Cyber Warfare: Everything you need to know about the frightening future of digital conflict.
In cyberwarfare every gadget you own could be turn into a weapon on a virtual battlefield and the damage will be felt in the real world. Today's security threats have expanded in scope and seriousness. There can now be millions of British Pounds at risk when information security isn't handled properly.
Cyberwarfare refers to the use of digital attacks -- like computer viruses and hacking -- by one country to disrupt the vital computer systems of another, with the aim of creating damage, death and destruction. Future wars will see hackers using computer code to attack an enemy's infrastructure, fighting alongside troops using conventional weapons like guns and missiles.
A dark world that is still filled with spies, hackers and top-secret digital weapons projects, cyberwarfare is an increasingly common -- and dangerous -- feature of international conflicts. But right now, the combination of an ongoing cyberwarfare arms race and a lack of clear rules governing online conflict means there is a real risk that incidents could rapidly escalate out of control.
What does cyberwarfare look like?
Just like normal warfare which can range from limited skirmishes to full-on battles, the impact of cyberwarfare will vary by target and severity. In many cases the computer systems are not the final target -- they are being targeted because of their role in managing real-world infrastructure like airports or power grids. Knock out the computers and you can shut down the airport or the power station as a result.
There are plenty of grim cyberwarfare scenarios available. Perhaps attackers start with the banks: one day your bank balance drops to zero and then suddenly leaps up, showing you've got millions in your account. Then stock prices start going crazy as hackers alter data flowing into the stock exchange. The next day the trains aren't running because the signalling stops working, and you can't drive anywhere because the traffic lights are all stuck on red, and the shops in big cities start running out of food. Pretty soon a country could be reduced to gridlock and chaos, even without the doomsday scenarios of hackers disabling power stations or opening dams.
Nearly every system we use is underpinned in some way by computers, which means pretty much every aspect of our lives could be vulnerable to cyberwarfare at some point.
Why are governments investing in cyberwarfare right now?
Governments are increasingly aware that modern societies are so reliant on computer systems to run everything from financial services to transport networks that using hackers armed with viruses or other tools to shut down those systems could be just as effective and damaging as traditional military campaign using troops armed with guns and missiles.
Unlike traditional military attacks, a cyberattack can be launched instantaneously from any distance, with little obvious evidence of any build-up, unlike a traditional military operation. Such as attack would be extremely hard to trace back with any certainty to its perpetrators, making retaliation harder.
As a result governments and intelligence agencies worry that digital attacks against vital infrastructure – like electricity Power grids or banking systems will give attackers a way of bypassing a country's traditional defences, and are racing to improve their computer security.
However, they also see the opportunity that cyberwarfare capabilities bring, offering a new way to exert influence on rival states without having to put soldiers at risk. The fear of being vulnerable to the cyberweapons of their rivals plus a desire to harness these tools to bolster their own standing in the world is leading many countries into a cyber arms race.
What is -- and what is not -- cyberwarfare?
Whether an attack should be considered as an act of cyberwarfare depends on a number of factors. These include the identity of the attacker, what they are doing, how they do it -- and how much damage they inflict.
Like other forms of warfare, cyberwarfare in its purest sense is usually defined as a conflict between states, not individuals. To qualify the attacks really should be of significant scale and severity.
Digital Arms Race
If cyberwarfare is best understood as serious conflict between nations, that excludes a lot of the attacks that are regularly and incorrectly described as cyberwarfare.
Attacks by individual hackers, or even groups of hackers, would not usually be considered to be cyberwarfare, unless they are being aided and directed by a state. Still, in the murky world of cyberwarfare there are plenty of blurred lines: states providing support to hackers in order to create plausible deniability for their own actions is, however, a dangerously common trend.
One example: cyber crooks who crash a bank's computer systems while trying to steal money would not be considered to be perpetrating an act of cyberwarfare, even if they come from a rival nation. But state-backed hackers doing the same thing to destabilise a rival state's economy might well be considered so.
The nature and scale of the targets attacked is another indicator: defacing an individual company's website is unlikely to be considered an act of cyberwarfare, but disabling the missile defence system at an airbase would certainly come at least close.
The weapons used are important, too -- cyberwarfare refers to digital attacks on computer systems: firing a missile at a data center would not be considered cyberwarfare, even if the data center contained government records. And using hackers to spy or even to steal data would not in itself be considered an act of cyberwarfare, and would instead come under the heading cyber espionage, something which is done by nearly all governments.
For sure there are many grey areas here (cyberwarfare is basically one big grey area anyway), but calling every hack an act of cyberwar is at best unhelpful and at its worst is scaremongering that could lead to dangerous escalation.
Cyberwarfare and the use of force
Why the who, what and how of cyberwarfare matters is because how these factors combine will help determine what kind of response a country can make to a cyberattack.
There is one key formal definition of cyberwarfare, which is a digital attack that is so serious it can be seen as the equivalent of a physical attack.
To reach this threshold, an attack on computer systems would have to lead to significant destruction or disruption, even loss of life. This is the significant threshold because under international law, countries are allowed to use force to defend themselves against an armed attack.
It follows then that, if a country were hit by a cyberattack of significant scale, the government is within its rights to strike back using the force of their standard military arsenal: to respond to hacking with missile strikes perhaps.
So far this has never happened -- indeed it's not entirely clear if any attack has ever reached that threshold. Even if such an attack occurred it wouldn't be assumed that the victim would necessarily strike back in such a way, but international law would not stand in the way of such a response.
That doesn't mean attacks that fail to reach that level are irrelevant or should be ignored: it just means that the country under attack can't justify resorting to military force to defend itself. There are plenty of other ways of responding to a cyberattack, from sanctions and expelling diplomats, to responding in kind, although calibrating the right response to an attack is often hard (see cyber deterrence, below).
What do cyberweapons look like?
Imaging the smartest hackers with the biggest budgets aiming to break the biggest systems they can; that's what the high end of cyber weapons can look like -- projects involving teams of developers and millions of dollars. But there are very, very few of these. In general the tools of cyberwarfare can vary from the incredibly sophisticated to the utterly basic. It depends on the effect the attacker is trying to create.
Many are part of the standard hacker toolkit, and a series of different tools could be used in concert as part of a cyberattack. For example, a Distributed Denial of Service (DDoS) attack was at the core of the attacks on Estonia in 2007.
Other standard hacker techniques are likely to form part of a cyberattack; phishing emails to trick users into handing over passwords or other data which can allow attackers further access to networks, for example. Malware and viruses could form part of an attack like the Shamoon virus, which wiped the hard drives of 30,000 PCs at Saudi Aramco in 2012.
Ransomware and cyberwarfare
Ransomware, which has been a constant source of trouble for businesses and consumers, may also have been used not just to raise money but also to cause chaos. Perhaps one of the most unexpected twists recently has been the use of weaponised ransomware to destroy data. The US, UK and a number of other governments blamed Russia for the NotPetya ransomware outbreak which caused havoc in mid-2017.
Cyberwarfare and zero-day attack stockpiles
Zero-day vulnerabilities are bugs or flaws in code that can give attackers access to or control over systems, but which have not yet been discovered and fixed by software companies. These flaws are particularly prized because there will likely be no way to stop hackers exploiting them. There is a thriving trade in zero-day exploits that allow hackers to sidestep security: very handy for nations looking to build unstoppable cyber weapons. It is believed that many nations have stock piles of zero day exploits to use for either cyber espionage or as part of elaborate cyber weapons. Zero day exploits formed a key part of the Stuxnet cyberweapon (see below).
One issue with cyber weapons, particularly those using zero-day exploits is that -- unlike a conventional bomb or missile -- a cyber weapon can be analysed and even potentially repurposed and re-used by the country or group it was used against.
One good example of this is shown by the WannaCry ransomware attack which caused chaos in May 2017. The ransomware proved so virulent because it was supercharged with a zero-day vulnerability that had been stockpiled by the NSA, presumably to use in cyber espionage. But the tool was somehow acquired by the Shadow Brokers hacking group (quite how is extremely unclear) which then leaked it online. Once this happened other ransomware writers incorporated it into their software, making it vastly more powerful.
This risk of unexpected consequences mean that cyber weapons and tools have to be handled -- and deployed -- with great care.
Is cyberwarfare escalation a concern?
There is a definite risk that we are at the early stages of a cyberwarfare arms race: as countries realise that having a cyberwarfare strategy is necessary they will increase spending and start to stockpile weapons, just like any other arms race. That means there could be more nations stockpiling zero-day attacks, which means more holes in software not being patched, which makes us all less secure. And countries with stockpiles of cyber weapons may mean cyber conflicts are able to escalate quicker. One of the big problems is that these programmes tend to be developed in secret with very little oversight and accountability and with mirky rules of engagement.
What are the targets in cyberwarfare?
Military systems are an obvious target: preventing commanders from communicating with their troops or seeing where the enemy is would give an attacker a major advantage.
How do you defend against cyberwarfare?
The same cybersecurity practices that will protect against everyday hackers and cyber crooks will provide some protection against state-backed cyberattackers, who use many of the same techniques.
That means covering the basics: changing default passwords and making passwords hard to crack, not using the same password for different systems, making sure that all systems are patched and up-to-date (including the use of antivirus software), ensuring that systems are only connected to the internet if necessary and making sure that essential data is backed up securely. This may be enough to stop some attackers or at least give them enough extra work to do that they switch to an easier target.
Recognising that your organisation can be a target is an important step: even if your organisation is not an obvious target for hackers motivated by greed (who would hack a sewage works for money?), you may be a priority for hackers looking to create chaos.
However, for particularly high-value targets this is unlikely to be enough: these attacks are called 'advanced and persistent'. In this case it may be hard to stop them at the boundary and additional cybersecurity investments will be needed: strong encryption, multi-factor authentication, and advanced network monitoring. It may well be that you cannot stop them penetrating your network, but you may be able to stop them doing any damage.
At a higher level, nations and groups of states are developing their own cyber defence strategies. The European Union recently announced plans to work on a cyber defence plan which it will invoke if it faces a major, cross-border cyberattack, and plans to work with NATO on cyber defence exercises. However, not all nations consider such planning to be a particularly high priority.
More broadly, to prevent cyberwar incidents, countries need to talk more: to understand where the boundaries lie and which kinds of behaviour are acceptable. Until that is done there is always the risk of misunderstanding and escalation.
What is cyber deterrence?
Just as nations attempt to deter rivals from attacking in conventional weapons, so countries are developing the concept of cyber deterrence to help to prevent digital attacks from occurring in the first place -- by making the cost of the attack too high for any potential assailant.
One way of doing that is securing and hardening their own computer systems so that is becomes very hard -- and very expensive -- for any attacker to find weaknesses. Thanks to the swiss-cheese nature of so many computer systems the attackers will still have the advantage here.
The other option is to impose costs on the attackers through sanctions, criminal investigations or even the threat of striking back. Most recently the US in particular has been attempting to create deterrence through a policy of naming-and-shaming, in particular using indictments to name particular individuals it believes are responsible for carrying out state-backed cyber attacks.However, as hackers (from all nations) continue to poke and pry at the computer systems of their rivals, it would seem that cyber deterrence is at best a work in progress.
What is cyber espionage?
Closely related but separate to cyberwarfare is cyber espionage, whereby hackers infiltrate computer systems and networks to steal data and often intellectual property. There have been plenty of examples of this in recent years.
The aim of cyber espionage is to steal, not to do damage, but it's arguable that such attacks can also have a bigger impact. Law scholars are, for example, split on whether the hacks on the DNC and the subsequent leaking of the emails could be illegal under international law.
Some argue that it mounts up to meddling in the affairs of another state and therefore some kind of response, such as hacking back, would have been justified; others argue that it was just below the threshold required.
As such the line between cyberwarfare and cyber espionage is a blurred one: certainly the behaviour necessary is similar for both -- sneaking into networks, looking for flaws in software -- but only the outcome is different; stealing rather than destroying. For defenders it's especially hard to tell the difference between an enemy probing a network looking for flaws to exploit and an enemy probing a network to find secrets.
Cyberwarfare and information warfare
Closely related to cyberwarfare is the concept of information warfare; that is, the use of disinformation and propaganda in order to influence others -- like the citizens of another state. This disinformation might use documents stolen by hackers and published -- either complete or modified by the attackers to suit their purpose. It may also see the use of social media (and broader media) to share incorrect stories.
When will cyberwar take place?
Some argue cyberwarfare will never take place; others argue cyberwarfare is taking place right now. The truth is of course somewhere in the middle.
Cyberwarfare operations will remain extremely rare, but already the concept has become absorbed into the broader set of military options that exist, just like other new technologies, such as submarines and aircraft, in the past.
It's possible that cyber weapons may also become a more common feature of low intensity skirmishes between nations because they are capable of causing confusion and chaos but not (too) much damage. But it's unlikely that a war would ever be fought purely with digital weapons because they are too expensive and hard to control and of limited impact.
That doesn't mean cyberwarfare is irrelevant -- rather that some kind of cyberwarfare