyberspace? 148

Does the Cybersecurity World Favor the Weak or the Strong? 150

Who Has the Advantage, the Offense or the Defense? 153

oxfordhb-9780199918096.indd vioxfordhb-9780199918096.indd vi 21-10-2013 22:38:1321-10-2013 22:38:13

Contents vii

A New Kind of Arms Race: What Are the Dangers of Cyber Proliferation? 156

Are There Lessons from Past Arms Races? 160

Behind the Scenes: Is There a Cyber-Industrial Complex? 162

PART III WHAT CAN WE DO? 166

Don’t Get Fooled: Why Can’t We Just Build a New, More Secure Internet? 166

Rethink Security: What Is Resilience, and Why Is It Important? 169

Reframe the Problem (and the Solution): What Can We Learn from Public Health? 173

Learn from History: What Can (Real) Pirates Teach Us about Cybersecurity? 177

Protect World Wide Governance for the World Wide Web: What Is the Role of International Institutions? 180

“Graft” the Rule of Law: Do We Need a Cyberspace Treaty? 185

Understand the Limits of the State in Cyberspace: Why Can’t the Government Handle It? 193

Rethink Government’s Role: How Can We Better Organize for Cybersecurity? 197

Approach It as a Public-Private Problem: How Do We Better Coordinate Defense? 205

Exercise Is Good for You: How Can We Better Prepare for Cyber Incidents? 211

Build Cybersecurity Incentives: Why Should I Do What You Want? 216

Learn to Share: How Can We Better Collaborate on Information? 222

Demand Disclosure: What Is the Role of Transparency? 228

Get “Vigorous” about Responsibility: How Can We Create Accountability for Security? 231

Find the IT Crowd: How Do We Solve the Cyber People Problem? 235

Do Your Part: How Can I Protect Myself (and the Internet)? 241

oxfordhb-9780199918096.indd viioxfordhb-9780199918096.indd vii 21-10-2013 22:38:1321-10-2013 22:38:13

viii Contents

CONCLUSIONS 247

Where Is Cybersecurity Headed Next?  247

What Do I Really Need to Know in the End? 255

ACKNOWLEDGMENTS 257

NOTES 259

GLOSSARY 293

INDEX 301

oxfordhb-9780199918096.indd viiioxfordhb-9780199918096.indd viii 21-10-2013 22:38:1321-10-2013 22:38:13

INTRODUCTION

Why Write a Book about Cybersecurity and Cyberwar?

“All this cyber stuff.”

The setting was a Washington, DC, conference room. The

speaker was a senior leader of the US Department of Defense.

The topic was why he thought cybersecurity and cyberwar was

so important. And yet, when he could only describe the problem

as “all this cyber stuff,” he unintentionally convinced us to write

this book.

Both of us are in our thirties and yet still remember the fi rst

computers we used. For a fi ve-year-old Allan, it was an early

Apple Macintosh in his home in Pittsburgh. Its disk space was so

limited that it could not even fi t this book into its memory. For a

seven-year-old Peter, it was a Commodore on display at a science

museum in North Carolina. He took a class on how to “program,”

learning an entire new language for the sole purpose of making one

of the most important inventions in the history of mankind print out

a smiley face. It spun out of a spool printer, replete with the perfo-

rated paper strips on the side.

Three decades later, the centrality of computers to our lives is

almost impossible to comprehend. Indeed, we are so surrounded

by computers that we don’t even think of them as “computers” any-

more. We are woken by computerized clocks, take showers in water

heated by a computer, drink coffee brewed in a computer, eat oat-

meal heated up in a computer, then drive to work in a car controlled

by hundreds of computers, while sneaking peeks at the last night’s

sport scores on a computer. And then at work, we spend most of our

day pushing buttons on a computer, an experience so futuristic in

oxfordhb-9780199918096.indd 1oxfordhb-9780199918096.indd 1 21-10-2013 22:38:1321-10-2013 22:38:13

2 INTRODUCTION

our parents’ day that it was the stuff of The Jetsons (George Jetson’s job was a “digital index operator”). Yet perhaps the best way to gain

even a hint of computers’ modern ubiquity is at the end of the day.

Lie in bed, turn off the lights, and count the number of little red

lights staring back at you.

These machines are not just omnipresent, they are connected. The

computers we used as little kids stood alone, linked to nothing more

than the wall electricity socket and maybe that spool printer. Just a

generation ago, the Internet was little more than a link between a few

university researchers. The fi rst “electronic mail” was sent in 1971.

The children of those scientists now live in a world where almost 40

trillion e-mails are sent a year. The fi rst “website” was made in 1991.

By 2013, there were over 30 trillion individual web pages.

Moreover, the Internet is no longer just about sending mail or

compiling information: it now also handles everything from linking

electrical plants to tracking purchases of Barbie dolls. Indeed, Cisco,

a company that helps run much of the back end of the Internet, esti-

mated that 8.7 billion devices were connected to the Internet by the

end of 2012, a fi gure it believes will rise to 40 billion by 2020 as cars,

fridges, medical devices, and gadgets not yet imagined or invented all

link in. In short, domains that range from commerce to communica-

tion to the critical infrastructure that powers our modern-day civiliza-

tion all operate on what has become a globalized network of networks.

But with the rise of “all this cyber stuff,” this immensely impor-

tant but incredibly short history of computers and the Internet has

reached a defi ning point. Just as the upside of the cyber domain is

rippling out into the physical domain, with rapid and often unex-

pected consequences, so too is the downside.

As we will explore, the astounding numbers behind “all this cyber

stuff” drive home the scale and range of the threats:  97  percent of

Fortune 500 companies have been hacked (and 3  percent likely have

been too and just don’t know it), and more than one hundred gov-

ernments are gearing up to fi ght battles in the online domain.

Alternatively, the problems can be conceptualized through the tough

political issues that this “stuff” has already produced: scandals like

WikiLeaks and NSA monitoring, new cyberweapons like Stuxnet, and

the role that social networking plays in everything from the Arab Spring

revolutions to your own concerns over personal privacy. Indeed,

President Barack Obama declared that “cybersecurity risks pose some

oxfordhb-9780199918096.indd 2oxfordhb-9780199918096.indd 2 21-10-2013 22:38:1321-10-2013 22:38:13

Introduction 3

of the most serious economic and national security challenges of the

21st century,” a position that has been repeated by leaders in coun-

tries from Britain to China.

For all the hope and promise of the information age, ours is also

a time of “cyber anxiety.” In a survey of where the world was head-

ing in the future, Foreign Policy magazine described the cyber area as the “single greatest emerging threat,” while the Boston Globe claimed that future is already here: a “cyber world war” in progress that will

culminate in “bloody, digital trench warfare.”

These fears have coalesced into the massive booming business

of cybersecurity, one of the fastest growing industries in the world.

It has led to the creation of various new governmental offi ces

and bureaucracies (the US Department of Homeland Security’s

National Cyber Security Division has doubled or tripled in size

every year since its inception). The same is true for armed forces

around the globe like the US Cyber Command and the Chinese

“Information Security Base” ( xinxi baozhang jidi ), new military units whose very mission is to fi ght and win wars in cyberspace.

As we later consider, these aspects of “cyber stuff” raise very real

risks, but how we perceive and respond to these risks may be even

more crucial to the future, and not just of the Internet. As Joe Nye,

the former Dean of the Harvard Kennedy School of Government,

notes, if users begin to lose confi dence in the safety and security of

the Internet, they will retreat from cyberspace, trading “welfare in

search of security.”

Fears over cybersecurity increasingly compromise our notions

of privacy and have allowed surveillance and Internet fi ltering to

become more common and accepted at work, at home, and at the

governmental level. Entire nations, too, are pulling back, which

will undermine the economic and human rights benefi ts we’ve seen

from global connectivity. China is already developing its own net-

work of companies behind a “Great Firewall” to allow it to screen

incoming messages and disconnect from the worldwide Internet if

needed. As a Yale Law School article put it, all of these trends are

“converging into a perfect storm that threatens traditional Internet values of openness, collaboration, innovation, limited governance

and free exchange of ideas.”

These issues will have consequences well beyond the Internet.

There is a growing sense of vulnerability in the physical world from

oxfordhb-9780199918096.indd 3oxfordhb-9780199918096.indd 3 21-10-2013 22:38:1321-10-2013 22:38:13

4 INTRODUCTION

new vectors of cyberattack via the virtual world. As a report entitled

“The New Cyber Arms Race” describes, “In the future, wars will not

just be fought by soldiers with guns or with planes that drop bombs.

They will also be fought with the click of a mouse a half a world

away that unleashes carefully weaponized computer programs that

disrupt or destroy critical industries like utilities, transportation,

communications, and energy. Such attacks could also disable mili-

tary networks that control the movement of troops, the path of jet

fi ghters, the command and control of warships.”

Such a vision of costless war or instant defeat either scares or

comforts, wholly dependent on which side of the cyberattack

you’re on. The reality, as we explore later in the book, is much more

complex. Such visions don’t just stoke fears and drive budgets.

They also are potentially leading to the militarization of cyber-

space itself. These visions threaten a domain that has delivered

massive amounts of information, innovation, and prosperity to the

wider planet, fuel tensions between nations, and, as the title of the

aforementioned report reveals, maybe even have set in motion a

new global arms race.

In short, no issue has emerged so rapidly in importance as cyber-

security. And yet there is no issue so poorly understood as this

“cyber stuff.”

Why Is There a Cybersecurity Knowledge Gap,

and Why Does It Matter?

“Rarely has something been so important and so talked about with

less and less clarity and less apparent understanding. . . . I have sat in

very small group meetings in Washington . . . unable (along with my colleagues) to decide on a course of action because we lacked a clear

picture of the long term legal and policy implications of any decision we might make.”

This is how General Michael Hayden, former Director of the

CIA, described the cybersecurity knowledge gap and the dangers it

presents. A major part of this disconnect is the consequence of those

early experiences with computers, or rather the lack of them among

too many leaders. Today’s youth are “digital natives,” having grown

up in a world where computers have always existed and seem a nat-

ural feature. But the world is still mostly led by“digital immigrants,”

oxfordhb-9780199918096.indd 4oxfordhb-9780199918096.indd 4 21-10-2013 22:38:1321-10-2013 22:38:13

Introduction 5

older generations for whom computers and all the issues the Internet

age presents remain unnatural and often confusing.

To put it another way, few older than fi fty will have gone through

their university training even using a computer. Even the few who

did likely used one that stood alone, not connected to the world. Our

most senior leaders, now in their sixties and seventies, likely did not

even become familiar with computers until well into their careers,

and many still today have only the most limited experience with

them. As late as 2001, the Director of the FBI did not have a com-

puter in his offi ce, while the US Secretary of Defense would have

his assistant print out e-mails to him, write his response in pen, and

then have the assistant type them back in. This sounds outlandish,

except that a full decade later the Secretary of Homeland Security, in

charge of protecting the nation from cyberthreats, told us at a 2012

conference, “Don’t laugh, but I just don’t use e-mail at all.” It wasn’t

a fear of security, but that she just didn’t believe e-mail useful. And

in 2013, Justice Elena Kagan revealed the same was true of eight out

of nine of the United States Supreme Court justices, the very people

who would ultimately decide what was legal or not in this space.

It is not solely an issue of age. If it was, we could just wait until

the old farts died off and all would be solved. Just because some-

one is young doesn’t mean the person automatically has an under-

standing of the key issues. Cybersecurity is one of those areas that

has been left to only the most technically inclined to worry their

uncombed heads over. Anything related to the digital world of zeros

and ones was an issue just for computer scientists and the IT help

desk. Whenever they spoke, most of us would just keep quiet, nod

our heads, and put on what author Mark Bowden calls “the glaze.”

This is the “unmistakable look of profound confusion and disinter-

est that takes hold whenever conversation turns to workings of a

computer.” The glaze is the face you put on when you can only call

something “stuff.” Similarly, those who are technically inclined too

often roll their eyes at the foreign logic of the policy and business

worlds, scoffi ng at the “old way” of doing business, without under-

standing the interactions between technology and people.

The result is that cybersecurity falls into a no man’s land. The

fi eld is becoming crucial to areas as intimate as your privacy and

as weighty as the future of world politics. But it is a domain only

well known by “the IT Crowd.” It touches every major area of

oxfordhb-9780199918096.indd 5oxfordhb-9780199918096.indd 5 21-10-2013 22:38:1321-10-2013 22:38:13

6 INTRODUCTION

public- and private-sector concern, but only the young and the com-

puter savvy are well engaged with it. In turn, the technical com-

munity that understands the workings too often sees the world only

through a specifi c lens and can fail to appreciate the broader picture

or nontechnical aspects. Critical issues are thus left misunderstood

and often undebated.

The dangers are diverse and drove us in the writing of the book.

Each of us, in whatever role we play in life, must make decisions

about cybersecurity that will shape the future well beyond the world

of computers. But often we do so without the proper tools. Basic

terms and essential concepts that defi ne what is possible and proper

are being missed, or even worse, distorted. Past myth and future

hype often weave together, obscuring what actually happened and

where we really are now. Some threats are overblown and overre-

acted to, while others are ignored.

This gap has wide implications. One US general described to us

how “understanding cyber is now a command responsibility,” as it

affects almost every part of modern war. And yet, as another gen-

eral put it pointedly, “There is a real dearth of doctrine and policy in

the world of cyberspace.” His concern, as we explore later, was not

just the military side needed to do a better job at “cyber calculus,”

but that the civilian side was not providing any coordination or

guidance. Some liken today to the time before World War I, when

the militaries of Europe planned to utilize new technologies like

railroads. The problem was that they, and the civilian leaders and

publics behind them didn’t understand the technologies or their

implications and so made uninformed decisions that inadvertently

drove their nations into war. Others draw parallels to the early

years of the Cold War. Nuclear weapons and the political dynamics

they drove weren’t well understood and, even worse, were largely

left to specialists. The result was that notions we now laugh off as

Dr. Strangelovian were actually taken seriously, nearly leaving the

planet a radioactive hulk.

International relations are already becoming poisoned by this dis-

connect between what is understood and what is known. While we

are both Americans, and thus many of the examples and lessons in

this book refl ect that background, the “cyber stuff” problem is not

just an American concern. We were told the same by offi cials and

experts from places ranging from China and Abu Dhabi to Britain

oxfordhb-9780199918096.indd 6oxfordhb-9780199918096.indd 6 21-10-2013 22:38:1321-10-2013 22:38:13

Introduction 7

and France. In just one illustration of the global gap, the offi cial

assigned to be the “czar” for cybersecurity in Australia had never

even heard of Tor, a critical technology to the fi eld and its future

(don’t worry, you—and hopefully she—will learn what everyone

needs to know about Tor in Part II).

This is worrisome not just because of the “naiveté” of such pub-

lic offi cials, but because it is actually beginning to have a danger-

ous impact on global order. For instance, there is perhaps no other

relationship as important to the future of global stability as that

between the two great powers of the United States and China. Yet,

as senior policymakers and general publics on both sides struggle

to understand the cyber realm’s basic dynamics and implications,

the issue of cybersecurity is looming ever larger in US-China rela-

tions. Indeed, the Chinese Academy of Military Sciences released

a report whose tone effectively captured how suspicion, hype,

ignorance, and tension have all begun to mix together into a dan-

gerous brew. “Of late, an Internet tornado has swept across the

world . . . massively impacting and shocking the globe. . . . Faced

with this warm-up for an Internet war, every nation and mili-

tary can’t be passive but is making preparations to fi ght the

Internet war.” 

This kind of language—which is mirrored in the US—doesn’t

illustrate the brewing global cyber anxiety. It also reveals how

confusion and misinformation about the basics of the issue help

drive that fear. While both sides, as we explore later on, are active

in both cyber offense and defense, it is the very newness of the

issue that is proving so diffi cult. Top American and Chinese gov-

ernmental leaders talked with us about how they found cybersecu-

rity to be far more challenging than the more traditional concerns

between their nations. While they may not agree on issues like

trade, human rights, and regional territorial disputes, they at least

understand them. Not so for cyber, where they remain woefully

ill-equipped even to talk about what their own nation is doing,

let alone the other side. For example, a top US offi cial involved in

talks with China on cyber issues asked us what an “ISP” was (here

again, don’t fret if you don’t yet know, we’ll cover this soon!). If

this had been back in the Cold War, that question would be akin to

not knowing what an ICBM was in the midst of negotiating with

the Soviets on nuclear issues.

oxfordhb-9780199918096.indd 7oxfordhb-9780199918096.indd 7 21-10-2013 22:38:1321-10-2013 22:38:13

8 INTRODUCTION

Such matters are not just issues for generals or diplomats but also

for all citizens. The general lack of understanding on this topic is

becoming a democracy problem as well. As we write, there are some

fi fty cybersecurity bills under consideration in the US Congress, yet

the issue is perceived as too complex to matter in the end to vot-

ers, and as a result, the elected representatives who will decide the

issues on their behalf. This is one of the reasons that despite all these

bills no substantive cybersecurity legislation was passed between

2002 and the writing of this book over a decade later.

Again, the technology has evolved so quickly that it is no sur-

prise that most voters and their elected leaders are little engaged on

cybersecurity concerns. But they should be. This fi eld connects areas

that range from the security of your bank accounts and online iden-

tity to broader issues of who in which governments can access your

personal secrets and even when and where your nation goes to war.

We are all users of this realm and are all shaped by it, yet we are not

having any kind of decent public dialogue on it. “We’re not having

a really good, informed debate,” as one professor at the US National

Defense University put it. “Instead, we either punt the problem

down the road for others to fi gure out, or to the small number of

people who make important policy in the smoky backrooms.” And

even that is insuffi cient, given that most people in today’s smoky

backrooms have never been in an Internet chatroom.

How Did You Write the Book and What Do You Hope to Accomplish?

With all of these issues at play, the timing and value of a book that

tried to tackle the basic issues that everyone should know about

cybersecurity and cyberwar seemed ideal. And the format of this

Oxford series, where all the books are in a “question and answer”

style, seemed to hit that sweet spot.

As we set out to research and write the book, this question-

and-answer style then structured our methodology. To put it another

way, if you are locked into a Q and A format, you better fi rst decide

the right set of Qs.

We tried to gather all the key questions that people had about this

fi eld, not only those asked by people working in politics or technol-

ogy, but also from our interactions and interviews well beyond. This

set of questions was backed by what would have previously been

called a “literature survey.” In the old (pre-Internet) days, this meant

oxfordhb-9780199918096.indd 8oxfordhb-9780199918096.indd 8 21-10-2013 22:38:1321-10-2013 22:38:13

Introduction 9

going to the library and pulling off the shelf all the books in that sec-

tion of the Dewey decimal system. Today, on this topic especially,

the sources range from books to online journals to microblogs. We

were also greatly aided by a series of workshops and seminars at

Brookings, the think tank in Washington we work at. These gathered

key public- and private-sector experts to explore questions ranging

from the effi cacy of cyber deterrence to what can be done about bot-

nets (all questions later dealt with in the book). We also held a series

of meetings and interviews with key American offi cials and experts.

They ranged from top folks like the Chairman of the Joint Chiefs, the

highest-ranking US military offi cer, and the Director of the National

Security Agency down to low-ranking systems administrators, from

civilian governors, cabinet secretaries, and CEOs to small business

owners and teenaged hackers. Our scope was global, and so the

meetings also included leaders and experts from China (the foreign

minister and generals from the PLA among them), as well as the UK,

Canada, Germany, France, Australia, Estonia, United Arab Emirates,

and Singapore. Finally, while it is a virtual world, we also visited

key facilities and various cybersecurity hubs in locales that ranged

from the DC Beltway and Silicon Valley to Paris and Abu Dhabi.

Over the course of this journey, we noticed a pattern. The ques-

tions (and the issues that came from them) generally fell under

three categories. The fi rst were questions of the essential contours

and dynamics of cyberspace and cybersecurity, the “How does

it all work?” questions. Think of these as the “driver ’s ed” part,

which gives the basic building blocks to the online world. The sec-

ond were questions on the broader implications of cybersecurity

beyond cyberspace, the “Why does it matter?” questions. And then

there were questions on the potential responses, the “What we can

do?” questions. The following sections follow this basic structure.

And with the questions laid out, then came the task of answer-

ing them. This book is the result. While the questions are diverse,

you’ll notice that over the course of answering them, a few themes

emerged to run through the book:

• Knowledge matters:  It is vital we demystify this realm if we ever want to get anything effective done in securing it.

• People matter:  Cybersecurity is one of those “wicked” problem areas that’s rife with complexities and trade-offs. This is in

oxfordhb-9780199918096.indd 9oxfordhb-9780199918096.indd 9 21-10-2013 22:38:1321-10-2013 22:38:13

10 INTRODUCTION

large part not because of the technical side, but because of the people part. The people behind the machines are inherently inside any problem or needed solution.

• Incentives matter: If you want to understand why something is or isn’t happening in cyberspace, look to the motivations, the costs, and the tensions at play behind the issue. Indeed, anyone claiming a simple “silver bullet” solution in the cyber realm is either ignorant or up to no good.

• The crowd matters: This is not a realm where governments can or should have all the answers. Cybersecurity depends on all of us.

• States matter: That said, governments’ roles are crucial, espe- cially the United States and China. The reason is not just that these two nations remain powerful and infl uential, but that the interplay of their often differing visions of cybersecurity are critical to the future of both the Internet and world politics.

• Cats matter: In the end, the Internet is what we make of it. And that means while serious “stuff” is at play in it, cyberspace is also a fun, often whimsical realm, with memes like danc- ing babies and keyboard-playing cats. So any treatment of it should be sure to capture that whimsy.

To put it another way, our goal was to wrestle directly with the

“cyber stuff” problem that set us on the journey. This is a book writ-

ten by two researchers, following rigorous academic guidelines, and

published by an esteemed university press. But our intent was not

a book only for academics. The best research in the world is worth-

less if it does not fi nd its way into the hands of those who need it.

Indeed, the number of academic papers related to cybersecurity has

increased at a compound annual growth rate of 20 percent for well

over a decade. Yet no one would say that the broader world is all the

more informed.

Instead, we embraced this series’ core idea of “what everyone

needs to know.” Everyone does not need to know the software pro-

gramming secrets of Stuxnet or the legal dynamics of ISP insurance

schemes. But as we all become more engaged in and dependent on

cybersecurity, there are certain building blocks of understanding that

we all need to have. Ignorance is not bliss when it comes to cyber-

security. Cyber issues affect literally everyone: politicians wrestling

oxfordhb-9780199918096.indd 10oxfordhb-9780199918096.indd 10 21-10-2013 22:38:1321-10-2013 22:38:13

Introduction 11

with everything from cybercrime to online freedom; generals pro-

tecting the nation from new forms of attack, while planning new

cyberwars; business executives defending fi rms from once unimagi-

nable threats, and looking to make money off of them; lawyers and

ethicists building new frameworks for right and wrong. Most of all,

cybersecurity issues affect us as individuals. We face new questions

in everything from our rights and responsibilities as citizens of both

the online and real world to how to protect ourselves and our fami-

lies from a new type of danger.

So this is not a book only for experts, but rather a book intended

to unlock the fi eld, to raise the general level of expertise, and then

push the discussion forward.

We hope that you fi nd the journey useful, and ideally even enjoy-

able, just like the world of “cyber stuff” itself.

Peter Warren Singer and Allan A. Friedman,

August 2013, Washington, DC

oxfordhb-9780199918096.indd 11oxfordhb-9780199918096.indd 11 21-10-2013 22:38:1321-10-2013 22:38:13

Part I

HOW IT ALL WORKS

The World Wide What? Defi ning Cyberspace

“It’s not a truck. It’s a series of tubes.”

This is how the late Alaska senator Ted Stevens famously explained

cyberspace during a congressional hearing in 2006. As late-night

humorist Jon Stewart noted, that someone who doesn’t “seem to

know jack BLEEP about computers or the Internet . . . is just the guy in

charge of regulating it” is a near-perfect illustration of how discon-

nected Washington policymakers can be from technological realty.

While it’s easy to mock the elderly senator’s notion of electronic

letters shooting through tubes, the reality is that defi ning ideas and

terms in cyber issues can be diffi cult. Stevens’s “tubes” is actually a

mangling of the idea of “pipes,” an analogy that is used by experts

in the fi eld to describe data connections.

If he wanted to be perfectly accurate, Stevens could have used

science-fi ction writer William Gibson’s original conception of cyber-

space. Gibson fi rst used the word, an amalgam of “cybernetics”

and “space,” in a 1982 short story. He defi ned it two years later in

his genre-revolutionizing novel Neuromancer as “A consensual hal- lucination experienced daily by billions of legitimate operators, in

every nation. . . . A graphic representation of data abstracted from the

banks of every computer in the human system. Unthinkable com-

plexity. Lines of light ranged in the nonspace of the mind, clusters

and constellations of data.” Of course, if the senator had described

cyberspace that way, most people would have thought him stoned

rather than simply disconnected.

oxfordhb-9780199918096.indd 12oxfordhb-9780199918096.indd 12 21-10-2013 22:38:1321-10-2013 22:38:13

How It All Works 13

Part of why cyberspace is so diffi cult to defi ne lies not only in

its expansive, global nature, but also in the fact that the cyberspace

of today is almost unrecognizable compared to its humble begin-

nings. The US Department of Defense can be considered the god-

father of cyberspace, dating back to its funding of early computing

and original networks like ARPANET (more on this soon). Yet even

the Pentagon has struggled to keep pace as its baby has grown up.

Over the years, it has issued at least twelve different defi nitions of

what it thinks of as cyberspace. These range from the “notional envi-

ronment in which digitized information is communicated over com-

puter networks,” which was rejected because it implied cyberspace

was only for communication and largely imaginary, to a “domain

characterized by the use of electronics and the electromagnetic spec-

trum,” which was also rejected as it encompassed everything from

computers and missiles to the light from the sun.

In its latest attempt in 2008, the Pentagon assembled a team of

experts who took over a year to agree on yet another defi nition of

cyberspace. This time they termed it “the global domain within

the information environment consisting of the interdependent

network of information technology infrastructures, including

the internet, telecommunications networks, computer systems,

and embedded processors and controllers.” It is certainly a more

detailed defi nition but so dense that one almost wishes we could

go back to just the “tubes.”

For the purposes of this book, we think it’s best to keep it simple.

At its essence, cyberspace is the realm of computer networks (and

the users behind them) in which information is stored, shared, and

communicated online. But rather than trying to fi nd the exact per-

fectly worded defi nition of cyberspace, it is more useful to unpack

what these defi nitions are trying to get at. What are the essential

features that not only compose cyberspace, but also make it unique?

Cyberspace is fi rst and foremost an information environment. It

is made up of digitized data that is created, stored, and, most impor-

tantly, shared. This means that it is not merely a physical place and

thus defi es measurement in any kind of physical dimension.

But cyberspace isn’t purely virtual. It comprises the computers

that store data plus the systems and infrastructure that allow it to

fl ow. This includes the Internet of networked computers, closed

oxfordhb-9780199918096.indd 13oxfordhb-9780199918096.indd 13 21-10-2013 22:38:1321-10-2013 22:38:13

14 CYBERSECURITY AND CYBERWAR

intranets, cellular technologies, fi ber-optic cables, and space-based

communications.

While we often use “Internet” as shorthand for the digital world,

cyberspace has also come to encompass the people behind those

computers and how their connectivity has altered their society. One

of the key features, then, of cyberspace is that its systems and tech-

nologies are man-made. As such, cyberspace is defi ned as much by

the cognitive realm as by the physical or digital. Perceptions matter,

and they inform cyberspace’s internal structures in everything from

how the names within cyberspace are assigned to who owns which

parts of the infrastructure that powers and uses it.

This leads to an important point often misunderstood. Cyberspace

may be global, but it is not “stateless” or a “global commons,”

both terms frequently used in government and media. Just as we

humans have artifi cially divided our globe into territories that we

call “nations” and, in turn, our human species into various groups

like “nationalities,” the same can be done with cyberspace. It relies

on physical infrastructure and human users who are tied to geogra-

phy, and thus is also subject to our human notions like sovereignty,

nationality, and property. Or, to put it another way, cyberspace’s

divisions are as real as the meaningful, but also imaginary, lines that

divide the United States from Canada or North from South Carolina.

But cyberspace, like life, is constantly evolving. The hybrid com-

bination of technology and the humans that use it is always chang-

ing, inexorably altering everything from cyberspace’s size and scale

to the technical and political rules that seek to guide it. As one expert

put it, “The geography of cyberspace is much more mutable than

other environments. Mountains and oceans are hard to move, but

portions of cyberspace can be turned on and off with the click of a

switch.” The essential features remain the same, but the topography

is in constant fl ux. The cyberspace of today is both the same as but

also utterly different from the cyberspace of 1982.

The hardware and software that make up cyberspace, for instance,

were originally designed for computers operating from fi xed wires

and telephone lines. Mobile devices were fi rst the stuff of Star Trek and then only for the drug dealers on Miami Vice who could afford to have something as exotic as a “car phone.” Today, a growing per-

centage of computing is moving onto mobile devices, so much so

oxfordhb-9780199918096.indd 14oxfordhb-9780199918096.indd 14 21-10-2013 22:38:1321-10-2013 22:38:13

How It All Works 15

that we’ve seen toddlers punch the screens of desktop computers as

if they were broken iPads.

Along with the technology of cyberspace, our expectations of it

are likewise evolving. This generates new norms of behavior, from

how kids “play” to the even more powerful concept that we should

all have access to cyberspace and be able to express our personal

opinions within it, on everything from a Hollywood star’s new

hairdo to what we think of an authoritarian leader.

So what constitutes the Internet itself is evolving before us in an

even more fundamental way. It is simultaneously becoming mas-

sively bigger (each day some 2,500,000,000,000,000,000 bytes are

added to the global supply of digital information) and far more per-

sonalized. Rather than passively receiving this onslaught of online

information, the individual users are creating and tailoring sites

to their personal use, ultimately revealing more about themselves

online. These sites range from social networks like Facebook in the

United States and RenRen in China to microblogs like Twitter and

the Chinese equivalents Tencent and Sina. Indeed, microblogs in

China (called Weibo) have taken off to the extent that 550  million

were registered in 2012.

Thus, while cyberspace was once just a realm of communication

and then e-commerce (reaching over $10 trillion a year in sales), it

has expanded to include what we call “critical infrastructure.” These

are the underlying sectors that run our modern-day civilization,

ranging from agriculture and food distribution to banking, health-

care, transportation, water, and power. Each of these once stood

apart but are now all bound together and linked into cyberspace via

information technology, often through what are known as “super-

visory control and data acquisition” or SCADA systems. These are

the computer systems that monitor, adjust switching, and control

other processes of critical infrastructure. Notably, the private sec-

tor controls roughly 90 percent of US critical infrastructure, and the

fi rms behind it use cyberspace to, among other things, balance the

levels of chlorination in your city’s water, control the fl ow of gas that

heats your home, and execute the fi nancial transactions that keep

currency prices stable.

Cyberspace is thus evolving from “the nervous system—the con-

trol system of our economy,” as President George W. Bush once said,

into something more. As Wired magazine editor Ben Hammersley

oxfordhb-9780199918096.indd 15oxfordhb-9780199918096.indd 15 21-10-2013 22:38:1321-10-2013 22:38:13

16 CYBERSECURITY AND CYBERWAR

describes, cyberspace is becoming “the dominant platform for life

in the 21st century.”

We can bitch about it, but Facebook, Twitter, Google and all the

rest are, in many ways the very defi nition of modern life in the

democratic west. For many, a functioning Internet with free-

dom of speech, and a good connection to the social networks

of our choice is a sign not just of modernity, but of civilization

itself. This is not because people are “addicted to the video

screen,” or have some other patronizing psychological diagno-

sis. But because the Internet is where we live. It’s where we do

business, where we meet, where we fall in love. It is the cen-

tral platform for business, culture, and personal relationships.

There’s not much else left. To misunderstand the centrality

of these services to today’s society is to make a fundamental

error. The Internet isn’t a luxury addition to life; for most peo-

ple, knowingly or not, it is life.

But just as in life, not everyone plays nice. The Internet that we’ve

all grown to love and now need is increasingly becoming a place of

risk and danger.

Where Did This “Cyber Stuff” Come from Anyway?

A Short History of the Internet

“Lo.”

This was the very fi rst real word transmitted over the computer

network that would evolve into the Internet. But rather than the

beginning of some profound proclamation like “Lo and behold,”

“Lo” was instead the product of a system failure. In 1969, research-

ers at UCLA were trying to log into a computer at the Stanford

Research Institute. But before they could type the “g” in the word

“log,” the computer at the Stanford end of the network crashed.

However, the ARPANET project, so named as it was funded by the

Advanced Research Projects Agency (ARPA), would eventually

transform how computers shared data and, with that, everything

else.

oxfordhb-9780199918096.indd 16oxfordhb-9780199918096.indd 16 21-10-2013 22:38:1321-10-2013 22:38:13

How It All Works 17

Electronic communication networks have been shaping how we

share information since the invention of the telegraph, the device

that some now look back on and call the “Victorian Internet.” The

hype around that old technology were similarly high; contempo-

raries declared that, with the telegraph, “It is impossible that old

prejudices and hostilities should longer exist.”

What makes the Internet distinct from prior communication

networks like the old telegraphs and then telephone networks,

however, is that it is packet-switched instead of circuit-switched.

Packets are small digital envelopes of data. At the beginning

of each packet, essentially the “outside” of the envelope, is the

header, which contains details about the network source, desti-

nation, and some basic information about the packet contents.

By breaking up flows of data into smaller components, each can

be delivered in an independent and decentralized fashion, then

reassembled at the endpoint. The network routes each packet as

it arrives, a dynamic architecture that creates both flexibility and

resiliency.

Packet-switching was not developed to allow the United States

to maintain communications even in the event of a nuclear attack,

a common myth. It was really just developed to better enable

more reliable, more efficient connections between computers.

Prior to its rise in the 1970s, communication between two com-

puters required a dedicated circuit, or preassigned bandwidth.

This direct link meant those resources could not be used by any-

one else, even when no data was being transmitted. By break-

ing these conversations into smaller parts, packets from multiple

distinct conversations could share the same network links. It also

meant that if one of the network links between two machines

went down mid-communication, a transmission could be auto-

matically rerouted with no apparent loss of connection (since

there was never a connection to begin with).

ARPA (now DARPA, with a D for “Defense” added) was an orga-

nization developed by the Pentagon to avoid technological surprise

by leaping ahead in research. Computers were proliferating in the

late 1960s, but even more researchers wanted to use them than was

available. To ARPA, that meant fi nding ways to allow people at

different institutions to take advantage of unused computer time

around the country.

oxfordhb-9780199918096.indd 17oxfordhb-9780199918096.indd 17 21-10-2013 22:38:1321-10-2013 22:38:13

18 CYBERSECURITY AND CYBERWAR

Rather than have dedicated—and expensive—connections

between universities, the vision was a network of shared data

links, sharing computational resources. Individual machines

would each be connected with an Interface Message Processor

that handled the actual network connection. This network was

ARPANET, home of the first “Lo” and start of the modern cyber

era. That first 1969 link from UCLA to Stanford grew to link

forty nodes in 1972. Soon more universities and research centers

around the world joined this first network, or alternatively cre-

ated their own networks.

For the purposes of the modern Internet, a series of packets sent

between machines on a single network does not count as an “inter-

net.” Internet implies connecting many different networks, in this

case these various other computer networks beyond ARPANET that

soon emerged but remained unlinked.

The challenge was that different networks used very different

underlying technology. The technical problem boiled down to

abstracting these differences and allowing effi cient communica-

tion. In 1973, the solution was found. Vint Cerf, then a professor

at Stanford, and Robert Khan of ARPA refi ned the idea of a com-

mon transmission protocol. This “protocol” established the expec-

tations that each end of the communication link should make of

the other. It began with the computer equivalent of a three-way

handshake to establish a connection, continuing through how each

party should break apart the messages to be reassembled, and how

to control transmission speeds to automatically detect bandwidth

availability.

The brilliance of the model is how it breaks the communication

into “layers” and allows each layer to function independently. These

packets, in turn, can be sent over any type of network, from sound

waves to radio waves to light pulses on a glass fi ber. Such Transport

Control Protocols, or TCPs, could be used over all sorts of packet

protocols, but we now use a type called the Internet Protocol, or IP,

almost exclusively in the modern Internet.

This protocol enabled the creation of a network of networks. But,

of course, the Internet didn’t stop there. The new links excelled at

connecting machines, but humans excel at making technology con-

form to their whims. As people shared machines for research, they

started leaving messages for each other, simple fi les that could be

oxfordhb-9780199918096.indd 18oxfordhb-9780199918096.indd 18 21-10-2013 22:38:1321-10-2013 22:38:13

How It All Works 19

edited to form a conversation. This became clunky, and in 1972 Ray

Tomlinson at the technical consulting fi rm BBN wrote a basic pro-

gram to read, compose, and send messages. This was e-mail: the fi rst

Internet “killer app.” Within a year, a majority of traffi c across the

network originally created for research was e-mail. Now networked

communication was about people.

The last step in creating the modern Internet was eliminating bar-

riers to entry. Early use was limited to those who had access to the

networked computers at research and defense institutions. These

organizations communicated via dedicated data lines. As the evi-

dent value of networked communication grew and the price of com-

puters dropped, more organizations sought to join. Modems, which

convert data to sound waves and back, allowed basic phone lines to

serve as links to other computers.

Soon, researchers outside computer science wanted access, not

just to take advantage of the shared computing resources, but also

to study the new networking technology itself. The US National

Science Foundation then connected the existing supercomputering

centers around the country into the NSFnet, which grew so rap-

idly that the expansion required commercial management. Each

upgrade brought greater demand, the need for more capacity, and

independently organized infrastructure. The architecture of a “back-

bone” that managed traffi c between the different regional networks

emerged as the effi cient solution.

This period also saw the introduction of the profi t motive in

Internet expansion. For instance, by this point Vint Cerf had joined

the telecommunications fi rm MCI. In 1983, he led efforts to start MCI

mail, the fi rst commercial e-mail service on the Internet. By the late

1980s, it became obvious that managing the nascent Internet was not

the business of the research community. Commercial actors could

provide the necessary network services supporting the Internet

and become avid consumers as well. So the White House Offi ce of

Science and Technology developed a plan to expand and commer-

cialize the backbone services, seeing it as the only way that the new

Internet could truly take off.

The planners envisioned a decade-long process, though, with the

fi nal stages of commercial handover not completed until the late

1990s. Fortunately, a young senator from Tennessee became con-

vinced it should speed up. In 1989, Al Gore authored a bill calling

oxfordhb-9780199918096.indd 19oxfordhb-9780199918096.indd 19 21-10-2013 22:38:1321-10-2013 22:38:13

20 CYBERSECURITY AND CYBERWAR

for quicker privatization of the network. While he would later

make a slight overstatement that he “took the initiative in creating

the Internet,” this move by Congress to accelerate things was cru-

cially important to the Internet’s expansion. By the time Gore was

Vice President in 1994, the NSF was turning over offi cial control of

regional backbone connections to private interests.

This privatization coincided with various new inventions

and improvements that then democratized and popularized the

Internet. In 1990, a researcher at the European research center

CERN in Switzerland took a relatively obscure form of present-

ing information in a set of linked computer documents and built

a new networking interface for it. With this HyperText Transfer

Protocol (HTTP), and an accompanying system to identify the

linked documents (URLs), Tim Berners-Lee “invented” the World

Wide Web as we now look at it. Amusingly, when Berners-Lee

tried to present it at an academic conference, his breakthrough

wasn’t considered worthy enough even to make a formal panel.

Instead, he was relegated to showing a poster on it in a hall-

way. A  few years later, researchers at the University of Illinois

introduced the Mosaic web browser, which simplified both web

design and introduced the new practice of “web surfing” for the

general public.

And whether we like to admit it or not, this is the period when

the pornography industry proved integral to the Internet’s history.

A  darker domain that some estimate makes up 25  percent of all

Internet searches, the smut industry drove both new online users

and new online uses like instant messaging, chatrooms, online

purchasing, streaming video, trading fi les, and webcams (and the

growing demands each of these placed on bandwidth, driving more

underlying business). “Of course pornography has played a key role

in the Web,” says Paul Saffo, an analyst with the Institute for the

Future, a Silicon Valley think tank. “Porn is to new media formats

what acne is to teenagers,” he said. “It’s just part of the process of

growing up.”

And soon the mainstream media started to wake up to the fact

that something big was happening online. As the New  York Times reported in 1994 (in a printed newspaper, of course!), “Increasing

commercialization of the Internet will accelerate its transforma-

tion away from an esoteric communications system for American

oxfordhb-9780199918096.indd 20oxfordhb-9780199918096.indd 20 21-10-2013 22:38:1321-10-2013 22:38:13

How It All Works 21

computer scientists and into an international system for the fl ow of

data, text, graphics, sound and video among businesses, their cus-

tomers and their suppliers.”

Lo and behold indeed.

How Does the Internet Actually Work?

For a few hours in February 2008, Pakistan held hostage all the

world’s cute cat videos.

The situation came about when the Pakistani government, in an

attempt to prevent its own citizens from accessing what it decided

was offensive content, ordered Pakistan Telecom to block access

to the video-sharing website YouTube. To do so, Pakistan Telecom

falsely informed its customers’ computers that the most direct

route to YouTube was through Pakistan Telecom and then pre-

vented Pakistani users from reaching the genuine YouTube site.

Unfortunately, the company’s network shared this false claim of

identity beyond its own network, and the false news of the most

direct way to YouTube spread across the Internet’s underlying

mechanisms. Soon over two-thirds of all the world’s Internet users

were being misdirected to the fake YouTube location, which, in turn,

overwhelmed Pakistan Telecom’s own network.

The effects were temporary, but the incident underscores the

importance of knowing how the Internet works. The best way to

gain this understanding is to walk through how information gets

from one place to another in the virtual world. It’s a bit complex, but

we’ll do our best to make it easy.

Suppose you wanted to visit the informative and—dare we

say—entertaining website of the Brookings Institution, the think

tank where we work. In essence, you have asked your device to talk

to a computer controlled by Brookings in Washington, DC. Your

machine must learn where that computer is and establish a connec-

tion to enable communication.

The fi rst thing your computer needs to know is how to fi nd the

servers that host the Brookings web page. To do that, it will use the

Internet Protocol (IP) number that serves as the address for end-

points on the Internet. Your machine was most likely automati-

cally assigned an IP address by your Internet service provider or

oxfordhb-9780199918096.indd 21oxfordhb-9780199918096.indd 21 21-10-2013 22:38:1321-10-2013 22:38:13

22 CYBERSECURITY AND CYBERWAR

whatever network you are using. It also knows the address of its

router, or the path to the broader Internet. Finally, your computer

knows the address of a Domain Name System server.

The Domain Name System, or DNS, is the protocol and infra-

structure through which computers connect domain names (human

memorable names like Brookings.edu) to their corresponding IP

addresses (machine data like 192.245.194.172). The DNS is global and

decentralized. Its architecture can be thought of as a tree. The “root”

of the tree serves as the orientation point for the Domain Name

System. Above that are the top-level domains. These are the country

codes such as .uk, as well as other domains like .com and .net. Each

of these top-level domains is then subdivided. Many countries have

specifi c second-level domains, such as co.uk and ac.uk, to denote

business and academic institutions, respectively.

Entry into the club of top-level domains is controlled interna-

tionally through the Internet Corporation for Assigned Names

and Numbers (ICANN), a private, nonprofi t organization created

in 1998 to run the various Internet administration and operations

tasks that had previously been performed by US government

organizations.

Each top-level domain is run by a registry that sets its own inter-

nal policies about domains. Organizations, such as Brookings or

Apple or the US Department of State, acquire their domains through

intermediaries called registrars. These registrars coordinate with

each other to ensure the domain names in each top-level domain

remain unique. In turn, each domain manages its own subdomains,

such as mail.yahoo.com.

To reach the Brookings domain, your computer will query the

DNS system through a series of resolvers. The basic idea is to go

up the levels of the tree. Starting with the root, it will be pointed

to the record for .edu, which is managed by Educause. Educause is

the organization of some 2,000 educational institutions that main-

tains the list of every domain registered in .edu. From this list, your

computer will then learn the specifi c IP address of Brookings’s inter-

nal name server. This will allow it to address specifi c queries about

content or applications from inside the Brookings domain. Then,

the Brookings name server will direct your computer to the specifi c

content it is looking for, by returning the IP address of the machine

that hosts it.

oxfordhb-9780199918096.indd 22oxfordhb-9780199918096.indd 22 21-10-2013 22:38:1321-10-2013 22:38:13

How It All Works 23

In reality, this process is a little more complex. For example,

servers often store data locally in caches for future use, so that

every query does not have to go to the root, and the protocol

includes specific error conditions to handle errors predictably. The

rough outline above, however, gives a sense of how it all works.

Now that your computer has the location of the data, how will

that data get to your computer? The server at Brookings needs to

know that it should send data to your machine, and the data needs

to get there. Figure  1.1 illustrates how your computer requests

a web page by breaking down the request into packets and send-

ing them across the Internet. First, at the “layer” of the application,

your browser interprets the click of your mouse as a command in

the HyperText Transfer Protocol (HTTP), which defi nes how to ask

for and deliver content. This command is then passed down to the

transport and network layers. Transport is responsible for breaking

the data down into packet-sized chunks and making sure that all of

How your computer talks to a website

5. Tier 1 or “back-bone” networks route traffic to other nodes that are closer to the destination IP address.

The Website’s

ISP

http://www

IP Packets IP Packets

Your ISP

Backbone Networks

1. You click on a link on your web browser application, which translates the click into a request in the HTTP protocol.

2. The application’s

HTTP request is chopped up by

the operating system into small,

individually addressed IP

packets.

3. Your computer sends packets to the local network.

4. Each packet is routed individually to a larger network. Packets in the same message can take different paths.

7. The web server reassembles the packets, and interprets the HTTP request to send the web content.

6. Website’s ISP sends the traffic to the web server.

Figure 1.1

oxfordhb-9780199918096.indd 23oxfordhb-9780199918096.indd 23 21-10-2013 22:38:1321-10-2013 22:38:13

24 CYBERSECURITY AND CYBERWAR

the chunks arrive free of error and reassembled in the correct order

for the application layer above. The network layer is responsible

for trying its best to navigate the packets across the Internet. If you

think of the data you are trying to send and receive as a package

of information, the transport layer is responsible for packing and

receiving the packages, while the network is responsible for mov-

ing them from source to destination. Once at the destination, the

packets are reassembled, checked, and then passed back up to the

application—in this case, a web server sending you the web content

you requested.

But how do the packets know how to get across the Internet to

their destination? Like the DNS that helped your computer fi nd the

website it was looking for, the organization of Internet networks can

be thought of as a hierarchy. Each computer is part of a network, like

the network connecting all the customers of an Internet service pro-

vider (ISP). ISPs are essentially the organizations that provide access

to the Internet, as well as other related services like e-mail or hosting

websites. Most ISPs are private, for-profi t companies, including a

number of the traditional telephone and cable TV fi rms that began

offering Internet access when the fi eld took off, while others are gov-

ernment or community owned.

Those networks, in turn, form nodes called Autonomous Systems

(AS) in the global Internet. Autonomous Systems defi ne the archi-

tecture of Internet connections. Traffi c is routed locally through the

AS and controlled by the policies of that organization. Each AS has

a set of contiguous blocks of IP addresses and forms the “home”

for these destinations. All have at least one connection to another

AS, while large ISPs might have many. So routing to a particular IP

address is simply a matter of fi nding its AS.

There’s a problem, though:  The Internet is big. There are over

40,000 AS nodes on the Internet today, and their interconnections are

changing and shifting over time. Given this scale, a global approach

to routing everything the same way is impossible.

Instead, the Internet uses a dynamic, distributed system that does

not maintain a permanent vision of what the network looks like at

any given time. The principle of routing is fairly simple:  at each

point in the network, a router looks at the address of an incoming

packet. If the destination is inside the network, it keeps the packet

oxfordhb-9780199918096.indd 24oxfordhb-9780199918096.indd 24 21-10-2013 22:38:1321-10-2013 22:38:13

How It All Works 25

and sends it to the relevant computer. Otherwise, it consults a rout-

ing table to determine the best next step to send the packet closer to

its destination.

The devil is in the details of this routing table’s construction.

Since there is no global address book, the nodes in the network have

to share key information with other routers, like which IP addresses

they are responsible for and what other networks they can talk to.

This process happens separately from the Internet routing process

on what is known as the “control plane.” Routers also pass along

information to their neighbors, sharing up-to-date news about the

state of the network and who can talk to whom. Each router then

constructs its own internal, temporary model of how best to route

the traffi c coming through. This new model, in turn, is shared so that

a router’s neighbors now know how it will pass along new traffi c.

If this sounds complex, it’s because it is! In just a few pages,

we’ve summed up what it took decades of computer science

research to create. The takeaway for cybersecurity is that the entire

system is based on trust. It is a system that works effi ciently, but

it can be broken, either by accident or by maliciously feeding the

system bad data.

The Pakistan example shows what happens when that trust is

abused. The government censors “broke the Internet” by falsely

claiming to have direct access to the IP address that serves YouTube.

This was a narrow, local, politically motivated announcement. But

because of how the Internet works, soon every ISP in Asia was try-

ing to route all their YouTube traffi c to Pakistan, solely because they

believed it was closer than the real intended destination. The models

they were building were based on false information. As more net-

works did this, their neighbors also came to believe that YouTube

was the Pakistani IP address. The whole mess wasn’t resolved until

Google engineers advertised the correct routes aggressively across

the network.

In sum, understanding the Internet’s basic decentralized architec-

ture provides two insights for cybersecurity. It offers an appreciation

of how the Internet functions without top-down coordination. But it

also shows the importance of the Internet’s users and gatekeepers

behaving properly, and how certain built-in choke points can create

great vulnerabilities if they don’t.

oxfordhb-9780199918096.indd 25oxfordhb-9780199918096.indd 25 21-10-2013 22:38:1321-10-2013 22:38:13

26 CYBERSECURITY AND CYBERWAR

Who Runs It? Understanding Internet Governance

In 1998, a computer researcher and a respected leader in the net-

working community named Jon Postel sent an innocuous sounding

e-mail to eight people. He asked them to reconfi gure their servers

so that they would direct their Internet traffi c using his computer

at the University of Southern California rather than a computer in

Herndon, Virginia. They did so without question, as Postel (who

had been part of the team that set up the original ARPANET) was

an icon in the fi eld, who served as a primary administrator for the

network’s naming system.

With that one e-mail, Postel committed the fi rst coup d’état of

the Internet. The people he had e-mailed ran eight of the twelve

organizations that controlled all the name servers—the comput-

ers ultimately responsible for translating a domain name such as

“Brookings.edu” into a computer-addressable IP address. And the

computer in Virginia that he had steered two-thirds of the Internet’s

root servers away from was controlled by the US government. While

Postel would later say he had only seized control of a majority of

the Internet’s root servers as a “test,” others think that he did so

in protest, showing the US government “that it couldn’t wrest con-

trol of the Internet from the widespread community of researchers

who had built and maintained the network over the previous three

decades.”

Postel’s “coup” illustrates the crucial role of governance issues

even for a technical space. As the Internet has grown from a small

research network to the global underpinning of our digital society,

questions of who runs it have become more and more important.

Or, as Eric Schmidt (who went on to become the CEO of a little fi rm

known as Google) told a 1997 programmers conference in San

Francisco, “The Internet is the fi rst thing that humanity has built

that humanity doesn’t understand, the largest experiment in anar-

chy that we have ever had.”

Since digital resources are not “scarce” like traditional resources, its

governance questions are a bit different. That is, the main questions of

Internet governance are of interoperability and communication rather

than the classic issue of distribution, which has consumed political

thinkers from Socrates to Marx. However, even in a digital world of

seemingly endless resources, traditional issues of governance also

arise in cyberspace, including representation, power, and legitimacy.

oxfordhb-9780199918096.indd 26oxfordhb-9780199918096.indd 26 21-10-2013 22:38:1321-10-2013 22:38:13

How It All Works 27

Key decision chokepoints revolve around the technical standards for

interoperability, the distribution of IP numbers that gives computers

an address allowing them to send and receive packets, and the man-

agement of the Internet’s naming system. Interestingly enough, it is

this fi nal category, the intersection of the technical and nontechnical

aspect of naming, that has produced the most confl ict.

The operations of the Internet require independent actors to fol-

low basic rules that guarantee interoperability, known as standards.

This standards-based approach goes back to the beginning of the

Internet, when the engineers building the initial systems published

Requests For Comments (RFCs) to seek feedback on proposed stan-

dards. Over time, this group of network engineers and researchers

grew into an international, voluntary standards organization called

the Internet Engineering Task Force (IETF). The IETF develops

new Internet standards and protocols and modifi es existing ones

for better performance. Everything developed by the IETF falls

under specifi c working groups that concentrate on areas like rout-

ing, applications, and infrastructure. These groups are open forums

that work mostly through mailing lists, and anyone is welcome to

participate. Many of the individuals in them are from large technol-

ogy fi rms, but no one actor or small party can steamroll the process,

which relies on consensus.

Openness, and even a sense of whimsy, is critical to the culture

of the IETF. In some working group meetings, the members decide

on an issue by humming for or against a proposal. The proposal

with the loudest hum advantage wins. While it sounds a bit silly, it

is seen as a way of maintaining the original Internet creators’ ethic

of fostering consensus and reaching decisions relatively quickly.

The volume of the humming also helps maintain a level of ano-

nymity, unless you abuse the system: That is, you can hum or not

without opening your mouth, but it’s hard to hum louder to domi-

nate a vote without being too obvious about it, which would cause

backlash.

Despite the sense of fun that can drive working groups members,

security is a principle concern in the system. In addition to work-

ing groups focused on particular security issues, every proposed

standard must have an explicit “Security Considerations” section.

Additionally, a security directorate reviews all proposed standards

passed from the working groups to the Steering Group.

oxfordhb-9780199918096.indd 27oxfordhb-9780199918096.indd 27 21-10-2013 22:38:1321-10-2013 22:38:13

28 CYBERSECURITY AND CYBERWAR

While the IETF has no offi cial board or formal leadership, the

Internet Engineering Steering Group (IESG) offers oversight and

guidance for both the standards process and the standards them-

selves. In turn, the Internet Architecture Board (IAB), which evolved

from the technical advisory board of the original ARPANET man-

agement in the early 1970s, offers further oversight of the IESG.

Both of these organizations fall under the auspices of the Internet

Society, or ISOC, an international group formed in 1992 that over-

sees most of the technical standards process. The ISOC came about

when Internet governance moved beyond just matters of techni-

cal coordination. As the web went global and companies began to

depend on Internet business, more and more participants had a

fi nancial or political stake in the system’s evolution in one direc-

tion or another. Organizations began to disagree on process, and

the US government’s central involvement worried many. The ISOC

was established as an independent, international organization to

offer a formal, legal means to safeguard the independent and open

standards processes. ISOC’s power derives from its membership;

it’s open to any individual and, for a fee, any organization. These

members then elect trustees who, in turn, appoint leadership to the

IAB, which oversees the governance process for the IESG and the

working groups’ process they guide.

Imagine this alphabet soup all as a mix of informal, semiformal,

and formal groups all nested together. This structure promotes a

high degree of independence while still allowing for accountability

to the Internet community. While there are political and fi nancially

motivated disagreements, when it comes to standards development,

the process has thus far fostered globally shared interest in main-

taining a functioning Internet.

This ethic of shared interest, however, becomes more diffi cult

in dealing with property rights and other scarce resources on the

Internet. The Internet may be seemingly infi nite in size, but it still

has zero-sum games. Identifi ers such as IP addresses and domains

have to be unique—the Internet wouldn’t work if multiple parties

attempted to use the same IP address or wanted to resolve a domain

name to a competing address. One of the earliest oversight roles

was apportioning these numbers and names. What emerged was

the Internet Assigned Numbers Authority, a collaborative effort of

the US government and the early researchers who had developed

oxfordhb-9780199918096.indd 28oxfordhb-9780199918096.indd 28 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 29

the original technology. Yet as the Internet grew, control of this pro-

cess grew more important. Assigning names and numbers meant

control over who could access the Internet and how. Jon Postel’s

“coup” illustrated the need for a more transparent and accessible

governance structure.

The growing pressure for a commercial Internet, and the emerg-

ing realization that Americans could not expect to control the net-

work forever, meant that this new structure could not be run by the

US government. In 1998, after a survey period that sought input

from the public and key Internet leaders and organizations, respon-

sibility shifted to an independent corporation with a governance

structure that “refl ects the geographical and functional diversity of

the Internet.” The Internet Corporation for Assigned Names and

Numbers, or ICANN, was born.

While chartered in California as a nonprofi t, ICANN set in motion

a structured way to distribute IP addresses that more appropriately

refl ected the Internet’s global nature. Regional authorities in North

America, Europe, and Asia, followed later by Latin America and

fi nally Africa in 2004, took over this task and continue to perform

this role today.

Not everything with ICANN is easy. Domains defi ne identity on

the Internet, which brings strong commercial and political inter-

ests into confl ict. Decisions about who gets what Internet iden-

tity inherently create winners and losers; adding new top-level

domains such as .tech enables new business models but requires

more expense for trademark protection to fend off “squatters.”

Trademarks themselves can pose risks. For example, a process was

needed to decide which of the many businesses with “Apple” in

their name would get apple.com. At the same time, that process

could not be corrupted to deny free speech opportunities, such as

<insert whatever trademark name you dislike>sucks.com. This

process has even touched on hot issues of national identity. When

nations achieve independence or dissolve into civil war, who con-

trols their country’s top-level domain? In Western Sahara, both

sides of a forty-year-old confl ict claim the rights to the top-level

domain .eh.

The process and governance of ICANN have drawn even more

controversy. Policy scholars use the term “multi-stakeholder pro-

cess” to describe its organic, open, yet non-representative approach.

oxfordhb-9780199918096.indd 29oxfordhb-9780199918096.indd 29 21-10-2013 22:38:1421-10-2013 22:38:14

30 CYBERSECURITY AND CYBERWAR

Decisions are supposed to be made by consensus, while a host

of advisory committees help represent key constituencies in the

Internet’s smooth operations, such as Internet service providers and

the intellectual property community. National interests from around

the world are represented through a Governmental Advisory

Committee. Yet this multi-stakeholder model strikes some as dis-

posed to favor the powerful. Governments and large commercial

interests can afford to pay staff to participate in these forums, while

nonprofi t civil society groups may lack the resources to sit at the

table at all. Many argue that special interests are too heavily repre-

sented among the decision-makers. Others want it to be more like

traditional international organizations, which tend to follow the

United Nations model of “one state, one vote.”

And despite efforts to globalize Internet governance, many still

see ICANN as captive to US interests. The control of assigning

names and numbers still ostensibly belongs to the US Department

of Commerce, which it delegates to ICANN by renewable contract.

That is, the United States retains overall control, while the manage-

ment function is held by an industry-led organization. Both have a

vested interest in maintaining the status quo.

The challenge, of course, is that no other institution or process

could easily replace ICANN. While it is easy to criticize ICANN,

there is no practical model for an alternative organization that must

represent and balance such a broad range of interests from around

the world and across all sides of complex policy issues.

The key takeaway of these governance issues for cybersecurity

is not just the important role that trust and open-mindedness have

played in the Internet’s growth (aspects that are challenged by

growing security concerns) but that the Internet has always been

recognized as a space that defi es traditional governance models. In

1992, Internet pioneer David Clark of MIT set out his bold dictum

for the community:

We reject: kings, presidents and voting. We believe in: rough consensus and running code.

This quote has been widely circulated. Less well known is what

Clark wrote on his very next slide: “What are we bad at? Growing

our process to match our size.”

oxfordhb-9780199918096.indd 30oxfordhb-9780199918096.indd 30 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 31

On the Internet, How Do They Know Whether You Are

a Dog? Identity and Authentication

Carnegie Mellon University professor Alessandor Acquisti has a fun

but scary party trick: show him a picture of your face that is online

and he will then guess your Social Security number.

Understanding how Acquisti does this is useful even for

non-Americans (who lack these supposedly secret Social Security

numbers) because it illustrates the story of identity and authenti-

cation and how it can go awry. Acquisti fi rst uses image-matching

technology to fi nd your face on a social networking website. If your

birthdate and birth city are listed online, as they are for most people,

then he can use the patterns that link time and location to the fi rst

fi ve of the nine numbers in your Social Security number. Then it is

just a numbers guessing game for the remaining digits. If you come

from a small state like Delaware, the Social Security number can be

determined in less than 10 tries.

In theory, no one should care, since Social Security numbers were

never meant to be secret. Before 1972, Social Security cards even said

“not for identifi cation” on them. But as we began to use computers

to track people, it became critical for computers to differentiate indi-

viduals. Using someone’s name alone wasn’t enough: there are too

many John Smiths in the world. Across every database, each record

needed to be accessed with some identifi er unique to that person.

And since every American had a unique Social Security number, it

was convenient to use that.

So far, so good. The number was just a means to look someone up in

a computer. But this number also became the way for two systems to

know they were talking about the same person. Soon the Social Security

number began to be used to track bank accounts, tax details, and all

other sorts of personal information. Along the way, organizations

assumed that, since Social Security numbers weren’t published, they

weren’t public, and if they weren’t public, they must be secret. Wrong.

In the computer world, “identifi cation” is the act of mapping an

entity to some information about that entity. This can be as mun-

dane as a fantasy football website accepting the association between

a person and the name the person claims, or as critical as matching

a medical record to an unconscious patient.

It is important to separate identifi cation from “authentication,”

which is the proof of the identifi cation. This proof has traditionally

oxfordhb-9780199918096.indd 31oxfordhb-9780199918096.indd 31 21-10-2013 22:38:1421-10-2013 22:38:14

32 CYBERSECURITY AND CYBERWAR

been defi ned as “something you know, something you have, or

something you are.” What you “know” is the basic password model.

It is a secret that is known, presumably only by the right person.

Something you “have” refers to a physical component with lim-

ited access, so that only the right person might have it. With bank

ATMs, it is a card, while more recently the mobile phone has become

a de facto authenticator for receiving text messages containing a

one-time code. By entering this one-time code, people taking action

on the Web show that they have control of the verifi ed mobile phone

that is receiving the messages. Finally, you can prove who you “are”

through something recognizable. Since this often refers to one’s

person, we call this a “biometric.” Biometrics can be as simple as

another human recognizing your face or as sophisticated as a sensor

that recognizes your eye’s retina.

There are weaknesses with these proofs. Passwords can be

guessed or broken and require a cognitive load (you have to memo-

rize them). If they are reused across different contexts, then breaking

one system allows an attacker into others. Things that you “have”

can be stolen or forged. And even biometrics can be compromised.

For instance, access readers that require supposedly unique fi nger-

prints have been fooled by forged fi ngerprints pressed into Gummy

Bear candy, or, much more gruesomely, pressing down an ampu-

tated fi nger onto the machine (Russian mobsters ironically don’t

seem to like cute, bear-shaped candy).

There are various mechanisms to bolster these measures. One is

to contact trusted friends to confi rm that individuals are who they

say they are. The idea is drawn from the old line “It’s all about who

you know,” since a mutually trusted friend can verify that the indi-

vidual in question conforms to the claimed identity. Other systems

factor in the cost of fooling the controls. Anyone can create a website

claiming a specifi c identity, but it requires time and effort to main-

tain an active and lengthy presence on an associated social media

platform like Twitter or Facebook. Here again, these can be hacked

or faked, but at a much greater cost to the attacker to pull off.

After authentication is authorization. Now that a system knows

who you are, what can you do? In classic computer security, autho-

rization was about giving access to network fi les, but in our increas-

ingly connected world, gaining authorization can open the doors

to practically everything. Authorization is the part that links these

oxfordhb-9780199918096.indd 32oxfordhb-9780199918096.indd 32 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 33

technical issues to policy, business, political and moral questions. Is

the individual authorized to buy something, like an account on an

online gambling site? And even if so, is the individual old enough to

participate? Or, at a slightly larger world stage, just because some-

one has access to a military’s classifi ed networks, should the person

be authorized to read and copy every fi le in them (a practice that

would haunt the US military in the Bradley Manning and Edward

Snowden leaks)?

The entire problem was perhaps best illustrated by one of the most

cited cartoons in history. In 1993, New Yorker magazine published a drawing by Peter Steiner of two dogs sitting near a computer. One

dog tells the other, “On the Internet, nobody knows you’re a dog.”

Yet this isn’t to say that people can’t fi nd out private details about

you if they want. Every activity on the Internet is data being routed

from an Internet Protocol (IP) address. As we saw in the prior section,

an IP address is a numerical label that is assigned to an addressable

connection in the Internet. For most consumers, the IP address is not

permanently assigned to their device. Instead, the IP address will be

dynamic. The consumer’s Internet service provider will assign an

IP address for a period of time, but it might be reassigned to some-

one else after the consumer disconnects. However, if an Internet ser-

vice provider retains the relevant data, it is able to correlate the IP

address at a specifi c date and time to a particular service subscriber.

An IP address is not in and of itself information about an identifi -

able individual. But it can provide some information about the geo-

graphic location and the means by which that individual accesses the

Internet. It is the potential for how the IP address can be combined

with other information (or could be reasonably combined with other

information) that has privacy advocates concerned. If you can com-

bine enough of this online and offl ine information, you might have

enough data to make a high-probability guess about who was doing

what and where. For instance, in the 2012 scandal that enveloped

CIA director General David Petraeus, the FBI was able to backtrack

the anonymous sender of a series of threatening e-mails to the busi-

ness center of a hotel that his mistress turned out to be staying at.

The information gathered about identity is not the same as proof

of identity. Relying on the IP address would be like relying on license

plates to identify drivers. A sophisticated user can easily hide or dis-

guise her IP address by routing her activities through another point

oxfordhb-9780199918096.indd 33oxfordhb-9780199918096.indd 33 21-10-2013 22:38:1421-10-2013 22:38:14

34 CYBERSECURITY AND CYBERWAR

on the Internet, making it appear that that node was responsible for

the original traffi c. There are, however, many other types of data

that can be collected that are harder to hide. Even the patterns of

how individual users browse and click through a website can be

used to identify them.

This question of how can we identify and authenticate online activities is a different question from how should we. You may not have wanted your Social Security number to be revealed at

a party. Or that dog might have preferred its identity remain

secret, at least until the two of you had gone out on a few more

online dates.

For the purposes of cybersecurity, the bottom line is that digital

identity is a balance between protecting and sharing information.

Limiting acquired information is not only good for privacy, it can

prevent others from gaining information for more sophisticated

authentication fraud. At the same time, each system has incentives

to maximize the amount of data it collects, as well as use that data

for its own goals.

What Do We Mean by “Security” Anyway?

There’s an old joke in the security industry about how to secure any

computer: Just unplug it.

The problem is not only that the joke is becoming outdated in

an era of wireless and rechargeable devices, but once a machine is

plugged in, there are practically an infi nite number of ways its use

might deviate from its intended purpose. This deviation is a mal-

function. When the difference between the expected behavior and

actual behavior is caused by an adversary (as opposed to simple

error or accident), then the malfunction is a “security” problem.

Security isn’t just the notion of being free from danger, as it is

commonly conceived, but is associated with the presence of an

adversary. In that way, it’s a lot like war or sex; you need at least

two sides to make it real. Things may break and mistakes may be

made, but a cyber problem only becomes a cybersecurity issue if

an adversary seeks to gain something from the activity, whether to

obtain private information, undermine the system, or prevent its

legitimate use.

oxfordhb-9780199918096.indd 34oxfordhb-9780199918096.indd 34 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 35

To illustrate, in 2011 the Federal Aviation Administration ordered

nearly half of US airspace shut down and more than 600 planes

grounded. It seemed like a repeat of how American airspace was

shut down after the 9/11 attacks. But this incident wasn’t a secu-

rity issue, as there was no one behind it. The cause was a software

glitch in a single computer at the Atlanta headquarters building.

Take the same situation and change the glitch to a hack:  that’s a

security issue.

The canonical goals of security in an information environment

result from this notion of a threat. Traditionally, there are three

goals:  Confi dentiality, Integrity, Availability, sometimes called the

“CIA triad.”

Confi dentiality refers to keeping data private. Privacy is not just

some social or political goal. In a digital world, information has

value. Protecting that information is thus of paramount importance.

Not only must internal secrets and sensitive personal data be safe-

guarded, but transactional data can reveal important details about

the relationships of fi rms or individuals. Confi dentiality is sup-

ported by technical tools such as encryption and access control as

well as legal protections.

Integrity is the most subtle but maybe the most important part

of the classic information security triumvirate. Integrity means

that the system and the data in it have not been improperly altered

or changed without authorization. It is not just a matter of trust.

There must be confi dence that the system will be both available and

behave as expected.

Integrity’s subtlety is what makes it a frequent target for the most

sophisticated attackers. They will often fi rst subvert the mechanisms

that try to detect attacks, in the same way that complex diseases like

HIV-AIDS go after the human body’s natural defenses. For instance,

the Stuxnet attack (which we explore later in Part II) was so jar-

ring because the compromised computers were telling their Iranian

operators that they were functioning normally, even as the Stuxnet

virus was sabotaging them. How can we know whether a system is

functioning normally if we depend on that system to tell us about

its current function?

Availability means being able to use the system as anticipated.

Here again, it’s not merely the system going down that makes

availability a security concern; software errors and “blue screens of

oxfordhb-9780199918096.indd 35oxfordhb-9780199918096.indd 35 21-10-2013 22:38:1421-10-2013 22:38:14

36 CYBERSECURITY AND CYBERWAR

death” happen to our computers all the time. It becomes a security

issue when and if someone tries to exploit the lack of availability

in some way. An attacker could do this either by depriving users of

a system that they depend on (such as how the loss of GPS would

hamper military units in a confl ict) or by merely threatening the

loss of a system, known as a “ransomware” attack. Examples of

such ransoms range from small-scale hacks on individual bank

accounts all the way to global blackmail attempts against gam-

bling websites before major sporting events like the World Cup

and Super Bowl.

Beyond this classic CIA triangle of security, we believe it is impor-

tant to add another property: resilience. Resilience is what allows a

system to endure security threats instead of critically failing. A key

to resilience is accepting the inevitability of threats and even limited

failures in your defenses. It is about remaining operational with the

understanding that attacks and incidents happen on a continuous

basis. Here again, there is a parallel to the human body. Your body

still fi gures out a way to continue functioning even if your external

layer of defense—your skin—is penetrated by a cut or even bypassed

by an attack like a viral infection. Just as in the body, in the event of

a cyber incident, the objective should be to prioritize resources and

operations, protect key assets and systems from attacks, and ulti-

mately restore normal operations.

All of these aspects of security are not just technical issues: they

are organizational, legal, economic, and social as well. But most

importantly, when we think of security we need to recognize its

limits. Any gain in security always involves some sort of trade-off.

Security costs money, but it also costs time, convenience, capabili-

ties, liberties, and so on. Similarly, as we explore later on, the dif-

ferent threats to confi dentiality, availability, integrity, and resiliency

each require different responses. Short of pulling the plug, there’s no

such thing as absolute security.

What Are the Threats?

It sounds odd that reporters took a passenger jet to Idaho just to

watch a cyberattack, but that’s exactly what happened in 2011.

Worried that the public did not understand the magnitude

of growing cyberthreats, the Department of Homeland Security

oxfordhb-9780199918096.indd 36oxfordhb-9780199918096.indd 36 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 37

fl ew journalists from around the country to the Idaho National

Laboratory. Only four years earlier, the INL, an incredibly secure

and secretive facility that houses a Department of Energy’s nuclear

research facility, had conducted a top-secret test to destroy a large

generator via cyberattack. In 2011, in an effort to raise awareness

about cyberthreats, government experts not only declassifi ed a

video of the 2007 test, but held a public exercise for journalists to

“watch” a faked cyberattack on a mock chemical plant. The govern-

ment wanted to show that even their own experts couldn’t prevent a

team of hired hackers (known as a “red team”) from overwhelming

the defenses of a critical facility.

This episode is a good illustration of how those who profession-

ally think and talk about cybersecurity worry that their discussions

of threats are ignored or downplayed. Frustrated, the result is that

they resort to turning the volume up to the proverbial 11 à la Spinal Tap , conducting outlandish exercises and only talking about the mat- ter in the most extreme ways that then echo out into the media and

public. Indeed, following a series of warnings by US government

offi cials, by 2013 there were over half a million online references in

the media to “cyber Pearl Harbor” and another quarter million to a

feared “cyber 9/11.” 

The complacency these experts worry about stems in part from

our political system’s reluctance to address diffi cult, complex prob-

lems in general, and cybersecurity in particular. But this kind of

tenor also feeds into a misunderstanding of the threats. For example,

three US senators sponsored a large cybersecurity bill in the summer

of 2011, and so wrote an op-ed in the Washington Post urging sup- port for their legislation. They cited a series of recent, high-profi le

attacks, including those against the Citigroup and RSA companies

and the Stuxnet worm’s attack on Iranian nuclear research. The

problem is that these three cases refl ected wildly different threats.

The Citigroup attack was about fi nancial fraud. The RSA attack was

industrial theft, and Stuxnet was a new form of warfare. They had

little in common other than they involved computers.

When discussing cyber incidents or fears of potential incidents,

it is important to separate the idea of vulnerability from threat. An

unlocked door is a vulnerability but not a threat if no one wants to

enter. Conversely, one vulnerability can lead to many threats:  that

unlocked door could lead to terrorists sneaking in a bomb,

oxfordhb-9780199918096.indd 37oxfordhb-9780199918096.indd 37 21-10-2013 22:38:1421-10-2013 22:38:14

38 CYBERSECURITY AND CYBERWAR

competitors walking out with trade secrets, thieves purloining valu-

able goods, local hooligans vandalizing property, or even cats wan-

dering in and distracting your staff by playing on the keyboards.

The defi ning aspects of threats are the actor and the consequence.

The acknowledgment of an actor forces us to think strategically

about threats. The adversary can pick and choose which vulnerabil-

ity to exploit for any given goal. This implies that we must not only

address a range of vulnerabilities with respect to any given threat,

but also understand that the threat may evolve in response to our

defensive actions.

There are many kinds of bad actors, but it is too easy to get lulled

into using media clichés like “hackers” to lump them all together.

An actor’s objective is a good place to start when parceling them out.

In the variety of attacks cited by the senators above, the Citigroup

attackers wanted account details about bank customers with an

ultimate goal of fi nancial theft. In the attack on RSA, the attackers

wanted key business secrets in order to spy on other companies. For

Stuxnet (a case we’ll explore further in Part II), the attackers wanted

to disrupt industrial control processes involved in uranium enrich-

ment, so as to sabotage the Iranian nuclear program.

Finally, it is useful to acknowledge when the danger comes from

one of your own. As cases like Bradley Manning and WikiLeaks

or Edward Snowden and the NSA scandal illustrate, the “insider

threat” is particularly tough because the actor can search for vulner-

abilities from within systems designed only to be used by trusted

actors. Insiders can have much better perspectives on what is valu-

able and how best to leverage that value, whether they are trying to

steal secrets or sabotage an operation.

It is also important to consider whether the threat actor wants

to attack you , or just wants to attack. Some attacks target specifi c actors for particular reasons, while other adversaries go after a cer-

tain objective regardless of who may control it. Untargeted mali-

cious code could, for example, infect a machine via e-mail, search

for stored credit card details of anyone, and relay those details back

to its master without any human involvement. The key difference

in these automated attacks is one of cost, both from the attacker’s

and the defender’s perspective. For the attacker, automation hugely

reduces cost, as they don’t have to invest in all the tasks needed,

from selecting the victim to identifying the asset to coordinating the

oxfordhb-9780199918096.indd 38oxfordhb-9780199918096.indd 38 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 39

attack. Their attack costs roughly the same no matter how many

victims they get. A targeted attack, on the other hand, can quickly

scale up in costs as the number of victims rises. These same dynam-

ics shape the expected returns. To be willing to invest in targeted

attacks, an attacker must have a higher expected return value with

each victim. By contrast, automated attacks can have much lower

profi t margins.

The good news is that there are only three things you can do to

a computer: steal its data, misuse credentials, and hijack resources.

Unfortunately, our dependence on information systems means that a

skilled actor could wreak a lot of damage by doing any one of those.

Stolen data can reveal the strategic plans of a country or undermine

the competitiveness of an entire industry. Stolen credentials can give

the ability to change or destroy code and data, changing payrolls or

opening up dams, as well as the ability to cover tracks. Hijacking

resources can prevent a company from reaching customers or deny

an army the ability to communicate.

In the end, there are many things that can happen, but they have

to be caused by someone. Threats should be assessed by under-

standing potential bad actors, what they are trying to do, and why.

And you shouldn’t need to fl y all the way to Idaho to learn that.

One Phish, Two Phish, Red Phish, Cyber Phish: What Are

Vulnerabilities?

In 2011, London police confronted a mysterious and unusual spike

in car thefts. The odd thing wasn’t just that so many cars were being

stolen, over 300 in all, but that the cars were all of a particular brand,

new BMWs. And, second, the thieves were somehow stealing hun-

dreds of cars equipped with some of the most advanced car security

systems in the world, without activating the alarms.

What the police soon fi gured out by watching hidden security

camera footage of the thieves in action was that the robbers had fi g-

ured out how to use the car’s advanced technology against itself.

First, they used radio frequency jammers to block the signal of a

car’s electronic key. Instead of the car owner locking the doors as

they walked away, the doors would remain unlocked. Once in the

car, the thief would then plug into the OBD-II connector (the elec-

tronic port that mechanics use to diagnose your car’s problems) and

oxfordhb-9780199918096.indd 39oxfordhb-9780199918096.indd 39 21-10-2013 22:38:1421-10-2013 22:38:14

40 CYBERSECURITY AND CYBERWAR

then use that to obtain the car’s unique key fob digital ID. Next, the

thief would reprogram a blank electronic key to correspond with

the car’s ID. Then they simply drove away, with the owner of the

advanced luxury car none the wiser. It all took only a few minutes.

These vulnerabilities led to so many thefts that police resorted to

leaving paper leafl ets on all BMWs parked in London warning them

of the danger.

The case of the lost luxury cars is a good illustration of how build-

ing a complex system can create new openings and hidden vulner-

abilities that bad guys can try to exploit. Different vulnerabilities

allow an attacker to achieve different goals. In some cases, it might

be the ability to read confi dential data. Or the goal could be the ulti-

mate prize—compromise of the entire system. When the attacker

has such “root access,” the ability to execute any command, the

victim is completely vulnerable, or what hackers call “pwned” (An

apocryphal story is that a hacker meant to type that a target was

now “owned.” But he typed too fast, mistakenly hit the p key right next to the o , and a cool term was born.)

Often the easiest way to gain control of the system is simply to

ask. A time-honored tradition for breaking into systems from hack-

ing’s early days is to call up a low-level employee, claim to be from

technical support, and ask for the person’s password. This falls into

the category of what is known as “social engineering,” manipu-

lating people into revealing confi dential information and thereby

helping the attacker. The manipulation can take many forms, often

with the attacker trying to set up a scenario designed to encourage

cooperation through psychological mechanisms. Fear is a powerful

motivator. When a user’s computer displays a message threatening

to expose activities on a pornographic website, fear of exposure can

motivate payment. More often, however, users just follow social

cues. In our daily lives, we regularly encounter problems that need

fi xing, like a program that won’t close until you just “click here,” or

people who need our help, like your Aunt Suzy who somehow got

robbed in Iceland and needs you to wire her money via Bangkok.

A particularly common form of social engineering is the “phish-

ing” attack. Phishing e-mails look like offi cial e-mails from the vic-

tim’s bank, employer, or some other trusted entity. They claim to

require some action by the victim, perhaps to correct an account

error or see a message on Facebook, and fool victims into visiting

oxfordhb-9780199918096.indd 40oxfordhb-9780199918096.indd 40 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 41

a web page where they are asked to enter their credentials. If the

victim enters his or her account details, the attacker can now do any-

thing with that information, from transfer money to read confi den-

tial e-mails. The phony credentials web page may have a URL that

looks similar to the authentic one. If you don’t look closely, maybe

www.paypai.com looks like www.paypal.com. In sophisticated

phishing attacks, the fake page may also actually log the user into

the real website to minimize the chance of detection.

One of the most challenging subsets of these “phishing” attacks

is known as “spear phishing.” These target not just networks but

key individuals inside those networks. It’s the difference between

you, along with scores of others people, receiving an e-mail from

that kind Nigerian prince who just needs your bank account infor-

mation, versus receiving an e-mail that looks exactly like it’s from

your mother. This is a good illustration of the difference between

the automated and targeted threats you read about in the last sec-

tion. Such specialized attacks require prior intelligence gathering to

fi gure out how to trick a particular person and are mostly reserved

for prime targets.

Attackers also prey on systems that have ignored basic precau-

tions, such as products that have default login names and pass-

words, which users often forget to change. Most home wireless

routers have default passwords that a shocking number of users

leave in place. Find the right one and it is easy to steal a neighbor’s

Wi-Fi and eavesdrop on their conversations. This kind of vulnerabil-

ity can also be created by product manufacturers that don’t priori-

tize security enough or fail to factor in the likely human errors and

even laziness of their customers. For instance, Microsoft’s database

product MS-SQL 2005 shipped without an administrator password,

so that any user could control the entire database until an admin

password was set. Other situations involve systems that have fea-

tures that may be convenient but represent real security vulnerabili-

ties, like that of the BMW remote access keys.

Applications can also create vulnerabilities if they are miscon-

fi gured. In one study, researchers at Dartmouth searched peer-to-

peer fi le-sharing services, where users share specifi c fi les from

their own computers with others, usually entertainment fi les like

movies or TV shows. Because of misconfi gured settings, in addi-

tion to users sharing episodes of Game of Thrones , a large number

oxfordhb-9780199918096.indd 41oxfordhb-9780199918096.indd 41 21-10-2013 22:38:1421-10-2013 22:38:14

42 CYBERSECURITY AND CYBERWAR

also had unintentionally shared personal bank statements and tax

documents. A  similar study found that large fi nancial institutions

were unintentionally leaking highly sensitive internal documents

through misconfi gured applications.

Another vector is mistakes in the systems themselves—software

vulnerabilities—that are exploited by more advanced attackers. It

is practically impossible to build a modern IT system without some

hidden vulnerabilities waiting to be discovered. Modern operating

systems have millions of lines of code and have hundreds of sub-

components that interact. An attacker’s goal is to fi nd some chink in

the armor of this code, where the system does not behave precisely

as designed and exploit that weakness. An attack that exploits a pre-

viously unknown vulnerability is known as a “zero day.” The term

comes from the notion that the attacks take places on the zeroth day

of the awareness that the rest of the world has of these vulnerability

and thus before a patch to fi x it can be implemented.

There are different types of vulnerabilities with different ways

of exploiting them, but a common approach is to fi nd some way

of tricking the victim’s computer into executing the attacker’s com-

mands rather than the intended program’s. A key is that most com-

puter systems treat data as both information to be processed and

commands to be executed. This principle is foundational to the very

idea of the modern computer, but also a major source of insecurity.

A  good illustration is a SQL (pronounced “sequel”) injection, one

of the most common ways a website is attacked. Many web appli-

cations are built on Structured Query Language (SQL), a type of

programming language used to manage data. It’s a highly effective

system that dates back to the 1970s. But an attacker, instead of enter-

ing a name and address as requested, can enter specifi cally crafted

commands that the database will read and interpret as program

code, rather than just data to be stored. These commands can be used

to learn about the database, read data, and create new accounts. In

some cases, access can be used to discover and change security set-

tings on the server, allowing the attacker to control the entire web

system. As we explore later in the Part II section on hactivists, the

Anonymous group used this kind of attack to penetrate the security

fi rm HB Gary and share its embarrassing secrets with the world.

Beyond attacking applications, attackers can also exploit vulner-

abilities in code at the system level. A common vulnerability is the

oxfordhb-9780199918096.indd 42oxfordhb-9780199918096.indd 42 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 43

buffer overfl ow. Computers use memory to store data and instruc-

tions. If a program can be tricked into writing inputted data that

is larger than expected, it can spill over the allocated “buffer,” or

storage area, and overwrite the space where the computer stores the

next instruction to be executed. If that newly written memory space

is then read and interpreted by the computer, the program can break

or follow the attacker’s instructions. Once the program executes

arbitrary instructions, the attacker can effectively gain control of the

system. In essence, it follows the same principle as the SQL attack,

where the computer interprets data as instructions, but now it takes

place at the system memory level.

Designing these types of attacks requires a great deal of skill and

experience, but once the vulnerability has been exploited it is rela-

tively easy to package. This “exploit” is a piece of software or set of

commands that can take advantage of the vulnerability. And that is

where cyber risk takes on a whole new level of concern, as it allows

other, less sophisticated attackers in on the action. It’s as if the mas-

ter thief now writes a book about safecracking that comes with a

handy-dandy set of tools.

Malicious software, or “malware,” is a prepackaged exploitation

of a vulnerability. There is often a “payload” of instructions detail-

ing what the system should do after it has been compromised. Some

types of malware contain instructions for reproduction, in order to

spread the attack. “Worms” spread themselves automatically over

the network. In some cases, this can be suffi cient to cause drastic

harm: many of the worms that attacked Microsoft Windows in the

late 1990s and early 2000s had no direct malicious effect but still

overwhelmed corporate networks because they tried to send out

an exponentially large number of copies. One worm even sought to

patch vulnerable computers, a “good worm,” but still managed to

cripple networks. Other vulnerabilities have been exploited to allow

the attacker to capture valuable personal data or, in an anarchistic

turn, just destroy data on the victim’s computer.

Malware can also be spread over the Web via “drive-by” attacks, where

the victim’s only mistake is visiting the wrong website. Such attacks

exploit vulnerabilities in the web browser or in the many components

and add-ons that web browsers use to take advantage of sophisticated

websites. The attacker fi rst compromises the web server and then sim-

ply attempts to exploit vulnerabilities in any browser that requests fi les

oxfordhb-9780199918096.indd 43oxfordhb-9780199918096.indd 43 21-10-2013 22:38:1421-10-2013 22:38:14

44 CYBERSECURITY AND CYBERWAR

from that website. Drive-by attackers often target groups by going

after websites used by specifi c communities, a so-called “watering hole”

attack (taken from the ideas that smart lions don’t chase after their prey

across the African savannah, but rather just wait for them all to come to

the watering hole). For example, a group out to steal secrets from a US

defense company indirectly targeted it by compromising the website of

a popular aerospace magazine that many employees read. In one case, a

watering hole attack infected fi ve hundred accounts in a single day.

More recently, malware has been used not only to take control

of a computer system but to keep control of that computer, in order

to exploit its computational and network resources. By capturing

victims’ systems and coordinating their behavior, attackers can

assemble armies of “zombie” computers. Millions of machines can

be controlled by a single actor through a range of different com-

mand and control mechanisms. These are referred to as “botnets,”

and most computer users will never know if they are part of one.

Botnets are powerful resources for a host of nefarious activities.

Regular access to the victims’ machines allows monitoring to capture

valuable data. Botnet controllers can also leverage the network connec-

tions of their victims’ systems to send spam, host websites to sell illegal

products, or defraud online advertisers. Perhaps most insidiously, bot-

nets can launch a “distributed denial of service” (DDoS) attack.

DDoS attacks target the subsystems that handle connections to the

Internet, such as web servers. Their vulnerabilities are based on the

principle that responding to an incoming query consumes computa-

tional and bandwidth resources. If someone were to call your phone

incessantly, you would fi rst lose the ability to concentrate and then

lose the ability to use your phone for any other purpose. Similarly, in

the cyber world, if the attacker can overwhelm the connection link,

the system is effectively removed from the Internet. It is fairly easy

to defend against a single attacker from a fi xed source: one just has

to block the sender, just like blocking an annoying caller’s number

(but never your mother’s. Never.). In a distributed denial-of-service

attack, the attacker uses a botnet of thousands or even millions to

overwhelm the victim. It’s the equivalent of having thousands or

even millions of people trying to call your phone. Not only would

you get nothing done, but the calls you actually want to receive

wouldn’t easily get through.

oxfordhb-9780199918096.indd 44oxfordhb-9780199918096.indd 44 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 45

This kind of power, and the fact that such attacks are fairly overt

and obvious, means that DDoS attacks are often linked to some

other goals. Criminal gangs may go to a website and threaten to take

it offl ine unless they pay for “protection.” (“That’s a nice website

you’ve got there. It’d be a real shame if anything were to . . . happen.”)

Or they may also be used as a diversion, to overwhelm the attention

and defenses of the victim while going after data elsewhere. They

are also increasingly common as a form of political protest or even

suppression. During the initial stages of the crisis in Syria in 2011,

supporters of the Syrian regime shared DDoS tools to attack critics

of the government and news organizations that covered the grow-

ing violence.

The bottom line is that vulnerabilities exist on every type of infor-

mation system in cyberspace. Despite how scary they sound, many

of them are not new. For instance, the common buffer overfl ow

attack was fi rst developed in the 1970s and almost brought down

the adolescent Internet in the 1980s. By 1996, a detailed how-to

guide appeared in a hacker’s magazine.

As threats evolve, so too must our responses to them. Some can

be mitigated with small changes in behavior or tweaks in code,

while whole classes of vulnerabilities can be prevented only by

developing and implementing new technologies. Other vulner-

abilities are simply a structural consequence of how we use sys-

tems. As we explore in Part III, how we navigate these challenges

comes down to accepting that bad guys are out to exploit these

vulnerabilities and then developing the best possible responses

that allow us to keep benefiting from the good parts of the

cyber age.

Or you could opt out, sell your advanced luxury car and ride the

bus instead. Just make sure you don’t check the bus schedule online.

How Do We Trust in Cyberspace?

There is perhaps no more important duty for a citizen than to vote,

and no part of the voting process is more important than preserv-

ing the integrity of that vote. And yet the Founding Fathers of

American democracy didn’t imagine a world of computerized vot-

ing machines, nor one in which Pac-Man might chomp his way into

an election.

oxfordhb-9780199918096.indd 45oxfordhb-9780199918096.indd 45 21-10-2013 22:38:1421-10-2013 22:38:14

46 CYBERSECURITY AND CYBERWAR

The incident started out as one of those fun projects that hack-

ers like to undertake, spending a few afternoons playing around

with an old piece of computer equipment. The difference here

was the hardware in question was an AVC Edge electronic voting

machine used in the 2008 elections. Such systems are supposed to

be tamper-proof or at least reveal if anyone tries to doctor them.

Yet the two young researchers from the University of Michigan and

Princeton were able to reprogram the machine without leaving any

sign on the tamper-resistant seals. While they chose to reprogram

the voting machine to innocuously play Pac-Man, the beloved 1980s

video game, they made it clear that the supposedly tamper-proof

machine was vulnerable to far more insidious attacks.

As the incident shows, our dependence on digital systems means

that increasingly we face the question of how we can trust them.

For cybersecurity, the users must trust the systems, and the sys-

tems must know how to trust the users. Not every machine is going

to have a unwanted Pac-Man on the screen to tell us something

is wrong. How do we know that the computer is behaving as we

expect it to or that an e-mail from our colleague is actually from

that colleague? And, just as importantly, how do computers know if

we’re supposed to be and are behaving the way we’re supposed to?

Online trust is built on cryptography—the practice of secure

communications that goes all the way back to the fi rst codes that

Julius Caesar and his generals used to keep their enemies from

understanding their secret messages. We often think of cryptogra-

phy as a means of keeping information confi dential, but it also plays

an equally important role in integrity, or the ability to detect any

tampering.

A key building block in cryptography is the “hash.” A hash func-

tion takes any piece of data and maps it to a smaller, set-length

output, with two specifi c properties. First, the function is one-way,

which makes it very diffi cult to determine the original data from

the output. Second, and even more important, it is incredibly hard

to fi nd two input pieces of data that generate the same output hash.

This lets us use the hash function to “fi ngerprint” a document or an

e-mail. This fi ngerprint can then verify the integrity of a document.

If a trusted fi ngerprint of a document does not match the fi ngerprint

that you generate yourself using the same method, then you have a

different document.

oxfordhb-9780199918096.indd 46oxfordhb-9780199918096.indd 46 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 47

Cryptographic integrity checks are useful, but for them to apply to

trust, we need some means to introduce identity. Trust is both a noun

and a transitive verb, after all; it requires someone or something to trust.

Cryptographic digital signatures provide that trust by using “asymmet-

ric” encryption. This explanation is starting to get complex, so it might

be useful to take a brief diversion into understanding a few basic points

of cryptography.

Modern cryptosystems rely on “keys” as the secret way of cod-

ing or decoding information on which trust is built. “Symmetric

encryption” relies on sharing the same key with other trusted par-

ties. I encrypt data with the same key that you use to decrypt it. It is

like us both sharing the same key for a bank lockbox.

But what if we have never met each other? How will we exchange

these secret keys securely? “Asymmetric cryptography” solves this

problem. The idea is to separate a secret key into a public key, which

is shared with everyone, and a private key that remains secret. The

two keys are generated such that something that is encrypted with

a public key is decrypted with the corresponding private key, and

vice versa. Figure 1.2 illustrates how public key cryptography works

to protect both the confi dentiality and the integrity of a message.

Suppose Alice and Bob—the classic alphabetical protagonists of

cryptographic examples—want to communicate. They each have a

pair of keys, and can access each other’s public keys. If Alice wants

to send Bob a message, she encrypts the message with Bob’s public

key. Then the only person who can decrypt it must have access to

Bob’s private key.

A digital signature of a message ties together the notion of a digital

fi ngerprint with public key cryptography. Returning to our friends

above, Alice takes the fi ngerprint of the document and signs it with

her private key and passes it to Bob, along with the unencrypted

document. Bob verifi es the signature using Alice’s public key and

compares it with a fi ngerprint he can generate of the unencrypted

document. If they do not match, then someone has changed the

document in between. These digital signatures can provide integrity

for any type of data and can be chained to allow for transitive trust.

But where does the trust come from in the fi rst place? For exam-

ple, I can verify that software I have downloaded from a company

is valid by checking it against the company’s public key, but how do

I know that the key actually belongs to that company? Remember,

oxfordhb-9780199918096.indd 47oxfordhb-9780199918096.indd 47 21-10-2013 22:38:1421-10-2013 22:38:14

48 CYBERSECURITY AND CYBERWAR

a signature only implies access to the private key that corresponds

with the public key, not the validity of that public key. Asymmetric

cryptography requires some means of trusting the public keys. In

most modern systems we rely on a “trusted third party.” These are

organizations that produce signed digital “certifi cates” that explic-

itly tie an entity to a public key. Known as certifi cate authorities

A

A

A

B

B

Meet Alice and Bob. They would like to talk to each other securely.

Alice and Bob each have a pair of mathematically linked keys, sharing one and keeping one private.

private key

private key

Bob receives the message. He then decrypts the message with his private key, and uses Alices’s public key to verify her signature.

To send a message, Alice encrypts the message with Bob’s public key, and signs with her private key.

A B

A

B

A

How public key encryption works

Encryption protects the confidentiality of the message, while the digital signature preserves integrity by preventing modification.

A

B

B

B

B

41 ed a3 a6 96 02 56 05 20 39

41 ed a3 a6 96 02 56 05 20 39

“Hello Bob”

“Hello Bob”

(shared) public keys

1

3

2

4

encrypt

inscribe

verify

signature

message

decrypt message

signature

Figure 1.2

oxfordhb-9780199918096.indd 48oxfordhb-9780199918096.indd 48 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 49

(CAs), they sign the certifi cates, and their public keys are known

widely enough so that they cannot be spoofed. If you trust the CA,

then you can trust the public key signed by the CA.

Every person online uses this system on a daily basis, even if

we do not realize it. When we visit HTTPS web addresses and get

the little lock icon to verify the secure connection, we are visiting

a secure website and are trusting the certifi cate authorities. Our

web browsers ask the secure domain for its public key and a certifi -

cate signed by a CA, tying the public key explicitly to the Internet

domain. In addition to verifying that the server our browser is talk-

ing to belongs to the organization it claims to belong to, this also

enables trusted communication by exchanging encryption keys.

Such trust serves as the basis for almost all secure communication

on the Internet between unaffi liated parties.

As the source of trust, certifi cate authorities occupy a critical role

in the cyberspace ecosystem, perhaps too important. If someone can

steal a CA’s signing key, then the thief (or whoever they pass the key

on to) could intercept “secure” traffi c without the victim noticing. It

is hard to pull off, but it has been done. In 2011, someone (later leaks

fi ngered the NSA) stole a Dutch CA’s keys and used them to inter-

cept Iranian users’ access to Google’s Gmail. Some have complained

that there are too many CAs around the world, many in countries

with less than savory histories in security and privacy. As attacks

evolve, the roots of trust will be even more at risk.

If one side of trust online is about the user feeling confi dent about

the system and other users, the other side is how systems should

trust the users. After identifi cation and authentication, a system

must authorize the user to use the system. Most systems use some

kind of “access control” to determine who can do what. At its sim-

plest, access control provides the ability to read, write, or execute

code in an operating environment.

The core of any system is the access control policy, a matrix of sub-

jects and objects that defi nes who can do what to whom. This can be

simple (employees can read any document in their small work group,

while managers can access any document in their larger division) or

much more complicated (a doctor may read any patient’s fi le, as long

as that patient has one symptom that meets a prespecifi ed list, but may

only write to that fi le after the billing system can verify eligibility for pay-

ment). Good access control policies require a clear understanding of

oxfordhb-9780199918096.indd 49oxfordhb-9780199918096.indd 49 21-10-2013 22:38:1421-10-2013 22:38:14

50 CYBERSECURITY AND CYBERWAR

both organizational roles and the architecture of the information system

as well as the ability to anticipate future needs. For large organizations,

whose users make extensive use of data, defi ning this policy perfectly is

incredibly diffi cult. Many believe it may even be impossible.

Failures of access control have been behind some of the more

spectacular cyber-related scandals in recent years, like the case of

Bradley Manning and WikiLeaks in 2010, which we explore next,

and the 2013 Edward Snowden case (where a low-level contrac-

tor working as a systems administrator at the NSA had access to a

trove of controversial and top-secret programs, which he leaked to

the press). These cases illustrate poor access control in all its glory,

from low-level individuals being granted default access to anything

and everything they wanted, to poor efforts to log and audit access

(for several months after Edward Snowden went public with leaked

documents about its various monitoring programs, the NSA still

didn’t know how many more documents he had taken, but hadn’t

yet released).

Whether the organization is the NSA or a cupcake store, the

questions about how data is compartmentalized are essential.

Unfortunately, most organizations either greatly overprovision or

underprovision access, rather than trying to fi nd a good medium.

Overentitlements grant too much access to too many without a

clear stake in the enterprise, leading to potentially catastrophic

WikiLeaks-type breaches. In many business fi elds, such as fi nance

and health care, this kind of overaccess even runs the risk of violat-

ing “confl ict of interest” laws that are supposed to prevent individu-

als from having access to certain types of information. Finally, and

most relevant to cybersecurity, if access control is poor, organiza-

tions can even lose protection of their intellectual property under

trade secret law.

At the other extreme, underentitlement has its own risks. In busi-

ness, one department may inadvertently undermine another if it

doesn’t have access to the same data. In a hospital, it can literally be

a matter of life and death if doctors cannot easily fi nd out informa-

tion they need to know in an emergency. Former intelligence offi cials

have implied that the stakes are even higher in their world, where a

lack of information sharing can leave crucial dots unconnected and

terrorist plots like 9/11 missed. 

oxfordhb-9780199918096.indd 50oxfordhb-9780199918096.indd 50 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 51

What this all illustrates is that even amid a discussion of technol-

ogy, hashes, and access control, trust always comes back to human

psychology and the decisions used to make explicit risk calcula-

tions. Pac-Man isn’t an actual man, but the system that allowed him

to enter a voting machine, and the consequences of that access, are

all too human.

Focus: What Happened in WikiLeaks?

bradass87 : hypothetical question: if you had free reign [ sic ] over classifi ed networks for long periods of time . . . say,

8–9 months . . . and you saw incredible things, awful

things . . . things that belonged in the public domain, and not on

some server stored in a dark room in Washington DC . . . what

would you do? . . .

( 12:21:24 PM) bradass87 : say . . . a database of half a million events

during the iraq war . . . from 2004 to 2009 . . . with reports, date

time groups, lat-lon locations, casualty fi gures . . . ? or 260,000

state department cables from embassies and consulates all over

the world, explaining how the fi rst world exploits the third, in

detail, from an internal perspective? . . .

( 12:26:09 PM) bradass87 : lets just say *someone* i know

intimately well, has been penetrating US classifi ed networks,

mining data like the ones described . . . and been transferring

that data from the classifi ed networks over the “air gap” onto a

commercial network computer . . . sorting the data, compressing

it, encrypting it, and uploading it to a crazy white haired

aussie who can’t seem to stay in one country very long =L . . .

( 12:31:43 PM) bradass87 : crazy white haired dude = Julian Assange

( 12:33:05 PM) bradass87 : in other words . . . ive made a huge mess.

This exchange on AOL Instant Messenger launched one of the

biggest incidents in cyber history. WikiLeaks not only changed the

way the world thinks about diplomatic secrets, but also became a

focal point for understanding how radically cyberspace has changed

our relationship with data and access.

In 2006, the website WikiLeaks was launched with the goal of

“exposing corruption and abuse around the world.” With an agenda

oxfordhb-9780199918096.indd 51oxfordhb-9780199918096.indd 51 21-10-2013 22:38:1421-10-2013 22:38:14

52 CYBERSECURITY AND CYBERWAR

that scholars call “radical transparency,” the concept was to reform

powerful actors’ behavior by exposing documented evidence of

their wrongdoing online. Led by the now-iconic “crazy white haired

dude,” Australian Julian Assange, it used the Wikipedia model of an

“open-source, democratic intelligence agency,” where activists from

around the world could upload information and share it through a

central but communally archived repository.

The group quickly gained a reputation for “releasing information

relating to a range of very different countries, and to potential cor-

ruption, malfeasance, or ineptitude.” Early projects exposed alleged

wrongdoings by Kenyan politicians, Church of Scientology lawyers,

and international trade negotiators. It soon won accolades from

anticensorship and human rights organizations.

In turn, the dangers of radical transparency quickly became

apparent to organizations that depended on secrecy. In a 2008

report, the Pentagon noted, “WikiLeaks.org represents a potential

force protection, counterintelligence, OPSEC and INFOSEC threat

to the U.S. Army.” (Ironically, we only know about this classifi ed

assessment because WikiLeaks itself published it in 2010.)

The Pentagon’s prescience was remarkable, as the website was

poised to publish a massive cache of documents that ranged from

diplomatic cables to memos and videos directly related to the US

military’s war efforts in Iraq and Afghanistan. This story’s beginning

goes back to “bradass87,” the online handle of Bradley Manning,

born in 1987.

Bradley Manning was a private fi rst class in the US Army, and

not a terribly happy one. As he described in instant messages sent to

another hacker turned journalist, “im an army intelligence analyst,

deployed to eastern baghdad, pending discharge for ‘adjustment

disorder’ in lieu of ‘gender identity disorder.’ ”

Later investigations found that Manning fi t in poorly with other

soldiers and that he had already been reprimanded for disclosing

too much information in video messages to his friends and family

that he posted to YouTube. In fact, he almost wasn’t deployed to Iraq

because his superiors had described him as a “risk to himself and

possibly others.” But the need for intelligence workers in the fi eld

was too great, and he was sent to the war zone.

While Manning was trained to handle classifi ed information, he was

not an analyst. Instead, his job was “to make sure that other intelligence

oxfordhb-9780199918096.indd 52oxfordhb-9780199918096.indd 52 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 53

analysts in his group had access to everything that they were entitled to

see.” His position thus gave him access to a huge range of data streams

from across the government’s computer networks.

After growing increasingly distraught about the war, a reaction

likely compounded by his personal troubles, Manning decided that

“Information has to be free.” While the Department of Defense had

banned USB storage devices for fear of malware and had tried to

“air gap” the secure networks from the Internet, they did not close

off writable CD drives. Manning would bring in CDs with music

on them and then overwrite the music with fi le upon fi le of clas-

sifi ed data. As he wrote, “I listened and lip-synced to Lady Gaga’s

Telephone while exfi ltratrating [ sic ] possibly the largest data spill- age in american history.”

In April 2010, WikiLeaks published a provocatively titled video,

“Collateral Murder,” depicting an edited, annotated video from a

US Army Apache attack helicopter fi ring on civilians in Iraq, includ-

ing two Reuters reporters. WikiLeaks followed this up in July and

October 2010 by releasing immense troves of classifi ed documents

relating to the wars in Afghanistan and Iraq.

While Manning had originally wanted to remain anonymous, as

was the WikiLeaks model, his facilitator, Assange, instead sought to

achieve maximum publicity. The video was fi rst displayed at a news

conference at the National Press Club in Washington, DC. For the

classifi ed documents, Assange worked with the New York Times, the Guardian , and Der Spiegel to verify, analyze, and present the docu- ments to the public. Unsurprisingly, US offi cials condemned the

release of these documents in strong language and began to hunt

down the source of the leaks.

Just a few months later, WikiLeaks dropped another virtual

bomb. In what became known as “Cablegate,” Manning had also

passed on 251,287 State Department cables written by 271 American

embassies and consulates in 180 countries, dating from December

1966 to February 2010. Much of the communication was boring stuff,

but there were also a number of embarrassing secrets, from what

American ambassadors really thought about their counterparts to

the fact that the United States had secretly eavesdropped on the UN

Secretary General in the lead up to the Iraq war. Amusingly, the US

government then ordered federal employees and contractors not to

oxfordhb-9780199918096.indd 53oxfordhb-9780199918096.indd 53 21-10-2013 22:38:1421-10-2013 22:38:14

54 CYBERSECURITY AND CYBERWAR

read the secret State Department documents posted online, which

the New York Times described as “a classic case of shutting the barn door after the horse has left.”

Originally, WikiLeaks relied on media sources like the Guardian, El País , and Le Monde to publish the cables, which they did at a relative trickle. The media focused on what they thought was most newsworthy

and edited the content wherever it might endanger someone inadver-

tently revealed in the cables, such as a secret informant. Only a hundred

or so were released at a time, a tiny fraction of the stolen documents.

A few months later, however, the password to the full data set was “acci-

dentally” released (reporters from the Guardian and Assange each blame the other). With the site now accessible, WikiLeaks decided to publish the

whole treasure trove of secret information, unredacted.

The leaking of documents was roundly condemned, and

WikiLeaks was accused of putting people at risk, and not just

American offi cials. In China, for instance, nationalist groups began

an “online witch hunt,” threatening violence against any Chinese

dissident listed in the cables as meeting with the US embassy.

At this point, WikiLeaks became more than just a nuisance to those

in power. According to the US Director of National Intelligence, the

leaks risked “major impacts on our national security,” and a senator

called for Assange to be tried for espionage. Others sought to down-

play the impact. As then Secretary of Defense Gates put it, “Is this

embarrassing? Yes. Is it awkward? Yes. Consequences for U.S.  for-

eign policy? I think fairly modest.”

In either case, the heat was turned up on the organization and

its key players. Assange’s personal Swiss bank account was closed

on the grounds that he had falsely claimed to live in Geneva upon

opening the account. Even more damaging, Swedish prosecutors

issued a warrant for Assange for sexual assault. After fi ghting and

losing a legal battle for extradition, Assange sought asylum at the

Ecuadorian embassy in London, where he remains at the time of this

book’s publication.

In another illustration of how the cyber world intersects with the

real world, the online group was also pressured via the online fi nan-

cial front. PayPal announced that it would no longer allow individu-

als to send money to WikiLeaks’s account, citing a letter from the US

government declaring WikiLeaks’s engagement in illegal behavior.

oxfordhb-9780199918096.indd 54oxfordhb-9780199918096.indd 54 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 55

MasterCard and Visa followed suit, making it much harder for sym-

pathizers around the world to contribute to the legal and technical

defense of the website.

Despite this pressure, the WikiLeaks organization survived. The

leaked documents are still available around the Web on dozens

of mirror websites to anyone who wants to see them (aside from

federal employees), while the group has popped up in subsequent

scandals from the NSA domestic spying revelations to the Syria

Files, a release of over two million e-mails from the Syrian regime,

including personal e-mails from Bashar al-Assad. More impor-

tantly, WikiLeaks’s model has proved powerful, inspiring copycat

attempts like Local Leaks, a website associated with Anonymous.

Local Leaks came to prominence in 2012, when it posted evidence

of a brutal sexual assault by prominent high school football players

in an Ohio town.

As for Manning, his role was revealed by the very same person

he shared his supposedly secret Internet chat with. A hacker named

Adrian Lamo had told Manning, “I’m a journalist and a minister.

You can pick either, and treat this as a confession or an interview

(never to be published) & enjoy a modicum of legal protection.”

Instead, Lamo turned Manning in to the FBI. Manning was subse-

quently court martialed for data theft and espionage and sentenced

to thirty-fi ve years in military prison.

In the end, those who wished to set information free are them-

selves no longer free. Others may be deterred by what has happened

to this episode’s main characters, or heartened by their enduring

impact.

What Is an Advanced Persistent Threat (APT)?

We were at a meeting of Washington, DC, government offi cials and busi-

ness leaders. A so-called consultant in cybersecurity (at least that’s what

his website said, and who are we to question the Internet?) spent half his

presentation talking up the massive boogeyman of cyber danger that

loomed for us all, repeatedly mentioning the new specter of “APTs.” But

fortunately, he spent the second half of his talk explaining how all that

was needed to deter such threats was to be “good enough.” He made

a joke that it was like the two friends chased by a bear. As one told the

other, “I don’t have to outrun the bear, just you.” As long as you made sure

oxfordhb-9780199918096.indd 55oxfordhb-9780199918096.indd 55 21-10-2013 22:38:1421-10-2013 22:38:14

56 CYBERSECURITY AND CYBERWAR

your defenses were slightly better than the next guy’s, he explained, the

cyberattackers would give up and quickly move on. And, lo and behold,

his fi rm had a generic package for sale that would satisfy all our cyberse-

curity needs. The presentation was slick, effective . . . and wrong.

APTs are “advanced persistent threats,” a phenomenon that has

gained more and more notoriety in recent years (Google reports the

term as being used some 10 million times by 2013) but is still poorly

understood. It illustrates the challenge in the policy world of calling

attention to very real emerging challenges in cyberspace but also

avoiding overreaction, hype, and hysteria.

If cybersecurity threats were movies, an advanced persistent

threat would be the Ocean’s 11 of the fi eld. It’s not that APTs star handsome actors like George Clooney or Brad Pitt; indeed, they are

more likely to be run by their polar opposites, clad in T-shirts instead

of Armani suits. Like the high-profi le heists in the movie, however,

APTs have a level of planning that sets them apart from other cyber-

threats. They are the work of a team that combines organization,

intelligence, complexity, and patience. And as with the movie, they

are quickly followed by sequels. No one knows how many APTs are

out there in the world, but one cybersecurity fi rm CEO told us how,

“Five years ago, I  would get very excited, and very proud, if we

found signs of an APT inside a client’s networks. It was something

that might happen once every few months. Now, we’re fi nding them

once a day.”

An APT starts with a specifi c target. The team knows what it wants

and who it is going after to get it. APT targets have ranged from

military jet designs to oil company trade secrets. So while many of

us would like to think that we are important enough to be targeted

by an APT, the reality is that most of us don’t rise to that level. But

if you do, well, watch out; locking your windows like everyone else

in the neighborhood probably isn’t going to be enough. The bear in

the sales guy’s story actually doesn’t care how fast your friend runs;

it just wants to take a bite out of you.

The hallmark of an APT is its coordinated team of specialized

experts, who each take on different roles. Much like a robber “cas-

ing” a bank or a spy observing a military base, a surveillance team

engages in what is known as “target development,” learning every-

thing it can about the person or organization it is going after along

with key vulnerabilities. In this effort, online search tools and social

oxfordhb-9780199918096.indd 56oxfordhb-9780199918096.indd 56 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 57

networking have been a godsend to the attackers. Want to steal a

widget and therefore need to know who the vice president of prod-

uct development is? In the past, you might have sent James Bond to

seduce the receptionist in human resources and then sneak into her

fi les while she was sleeping off a night of shaken martinis and sex.

Now, it’s more boring. Just type the name into an Internet search

engine and you can get everything from that executive’s resume to

the name of her daughter’s pet iguana. As cybersecurity expert Gary

McGraw notes, “The most impressive tool in the attackers’ arsenal

is Google.”

It is this phase that also differentiates the attacks as “persistent.”

The reconnaissance and preparations can take months. The teams

are not just trying to understand the organization of the target but

also its key concerns and even tendencies. One APT, for example,

was casing a major technology fi rm headquartered in Minnesota.

Team members eventually fi gured out that the best way to crack

the system was to wait until a major blizzard. Then they sent a fake

e-mail about the fi rm changing its snow day policy; in Minnesota,

this was something that everyone from the CEO on down cared

about. Another effort, which American national security offi cials

have blamed on Chinese intelligence and military units, gathered

details not only on targets’ key friends and associates but even what

farewell they typically used to sign off their e-mails (e.g., “All the

best” vs. “Best regards” vs. “Keep on Trucking”) to mimic it for a

spear phishing attack vector.

With the target understood, an “intrusion team” will then work

to breach the system. What’s notable here, though, is that the ini-

tial target is frequently not the main prize. An effective way into

a network is via trusted outsiders, who often have lower levels

of defense, or by targeting people in the network who have some

access permissions to open the gates wider. For example, a series of

American think tanks (including our place of work) were targeted in

2011 and again in 2012 by an APT that sought access to the accounts

of scholars who worked on Asian security issues (they were inter-

ested not just in their fi les, but also their address books, which had

the contact information for senior government leaders). But the APT

initially went after other employees who had administrative rights

and access to passwords.

oxfordhb-9780199918096.indd 57oxfordhb-9780199918096.indd 57 21-10-2013 22:38:1421-10-2013 22:38:14

58 CYBERSECURITY AND CYBERWAR

These attackers frequently use spear phishing and faked e-mails,

with some exploit hidden inside triggering a download of malware.

In “Operation Shady RAT” (an APT we talk about later on in Part II),

when the counterfeit e-mail attachment was opened, malware was

implanted. This then created a backdoor communication channel

to another outside web server that had, in turn, been compromised

with hidden instructions in the web page’s code, an effort by the

attackers to cover their tracks.

The malware used in these attachments is often quite sophisti-

cated. The emphasis is on stealth, so the authors will not only try

to hide from traditional antivirus defenses, but burrow deep into

networks and operating systems to avoid discovery, attempting to

impersonate legitimate network traffi c. Like other businesses, APT

groups often conduct dry runs and even “quality assurance” tests

to minimize the number of antivirus programs that can detect them.

But e-mail is not the only way in. Other APTs have, for example,

used networks like Facebook to fi nd friends of individuals with a

high level of privilege inside a targeted network. Then they compro-

mise these friends’ instant messaging chats to sneak in. Perhaps the

most interesting example of this use of social networking tools saw

senior British offi cers and defense offi cials tricked into accepting

“friend requests” from a faked Facebook account that claimed to be

Admiral James Stavridis, the commander of NATO. Who wouldn’t

want an admiral as a friend; imagine their disappointment when it

turned out to be a hacker!

Once the team is in, they branch out like a viral infection, often

with more personnel joining the effort. They jump from the initial

footholds, compromising additional machines inside the network

that can run the malware and be used to enter and leave. This often

involves installing keystroke-logging software that tracks what

people are typing and a “command and control” program that can

direct the malicious code to seek out sensitive information.

At this point, the target is “pwned.” Now at the mercy of the attack-

ers, an “exfi ltration team” works to retrieve the information the APT

was targeting all along. Here is another APT hallmark: Instead of the

usual criminal ethic of “Grab what you can get,” they go after very

specifi c fi les. Frequently, the attackers don’t even open the fi les, sug-

gesting that their reconnaissance was so thorough that they didn’t

need to review what they were targeting. Instead, someone draws

oxfordhb-9780199918096.indd 58oxfordhb-9780199918096.indd 58 21-10-2013 22:38:1421-10-2013 22:38:14

How It All Works 59

up a specifi c list of collection requirements and the team is disci-

plined enough to stick to it.

Not all APTs just copy and exit with the data. Some add tech-

nology to allow them to steal new secrets beyond what was inside

the network or even gain control. French offi cials, for example, have

accused APTs linked to Chinese intelligence of gaining access to the

computers of several high-level French political and business lead-

ers and then activating microphones and web cameras so that they

could eavesdrop on conversations. Even more nefarious are those

that don’t simply steal data but also alter fi les, which as we explore

later can have major consequences. This ultimately shifts the APT

from an act of crime or espionage to an act of sabotage or even war.

The exfi ltration phase, when massive amounts of data leave

the network (such as when an entire e-mail fi le exits), is actually

when many successful APTs are detected. This “phone home” phase

makes for an anomaly in network traffi c that is hard to mask.

Exfiltration teams therefore use all sorts of tricks to sneak the

information out and then hide their tracks. One common tactic

involves routing data through way stations in multiple countries,

akin to a money launderer running stolen funds through banks

all over the world. This not only makes it more difficult to track

them down, but also routes the APT’s activities through differ-

ent countries and legal jurisdictions, ultimately complicating

prosecution.

What makes APTs even more of a challenge is that when a target

fi nally realizes it has been attacked, the pain is not over. Finding

which machines inside the system have been infected can take

months. Even worse, if the effort is truly persistent—say if the target

has some sort of ongoing value to the attacker—there might be an

additional unit in the APT whose very job it is to maintain an elec-

tronic foothold in the network. Rather than focusing on what infor-

mation to steal, this unit will monitor internal e-mails to learn how

the defenders are trying to get them out. In one case, an American

company hired a Pentagon-qualifi ed computer security fi rm to clean

its infected network after being targeted by an APT. Despite this,

a few months later, a thermostat and printer in its building were

caught sending messages to a server located in China. With their

e-communication compromised, the defenders’ response is often to

oxfordhb-9780199918096.indd 59oxfordhb-9780199918096.indd 59 21-10-2013 22:38:1521-10-2013 22:38:15

60 CYBERSECURITY AND CYBERWAR

go old-school. They will literally yank hard drives out of their com-

puters and post handwritten signs in the hallways about password

policy changes.

APTs are a nightmare scenario for any organization. Most don’t

know they’ve been targeted until it is too late. And even if they do

fi nd out, it is often impossible to prove who’s behind it. Indeed, that’s

why APTs may be the most controversial of all the threat vectors.

Except in cases where the attackers are sloppy (our favorite example

being when a high-ranking Chinese military offi cer employed the

same server to communicate with his mistress and coordinate an

APT), there is little actual proof that would stand up in a court of

law or sway a country’s position. What we are often left with instead

are suspicions and fi nger-pointing, which makes APTs so poison-

ous for diplomatic relations, as we’ve seen over the last few years

between the United States and China.

How Do We Keep the Bad Guys Out? The Basics of Computer Defense

It is by far the world’s largest zoo. In 2013, it held more than

110  million different species painstakingly collected from “the

wild.” And yet it is a strange sort of zoo, where you can’t actu-

ally see the animals. The reason is that they only exist in the

virtual world.

The McAfee “malware zoo” is what the computer security firm

calls its collection of the various types of malicious or malevo-

lent software (known as “malware”) designed to wreak havoc on

Internet users. Its growth illustrates the seemingly insurmount-

able scale of the problem. In 2010, McAfee thought it impressive

that it was discovering a new specimen of malware every fifteen

minutes. In 2013, it was discovering one every single second!

If we think of each type of malware as a unique threat, these

numbers are overwhelming. Instead, we must understand why

there are so many “unique” threats. The answer refl ects the

cat-and-mouse game that attackers and defenders play. Since the

early Internet, attackers have tried to exploit vulnerabilities, and

the defenders have sought to deny them. The adversaries, in turn,

adapted and altered their patterns of attack, changing it into an

evolutionary game.

oxfordhb-9780199918096.indd 60oxfordhb-9780199918096.indd 60 21-10-2013 22:38:1521-10-2013 22:38:15

How It All Works 61

The advantage of defending a computer system is that once

you know what might attack you, you can just tell the computer

what to watch for and how to avoid it. Traditional antivirus soft-

ware relies on detecting these “signatures.” The programs scan

all files on the system as well as incoming traffic against a dic-

tionary of known malware, looking for anything that matches

these signatures of malice.

This classic approach has a few glaring fl aws. As the number of attacks

grows over time, these defi nition fi les and the time it takes to search them

also grow. Most of these old signatures don’t represent current threats,

and as the threats proliferate, it becomes a losing game. One study found

that only 0.34 percent of signatures in common antivirus programs were

needed to detect all the malware found in all incoming e-mail. And yet

prudence dictates that we still must look for the 99.66 percent of the old

malware, just in case the attacker gets sneaky and goes back to them.

The bigger problem is evolution. Authors of malware have fought

back against the traditional antivirus approach by taking a page from

biology. Just as some viruses such as HIV and the fl u change their

protein coatings to avoid detection by the human immune system,

malware creators change the outward appearance of their attack-

ing programs. The very same attack can be made into very different

signatures, disguised by programs that automatically generate new

features. This gives rise to enormous numbers, like those refl ected

in the “zoo” statistics cited above and renders the old approach of

detection by signature less useful. One analysis found that, over an

eight-day period, while over one hundred thousand new signatures

of new known malware were added by a major antivirus vendor

into the list of what to scan for, only twelve new detections resulted.

Twelve detections for processing one hundred thousand signatures

may seem paltry, but this refl ects the camoufl age techniques used

by malware authors more than ineptitude on the part of antivirus

companies. Infl ating the number of signatures may make the mal-

ware problem seem bigger than it is, but it would be equally wrong

to conclude that malware is not a problem at all.

Security vendors have thus had to change how they detect

malicious code. Modern antivirus don’t just screen, they use “heu-

ristic” detections to identify suspicious computer code behavior

based on rules and logical analysis. Static analysis breaks apart

the computer code and looks for patterns associated with the

oxfordhb-9780199918096.indd 61oxfordhb-9780199918096.indd 61 21-10-2013 22:38:1521-10-2013 22:38:15

62 CYBERSECURITY AND CYBERWAR

behavior of an attacker. Virtual machines and other sophisticated

defenses dynamically simulate the code operation to determine

whether the fi le examined will misbehave without putting the

actual system at risk. Just as police bomb squads test suspicious

packages, virtual “detonation chambers” can cause an incoming

piece of malware to mistakenly think it is inside the machine and

detonate prematurely.

If securing a modern operating system is diffi cult, an alternate

approach tries to prevent the bad stuff from reaching the computer

over the network. The simplest form of network defense is a “fi re-

wall.” Taken from the concept of barriers built into cars or buildings

to prevent fi res from spreading, computer fi rewalls are like fi lters

that reject traffi c based on specifi c rules. Firewalls can prevent exter-

nal computers from connecting to the fi rewalled machines except

under preset circumstances or prevent certain applications on the

computer from opening network connections.

Firewalls are fi lters that only permit valid activity on the net-

work; the next layer of defense is a set of sensors that look for

invalid behavior. “Intrusion detection systems” exist at the com-

puter level or on the network. They detect attack signatures and

identify anomalous behavior (“That’s funny, the janitor ’s computer

doesn’t usually open an encrypted connection with Moldova at 2

in the morning”). These systems alert administrators to potential

attacks and keep logs for detailed forensic analysis. Most detec-

tion systems now have some intrusion prevention capacity as well,

which closes suspicious network connections and throws away

anonymous traffi c. Like antivirus software, these systems come

with a price; in addition to typically costing more money, they cost

time and performance resources inside the machine, especially if

a system must evaluate all incoming traffi c on a large network in

real time.

While you heard earlier about a “zero day” that goes after a

newly found vulnerability, most attacks attempt to exploit vulner-

abilities that the vendor has already discovered and attempted to

ameliorate via a code update or “software patch.” The presence of a

patch indicates that the vendor has found a vulnerability, identifi ed

a threat mitigation, and perhaps most importantly, built a fi x into the

existing code.

oxfordhb-9780199918096.indd 62oxfordhb-9780199918096.indd 62 21-10-2013 22:38:1521-10-2013 22:38:15

How It All Works 63

The problem is that many users don’t always pay attention to

these security updates and leave the vulnerabilities unpatched.

This why we have seen an evolution from the makers sending

out simple notifi cations of new updates, which puts the burden

of action on the user ’s part, to automatic downloads and even

installation of the patch. But other costs have come along with this

shift. Modern software is very complex, and fi xing one small vul-

nerability could affect countless other processes in the program.

Horror stories describe patches turning brand-new smartphones

into rather snazzy paperweights or breaking entire enterprise net-

works. Since every large organization runs different software and

has different confi gurations, patch management is an important

part of any IT support.

Just as your body’s defenses aren’t just skin-level, serious threats

are countered not only by keeping them out. There are measures to

protect what’s valuable even if threats get in. In the case of cyber

espionage, for example, if you cannot prevent attackers from access-

ing the data, you can limit their ability to understand the data

through encryption.

The last line of defense is akin to the strategy that nuns use to

police Catholic school dances. The nuns often stuff balloons between

teenagers dancing too closely, creating an “air gap” to ensure noth-

ing sneaky happens. In cybersecurity terms, an air gap is a physical

separation between the network and critical systems. Such practice

is common with critical infrastructure, such as with power compa-

nies, and was even attempted by the Iranians to protect their nuclear

research from cyberattack.

The problem with air gaps, much like the abstinence that the nuns

try to enforce, is that it often doesn’t work in practice. Giving up

control of operational infrastructure involves sacrifi ces in effi ciency

and effectiveness. Power companies that don’t link up, for instance,

may be less vulnerable, but they can’t run “smart” power grids that

save both money and the environment.

Similarly, maintaining an air gap is often unrealistic, as the

Iranians discovered when their supposedly air-gapped systems

still got infected by the Stuxnet virus. At some point, old data

needs to come out, and new instructions need to go in. Systems

need to be patched, updated, and maintained. Indeed, the National

Cybersecurity and Communications Integration Center has

oxfordhb-9780199918096.indd 63oxfordhb-9780199918096.indd 63 21-10-2013 22:38:1521-10-2013 22:38:15

64 CYBERSECURITY AND CYBERWAR

conducted literally hundreds of vulnerability assessments of pri-

vate American business air-gapping attempts. Not once did it fi nd

an operations network successfully separated from the fi rm’s other

computer enterprise networks.

Finally, some advocate the old slogan that the “Best defense is a good

offense.” In the cyber world, this is known as “hackback,” and a number of

fi rms have emerged to go after the attackers’ own computer networks.

Like vigilantism, it both feels good and may teach the original attacker

a lesson.

But the hackback business has two major problems. The fi rst is

that the question of who has the “right” to carry out cyberattacks

is unclear, which means that “cyber Blackwater” fi rms are “skating

on thin ice” legally, says Nate Fick, CEO of the cybersecurity fi rm

Endgame. The second is that it’s not yet clear that hackback is even

that effective over the long term. Alex Harvey, a security strategist

for Fortinet, explains that “Breaking in and shutting them down

isn’t hard, but a new one will just pop up. You’ll get a couple of

minutes of peace and quiet.”

The bottom line in cyber defense is that it is a hard task, with vari-

ous options that are far from perfect. But the only other option is to

close the zoo and let the malware animals run free.

Who Is the Weakest Link? Human Factors

In 2008, a US soldier was walking through a parking lot outside of a

US military base in the Middle East when he spotted an unwrapped

candy bar lying on the ground. Without knowing who had left it or

how long the candy had been on the ground, he decided to take the

bar inside the base and eat it for lunch.

Sounds absurd and even a bit disgusting, right? Well, substitute

a USB fl ash drive for that candy bar, and you have the story of what

started Buckshot Yankee, one of the largest cyber breaches in US mil-

itary history. In 2008, a foreign intelligence agency left fl ash drives in

the parking lot outside a US base, a tactic known as a “candy drop.”

A soldier saw one of the drives in the dirt, picked it up and thought

it a good idea to plug the drive into a computer on the US military’s

Central Command network. The drive uploaded a worm named

agent.btz that scanned computers for their data, created backdoors,

oxfordhb-9780199918096.indd 64oxfordhb-9780199918096.indd 64 21-10-2013 22:38:1521-10-2013 22:38:15

How It All Works 65

and linked to command and control servers. The Pentagon spent the

following fourteen months cleaning the worm out, all because one

soldier didn’t have the common sense to apply the “fi ve-second

rule” to how he treated his computer.

The real battle in cybersecurity is not just about high technology. It is

also driven by the human factor, the fi ght over our behavior. To use a met-

aphor from the wars of old, the walls protecting a network don’t always

have to be knocked down or tunneled under by an attacker. Sometimes,

as in ancient Troy, oblivious defenders simply open up the gates without

recognizing the attacker’s deception. While there are varied advanced

threats in cybersecurity, many of the most successful take advantage of

good old-fashioned human error. Examples range from the executive at

an IT company who found a malware-ridden CD in the men’s bathroom

and popped it into his computer to see what was on it (again, think of the

comparisons: would you pick up a comb you found beside the urinal?

A sandwich?) to the employee at a defense company, who used his busi-

ness network to fi le-share music. Besides sharing proprietary rock songs

online, he also unintentionally shared designs for the electronics of the

US presidential helicopter with Iranian hackers.

It is for this reason that many IT experts believe that if a net-

work has any kind of sensitive information in it, all users need to

be regularly certifi ed in cybersecurity basics. This means every-

one, from junior staff all the way up the leadership. This is not just

about enforcing the fi ve-second rule for things you plug into your

computer. Clever attackers take advantage of our innate trust to

convince us to click links, open attachments, or give out our pass-

words to strangers over the phone. Since 99  percent of the time

our phone calls and e-mails are not malicious, it is hard to be con-

stantly vigilant.

Even experts can and will be fooled. Professor John Savage

founded the Computer Science department at Brown University in

1979 and has devoted much of his distinguished career to studying

information security, including a stint advising the Department of

State. Yet while teaching a class on computer security, one of his stu-

dents successfully tricked him into clicking a link in an e-mail and

entering his password. (We subsequently hired that very enterpris-

ing student as a research assistant for this book.)

oxfordhb-9780199918096.indd 65oxfordhb-9780199918096.indd 65 21-10-2013 22:38:1521-10-2013 22:38:15

66 CYBERSECURITY AND CYBERWAR

We will go more into this in Part III, but the goal is to recog-

nize the key part that human behavior plays in enabling threats,

and then build constant awareness, reinforcing it with new train-

ing. If users fail to learn the lessons of proper caution, then their

access privileges should be revoked. Indeed, some companies like

Lockheed Martin even have “red team” programs that every so

often try to trick their own employees. If the employee opens a

link in a suspicious e-mail, for example, it links the offender to a

refresher course on cybersecurity. Better we learn our lesson this

way than download real malware, Trojan Horses, or any other

Greek-borne cyber gifts.

oxfordhb-9780199918096.indd 66oxfordhb-9780199918096.indd 66 21-10-2013 22:38:1521-10-2013 22:38:15

Part II

WHY IT MATTERS

What Is the Meaning of Cyberattack? The Importance of

Terms and Frameworks

It had taken a long time to bring the two groups together, but fi nally

the senior American and Chinese offi cials were gathered around the

same table. The important issues on the two great powers’ agenda

ranged from trade and fi nance matters to emerging cybersecurity

concerns. But when the discussion fi nally started, the Chinese were

baffl ed. The US representatives spoke about the importance of the

“engagement.” The Chinese translator wasn’t sure whether the

Americans were making a “marriage proposal” or discussing an

“exchange of fi re,” neither of which seemed appropriate for a meet-

ing of diplomats.

Trying to talk about a new issue can be a bit like traveling to a

foreign land. New discussions require entire new vocabularies and

frameworks just to understand what is happening. It can get even

more complex in the realm of cyber issues, as the topics mix highly

technical matters with broad concepts in which even the most basic

terms can be loaded with meaning. For instance, when the United

States and the USSR negotiated arms control treaties during the

Cold War, they may have argued over things like the defi nition of

a cruise missile, but there was no dispute as to whether the cruise

missile was a weapon, nor that using a weapon like that against the

other would be construed as an attack.

The same cannot be said of the cyber realm, especially when it

comes to what constitutes an “attack” in cyberspace. This term has

oxfordhb-9780199918096.indd 67oxfordhb-9780199918096.indd 67 21-10-2013 22:38:1521-10-2013 22:38:15

68 CYBERSECURITY AND CYBERWAR

been used to describe everything from online protests to the stealing

of Internet secrets to cyber sabotage of nuclear research to battlefi eld

acts of war. And people fall prey to this confusion all the time. As

we saw in Part I, in 2011, a group of top US senators talked about

a $3  million case of credit card fraud at Citigroup and the Stuxnet

worm, specially designed to cripple Iranian nuclear research, as if

they were one and the same problem. Likewise, Chinese Foreign

Ministry offi cials have talked about the spreading of rumors via

social networks like Facebook as an “attack” in the same vein as

hacking into power plants.

Even experts in the fi eld can fall prey to this problem or sometimes

take advantage of others’ confusion on the topic. In 2010, the lead US

general for the military’s Cyber Command testifi ed to Congress that

“Every day, America’s armed forces face millions of cyber attacks.”

To get those numbers, though, he was combining everything from

probes and address scans that never entered US networks to actual

data theft. But none of these attacks was what most of his listeners in

Congress thought he meant by an “attack,” the feared “digital Pearl

Harbor” or “cyber 9/11” that his boss, the Secretary of Defense, had

been warning them about in a simultaneous series of speeches, tes-

timony, and interviews with the mainstream media.

Essentially, what people too often do when discussing “cyberat-

tacks” is bundle together a variety of like and unlike activities, sim-

ply because they involve Internet-related technology. The parallel

would be treating the actions of a prankster with fi reworks, a bank

robber with a revolver, an insurgent with a roadside bomb, and a

state military with a cruise missile as if they were all the same phe-

nomenon simply because their tools all involved the same chemistry

of gunpowder.

When the US government convened the National Research

Council to study cyberattacks in 2009, it defi ned them as “deliber-

ate actions to alter, disrupt, deceive, degrade, or destroy computer

systems or networks or the information and/or programs resident

in or transiting these systems or networks.”

It’s a good summary, but if you really want to know what a cyber-

attack is, you fi rst have to distinguish it from traditional attacks. To

begin, cyberattacks employ different means. Instead of using kinetic

force (a fi st, a sword, a bomb, etc.), they use digital means, a com-

puter action of some sort. This is signifi cant:  a cyberattack is not

oxfordhb-9780199918096.indd 68oxfordhb-9780199918096.indd 68 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 69

constrained by the usual physics of traditional attacks. In cyber-

space, an attack can literally move at the speed of light, unlimited by

geography and the political boundaries. Being delinked from phys-

ics also means it can be in multiple places at the same time, meaning

the same attack can hit multiple targets at once.

The second way a cyberattack differs is in the target. Instead of

causing direct physical damage, a cyberattack always fi rst targets

another computer and the information within it. The intended

results of the attack may be to damage something physical, but that

damage always fi rst results from an incident in the digital realm.

Stemming from these two fundamental differences are all the

other ways that a cyberattack seems different from a physical attack.

For instance, cyberattacks are often more diffi cult to attribute to a

particular actor, at least compared to a clear “smoking gun” of a

literally smoking gun. Of course, snipers sometimes shoot rifl es spe-

cifi cally designed to thwart detection, while some cyberattackers

sign their name into their malware to make sure they get credit for

an attack. Similarly, the effect of a physical attack is usually, but not

always, easier to predict. You can drop a laser-guided bomb through

a window and project with near certainty the explosion’s damage

radius. With a computer virus, you can’t always know whose com-

puter it might end up on. Of course there are exceptions: that bomb

might also unintentionally collapse the building or explode a gas

line that no one knew was inside, while, in turn, some viruses like

Stuxnet are specially designed only for a specifi c set of targets.

Moreover, the costs to conduct a physical attack are likely in the

purchase of actual weapons and their materials, while in cyberat-

tacks the costs are more on the research and development side. That

said, the experience of the Manhattan Project and the atomic bomb

shows the exception to this rule. Bottom line: the only hard and fast

difference between cyberattacks and other attacks is in their digital

means and digital targets.

But how then can we distinguish among cyberattacks them-

selves? As we’ve seen, they involve everything from “denial of ser-

vice,” where the targeted system is simply fl ooded with too many

requests from other networks, to Stuxnet, where the malware caused

physical equipment in an Iranian nuclear lab to malfunction and

spin out of control. It’s like categorizing everything from a band of

neighborhood kids ringing your doorbell and running away to the

oxfordhb-9780199918096.indd 69oxfordhb-9780199918096.indd 69 21-10-2013 22:38:1521-10-2013 22:38:15

70 CYBERSECURITY AND CYBERWAR

Norwegian resistance’s sabotage of Nazi nuclear research in World

War II.

In Part I, we discussed the classic “CIA triad,” the three funda-

mental goals that make up information security:  Confi dentiality,

Integrity, and Availability. Unsurprisingly, the best way to catego-

rize attacks is by which of these three goals is being threatened.

Availability attacks are those that try to prevent access to a net-

work, whether by overwhelming it with visits, a denial of service,

or even taking it offl ine to shut down the physical or virtual pro-

cesses that depend on it. As Dmitri Alperovitch, a leading cyberse-

curity expert, notes, “Scale and impact are absolutely key” in trying

to weigh these attacks. A  one-hour denial-of-service attack on a

video-gaming website might seem a big deal to the gamers, but it

isn’t a strategic matter. By comparison, “A prolonged denial of ser-

vice attack that is not easily mitigated and which shuts down critical

parts of the nation’s infrastructure may very well be strategic and

something we want to try to deter.”

Confi dentiality attacks are efforts to gain entry into computer net-

works in order to monitor activities and extract information on the

systems and on users’ data. Weighing this kind of attack depends on

both the information extracted and the scale of the effort. A  crimi-

nal stealing your credit card and a spy agency stealing a jet fi ghter

design are both conducting confi dentiality attacks, but the conse-

quences of fi nancial fraud versus espionage are obviously different.

As we explored with APTs, the real challenge occurs when these

attacks extract information in a massive, organized way. Entities

that have suffered such confi dentially attacks range from consumer

goods companies that have seen their designs replicated without

payment, to oil companies that have had their bidding strategy and

drilling secrets taken, to aerospace companies that have seen designs

of combat aircraft stolen. Over time these can add up to a huge loss,

which is why confi dentiality attacks on intellectual property have

become a strategic matter in US-Chinese relations. Indeed, while

the focus of US debate is more frequently on fears of a so-called

“digital Pearl Harbor,” the more serious problem may actually be a

long-term economic “death by a thousand cuts.”

Finally, integrity attacks involve entering the system to change

rather than extract information. They manipulate data in the virtual

world as well as the systems and people who depend on that data

oxfordhb-9780199918096.indd 70oxfordhb-9780199918096.indd 70 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 71

in the real world. Most often, these attacks intend to either change

the user’s perception or situational awareness or cause sabotage

or subversion of physical devices and processes that are guided

or operated by information systems. Such integrity attacks can be

particularly insidious, since we rely on computer systems to under-

stand what’s going on inside these same systems.

Here, too, the goals and consequences of an integrity attack vary

widely. The effect could be mere vandalism for political purposes,

such as a defaced public-facing website of a government agency. An

attack might be aiding or executing some sort of illegal endeavor,

such as by changing access or identities to allow criminals through

security barriers. Or it might seek to cause major harm of a strate-

gic nature, such as damaging another country’s ability to implement

offi cial decisions, to defend itself, or to provide services to its citi-

zens (via delivery of electric power, health care, etc.). The data that

is being changed, therefore, is what determines an integrity attack’s

importance. For instance, a hacker changing the software code for

the White House website’s welcoming picture of the president and

a hacker changing the president’s code for nuclear weapons com-

mands are each conducting an integrity attack. But they will have

vastly different results, and call for vastly different responses.

The diffi cult challenge is often not so much classifying these

kinds of attacks as it is distinguishing them from each other, espe-

cially when they happen in real time. A confi dentiality attack and an

integrity attack both exploit vulnerabilities to gain entry to a system.

They can use the same approaches and technical specs to get inside,

but it’s what the attackers do once there that makes the difference.

Do they observe and steal data, change data, or add new data, depos-

iting what is known in weapons terms as a “payload?” Often the

victim won’t be able to tell until the act plays out. To continue with

our White House example, when the Secret Service notices a man

sneaking over the fence, they don’t wait to see whether he wants to

peek at papers on the President’s desk or plant a bomb there. The

difference in the cyber realm, however, is that such drama can play

out in a matter of nanoseconds.

To go back to our original “engagement” problem, defi ning

these terms is only the start. Next is crossing the huge gulf between

how different nations conceive them. Take the notion of “infor-

mation,” which is the target of all these types of attacks whether

oxfordhb-9780199918096.indd 71oxfordhb-9780199918096.indd 71 21-10-2013 22:38:1521-10-2013 22:38:15

72 CYBERSECURITY AND CYBERWAR

the intent is to disrupt, steal, or change it. But information and its fl ow

across the Internet can be interpreted in vastly different ways. The

provision of online news and connections across geographic borders

via social networking tools has been described by American leaders

as an essential human right. By contrast, the very same free fl ow has

been described by leaders in Russia and China not as a human right

but as an “information attack” designed to undermine state stability.

As a result, in international exchanges US offi cials have talked about

cyberattacks in terms of “assaults on and intrusion of cyber systems

and critical infrastructure,” while their counterparts, from places like

Russia, have discussed them as part of a Western “information war”

to undermine regimes “in the name of democratic reform.”

Figuring all this out is going to take a very long “engagement,”

indeed.

Whodunit? The Problem of Attribution

The name came from either a mash-up of the domain name

“traffi cconverter.biz” or a play on the German swear word for

“fucker.”

In either case, “Confi cker” wasn’t so much innovative as it was

nasty, combining several types of malware to enter into unprotected

computers, hide under a random fi le name in the root directory, and

use the compromised computer to connect out and build a botnet.

It fi rst surfaced in late 2008 when a vulnerability was discovered

in Microsoft Windows programs. The company rushed to release

a patch to the public, but as many as 30  percent of users did not

apply the protection. Soon after, security experts in different parts of

the IT industry detected the fi rst moves of what became known as

“Confi cker,” a computer worm. Within a few months of Confi cker’s

appearance, some seven million computers had been compromised

into one of the biggest botnets in the world. Computers in networks

ranging from the French navy to Southwest Airlines were all pulled

into what one security expert called “the Holy Grail of a botnet.”

Spooked by its scale, a diverse group of investigators represent-

ing security fi rms, consumer software companies, ISPs, and univer-

sities assembled to battle Confi cker. Still, no one could fi gure out

the worm’s exact purpose or origin. Someone was building a mas-

sive botnet, but who was doing it and why? Then the team found

oxfordhb-9780199918096.indd 72oxfordhb-9780199918096.indd 72 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 73

a tantalizing hint—an early version of the malware checked the

targeted computer’s keyboard layout. If it was set to the Ukrainian

language, the attack aborted. But what did this mean? Was it a sign

that it was authored in Ukraine (not Russia or China, as some had

originally thought) and the authors wanted to avoid infecting their

compatriots and avoid committing a crime in their own local juris-

diction? Or was it a clever bit of misdirection, designed to make it

seem like whoever designed it was Ukrainian? Years later, the who

and why of Confi cker still remain a mystery.

As this episode illustrates, beyond the issue of terminology, there

are other dimensions that make the cyber arena so challenging to

secure and therefore need to be explored further. Perhaps the most

diffi cult problem is that of attribution.

Many forms of malware take control of the victims’ computers

and form a botnet that links unrelated computers and enables the

controller to leverage their combined computing and communica-

tions capabilities. The resulting network of secretly linked devices

can easily grow to extraordinary dimensions. For example, in 2010

three not so terribly sophisticated Spaniards created a global bot-

net that included over 12 million computers using a program they

bought on the black market. In other cases, a controller may seek to

capture and leverage only a small number of computers. Controllers

use this tactic when concealing their identity is a priority.

Three key features of this capability to capture and utilize other

computers are particularly important. First, there are no geographi-

cal limits. For example, someone in Brazil can compromise comput-

ers in South Africa to launch attacks on systems in China, which

might be controlled by computers physically located in the United

States. Second, the owner of a captured computer often has no idea

that it is being used by a remote actor for pernicious purposes. Of

the computers that attacked Estonia in the cyber incidents of 2007,

25  percent were US-based, even though the attack was originally

Russian sourced, as we describe later. And third, when some perni-

cious activity is perpetrated, sophisticated analysis can typically, at

best, identify the computer being used to launch the attack. It is far

more diffi cult to determine whether that computer is being operated

remotely and, if so, by whom.

Even if a computer is not being remotely accessed, in many situ-

ations (such as with a computer at a university or an Internet café)

oxfordhb-9780199918096.indd 73oxfordhb-9780199918096.indd 73 21-10-2013 22:38:1521-10-2013 22:38:15

74 CYBERSECURITY AND CYBERWAR

it is diffi cult to determine the identity of those sitting behind the

computer, their nationality, or what organization they represent.

Such information would be crucial in a crisis but is rarely available

in a timely manner, and attempts to gather it raise huge privacy

concerns.

It does not take much imagination to see how damaging these

problems can be. Take how cybersecurity concerns have increasingly

poisoned US-Chinese relations (which we personally witnessed as

part of exchanges with US and Chinese cyber experts and offi cials).

Since many in the United States assume that the Chinese govern-

ment has signifi cant control over its citizens, it is easy to assume

that the government is behind most insidious activities launched

by computers located within China. But, of course, this also means

that bad actors elsewhere may be incentivized to target Chinese

computers for capture and use in their activities, to misdirect suspi-

cions. This very same logic, though, also enables Chinese actors to

deny responsibility. They consistently argue that activities actually

launched from China are being perpetrated by others who want to

take advantage of the widespread suspicions of China, pointing to

the large number of vulnerable, unpatched computers in their coun-

try. And the same type of misdirection can be carried out using com-

puters physically located inside the United States. Essentially, you

get a lot of fi nger-pointing and not much certainty.

The issue is that establishing attribution is not the same as

establishing complicity. It is sometimes possible to track an actor ’s

efforts to a certain geographic locale, but it is more diffi cult to

establish any formal government role, whether as perpetrator or

sanctioner of the operation. As we explore later, “patriotic hacker”

communities and other nonstate groups, including student and

even cybercriminal groups, have been mobilized by their govern-

ments for such purposes. They offer deniable, but directed, attack.

Ronald Deibert is a leading Canadian expert who has tracked var-

ious cyber espionage networks like GhostNet, which stole infor-

mation from over 1,200 computers in 103 countries. He explains,

“Attacks can be ‘crowd sourced’ by governments . . . or arise from

acts of spontaneous participation, or both. In such an environ-

ment, it complicates the task of assigning blame to a state and

forming an appropriate response. This is potentially destabilizing

to the global order.”

oxfordhb-9780199918096.indd 74oxfordhb-9780199918096.indd 74 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 75

Attribution is further complicated by the fact that in some kinds

of attacks, it is diffi cult to initially determine if what is going on is

“hostile.” A shift in routing information at an Internet access point,

for example, might be a normal update or it could be a malicious

attempt to reroute Internet traffi c. A  stream of unusual traffi c that

hits a system’s fi rewall could just be a misconfi gured application

somewhere in the world, or it could be a probe of defenses. Packets

are not like ICBMs, where radar can quickly detect the missile for

what it is.

On top of this, once malware enters a system, it does not always

bear any telltale sign of its origin or intent. Unlike bullets or even

atomic bombs (each nuclear reactor has a distinctive “signature”

to which a bomb’s fi ssionable material can typically be traced),

when malware is uncovered it often does not point to a particular

culprit.

What this means is that “proving” attribution is a crucial but

excruciatingly difficult task. In TV shows like Law & Order or Perry Mason , the prosecutors tell juries to focus on three aspects of a crime to determine a culprit’s guilt:  means, motive, and

opportunity. The same is true in cyber sleuthing, where investiga-

tors must often painstakingly connect the dots. For instance, Ron

Deibert’s team of researchers confirmed that a group of Chinese

hackers conducted a series of cyber intrusions (known as the

“Byzantine Hades” attacks) aimed at Tibetan groups, including

the office of the exiled Dalai Lama. They did so by tracking com-

munications from the infected computers back to control servers

that had previously gone after Tibetan targets during the 2008

Olympics in Beijing.

But this is also where TV has it wrong. Contrary to what the law-

yers say in those dramatic shows, a real court can’t convict just on the

mere presence of those three elements. There has to be compelling

proof that the means were used and that the motivated defendant

being charged actually acted upon the opportunity. Often in these

cyber situations, one can point a fi nger, but not with the needed

precision. The investigators of Byzantine Hades, for example, could

confi rm it was a team of hackers located in China, yet as Deibert

explained, “We could not pinpoint the attacks to the Chinese gov-

ernment itself, but they certainly would benefi t by the information

that was stolen from compromised victims.”

oxfordhb-9780199918096.indd 75oxfordhb-9780199918096.indd 75 21-10-2013 22:38:1521-10-2013 22:38:15

76 CYBERSECURITY AND CYBERWAR

In cybersecurity, we are instead usually left with an attribu-

tion dilemma. One has to weigh the potential gains versus losses

of pointing the fi nger at the group or person you think is behind

a cyberattack. In deciding this, your real-world goals then matter

more than what took place in the cyber realm. Are you trying to

fi gure out who harmed you as a prelude to justifying your own

counterattack? Or are you simply trying to communicate that you

know which people are behind an attack, in order to “out” them,

blow their cover, and maybe cause some kind of public shaming

that will force them to stop? Different goals and different actions

require different standards. The US government’s 2011 counterin-

telligence report is a good example. It was willing to point a fi nger

at China’s general direction for cyber theft, in the hope of causing

some shaming effect, but it repeatedly indicated at the very same

time that it lacked “absolute certainty” that would have forced mat-

ters further.

Two years later, the New York Times went one step further when Chinese hackers were caught trying to penetrate its networks.

Working with the Mandiant computer security company, it tracked

the activities to a specifi c set of IP addresses assigned to a neighbor-

hood in Shanghai that was home to a specifi c unit of the Chinese

military. The Times published a front-page article with a picture of the unit’s headquarters. The reporters then tracked down individ-

ual hackers using clues mistakenly left on social media, including

the hackers’ personal mobile phone numbers and even that one

was apparently a “keen Harry Potter fan” but not a great speller

(all his security questions and passwords revolved around “Harry

Pota”). Yet the Chinese government continues to deny the allega-

tions, and few people think we’ll see a TV-style dramatic courtroom

confession.

The takeaway here is twofold. First, attribution has an inverse

relationship to scale. The more people involved, the bigger their

operations (and likely impact), but also the more likely that some-

one will make mistakes that allow them to be tracked down. But,

secondly, the context and goals of this backtracking matter greatly.

You might use far different standards if you were trying to prosecute

in a court of law than in a court of public opinion. Simply put, law-

yers may want evidence “beyond a reasonable doubt,” but this is

not always possible in cybersecurity.

oxfordhb-9780199918096.indd 76oxfordhb-9780199918096.indd 76 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 77

What Is Hactivism?

In October 1989, administrators at the Department of Energy and

NASA sat down to their computers to fi nd that they had been

“WANKed.” Instead of letting them log in, their screens blasted a

message from “WANK:  Worms Against Nuclear Killers” that said,

“You Talk of Peace for All, and Then Prepare for War.”

The WANK worm had actually been placed by young hack-

ers from Australia (explaining both the double entendre of the

name—to “wank” is Aussie slang for masturbating—and the ori-

gin of the message, which were lyrics from the Australian anti-

nuclear band Midnight Oil). The youth wanted to protest a new

program of nuclear energy research, but rather than travel to the

United States to stand with other protesters holding posters out-

side the Kennedy Space Center, they spread their message from

within their target’s computers. As it was early in the age of net-

worked computers, the worm they built now seems fairly simple.

It targeted accounts that had the same password as their user-

name (remember these good old days?) and was easily cleared

from the system. But WANK is still significant. A  few young

hackers WANKing off had carried out one of the first examples

of “hacktivism.”

Hacktivism is a term often credited to the Cult of the Dead Cow, a

hacker group founded in a former Lubbock, Texas, slaughterhouse.

They were among the fi rst to argue that access to online information

was a universal human right (among their early efforts was an effort

to hack Chinese government agencies and Western companies coop-

erating with them) and so organized Hactivismo, a project to fi ght

Internet censorship and provide technical help to those living under

oppressive governments. The idea is exactly what the mash-up of

the words “hacker” and “activism” might suggest: the idea of pro-

moting or resisting some kind of political or societal change through

nonviolent but often legally questionable cyber means of protest.

Just as Martin Luther once harnessed the revolutionary power of

the printing press to spread his message, and Martin Luther King,

Jr. similarly used the new venue of television, hacktivists are simply

tapping into the latest technology to aid their own civil disobedi-

ence, agitation, and protest. But unlike in the past, this technology

offers the ability to operate instantaneously, transnationally, and

anonymously.

oxfordhb-9780199918096.indd 77oxfordhb-9780199918096.indd 77 21-10-2013 22:38:1521-10-2013 22:38:15

78 CYBERSECURITY AND CYBERWAR

Much like other actors in cyberspace, hacktivists can range from

single individuals to loose coalitions like Anonymous, which come

together around a common target, to tightly organized groups. As

a result, the scale of action includes small protests against a single

target that barely make a ripple in cyberspace to what the New York Times somewhat erroneously called “World Wide Web War I” in 2001. After a US Navy P-3 surveillance plane and Chinese fi ghter jet col-

lided, anger in China skyrocketed and some one hundred thousand

Chinese hackers worked together to knock the White House website

offl ine with a denial-of-service attack, plant viruses in the Justice

Department’s network, and even deface the home pages of some

Ohio high schools. Groups of American hackers then responded by

changing various Chinese websites to display American fl ags and

messages like “Slouching Tiger, Hidden Dragon.”

One of the big misconceptions about hacktivists is that they are

all bona fi de hackers with a real understanding of their actions.

Actually, the vast majority are what are known as “script kiddies.”

That is, they use “scripts,” or programs made by others, that allow

them to download attack software from a website and then join in

with the click of a button, no expertise required. Expert hackers tend

to look down on them, hence the notion of a “kid” or juvenile. As

a report for the US Defense Department explained, script kiddies

are the “more immature but unfortunately often just as dangerous

exploiter of security lapses on the Internet. The typical script kiddy

uses existing and frequently well known and easy-to-fi nd techniques

and programs or scripts to search for and exploit weaknesses in other

computers on the Internet—often randomly and with little regard or

even understanding of the potentially harmful consequences.”

These politically motivated “hactions” therefore usually aren’t as

complex or even sophisticated as many other types of cyberthreats.

Typical incidents involve defacing websites, such as changing the

front page of a company or government agency’s website into some-

thing embarrassing, and “Virtual Sit-ins.” Much like the sit-ins at col-

lege campuses in the 1960s, the idea is to use the power of the crowd

to block traffi c and hinder work. Now it is Internet traffi c rather than

long-haired hippies that block the corridors of power. One of the fi rst

of these occurred in 1997. The Electronic Disturbance Theater, a group

that crossed hacktivists with performance artists, organized a vir-

tual sit-in that fl ooded Pentagon and Mexican government websites

oxfordhb-9780199918096.indd 78oxfordhb-9780199918096.indd 78 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 79

with messages to try to bring attention to the Chiapas confl ict. Recent

sit-ins have targeted physical location, such as a specifi c government

building, by trying to overwhelm the networks and devices at that

site with large geotagged fi les, such as YouTube videos.

More sophisticated hactions tend to involve efforts along the

lines of cyber espionage. They penetrate a network, fi nd valuable

information, and then extract it. In this case, though, they usually

target information that is more embarrassing than valuable and

then display it to the world. Examples range from the hacking of

former US vice presidential candidate Sarah Palin’s Yahoo e-mail

account to WikiLeaks’ posting of internal memos from the Stratfor

private intelligence fi rm, which showed that a fi rm charging others

for supposedly super-sophisticated strategic analysis was actually

fairly clueless. When an attack focuses on an individual’s personal

information, it’s referred to as “doxing,” as in revealing personal

documents publicly. Often, doxing requires minimal network pen-

etration, relying more on careful research to link public but hidden

personal or embarrassing data to the victim. The Chinese expression

Rénròu S ō usu ǒ describes this practice and translates as “human fl esh search engine.”

The most complex operations, however, are those that ironically

circle back into the real world, combining both new hactivism and

old-school civil disobedience. For example, in 2004 an undercover

video showed a variety of acts of animal cruelty at the Huntingdon

Life Sciences testing lab, including employees punching beagle

puppies in the face. So a hacktivist group called Stop Huntingdon

Animal Cruelty (SHAC) organized a campaign. They gained access

to the company’s networks, and through them, the fi rm’s entire life

cycle, including the names and home addresses of all its employees,

shareholders, customers, and business partners. They published all

these names and addresses online, even those of the fi rm’s cater-

ers and cleaners. Many of these individuals and companies were

subsequently targeted in a strategy to undermine “every critical

relationship of a company necessary to thrive.” Neighbors were

told embarrassing facts about employees. Investors who thought

themselves anonymous were sent letters at home, while an entire

New York yacht club was covered in red paint after it was revealed

many of its members traded shares in the beagle-punching fi rm.

These actions extended to more violent attacks, such as when the

oxfordhb-9780199918096.indd 79oxfordhb-9780199918096.indd 79 21-10-2013 22:38:1521-10-2013 22:38:15

80 CYBERSECURITY AND CYBERWAR

fi rm’s marketing director opened his front door only to be sprayed

in the eyes with a stinging chemical (the activists claimed to be

simulating what was done to test animals). The campaign proved

somewhat successful; so many investors and partners were spooked

that the company ended up being delisted from the New York Stock

Exchange. But, in turn, several of the SHAC hactivists were con-

victed for various crimes, including Internet stalking and using their

websites to incite violence.

But no one should think that hactivism is solely antibusiness.

Recently, private fi rms have grown more involved in various hack-

tivist endeavors. For example, during the 2011  “Arab Spring”

popular uprisings, fi rms like Google, Twitter, and Skype provided

technical support to protesters and various workarounds to the gov-

ernment Internet censorship. When the Egyptian government tried

to shut down Internet access during the mass protests, the fi rms pro-

vided a service called “Speak to Tweet,” whereby voicemail mes-

sages left by phone were converted to text tweets and downloadable

audio fi les, so that news could still get out.

An interesting issue for hacktivism moving forward, however,

turns the notion of Internet freedom of expression on its head. Many

see hactivism as a new form of civil disobedience that echoes back

to past generations of activists, whether it be Thoreau’s essays in the

1840s or the Chicago Eight’s use of TV in 1968, just now on a new

medium. Others note that the tactics, like denial of service or altered

websites, involve some attack on the other party’s use of the Internet,

effectively undermining their freedom of speech. Moreover, as the

SHAC example illustrates, the anonymous nature of hactivism and

the frequent posting of private information can inspire or provide

cover for more nefarious, even violent actions. Thus, hactivism faces

the same constant question as traditional activism: Do the ends jus-

tify the new cyber means?

Focus: Who Is Anonymous?

Aaron Barr made a terrible mistake.

On February 5, 2011, the CEO of the computer security fi rm

HB Gary Federal announced that his company had infi ltrated the

Anonymous hacktivist group and would reveal its fi ndings to the

media at a major conference in San Francisco. It wasn’t to be. As

oxfordhb-9780199918096.indd 80oxfordhb-9780199918096.indd 80 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 81

Wired magazine reported, instead of the acclaim and profi ts he expected, Barr and his fi rm walked into “a world of hurt.”

HG Gary Federal’s website was quickly compromised by

Anonymous, which posted its own message on the firm’s very

own site: “Your recent claims of ‘infiltrating’ Anonymous amuse

us, and so do your attempts at using Anonymous as a means to

get press attention for yourself. . . . What you have failed to realize

is that, just because you have the title and general appearance of

a ‘security’ company, you’re nothing compared to Anonymous.

You have little to no security knowledge. . . . You’re a pathetic

gathering of media-whoring money-grabbing sycophants who

want to reel in business for your equally pathetic company. Let

us teach you a lesson you’ll never forget:  you don’t mess with

Anonymous.”

The group then made a complete mockery of the fi rm’s claims to

offer its clients security. Besides taking over the website, it also seized

control of HB Gary’s e-mail system and dumped more than 68,000

private messages and memos onto the public Internet. All sorts of

embarrassing laundry were aired, from the company’s offer to cli-

ents to target journalists and donors to the WikiLeaks organization

(a business proposal that many considered not just a bad idea, but

potentially illegal), to the CEO’s discussion of logging onto teen chat

rooms and posing as a sexy sixteen-year-old girl with the handle of

“Naughty Vicky.” Anonymous also carried out doxing attacks, tak-

ing control of Barr’s personal Twitter account and then using it to

post his Social Security number and home address.

HB Gary’s reputation as a security fi rm was destroyed in what

Wired magazine described as an electronic version of a “beatdown.” By the end of the month, a congressional committee was investigat-

ing inappropriate contracts by the fi rm, and Barr had resigned in

disgrace. As Anonymous concluded its message on HB Gary’s web-

site, “It would seem the security experts are not expertly secured.

We are Anonymous. We are Legion. We do not forgive. We do not

forget. Expect us.”

With exploits like this and its signature use of Guy Fawkes masks

(in honor of the 1605 Gunpowder Plot, popularized as an antigov-

ernment symbol in the movie V for Vendetta ), Anonymous may be the most noted of the hactivist groups. Ironically, its notoriety is due

to its anonymity. It is not a single, easily identifi able organization.

oxfordhb-9780199918096.indd 81oxfordhb-9780199918096.indd 81 21-10-2013 22:38:1521-10-2013 22:38:15

82 CYBERSECURITY AND CYBERWAR

Instead, the best words to describe the soup refl ect the Internet itself,

“decentralized” but “coordinated.”

Anonymous is essentially composed of unidentifi ed users from

various Internet forums who gather to conduct organized protests

and other actions using cyber means. As one member explained,

“Anyone who wants to can be Anonymous and work toward a

set of goals. . . . We have this agenda that we all agree on and we all

coordinate and act, but all act independently toward it, without any

want for recognition. We just want to get something that we feel is

important done.”

With no single leader or central control authority, the group

visualizes itself not as a democracy or a bureaucracy, but as a

“do-ocracy.” Members communicate via various forums and

Internet Relay Chat (IRC) networks to debate potential causes to

support and identify targets and actions to carry out. If enough of a

collective is on board for action, a date will be selected and plan put

into action; one member described it as “ultra-coordinated moth-

erfuckery.” The members then use various media such as Twitter,

Facebook, and YouTube to distribute “attack posters” to announce

the plans, further coordinate steps, and draw new volunteers from

around the world into the attacks, building up the ranks of an

“Anonymous” army of hactivists. The paradox is that for such a

supposedly secretive group, most of Anonymous’s planning and

action takes place in the open.

There is no exact date linked to the founding of Anonymous, but

most accounts credit its formation to the mid-2000s, merging early

hacker communities dating back to the 1980s with a new genera-

tion of hactivists, who congregated around online bulletin boards

like 4chan. For the next few years, the group would rarely pop up

outside of the computer security world media. One of the fi rst men-

tions came in 2007, when Canadian news reported the arrest of a

fi fty-three-year-old child predator who had been tracked down and

turned into the police by a “self-described Internet vigilante group

called Anonymous.” This was notable not just because of the revela-

tion of the group, but also because it was the fi rst time a suspected

online predator was arrested by the police as a result of “Internet

vigilantism.”

oxfordhb-9780199918096.indd 82oxfordhb-9780199918096.indd 82 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 83

Soon the group made bigger news with “Project Chanology” in

2008. As with all great world events, this started with a Tom Cruise

video. A  somewhat embarrassing interview of the actor gushing

about Scientology (including claims that Scientologists are the only

people who can help after a car accident) leaked onto YouTube. The

Church of Scientology then threatened the online video-sharing

site with legal action if it didn’t take the video down. Members of

Anonymous were angered by what they viewed as a heavy-handed

attempt at controlling online information. So they organized a sys-

tematic effort instead to knock Scientology websites offl ine, with

members assembling to launch a wave of denial-of-service attacks,

akin to building a voluntary botnet.

In 2010, the group made more serious waves when an active

node called AnonOps undertook a series of actions with names like

“Operation Payback (is a Bitch),” “Operation Avenge Assange,” and

“Operation Tunisia.” The fi rst started as a battle over Internet copy-

right issues, with Anonymous targeting various organizations the

hactivists saw as being too stringent or abusive in trying to restrict

Internet piracy. Groups like the Motion Picture Association of

America, the Recording Industry Association of America, copyright

law fi rms, and even Gene Simmons, the lead singer of the band KISS

(targeted because he had threatened to “sue everybody” who had

downloaded his music without permission and “take their homes”),

saw their websites knocked offl ine repeatedly and/or had their fi les

opened to the world.

Eventually, this effort to battle what Anonymous saw as grow-

ing restrictions on Internet freedom connected to broader political

issues. Companies like PayPal, Bank of America, MasterCard, and

Visa were targeted because they stopped processing payments to

the whistle-blowing website WikiLeaks, following its controversial

publication of US diplomatic cables. The Zimbabwe government’s

websites were targeted after its president’s wife sued a newspaper

for US$15 million for publishing a WikiLeaks cable that linked her

to the blood diamond trade. The Tunisian government was targeted

for censoring the WikiLeaks documents as well as news about upris-

ings in the country (in a poignant twist, a noted local blogger, Slim

Amamou, who had supported Anonymous in the effort, was arrested

by the old regime and then became a minister in the new regime

that the effort helped put into power). The British government was

oxfordhb-9780199918096.indd 83oxfordhb-9780199918096.indd 83 21-10-2013 22:38:1521-10-2013 22:38:15

84 CYBERSECURITY AND CYBERWAR

threatened with similar attacks if it extradited WikiLeaks founder

Julian Assange.

As Anonymous went after bigger and more powerful targets, the

group garnered more and more attention. This notoriety, however,

has ironically rendered Anonymous less anonymous, bringing real

costs in the process. Law enforcement agencies became motivated to

identify and arrest members involved in the operations, especially

any that connected to government agencies. Police raids sent mem-

bers in places like the United States, the UK, and the Netherlands

to jail. By 2011, the challenge grew more complex, when danger-

ous foes emerged outside of traditional states. As a US Army War

College report explored, “Two clandestine non-state groups—a

hacktivist collective and a Mexican drug cartel—stared each other

down in the digital domain, with potentially fatal real world conse-

quences for both sides.”

The episode started when the Los Zetas, a drug cartel founded

by former Mexican army commandos, kidnapped a member of

Anonymous. The hacktivists then threatened to post an extensive

array of information about Los Zetas and its partners online unless

their member was released. This “doxing,” however, wouldn’t

just be embarrassing to the Zetas, but deadly, as the revelations

would open them up to arrest and likely assassination by their

rivals. In response, the cartel hired experts to help it “reverse

hack” Anonymous, seeking to uncover some of its members, and

threaten them with death. Ultimately, they came to a shaky cease-

fi re. The kidnap victim was released but with an accompanying

online threat from the Zetas that they would kill ten people for

every name Anonymous publicized.

The ultimate question for Anonymous, as well as for other hac-

tivists, is the same as for earlier generations of activists and agita-

tors:  can the power of the crowd actually have a lasting impact?

Some argue that the group is “all bark, no bite,” a new form of a

“noisy political demonstration.” Others argue that such critique

misses the point:  a  handful of anonymous computer hackers have

garnered worldwide attention for their personal causes, simply by

putting forward a new model for mobilization on a global scale.

As Electronic Frontier Foundation cofounder John Perry Barlow

described, it may well be the new “shot heard round the world—

this is Lexington.”

oxfordhb-9780199918096.indd 84oxfordhb-9780199918096.indd 84 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 85

The Crimes of Tomorrow, Today: What Is Cybercrime?

When we were kids, you could visit a strange, wonderful place

known as a “library.” There you could check out an encyclopedia

(for you youngsters, imagine a paper Wikipedia) entitled the World of Tomorrow . As this guidebook to the future was published in 1981, “Tomorrow” was, of course, the far-off land of the twenty-fi rst cen-

tury. It was a wonderful world, but one of the chapters in the book

did warn children that the future might not be perfect. Alongside

the picture of a shady man, who is obviously guilty of something

heinous (because he is wearing a Members Only jacket), the book

explained:

There is one kind of crime which may exist in the future—

computer crime. Instead of mugging people in the streets or

robbing houses, tomorrow’s criminal may try to steal money

from banks and other organizations by using a computer. The

computer criminal works from home, using his own computer

to gain access to the memories of the computers used by the

banks and companies. The criminal tries to interfere with the

computers in order to get them to transfer money to his com-

puter without the bank or company knowing that it has been

robbed.

It’s a scary future we now live in.

Cybercrime, as we now think of computer crime, is most often

defi ned as the use of digital tools by criminals to steal or other-

wise carry out illegal activities. As information technology grows

more pervasive, however, it becomes harder to fi nd crimes that

don’t have a digital component. The European Commission, for instance, has tried to sharpen the defi nition in its laws by distin-

guishing between traditional crimes that may use cyber tools and

cybercrimes as being unique to electronic networks in both the

ends and means.

The most pervasive type of cybercrime is “credential fraud,” or

the misuse of account details to defraud fi nancial and payment sys-

tems. Such systems include credit cards, ATM accounts, and online

banking accounts. In order to access these accounts, criminals can

obtain security credentials like passwords and other data wholesale

oxfordhb-9780199918096.indd 85oxfordhb-9780199918096.indd 85 21-10-2013 22:38:1521-10-2013 22:38:15

86 CYBERSECURITY AND CYBERWAR

by attacking computers that store account details for the merchants,

banks, and processors in charge of the whole system. Or they go

directly after the individual account owner by tricking him or taking

over his computer. A common tool is the “phishing” e-mail, which

poses as a communication from a fi nancial institution and presents a

link where the victim is prompted to enter his credentials.

In the end, a credential’s worth depends on the criminal’s ability

to extract value. A credit card number, for instance, is only useful if

the attacker can turn it into desired goods and services. This might

be easy to do with one stolen credit card, but what about ten thou-

sand? In the case of online banking fraud, a thief can’t just transfer

money to her personal account since the banks can easily track that.

The result is that effective credential fraud requires a large organiza-

tional infrastructure of sellers, resellers, patsies, and “money mules,”

who act as intermediate steps in the transfer of money or goods. It’s

similar to more traditional money laundering, but in reverse. Rather

than washing criminal profi ts into a wider legitimate pool, the goal

is to create a series of seemingly legitimate transactions to get the

money into the hands of criminals.

Another kind of cybercrime attacks intermediaries more directly,

by identifying sources of value in the advertising mechanisms that

drive the free Web we know and love. When advertisers pay by the

click, scammers develop automated click-fraud to drive up the prof-

its of hosting advertisements (and cost to the marketer). Criminals

take advantage of advertising revenue by registering web domains

just a few letters different from popular websites, or “typosquat-

ting,” and collect ad revenue from the page visits by those with

clumsy fi ngers. Enterprising scammers even take advantage of

“trending” topics on the Web by quickly registering websites in the

hopes of being seen by users searching for newly popular stories,

again extracting advertising revenue. These attacks reduce the effi -

cacy of online advertising, which is the lifeblood of freely available

content. This technique isn’t easy, however, and requires infrastruc-

ture and an understanding of the internal mechanics of advertising

fi nancing.

Internet scammers employ trickery of a different sort. Their goal

is to persuade the victim to deliver his or her money willingly. These

efforts target our most basic human emotions: greed, fear, and love.

An example from the greed category is the notorious “Letter from

oxfordhb-9780199918096.indd 86oxfordhb-9780199918096.indd 86 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 87

Nigeria” scam, which offers the victim huge potential wealth for just

a token deposit.

Scams built around fear often hype threats and then target the

supposedly security-conscious. While we explore the policy side

of this later in the section on the “cyber industrial complex,” at the

individual level these scams often involve fake antivirus software.

Sometimes appearing as fake pop-up “warnings” on websites, the

victim thinks he is gaining added protection from the scary online

world, but he is really downloading malware. And once their genu-

ine antivirus software is disabled, the victim is repeatedly prompted

for payments to update the fake software. One study estimated that

this is a $100 million business.

Finally, online cons also prey on the love we have for one another,

whether for someone we know or for the wider world. In the

“Stranded Traveler” scam, criminals take over a victim’s e-mail,

social network account, or both, and issue a plaintive call for help,

claiming to be stuck in a remote location without their wallet or pass-

port. The victim’s friends and family are encouraged to send money

to help the (safe at home) victim. Broader efforts include fake charity

websites, which pop up after natural disasters and sadly siphon off

money from those truly in need.

What makes scams so hard to combat systematically is that,

unlike credential fraud, the victims are willing participants, at least

until they learn of the scam. Related to this is another type of crime,

fraud. The Internet has enabled the widespread sale of counter-

feit or illegitimate goods, whether knock-off luxury handbags or

Hollywood blockbusters. Here, even when they’re aware, many

users are still eager to participate, as they see the true victims as

being someone else.

As anyone who has waded through an inbox full of erectile dys-

function drug ads can attest, fake pharmaceuticals are also particu-

larly popular. Contrary to popular belief, many criminals make good

on their illegal offers, delivering real drugs from offshore pharma-

ceutical plants. These organizations use an affi liate program to coor-

dinate advertising, product sourcing, payments, and the technical

infrastructure of botnets to coordinate their activity. Interestingly,

the reasons there are more erectile dysfunction and diet ads is that

such programs tend to eschew offering drugs that might attract par-

ticular attention from law enforcement, such as opiate painkillers.

oxfordhb-9780199918096.indd 87oxfordhb-9780199918096.indd 87 21-10-2013 22:38:1521-10-2013 22:38:15

88 CYBERSECURITY AND CYBERWAR

All of these illegitimate offerings violate intellectual property

controls as well as laws governing medical safety and supervision.

Harm can occur through unscrupulous manufacturing or tainted

products, especially when it comes to pharmaceuticals. Most losses,

however, are indirect, through missed sales and diluted brand value

for the companies that followed the rules.

Many cybercrimes target businesses more directly. We explore

one particularly widespread type, trade secret and intellectual prop-

erty theft, later. But companies can also be harmed directly through

extortion attacks. This is the category that uses the type of ransom-

ware attacks we read about earlier. The victim has to weigh the

potential cost of fi ghting a well-organized attack versus paying off

the potential attacker. Websites with time-dependent business mod-

els, such as seasonal sales, are particularly vulnerable. One study

reported that, “In 2008, online casinos were threatened with just

such an [extortion] attack, timed to disrupt their accepting wagers

for the Super Bowl unless the attackers were paid 40,000 dollars.”

Of course, gambling itself is illegal in many jurisdictions, making

it just one of many illicit activities that have extended into cyber-

space. What makes these activities relevant to cybersecurity is their

virtualization challenges territorial defi nitions. Some activities, such

as the distribution of pedophilic images, are widely condemned

around the world whether in a physical magazine or a website.

Other behaviors, such as gambling, enjoy the legal protection of

some jurisdictions in both the physical and the online worlds. The

extended scope of online wagering may have even contributed to

the 2013 football match-fi xing scandal in Asia, in which gangsters

were accused of “reverse-engineering the safeguards of online bet-

ting houses.” Another sticky area is hate speech. The EU’s resolve to

condemn “incitement to racial hatred” online in European criminal

codes is contrary to American free speech protections, both on- and

offl ine.

So how big is cyber crime? These varying attack types illustrate

how it is diffi cult to put any single exact, meaningful fi gure on the

size of the problem. There’s also a scarcity of reliable data; criminals

don’t tend to share their information or statistics with academics.

As Cambridge University’s Ross Anderson lays out, “There are over

one hundred different sources of data on cybercrime, yet the avail-

able statistics are still insuffi cient and fragmented; they suffer from

oxfordhb-9780199918096.indd 88oxfordhb-9780199918096.indd 88 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 89

under- and over-reporting, depending on who collected them, and

the errors may be both intentional (e.g., vendors and security agen-

cies playing up threats) and unintentional (e.g., response effects or

sampling bias).”

Even if data were available, defi ning the costs of cybercrime isn’t

that simple. Direct costs fall not only on the direct victims but also

on intermediaries like banks and ISPs that have to handle spam vol-

ume. These indirect costs can really add up. By 2013, an average

fi rm of 1,000 employees or more was spending roughly $9  million

a year on cybersecurity, whether it was a bank or paint maker. One

can think of these costs as a collective tax we all pay, resulting from

the infrastructure that supports criminal enterprises, like the costs

of cleaning up botnets, and the ancillary harms of an untrustworthy

cyberspace, including the reduced use of money-saving online ser-

vices. This is in addition to the money, time, and effort spent mount-

ing a defense, from technical defenses at the organizational level to

the cost of law enforcement, all of which could be put toward more

useful endeavors. When viewed holistically, cybercrime imposes a

substantial cost across society, and defending against it requires an

appreciation of modern cybercriminals’ true sophistication.

A different way of looking at cybercrime is not the costs, but

the size of its business. One approach is to examine cybercriminal

income, but here too it gets complex, setting aside few report their

incomes. The money can certainly be good. According to promi-

nent cybersecurity expert Jim Lewis, “Cybercrime pays well. One

pair of cybercriminals made $2 million in one year from click fraud

on Facebook. Another pair created those bogus malware warnings

that fl ash on computer screens—the FBI says those cybercriminals

made $72  million from people paying to have the phony threats

‘removed.’ A gang in Russia extracted $9.8 million from a U.S. bank

over Labor Day weekend in 2008. . . . Million-dollar crimes probably

happen every month, but are rarely reported.”

Other attempts do a great deal of harm but yield little reward

for the criminal. Rogelio Hacket Jr. was convicted in 2011 of steal-

ing credit cards linked to $36 million in fraud. Although his crimes

spanned seven years, this criminal mastermind was not about to

retire on his ill-gotten gains. According to court fi lings detailing

his nefarious deeds, “In all, the defendant personally received over

$100,000 from his credit card fraud scheme.”

oxfordhb-9780199918096.indd 89oxfordhb-9780199918096.indd 89 21-10-2013 22:38:1521-10-2013 22:38:15

90 CYBERSECURITY AND CYBERWAR

The point is that most types of cybercrime require organization

for execution as well as profi tability. Each successful fraud requires

many different steps that are often individually worth relatively

little.

So the scale of cybercriminal activity is another way to approach

cybercrime. Investigators and researchers have had the opportunity

to study the organization of cybercrime by infi ltrating digital “black

markets,” where criminals trade the necessary components of their

schemes. Forum sellers post offers for spam, credit card numbers,

malware, and even usability tools. When we started writing this

book, a twenty-four-hour denial-of-service attack was listed on a

major black market for only $80, while a mere $200 would pay for

“large projects.”

In any market, even black markets, customer relationships are

important. As one criminal posted, “Price for a million of delivered

mails is starting at $100, and drop real fast, practically to $10, for

regular clients. Selection of countries is free.” These independent

brokers don’t represent the entire threat, though. More enterprising

criminals vertically integrate; that is, they control the entire process

from top to bottom. Security expert Eugene Spafford describes this

as the far more daunting cybercriminal threat: “It is well-funded and

pursued by mature individuals and groups of professionals with

deep fi nancial and technical resources, often with local government

(or other countries’) toleration if not support.”

As in weighing cybercrime’s costs, scale also matters more in

indirect ways. In the same way that a drug den opening up in a

neighborhood will drive away customers from other local busi-

nesses, a growth in these cybercrime organizations and black mar-

kets can undermine trust in the broader digital systems that make

all business more effi cient. If we come to believe that every e-mail

claiming to be from our bank is a phishing attempt, for instance,

then our banks can no longer effectively communicate via e-mail.

The ultimate risk is that the ever-growing scale of cybercrime will

undermine the broader system. If banks decide that the fraud rate

from stolen banking credentials is greater than the cost savings and

customer service benefi ts of online banking, they may just turn it off.

Yet this is where cybercriminals differ from more traditional

crooks; they, too, have a stake in the system. The vast majority of

cybercriminals are parasites, interested in leaching off as much

oxfordhb-9780199918096.indd 90oxfordhb-9780199918096.indd 90 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 91

value as they can rather than destroying the system. And that may

be the fundamental difference between cybercrime and other types

of online harm we explore later, like espionage, war, and terrorism.

Fortunately, this “world of tomorrow” playing out today is not all

bad news. The old books about the future may have predicted “com-

puter crime,” but they also depicted how we would solve it. The

scary future criminals would be chased down by futuristic police-

men armed with ray guns.

“Nevertheless, a computer criminal may succeed now and then

and the detectives of the future will have to be highly skilled com-

puter operators. There will probably be police computer-fraud

squads, specially trained to deal with computer crime. Here you can

see a squad arriving at the home of a computer criminal and arrest-

ing him as he makes a dash for it. He is clutching a computer cas-

sette that contains details of his computer crimes, and the police will

need this as evidence to prove that he is guilty.”

We’ll get to this in Part III, where we explore the path to a more

secure cyberspace, which fortunately doesn’t require ray guns.

Shady RATs and Cyberspies: What Is Cyber Espionage?

In 2011, Dmitri Alperovitch and a team of threat research-

ers at the cybersecurity fi rm McAfee cracked the logs of a

command-and-control server that they suspected had been part of a

series of cyberattacks. The attacks were like many other APTs. They

went after specifi c targets, often using spear-phishing e-mails aimed

at particular individuals with the right level of access inside an

organization. Once downloaded, malware communicated back to a

command-and-control server. Live intruders then remotely jumped

onto the infected machine and used their new access to move across

the network, implanting even more malware and exfi ltrating key

data. So, in many ways, “Operation Shady RAT,” as it came to be

called (after the notion of a Remote Administration Tool), was rather

unremarkable.

But as it began to analyze the logs, the McAfee team pieced

together that something much bigger was going on. This wasn’t

a case of hacktivists seeking attention or cybercriminals pursuing

monetary gain. The attackers, as Alperovitch described, had bigger

things in mind; they seemed motivated by “a massive hunger for

oxfordhb-9780199918096.indd 91oxfordhb-9780199918096.indd 91 21-10-2013 22:38:1521-10-2013 22:38:15

92 CYBERSECURITY AND CYBERWAR

secrets.” This one group had spent fi ve years targeting fi les every-

where from governmental national security agencies to solar energy

companies. One major US news organization saw its New  York

headquarters and Hong Kong bureau compromised for over twenty-

one  months, while the World Anti-Doping Agency’s internal fi les

were cracked right before the 2008 Beijing Olympics.

And the logs showed the attackers had been hugely successful,

ultimately penetrating seventy-two major targets around the world.

The data they made off with included national security secrets, prod-

uct design schematics, and negotiation plans. As he added up the

scale of what “had fallen off the truck” in terms of overall national

and economic security value, Alperovitch realized he had just

watched one of the biggest thefts in history unfold in slow motion

on his computer screen. While he declines to explicitly identify the

attackers, preferring to speak only on known specifi cs, Alperovitch

does say the effort had all the hallmarks of a state-related campaign,

given the range of secrets targeted, and that the state likely behind

the efforts certainly had a strong interest in Asia. If this was a Harry

Potter novel, China was Voldemort, the large Asian cyber power

that “shall not be named.”

Shady RAT illustrates an important change in the art of steal-

ing secrets. Before the computer came along, governments and

other actors would keep their secrets in locked fi le cabinets, behind

a locked door, in a locked building, and behind high walls. Today,

though, if that information is to be useful in any way, it’s stored in

a digital form on a computer that is connected to a network. Even

in organizations as secretive as the CIA, analysts must use comput-

ers (invisible ink has gone the way of the shoe phone) to send and

receive classifi ed information across offi ces and agencies, especially

if they ever want to do something like connect the dots needed to

stop a terrorist attack.

The problem, as we explored earlier, is that many of these networks

are not as secure as their users may think. And so while computer net-

works are allowing groups to work more effi ciently and effectively

than ever before, they are making it easier to steal secrets. We have

entered what one security organization calls the “golden age” of intel-

ligence. As one report notes, “Nations don’t need expensive ground

stations, satellites, airplanes or ships to spy. Global intelligence capa-

bilities now just need a few laptops and a high-speed connection.”

oxfordhb-9780199918096.indd 92oxfordhb-9780199918096.indd 92 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 93

Cyber espionage is the use and targeting of computers to obtain a

secret of some sort. Much like other forms of espionage, it is clandes-

tine (i.e., not using open means) and usually involves a government

agency. This digital form of intelligence gathering dates at least to

1982, when Soviet KGB spies reputedly stole a Canadian fi rm’s soft-

ware that had been laced with a logic bomb secretly planted by the

CIA. It is in the twenty-fi rst century, however, that digital espionage

has truly taken off. Every intelligence agency in the world operates

in this realm, and every country has been targeted. As an example,

in 2009 researchers uncovered a network of 1,295 infected host sys-

tems in 103 countries. This “GhostNet” had targeted foreign affairs

ministries, embassies, and multilateral organizations in places from

Iran and Germany to the Tibetan government in exile. While the ori-

gin of the operation was never confi rmed, researchers pointed out

that the servers utilized were all located on Hainan Island in China.

But before we point too many fi ngers at China for operating in this

realm, remember that the United States is just as active; indeed, large

parts of its intelligence apparatus, like the aforementioned CIA and

NSA, are dedicated to this same mission; the 2013 Snowden leaks

showed 213 of these operations in 2011 alone.

One of the big changes from past espionage, though, is not just the

global scale of cyber operations but their increasingly economic qual-

ity. In many circumstances, the advantage a state gains from stealing

such secrets is fairly direct and obvious. Examples range from the

theft of several Western governments’ preparatory documents for

the G-20 summit in 2011, which would have given the other sides

an edge in international negotiations, to a spate of attacks targeting

the F-35 fi ghter jet’s design and manufacturing process. Intended as

the West’s next-generation, highly computerized, stealthy plane, the

F-35 program’s computer networks have instead been penetrated at

least three times. In one instance, intruders compromised the plane’s

onboard systems responsible for diagnosing mid-air maintenance

problems. The attackers gained access as the plane was literally in

the midst of a test fl ight!

And as with Shady RAT, these losses affect both national and eco-

nomic security. The data taken from the F-35 program, for instance,

has to be weighed both in terms of the billions of dollars of research

that the attacker gained for next to nothing as well as of the infor-

mational edge it might have on a future battlefi eld. Jason Healey, a

oxfordhb-9780199918096.indd 93oxfordhb-9780199918096.indd 93 21-10-2013 22:38:1521-10-2013 22:38:15

94 CYBERSECURITY AND CYBERWAR

retired US Air Force offi cer, was a “plankholder” (founding mem-

ber) of the Joint Task Force–Computer Network Defense, the world’s

fi rst joint cyberwar-fi ghting unit. He compares the strategic impact

of this kind of theft to cancer. “You can’t see it, but it will kill a lot of

us as we get older.”

But many see a broader espionage campaign that is not just about

traditional security per se, but economic competitiveness. Today’s

modern economy is driven by innovation, while cyber theft provides

a low-cost shortcut. As Greg Garcia, assistant secretary for cyberse-

curity at the US Department of Homeland Security, puts it, “Any

country that wants to support and develop an indigenous industry

may very well use cyber espionage to help do that.” Indeed, Dmitri

Alperovitch believes the scale of such theft is even more signifi cant

than the large but lone Shady RAT operation he uncovered. “I am

convinced that every company in every conceivable industry with

signifi cant size and valuable intellectual property and trade secrets

has been compromised (or will be shortly), with the great major-

ity of the victims rarely discovering the intrusion or its impact. In

fact, I  divide the entire set of Fortune Global 2000 fi rms into two

categories:  those that know they’ve been compromised and those

that don’t yet know.”

This cross between digital espionage of a political and busi-

ness nature is why fi ngers typically get pointed at China. A  key

concern in Beijing, which has more state-run and state-affi liated

corporations than its trading partners, is how to keep China’s

economy growing at its incredibly fast pace. But its challenge is not

just a matter of continued growth, but of capturing more of that

growth’s value. Over the last generation, China’s economy primar-

ily produced goods using foreign intellectual property. It worked to

jump-start the Chinese economic boom, but it is not the most attrac-

tive approach in the long term; the Chinese factory that made early

model iPhones, for example, earned only about $15 per phone for

assembling a $630 iPhone.

As it tries to become the world’s largest economy, experts argue

that the Chinese government is increasingly turning to cyber espio-

nage to maintain its expansion. “They’ve identifi ed innovation as

crucial to future economic growth—but they’re not sure they can

do it,” says Jim Lewis, an expert at the Center for Strategic and

International Studies. “The easiest way to innovate is to plagiarize.”

oxfordhb-9780199918096.indd 94oxfordhb-9780199918096.indd 94 21-10-2013 22:38:1521-10-2013 22:38:15

Why It Matters 95

Accusers cite disconnected sales of high-tech computer software

(China is oddly the world’s second-largest market for computer

hardware sales but is only the eighth-largest for software sales) to

more mundane illustrations, such as the manufacture of a certain

type of furniture in China, shortly after the cyber theft of its design. 

Unsurprisingly, Chinese writers and offi cials have reacted angrily

to direct and veiled accusations, describing them as “groundless.”

But the reality is that of some thirty successful prosecutions of eco-

nomic espionage tied to a foreign actor, eighteen have direct ties to

China. Indeed, a study by Verizon’s Data Breach Investigations team

found that “96  percent of recorded, state-affi liated attacks target-

ing businesses’ trade secrets and other intellectual property in 2012

could be traced back to Chinese hackers.”

The outcome is a cyber irony. Cyber espionage is turning into a

major political problem more due to the accusations of intellectual

property (IP) theft than political secret theft. While there is an expec-

tation that all governments have and will continue to try to steal

each other’s state secrets, the IP theft issue is creating global tensions

in two major ways. First, it reinforces a sense that not everyone in

the world marketplace is playing by the same set of rules. While

many hold to the theory of free markets, this new practice privileges

not those who innovate new business ideas but those who steal

them. This, then, further exacerbates tensions that normally arise

when democracies and authoritarian systems interact. Cyber theft

has been described in the New  York Times as “the No. 1 problem” that the United States has with China’s rise. In turn, those in China

describe these accusations as evidence that the United States is still

“locked in a Cold War mentality.”

Second, this theft threatens nations’ long-term economic security.

Cyber espionage creates both strategic winners and losers. Dmitri

Alperovitch, for example, is careful not to call what goes on mere

theft, but a “historically unprecedented transfer of wealth.” As busi-

ness plans, trade secrets, product designs, and so on move from one

country to another, one side is strengthened and the other weakened.

The target loses future potential economic growth derived from that

secret in addition to forfeited development investment. Many worry

that this “transfer” can ultimately have a hollowing-out effect on an

entire economy. Each loss from cyber espionage is too small to be

fatal on its own, but their accumulation might prove crippling. As

oxfordhb-9780199918096.indd 95oxfordhb-9780199918096.indd 95 21-10-2013 22:38:1621-10-2013 22:38:16

96 CYBERSECURITY AND CYBERWAR

one US offi cial put it, “We should not forget that it was China where

‘death by a thousand cuts’ originated.”

As for Dmitri Alperovitch, he grew tired of simply watching

secrets get stolen without consequences. A  year later, he helped

found a cybersecurity company called CrowdStrike, which aims not

only to identify hackers stealing information but strike back using

the same cyber skill sets. He explains, “If I tackle you on the street,

that’s assault and battery. But if a few minutes prior you had taken

my wallet, it’s completely legal, I’m defending my property rights.”

This has a certain direct logic, but as we’ll see, this kind of cyber

retaliation is not nearly as simple in execution.

How Afraid Should We Be of Cyberterrorism?

Thirty-one thousand three hundred. That’s roughly the number of

magazine and journal articles written so far that discuss the phe-

nomenon of cyberterrorism.

Zero. That’s the number of people who had been physically hurt

or killed by cyberterrorism at the time this book went to press.

The FBI defi nes cyberterrorism as a “premeditated, politi-

cally motivated attack against information, computer systems,

computer programs, and data which results in violence against

non-combatant targets by sub-national groups or clandestine

agents.” But in many ways, cyberterrorism is like Discovery

Channel’s “Shark Week” (wherein we obsess about sharks despite

the fact that you are roughly 15,000 times more likely to be hurt

or killed in an accident involving a toilet). As with so many of the

other issues in cybersecurity, what’s real and what’s feared often

get confl ated.

This is not to say that terrorist groups are uninterested in using

the cyber technology to carry out acts of violence. For example, in

2001, al-Qaeda computers seized in Afghanistan showed models of

a dam and engineering software that simulated catastrophic failure

of controls. Similarly, in 2006, terrorist websites promoted cyberat-

tacks against the US fi nancial industry in retaliation for abuses at

Guantánamo Bay. But fortunately, what terrorists have actually

accomplished online so far doesn’t come close to their unfulfi lled

dreams, our broader fears, or, more importantly, the scale of destruc-

tion they’ve wrought through more traditional means. Despite

oxfordhb-9780199918096.indd 96oxfordhb-9780199918096.indd 96 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 97

plenty of speculation and foiled potential plots, there have been no

actual successes.

As one congressional staffer put it, the way we use a “term like

cyberterrorism has as much clarity as cybersecurity, that is none

at all.” Indeed, the only publicly documented case of an actual

al-Qaeda attempt at a cyberattack doesn’t even meet the FBI defi ni-

tion. A  detainee at Guantánamo Bay, Mohmedou Ould Slahi, con-

fessed to trying to knock the Israeli prime minister’s public-facing

website offl ine. Beyond this there have been various unsubstanti-

ated claims, such as that of September 2012, when the “Izz ad-Din

al-Qassam Cyber Fighters” claimed responsibility for a series of

denial-of-service attacks on fi ve US banking fi rms. While many

believe they stole credit for cybercriminals’ work, the effects of the

attacks were negligible, shutting down customer access to the sites

for a few hours. Most customers didn’t even know there had been an

attack. Take out the word “cyber” and we wouldn’t even call such a

nuisance “terrorism.”

Let us be crystal clear: the worries over vulnerabilities in critical

infrastructure to cyberattack have real validity. From 2011 to 2013,

probes and intrusions into the computer networks of critical infra-

structure in the United States went up by 1700 percent. And the wor-

ries of cyberterrorists harming this infrastructure are certainly a real

concern. For instance, in 2011 a water provider in California hired

a team of computer hackers to probe the vulnerabilities of its com-

puter networks, and the simulated attackers got into the system in

less than a week. Policymakers must be aware that real versions of

such terror attacks could expand beyond single targets and have a

wider ripple effect, knocking out the national power grid or shutting

down a city or even region’s water supply.

But just as our fears inspired all sorts of potential new terror

attack scenarios in the immediate aftermath of 9/11, the key is dis-

tinguishing between our nightmarish visions of what might happen from the actual uses of the Internet by terrorist groups. As one cyber

expert put it to us, “There are threats out there, but there are no

threats that threaten our fundamental way of life.”

This is because cyberattacks of a massive scale are fairly dif-

fi cult to pull off, especially compared to more traditional terrorist

activities. In 2011, then US Deputy Defense Secretary William Lynn,

the Pentagon’s second highest civilian leader, spoke to the RSA

oxfordhb-9780199918096.indd 97oxfordhb-9780199918096.indd 97 21-10-2013 22:38:1621-10-2013 22:38:16

98 CYBERSECURITY AND CYBERWAR

conference in San Francisco, a gathering of the top experts in cyber-

security, about the dangers of cyberterrorism. “It is possible for a

terrorist group to develop cyberattack tools on their own or to buy

them on the black market,” Lynn warned. “A couple dozen talented

programmers wearing fl ip-fl ops and drinking Red Bull can do a lot

of damage.”

But here again, he was confl ating a fear and a reality, not just

about what such Red Bull–drinking programmers are actually hired

to do but also what is needed to accomplish a truly violent cyberat-

tack of major scale. It goes well beyond fi nding top cyber experts.

Taking down hydroelectric generators or designing malware like

Stuxnet that causes nuclear centrifuges to spin out of sequence

doesn’t just require the skills and means to get into a computer sys-

tem. It requires knowing what to do once you’re there.

To cause true damage entails an understanding of the devices

themselves:  how they run, their engineering, and their underly-

ing physics. Stuxnet, for example, involved cyber experts as well

as experts in nuclear physics and engineers familiar with a specifi c

kind of Siemens-brand industrial equipment. On top of the required

expertise, expensive software tests had to be conducted on work-

ing versions of the target hardware. As a professor at the US Naval

Academy explains, “the threat of cyber terrorism, in particular, has

been vastly overblown,” because conducting a truly mass-scale act of

terrorism using cyber means “simply outstrips the intellectual, orga-

nizational, and personnel capacities of even the most well-funded

and well-organized terrorist organization, as well as those of even

the most sophisticated international criminal enterprises. To be

blunt:  neither the 14-year old hacker in your next-door neighbor’s

upstairs bedroom, nor the two or three person al Qaeda cell holed

up in some apartment in Hamburg are going to bring down the Glen

Canyon and Hoover Dams.” By comparison, the entire 9/11 plot

cost less than $250,000 in travel and organizational costs and used

simple box-cutters.

There is another cautionary note that puts the impact of such

potential attacks into perspective. The 2007 cyberattacks on Estonia

were allegedly assisted by the Russian government and hence were

well beyond the capacity of most terror organizations. And yet,

while they were able to interfere with public-facing government

websites for several days, they had little impact on the daily life of

oxfordhb-9780199918096.indd 98oxfordhb-9780199918096.indd 98 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 99

the average Estonian and certainly no long-term effect. Compare

that with the impact of a plane crashing into the center of the US

fi nancial system. Indeed, even when you move into the “what if”

side of the largest-scale potential terror attacks, a successful cyber-

terror event still pales compared to other types of attacks. The dis-

ruption of the electric power grid for a few days or even months

would most defi nitely be catastrophic. But the explosion of just one

nuclear bomb, even a jury-rigged radiological “dirty bomb,” would

irradiate a city for centuries and set off an earthquake in global pol-

itics. Similarly, while a computer virus could wreak havoc in the

economy, a biological weapon could change our very patterns of life

forever.

As Mike McConnell, former Director of National Intelligence, put

it when talking about cyberterrorism, we need to weigh the balance

of what is real and what is potential. “Terrorist groups today are

ranked near the bottom of cyberwar capability.” But just because

no one has pulled off an attack thus far doesn’t mean one shouldn’t

be mindful of the threats. “Sooner or later [they] will achieve

cyber-sophistication.”

So How Do Terrorists Actually Use the Web?

That cyberterrorism may not be as likely or scary as the media and

some government leaders portray doesn’t mean that terrorists are

Luddites who never use technology. Far from it. The Internet offers

the means to connect with vast groups of people, overcoming tra-

ditional geographic constraints. It links people of similar interests

and beliefs who otherwise wouldn’t normally meet while allowing

voices to be magnifi ed and reach more people. So, just as the Internet

has been used by everyone from companies looking to recruit new

workers to Christian singles looking to mingle, so too has it been a

boon to terrorist groups.

Indeed, if you want to understand terrorists’ use of cyber tech-

nology, just look at how others use it to engage in less nefarious

acts. For terrorists, and the rest of us, cyberspace is a medium mostly

for communication and information sharing. Al-Qaeda, for exam-

ple, rarely used the Internet during its formative years in the early

1990s. Osama bin Laden’s messaging was spread through the distri-

bution of audio- and then videotapes, usually passed surreptitiously

oxfordhb-9780199918096.indd 99oxfordhb-9780199918096.indd 99 21-10-2013 22:38:1621-10-2013 22:38:16

100 CYBERSECURITY AND CYBERWAR

between vetted followers. Indeed, the very name “al-Qaeda,” or

“the base,” is thought to have originated after the name of the fi rst

terrorist training camps in the mountains of Afghanistan (anyone

who had gone through the camps was already known, trained, and

trusted). But in the 2000s, two key changes occurred. After 9/11, the

US military’s operations in Afghanistan eliminated a physical safe

haven for training and organization, while simultaneously cyber

technology became more commonplace and usable.

The result was a group, guided by medieval ideals, embracing

twenty-fi rst-century technology. Al-Qaeda didn’t use cyberspace to

conduct cyberterrorism as it is usually defi ned, but to conduct infor-

mation operations, harnessing the power of the Internet to reach the

wider world in a way never before possible for such a small group.

Bin Laden’s speeches and musings could be delivered alone in a

hideout yet uploaded onto the Internet and seen by millions.

Notably, these messages were often distributed not just to the

media but also within Internet chat rooms, where individuals who

reacted positively could then be targeted for recruitment. Here, too,

technological change was crucial. At the time of the 9/11 attacks,

downloading such a propaganda video would have taken so long

that few would have even been able to watch it, let  alone fi nd out

about it. Now, video clips can be uploaded and downloaded in

seconds.

As the cyber world has evolved, so too has terrorist groups’ use

of it, especially in information operations. Just as in other parts

of cyberspace, the more attention-grabbing the content, the more

likely it is to be watched, thus rewarding aberrant and abhorrent

attitudes and behavior with more web clicks (this is what terrorists

and the Kardashians have in common). It has allowed fringe groups

to reach the mainstream, often to the disadvantage of more mod-

erate and representative voices. For example, searches for generic

terms like “Islam” on YouTube will yield speeches by radical imams

with fringe followings, like the one that inspired the 2013 Boston

Marathon bombers, who often get higher page counts than those

by reputable Muslim scholars. Accordingly, groups have begun to

tailor their activities to recruit adherents who can operate inside the

West, especially as borders become harder to cross for would-be

terrorists. The al-Anser Forum, for instance, is a jihadi site pub-

lished mainly in English.

oxfordhb-9780199918096.indd 100oxfordhb-9780199918096.indd 100 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 101

The Internet revolution has allowed terrorist groups to obscure

their operations in new ways that complicate the old ways of think-

ing about threats. Terror groups, eerily like the rest of us, value the

Internet for its reliable service, easy terms, and virtual anonymity.

The Taliban, for example, ran a propaganda website for over a year

that kept a running tally of suicide bombings and other attacks

against US troops in Afghanistan. And yet the host for the website

was a Texas company called ThePlanet that rented out websites for

$70 a month, payable by credit card. With some 16 million accounts,

the company wasn’t aware of the Taliban site’s existence and took it

down once notifi ed by authorities.

And even when these sites are discovered and taken down, what

we know and love about the Internet’s structure works to these

groups’ advantage. Osama bin Laden’s very last video before his

death was simultaneously uploaded onto fi ve different sites. And

while counterterrorism agencies rushed to take them down, within

one hour the video had been captured and uploaded by over 600

sites. Within a day, the number of sites hosting the video had dou-

bled once again.

For terror groups, Internet communication does more than just

create new connections and spread viral ideas; it also maintains old

ones much in the same way that the rest of us use social network-

ing to keep in touch with high school friends. Here, too, the rela-

tive anonymity and shrinking of distance that cyberspace allows are

valuable advantages. Anarchist groups in the 1800s, the progenitors

of many of the terror groups today, sent secretly coded messages

by post and had to wait months for a reply. Today, a group can link

members continents away instantaneously. All of the 9/11 attackers,

for example, had Hotmail accounts, and they were thought to have

coordinated through notes left in the guestbook section of a website

run by the brother-in-law of one of Osama bin Laden’s lieutenants.

Where cyberspace has had perhaps the greatest impact is in the

sharing of knowledge in new and innovative ways. Some organiza-

tions take advantage of this for the positive, like the Khan Academy,

which has allowed children around the world to learn math and sci-

ence via online tutorials. But terrorists have also spread their pecu-

liar type of knowledge, or what security experts call “TTPs” (short

for tactics, techniques, and procedures), in ways not possible before.

The recipes for explosives are readily available on the Internet, as

oxfordhb-9780199918096.indd 101oxfordhb-9780199918096.indd 101 21-10-2013 22:38:1621-10-2013 22:38:16

102 CYBERSECURITY AND CYBERWAR

are terrorist-provided designs for IEDs for use across confl ict zones

from Iraq to Afghanistan. This diffusion of terror teachings has been

hugely important as these groups have found fewer and fewer train-

ing spaces free from global drone strikes.

The transfer of knowledge is not just about the “how” of a terror

attack, but also the “who” and the “where” on the targeting side.

Groups use cyberspace as a low-cost, low-risk venue to gather intel-

ligence in ways they could only dream about a generation ago. For

example, no terrorist group has the fi nancial resources to afford a

spy satellite to scope out targets with pinpoint precision, let  alone

the capability to build and launch one into space. Yet Google Earth

worked just as effectively for Lashkar-e-Taiba, a Pakistan-based ter-

ror group, when it was planning the 2008 Mumbai attacks.

As in other areas of cybersecurity, we have to be aware of our

own habits and uses of the Internet and how such bad actors might

take advantage. In 2007, US soldiers took smartphone photos of

a group of new US Army helicopters parked at a base in Iraq and

then uploaded them to the Internet. The helicopters weren’t classi-

fi ed and the photos showed no seemingly useful information to the

enemy. But the soldiers didn’t realize the photos also included “geo-

tags,” which revealed where the photographers had been standing.

Insurgents then used these geotags to pinpoint and destroy four

of the helicopters in a mortar attack. Experts now use this exam-

ple to warn people to be more careful about what they share when

engaged in an important activity. “Is a badge on Foursquare worth

your life?” asked Brittany Brown, social media manager at Fort

Benning, Georgia.

A growing worry is that groups may fully exploit social net-

working to locate better targeting information, and not just for

geographic targets, but human ones. After the bin Laden raid in

2011, an American cybersecurity analyst was curious as to what he

could fi nd out about the supposedly super-secret unit that carried

it out. He told us how he was able to fi nd twelve current or former

members’ names, their families’ names, and home addresses. This

was not a matter of leaks to the press but rather through a series

of social networking tricks. He identifi ed one member of the raid

team from a website photo of his SEAL training class, and another

after he located an online image of a person wearing a SEAL team

T-shirt with a group of friends and then tracked down those friends.

oxfordhb-9780199918096.indd 102oxfordhb-9780199918096.indd 102 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 103

Using these same tactics, he also found the names of FBI undercover

agents and, in another case, two married senior US government offi -

cials who were participating in a swinger site (and thus vulnerable

to blackmail).

The analyst carried out the exercise to warn these targets to

beware that there was more about them on the Internet than they

thought, a useful reminder for us all.

What about Cyber Counterterrorism?

“It seems that someone is using my account and is somehow send-

ing messages with my name. . . The dangerous thing in the matter is

that they [those replying to what they thought was a genuine e-mail]

say that I had sent them a message including a link for download,

which they downloaded.”

We can all empathize with this fellow. Many of us have received

similar warnings from friends or family that someone has hacked

their account and to beware of suspicious messages. The difference

is that the individual complaining about being hacked in this case

was “Yaman Mukhadab,” a prominent poster inside Shumukh, a

supposedly elite, password-protected forum for radicals. Before

he sent out his warning to the forum, the group’s agenda had

included assembling a “wish list” of American security industry

leaders, defense offi cials, and other public fi gures for terrorists to

target and kill.

Mukhadab’s cyber hardships illustrate that technology is a

double-edged sword, even in the cyber realm that otherwise seems

to be perfect for terrorists. Consider how much better and faster

the Internet is today for terrorists wanting to communicate ver-

sus the experience of their 1800s forebears, who had to use snail

mail to plan bombings. Yet, just as the mail of the past proved a

liability for nineteenth-century anarchists once police learned to

track them down by searching their correspondence, so too can

today’s terrorists’ online activities shift from an advantage to a

vulnerability.

A new debate has emerged in recent years, with some arguing

that in lieu of playing a never-ending game of whack-a-mole, trying

to track and then shut down all terrorist use of the Internet, it might

be better to let the groups stay. “You can learn a lot from the enemy

oxfordhb-9780199918096.indd 103oxfordhb-9780199918096.indd 103 21-10-2013 22:38:1621-10-2013 22:38:16

104 CYBERSECURITY AND CYBERWAR

by watching them chat online,” said Martin Libicki, a senior policy

analyst at the RAND Corporation, a nonprofi t research organization.

The point is that the advantages of cyberspace for terrorism can

be equally useful for counterterrorism. The Web has aided terror-

ist groups by acting as both a Rolodex and playbook. But those

on the other side of the fi ght have access to the same Rolodex and

playbooks.

The networking effects of cyberspace, for instance, allow terror-

ists to link as never before, but they also allow intelligence analysts

to map out social networks in unprecedented ways, providing clues

about the leadership and structure of terrorist groups that would oth-

erwise be impossible to gain. The world learned just how powerful

some of these tools can be from documents leaked by NSA contrac-

tor Edward Snowden in 2013, detailing how US intelligence agencies

and their allies engaged in online surveillance of an unprecedented

scale. The approach was to monitor as much Internet traffi c as possi-

ble, with a particular goal of collecting what is known as “metadata.”

Essentially data about the data itself, metadata is information

that describes the nature of communication, rather than the content.

In traditional telephone surveillance, for example, this would sim-

ply be a record of what phone number called another phone num-

ber at what time, as opposed to what was said on the call. In the

cyber era, metadata is far more complicated and thus far more use-

ful. It includes information about geographic location, time, e-mail

addresses, and other technical details about the data being created

or sent. When this data is gathered together from sources around

the world, sophisticated algorithms can be used to connect dots and

reveal new patterns, as well as track individual devices, even when

the user is trying to hide her identity. The effort was designed to

help fi nd links between terrorists. But the NSA programs controver-

sially entailed collecting such information on the online activities of

millions of non-terrorists. Think of it as trying to fi nd a needle in a

haystack, by collecting the entire haystack.

Online efforts can even be used as a means to pinpoint those not

yet linked into terror networks, such as those pondering joining

extremist groups or engaging in the sort of “lone wolf” attacks that

have become more prominent in recent years. For instance, in 2008

and 2009 US intelligence agencies reportedly tried to attack and shut

down the top terrorist propaganda websites on the anniversary of

oxfordhb-9780199918096.indd 104oxfordhb-9780199918096.indd 104 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 105

9/11, in order to delay the release of an Osama bin Laden video cel-

ebrating the attacks. In 2010, however, they took a different tack. As

Wired magazine reported, “The user account for al-Qaida’s al-Fajr media distribution network was hacked and used to encourage

forum members to sign up for Ekhlaas, a forum which had closed

a year before and mysteriously resurfaced.” The new forum turned

out to be a fake, an online spiderweb entangling would-be terrorists

and their fans. Similarly, while the Internet might spread potential

terrorist tactics, defenders can also gain crucial insight into which

tactics are taking hold and need to be defended against.

And, of course, one doesn’t have to just watch but can also

engage in cyberattacks against the terrorists. One known example

(we only want to talk about the cases the terrorists already know

about!) is using the terrorists’ own computers to spy on them. This

is what happened to Yaman Mukhadab and to the Global Islamic

Media Front (GIMF), a network for producing and distributing radi-

cal propaganda online. In 2011, it had to warn its members that the

group’s own encryption program, “Mujahideen Secrets 2.0,” actu-

ally shouldn’t be downloaded because it had been compromised.

Just as cyberattacks don’t always just seek to breach a network

to gain information, cyber counterterrorism can change information

inside a terrorist’s networks. This might include playing a cheeky

game of propaganda. In 2010, the terror group Al-Qaeda in the

Arabian Peninsula (AQAP) issued “Inspire,” an English-language

online magazine designed to draw in recruits and spread terror tac-

tics. Their fi rst issue was reportedly hacked by British intelligence

agencies, who replaced the terrorist “how to” pages with a cupcake

recipe. Or the corruption of information might fl ip the idea of cyber-

terrorism on its very head. In one case, online bomb-making instruc-

tions were changed so that the attacker would instead blow himself

up during the construction of the device.

What’s notable about these online counterterror efforts is that, as

with the rest of cybersecurity, governments are not the only play-

ers. Nonstate “hacktivism” has even played an important role in

policing the Web. Jon Messner, for instance, is a private citizen from

Maryland, who took down al-Neda, an al-Qaeda site. Fighting ter-

rorism online is a hobby for Messner, though. His day job is run-

ning an Internet pornography business, being perhaps best known

for originating the “housewife next-door” genre. It’s yet another

oxfordhb-9780199918096.indd 105oxfordhb-9780199918096.indd 105 21-10-2013 22:38:1621-10-2013 22:38:16

106 CYBERSECURITY AND CYBERWAR

illustration of how the Internet isn’t ungoverned, but rather is

self-governed in strange and fascinating ways.

Security Risk or Human Right? Foreign Policy and the Internet

Cloud computing, the concept of delivering computing resources

remotely over a network, is both a multibillion-dollar industry and

a growing fi eld that many believe is key to the future of the online

world (as we’ll explore later on). But for three days in 2011, the

Dutch government threatened to undermine the new era of cloud

computing, all in the name of human rights.

Taking issue with American laws that gave the US government

access to any data stored on computers controlled by American

companies, the Dutch Minister of Safety and Justice threatened to

deny any American fi rm the ability to offer cloud-computing ser-

vices to the Dutch government in 2011. Yet if no country was willing

to let its data be held by a foreign company for fear of government

surveillance, the transformative power of cloud computing to store

and distribute data globally would be severely undermined. The

Dutch ultimately backed down, but these calls have been echoed

even more sharply around the world following the disclosure of

certain NSA surveillance practices in 2013. Such episodes highlight

a key tension:  How do we balance the need for security with the

importance of privacy and free expression?

Often couched in the language of human rights, the term

“Internet freedom” centers on the idea of online free expression and

the right to access the Internet as a means of connecting to others

around the world. This idea builds on political rights granted well

before the cyber age, like those in the 1948 Universal Declaration

of Human Rights and the 1966 International Covenant on Civil

and Political Rights “that guarantee the right to seek, receive and

impart information and ideas through any media and regardless

of frontier.”

As the world moved into the digital age, democratic states argued

that the online world wasn’t just structured with a democratic ethic

in mind, such as through the governance models we discussed in

Part I; it also had to respect rights in the same spirit. This became

a major part of former US Secretary of State Hillary Clinton’s

agenda, when she argued that our basic human rights must include

oxfordhb-9780199918096.indd 106oxfordhb-9780199918096.indd 106 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 107

cyberspace, since “people are as likely to come together to pursue

common interests online as in a church or a labor hall.”

The battle over Internet freedom is not simply a matter of access

(such as whether Chinese or Iranian citizens should have access to

online news reports). It has evolved to be more pointed and rele-

vant to cybersecurity issues, as the Internet has become viewed as a

means to change regimes themselves.

A number of nations, including the United States and the UK,

as well as advocacy groups, have reached out to dissident groups

operating under repressive regimes in ways that complicate cyber-

security. This effort has gone beyond traditional diplomacy, provid-

ing not just cyber training for the groups, but also the development

and distribution of new technologies, like Tor, that aid users in

evading government surveillance and censorship. It seems simple

enough, but the problems are manifold. By enabling behavior on

the Internet outside control or observation of the local government,

regimes have often seen the technologies and those behind them as

a security threat. For instance, in China, the government views its

censorship not as a violation of human rights but as a tool for stabil-

ity. Thus, these technologies have been categorized by China and its

allies in international forums as tools of cyberattacks.

Freedom of speech is not only viewed differently among authori-

tarian and democratic states, but also across cultural and historic

lines. In Thailand, it is illegal to defame the monarch; in Britain, it’s

a popular hobby. Controversial laws limit behavior online in the

West, too. France successfully sued Yahoo! to ban the sale of Nazi

memorabilia, something legal in the United States. Indeed, at the

very moment the US State Department was pushing an online free-

dom agenda, other parts of the Obama administration and the US

Congress were considering the Stop Online Piracy Act, which would

have forced American ISPs to prevent access to foreign websites that

illegally offer copyrighted material. An online protest movement,

including a blackout of Wikipedia, forced the administration and

Congress to back down.

The confl ict between rights and security is not just a matter of

political expression but also tests how issues of cybersecurity might

be resolved. The debate about Internet governance has spilled into

the security space. Those opposing American dominance in the

multistakeholder process of setting Internet standards (discussed in

oxfordhb-9780199918096.indd 107oxfordhb-9780199918096.indd 107 21-10-2013 22:38:1621-10-2013 22:38:16

108 CYBERSECURITY AND CYBERWAR

Part I) point to the revelations of NSA surveillance and the build

up of Pentagon cyberwar capabilities as evidence for why a shift is

needed. Defenders of the ICANN model, in turn, observe that many

of those nations pushing for more government control just happen

to be the most active at restricting speech within their own countries.

Ultimately, these questions turn on basic political questions of

who should and who does have the power to decide whether some-

thing is a security risk or a human right. It is a matter that has vexed

everyone from ancient Greek philosophers to the Founding Fathers,

and it continues with us today.

Focus: What Is Tor and Why Does Peeling Back the Onion Matter?

It has received fi nancial backing from the US Department of Defense

as part of a Naval Research Lab program to keep digital secrets secret,

but in turn, Edward Snowden revealed that any use of it is grounds

for surveillance by the NSA. It has been described by The Economist as a “dark corner of the Internet,” while it also won the 2010 Award

for Projects of Social Benefi t for enabling “36 million people around

the world to experience freedom of access and expression on the

Internet.” Tor is one complex character.

Suppose you want to communicate with another computer user

and not have anyone know. You could use encryption, but that

would only prevent any eavesdropper from knowing what you were

saying. Sometimes it’s also important to keep private who you are

communicating with. This type of privacy is important for a wide

variety of online players: intelligence agencies communicating with

undercover sources, companies exploring the competition’s pub-

lic website without their IP address showing up in the server logs,

and especially for political activists inside authoritarian states, who

don’t want their governments to identify other dissidents whom

they’re working with.

A simple approach is a single-hop proxy, where you send your

traffi c to a computer that then passes it along to the fi nal destination.

This can be effective for an adversary watching an endpoint, but

now you have to trust the intermediary. Who controls it? Do they

keep records? What legal jurisdiction do they operate under?

Many users are rightly hesitant to use anonymity infrastructure

that they do not control. However, on an open network such as the

oxfordhb-9780199918096.indd 108oxfordhb-9780199918096.indd 108 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 109

Internet, running one’s own system won’t work. A system that car-

ries traffi c for only one organization will not hide the traffi c entering

and leaving that organization. Nodes must carry traffi c from others

to provide cover.

The solution is a system called Tor, short for “The Onion Router.”

Tor is an “overlay network” that provides online protection against

surveillance and traffi c analysis. An overlay network sits on top

of the Internet but provides its own virtual structure of nodes and

links. The network is formed by volunteers who offer their machines

as nodes. Internet traffi c is broken up into chunks, much like the

underlying Internet packets, and encrypted to provide confi denti-

ality. Communication then takes a multiple-hop path through the

network, forcing any surveillance regime to watch every node in

the network if they want to trace communication between the end-

points. Communication between each hop is separately encrypted

so that an eavesdropper cannot learn as much from watching any

single node. In short, Tor uses a network of intermediates to disguise

both the source and endpoint of a conversation.

While it offers complex protection, Tor engineers have worked

hard to make the network easy to use. You can download a whole

web browser with Tor built in. Individuals with access can then

e-mail, surf the Web, and share content online without anyone

knowing who or where they are.

The positive social side of Tor is that it provides anonymity that

supports free expression on the Internet by circumventing censor-

ship. Tor originated in 2004 but rose to greater prominence a few

years later during the 2009 “Green Revolution” protests in Iran and

the 2011 “Arab Spring” as a means for dissident movements to col-

laborate but remain hidden in plain view.

Yet that same advantage also means that it provides anonymity

for criminals seeking to avoid law enforcement’s online surveillance.

Tor has been used in cases involving child pornography (an FBI

agent told us about one forum where anonymous users exchanged

information on the best way to drug children), bank fraud, malware

distribution, and an online anonymous black market called “Silk

Road,” where Internet users buy and sell controlled substances,

guns, and narcotics.

The result has been a mixed attitude toward the technology and

its uses. Despite the fact that it originally funded Tor, parts of the US

oxfordhb-9780199918096.indd 109oxfordhb-9780199918096.indd 109 21-10-2013 22:38:1621-10-2013 22:38:16

110 CYBERSECURITY AND CYBERWAR

military have described it as a threat, not least because of its use in

several whistleblower cases like WikiLeaks. Meanwhile, because it

has proved to be a thorn in the side of authoritarian governments,

the US Congress and State Department have been supportive,

describing it as an enabler of online freedom.

Tor’s future rests on how this battle over Internet freedom

is resolved, not just on the policy side but also technologically.

Increasingly, regimes like China are employing new Internet censor-

ship technology to fi ght a cat-and-mouse game with Tor developers.

As the censors seek to fi nd ways to block access to the network, Tor

tries to circumvent each new technique. For instance, one innova-

tive effort to keep Tor open for users behind the “Great Firewall of

China” piggybacks Tor traffi c inside a Skype video conference con-

nection. This technique is innovative not only because it success-

fully hides Tor traffi c within another protocol, but also because if the

Chinese authorities were to shut it down, they would be forced to

shut down all Skype traffi c in the country, an impossible task given

Skype’s importance to multinational fi rms communicating with

branch offi ces. Censorship then comes with a real monetary cost.

Tor illustrates the tension that can emerge between cyber freedom

and security. The onion router has given extra layers of security to

those who want to stay secret online, but secrecy can be scary to the

established order.

Who Are Patriotic Hackers?

When Estonia’s websites were attacked in the “Estonian Cyberwar”

of 2007, Urmas Paet, the tiny nation’s foreign minister, was quick

to point his fi nger at neighboring Russia. He angrily accused the

Kremlin of trying to paralyze his nation’s economy and government

through a massive denial–of-service attack. “Russia is attacking

Estonia. . . . The attacks are virtual, psychological and real.” But the

Russian parliamentary leader Sergei Markov suggested the accusers

look elsewhere than the Russian government:  “About the cyberat-

tack on Estonia . . . Don’t worry, that attack was carried out by my

assistant.”

It sounds odd, but Markov’s version of the story actually has

an element of truth in it. Far from denying his role in what many

thought of as an illegal action, Markov’s young assistant openly

oxfordhb-9780199918096.indd 110oxfordhb-9780199918096.indd 110 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 111

acknowledged it. He was a leader in Nashi (“Ours”), a move-

ment of some 120,000 Russians between the ages of seventeen and

twenty-fi ve. While not offi cially part of the Russian government,

the group was organized by pro-Putin regime supporters to take

on “anti-Fatherland” forces. Modeled in some ways after the Young

Soviet Kosomol, its activities ranged from running summer camps

to beating up antiregime protesters in street rallies. It also engaged

in cyber activities against what it saw as the twin perils of “Nazism

and liberalism.” In this case, Estonia had moved the Bronze Soldier

of Tallin, a Russian grave marker from World War II. It was an act

that Russian nationalists like members of Nashi believed deserved

retribution, including by cyber means.

What Nashi was involved in is often called “patriotic hacking,” an

action that involves citizens or groups within a state joining together

to carry out cyberattacks on perceived enemies of that country.

While those executing the attacks are private citizens and groups,

one of the hallmarks of patriotic hacking is the subtle role that a

government often plays in orchestrating the action to make it effec-

tive. One lone Russian youth trying to carry out a denial-of-service

attack would meet with little success. But in the Estonian case, tools

and instruction kits detailing how to carry out the DDoS attack were

posted in Russian forums, mobilizing vast numbers of individual

hackers to give it a state-sized scale. In an even better example, cyber-

attacks against Georgia only a year later during the Russian-Georgia

War were not only timed to coincide with Russian military opera-

tions but even utilized, in the words of one study, “vetted target

lists of Georgian government websites,” thought to be provided by

Russian intelligence.

The advantage of using patriotic hackers is that a government can

utilize the synchronization and large-scale effort it wants without

being offi cially involved, giving it just enough cover to claim plau-

sible deniability. Without cross-border police cooperation (which

the Russians refused to provide—another hallmark of the phenom-

enon), it was impossible to determine exactly who was behind all

the computer accounts involved in the Estonia attacks (besides par-

liamentary leaders ratting out their assistants). Thus, in an ironic

twist, governments that orchestrate such attacks can act aggrieved

whenever accused of involvement. Ultimately, while attacks against

Russia’s foes occurred in cyberspace and a parliamentary leader

oxfordhb-9780199918096.indd 111oxfordhb-9780199918096.indd 111 21-10-2013 22:38:1621-10-2013 22:38:16

112 CYBERSECURITY AND CYBERWAR

spoke of his offi ce’s own role in it, a Russian ambassador could

retort, “If you are implying [the attacks] came from Russia or the

Russian government, it’s a serious allegation that has to be substan-

tiated. Cyber-space is everywhere.”

Patriotic hackers, though, aren’t limited to youth groups. An

interesting nexus actually exists with criminal organizations. They

usually operate for their own profi t motives but can also be mobi-

lized by a state for political purposes. Many of the very same tools,

platforms, and tactics used in the 2008 Georgia attacks, for instance,

were also utilized by the Russian Business Network, one of the larger

cybercriminal organizations. This leads many to believe that agree-

ments have occasionally been struck in the patriotic hacker world.

Criminal groups are given some freedom to operate in exchange

for demonstrating their patriotism when governments ask for aid.

Think of it as the cyber equivalent of the deal struck between the

FBI and Mafi a during World War II, when the Feds agreed to lay

off their investigations in exchange for the mobsters watching the

docks for Nazi spies and aiding military intelligence operations in

Italy. Similarly, Russia was fairly active in cracking down on cyber-

crime rings before the cyberattacks of the late 2000s, but it has been

far more lax in its law enforcement since. Indeed, it’s notable that

while nearly any publication that the Russian government considers

objectionable has been prosecuted and harassed into prohibition in

recent years, the hacker magazine Xaker: Computer Hooligan remains in broad circulation.

Sometimes, these activities are more explicitly condoned. In

2011, a hacker collective calling itself the Syrian Electronic Army

defaced or disabled news websites that were critical of the Syrian

regime’s behavior in the widening civil war. Syrian president Assad

praised these activities, calling the group “an electronic army

which has been a real army in virtual reality.” This led to “patri-

otic hacker” versus “hacktivist” drama as Anonymous entered the

fray against the Syrian regime, and the SEA retaliated by targeting

Anonymous-affi liated sites.

Another advantage is that patriotic hackers allow governments

to tap into expertise and resources that lie beyond the state. Some

governments even appear to be working in concert with patriotic

hacker groups in order to scout new talent and create a “B-team” of

cyber reserves. In 2005, the Chinese military reportedly organized a

oxfordhb-9780199918096.indd 112oxfordhb-9780199918096.indd 112 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 113

series of regional hacker competitions to identify talented civilians.

As a result, the founding member of the infl uential hacker group

Javaphile (hugely active in Chinese patriotic hacker attacks on the

United States in the early 2000s, including the defacement of the

White House website) joined the Shanghai Public Security Bureau

as a consultant.

However, this comes with a price. While patriotic hackers have

proved able to hamper state foes in cyberspace while maintaining

plausible deniability, they may not have the level of control that

governments, especially authoritarian ones, desire. Once set loose

in cyberspace, hackers can go off message or engage in unwanted

activities. In an embarrassing episode, the winner of China’s 2005

regional competition was later arrested for attacking rival hacker

groups’ websites. And when the Chinese government only wanted

positive news to surround the 2008 Beijing Olympics, Chinese patri-

otic hacker forums made negative news by providing tutorials on

how to launch a DDoS attack against the CNN website (they were

upset by its reporting on riots in Tibet). Things proved especially

escalatory in 2010 when patriotic hackers from Iran and China, two

ostensible allies in the real world, got into an escalating series of

retaliatory attacks after baidu.com (the Chinese version of Google)

was hit by the “Iranian Cyber Army.”

Thus, governments are sometimes forced to crack down on the

very patriotic hackers they once relied on. For instance, in 2010, the

Chinese government ordered the Black Hawk Safety Net site shut.

Previously, the site had been a hub for patriotic hacker tools and les-

sons, with some 170,000 members.

Some governments, however, then embrace these groups,

bringing them into the fold through “cyber militias.” Many trace

this trend back to the 2001 Hainan Island incident, during which

a Chinese J-8 fi ghter pilot veered too close to an American Navy

P-3 surveillance plane and the two aircraft collided in midair. The

smaller Chinese plane spun to earth and its hotdogging pilot was

killed, while the American plane had to make an emergency land-

ing at a Chinese airfi eld on Hainan. As the two governments angrily

accused the other of causing the collision, the Communist Party

encouraged computer-savvy citizens in China to deface American

websites to show their collective displeasure. As we discussed ear-

lier, Chinese teens organized online by the thousands and gleefully

oxfordhb-9780199918096.indd 113oxfordhb-9780199918096.indd 113 21-10-2013 22:38:1621-10-2013 22:38:16

114 CYBERSECURITY AND CYBERWAR

joined in the cyber vandalism, targeting everything from public

libraries in Minnesota to the aforementioned White House website.

After an eleven-day standoff, the recently elected Bush administra-

tion agreed to send a “letter of sorrow” and pay China $34,000 for the

detained crew’s “food and lodging,” after which the American crew

was released. And with that, the Chinese government declared an

end to the episode and sought to normalize relations with the United

States. The only problem was that, once loosed, the young patriotic

hackers were stoked with nationalism and proved diffi cult to rein in.

Several were ultimately arrested when they wouldn’t stop unauthor-

ized hacks. As a result, the Party organized the once informal recre-

ational groups into more formal, controllable organizations.

A fi rst step in this direction took place in 2003 in the Guangshou

Military Region, where part of China’s IT economy is clustered.

People’s Liberation Army offi cers conducted a survey to identify

“those with advanced degrees, who studied overseas, conducted

major scientifi c research, [and] those considered computer network

experts.” Unpaid, volunteer (as much as that means in such an envi-

ronment) units were organized around these individuals, who then

operated out of computer labs and commercial fi rms rather than

military bases. This gave the militia the combination of “politically

reliability,” educated staff, modern commercial infrastructure, and

advanced software design capabilities. It’s now estimated that these

units have well over 200,000 members.

Mobilizing the skills and scale of civilian hackers while main-

taining greater government control may be how patriotic hacking

evolves globally in the future. This alignment, however, also makes

it harder for many states to use patriotic hackers, because they for-

feit plausible deniability. As we’ll see, striking the right balance

often comes down to more than how the groups are organized; the

ways they operate are also important.

Focus: What Was Stuxnet?

Ralph Langner is a jovial fellow with a quick wit, whose sense of

whimsy is perhaps best illustrated by the fact that he wears cowboy

boots. Wearing cowboy boots shouldn’t be all that notable, until one

realizes that Ralph is not from Texas, but Germany, and is not a cow-

boy, but a computer specialist. Langner is also incredibly inquisitive.

oxfordhb-9780199918096.indd 114oxfordhb-9780199918096.indd 114 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 115

It was this combination that led him to play a role in the discovery

of one of the most notable weapons in history; and not just cyber

history, but history overall.

Since 1988, Ralph and his team of security experts had been

advising on the safety of large-scale installations. Their special focus

was industrial control systems, the computer systems like SCADA

(short for “supervisory control and data acquisition”) that monitor

and run industrial processes. SCADA is used in everything from the

management and operation of power plants to the manufacture of

candy wrappers.

In 2010, like many other industrial control experts, Ralph grew

concerned about a cyber “worm” of unknown origin that was spread-

ing across the world and embedding itself in these control systems.

Thousands of computers in places like India and the United States

had been infected. But the bulk of the infections (roughly 60  per-

cent) were in Iran. This led many experts to infer that either Iran had

particularly poor cyber defenses for its SCADA-related programs,

which made it more vulnerable, or a virus had initially targeted

some site in Iran and, as one report put it, “subsequently failed in

its primary purpose and run amok, spreading uncontrollably to

unintended targets all over the world, and thus demonstrating how

indiscriminate and destructive cyber weapons were likely to be.”

Both turned out to be far from the case. Curious, Ralph began

to dissect the code of “Stuxnet,” as it became known. The more he

and his team explored it, the more interested they became. It was

a wonderfully complex piece of malware like none the world had

ever seen. It had at least four new “zero days” (previously unknown

vulnerabilities), utilized digital signatures with the private keys of

two certifi cates stolen from separate well-known companies, and

worked on all Windows operating systems down to the decade-old

Windows 95 edition. The number of new zero days particularly

stood out. Hackers prize zero days and don’t like to reveal them

when they don’t have to. To use four at once was unprecedented and

almost illogical given that one new open door is enough. It was a

pretty good sign that Stuxnet’s makers had enormous resources and

wanted to be absolutely certain they would penetrate their target.

Stuxnet also slipped by the Windows’ defenses using the equiva-

lent of a stolen passport. To gain access to the “kernel,” or oper-

ating system’s control system, Stuxnet had to install a component

oxfordhb-9780199918096.indd 115oxfordhb-9780199918096.indd 115 21-10-2013 22:38:1621-10-2013 22:38:16

116 CYBERSECURITY AND CYBERWAR

that could talk to the kernel. The authors chose a “device driver,”

a common tool that allows hardware devices to interact with the

operating system. Windows uses a scheme of digital signatures to

allow trusted hardware manufacturers to write device drivers that

are trusted by the operating system. Unsigned drivers raise an alert

for the user, while signed drivers do not. The drivers in Stuxnet were

signed by two real companies in Taiwan, indicating that the authors

had access to the secret signing keys—most likely stolen. Again, this

is a rare style of attack: stolen signing keys are incredibly powerful,

would have been well protected, and would be very valuable in any

illicit market.

The malware’s DNA revealed something even more interest-

ing:  Rather than being truly infectious, Stuxnet was hunting for

something in particular. As Langner delved deeper, he discovered

that Stuxnet was not going after computers or even Windows soft-

ware in general, but a specifi c type of program used in Siemens’s

WinCC/PCS 7 SCADA control software. Indeed, if this software

wasn’t present, the worm had built-in controls to become inert. In

addition, rather than trying to spread as widely as possible, as was

the goal with past worms, Stuxnet only allowed each infected com-

puter to spread the worm to no more than three others. It even came

with a fi nal safeguard; a self-destruct mechanism caused it to erase

itself in 2012. Ralph realized that whoever made Stuxnet not only

had a specifi c target in mind, but didn’t want the code lingering in

the wild forever. This was a very different worm, indeed.

But what was the target? This was the true mystery. Here

Langner’s background in working with industrial fi rms proved par-

ticularly useful. He fi gured out that Stuxnet was only going after a

specifi c industrial controller, manufactured by Siemens, confi gured

to run a series of nuclear centrifuges—but not just any old nuclear

centrifuges you might have lying around the house, only a “cascade”

of centrifuges of a certain size and number (984) linked together.

Not so coincidentally, this was the exact setup at the Natanz nuclear

facility, a suspected site in Iran’s illicit nuclear weapons program.

Things got especially tricky once Stuxnet found its way into this

target (it was later revealed that the delivery mechanism was infi l-

tration through Iranian nuclear scientists’ own laptops and memory

sticks). Langner discovered that the cyberattack didn’t shut down

the centrifuges in any obvious manner. Instead, it ran a series of

oxfordhb-9780199918096.indd 116oxfordhb-9780199918096.indd 116 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 117

subroutines. One, known as a “man in the middle,” caused tiny

adjustments in pressure inside the centrifuges. Another manipu-

lated the speed of the centrifuges’ spinning rotors, causing them to

alternately slow down and then speed back up, throwing the rotors

out of whack and ruining their work. On top of this, every so often

the malware would push the centrifuge speeds past the designed

maximum. So the centrifuges weren’t just failing to produce refi ned

uranium fuel, they were frequently breaking down and grinding to

a halt from the damaging vibrations that the various random surges

caused. At other times, the machines were literally spinning out of

control and exploding.

The effect, Langner wrote, was “as good as using explosives”

against the facility. In fact, it was better. The victim had “no clue

of being under a cyber attack.” For over a year, Stuxnet had been

inside Iranian networks, but the nuclear scientists initially thought

their facility was just suffering from a series of random breakdowns.

The scientists just kept replacing the broken centrifuges with new

ones, which would then get infected and break again. Soon, though,

they wondered whether they were being sold faulty parts or were

suffering from some kind of hardware sabotage. But the machines

checked out perfectly every time, except for the fact that nothing

was working the way it should.

This was perhaps the most insidious part of Stuxnet:  it was an

integrity attack par excellence. Stuxnet didn’t just corrupt the pro-

cess, it hid its effects from the operators and exploited their trust

that the computer systems would accurately and honestly describe

what was taking place. Iranian engineers didn’t even suspect a

cyberattack; their systems were air-gapped from the Web, and up

to this point worms and viruses had always had an obvious effect

on the computer, not the hardware. Eventually, the Iranian scien-

tists suffered low morale, under the impression that they couldn’t

do anything right; seventy years earlier a bunch of Americans had

built an atomic bomb using slide rulers, and they couldn’t even get

their modern-day centrifuges to work. Overall, Langner likened the

Stuxnet effect to the cyber version of “Chinese water torture.”

When Ralph Langer revealed his fi ndings on his blog, the

little-known German researcher quickly became an international

celebrity. First, he had exposed a top-secret campaign of sabotage

(later leaked to have been a collaborative effort between US and

oxfordhb-9780199918096.indd 117oxfordhb-9780199918096.indd 117 21-10-2013 22:38:1621-10-2013 22:38:16

118 CYBERSECURITY AND CYBERWAR

Israeli intelligence agencies, known as “Olympic Games”), and

second, it was a fi nd of global importance. A new kind of weapon

long speculated about but never seen, a specially designed cyber

weapon, had fi nally been used.

What Is the Hidden Lesson of Stuxnet? The Ethics of Cyberweapons

“The musket of cyberwarfare. What will be its rifl e? Its AK-47? Its

atomic bomb?”

Judith Donath of Harvard University described Stuxnet as a dem-

onstration of a new kind of weapon that could only get better. But

others worried that these better weapons would promote a new

kind of escalation and global risk. “Stuxnet was the absolute game

changer,” wrote cyber thinker Mikko Hypponen. “We are entering

an arms race where countries start stocking weapons, only it isn’t

planes and nuclear reactors they’re stocking, but it’s cyberweap-

ons.” And still others worry that not enough people took notice of

this “opening shot in a war we will all lose,” says Leslie Harris of the

Center for Democracy and Technology.

Stuxnet was all of these things, perhaps, but it was also notable

for another reason. This nasty little worm was a superb illustration

of how ethics can be applied to cyberwar.

There is the notion that all is fair in love and war, but the real-

ity is that there are actually a series of strict guidelines that are

supposed to shape behavior in war—what seventeenth-century

legal thinker Hugo Grotius called jus in bello (“Laws in War”). The two biggest laws are proportionality and discrimination. The

law of proportionality states that the suffering and devastation

that you cause, especially collateral damage to unintended tar-

gets, can’t outweigh whatever harm prompted the conflict. If the

other side stole your cow, you can’t justifiably nuke their city. The

law of discrimination maintains that the sides must distinguish

legitimate targets from those that shouldn’t be targeted (be they

civilians or wounded) and do their utmost only to cause harm to

the intended, legitimate targets.

Stuxnet stood out as a new kind of weapon in that it was designed

to cause physical damage via cyber means. Its makers wanted it to

break things in the real world, but through action only on digital

oxfordhb-9780199918096.indd 118oxfordhb-9780199918096.indd 118 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 119

networks. But what really stands out compared to traditional weap-

ons is how small its physical impact was, especially compared to the

intense stakes. The target was a nuclear bomb-making program, one

that had already been targeted by diplomatic efforts and economic

sanctions. While it’s certainly arguable whether preemptive action

against the Iranian program is justifi able, this is when the question

of proportionality becomes relevant. Stuxnet broke nothing other

than the nuclear centrifuges that had been illegally obtained by Iran

to conduct illicit research. Moreover, it neither hurt nor killed any-

one. By comparison, when Israel attempted to obstruct Iraqi nuclear

research in 1981, its forces dropped sixteen 2,000-pound bombs on

a research site during “Operation Opera,” leveling it and killing

eleven soldiers and civilians.

But discrimination also matters when judging the ethics of these

attacks. At face value, Stuxnet would seem to have been incredibly

indiscriminant. While limited in its promiscuity compared to prior

malware, this was a worm that still got around. It infected not just

targets in Iran but thousands of computers across the world that had

nothing to do with Iran or nuclear research. Many lawyers see this

facet of cyber weapons as proof of their inherent violation of “pre-

vailing codes of international laws of confl ict, as they go beyond

just the original target and deliberately target civilian personnel and

infrastructure.”

While Stuxnet lacked discretion under the old way of thinking,

its very design prevented harm to anyone and anything beyond the

intended target. This kind of discrimination was something never

previously possible in a weapon. As George Lucas, a philosopher at

the US Naval Academy, wrote in an assessment of Stuxnet’s ethics,

“Unless you happen to be running a large array of exactly 984 Siemens

centrifuges simultaneously, you have nothing to fear from this worm.”

In effect, judging the ethics of Stuxnet and cyber weapons more

generally turns on which part of the story you care about most. Do

you focus on the fact that this new kind of weapon permitted a pre-

emptive attack and in so doing touched thousands of people and

computers who had nothing to do with Iran or nuclear research? Or

do you focus on the fact that the cyber strike caused far less damage

than any previous comparable attack and that the weapon was so

discriminating it essentially gave new meaning to the term? Are you

a cyber weapon half full or half empty kind of guy?

oxfordhb-9780199918096.indd 119oxfordhb-9780199918096.indd 119 21-10-2013 22:38:1621-10-2013 22:38:16

120 CYBERSECURITY AND CYBERWAR

History may render the ultimate judgment of Stuxnet, how-

ever. As Ralph Langner put it, the fascinating new weapon he

discovered “could be considered a textbook example of a ‘just

war ’ approach. It didn’t kill anyone. That’s a good thing. But I am

afraid this is only a short-term view. In the long run it has opened

Pandora’s box.”

“Cyberwar, Ugh, What Are Zeros and Ones

Good For?”: Defi ning Cyberwar

“Be it resolved by the Senate and House of Representatives of the

United States of America in Congress assembled, that the state of

war between the United States and the Government of Bulgaria,

which has thus been thrust upon the United States, is hereby for-

mally declared.”

This June 5, 1942, text describes the last time the United

States actually declared war. The declaration covered the minor

Axis powers, who were feeling left out after the first post–Pearl

Harbor vote to go to war against Nazi Germany, Japan, and Italy.

In the years since, America has sent troops to Korea and Iraq

and launched airstrikes into places like Yugoslavia, Cambodia,

and Pakistan, but the United States has not formally declared

war on another state. Wars have been declared on various other

things, however:  President Johnson’s 1964  “Nationwide War on

the Sources of Poverty”; Nixon’s 1969 “War on Drugs”; and what

some conservative leaders more recently claim is a secret “War

on Christmas.”

The disconnect between an actual state of war and the far more

frequent uses and misuses of the concept of “war” is important to

keep in mind when discussing a term like “cyberwar.” War is used

to describe an enormously diverse set of conditions and behaviors,

from a state of armed confl ict between nations (World War II) to

symbolic contestations (New  York City’s “war on sugar”). As for

“cyberwar,” the term has been used to describe everything from a

campaign of cyber vandalism and disruption (the “Russian Estonian

cyberwar,” as it is too often called) to an actual state of warfare uti-

lizing cyber means. Indeed, in 2010 The Economist ran a cover story on cyberwar that portrayed it as everything from military confl ict to

credit card fraud.

oxfordhb-9780199918096.indd 120oxfordhb-9780199918096.indd 120 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 121

Defi ning cyberwar need not be so complicated. The key ele-

ments of war in cyberspace all have their parallels and connections

to warfare in other domains (the real kind, not the symbolic “war

between the sexes” kind). Whether it be war on land, at sea, or in

the air, or now in cyberspace, war always has a political goal and

mode (which distinguishes it from crime) and always has an ele-

ment of violence. Currently, the US government’s position is that

to meet this defi nition of the use of force, a cyberattack would have

to “proximately result in death, injury or signifi cant destruction.”

That is, even if conducted through cyber means, the effect must

be physical damage or destruction. To provide a parallel, a plane

dropping bombs is engaged in air warfare; a plane dropping leaf-

lets, not so much.

Knowing when cyberwar begins or ends, however, might be

more challenging than defi ning it. Most wars don’t actually have

the clear start and negotiated ends that World War II had. Instead,

their starts and ends blur. For instance, the United States may not

have formally declared war on North Korea in 1950, but it’s hard to

argue that a confl ict in which 5.3 million perished was just a “police

action,” as President Truman called it at the time. In turn, while the

Korean War, as the history books record it, has never formally ended

with a peace treaty, the actual fi ghting ceased in 1953.

Cyberwar ’s lines can be just as fuzzy. “We in the US tend

to think of war and peace as an on-off toggle switch—either

at full-scale war or enjoying peace,” says Joel Brenner, former

head of counterintelligence under the US Director of National

Intelligence. “The reality is different. We are now in a constant

state of conflict among nations that rarely gets to open war-

fare. . . . What we have to get used to is that even countries like

China, with which we are certainly not at war, are in intensive

cyberconflict with us.”

This may be where cyberwar has more in common with more

informal concepts of confl ict like the Cold War, during which con-

stant confl ict didn’t actually result in direct, open violence. Indeed,

the editor of Foreign Policy magazine, David Rothkopf, has argued we may be entering the era of the “cool war,” not only because of the

remote nature of the attacks but because “it can be conducted indefi -

nitely—permanently, even—without triggering a shooting war. At

least, that is the theory.”

oxfordhb-9780199918096.indd 121oxfordhb-9780199918096.indd 121 21-10-2013 22:38:1621-10-2013 22:38:16

122 CYBERSECURITY AND CYBERWAR

A War by Any Other Name? The Legal Side of Cyber Confl ict

“The Parties agree that an armed attack against one or more of them

in Europe or North America shall be considered an attack against

them all.”

This sentence opens Article 5 of the Washington Treaty, which in

1949 established the North Atlantic Treaty Organization, or NATO.

It is one of the most important passages ever written in interna-

tional politics. These simple words outlined the concept of “collec-

tive defense,” which created the most successful alliance in history.

This “All for one, one for all” approach to sharing risk and response

allowed the United States and its allies to stand together, taking

them from the start of the Cold War to the fall of the Berlin Wall and

beyond, including their collective response to the 9/11 attacks on

the United States and subsequent deployment half a world away to

Afghanistan.

But in April 2007, NATO and its collective defense ideals faced

a twenty-fi rst-century test. A  new alliance member, Estonia, was

one of Europe’s most wired states. The majority of its citizens

conducted everything from their banking to their voting online.

Suddenly, Estonian banks, media web pages, and government web-

sites were hit with a large-scale denial of service attack. While the

attack resulted from a series of botnets that had captured over a

million computers in seventy-fi ve countries, as we read about ear-

lier, Estonia quickly pointed the fi nger at its neighbor Russia, with

whom it was embroiled in a political dispute over the move of a

statue honoring Russian soldiers from World War II. Estonia’s for-

eign minister called for help, believing that the massive cyberattack

threatened its security and hence the alliance’s as a whole. It argued

that under the Washington Treaty NATO was obliged to defend

against this start of a new “cyberwar.”

While they were concerned about the attacks, however, the other

members of NATO didn’t think Article 5 applied. Estonia was being

bullied in cyberspace, but no one was dead or hurt and no property

was actually destroyed or damaged. It didn’t look like the start of

a war, at least as NATO understood it, and certainly wasn’t worth

the alliance risking an actual war with Russia. Instead, the defense

ministers of NATO waited a few weeks to issue a joint statement

deploring the cyberattacks and sent technical experts to aid Estonia

in unblocking its networks. Amusingly, while NATO’s political

oxfordhb-9780199918096.indd 122oxfordhb-9780199918096.indd 122 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 123

leaders judged that the cyberattacks were not an act of war, NATO’s

Department of Public Diplomacy later created a short fi lm about the

episode entitled War in Cyberspace . The Estonia case is instructive because it shows the back and forth

that takes place between old laws and new technologies, especially

when it comes to the question of what constitutes an act of war in

the cyber realm. Much of today’s thinking on the laws and state-

craft of war dates to the post–World War II 1945 UN Charter and

1949 Geneva Conventions. The challenge is that concepts developed

back when computers used punch cards don’t necessarily apply as

clearly to the cyber realm.

In international law, for instance, an “aggression” that would jus-

tify going to war is described by the UN Charter as a “use of force

against the territorial integrity . . . of a state.” The problem is that this

assumes only a physical world of clearly demarcated borders. This

was perfectly acceptable back in 1945 but not in the contemporary

world; cyberattacks don’t use physical force, take place in a geo-

graphic realm, nor necessarily involve only states.

That old laws are growing more challenging to apply doesn’t

mean, however, that the cyber world is the Wild West. There are

nascent efforts to either update the old codes or create new ones.

For example, after the confusion over the Estonia incident, the

NATO Cooperative Cyber Defence Centre of Excellence commis-

sioned twenty law professors to formally examine how the known

laws of war apply to cyberspace, in a document entitled the “Tallinn

Manual on the International Law Applicable to Cyber Warfare.” The

manual laid out their ideas on everything from what self-defense

might mean in the cyber world to a controversial (but logical) argu-

ment that any civilian fi ghting in a cyberwar loses legal protections

as a civilian. While an important effort, it has no legal standing, and

obviously a number of nations outside of NATO, such as Russia,

were less than enthusiastic about the manual’s fi ndings. Even more,

certain NATO members like the United States were not quick to

embrace the manual they had sponsored.

The reality is that the “process of formalizing rules for cyber-

space will likely take decades given the differing priorities among

various governments,” reports Foreign Policy magazine. This seems to leave a massive vacuum in the interim. So until the old treaties

are updated or new ones are accepted for the cyber world, there is

oxfordhb-9780199918096.indd 123oxfordhb-9780199918096.indd 123 21-10-2013 22:38:1621-10-2013 22:38:16

124 CYBERSECURITY AND CYBERWAR

a third option:  apply existing laws’ basic principles and values to

cyberspace. Charles Dunlap, a military lawyer who retired as a US

Air Force major general and now teaches at Duke University Law

School, notes, “A cyber attack is governed by basically the same

rules as any other kind of attack.”

The primary way to determine when a cyberattack constitutes the

kind of “use of force” that legally justifi es war is to weigh its effects.

What did the act do to the real world, regardless of the fact that it

happened via cyber means? Look to the amount of damage, caused

or intended, and establish parallels.

Focusing on impact is important because it recognizes that not all

attacks have to involve traditional armed violence. Indeed, in inter-

national law an enemy that uses unarmed means to intentionally

divert a river to fl ood a neighboring state or set fi res to burn wildly

across the border would still be committing an armed act of aggres-

sion equivalent to the use of guns for the same effect.

The same logic applies in reverse. You wouldn’t go to war if

someone defaced your posters in the street, so neither should a gov-

ernment if an enemy defaces its websites. By comparison, when the

action causes death and destruction, the discussion moves into the

realm of war. If your power plant explodes in a fi ery blast that kills

thousands, whether the cause was an actual bomb or logic bomb is

not a major distinguishing factor.

The real challenge is the gray area in the middle, incidents

between destruction and disruption, such as a denial-of-service

attack. When it was under attack, Estonia wanted NATO to declare

that its sovereignty had been violated, which would have triggered

the collective self-defense article of the NATO treaty. In the virtual

world perhaps it had been, but not in the physical world. Here again,

even these seemingly new forms of attack have parallels to guide

us. While they may not have imagined cyberspace, the 1940s-era

statesmen who wrote the UN Charter did imagine things like the

interruption of “postal, telegraphic, radio, and other means of com-

munications.” Such interruptions were certainly frowned upon, but

they did not constitute war. Professor James Hendler, former chief

scientist at the Pentagon’s Defense Advanced Research Projects

Agency (DARPA), says that in the case of Estonia, the attacks were

“more like a cyber riot than a military attack.” It was disruptive, but

it wasn’t war.

oxfordhb-9780199918096.indd 124oxfordhb-9780199918096.indd 124 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 125

Another example in Estonia’s neighborhood serves as illustra-

tion. In 2008, the nation of Georgia also got in a dispute with its

larger neighbor. Just as in Estonia, Georgian websites suffered

denial-of-service attacks, as we saw earlier, thought to have been

coordinated by Russian sources. The attacks crippled the websites’

operations for several days and limited the Georgian government’s

ability to communicate with its people and the outside world. At the

same time, several brigades of Russian tanks crossed into Georgia,

and Russian bombers and missiles pummeled the country, causing

over 1,300 casualties. The difference in impact was stark. The cyber-

attacks alone were not war, but a war was clearly taking place.

The severity of the attack is not the only thing to keep in mind.

There are all sorts of actions that could ultimately spark a chain

of events that cause the same death and destruction as real war.

A young boy drops a banana, upon which a diplomat slips. The dip-

lomat goes to the hospital instead of peace talks. The peace talks

consequently fail and war breaks out. We can conceptualize how the

boy’s action helped lead to war, but was his dropping the banana an

act of war? Of course not; the invasion was the action that mattered

when looking to judge how the war actually started. Cause is not the

same as effect.

This points to the second key determinant of when a cyberattack

becomes an act of war: directness and measurability. There must be

some fairly direct and intended link between cause and effect. This

factor is often applied to distinguish acts of espionage from acts of

war. The theft of government secrets could certainly lead to soldiers

losing their lives one day by revealing to the enemy, for instance,

how a plane operates or the location of a secret base. But it is only if

and when the war starts that this theft could ever have that impact.

This indirectness is why nations have traditionally not gone to war

over acts of espionage, be they physical or increasingly now virtual.

No one likes to be the victim of espionage, to be sure. But spying is

cast more as part of the rough game of statecraft that nations play

rather than the all-out breaking of international rules that starts

real wars.

An important part of these discussions, however, is often forgot-

ten. While we’d like to think that law is the guide to our behav-

ior, clearly delineating when a cyberattack escalates into war is not

just an issue of law or just for the lawyers to decide. As the great

oxfordhb-9780199918096.indd 125oxfordhb-9780199918096.indd 125 21-10-2013 22:38:1621-10-2013 22:38:16

126 CYBERSECURITY AND CYBERWAR

philosopher of war Carl von Clausewitz wrote, “War is not an inde-

pendent phenomenon, but the continuation of politics by different

means.” War is political. And by being political, it is also always

interactive. That is, there are sides to the war, each with their own

goals, actions, and responses, each trying to bend the other to its will.

This fundamentally political nature of war means that all of

these questions on when a cyberattack reaches the realm of war will

come down to making tough political decisions, in what Clausewitz

would see as a digital version of his famous “fog of war,” the messy,

fast-moving, unclear circumstances that always accompany war.

Ultimately, cyberwar is what we in the real world believe it to be.

“At the end of the day, it’s the President who gets to decide if this

is war or something else,” explains Jim Lewis, a senior fellow at

the Center for Strategic and International Studies. “The standard is

ambiguous. Deciding when something is an act of war is not auto-

matic. It’s always a judgment.”

What Might a “Cyberwar” Actually Look Like?

Computer Network Operations

Like so many stories in the world of cybersecurity, Operation Orchard

began with simple human carelessness. In 2006, a senior offi cial in

the Syrian government left his laptop computer in his hotel room

while visiting London. When he went out, agents from Mossad, the

Israeli intelligence agency, snuck into his room and installed a Trojan

horse onto the laptop to allow them to monitor his communications.

That was bad enough for the Syrians.

But one man’s poor computer security turned out to have more

signifi cant consequences when the Israelis began to examine the

fi les that the offi cial had stored on the laptop’s hard drive, includ-

ing pictures. One photo in particular caught the Israelis’ attention.

It showed an Asian man in a blue tracksuit standing next to an Arab

man in the middle of the Syrian desert. It could have been innoc-

uous, but then Mossad identifi ed the two men as Chon Chibu, a

leader of the North Korean nuclear program, and Ibrahim Othman,

director of the Syrian Atomic Energy Commission. Combined with

other documents lifted from the hard drive, such as construction

plans and photos of a type of pipe used for work on fi ssile materiel,

the Israelis realized the laptop was an atomic alarm bell. The Syrians

oxfordhb-9780199918096.indd 126oxfordhb-9780199918096.indd 126 21-10-2013 22:38:1621-10-2013 22:38:16

Why It Matters 127

were secretly constructing a facility at al Kibar to process plutonium,

a key step in the assembly of a nuclear bomb, with aid from North

Korea (an International Atomic Energy Agency investigation would

later confi rm the Israeli suspicions).

This news led to Operation Orchard, the next key part of the

cyber story. Just after midnight on September 6, 2007, seven Israeli

F-15I fi ghter jets crossed into Syrian airspace. They fl ew deep into

the Syrian interior and dropped several bombs, leveling the Kibar

complex depicted in the photos. The whole time the planes were in

Syrian airspace, the air defense network never fi red a shot.

Reportedly, the Syrian defense didn’t even detect the jets, mean-

ing they didn’t even know they were under attack until the bombs

started to go off. Yet Syrian radar offi cers hadn’t all turned trai-

tor that night. Rather, their technology had. If initially planting

the Trojan horse into the Syrian offi cials laptop had been about

fi nding secret information via cyber means, this was its cousin, a

cyber operation with a military outcome. The Israelis had success-

fully penetrated the Syrian military’s computer networks, allowing

them to see what the Syrians were doing as well as direct their own

data streams into the air defense network. This caused the Syrian

radar operators to see a false image of what was really happening

as the Israeli jets fl ew across the border. By effectively turning off

the Syrian air defenses for the night, the Israelis not only got to

their target without any losses, but they also did so with a much

smaller force.

Orchard is a great illustration of the concepts behind “computer

network operations,” as such military cyberattack operations are

dubbed. While much is shrouded in secrecy about the rise of such

operations, one of the fi rst known US military exercises in this space

was “Eligible Receiver,” a test of computer network operations in

1997. In many ways it was akin to the Fleet Problems of the 1920s,

when the US Navy fi rst experimented with aircraft carriers, or the

Louisiana Maneuvers of 1940, when the US Army evaluated mech-

anized tank forces. After a small “red team” of computer experts

gained access to the computers at the US Pacifi c Command’s head-

quarters as well as the 911 emergency phone systems in nine US cit-

ies, the Pentagon decided that, just as with the airplane or the tank,

the time had arrived for computers to play a part in military opera-

tions. Indeed, the naysayers were hushed the very next year when

oxfordhb-9780199918096.indd 127oxfordhb-9780199918096.indd 127 21-10-2013 22:38:1621-10-2013 22:38:16

128 CYBERSECURITY AND CYBERWAR

hackers compromised over fi ve hundred Pentagon computers in an

incident that became known as “Solar Sunrise.”

Today, the vast majority of the world’s militaries have some sort

of planning or organization in place for cyber warfare. These plans

can be thought of as the “Five D’s plus One.” The US Air Force

describes cyberwar as the ability “to destroy, deny, degrade, dis-

rupt, [and] deceive,” while at the same time “defending” against the

enemy’s use of cyberspace for the very same purpose.

Such military programs range from focused infi ltrations and

raids like Israel’s Operation Orchard to broader efforts like the US

military’s “Plan X,” a $110 million program designed to “help war-

planners assemble and launch online strikes in a hurry and make

cyber attacks a more routine part of U.S.  military operations.” But

across the world, what the New  York Times called “a new type of warfare” actually has much in common with war as it has always

been conducted. The computer used as a military weapon is just a

tool. Just as with the spear, the airplane, or the tank, it simply aids in

achieving the goals that are part of any military operation.

Before battle begins, a smart commander engages in what is

known as “intelligence preparation of the battlefi eld.” Much as

Allied efforts to crack Axis radio codes proved crucial to victory

in World War II, intercepted digital communications can be just as

critical today. As the Israelis did in Orchard, this part of cyber war-

fare is about deploying one’s digital weapons even before the battle

has begun, infi ltrating networks, gathering information, and poten-

tially even laying the groundwork for more aggressive action. For

example, some of the information inside US military computers sus-

pected to have been targeted by Chinese military hackers includes

unit deployment schedules, resupply rates, materiel movement

schedules, readiness assessments, maritime prepositioning plans,

air tasking for aerial refueling, and “the logistics status of American

bases in Western Pacifi c theater.” This kind of data might prove use-

ful if war ever broke out. And, as the 2013 Snowden leaks showed,

US cyber warriors are gathering the same information about their

potential adversaries in China and elsewhere.

But the difference between current cyber efforts and past intel-

ligence collection programs is how computer network operations

also allow aggressive actions inside the enemy’s communications

once the shooting has begun. It’s the difference between reading the

oxfordhb-9780199918096.indd 128oxfordhb-9780199918096.indd 128 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 129

enemy’s radio signals and being able to seize control of the radio

itself.

The modern military is what some folks call “network-centric,”

utilizing computers bound together in a “system of systems” to coor-

dinate across great distances with digital speed. But these advan-

tages can create vulnerabilities. If you can compromise an enemy’s

networked communications, you move from knowing what they’re

doing, which is advantage enough, to potentially changing what

they’re doing.

Inside a foe’s communications networks, one can disrupt or even

disable command and control, keeping commanders from send-

ing out orders, units from talking to each other, or even individual

weapons systems from sharing needed information. In one example,

over one hundred American defense systems, from aircraft carriers

to individual missiles, rely on the Global Positioning System (GPS) to

locate themselves during operations. In 2010, an accidental software

glitch knocked 10,000 of the military’s GPS receivers offl ine for over

two weeks, including the US Navy’s X-47 prototype robotic fi ghter jet.

Cyber warfare would, in effect, make such software glitches deliberate.

Alternatively, the attack might not try to disable or jam these

communications but instead attack the information within them,

feeding the enemy false reports via its own devices. “Information

warfare” is how the military has traditionally described operations

that try get inside the enemy’s mind and infl uence decision-making.

Now the idea is to use modern information technologies to the same

ends. The objectives might be highly strategic, such as false com-

mands from top leaders, to more tactical insertions along the lines of

what the Israelis did in Orchard, compromising individual weapons

systems and their sensors.

One of the more interesting potential effects of such attacks is

how success might be multiplied by the impact on the minds of

the users of the networks under attack. Only a relatively small per-

centage of attacks would have to be successful in order to plant

seeds of doubt in any information coming from a computer. Users’

doubt would lead them to question and double-check everything

from their orders to directions. This illustrates again the notion of

trust, which was so important in Part I.  The impact could even go

beyond the initial disruption. It could erode the trust in the very net-

works needed by modern military units to work together effectively;

oxfordhb-9780199918096.indd 129oxfordhb-9780199918096.indd 129 21-10-2013 22:38:1721-10-2013 22:38:17

130 CYBERSECURITY AND CYBERWAR

it could even lead some militaries to abandon networked computers

for anything important and set their capacity back decades.

Such technological abstinence sounds extreme, especially when

computers have proven so useful in modern war. But imagine if you

had a memo that you needed to get to your boss with absolutely

no mistakes, at the risk of losing your job. Would you e-mail it if

there were a 50  percent risk of it somehow being lost or changed

en route? Or would you just hand-deliver it? What about if the risk

were 10 percent? How about just 1 percent, but still at the risk of los-

ing your job? Then apply the same risk tolerances when it’s your life

in battle rather than your job. How do your risk numbers change?

Computer network operations, though, won’t just be limited to

targeting command and control with indirect effects. As more and

more unmanned systems are introduced into warfare (the US mili-

tary has over 8,000 “drones” like the famous Predator and Reaper,

while over eighty countries now have military robotics programs),

targeting command-and-control networks opens up even more

direct avenues of attack. These robotic weapons systems all link

into computer networks, providing everything from GPS location to

remotely controlled operations. Here again, the very same network-

ing that allows drones to strike targets with precision thousands of

miles away also opens up new possibilities of disruption and even

co-option. What we enter is an era of “battles of persuasion.”

One could never co-opt the fl ight of a bullet, steering it away from

where the gunner shot it. Nor has anyone proven able to brainwash

a bomber pilot in midair and shift his allegiance. But if the com-

puters on robotic weapons systems are compromised, they could

be “persuaded” to do the opposite of what their owners intended.

This creates a whole new type of combat, where the goal may not be

merely to destroy the enemy’s tanks but to hack into his computer

networks and make his tanks drive around in circles or even attack

each other.

And, of course, cyberwar might see computers used in the same

way that other weapons have been used to cause destruction and

loss of life among enemy forces. As opposed to traditional kinetic

attacks (a blade, a bullet, an explosion), these would involve more

destruction through indirect means. Many military systems like ship

engines operate under SCADA programs, meaning that they can be

targeted in much the same way that the Stuxnet virus caused Iranian

oxfordhb-9780199918096.indd 130oxfordhb-9780199918096.indd 130 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 131

centrifuges to spin out of control. In 2009, for instance, an employee

at the Shushenskaya dam in Siberia accidentally turned on an unused

turbine with a few mistaken keystrokes, leading to the release of a

massive “water hammer” that destroyed the plant and killed seventy-

fi ve people. This is the computer software version of how allied

planes in World War II and Korea dropped bombs on dams, using the

ensuing wave to destroy enemy targets in the fl ood’s path.

As in traditional war, though, what sounds easy in description

can prove hard in execution. This is not just due to the complexity

of target systems and the operations needed to exploit them, but

because every war, even in cyberspace, has at least two sides. Every

potential operation meant to attack and defeat a foe would be met by

the opponent’s efforts to keep the enemy out or threats of an equiva-

lent attack to make the aggressor think twice about conducting it.

These diffi culties drive adversaries to instead go after “soft tar-

gets,” as has long been the case in traditional modes of war. In

theory, war is only a contest among warriors. In reality, well over

90 percent of the casualties in the last decades of war have been civil-

ians. Unfortunately, one can expect the same dynamic in cyberwar.

The more conventional type of civilian targeting in computer

network operations would attack civilian networks and operators

viewed as directly or indirectly supporting the military enterprise.

These range from civilian contractors, who provide much of the

supply and logistics support to modern militaries (about half of the

American force in places like Afghanistan and Iraq were actually

private contractors), to the infrastructure that the military relies on

for its operation, such as ports and railroads. Of note, the computer

networks that these civilian forces rely upon often don’t have the

same levels of security as military networks because they lack simi-

lar resources, standards, and incentives. The result is they make par-

ticularly choice targets. In one 2012 Pentagon-sponsored war game

we participated in, a simulated enemy force hacked the contractor

company supplying the logistics of a US force, with the simple pur-

pose of transposing the barcodes on shipping containers. It seems

a minor change with little impact. But had it been a real attack, US

troops in the fi eld would have opened up a shipping pallet expect-

ing to fi nd ammunition and instead only found toilet paper.

The history of warfare shows that it’s not just those who directly

support the military who might cross the cyber fi ring line. When

oxfordhb-9780199918096.indd 131oxfordhb-9780199918096.indd 131 21-10-2013 22:38:1721-10-2013 22:38:17

132 CYBERSECURITY AND CYBERWAR

new technologies like the airplane expanded forces’ reach beyond

the front lines, militaries gradually expanded who they defi ned as

a legitimate target. First, it was only those working directly for the

military. Then it was those engaged in the war effort, such as work-

ers at a tank factory. Then it was the workers’ houses. And by the

end of World War II, all the sides had engaged in strategic bomb-

ing against the broader populace, arguing that the best way to end

the war was to drive home its costs to all civilians. Given civilians’

greater vulnerability to cyberattacks, we should expect nothing less

as part of any cyberwar. Thanks to the modern military’s depen-

dence on civilian networks, they might even make up a new center

of gravity to target.

As scary as this all sounds, it’s important to note two key differ-

ences between war in the cyber realm and other past modes of con-

fl ict. First, unlike previous transitions in warfare, cyber is unlikely

to immediately multiply the level of destructive power in ways that

previous technological innovations did. Because of its reliance on

indirect effects, cyber’s effects will have less long-term destructive

impact. That is, attacks that change GPS codes or shut down the

energy grid would be quite devastating. But they would be nowhere

near the destruction visited by explosive-fi lled bombs and incendi-

aries upon Dresden or the permanent irradiation of Hiroshima.

Second, the weapons and operations in cyberwar will be far less

predictable than traditional means, leading to greater suspicion of

them among military commanders. For instance, the blast radius of

a bomb can be projected to exacting standards; not so the radius

of most malware. Most cyberattacks rely on the second- and even

third-order effects that might result, and while these widen the

impact, they can also have unexpected outcomes. During the Iraq

war, for instance, US military offi cers were very excited by the

prospects of taking down an enemy computer network facilitating

suicide bombings. But the operation accidentally took down over

300 other servers in the wider Middle East, Europe, and the United

States, opening a whole new can of worms. Similarly, Stuxnet was

specifi cally tailored to target just a few Iranian centrifuges and yet

ended up spreading to well over 25,000 other computers around

the world.

In the end, we are still at the early stages of conceptualizing what

cyberwar will look like. Predicting the future of computer network

oxfordhb-9780199918096.indd 132oxfordhb-9780199918096.indd 132 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 133

operations now is akin to those who laid out their visions of air

war in the early days of “fl ying machines” at the turn of the last

century. Some of their predictions proved right, like the idea that

planes would bomb cities, while others proved woefully wrong, like

the prediction that airplanes would render all other forms of war

obsolete.

The same is likely to happen with cyberwar. It will prove to be

fantastically game-changing, introducing real-world capabilities

and operations that once seemed science fi ction. But even in a world

with digital weaponry, war will still be a chaotic domain. This means

that war, even cyber-style, will still remain a waste of resources and

efforts better spent elsewhere.

Focus: What Is the US Military Approach to Cyberwar?

Do you know what “9ec4c12949a4f31474f299058ce2b22a” means? If

so, the US military may have a job for you.

The answer is actually a wonderful summary of where the US

military stands in its approach to cybersecurity. This code appears

in the logo of the US military’s Cyber Command, a revolutionary

new military organization formed in 2010. In cryptography, a hash

is a one-way function that creates a unique “fi ngerprint” of a fi le.

The MD5 (Message-Digest algorithm 5)  hash was a widely used

way to add security by detecting tampering in fi les. The code above

is the MD5 hash of Cyber Command’s mission statement, which

reads: “USCYBERCOM plans, coordinates, integrates, synchronizes

and conducts activities to: direct the operations and defense of spec-

ifi ed Department of Defense information networks; and prepare to,

and when directed, conduct full spectrum military cyberspace oper-

ations in order to enable actions in all domains, ensure US/Allied

freedom of action in cyberspace and deny the same to our adversar-

ies.” There is an irony, however. The same year Cyber Command

put the code on its logo, the US Department of Homeland Security

announced that it was moving the US government away from the

MD5 hash for its computer systems. The once sophisticated code

was now too easy to break.

Cyber Command brings together all components of the US

military that work on cyber issues, from the Army’s Ninth Signal

Command to the Navy’s Tenth Fleet (the Fleet Cyber Command). All

oxfordhb-9780199918096.indd 133oxfordhb-9780199918096.indd 133 21-10-2013 22:38:1721-10-2013 22:38:17

134 CYBERSECURITY AND CYBERWAR

told, the organization boasts a cyber warrior force of just under 60,000

personnel, with headquarters located at Fort Meade, Maryland. Its

location was deliberate, placing CYBERCOM, as it is known, next

door to the National Security Agency, the spy agency that focuses on

signals and information intelligence and protection. This allows the

two agencies to share resources at the fi eld level, such as the hun-

dreds of PhDs in mathematics, computer science, engineering, and

other fi elds who work there, all the way up to the top. Currently, the

director of the NSA and the commander of CYBERCOM is the same

person. General Keith Alexander was named the head of both orga-

nizations simultaneously, or “double-hatted” in military parlance.

While some see this pairing as natural, given the two entities’

close responsibilities, many worry about blurring the lines between

a military command and a civilian spy agency. There is a question

as to which mentality will prevail: the spy’s inclination to watch and

learn or the warrior’s inclination to act? There is also a worry about

one person trying to take on too many different roles at once.

In contrast, others worry that CYBERCOM is not distinct enough,

not merely from the NSA but from the military services that source

it. Much as the Air Corps was once part of the Army before evolv-

ing into its own service (the Air Force) in 1947, some feel that Cyber

Command, too, needs to become its own military branch. Two US

Army offi cers have observed that the current military services are

“properly positioned to fi ght kinetic wars, and they value skills such

as marksmanship, physical strength, the ability to leap out of air-

planes and lead combat units under enemy fi re. Unfortunately, these

skills are irrelevant in cyber warfare. Technical expertise isn’t highly

valued in the three services. Just look at military uniforms: no deco-

rations or badges honoring technical expertise.”

Regardless, CYBERCOM is growing rapidly in both size and per-

ceived importance inside the US military. Indeed, the Pentagon’s

2013 budget plan mentioned “cyber” 53 times. Just a year later, the

2014 budget plan discussed “cyber” 147 times, with spending on

CYBERCOM’s headquarters alone set to effectively double (all the

more notable as the rest of the US military budget was being cut).

The strategy that guides CYBERCOM draws from the overall

idea that cyberspace is a new domain of both possibilities and risks,

and the US military had better do its utmost to protect its ability to

use this domain (its traditional “freedom of maneuver”) as well as

oxfordhb-9780199918096.indd 134oxfordhb-9780199918096.indd 134 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 135

preserve the initiative, and prevent others from using it to their full

potential (establishing “dominance”). As Lieutenant General Jon

Davis, the deputy commander of CYBERCOM, describes, the US

military is treating cyber issues with a whole new level of serious-

ness. “This is now commander’s business; this is no longer admin

tech business.”

The current plan runs over twelve pages in its unclassifi ed version

and thirty pages in the classifi ed form. In sum, CYBERCOM focuses

on fi ve objectives:  treat cyberspace as an “operational domain” as

the rest of the military does the ground, air, or sea; implement new

security concepts to succeed there; partner with other agencies and

private sector; build relationships with international partners; and

develop new talent to spur new innovation in how the military might

fi ght and win in this space. As part of this mission, CYBERCOM is to

create and lead three types of cyber forces: “cyber protection forces”

that will defend the military’s own computer networks, regionally

aligned “combat mission forces” that will support the mission of

troops in the fi eld, and “national mission forces” that will aid in the

protection of important infrastructure.

While turning these ideas into an actual working military doc-

trine, three key concerns have bedeviled CYBERCOM planners. The

fi rst is the long-standing question over mission areas and responsi-

bilities. The wider cybersecurity roles that CYBERCOM has taken

on have pushed it closer and closer to the civilian sphere, creating

a twofold problem. Not only is CYBERCOM continually operating

on civilian and government computer networks that it must now

seemingly defend, but these responsibilities are frequently compet-

ing with others who have a duty to monitor the same networks,

including the private sector and other government agencies like the

civilian Department of Homeland Security. To make a parallel to the

expanded role of “national mission forces,” when banks are mov-

ing physical money, it isn’t the Pentagon that defends the cash, but

rather a combination of hired security and the police. But when the

cash is virtualized, CYBERCOM has now joined into the discussion.

The second big concern is how far can and should the US military

go to maintain the freedom of maneuver it so desires in cyberspace.

When the command was fi rst formed, defense leaders like then

Deputy Secretary of Defense William Lynn publicly talked about

how CYBERCOM would simply busy itself with the “day-to-day

oxfordhb-9780199918096.indd 135oxfordhb-9780199918096.indd 135 21-10-2013 22:38:1721-10-2013 22:38:17

136 CYBERSECURITY AND CYBERWAR

defense and protection of all DOD networks.” Within four years,

the new roles and strategy pushed well beyond that. As one

CYBERCOM offi cial put it, “We need the capabilities to do things

offensively in cyber . . . everybody acknowledges that, but how we

specifi cally employ that in an operational context is classifi ed.” Or,

as a former National Security Agency watch offi cer put it, the goal is

to ensure that US capabilities remain more advanced than those of

potential adversaries. “Whatever the Chinese can do to us, we can

do better.”

Another strategic question is whether the United States can man-

age the way threats shift between the cyber domain and the real

world and still maintain deterrence in both. It sees the concept of

“equivalence” as key to addressing this question. As one report

described, “If a cyber attack produces the death, damage, destruc-

tion or high-level disruption that a traditional military attack would

cause, then it would be a candidate for a ‘use of force’ consideration,

which could merit retaliation.”

The idea is to send a message to adversaries that the US military

plans to fi ght and win in cyberspace, but it reserves the right to play

a different game if it doesn’t like the outcome. Or, as one US mili-

tary offi cial put it more bluntly, “If you shut down our power grid,

maybe we will put a missile down one of your smokestacks.”

The central problems this strategy faces are whether cyber-

space dominance is achievable and whether deterrence in cyber-

space is workable in execution. Such posture requires knowing

who your adversaries are, which is exceedingly difficult in

cyberspace. As a study on American cyberattack policy and eth-

ics concluded, “Absolute, unambiguous technical proof could be

lacking, which forces more reliance on non-technical info than

policy makers like.”

Additionally, deterrence is not as effective against nonstate

groups, which, of course, are major players in cyberspace. Not all

are rational actors, and even those that are rational weigh costs and

benefi ts very differently than governments with broad territories

and populaces to defend. Nonstate groups frequently don’t have

fi xed locales to target, and many of them would even welcome

counterattacks. A  response from the United States would provide

the recognition that so many nonstate groups crave while possibly

even generating public sympathy. There is also a deep concern that

oxfordhb-9780199918096.indd 136oxfordhb-9780199918096.indd 136 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 137

the strategy of equivalence could be escalatory, cascading an attack

in cyberspace into a much bigger confl ict.

Perhaps the biggest issue cyber experts raise about US strategy,

though, is whether it places too much emphasis on the offense.

Indeed, budget plans in 2014 show the US Air Force spending 2.4

times as much on cyber offense research as on cyber defense. The

concern goes beyond the traditional view that offense is the more

destabilizing side (the worry that it encourages an attack mentality)

and that defense is typically stabilizing (good defenses reduce the

likely gains of any attack, discouraging offensive attacks in general).

Rather, experts worry about the inherently seductive nature of cyber

offense and the impact it might have on the military. As one report

put it, offensive concepts like “cyber war, software exploit, digital

catastrophe and shadowy cyber warriors” are much more glamor-

ous than the defensive, like “security engineering, proper coding,

protecting supply chains.” Yet defense is where the United States

should be putting more of its efforts, not just because of how it aids

stability and deterrence, but as a senior US  military offi cial said

bluntly, “We’re already very good at offense, but we’re just as bad

at defense.”

Regardless of where CYBERCOM and the broader US military

come down on these issues in the years ahead, it’s critical that the

civilian side of the national security apparatus and civilian govern-

ment leaders start to understand and contribute to them. Important

plans and strategies for a powerful new technology are being made,

but the broader civilian political system and populace has largely

remained apart from the discussion. For example, the United States’

strategic policy laying out its budding offensive cyber posture,

is designed to “offer unique and unconventional capabilities to

advance US national objectives around the world with little or no

warning to the adversary or target and with potential effects rang-

ing from subtle to severely damaging.” But it only emerged in public

discourse via leaks to newspapers, months after it had been decided.

It would be a mistake to draw a historic parallel between the

destructive power of cyber weapons and nuclear bombs, as some

civilian leaders have recently done (the head of the US Senate

Armed Services Committee amusingly described a cyber weapon as

just “like a WMD”). Yet there is a worrisome parallel in how civilian

leaders nowadays, as in the past, might be caught off guard by how

oxfordhb-9780199918096.indd 137oxfordhb-9780199918096.indd 137 21-10-2013 22:38:1721-10-2013 22:38:17

138 CYBERSECURITY AND CYBERWAR

operational plans actually make use of these new weapons. For

instance, when General Curtis LeMay headed the new Strategic

Air Command in the 1950s, he surprised civilian leaders when they

fi nally got around to asking what he planned for American nuclear

bomber forces, if there ever were a crisis with the Soviets. LeMay

explained that he was not too concerned, because he’d just order a

preemptive nuclear attack. “I’m going to knock the s**t out of them

before they take off the ground.” It’s a good thing they asked and

shut down such plans before the Cuban Missile Crisis just a few

years later. Today’s leaders might want to ask if there are any cyber

equivalents.

Focus: What Is the Chinese Approach to Cyberwar?

“The most threatening actor in cyberspace.”

So who won this not-so-prized description? Not al-Qaeda. Not

the US military’s Cyber Command. Not Facebook’s privacy policy.

Not even “RickRolling,” the Internet meme wherein victims are

tricked into watching a horribly addictive music video by 1980s

singer Rick Astley. Rather, this is how the US Congress described

China in a major report.

Time and again, China has been described as the bane of the

cybersecurity world, whether in government reports like those

issued by Congress (another one by the US executive branch spe-

cifically named China as the “most active and persistent” perpe-

trator of cyber intrusions in the United States) or Western media

articles (a typical headline: “China: No. 1 Cyber Threat”). Behind

these pointed fingers are real concerns. While it did not specify

an individual nation, the Pentagon’s 2011 Strategy for Operating in Cyberspace , designed to guide Cyber Command, clearly placed China among the most important threats in this realm. Indeed,

many are now framing the US-Chinese relationship in cyberspace

as a digital echo of that between the United States and USSR dur-

ing the Cold War. Former presidential national security adviser

Brent Scowcroft, for instance, describes the situation as “eerily

similar,” while journalist David Ignatius summed up his meet-

ings with top Pentagon officials in an article titled “Cold War

Feeling on Cybersecurity.”

oxfordhb-9780199918096.indd 138oxfordhb-9780199918096.indd 138 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 139

Unsurprisingly, Chinese writers and offi cials have reacted angrily

to direct and veiled accusations, describing them as “groundless

and refl ecting Cold War mentality.” Moreover, they assert that it’s

China that is the aggrieved party and the one more frequently under

attack. And in one way they’re right. By the raw numbers, China

suffers the largest number of cyberattacks in the world. The Chinese

Ministry of Public Security has reported that the number of cyberat-

tacks on Chinese computers and websites has soared by more than

80  percent annually, while some 10 to 19  million or more Chinese

computers are estimated to be part of botnets controlled by foreign

computer hackers.

But the story isn’t that simple. The reason for China’s heavy

malware infection rate is that as much as 95 percent of the software

that Chinese computers use is pirated, meaning that it doesn’t get

the same security upgrades and patches that legal license holders

do, leaving them vulnerable to basic threats. As computer security

expert James Mulvenon explains, “Therefore, China is right when

it says that it is a victim of hacking, but the main culprit is its own

disregard for intellectual property, not state-sponsored espionage.”

Regardless of the structural causes, Chinese analysts are quick

to push back the country’s reputation as an abusive cyber power.

“China is accused time and again for launching cyberattacks abroad

but there is never any solid proof. Actually, China has become a

victim of such repeated claims,” summarizes Su Hao, an expert

on international security at the China Foreign Affairs University.

Moreover, Chinese offi cials and writers assert that most of the

increasing attacks on Chinese computers originate in the United

States. Government offi cials claimed in 2011 that China was the tar-

get of some 34,000 cyberattacks from the United States, while in 2012

the numbers escalated to the point that Chinese military sites alone

were targeted by American sources almost 90,000 times.

While the numbers are arguable (they turn on the same varied

meaning of “attack” that we saw US offi cials abuse as well), it is

undeniable that a large amount of malicious Internet activity ema-

nates from or at least moves through the United States. For example,

security researchers at HostExploit have found that twenty of the top

fi fty crime-spewing ISPs in the world are American. Moreover, US

government agencies like the NSA and Cyber Command are clearly

active and expert in cyber operations. When documents leaked by

oxfordhb-9780199918096.indd 139oxfordhb-9780199918096.indd 139 21-10-2013 22:38:1721-10-2013 22:38:17

140 CYBERSECURITY AND CYBERWAR

Edward Snowden in 2013 showed that the NSA had hacked the pres-

tigious Tsinghua University in Beijing—home to one of six “network

backbones” that route all of mainland China’s Internet traffi c—as

well as the Hong Kong headquarters of Pacnet, which operates one

of the Asia-Pacifi c region’s largest fi ber-optic networks, Chinese

state media had a fi eld day. “The United States, which has long been

trying to play innocent as a victim of cyber attacks, has turned out to

be the biggest villain in our age.”

Finally, Chinese cyber experts often express frustration at

being painted as the main villain in a world they had little hand

in creating. Many feel that the United States enjoys too highly

privileged a position in the global cyber community, a legacy of

its role in developing the Internet. They note, for example, that

of the thirteen root servers that are essential to the functioning

of the entire Internet, ten were originally located in the United

States (and include US government operators like the US Army

Research Lab and NASA), and the other three are in US allies

(Japan, the Netherlands, and Sweden). Similarly, ICANN, which

manages the protocol addresses essential to preserving the stabil-

ity and smooth operation of the global Internet, started as a US

government entity.

The result is that, far from taking the blame for cyber insecurity,

China has increasingly taken the position that it must also equip

itself for future cyberthreats and confl icts. As we read earlier, in 2011,

the Communist Party–controlled China Youth Daily newspaper pub- lished an article by two scholars at the Chinese Academy of Military

Sciences. In direct terms it described how the Chinese military estab-

lishment viewed developments in cyberspace, from the creation of

the US military’s Cyber Command to the revelation of Stuxnet. “Of

late, an Internet tornado has swept across the world . . . massively

impacting and shocking the globe. Behind all this lies the shadow of

America. Faced with this warm-up for an Internet war, every nation

and military can’t be passive but is making preparations to fi ght the

Internet war.”

In real terms, this has translated into a buildup of the People’s

Liberation Army’s (PLA) cyber capabilities at just as rapid a pace

as the building out of Cyber Command and the NSA over the same

period. According to government sources, Chinese spending on

cyber warfare became a “top funding priority,” and a host of new

oxfordhb-9780199918096.indd 140oxfordhb-9780199918096.indd 140 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 141

units were created with the responsibility of “preparing attacks on

enemy computer networks.”

While the Chinese military organization responsible for cyber

operations is not as open about its structure as the United States mili-

tary’s (no online password-guessing games like at Cyber Command),

many think it falls under the PLA General Staff Department’s Third

Department. This entity, based in Beijing, is very similar to the NSA,

with a focus on signals intelligence and code-breaking, making it

a natural fi t for cyber activities. The department has some 130,000

personnel reportedly assigned to it. A key part is the Beijing North

Computer Center (also known as the General Staff Department 418th

Research Institute or the PLA’s 61539 Unit), which some believe to

be the Chinese equivalent of Cyber Command. It has at least ten

subdivisions involved in “the design and development of computer

network defense, attack, and exploitation systems.” There are at

least twelve additional training facilities located around the country.

Of special note is a unit located in Zhurihe that is permanently des-

ignated to serve as an “informationized Blue Team.” That is, the unit

simulates how the US military and its allies use cyberspace and pro-

vide targets for Chinese units to hone their skills on in war games.

A particular hub that has drawn unwanted attention is the Second

Bureau of the Third Army, Unit 61398, also known in cybersecurity

circles as the “Comment Crew” or “Shanghai Group.” This is a key

unit tasked with gathering political, economic, and military-related

intelligence on the United States through cyber means. In 2013, it

was caught stealing employee passwords to break into the New York Times ’ computer networks. Proving that the old saying “Never argue with a man who buys his ink by the barrel” still holds true in

the cyber age, the Times then got its revenge by publishing a series of embarrassing exposés. The paper revealed that the once-secret

Chinese unit was behind some 141 APT attacks across 20 different

industries and governments, targeting everyone from Coca-Cola to

the Pentagon and the United Nations. It even suffered the indig-

nity of having a picture of its no-longer-secret headquarters, located

on Datong Road in Shanghai, splashed across the newspaper’s

front page.

The 61398 unit is far from alone; some estimates point to as many

as 40 other APT operations of a similar scale. While its 12-story

offi ce building is next door to a massage parlor and wine importer,

oxfordhb-9780199918096.indd 141oxfordhb-9780199918096.indd 141 21-10-2013 22:38:1721-10-2013 22:38:17

142 CYBERSECURITY AND CYBERWAR

a number of the other PLA cyber programs are colocated with engi-

neering schools and technology fi rms. For instance, the 61539 cen-

ter is next to Beijing University and the Central Communist Party

School in the city’s northwestern Jiaoziying suburbs.

Just as many US military cyber facilities are colocated with the

NSA and civilian research programs, the PLA also draws from the

wider cyber expertise resident in its eight-million-strong people’s

militia, supplementing offi cial forces with a “patriotic hacker”

program. These universities also make prime recruiting grounds,

although sometimes in ways that later hinder attempts to keep the

units secret. When Unit 61398 started to garner attention, research-

ers were found that its digital tracks hadn’t been cleaned up. The

Zhejiang University website even had a public notice that “Unit

61398 of China’s People’s Liberation Army (located in Pudong

District, Shanghai) seeks to recruit 2003-class computer science

graduate students.”

Guiding this buildup is the concept of “informatization,” a hall-

mark in the Chinese military’s approach to cyber operations. As one

key Chinese military report put it, modern forces, and especially the

American military, are so highly reliant on information that who-

ever dominates the battle of cyberwar will occupy the “new stra-

tegic high ground.” Gaining the “upper hand of the enemy” will

be determined by “whether or not we are capable of using various

means to obtain information and of ensuring the effective circula-

tion of information; whether or not we are capable of making full

use of the permeability, sharable property, and connection of infor-

mation to realize the organic merging of materials, energy, and

information to form a combined fi ghting strength; [and] whether or

not we are capable of applying effective means to weaken the enemy

side’s information superiority and lower the operational effi ciency

of enemy information equipment.”

In execution, the Chinese plan for informationized war would

most likely focus on defending PLA networks and, in turn, targeting

the adversary’s key nodes of communication, command, and coor-

dination. The idea is to degrade an enemy’s decision-making, slow

down its operations, and even weaken its morale. Most importantly,

they believe that the side that controls the fl ow of information can

create “blind spots” that can be exploited, windows of opportunity

to attack undetected or with a reduced risk of counterattack.

oxfordhb-9780199918096.indd 142oxfordhb-9780199918096.indd 142 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 143

By focusing on an adversary’s information systems, China

advances the idea that cyberattacks turn technical advantage into

a liability. In a controversial 1999 volume, two PLA offi cers wrote,

rather pugnaciously, “Who now dares state with certainty that in

future wars this heavy spending will not result in an electronic

Maginot line that is weak because of its excessive dependence on

a single technology?” The basic thinking is that any foreign power

that might threaten China (i.e., the United States) would depend

on well-coordinated technical systems. Infi ltrating and disrupting

these systems is thus a natural “defensive” posture. Unfortunately,

to those on the opposite end of the cyber gun barrel, the emphasis on

infi ltrating and disrupting communications and command systems

looks aggressive.

This amount of military activity and planning in the cyber realm

is certainly worrisome to other nations watching China’s historic

rise over the last few years in economic, political, and now military

power. But, for all the concern, no one should confuse ambition

with full capability. In fact, Chinese military offi cers echo many

of the same complaints that American offi cers have about their

own cyber problems. Chen Weizhan, head of the Military Training

and Service Arms Department of the Guangzhou Military Region,

has talked about how “many generations of weapons and equip-

ment exist at the same time . . . incompatible software systems,

unmatched hardware interfaces, and non-unifi ed data formats.”

He concluded that “there are considerable gaps in the fundamen-

tal conditions of the units, and the level of informationization is

not high.”

Despite these problems, China’s growth in military cyber power

still has two major implications, each of which parallel America’s

own growing military cyber power. Just as in the United States,

there is concern whether the Chinese civilian political leadership

is involved in and understands enough about their military’s own

plans. This may be even more of a concern for China, though, as the

current Chinese political system gives the PLA an immense amount

of leeway. Indeed, there is no equivalent to America’s civilian-led

and staffed National Security Council or Department of Defense.

The risk, therefore, is that Chinese military cyber capabilities and

operations could outpace civilian leaders’ understanding of them,

perhaps crossing “red lines” in a crisis that could have been avoided.

oxfordhb-9780199918096.indd 143oxfordhb-9780199918096.indd 143 21-10-2013 22:38:1721-10-2013 22:38:17

144 CYBERSECURITY AND CYBERWAR

The other problem is what such rapid efforts to militarize

cyberspace might do to the Internet. China isn’t just a loom-

ing superpower, it’s also home to the world’s largest number of

Internet users. As it follows in the United States’ steps, it con-

tinues a dark trend. A  uniquely democratic space created for

communication and sharing is instead being transformed into

a future battleground. “Winning IT-based warfare” (former

Chinese president Hu Jintao) and “Fighting and winning wars

in cyberspace” (General Keith Alexander, the first head of the US

military’s Cyber Command) are certainly important new military

responsibilities in the twenty-first century. But that doesn’t make

them positive developments for the wonderful World Wide Web

that so defines modern life.

Fear of a militarized cyberspace, however, may well lead us to

avoid the very cyber confl icts we are all gearing up for. At a meeting

with US offi cials, a high-ranking Chinese military offi cer explained

how his views of cybersecurity have evolved as each side has built

up its cyber powers and raised the stakes in a potential confl ict: “The

United States has big stones in its hands but also has a plate-glass

window. China has big stones in its hands but also a plate-glass win-

dow. Perhaps because of this, there are things we can agree on.”

What about Deterrence in an Era of Cyberwar?

“Cyber offense may provide the means to respond in-kind. The pro-

tected conventional capability should provide credible and observ-

able kinetic effects globally. Forces supporting this capability are

isolated and segmented from general-purpose forces to maintain

the highest level of cyber resiliency at an affordable cost. Nuclear

weapons would remain the ultimate response and anchor the deter-

rence ladder.”

These lines come from a 2013 US Defense Science Board report,

one of the highest-level offi cial advisory groups to the Secretary of

Defense. While the text reads like typical Pentagonese, what these

lines translate into is a proposal to create a new US military force spe-

cially designed to retaliate against a cyber strike. Of note, it wouldn’t

just be able to respond with counter cyber weapons, but also would

include “Global selective strike systems e.g. penetrating bomber,

submarines with long range cruise missiles, and Conventional

oxfordhb-9780199918096.indd 144oxfordhb-9780199918096.indd 144 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 145

Prompt Global Strike [a ballistic missile].” Foreign Policy magazine’s reaction to the news perhaps sums it up the best: “Wow.”

When we think about deterrence, what most often comes to

mind is the Cold War model of MAD, mutually assured destruction.

Any attack would be met with an overwhelming counterstrike that

would destroy the aggressor as well as most life on the planet, mak-

ing any fi rst strike literally mad.

Yet rather than just getting MAD, deterrence really is about the

ability to alter an adversary’s actions by changing its cost-benefi t

calculations. It refl ects subjective, psychological assessments, a

“state of mind,” as the US Department of Defense says, “brought

about by the existence of a credible threat of unacceptable counter-

action.” In addition to massive retaliation, the adversary’s decisions

can also be affected by defenses, in what has been called “deterrence

by denial.” If you can’t get what you want by attacking, then you

won’t attack in the fi rst place.

Theorists and strategists have worked for decades to fully under-

stand how deterrence works, but one of the key differences in the

cyber realm, as we have explored, is the problem of “who” to deter

or retaliate against. Specifi cally, this is the issue of attribution we

explored earlier.

The effect of this on real-world politics is driven by the fact that

the question of “who” in cyberspace is far more diffi cult than ever

could have been imagined by the original thinkers on deterrence

theory back in the 1950s. Tanks and missile launches are hard to dis-

guise, while networks of compromised machines or tools like Tor

make anonymity easy. The threat of counterstrike requires knowing

who launched the initial attack, a diffi cult thing to prove in cyber-

space, especially in a fast-moving crisis. Computer code does not

have a return address, and sophisticated attackers have grown adept

at hiding their tracks. So painstaking forensic research is required,

and, as we saw, it’s rarely defi nitive.

Moreover, for the purposes of deterrence, it’s not enough to trace

an attack back to a computer or fi nd out who was operating a spe-

cifi c computer. Strategically, we must know what political actor was

responsible, in order to change their calculations.

This problem has made improving attribution (or at least making

people think you have improved attribution) a key strategic prior-

ity for nations that believe themselves at risk of cyberattack. So, in

oxfordhb-9780199918096.indd 145oxfordhb-9780199918096.indd 145 21-10-2013 22:38:1721-10-2013 22:38:17

146 CYBERSECURITY AND CYBERWAR

addition to considering the massive retaliatory forces outlined by

the Defense Science Board, the United States has grown its mes-

saging efforts on this front. In 2012, for example, then Secretary of

Defense Panetta laid down a public marker that “Potential aggres-

sors should be aware that the United States has the capacity to locate

them and to hold them accountable for their actions that may try to

harm America.” In turn, these potential aggressors must now weigh

whether it was bluster or real.

The “who” of deterrence is not just about identifi cation but also

context. The United States has approached deterrence very dif-

ferently when facing terrorists, rogue nations, and major powers.

While the theory often lays out a series of set actions and counter-

actions, the reality is that different actors can dictate very different

responses. Imagine, for example, what the Bush administration’s

reaction might have been if the groups attacking the United States’

NATO partner Estonia in 2007 had been linked to Tehran instead of

Moscow.

If the actor is known, the next component in deterrence is the

commitment to retaliate, a decision whether to match or escalate

the use of force. Unlike when the United States and the Soviet

Union pointed nuclear weapons at each other ’s territory, the play-

ers and stakes in the cyber realm are far more amorphous. Some

even argue that if one wants to change an adversary’s “state of

mind,” the “credible threat” against cyberattack needs to go

beyond the cyber realm.

This is the essence of the Pentagon’s plan for a mixed cyber- and

real-world retaliatory force, which has also been proposed even in

situations of espionage. But going back to the issue of context, the

challenge of intellectual property theft is that an in-kind response

would not be effective; the very fact that your secrets are being sto-

len is a pretty good indicator that the enemy doesn’t have anything

worth stealing back. Likewise, the traditional deterrence and retali-

ation model in espionage (they arrest your spies, you arrest theirs or

deport some embassy staff) doesn’t translate well when the spy is

thousands of miles away and likely outside of the government. Thus,

some have argued that alternative means have to be found to infl u-

ence an enemy’s calculations. Dmitri Alperovitch, who watched the

massive Shady RAT attacks play out, argues that we should try to

“raise the economic costs on the adversary through the use of such

oxfordhb-9780199918096.indd 146oxfordhb-9780199918096.indd 146 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 147

tools as sanctions, trade tariffs, and multilateral diplomatic pressure

to impact their cost benefi t analysis of these operations.”

Timing also plays a more complicated role in cyber deterrence. In

the nuclear age, speed was key to MAD. It was crucial to show that

you could get your retaliatory missiles and bombers off the ground

before the other side’s fi rst strike. In the cyber age, however, there

is simultaneously no time and all the time in the world to respond.

The fi rst strike might play out in nanoseconds, but there are many

compelling reasons to delay a counterstrike, such as to gain better

attribution or better plan a response.

Similarly, how much of a guarantee of reprisal is needed? In the

nuclear realm, the game theory that guided American Cold War

planners put a mandate on having comparable “survivable” coun-

terstrike forces that would make sure the other guy got nuked even

if he tried a sneak attack. In a cyber era, it’s unclear what a “surviv-

able” counterforce would look like, hence the US plan to establish a

nuclear equivalent.

The same lack of clarity extends to the signals that the two sides

send each other, so key to the game of deterrence. If you fi re back

with a missile, the other side knows you have retaliated. But fi re

back with malware, and the effect is not always so evident, espe-

cially as its impact can sometimes play out just like a normal sys-

tems failure. This means that different types of cyber weapons will

be needed for different purposes in deterrence. When you want to

signal, “noisy” cyber weapons with obvious effects may be better,

while stealthy weapons might be more key to offensive operations.

The result, though, is something that would be familiar to those

wrestling with past deterrence strategies:  in the effort to head off

war, new weapons will be in constant development, driving for-

ward an arms race.

In short, the growing capacity to carry out multiple types of

cyberattack is further complicating the already complex fi eld of

deterrence. Without a clear understanding or real reservoir of test

cases to study for what works, countries may have to lean more

heavily on deterrence by denial than during the nuclear age.

Ultimately, while the technologies may be shifting, the goals

of deterrence remain the same:  to reshape what an enemy thinks.

Cyber deterrence may play out on computer networks, but it’s all

about a state of mind.

oxfordhb-9780199918096.indd 147oxfordhb-9780199918096.indd 147 21-10-2013 22:38:1721-10-2013 22:38:17

148 CYBERSECURITY AND CYBERWAR

Why Is Threat Assessment So Hard in Cyberspace?

In the 1960s there was a heated argument in the Pentagon between

Alain Enthoven, a civilian strategist, and an air force general about

the number of nuclear weapons that the United States would need if

the Cold War ever turned hot. Angry that this nerdy civilian didn’t

see the threat the same way, the general told Enthoven that his opin-

ion was not wanted. Enthoven then famously responded, “General,

I have fought just as many nuclear wars as you have.”

This anecdote is useful when thinking about cybersecurity and

all the potential ripple effects it will have for arms races, wars, and

other confl icts. A  “threat assessment” is the process of weighing

the risks that any entity faces, be it a nation, a business, or even an

individual. Herbert Lin is Chief Scientist for computer science at

the National Academies and one of the leading thinkers in the fi eld

of cybersecurity. As he has explained, to do a proper threat assess-

ment, one essentially evaluates three basic factors: “The feasibility of

adversaries being able to identify and exploit your vulnerabilities,

the effect that would happen if they were able to take advantage

of these vulnerabilities, and, fi nally, the likelihood that they will, in

fact, be willing to do so.”

Threat assessments are notoriously hard. There are usually lay-

ers upon layers of uncertainty, not just in evaluating your own vul-

nerabilities but also gauging the enemy’s capabilities and likely

intentions. And because it’s about weighing risks, there is a natu-

ral human and organizational inclination toward “threat infl ation.”

When you don’t know what the exact risks are, many will play it

safe and assume a worst-case scenario. You may get it wrong, but

you also don’t get caught with your pants down. It sounds sensible

enough, except you can then waste immense time and energy wor-

rying about risks that aren’t real. A good example of this occurred

during the Cold War. In 1967, the United States deployed new

advanced spy satellites that could monitor Soviet missile sites at a

whole new level of detail. It was only then that President Lyndon

B.  Johnson realized that the US counts of Soviet missiles had been

way off. Rather than the previous threat assessment pointing to a

“missile gap” that had driven US strategy for the last decade, “We

were doing things that we didn’t need to do. We were building

things that we didn’t need to build. We were harboring fears that we

didn’t need to have.”

oxfordhb-9780199918096.indd 148oxfordhb-9780199918096.indd 148 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 149

The scary realization waiting for us in the twenty-fi rst century

may be that these twentieth-century strategists had it easy. Threat

assessments in cyberspace may be even more diffi cult.

The nature of vulnerabilities in cyberspace makes assessing them

extremely diffi cult. While it’s easy to look at a map of your country

and fi gure out likely approaches of attack (for instance, “My enemy

is more likely to attack across this open plain than through these

rugged mountains”), the very term “zero day” illustrates the prob-

lem in cyberspace. The vulnerabilities that are most often targeted

are the ones that no one but the attacker knows about.

Similarly, a key element of any threat assessment is the capability

of the adversary and its weapons. While you may not always have

perfect information about an enemy’s current or next generation of

weapons, there have traditionally been at least some bounds that

could be placed around any assessment. At the bare minimum, you

could at least “ballpark” estimate a threat based on what the last

generation of weapons could do, your own experience with simi-

lar weapons, and perhaps most of all, the basic laws of physics. An

enemy might surprise you with a new tank, but it wouldn’t drive

1,000 miles per hour faster than a current version.

Cyber weapons, by comparison, are not bound by the same laws

of physics. Each new piece of malware can be designed in very dif-

ferent ways to do very different things. That is, their nonphysical

nature means that they can be produced and stored in a manner

and number that makes the already tough task of threat assess-

ment an order of magnitude more diffi cult. During the Cold War,

the United States could watch Soviet tank, ship, or missile factories

to see what was going in and then leaving the assembly line. They

would then watch Red Army bases to see how many weapons were

stored and the rough order of battle they were organized into, and

then track movements to and from these bases to see where units

and their weapons were headed. We may have frequently gotten the

count wrong, as LBJ explained, but at least there were “things” to

count. With malware, there are no factories, no storage yards, and of

course, no things.

This nonphysical nature of cyberthreats becomes even more

important when trying to assess a potential adversary’s actions and

intent. With physical weaponry, there are sometimes tea leaves that

can be read as telltale signs that trouble might be coming, whether

oxfordhb-9780199918096.indd 149oxfordhb-9780199918096.indd 149 21-10-2013 22:38:1721-10-2013 22:38:17

150 CYBERSECURITY AND CYBERWAR

it’s an enemy fl eet headed out to sea or reservists reporting to duty.

The cyber realm doesn’t have this, and the waters are made even

murkier by the problem of attribution; pinpointing an adversary

is diffi cult in a world fi lled with so many different potential state

and nonstate players. And, even if you know that you’re being tar-

geted and by whom, determining the adversary’s actual intent can

be tremendously diffi cult. Someone could be targeting your sys-

tems, but the goal might be to gather intelligence, steal information,

shut down your operations, or just show off the hacker’s capability.

Threat assessment is about predicting the likely risks. But in cyber-

space, many of these risks will remain undiscovered until after an

attack takes place.

Given all this uncertainty, the main lesson for threat assessment

in cyberspace goes back to the problem that Enthoven and the gen-

eral faced in the early days of nuclear weapons. Instead of claiming

any kind of perfect knowledge in the midst of any cyber crisis, we

should instead recognize our inherent limitations and uncertainties

and act accordingly. As one former Justice Department cybersecurity

offi cial put it, “I have seen too many situations where government

offi cials claimed a high degree of confi dence as to the source, intent,

and scope of an attack, and it turned out they were wrong on every

aspect of it. That is, they were often wrong, but never in doubt.”

Does the Cybersecurity World Favor the Weak or the Strong?

In 2009, American soldiers captured an insurgent leader in Iraq. As

they went through the fi les on his laptop computer, they made a

remarkable discovery: he’d been watching them watch him.

A key part of the US military effort was the fl eet of unmanned

systems (“drones”) that fl ew overhead, gathering intelligence on

the insurgent force, tracking their movements and beaming back

video to US Air Force pilots on the ground. But inside the captured

leader’s laptop were “days and days and hours and hours of proof”

that the digital feeds were being intercepted and shared among the

various insurgent groups. The insurgents had evidently fi gured out

how to hack and watch the drones’ feed, like a robber listening in on

a police radio scanner. Even more disturbing to the US soldiers was

how the insurgents had pulled it off. It turned out they were using

commercially available software originally designed by college kids

oxfordhb-9780199918096.indd 150oxfordhb-9780199918096.indd 150 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 151

to illegally download satellite-streamed movies. Skygrabber, as it

was known, cost as little as $25.95 on a Russian website.

Examples like this lead many to believe that cyberspace is one

of those strange places where the weak have an advantage over the

strong. On one hand, the barriers to entry to developing cyberat-

tack capabilities are relatively low, especially compared to build-

ing up more traditional military capabilities. For instance, it cost

the United States roughly $45  million for the unmanned plane

system and several billion dollars for the space satellite network

that its feed traveled over. The $25.95 spent on illegal software to

undermine those systems was a pretty good bargain. As the head

of Israeli military intelligence has explained, “Cyberspace grants

small countries and individuals a power that was heretofore the

preserve of great states.”

However, the real worry for states like the United States is not

just that others can now build up cyberthreats but that traditional

strengths are proving cyber vulnerabilities. As director of national

intelligence from 2007 to 2009, Mike McConnell oversaw a surge of

US cyberwar capabilities, funded by tens of billions of dollars, that

culminated in the development of weapons like Stuxnet. But instead

of feeling more confi dent about where the United States stood in

cybersecurity after this effort, McConnell testifi ed to the Senate, “If

the nation went to war today, in a cyberwar, we would lose. We’re

the most vulnerable. We’re the most connected. We have the most

to lose.”

Unlike many of its potential adversaries in this space, the United

States and especially the US military is highly reliant on computer

networks for everything from communications to electricity (the

vast majority of electrical power used by US military bases, for

instance, comes from commercial utilities using a fairly vulnerable

power grid). So cyberattacks of equivalent strength would have far

more devastating consequences on the United States than on poten-

tial adversaries like China, whose military is still less networked,

let  alone a cyber pygmy like North Korea, whose economy never

entered the information age. As former NSA offi cial Charlie Miller

explains, “One of North Korea’s biggest advantages is that it has

hardly any Internet-connected infrastructure to target. On the other

hand, the United States has tons of vulnerabilities a country like

North Korea could exploit.”

oxfordhb-9780199918096.indd 151oxfordhb-9780199918096.indd 151 21-10-2013 22:38:1721-10-2013 22:38:17

152 CYBERSECURITY AND CYBERWAR

This creates the strange irony of cyberwar. The more wired

a nation, the more it can take advantage of the Internet. But the

more wired a nation, the more it can potentially be harmed by

those using the Internet maliciously. To think of it another way,

the nations most skilled at throwing rocks live in the biggest glass

houses.

That nations like the United States are feeling increasingly vul-

nerable is not, however, a sign that the strong are toothless in the

cyber realm or even that the weak are now at an advantage. As

Joseph Nye, a former Pentagon offi cial and dean of the Harvard

Kennedy School, writes, “Power diffusion is not the same as power

equalization.”

Nonstate groups and weaker states can certainly now play in a

game that was once out of their reach. But that doesn’t mean they

have the same resources to bring to bear in it. The most strategic

cyberattacks, as opposed to ones that prove a nuisance or merely

have a disruptive effect, combine sophisticated new weapons with

vast economic and human resources, sometimes outside the cyber

realm. What made Stuxnet so effective was that it combined mul-

tiple new exploits built into the weapon’s design and that it was

specifi cally targeted to hit a precise confi guration of centrifuges that

painstaking intelligence had identifi ed at an Iranian facility. It had

even been tested on an expensive dummy set of centrifuges built

just for the effort. Low-end actors can now carry out copycat attacks,

but the cyber powers that will break new ground or have the most

lasting and sustained effects are still likely to be the major pow-

ers. The confi guration of power has something old and something

new: “Governments are still top dogs on the Internet,” as Nye puts

it, “but smaller dogs bite.”

The true advantage for the strong in these cyber confl icts and

arms races may come, however, from their powers outside the cyber

realm. While the small groups and weak states are now able to cre-

ate more cyberthreats, the powerful still retain what is known as

“escalation dominance.” As we saw in the earlier discussion of US

cyber deterrence strategy, if things go poorly in the cyber realm, the

United States “reserves the right” to take the matter outside cyber-

space, where it might have a clearer advantage.

Being powerful means you have the choice. Being weak means

you don’t. The insurgents in Iraq would rather have had the drones

oxfordhb-9780199918096.indd 152oxfordhb-9780199918096.indd 152 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 153

than just their pirated video feed. That’s why it still pays to be the

stronger in battle, even on a cyber battlefi eld.

Who Has the Advantage, the Offense or the Defense?

“Whatever the question, to attack was always the answer.”

Attaque à outrance , or “Attack to excess,” was a concept that took hold in European military circles at the turn of the last century.

The idea was that new technologies like the railroad and tele-

graph gave an advantage at the strategic level to whichever nation

could mobilize fi rst and go on the offensive, while new technolo-

gies like the fast-fi ring cannon, machine guns, and rifl es meant

that the troops who showed the greatest offensive élan (a concept

that combined both willpower and dash) would always carry the

day on the battlefi eld. The philosophy gained huge popularity. In

Germany, it drove the adoption of the Schlieffen Plan (which envi-

sioned a rapid mobilization of Germany’s army to fi rst knock out

France to its west with a lightning offensive and then swing to face

Russia to the east), while in France it was actually written into mili-

tary law in 1913 that the French army “henceforth admits no law

but the offensive.”

There were only two problems with Attaque à outrance , an idea that historians now call the “cult of the offensive.” The fi rst was

that it drove the European powers into greater and greater compe-

tition and ultimately war. When crisis loomed after the assassina-

tion of Archduke Franz Ferdinand in 1914, few thought it worth

going to war. But soon the sides feared that they were losing a tight

window of opportunity during which to mobilize to their advan-

tage, or even worse, that they would be caught helpless. Fear of

being on the defensive prompted the powers to move to the offen-

sive, launching their long-planned attacks as part of a war most

didn’t want.

The second problem was even worse. These new technologies

didn’t actually give the offense the advantage. Once the war started,

it became clear that “attacking to excess” against fast-fi ring artil-

lery, rifl es, and machines guns was not the way to quick victory, but

rather to a quick death. A bloody stalemate of trench warfare instead

resulted.

oxfordhb-9780199918096.indd 153oxfordhb-9780199918096.indd 153 21-10-2013 22:38:1721-10-2013 22:38:17

154 CYBERSECURITY AND CYBERWAR

This question of whether a new technology favors the offense or

the defense is a critical one for cybersecurity, as it might similarly

shape everything from the likelihood of war to how governments

and even businesses should organize themselves. For the most part,

there is a general assumption that cyberattack has the advantage

against cyber defense. As one Pentagon-funded report concluded

in 2010, “The cyber competition will be offense-dominant for the

foreseeable future.”

This assumption is what has helped drive the larger spending

on cyber offense by militaries around the world. Their basic think-

ing behind the offense’s advantage is that “It will be cheaper and

easier to attack information systems than it will be to detect and

defend against attacks.” Compared to traditional military capabili-

ties, those needed to put together a cyberattack are relatively cheap.

More importantly, the attackers have the initiative, the advantage

of being able to choose the time and place of their attack, whereas

the defender has to be everywhere.

This is true with any weapon, but in cyberspace a few other fac-

tors kick in. While in the physical world territory is relatively fi xed,

the amount of “ground” that the defender has to protect is almost

always growing in the cyber world, and growing exponentially.

The number of users on computer networks over time is an almost

constant upward curve, while the number of lines of code in secu-

rity software, measured in the thousands two decades ago, is now

well over 10 million. By comparison, malware has stayed relatively

short and simple (some is as succinct as just 125 lines of code), and

the attacker only has to get in through one node at just one time to

potentially compromise all the defensive efforts. As the director of

the Defense Advanced Research Project Agency (DARPA), put it,

“Cyber defenses have grown exponentially in effort and complex-

ity, but they continue to be defeated by offenses that require far less

investment by the attacker.”

Just as before World War I, however, the story of the offense’s

inherent advantage is not so simple. The cyberattacks that are truly

dangerous require a great deal of expertise to put together. And

while they might play out in terms of microseconds, they often

take long periods of planning and intelligence gathering to lay the

groundwork. Neither Rome nor Stuxnet was built in a day, so to

speak. This means that crippling attacks out of the blue, the ultimate

oxfordhb-9780199918096.indd 154oxfordhb-9780199918096.indd 154 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 155

threat from the offense’s advantage, are not as easy to pull off in the

cyber world as is often depicted.

Another challenge for the offense is that the outcome of a cyberat-

tack can be highly uncertain. You may be able to get inside a system

or even shut it down, but that is only part of the story of what makes

a good offense. The actual effect on your target is hard to predict,

and any damage assessment can be diffi cult to estimate.

Nor is the defender so helpless in cybersecurity. The attackers

may have the luxury of choosing the time and place of their attack,

but they have to make their way through a “cyber kill chain” of mul-

tiple steps if they actually want to achieve their objectives. Charles

Croom is a retired US Air Force lieutenant general, who once led the

Defense Information Systems Agency (DISA), the agency that ser-

vices the IT needs of the entire US military, and now is Lockheed’s

vice president for cybersecurity solutions. As he explains, “The

attacker has to take a number of steps:  reconnaissance, build a

weapon, deliver that weapon, pull information out of the network.

Each step creates a vulnerability, and all have to be completed. But a

defender can stop the attack at any step.”

And, as we saw earlier, defenders who are losing in the cyber

realm don’t have to restrict the game to just that domain. They can

try to impose some other costs on the attacker, whether they be some

kind of economic or diplomatic costs, traditional military action, or

even a cyber counterattack. Rather than just sitting there defense-

less, they can take action either to deter the attack or reduce the ben-

efi ts from it.

The most important lesson we have learned in traditional

offense-defense balances, and now in cybersecurity, is that the best

defense actually is a good defense. Regardless of which side has the

advantage, any steps that raise the capabilities of the defense make

life harder on the offense and limit the incentives for attacks in the

fi rst place. In cybersecurity, these include any and all measures that

tighten network security and aid in forensics to track back attackers.

Beyond the best practices we’ll explore in Part III that weigh risks

and make individuals and important infrastructure more secure,

there is also the potential for new technology that can continue to

function even if compromised. The idea is to build systems where

the parallel for measuring offense and defense isn’t war, but biol-

ogy. When it comes to the number of bacteria and viruses in our

oxfordhb-9780199918096.indd 155oxfordhb-9780199918096.indd 155 21-10-2013 22:38:1721-10-2013 22:38:17

156 CYBERSECURITY AND CYBERWAR

bodies, our human cells are actually outnumbered by as much as 10

to 1. But the body has built up a capacity of both resistance and resil-

ience, fi ghting off what is most dangerous and, as Vint Cerf puts it,

fi guring out how to “fi ght through the intrusion.” No computer net-

work will mimic the human body perfectly, but DARPA and other

groups are working on “intelligent” computer security networks

that learn and adapt to resist cyberattacks. The defense would start

to outsmart an adversary and turn the tables on them. Just the mere

existence of such a system would always sow doubt in the offense

that the attack is going to work.

The fi nal question, though, is whether an offensive advantage (if

it is even possible) actually does have to doom a system to instabil-

ity and risk. Some are now arguing that the real problem in cyber is

not that the offense may have an advantage, but that it isn’t talked

about enough, which fails to warn all sides of the risks if ever used.

“We’ve got to step up the game; we’ve got to talk about our offensive

capabilities and train to them; to make them credible so that people

know there’s a penalty to this,” said James Cartwright, the four-star

Marine Corps general who led much of the initial US strategy in

cyber issues until his retirement in 2011. “You can’t have something

that’s a secret be a deterrent. Because if you don’t know it’s there, it

doesn’t scare you.” (Two years later, this quote took on far greater

resonance, when General Cartwright was reported to have been

the alleged source of leaks to the media that revealed the US role in

building Stuxnet, the fi rst true use of a cyberweapon.)

A New Kind of Arms Race: What Are the Dangers of

Cyber Proliferation?

In 280 BC, King Pyrrhus of Epirus invaded Italy with an army of

25,000 men, horses, and war elephants. In the battle of Asculum, his

force soundly defeated the Romans, but at the loss of a large portion

of his force. When one of his offi cers congratulated him on the win,

a despondent Pyrrhus supposedly responded, “One more such vic-

tory and we shall be utterly ruined.”

This idea of a “Pyrrhic victory” has come to describe accomplish-

ments that seem to offer great benefi t but ultimately sow the seeds

of defeat. Many now describe Stuxnet in a similar way. The develop-

ment and use of a cyber weapon seriously damaged Iran’s nuclear

oxfordhb-9780199918096.indd 156oxfordhb-9780199918096.indd 156 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 157

program in a way that avoided direct military confrontation for sev-

eral years. But by proving that it could be done, the episode also

perhaps opened the page to a new kind of arms race.

Over the last decade, the idea of building and using cyber weap-

ons moved from science fi ction to concept, and now to reality. Much

of the work is naturally shrouded in secrecy, but most estimates are

that this new arms race is quite global. As one report put it, “By

one estimate, more than one hundred nations are now amassing

cybermilitary capabilities. This doesn’t just mean erecting electronic

defenses. It also means developing ‘offensive’ weapons.”

The capabilities of these nations, though, greatly differ. Just as in

traditional military clout, Burundi’s cyber power pales compared to

that of the United States or China. McAfee, a Santa Clara, California,

computer security fi rm, for instance, estimates that there are only

around twenty countries that actually have “advanced cyber-

war programs” that could build something comparable to a new

Stuxnet-like weapon.

Michael Nacht, the former US Assistant Secretary of Defense for

Global Strategic Affairs, told us how all this work impacts global

politics:  “An arms race is already going on in cyberspace and it is

very intense.” The irony is that, just as in past arms races where

nations rushed to construct everything from battleships to nuclear

weapons, the more states compete to build up their capabilities,

the less safe they feel. As we saw, the United States and China are

perhaps the two most important players in this game, but both are

deeply on edge about the threat they see from the other. This is per-

haps the true hallmark of an arms race.

What sets this twenty-fi rst-century cyber arms race apart from

the past is that it is not just a game of states. As we’ve explored again

and again, what makes cyberspace so simultaneously positive and

problematic from a policy standpoint is that it is populated by both

public and private actors. So when it comes to arms races within it,

there are new wrinkles of decentralization and scale.

While the impact of individuals is often overstated in cyberse-

curity (the best types of malware often require the cooperation of

multiple experts, skilled in a variety of areas, rather than the popu-

lar trope of a single teenaged hacker in his parents’ basement), the

cyber realm is one in which small groups can potentially generate

enormous consequences. In software programming, businesses

oxfordhb-9780199918096.indd 157oxfordhb-9780199918096.indd 157 21-10-2013 22:38:1721-10-2013 22:38:17

158 CYBERSECURITY AND CYBERWAR

like Google and Apple have found that the productivity difference

between a good and an elite programmer can be several orders

of magnitude. The same goes for those who program malware.

Nonstate actors all the way down to individuals are now key play-

ers in a major arms race, something that hasn’t happened before.

Ralph Langner, the cybersecurity expert who discovered Stuxnet,

for example, discussed with us how he would rather have ten

experts of his own choosing versus all the resources of the US Cyber

Command at his disposal. While Ralph was slightly exaggerating

to make a point, the fact is that small groups or organizations can

be meaningful in a manner unimaginable in earlier times. New

malware can be extremely harmful on a global scale and yet can be

developed and deployed by only a few people.

The key is not just these groups’ power but their ability to share

it, what arms control experts call proliferation. Unlike with battle-

ships or atomic bombs, those same groups or individuals can, if

they wish, almost instantaneously communicate knowledge of how

to create any new capability to millions of others. For example, it

may have taken the combined efforts of a team of experts almost a

year to build Stuxnet, but within weeks of its discovery an Egyptian

blogger had posted an online how-to guide to building this new

cyber weapon.

This new kind of cyber proliferation can take two paths. One

is just to try to use the new capability “as is” by making a direct

copy. This wouldn’t seem like such a big problem, as good defenses

would plug any gap identifi ed and exploited by the use of a new

weapon like Stuxnet. Except many pieces of malware turn out to be

more than one-time-only weapons because their potential targets

are irresponsible, and fail to adapt their defenses. Part of Langner ’s

original motivation to go public about Stuxnet was to encourage

adoption of the vendor patches needed to prevent future exploita-

tion among potential targets in the West. Yet a full year after Stuxnet

was fi rst revealed to the world, Langner and other security experts

were lamenting that that a number of major public infrastructure

companies had still not plugged the vulnerabilities that Stuxnet

attacked.

The more problematic proliferation path, however, is via inspi-

ration. Each construction and use of a new type of cyber weapon

lowers the bar for the rest of the crowd. Stuxnet had a complex

oxfordhb-9780199918096.indd 158oxfordhb-9780199918096.indd 158 21-10-2013 22:38:1721-10-2013 22:38:17

Why It Matters 159

infection package that included new zero-day attacks, as well as a

novel payload that attacked SCADA controllers, but its beauty (and

the lesson for others) was in how the different parts of this complex

attack worked together. Some of the copycats were fairly simple.

Duqu, for example, was a worm that was discovered in the wild

soon after Stuxnet using very similar Microsoft Windows–exploit-

ing code. Many took to calling it “son of Stuxnet,” with the idea that

it must be the next version designed by the same team. However,

while there are key similarities, experts also have noticed key dif-

ferences and thus now believe that it was more a case of inspiration

than evolution. As Ralph Langner describes this new kind of prolif-

eration problem:

Son of Stuxnet is a misnomer. What’s really worrying are

the concepts that Stuxnet gives hackers. The big problem

we have right now is that Stuxnet has enabled hundreds of

wannabe attackers to do essentially the same thing. Before,

a Stuxnet-type attack could have been created by maybe fi ve

people. Now it’s more like 500 who could do this. The skill set

that’s out there right now, and the level required to make this

kind of thing, has dropped considerably simply because you

can copy so much from Stuxnet.

The booming underground black market of creating and distrib-

uting malware, in which transnational criminal groups buy and

sell specialized cyber capabilities, makes this proliferation even

smoother and more worrisome.

This combination is what makes the cyber realm so different

when it comes to arms races. It’s not just that the ideas behind

the weapons spread globally in mere microseconds, but that the

required tools to turn a blueprint into action do not require the

kind of large-scale human, fi nancial, or physical resources one

used to need. To make a historic comparison, building Stuxnet

the fi rst time may have required an advanced team that was the

cyber equivalent to the Manhattan Project. But once it was used,

it was like the Americans didn’t just drop this new kind of bomb

on Hiroshima, but also kindly dropped leafl ets with the design

plan so anyone else could also build it, with no nuclear reactor

required.

oxfordhb-9780199918096.indd 159oxfordhb-9780199918096.indd 159 21-10-2013 22:38:1721-10-2013 22:38:17

160 CYBERSECURITY AND CYBERWAR

Are There Lessons from Past Arms Races?

“We are here to make a choice between the quick and the dead. . . . If

we fail, then we have damned every man to be the slave of fear.

Let us not deceive ourselves; we must elect world peace or world

destruction.”

In June 1946, Bernard Baruch, the personal representative of

President Truman, made this speech to the United Nations as part

of an amazing offer that history little remembers. Despite the fact

that the United States was the only nation with nuclear weapons

at the time, it offered to turn over all its nuclear bombs to the

United Nations. Baruch’s condition was that all other nations also

agree not to build them and open themselves up to inspection. It

seemed a noble gesture, but the Soviets (who wouldn’t be able to

fi gure out how to build nuclear bombs for another three years)

balked. They demanded that the United States instead fi rst give

up its weapons and only afterward should the world develop a

system of controls. They were also deeply suspicious of the UN,

feeling that it was too US-dominated to be trusted (how things

have changed!). With the two superpowers at loggerheads, the

Baruch plan fell apart. Instead, a nuclear arms race would shape

the next 50 years of global politics, a time in which over one hun-

dred thousand atomic bombs would be built and the world would

almost be destroyed several times over, as during close calls like

the Cuban Missile Crisis.

While today’s emerging cyber arms races are far from identical to

the Cold War, there are still lessons that can be learned from it. Or, to

paraphrase Mark Twain, while history may not always repeat itself,

“It does rhyme.”

One of the most instructive lessons is that the initial periods of

a burgeoning arms race are often the most dangerous. These early

days have a dark combination. The possessors of the new technol-

ogy see themselves as having a unique advantage but one that is

fl eeting, creating a “use it or lose it” mentality. It is also the period

in which the technology and its consequences are least understood,

especially by senior leaders. In the Cold War, for example, proba-

bly the scariest time was not the Cuban Missile Crisis, but the late

1940s and 1950s when the real-world versions of Dr.  Strangelove were taken seriously, arguing that nuclear war was something that

was not only survivable but winnable. This was a period that saw

oxfordhb-9780199918096.indd 160oxfordhb-9780199918096.indd 160 21-10-2013 22:38:1821-10-2013 22:38:18

Why It Matters 161

everything from General Douglas Macarthur’s 1951 demand to be

given sole discretion to drop atomic bombs on mainland China to

perhaps one of the most outrageous nuclear concepts of all, Project

A-119. When the Soviets launched the Sputnik satellite into space

in 1957, the US Air Force proposed a nuclear missile be shot at the

moon, just to demonstrate that the United States could also do excit-

ing things in space.

In the cyber world, there is justifi able concern that at least some

elements of this combination are also present today. The National

Academy of Sciences has reported that emerging technologies

“greatly expand the range of options available to US policy mak-

ers as well as the policy makers of other nations,” which makes

leaders often very itchy to take action. And yet, as the report con-

tinued, “Today’s policy and legal framework for guiding and regu-

lating the use of cyberattack is ill-formed, undeveloped, and highly

uncertain.” Or, as James Mulvenon, president of the Cyber Confl ict

Studies Association, puts it: “Here’s the problem—it’s 1946 in cyber.

So we have these potent new weapons, but we don’t have all the

conceptual and doctrinal thinking that supports those weapons or

any kind of deterrence. Worse, it’s not just the United States and

Soviets that have the weapons—it’s millions and millions of people

around the world that have these weapons.”

What this means is that, akin to the Cold War, any great strategic

advantages a nation is able to seize in a cyber arms race will be fl eet-

ing. The United States only had a window of four years before the

Soviets were able to build their own bomb. That seemed incredibly

quick at the time. By comparison, the proliferation of cyber weapons

happens at Internet speed, so any window that fi rst users had with

weapons like Stuxnet has already closed.

This raises the question of whether some kind of stability like that

during the Cold War will then set in. While the nuclear arms race

put humanity on the precipice of disaster for almost a half century,

once the two sides both had nuclear weapons, the balance of terror

known as MAD took hold, and the great powers shied away from

directly fi ghting each other. The problem is that, unlike in the Cold

War, there is no simple bipolar arrangement, since, as we saw, the

weapons are proliferating far more widely. Even more, there are no

cyber equivalents to the clear and obvious tracing mechanism of a

missile’s smoky exhaust plume heading your way, since the attacks

oxfordhb-9780199918096.indd 161oxfordhb-9780199918096.indd 161 21-10-2013 22:38:1821-10-2013 22:38:18

162 CYBERSECURITY AND CYBERWAR

can be networked, globalized, and of course, hidden. Nuclear explo-

sions also present their own, rather irrefutable evidence that atomic

weapons have been used, while a successful covert cyber operation

could remain undetected for months or years.

Instead of trying to get MAD, the better lesson from arms races

past may be that “Talk is cheap(er),” as defense analyst Rebekka

Bonner has said. Arms races are relatively expensive. Indeed, she

found that the United States alone spent almost $9 trillion on the

Cold War arms race “that resulted in a net decline in national secu-

rity.” While early efforts like the Baruch plan didn’t work, it doesn’t

mean that efforts at arms control were not worthy. The whole time

that nuclear weapons were building up during the Cold War, there

were off-and-on attempts to build them down. These started with

bold offers like the Baruch Plan and continued into everything from

the Pugwash dialogues between nuclear scientists to the SALT and

START arms control talks between world leaders. Not all met with

success, but they were relatively costless. More importantly, they

helped dampen tensions and ultimately set the table for the Cold

War to end.

As we’ll explore soon in Part III, the comparison to today high-

lights the glaring need for similar efforts. It is unlikely (and unverifi -

able) that the various players in this cyber arms race will just give

up their capabilities in some new form of the Baruch Plan. But the

basic choice is much like that back in the 1940s. One path is to be a

“slave to fear,” solely to focus on the threats, and race to build up

a capability to counter them, even if it likely won’t deliver much

security in the end. The other is to recognize the mutual risks that

all the participants in cyberspace face from this new arms race and

explore how we can be responsible stakeholders. The direction we

take won’t just shape this new twenty-fi rst-century arms race, but

also will shape the future of the Internet itself.

Behind the Scenes: Is There a Cyber-Industrial Complex?

“Unlike most wars, the Cyber War will have no end, as the

Internet along with the continued globalization of industries central

to the development of a middle class, will create new battlefi elds

to protect. The investment required to protect corporate America

and the US Government will grow at almost exponential rates,

oxfordhb-9780199918096.indd 162oxfordhb-9780199918096.indd 162 21-10-2013 22:38:1821-10-2013 22:38:18

Why It Matters 163

public and private partnerships will have to fl ourish, more and

more existing defense companies will have to pivot, and the Merger

& Acquisitions and investment opportunities will increase. If you

wish to invest in the Cyber Arms Race, then this is the conference

for you.”

This is from an invitation that we received to a conference in 2013.

Where some see threats, others see opportunities. And maybe that

should worry us all.

The rise of cybersecurity as an issue has gone hand in hand with

a boom in the number of companies trying to make money from it.

And there is a lot of money to be made. Indeed, the 2013 cybersecu-

rity market in the United States alone was estimated to be $65 billion

and projected to grow at a 6 percent to 9 percent rate per year for at

least the next fi ve years. In only ten years, cybersecurity could be a

$165 billion market. Other estimates already place the global scale

of the cyber-industrial complex at “somewhere between $80 billion

and $150 billion annually.”

What is notable is that this growth is happening at the same time

that traditional defense budgets are going down. “In a barren global

defence market the cyber security domain has provided a rare oasis”

is how a leading defense industry magazine described the world of

cybersecurity. And, like much else in cybersecurity, the boom is not

just an American phenomenon. For instance, even in an environment

of austerity and dramatic cuts across the UK government, the 2010

Strategic Defence and Security review recommended an increase in

cybersecurity funding of $1.7 billion. As Professor Peter Sommer of

the London School of Economics wrote, “In terms of the involvement

of the big military companies, you have to realize that they are fi nd-

ing it extremely diffi cult to sell big, heavy equipment of the sort they

are used to because the type of wars that we’re involved in tend to be

against insurgents. And so they are desperately looking for new prod-

uct areas—and the obvious product area, they think, is cyber warfare.”

With these trends in play, traditional defense fi rms have taken

three primary approaches to getting on board what they see as a

cyber gravy train. Or, as we were told in the conference invitation,

they are seizing the “wealth of opportunity” that awaits in “the

migration from traditional ‘warfare’ to “cyber war.”

The fi rst strategy has been to expand their own internal cyber

operations. Companies like Lockheed Martin and Boeing may be

oxfordhb-9780199918096.indd 163oxfordhb-9780199918096.indd 163 21-10-2013 22:38:1821-10-2013 22:38:18

164 CYBERSECURITY AND CYBERWAR

better known for making jet fi ghters, but now they also run cyberse-

curity centers for defense ministries and other government agencies.

Second, there has been a buying spree of the smaller cyber fi rms.

Indeed, since 2010, 15 percent of all mergers and acquisitions trans-

actions completed by defense companies involved a cybersecurity

target. Sometimes these have been military-oriented fi rms, while

at others it has been military fi rms bringing in niche skills from

other domains. BAE may be known for building Typhoon fi ghter

jets and Queen Elizabeth class aircraft carriers, but it also paid almost $300 million in 2011 to become the proud owner of Norkom, a cyber

fraud and anti-money-laundering specialist. Its competitor Boeing

has spent over $1 billion buying up smaller cybersecurity fi rms in

the last fi ve years. Finally, there have been a series of corporate alli-

ances. Boeing, for instance, doesn’t just sell F-15 fi ghter jets to Japan,

but also in 2012 inked a partnership with Sojitz, a leading Japanese

conglomerate, in which the two megafi rms agreed to help protect

critical Japanese government, civil, and commercial IT infrastruc-

tures. As one report described, the outcome is that “Companies

with cyber security relevant capabilities have seen fi nancial worth

increase almost on dot-com levels witnessed in the late 1990s.”

But with this growth comes some concern, especially in the role

such fi rms seek in infl uencing public policy. In 2001, only four fi rms

were lobbying Congress on cybersecurity issues. By 2012, it had risen

to 1489 companies. The Washington Post even gave an article on the phenomenon the title “Good News for Lobbyists: Cyber Dollars.”

As Ronald Deibert, a cybersecurity expert who helped found the

Information Warfare Monitor project, worries, “This not only creates

a kind of feeding frenzy among defense contractors, but also propels

the development of more refi ned techniques of monitoring, exploi-

tation, and attack. This new cybersecurity market brings to mind

Dwight Eisenhower’s warnings of a looming ‘military-industrial

complex.’ When you have a major defense budget served by the pri-

vate sector, a constituency is created that has enormous infl uence

over policy, perceptions of threats, and strategic interests.”

This potential cyber-industrial complex now has vested inter-

ests in developing newer and better modes of both cyber defense

and attack, which, of course, must go hand in hand, driving up the

levels of threats and tensions in this space. Perhaps the more wor-

risome aspect has been the manner in which very real risks and

oxfordhb-9780199918096.indd 164oxfordhb-9780199918096.indd 164 21-10-2013 22:38:1821-10-2013 22:38:18

Why It Matters 165

threats in cybersecurity have sometimes been mischaracterized. In a

study called “Loving the Cyber Bomb” (a play on the old Cold War

movie Dr. Strangelove or How I Learned to Stop Worrying and Love the Bomb ), cyber experts at George Mason University found extensive evidence of threat infl ation in Washington, DC, cyber discussions,

most frequently by those with political or profi t incentives to hype

the threats.

As we’ve seen, such hype infl ation ranges from the mischaracter-

ization of unsophisticated attacks as war to full-blown falsehoods.

A repeatedly cited example is the “cyber Pearl Harbor” attack carried

out on the Brazilian power grid. This supposed episode was even

featured in a 2009 episode of 60 Minutes , with pundits positing that a series of power blackouts in Brazil had been caused by cyber black-

mail. It turns out the blackouts were actually just non-cyber-related

failures at a single power supplier.

The point here is not that cyberthreats are all just the work of a

vast conspiracy or that “cyberwarfare is a meaningless buzzword

coined by rapacious defense contractors,” as writer Cory Doctorow

once put it. As we have explored, there are very real and very dan-

gerous things going on in cyberspace, and, indeed, that is why we

wrote this book. But these threats have to be put in their proper con-

text and understanding. And part of that understanding requires us

all to realize that there is now a lot of money to be made in the fi eld.

With that money comes the risk of bias and even hype.

The most important takeaway, then, is that we must avoid letting

our fears get the better of us, or even worse, let others stoke our fears

and thus drive us into making bad decisions. How we respond to

this world of growing cyberthreats will shape everything from our

personal privacy and the future of the Internet to the likelihood of

regional crises and even global wars. So we better try to get it right.

And that is what Part III is all about.

oxfordhb-9780199918096.indd 165oxfordhb-9780199918096.indd 165 21-10-2013 22:38:1821-10-2013 22:38:18

Part III

WHAT CAN WE DO?

Don’t Get Fooled: Why Can’t We Just Build a New,

More Secure Internet?

The proposal started out as an April Fool’s joke, but many people

still took it seriously.

Steve Bellovin, a computer network and security researcher, can

claim to have literally written the book on fi rewalls, being one of the

earliest researchers on how to repel what he called “the wily hacker.”

On April 1, 2003, he issued a new proposal for an Internet-wide stan-

dard to ensure network security. Noting that the problem in cyber-

security was really just one of separating the bad traffi c from good

traffi c, he proposed that each packet come with a new fl ag on it,

a one-digit signifi er that could be 1 or 0.  “If the bit is set to 1, the

packet has evil intent. Secure systems SHOULD try to defend them-

selves against such packets.”

Of course, the Internet’s very structure has no way of enforcing

“evil bit” settings, and there is no reason why an evildoer would set

such a fl ag. That was the essence of the joke. Nonetheless, it is easy

to look at all of today’s problems with Internet security and wonder

if there is a way to just start over.

Some argue that the threats the cyber age has brought are so “ter-

rifying” that, as Washington Post columnist Robert Samuelson wrote, we should just “repeal the Internet. It is the technological marvel of

the age, but it is not—as most people imagine—a symbol of prog-

ress. Just the opposite. We would be better off without it.”

oxfordhb-9780199918096.indd 166oxfordhb-9780199918096.indd 166 21-10-2013 22:38:1821-10-2013 22:38:18

What Can We Do? 167

To put it bluntly, such an idea is a nonstarter. Setting aside that a

technology is not a law—it can’t be “repealed” or uninvented—the

notion of going back to the world right before the Internet makes as

much sense as rebooting Beverly Hills 90210 . The world has changed. We are now dependent on the Internet in everything from com-

merce to communications to, yes, even confl icts, while the modes

and expectations of cyberspace have become woven into an entire

generation’s very worldview.

If we can’t roll back time, others argue for something seemingly

more modest, building a more secure section of cyberspace: a new

region of peace and predictability set inside the supposed lawless

Wild West of the Internet. This approach advocates creating trusted

networks inside the Internet, which would solve the problems of

anonymity and inability to limit access. The model might be applied

only to the most critical infrastructure systems, such as power plants,

or more the more frequent online targets, such as consumer banks.

A number of senior government leaders have pushed this

“.secure” model. The concept has been described in different man-

ners, but essentially argues that the current Internet and network

architecture were not designed with enough security to meet today’s

threats, and a new part of the Internet should be created with just

this in mind. General Keith Alexander, head of both the NSA and US

Cyber Command, argued for a “secure, protected zone.” Similarly,

the FBI’s former Assistant Director Shawn Henry argued for a “new,

highly secure alternative Internet.”

Many in the private sector have watched these discussions of sep-

arating out the Internet or making it anew and started to explore their

associated business opportunities. In 2012, the security company

Artemis declared its intention to buy a new domain of .secure and

create a “neighborhood on the Internet where security is required,

and users know that.” Rather than focus on any network aspects,

the .secure domain would be a brand of sorts. Any website wishing

to use the .secure appendage would have to meet Artemis’s security

standards, including no hosted malware, fully implemented top-of-

the-line protections, and rapid vulnerability patching.

Will these approaches work? It depends on two features. The fi rst

is what kind of security is actually offered. The commercial .secure

domain offers no protection from malicious actors on the network

oxfordhb-9780199918096.indd 167oxfordhb-9780199918096.indd 167 21-10-2013 22:38:1821-10-2013 22:38:18

168 CYBERSECURITY AND CYBERWAR

or on your computer. Instead, it will only secure the websites them-

selves. Your bank’s website won’t attack you, but you would still be

vulnerable to having your bank account credentials stolen.

Similarly, the government’s secure Internet could take one of

several forms of added security. The least amount of reengineer-

ing and effort would simply be to build a model of opting in at

the network level, allowing more government analysis of network

traffi c to detect threats. This would offer benefi ts, to be sure, but

would hardly create the kind of “more secure Internet” that peo-

ple talk about as the needed alternative. More rigorous proposals

require individual authentication at the network level to support

connectivity. Even if we could engineer a mechanism to convey

real authentication at the network level (as opposed to the applica-

tion level), a vulnerable computer could still allow credential theft

and undermine security.

The second feature to solve is scale. Network security is gener-

ally inversely correlated with size, while network utility is posi-

tively correlated. To put it another way, the bigger the network, the

more security problems, but the smaller the network, the less use-

ful it is. If the network spans a large set of organizations and risks,

its security becomes less and less certain, depending on more and

more people not making mistakes. But if the inner circle of protec-

tion doesn’t extend that far, then it’s not all that useful for solving

the problems these advocates cite. For example, will the govern-

ment approach include smaller organizations, a rural power plant

for instance, that are clearly vulnerable? But how will those less

able organizations live up to the supposedly newly high security

standards set for the extremely critical infrastructure? Moreover,

how would we treat a large organization with critical functional-

ity? Does the payroll department also have to conform to the new

super-duper security standards for the new secure Internet? If not,

how do we enforce segregation between those systems that every-

one uses and the critical systems that only some people use some

of the time? As we’ve seen, separating secure and insecure sys-

tems by “air gapping” them is very diffi cult in practice, and hasn’t

been a guarantee of safety. If it was so simple, the Pentagon’s

Secure Internet (SIPRINET) wouldn’t have been repeatedly com-

promised by relatively unsophisticated cyberattacks, nor would

Stuxnet have been a problem to the Iranians.

oxfordhb-9780199918096.indd 168oxfordhb-9780199918096.indd 168 21-10-2013 22:38:1821-10-2013 22:38:18

What Can We Do? 169

These same kinds of problems strike the private side, just

with added layers. Suppose your mother hears about all these

new fangled cyberthreats and decides only to trust websites with

the .secure domain. Now any company that wants to reach her

must join this group. This seems a positive step for the mar-

ket,  shaping it toward more security. The problem is that the

bigger the market gets, the more it increases the number of web-

sites (and all the people behind them) that could deviate from the

security goals. What’s more, when her grandson comes and surfs

the Web on her computer or phone, not always using .secure,

she’ll lose her protection, and when it no longer works the way

she was sold, she will see little reason to continue following

the brand.

In practice, too many of the concepts of building an entirely new

Internet end up a lot like the idea of relying on Bellovin’s joked

“evil bit.” This isn’t to say that the goal of a less risky Internet isn’t

worth pursuing. But starting anew just isn’t the easy option that is

oft portrayed. Instead, the task is to analyze carefully the changes

proposed, and compare their costs with their potential to affect spe-

cifi c security goals.

Rethink Security: What Is Resilience, and Why Is It Important?

“Hundreds of Thousands May Lose Internet.” 

Articles with this headline not so ironically hit the Internet in

the summer of 2012. The story started when the FBI caught the

group behind the DNS Changer virus. This cybercriminal ring

based out of Estonia had been able to infect more than 570,000

computers worldwide, reprogramming the victim’s machines to

use DNS servers run by the criminals. They would then steer the

computers to fraudulent websites, where the hackers would profi t

(to the tune of over $14  million) from websites that the victims

were tricked into visiting. But when the FBI got ready to shut down

the ring, said Tom Grasso, an FBI supervisory special agent, “We

started to realize that we might have a little bit of a problem on

our hands because. . . . If we just pulled the plug on their criminal

infrastructure and threw everybody in jail, the victims were going

to be without Internet service. The average user would open up

oxfordhb-9780199918096.indd 169oxfordhb-9780199918096.indd 169 21-10-2013 22:38:1821-10-2013 22:38:18

170 CYBERSECURITY AND CYBERWAR

Internet Explorer and get ‘page not found’ and think the Internet

is broken.”

Faced with this problem, the FBI entered the Internet server pro-

vider business. With the help of the Internet Systems Consortium,

on the night of the arrests the agency installed two of its own

Internet servers to take over the operations run by rogue servers

that the victims’ computers had been using, which by then were

sitting impounded in an FBI evidence locker. For the next nine

months, the FBI tried to let victims know that their computers had

been infected and how to fi x the problem. But after running its

own servers at a cost of $87,000, the FBI said it had to pull the plug

on its safety net, hence the media warnings of mass Internet loss.

Fortunately, the “Internet Doomsday” that Fox News described

was avoided; it turned out many of the systems were no longer

used, while other ISPs set up various technical solutions to steer

people to assistance.

In a world that depends so much on the Internet, the fear of los-

ing access to it is very real. It’s not just the lost social connections on

venues like Facebook or Twitter, or the emptiness of a day without

online cat videos, but the impact it can have on things like politics

and economics. As a result, the need to build “resilience” against

such shocks has become one of the magic words of cybersecurity.

Resilience is another one of those concepts that is both overused

and underexplored. A  study by the Homeland Defense Institute

identifi ed 119 different defi nitions of the term. The general idea

behind resilience is to adapt to adverse conditions and recover. It is

a wonderful concept, but the problem is that it can apply to every-

thing from computer systems to our own love life. Indeed, there

have been over 3,000 books written with “the word ‘resilience’” in

their title, most of them in the “self-help” section!

In cybersecurity, we should think about resilience in terms of

systems and organizations. Resilient systems and organizations are

prepared for attacks and can maintain some functionality and con-

trol while under attack. “Intrusion tolerance” is how security expert

Dan Geer frames it. “We must assume that intrusions have hap-

pened and will happen. We must maximize the probability that we

can tolerate the direct effect of those intrusions, and that whatever

damage is done by the intruder, the system can continue to do its job

to the extent possible.”

oxfordhb-9780199918096.indd 170oxfordhb-9780199918096.indd 170 21-10-2013 22:38:1821-10-2013 22:38:18

What Can We Do? 171

There are three elements behind the concept. One is the impor-

tance of building in “the intentional capacity to work under

degraded conditions.” Beyond that, resilient systems must also

recover quickly, and, fi nally, learn lessons to deal better with future

threats.

For decades, most major corporations have had business continu-

ity plans for fi res or natural disasters, while the electronics industry

has measured what it thinks of as fault tolerance, and the commu-

nications industry has talked about reliability and redundancy in

its operations. All of these fi t into the idea of resilience, but most

assume some natural disaster, accident, failure, or crisis rather than

deliberate attack. This is where cybersecurity must go in a very dif-

ferent direction: if you are only thinking in terms of reliability, a net-

work can be made resilient merely by creating redundancies. To be

resilient against a hurricane just requires backups located elsewhere,

ready to just fl ip on if there is fl ooding at your main computer cen-

ter. But in cybersecurity, an attacker who understands a network can

go after the key nodes that connect all these redundancies, shutting

the whole thing down.

Resilience in cybersecurity starts with the primary goal of pre-

serving the functions of the organization. As a result, the actions that

are needed to be resilient vary. Preparedness and continuity might

depend on the ability to quickly lock down valuable information or

dynamically turn on otherwise onerous defenses. Outward-facing

Internet services could be shut down, with some alternative process

in place for a less effi cient but more secure alternate. In other situ-

ations, resilience might depend on mitigation or the ability to “fail

gracefully.” One example is having mechanisms that keep attacks on

web servers from gaining access to internal servers. It’s the differ-

ence between your picture on the company website being defaced

with a funny mustache, and sensitive data being compromised.

This notion of multiple modes of planned failure is important to

resilience planning: systems and organizations should not fail criti-

cally from a single attack but should have enough distributed con-

trol to continue operations. Another key aspect is that failure must

be evident. If the system allows “silent failures,” its operators can’t

adapt in a timely fashion.

Still, it’s not terribly useful for a policymaker or senior man-

ager to send off planners with the dictums to “Be resilient” and

oxfordhb-9780199918096.indd 171oxfordhb-9780199918096.indd 171 21-10-2013 22:38:1821-10-2013 22:38:18

172 CYBERSECURITY AND CYBERWAR

“Expect the unexpected.” We need metrics to support organiza-

tional decision-making, infl uence system design, and guide tech-

nical investment. There are dependability metrics that measure,

for instance, how critical any component is to the overall system.

Similarly, understanding the means and timing of a system’s recov-

ery from the accidents or non-attack-related failures that normally

happen can inform resilience against targeted attacks. Particularly

useful are exercises that test security, such as having an outside “red

team” test potential vulnerabilities and the recovery from them,

before an actual foe makes a real attack.

Resiliency cannot be separated from the human component,

though. Adaptability and recovery cannot happen without individ-

uals, processes, and practices that can quickly assess the situation,

handle dynamic environments, and learn from their experiences. As

the famous World War II British poster advises, the most resilient

response is not to freak out that the Internet sky is falling, but rather

to “Keep Calm and Carry On.”

The biggest challenge perhaps is that the structural aspects of

resiliency are frequently at odds with other goals. The media that

writes headlines warning of an “Internet Doomsday” want to draw

in readers, not supply answers. The same government bureaucra-

cies that should be building an ethic of public resilience benefi t from

public fears that drive up their budgets and powers. And even in

private fi rms, the incentives for effi ciency can drive in opposite

directions. Redundancy is intuitively wasteful. Meeting day-to-day

goals requires looking away from the big picture. And the kind of

employee who is best at adapting to changing conditions may not be

as good at doing the same thing again and again, which many fi rms

want instead. Indeed, when the World Economic Forum tried to sell

its corporate members on the importance of building cyber-resilient

organizations, its business case mostly relied on public goodwill,

which is nice, but less than compelling to companies focused on the

bottom line.

There are, however, incentives to adopt a more holistic approach to

resilience. Media that continually warn the sky is falling end up los-

ing the trust and attention of their intended audience. Government

leaders who can only talk in terms of threats become discounted.

And organizational theorists have noticed that businesses that have

the greatest apparent effi ciency actually are too lean, and suffer from

oxfordhb-9780199918096.indd 172oxfordhb-9780199918096.indd 172 21-10-2013 22:38:1821-10-2013 22:38:18

What Can We Do? 173

an inability to adapt or innovate. They lack “organizational slack”

that drives a positive culture and enables future growth. The same

organizational features that create resiliency enable this organiza-

tional slack. Similarly, being better at self-assessment and cultivating

employees who understand the broader goals of the organization

are other areas that help both resiliency and a broader mission.

There is no single defi nition, path, or strategy for resilience. We

need to avoid treating it like a magical buzzword that has no real

meaning, whether as a falsely claimed property of every new prod-

uct or as a black box inserted into organizational planning docu-

ments. Instead, resiliency is about understanding how the different

pieces fi t together and then how they can be kept together or brought

back together when under attack. Like all the other cybersecurity

solutions, it’s not only a matter or architecture and organization, it’s

about people and processes.

Reframe the Problem (and the Solution): What Can

We Learn from Public Health?

In 1947, the seven staff members of what was then known as the

Offi ce of Malaria Control in War Areas took up a collection to raise

$10. They needed the money to buy fi fteen acres of land in DeKalb

County, Georgia, where they planned one day to build their new

headquarters. Over the next six decades, the organization widened

its focus beyond malaria, changed its name, and the $10 investment

in real estate more than paid off. Today, the acreage just outside

Atlanta houses the Centers for Disease Control (CDC), a program

with 15,000 staff members that is considered one of the most suc-

cessful government agencies in history. The CDC serves as a bul-

wark of the modern American public health system, having ended

the scourge of killers like smallpox and now standing guard against

new disease outbreaks like pandemic fl u.

While the Cold War is by far the most frequent analogy used in

policy discussions of cybersecurity, this historic parallel is actually

not so apt. The Cold War was a competition between two superpow-

ers with political leadership and decision-making clearly located

in Washington and Moscow, each hubbing a network of allied

treaties  and client states and competing over the so-called Third

World. By contrast, the Internet isn’t a network of governments but

oxfordhb-9780199918096.indd 173oxfordhb-9780199918096.indd 173 21-10-2013 22:38:1821-10-2013 22:38:18

174 CYBERSECURITY AND CYBERWAR

the digital activities of billions of public and private users, trav-

eling across an infrastructure that is in the hands of some 5,000-

plus Internet service providers (ISP) and carrier networks owned

by an array of businesses. The Cold War was also a war of ideas

between two competing political ideologies. The ideas at play

on the Internet sometimes touch on serious ideology, including

free speech and human rights, but they also include the 800,000

hours of videos of keyboard-playing cats and pop song parodies

uploaded onto YouTube each day.

It is this diversity that leads many experts to argue that agen-

cies like the CDC are a more apt comparison for the needed future

of cybersecurity. It’s not just that there are many similarities

between the spread of malware and the spread of communicable

disease (even the terminology is the same—“viruses,” “infec-

tion,” etc.). It’s that the broader public health approach might be

a useful guide to how cyber policy overall could be more effec-

tively reimagined.

Organizations like the CDC play a key role in public health by

serving as research organizations, trying to understand emerging

threats, as well as trusted clearing houses, transparently sharing

information to anyone and everyone who needs it. The CDC’s suc-

cess has made it a one-stop shop for reliable reporting on everything

from how to protect yourself from the common cold to the latest

genetic analysis of bird fl u.

Given the similar problem with information that clouds effective

responses to cyberthreats, there may now be the need for an equiva-

lent “Cyber CDC.” The concept is to form an agency much like the

CDC, linked to a relevant department like Homeland Security, but

independent enough to focus on its core mission of research and

information sharing, which also differentiates it from both organi-

zations like CYBERCOM and private fi rms with their own profi t

interests. Indeed, cybersecurity research fi rms’ incentives to hoard

information parallel the incentives of drug companies, which, while

not happy to see diseases break out, do prefer to be the one with the

patent on the cure.

As one study explained, the cyber CDC equivalent’s “func-

tions might include threat and incident watch, data dissemination,

threat analysis, intervention recommendations, and coordination of

oxfordhb-9780199918096.indd 174oxfordhb-9780199918096.indd 174 21-10-2013 22:38:1821-10-2013 22:38:18

What Can We Do? 175

preventive actions.” It would be structured in a similar way, with

leadership appointed by the government but with staff recruited

across a wide range of specialties. Just as the CDC now has offi ces

beyond Atlanta to allow it to research and track disease outbreaks

of various types and locales across the nation (hence the name

“Centers”), so too would the Cyber CDC equivalent distribute itself

physically and virtually in order to cast a wider net around emer-

gent threats on the World Wide Web. It would also be able to nav-

igate privacy concerns in much the same way that CDC research

on disease outbreaks focuses on trends rather than individual case

identities. As one blog joked, “Essentially, take everything the CDC

already does and slap a cyber in front of it.”

One of the pillars of modern public health is the sharing of

responsibility for action across the system. Thus, the cyber ver-

sion of the CDC would not stand alone but simply serve as a hub

for cooperation with all the various other state and international

agencies as well as nonstate actors that matter in cyberspace, just

as the CDC works collectively with groups like the World Health

Organization (WHO) all the way down to local hospitals, universi-

ties, and research centers. (There is an argument to be made for a

WHO equivalent at the international level for cyber, but that level of

international cooperation may be a bridge too far at this time).

Framing cybersecurity as like a public health problem may

not just be more effective, but also have huge policy and political

implications. Importantly, while the rethinking still allows for the

problem of deliberate attacks (public health must defend against

biological weapons attacks, for instance), it shifts the focus away

from a meme of just cyberattack-counterattack and toward the

needed goal of cooperation, among individuals, companies, states,

and nations. As opposed to the current trend of leaders calling for a

“cyber Manhattan Project to build weapons,” looking at the matter

through a health lens would aid coalitions of governments and net-

work organizers to collaborate around solutions and go after many

of the core, shared problems of cybersecurity. Indeed, by even just

focusing on research and information, such an agency might serve

as a key intermediary in heated political environments, just as the

health version of the CDC does. (The international battle to stop

smallpox was actually fi rst introduced by a Soviet deputy health

oxfordhb-9780199918096.indd 175oxfordhb-9780199918096.indd 175 21-10-2013 22:38:1821-10-2013 22:38:18

176 CYBERSECURITY AND CYBERWAR

minister, allowing the CDC to serve as an alternative track of coop-

eration between Cold War enemies.)

Like the eradication of most diseases, the cyber equivalent to

public health would be to focus both on the causal factors and vec-

tors of spread. For instance, botnets create a huge amount of infec-

tion across the Internet by spewing out spam, but they also make it

hard to track down the more directed, malicious actors conducting

more advanced cyberattacks. In much the same way that the CDC

targeted malaria, dedicated efforts could be made to “drain the

Internet swamp” of botnets through efforts to take infected comput-

ers offl ine, to collect and share information about which ISPs (and

which owners of IP addresses) are the originators or relay points

for the most malicious traffi c, and to improve cooperation across

network providers by developing “white lists” of fi rms that follow

best practices. (One survey found that 27  percent of network pro-

viders “do not attempt to detect outbound or cross-bound attacks,

and of those that do, nearly half take no actions to mitigate such

attacks.”)

As in public health, this kind of cooperation would ideally extend

all the way to the individual level. For instance, the CDC has led

efforts to bolster the average American citizen’s awareness and edu-

cation on basic steps to take to keep themselves safe, as well as pre-

vent dangerous diseases from spreading. The underlying concept to

emerge from the CDC’s research is that Ben Franklin’s saying, “An

ounce of prevention is worth a pound of cure,” really is true. In stud-

ies of everything from malaria to HIV, the CDC found that disease

prevention was the best pathway to control and, in turn, that effec-

tive prevention required building an ethic of individual responsibil-

ity. We see the fruits of this work woven into our daily lives, from

workplace reminders on how washing your hands can prevent the

spread of the seasonal fl u to TV and web advertisements on how

abstinence and the use of condoms can prevent the spread of sexu-

ally communicable diseases.

The same kind of “cyber hygiene” and “cyber safe” ethics might

be bolstered through similar efforts to convince users of cyberspace

of their own responsibilities to help prevent the spread of threats

and malware. As Scott Charney, Vice President of Trustworthy

Computing at Microsoft explains, “Just as when an individual who

is not vaccinated puts others’ health at risk, computers that are not

oxfordhb-9780199918096.indd 176oxfordhb-9780199918096.indd 176 21-10-2013 22:38:1821-10-2013 22:38:18

What Can We Do? 177

protected or have been compromised with a bot put others at risk

and pose a greater threat to society.”

Learn from History: What Can (Real) Pirates Teach Us

about Cybersecurity?

In 1522, three Spanish galleons left Havana, Cuba, on their way to

Seville, Spain. Loaded onto the ships were literally tons of gold,

emeralds, jade, and pearls, all the riches of the Aztec empire gath-

ered into one massive shipment. Hernando Cortés has just con-

quered Mexico and was sending its treasure as a tribute back to his

king, Charles V.  But once the fl eet set out on its long journey, fi ve

more ships appeared on the horizon. The lumbering treasure-laden

ships couldn’t escape. A short fi ght ensued, and the Spanish lost to

a squadron led by a French captain named Jean Fleury. By stealing

the Aztec gold, Fleury had pulled the ultimate score. The episode

would inspire generations to come and launch what is known as the

“Golden Age of Piracy,” a period romanticized in books like Treasure Island and movies like Pirates of the Caribbean .

In centuries past, the sea was a primary domain of commerce and

communication over which no one actor could claim complete con-

trol, much like the Internet today. While most just used the sea for

normal commerce and communication, there were also those who

engaged in bad deeds, again much like the Internet today. They var-

ied widely, from individual pirates to state militaries with a global

presence. In between were state-sanctioned pirates, known as pri-

vateers. Parallel to today’s “patriotic hackers” (or the private con-

tractors working for government agencies like the NSA or Cyber

Command), privateers were not formally part of the state but

licensed to act on its behalf. They were used both to augment tradi-

tional military forces and to add challenges of identifi cation (attribu-

tion in cyber parlance) for those defending far-fl ung maritime assets.

These pirates and privateers would engage in various activi-

ties with cyber equivalents, from theft and hijacking, to blockades

of trade (akin to a “denial of service”), to actual assaults on eco-

nomic infrastructure and military assets. During the War of 1812,

for example, the American privateer fl eet numbered more than 517

ships—compared to the US Navy’s 23. Even though the British con-

quered and burned the American capital city, the private American

oxfordhb-9780199918096.indd 177oxfordhb-9780199918096.indd 177 21-10-2013 22:38:1821-10-2013 22:38:18

178 CYBERSECURITY AND CYBERWAR

fl eet caused such damage to the British economy that they com-

pelled negotiations. As in cyberspace today, one of the biggest chal-

lenges for major powers was that an attacker could quickly shift

identity and locale, changing its fl ags and often taking advantage of

third-party harbors with loose local laws.

Maritime piracy is still with us, but it’s confi ned off the shores

of failed states like Somalia and occurs on a miniscule scale com-

pared to its golden age (only 0.01  percent of global shipping is

taken by modern-day pirates). Privateering, the parallel to the most

egregious attacks we have seen in the cyber realm, is completely

taboo. Privateers may have helped the US against the British in the

War of 1812, but by the time the American Civil War started in 1861

President Lincoln not only refused to recruit plunderers-for-hire, but

also blasted the Confederates as immoral for opting to employ them.

The way this change came about provides an instructive parallel

to explore for cybersecurity today. Much like the sea, cyberspace can

be thought of as an ecosystem of actors with specifi c interests and

capacities. Responsibility and accountability are not natural market

outcomes, but incentives and frameworks can be created either to

enable bad behavior or to support the greater public order.

To clamp down on piracy and privateering at sea, it took a

two-pronged approach that went beyond just shoring up defenses

or threatening massive attack (which are too often talked about in

cybersecurity as the only options, again making false comparisons to

the worst thinking of the Cold War). The fi rst strategy was to go after

the underlying havens, markets, and structures that put the prof-

its into the practice and greased the wheels of bad behavior. Major

markets for trading pirate booty were disrupted and shut down;

pirate-friendly cities like Port Royal, Jamaica, were brought under

heel, and blockades were launched on the potentates that harbored

the corsairs of the southern Mediterranean and Southeast Asia.

Today, there are modern cyber equivalents to these pirate havens

and markets. And much like the pirate friendly harbors of old, a sub-

stantial portion of those companies and states that give cybercrime

a legal free pass are known. These range from known malware and

other cyber black marketplaces to the fi fty Internet service provid-

ers that account for around half of all infected machines worldwide.

Without the support of these havens and networks, online crimi-

nal enterprises would fi nd it harder to practice their illegal action,

oxfordhb-9780199918096.indd 178oxfordhb-9780199918096.indd 178 21-10-2013 22:38:1821-10-2013 22:38:18

What Can We Do? 179

which not only would clean the cyber seas, but also make it easier to

identify and defend against the more serious attacks on infrastruc-

ture and the like.

Melissa Hathaway, who led the White House’s policy team on

cyberspace issues, has talked about this as a strategy to “ ‘drain the

swamp’ of malicious cyber activity and tilt the playing fi eld [back]

in our favour.” Much as with piracy at sea, some of the efforts might

be taken as part of a cooperative global effort, while other actions

could be taken on a unilateral basis, such as operations to disrupt or

destroy the markets where hacker tools are traded, and tracking and

targeting the assets of attackers themselves.

This links to the second strategy, the building of a network of trea-

ties and norms, something explored in a following section. Fleury’s

attack launched a golden age of piracy that was great for the pirates

but not everyone else, including the governments of the time. Pirates,

who had been tolerated at the individual level, began to be seen as

general threats to economic prosperity. In turn, privateers, who had

been viewed as useful tools, turned into the bureaucratic rivals of the

formal navies being built up in these states (here again, akin to how

patriotic hackers lose their shine when states build out more of their

own formal cyber military units). As Janice Thompson recounts in

her seminal study of why the pirate trade ended, Mercenaries, Pirates, and Sovereigns , maritime hijackers (and their state-approved counter- parts) became marginalized as nations’ values changed and they saw

the need to assert greater power and control.

Soon a webwork of agreements was established that set a gen-

eral principle of open trade across the high seas. The agreements,

some bilateral and others multilateral, also asserted that maritime

sovereignty would only be respected when a nation took responsi-

bility for any attacks that emanated from within its borders. Slowly,

but surely, they paved the way toward a global code of conduct.

By 1856, forty-two nations agreed to the Declaration of Paris, which

abolished privateering and formally turned pirates from accepted

actors into international pariahs to be pursued by all the world’s

major powers.

The cyber parallel today, again, is that all netizens have a shared

global expectation of freedom of action on the Internet, particularly

online trade, just as it is ensured on the open ocean. If you know-

ingly host or abet maritime pirates or privateers, their actions refl ect

oxfordhb-9780199918096.indd 179oxfordhb-9780199918096.indd 179 21-10-2013 22:38:1821-10-2013 22:38:18

180 CYBERSECURITY AND CYBERWAR

back on you. The same should be true online. Building those norms

will motivate both states and companies to keep a better check on

individual hackers and criminals (the pirate equivalent). It will also

weaken the value of outsourcing bad action to patriotic hackers (the

latter-day privateers).

In addition to encouraging new accountability, this approach also

offers opportunities for what are known as “confi dence-building

measures,” where two states that don’t get along can fi nd ways to

work together and build trust. After the War of 1812, for example,

the British Royal Navy and nascent US Navy constantly prepared

for hostilities against each other, which made sense since they had

just fought two outright wars. But as the network of norms began

to spread, they also began to cooperate in antipiracy and antislav-

ery campaigns. That cooperation did more than underscore global

norms:  it built familiarity and trust between the two forces and

helped mitigate the danger of military confl ict during several crises.

Similarly, today the United States and China are and will certainly

continue to bolster their own cyber military capabilities. But like the

Royal Navy and new American Navy back in the 1800s, this should

not be a barrier to building cooperation. Both countries, for instance,

could go after what the Chinese call “double crimes,” those actions

in cyberspace that both nations recognize as illegal.

The lesson here is that the world is a better place with commerce

and communication made safe and freewheeling pirates and priva-

teers brought under control. Indeed, the period was never all that

good even for the pirates. Jean Fleury made away with all that Aztec

gold, but he should have quit while he was ahead. Just fi ve years

after the ultimate pirate score, he was caught by the Spanish on

another raiding expedition and hanged.

Protect World Wide Governance for the World Wide Web:

What Is the Role of International Institutions?

In 1865, engineers from around the world gathered in Paris to dis-

cuss a dilemma. The invention of a new technology called a “tele-

graph” (taken from the Greek words for “far writing”) had spread

around the world rapidly, linking people in a way never thought

possible. The only problem was that as messages were sent across

national borders, each of the countries charged different tariffs, had

oxfordhb-9780199918096.indd 180oxfordhb-9780199918096.indd 180 21-10-2013 22:38:1821-10-2013 22:38:18

What Can We Do? 181

different types of equipment, and used different codes for the mes-

sages. For example, American telegraphs communicated using the

inventor Samuel Morse’s concept of patterns of four basic keys rep-

resenting letters of the alphabet, while the Germans communicated

with a modifi ed version invented by Frederich Gerke that just used

two keys (what we now ironically call “Morse code”).

At the meeting, representatives of the European powers (except

Great Britain, which was not invited, as its telegraph networks were

privately owned—a telling parallel to today’s Internet problems)

agreed on a set of standards that all the nations using telegraphy

would follow. These agreements included uniform tariffs for inter-

national telegrams, the right of privacy for all correspondence, and

the international use of Morse code (the German version). A  new

governmental body, an International Telegraph Union (ITU), was to

be created to administer and monitor these efforts. It was to be led

by a Swiss engineer, Louis Curchod, who had impressed the others

at the Paris meeting with his wisdom and good cheer.

It was a landmark moment, both for international communica-

tion and cooperation, and news instantaneously spread around the

world, by telegraph of course. There was one caveat, however, to

this new concept of using an international organization to link peo-

ple together; the ITU agreement included a clause that nations “also

reserved the right to stop any transmission that they considered

dangerous for state security, or in violation of national laws, public

order or morals.” The ITU helped ensure a new era of global com-

munication, but it also made sure that the old governments would

stay in control of it.

There is a notion that the Internet is a place without boundar-

ies, where governments do not matter and therefore do not belong.

John Barlow of the Electronic Frontier Foundation perhaps cap-

tured this sentiment best in his “Declaration of the Independence

of Cyberspace.” “Governments of the Industrial World, you weary

giants of fl esh and steel. . . . I  ask you of the past to leave us alone.

You are not welcome among us. You have no sovereignty where we

gather. . . . Cyberspace does not lie within your borders. . . . You claim

there are problems among us that you need to solve. You use this

claim as an excuse to invade our precincts. Many of these problems

don’t exist. Where there are real confl icts, where there are wrongs,

we will identify them and address them by our means.”

oxfordhb-9780199918096.indd 181oxfordhb-9780199918096.indd 181 21-10-2013 22:38:1821-10-2013 22:38:18

182 CYBERSECURITY AND CYBERWAR

The problem with this thinking is twofold. First, governments

have seen the Internet become crucial to global commerce and

communication but even more so to their own national security

and economic prosperity. And so, even if they’re unwanted, they

are involved, simultaneously solving and creating real problems in

cyberspace. Second, as international relations expert Robert Axelrod

writes, while there may be no actual physical territory or borders

in cyberspace, these governments “have woken up to an interest-

ing fact:  every node of the network, every router, every switch is

within the sovereign borders of a nation-state and therefore sub-

ject to its laws or travels on a submarine cable or satellite con-

nection owned by a company that is incorporated in a sovereign

nation-state and therefore subject to its laws. In other words, there is

no non-sovereign, ‘free’ part of cyberspace.”

The outcome of this is an important shift. Countries have long

sought to control the Internet within their own borders, both legally

and operationally. As a report from the Internet Governance Project

described, “That’s why Bradley Manning is in jail and WikiLeaks is

persecuted; that’s why China constructed the Great Firewall; that’s

why South Korea censors Internet access to North Korea and vice

versa; that’s why France prosecuted Yahoo for displaying Nazi

memorabilia.”

What has recently emerged is a push for regime change at the

international level of cyberspace. The ostensible reason is cybersecu-

rity. Much as with the origin of the ITU, there is a need to foster bet-

ter technical coordination in the use and misuse of this cross-border

technology. In reality, there is also an underlying issue of control,

driven by many governments’ discomfort with the mostly nongov-

ernmental structures behind Internet governance.

Fred Tipson is a Special Adviser to the Center for Science,

Technology and Peacebuilding at the US Institute of Peace, who has

also worked at the United Nations and Microsoft. As he explains,

the basic problem is that “Many governments view the unrestricted,

un-channeled, uncontrolled dimensions of the Internet to be an aber-

ration to be contained or even undone, not a wave of the future.” As

an illustration, China Youth Daily , a major newspaper owned by the Chinese Communist Party that often acts as a voice for the regime,

has noted the need for China to “express to the world its princi-

pled stance of maintaining an ‘Internet border’ and protecting its

oxfordhb-9780199918096.indd 182oxfordhb-9780199918096.indd 182 21-10-2013 22:38:1821-10-2013 22:38:18

What Can We Do? 183

‘Internet sovereignty,’ unite all advanced forces to dive into the rag-

ing torrent of the age of peaceful use of the Internet, and return to

the Internet world a healthy, orderly environment.”

Because they see the problem as an international matter between

states, the mechanism for much of this push for governmental con-

trol over the Internet has come at international institutions of states.

And here is where the ITU, still functioning a century and a half

after its formation, comes back into the story. In the time since its

creation, the ITU moved from regulating telegrams sent over wires,

to telephones, to messages sent wirelessly over radio, to now what

it calls “Information and Communication Technologies,” and so

renamed itself the International Telecommunications Union.

This issue came to a head at the December 2012 meeting of the

ITU. The nations of the world gathered in Dubai to renegotiate the

International Telecommunication Regulations, ITU agreements that

had governed telecommunications between nations. At the meet-

ing, nations like Russia, China, Sudan, and others pushed for the

Internet to be included in the ITU’s responsibilities, giving countries

the right to manage how the Internet was structured. Cybersecurity

was at the center of their rationale, with these countries arguing that

it was a step in the natural evolution of the ITU (from telegrams to

radio to telephones, etc.) to help manage the Internet in its contin-

ued mission in order to build “confi dence and security in the use of

international communications technologies.”

This proposed expansion, though, was a big deal. It would change

the nature of Internet governance, in essence giving governments

sweeping powers. Governments (not the community of nonstate,

nonprofi t organizations that you read about in Part I, which had pre-

viously managed the Internet) “would be ultimately responsible for

making sure that people trying to reach a given website actually get

there.” Or, more worrisome, given the track record of the autocratic

nations pushing the proposal, they could also ensure that people

trying to reach a given website didn’t get there. The fear was that,

much as with telegraphs, governments could control not just access

within their nations but also across borders.

The result is that the usually placid ITU has instead become a

tense battleground of what the Economist magazine called “a digital version of the Cold War.” Notably, the two sides were actually the

same primary nations that had been divided by the Iron Curtain.

oxfordhb-9780199918096.indd 183oxfordhb-9780199918096.indd 183 21-10-2013 22:38:1821-10-2013 22:38:18

184 CYBERSECURITY AND CYBERWAR

The United States, Europe, and other allies like Australia and Japan

worried that cybersecurity fears were being misused to restrict free-

dom. They argued that the ITU should not even mention the word

“Internet” and just stick to regulating traditional telecommunica-

tions such as international phone calls.

ITU agreements had a tradition of being decided by consensus,

even during the height of the Cold War. But so far, cyberspace at the

ITU has proven anything but consensus oriented. When the 2012

summit vote broke with tradition and was decided by majority vote

instead of consensus, the bloc of allies angrily walked out of the

meeting (yes, it was ironic the democratic countries were upset by a

vote). So the proposal to have the ITU expand its role into cyberse-

curity issues passed, but with only half the world’s nations on board

and few of these being major Internet powers, most notably miss-

ing the very nation that had invented it. This uninspiring collection

didn’t stop the new ITU from issuing a press release claiming, “New

global telecoms treaty agreed in Dubai.”

The questions of what roles old international organizations

should play when it comes to the Internet will remain with us for

years to come. At the time of this book’s writing, the new treaty still

needs to be ratifi ed by a number of the signatory states to become

binding (a process that can take years), and it is unclear how it could

be globally enforced with so many important states in opposition.

The ITU also looks to be worse off for the episode, which is a shame.

Not only has the nearly 150-year-old organization been a valuable

player in global cooperation, but lost in the imbroglio were a num-

ber of positive steps that all could agree on, because of their benefi t

to all, such as agreements to spread fi ber-optic networks to expand

and speed Internet access. This points to the need to return the ITU

to its more traditional mode of decision-making and focus on areas

of consensus.

The bigger, longer-term issue is whether that will be possible. The

world is dividing into very different visions of the Internet and its

governance. One, coming largely from more authoritarian countries,

wants “to turn back the clock and regain sovereignty over their own

national bits of the Internet.” The alternative vision, coming largely

from democratic states, sees the very openness of the Internet as

the key to its success, allowing it to evolve to meet its users’ virtual

wants and needs, regardless of their physical location in the world.

oxfordhb-9780199918096.indd 184oxfordhb-9780199918096.indd 184 21-10-2013 22:38:1821-10-2013 22:38:18

What Can We Do? 185

The interplay between these two global visions is what makes

understanding the true issues and problems of cybersecurity so

crucial. As one report on the future of Internet concluded, “Just as

an appeal to patriotism was once described as the ‘last refuge of a

scoundrel,’ all kinds of scoundrelly proposals to stifl e free expres-

sion, invade privacy, abolish anonymity, restrict new businesses,

and elevate state power invoke cybersecurity as the rationale. At

the same time, who can oppose efforts to improve the security and

privacy of digital services and the Internet infrastructure? Thus,

discussions of cybersecurity must be careful and measured in their

approach. They should be grounded in an awareness that there is a

legitimate need for action, but mindful of the abuses and manipula-

tions that can masquerade under the banner of security.”

“Graft” the Rule of Law: Do We Need a Cyberspace Treaty?

“The rules of aerial warfare apply to all aircraft, whether lighter or

heavier than air, irrespective of whether they are, or are not, capable

of fl oating on the water.” 

This is how the 1923 Hague Rules on Aerial Warfare begins. The

treaty was written just a decade after the strange new invention of

fl ying machines were introduced to war, but today it still serves as

“the basis of all current regulation of air warfare.”

The use of the Internet is now well past the time it took for the

use of the air to lead to the Hague Rules, leading many to argue that

cyberspace is in need of an equivalent international treaty, or what

some call a kind of Internet version of the Hague Rules, or a “cyber

Geneva Convention,” as some call it. “We have reached a tipping

point on cybersecurity,” says Neil Fisher, Vice President of Global

Security Solutions at Unisys in London. “It is now a signifi cant threat

to a lot of economies. So getting an international agreement on what

constitutes normal behaviour is now badly needed.” Or, as one US

government offi cial writes, “With the risk of discovery almost nil, a

disputed legal status, and little in the way of unifi ed international

law enforcement collaboration, the cyber domain is today’s equiva-

lent of the untamed American West during the 1800’s.”