1 of 27

CYBER WARFARE

Miguel Opeña

2 of 27

What is cyber warfare?

How is it unique as warfare?

What are its future directions?

How can you help?

3 of 27

BIAS DISCLOSURE

4 of 27

What is cyber warfare?

How is it unique as warfare?

What are its future directions?

How can you help?

5 of 27

Cyber warfare: A digital attack against a nation-state that is likely to cause, or does cause, harm

My personal definition is the following ^ but it’s a bit hacky, there’s no clean-cut definition, and mine deserves a little bit of parsing to understand it fully. One reason is that my definition somewhat misuses the term “warfare”, in that many cyber warfare techniques are not proper acts of war, for the most part.

Nation-state: This does not outright exclude hacks against companies. As we’ll see shortly, digital attacks can occur against companies can meet the political goals of a nation-state, like when China’s military tries to spy on American companies to acquire sensitive data and trade secrets. Likewise, a hypothetical cyberattack against American power grid companies might be considered an act of war because of its broader implications for American citizens.

Likely to cause harm: Unlike other modes of warfare, cyber warfare is not guaranteed to result in physical destruction. This can happen, as in the Stuxnet worm, but it’s really quite rare. Other kinds of harm include informational harm (e.g., leaking or destroying important information), psychological/social harm (e.g., loss of faith in institutions, reduced sense of safety), and economic harm (e.g., extorting a ransom).

Digital attack: Some call it hacking, others don’t, but “digital attack” really makes the most sense here. More on this later.

6 of 27

Nation-State

Adversaries

7 of 27

8 of 27

One intent of cyberattack is subversion, a systematic undermining of the established social order. Subversion has been around for millennia, but the rise of computer technologies and the Internet has made subversion far easier. Dissident movements can amass forces, spread propaganda, and perform hacks on a global scale, without taking the huge risk of an in-person gathering.

Cyber subversion can take many forms. You all might be familiar with the hacker group known as Anonymous. They are one of the best examples of a non-state actor subverting the social order. They set an intention and hack a target along those lines. They’ve gone after targets for moral reasons, such as ISIS, websites that host CSAM, and websites run by neo-Nazis. The bulk of their activites involve hacking government agencies at the state level and national level, including the US, Canada, Israel, and others. Subversion also describes the actions of Putin’s Russia and their attempts to destabilize American democracy. However, I’ll talk more about that on the next slide.

9 of 27

ESPIONAGE

Espionage is far older than anything computer-related, but it has been a driving force behind all kinds of cyberattacks. Thanks to Edward Snowden, it’s no secret that American intelligence agencies, especially the NSA, have incredibly sophisticated surveillance and espionage capabilities. One of these capabilities is called IRATEMONK, which enables an attacker to keep their software on the victim’s device, even if the hard drive has been wiped. It harnesses a vulnerability in the firmware of many well-known brands of hard drives. Technologies like this ensure that, for example, the attacker can spy on a victim unless they physically destroy their own hard drive.

Espionage is done by other nation-states. Russia-backed hackers leaked emails from high-ranking members of the US Democratic Party, as part of Putin’s broader strategy to destabilize our democracy. In that case, the attacker both collected information and disseminated it, a notable exception to the general practice of nation-states collecting and analyzing information, keeping almost all of it out of the public eye.

10 of 27

There’s only a handful of confirmed cases where cyberattack has been used for sabotage. I choose Stuxnet because it’s one of the most vivid examples, and there’s a lot behind it. Back in 2005, the United States and Israel teamed up to seek vulnerabilities in the industrial control software that Iran relies on for its state-run nuclear program. They created a worm, later called Stuxnet, that infected over 200,000 computers. The worm was extremely sophisticated, as it would only activate upon detecting the specific software used to control gas centrifuges (see below). The centrifuges were driven to speeds beyond operational limits, then rapidly decelerated. In total, roughly 1,000 centrifuges were damaged by Stuxnet. Stuxnet also contained many design elements intended to limit its spread (e.g., self-destruct code), but it was discovered in 2010, and its code is on the Internet for anyone to download and play with.

Centrifuges: Gaseous uranium hexafluoride is spun at high speed, which separates heavier uranium-238 from lighter uranium-235. This is a key step in the nuclear fuel enrichment process. Virtually all enriched uranium in the world is made by these gas centrifuges.

Zero-day: An exploit/vulnerability within a piece of software that the software creators do not know about. Nation-states and unaffiliated hackers love finding and collecting zero-day vulnerabilities, to be used when it’s most beneficial. (Stuxnet harnessed four zero-days in MS Windows and Siemens software.) The problem is, once the exploit is used, someone will find out, and eventually the software creators will patch the vulnerability; all zero-days are one-trick ponies, one-shot weapons. Similarly, stealing someone else’s zero-days is often sufficient motivation for a cyberattack.

11 of 27

What is cyber warfare?

How is it unique as warfare?

What are its future directions?

How can you help?

12 of 27

Attribution means, “Who did it?” After a military action occurs, every country has a desire to learn who did it. There are multiple motivations: to understand the movements of adversaries (situational awareness), to initiate a counterattack (retaliation), and to maintain global accountability regarding military actions.

In cyber warfare, attribution is both easier and harder. The figure shows a few examples of past cyber-attacks, along with a few qualitative dimensions that help identify who likely did the attack. As you can see on the bottom incident, there might not always be enough information to make a “beyond-reasonable-doubt” attribution.

Easier: Adversaries leave “fingerprints” in their code, or design patterns that typically suggest who wrote the code. It comes down to the software engineering practices and designs that are relatively unique to the small group of state-backed hackers who built that code. Also, there are some scenarios where an attacker would directly attribute themselves, whether to make a statement, cause fear, or achieve some other goal.

Harder: Even before attribution, it’s hard to know when a cyber attack has happened. A well disguised piece of attack code will remain hidden, quietly exfiltrating data or manipulating physical systems with as little attention as possible. Also, network traffic can be easily routed through and around international borders, e.g., through servers owned or seized by the attacker. There’s no smoking gun like a satellite image that can alert a victim as to who the attacker was. Worst of all, attackers might pretend to be someone else (e.g., China hacks the US power grid while pretending the code was sent from and written by Iran), which can lead to scapegoating and escalation with few immediate repercussions for the actual attacker.

13 of 27

PROPORTIONALITY

An uncomfortable reality of warfare is that it results in civilian casualties. The concept of proportionality states that civilian harm due to an attack must be proportional to the military gains that the attack brings. In particular, a military attack must not lead to excessive civilian death and destruction; that would be a war crime under international laws and treaties.

The picture I’ve chosen is a historical example from the firebombing of Tokyo during WWII. The military gains of this attack were to disable Tokyo’s contributions to Japan’s war industry. In this specific sense, the attack worked, cutting the city’s productivity in half. However, it led to roughly equal destruction of both commercial and residential neighborhoods, culminating in a death toll of 100,000. With the benefit of hindsight, some believe that this was a war crime, that the civilian deaths were excessive compared to the military gains.

The difficulty of viewing cyber warfare through proportionality is that civilian deaths just don’t happen due to cyberattacks. Few deaths have been properly attributed to cyberattacks, and none of those involved a military target. I’m not trying to discount the possibility that this might happen in the future, but it doesn’t happen today, which makes it harder to think about. I subscribe to one particular argument, reframing proportionality in cyber warfare to focus on harm done beyond humans and physical structures. I believe one can argue that modern information systems are so embedded into human society and culture, that they should be held to the same level as physical structures. In that sense, a higher standard is raised for cyber warfare: even something as physically unharmful as wiping data should be treated seriously by both attacker and defender.

This raises the question as to how countries should respond when a cyberattack causes informational and physical damage: When should they respond in kind with a cyberattack, and when should they escalate to kinetic warfare?

14 of 27

Discernment refers to the age-old problem of distinguishing military combatants and civilians. Even today, with advanced sensing technologies like drones and satellites, it’s hard to distinguish combatants and civilians. This picture from a drone feed is a good example. Let’s say your human intelligence sources tell you that one of those houses contains a terrorist cell, and the rest are civilians. How do you know which house to destroy? How can you be sure before you strike? How can you check after the fact, and how should you be held accountable if you are wrong?

In cyber warfare, proper discernment should be easy, right? Code is code; you can use code to tell whether a worm should reproduce on a specific machine, whether the network you’re in belongs to a military target, etc. In practice, it’s not that simple. Except for the most protected and isolated computer networks, most military networks are connected to civilian networks. In those cases, attacking the network might have evident strategic value, even if one cannot guarantee civilian damage.

Furthermore, what if the adversary does not care to discern? Civilian targets are extremely appealing, ranging from the servers of corporations to the personal data of private citizens. Worse still, civilian targets tend to have terrible defenses, and they are much less capable of repairing damages after an attack. In some versions of a cyber war, adversaries will go directly for civilian targets, finding civlians’ weak defenses and slow recovery to work in their favor, far more than a military attack would. This has already happened, and it appears to be a popular mode of cyber warfare. (Contentious opinion: Maybe the reason why we haven’t seen all-out cyber warfare is because both the US and our adversaries usually poke and prod at civilian, usually corporate, targets.)

15 of 27

What is cyber warfare?

How is it unique as warfare?

What are its future directions?

How can you help?

16 of 27

One emerging technology is the Internet of Things: a new framing of technology that espouses interconnected “smart” devices. Imagine a fridge that can scan its contents and draw up a shopping list for you. Imagine a speaker that can hear commands and feed them to an artificially intelligent agent, like Alexa. IoT is appealing to consumers for reasons of convenience, but it’s also appealing to enterprise customers. There are many problems in industry where having a network of IoT-connected machines and sensors can be useful. (Think remote monitoring, quality control, and remote control.)

Unfortunately, IoT is a moderate disaster in terms of information security. It’s bad. Consumer smart devices can be hacked, turning Amazon Echos and baby monitors into omniscient spyware. Industrial smart devices can be hacked, creating misleading sensor outputs and causing physical systems to go haywire. Hackers backed by Putin or the CCP are probably imagining, if not planning, a cyberattack on the United States electrical grid. If insecure IoT devices continue to be introduced into our critical infrastructure, that attack will be extremely easy. Fortunately, I get the sense that new devices are more secure. It remains to be seen whether private-sector incentives will sustain a supply and a demand for IoT devices with better security.

17 of 27

“Whoever becomes the leader in AI will become the ruler of the world.”

18 of 27

“Whoever becomes the leader in AI will become the ruler of the world.”

—Vladimir Putin

19 of 27

AI can learn behavior patterns for users and agents.

However, AI can’t defend a network without human help.

This might change in the future, but it might not.

Modern infosec products already use AI to defend against hackers. These AIs learn patterns to understand what behavior qualifies as “normal”, and what qualifies as “suspicious”. For example, if a system is intended for use by humans only, then a rapid sequence of repeated login attempts is probably an autonomous agent, hence it should be classified as suspicious.
These technologies are still limited. I don’t think there are any examples of a useful, fully autonomous AI that defends a network from attack 24/7. In short, we’re nowhere close to Skynet.
I can foresee companies adopting such fully-autonomous solutions if they feel it will be safer to do so. However, those technologies relinquish so much human decision-making and control, that it would take something truly drastic, like AI-powered attack code, for this to come about. There’s also a question of effectiveness: it will take a long time before a fully autonomous AI is more effective than humans+computers or humans+AIs.

20 of 27

The third emerging technology to think about is quantum computing. The underlying mathematics of information security is called cryptography. Many building blocks of cryptography, like encryption and digital signatures, rely on mathematical problems that are intractable for non-quantum computers, but are much easier for a sufficiently advanced quantum computer (e.g., factoring semiprime numbers, solving polynomials in finite fields). However, depending on who you ask, a quantum computer with enough quantum bits (“qubits”) to solve thse problems is far away, on the order of 10-100 years away.

On the other hand, ther are ways around this problem. Even if you’re optimistic that QC will happen soon, it will take much longer before everyone has a QC in their home office. QC is already a cloud service, and it will remain so for much time. Companies can and should restrict how the product is used, e.g., by preventing users from factoring large numbers.

Side note: If quantum computing facilitates the development of an intelligent connectionist AI, that would permanently change the landscape of information security and cyber warfare in non-obvious ways.

21 of 27

FUTURE PARADIGMS

22 of 27

What is cyber warfare?

How is it unique as warfare?

What are its future directions?

How can you help?

23 of 27

Disclose hacks of your organization.

Consistent funding, periodic training.

Work with the federal government*.

If you get hacked, spread the word. There are several reasons to disclose a hack. You can help infosec firms/researchers begin conducting forensics and building defenses. You can help the federal government trace and prosecute the attackers and their conspirators. Basically, you’ll be helping prevent future harm. Don’t try to save face by hiding the hack. Sure, your share price might dip, and you might lose customers. However, you will probably lose even more reputation by hiding the hack and getting exposed for doing so.
Getting hacked is basically inevitable, but it doesn’t have to be damaging. Fund your infosec team, give them a seat at the table. Train your entire staff, down to the lowest people on the org chart. Be on the lookout for ”less technical” cyberattacks, like phishing and other forms of social engineering and deceit.
Work with the federal government, within reason. Share information, set up cloud contracts, develop tools that appeal to public- and private-sector customers. BUT, don’t do shady shit like building encryption backdoors into your customers’ systems, or giving away customer data without a compelling reason.

24 of 27

CYBER WARFARE

Miguel Opeña

25 of 27

26 of 27

27 of 27

READING LIST

Army of None: Autonomous Weapons and the Future of War (P. Scharre, 2015)
Contemporary World Issues: Cyber Warfare (Paul J. Springer, 2015)
Encyclopedia of Cyber Warfare (Paul J. Springer, 2017)
Ethics and Policies for Cyber Operations (M. Taddeo and L. Glorioso, 2017)
The Fifth Domain (R.A. Clarke and R.K Knake, 2019)
Cyber War Will Not Take Place (Thomas Rid, 2013)
Hostile Social Manipulation (RAND Corporation, 2019)
Deterring Cyber Warfare (Brian Mazanec and Bradley Thayer, 2015)