The IT Law Wiki
Don't have an account?
Register
Advertisement
Register
in: Military, Security, Definition,
and 3 more

Cyberwarfare

Edit
“ Although it is a man-made domain, cyberspace is now as relevant a domain for DoD activities as the naturally occurring domains of land, sea, air and space. There is no exaggerating our dependence on DoD's information networks for command and control of our forces, the intelligence and logistics on which they depend, and the weapons technologies we develop and field. In the 21st century, modern armed forces simply cannot conduct high-tempo, effective operations without resilient, reliable information and communication networks and assured access to cyberspace.[1] ”

Definitions[]

Cyberwarfare (CyW or CyberWar)) is

“ [a]ny act intended to compel an opponent to fulfill our national will, executed against the software controlling processes within an opponent's system. CyW includes the following modes of cyber attack: cyber infiltration, cyber manipulation, cyber assault, and cyber raid. ”
“ [t]he component of CyberOps that extends cyber power beyond the defensive boundaries of the GIG to detect, deter, deny, and defeat adversaries. CyberWar capabilities target computer and telecommunication networks and embedded processors and controllers in equipment, systems, and infrastructure. CyberWar uses CyE, CyA, and DCyD in a mutually supporting and supported relationship with CyNetOps and CyberSpt.[2] ”
“ conducting, and preparing to conduct, military operations according to information-related principles. It means disrupting if not destroying the information and communications systems, broadly defined to include even military culture, on which an adversary relies in order to "know" itself: who it is, where it is, what it can do when, why it is fighting, which threats to counter first, etc. It means trying to know all about an adversary while keeping it from knowing much about oneself. It means turning the "balance of information and knowledge" in one's favor, especially if the balance of forces is not. It means using knowledge so that less capital and labor may have to be expended.[3] ”
“ actions by a nation-state to penetrate another nation's computers or networks for the purposes of causing damage or disruption.[4] ”

Overview[]

Cyberwarfare can include defending information and computer networks, deterring information attacks, and denying an adversary the ability to do the same. It can include offensive information operations mounted against an adversary, or even dominating information in the battlefield. It also includes computer and network penetration, denial-of-service attacks on computers and networks, equipment sabotage through cyberspace, sensor jamming, and even manipulating trusted information sources to condition or control an adversary's thinking.

“ When determining whether a cyber attack is an act of cyber war, experts evaluate four key attack attributes:
  • Source: Was the attack carried out or supported by a nation-state?
  • Consequence: Did the attack cause harm?
  • Motivation: Was the attack politically motivated?
  • Sophistication: Did the attack require customized methods and/or complex planning?[5]
 ”

China[]

China is moving aggressively toward incorporating cyberwarfare into its military lexicon, organization, training, and doctrine. In fact, if a Revolution in Military Affairs (RMA) is defined as a significant change in technology taken advantage of by comparable changes in military training, organization, and doctrine, then perhaps China of all nations is experiencing a true RMA in cyberspace. Moreover, China’s warfare development has cause some U.S. military leaders to express concern. For instance, Gen. Eberhart, who heads U.S. Space Command, said the U.S. military is concerned about China’s intentions and is worried about China’s developing the means to carry out computer network attacks.[6]

The Chinese concept of cyberwarfare incorporates unique Chinese views of warfare based around the People’s War concept (modern) and the 36 Strategems (ancient). Both are indigenous views of how to wage war at the strategic, operational, and tactical level. China also is heavily influenced by Marxist-Leninist ideology regarding warfare. Much of its approach has to do with an emphasis on deception, knowledge-style war, and seeking asymmetrical advantages over an adversary. Cyberwarfare is seen as a “transformation from the mechanized warfare of the industrial age to . . . a war of decisions and control, a war of knowledge, and a war of intellect.”[7]

China is pursuing the concept of a Net Force (battalion size), which would consist of a strong reserve force of computer experts trained at a number of universities, academies, and training centers. Several large annual training exercises have already taken place since 1997. The Chinese have placed significant emphasis on training younger persons for these tasks.

France[]

The French apparently view cyberwarfare as having two main elements: military and economic (or civil) (full-text). The militari concept envisions a somewhat limited role for cyberwarfare activities. Their military concept sees cyberwarfare activities taking place largely in the context of low intensity conflict or operations other than war, undertaken generally within the framework of NATO and the United Nations (and often under the control of the United States). In this context, allies are not considered adversaries.

In contrast, the economic or civil concept includes a wider range of potential cyberwarfare applications. The French view seems to assume a much broader and deeper basis for conflict in the economic sphere; economic peace does not exist as much as an environment in which competitors pursue zero-sum market advantages. The French do not see themselves bound by NATO, UN, or U.S. approval. Their perspective toward economic conflict allows for one to be both an ally and an adversary at the same time. The French even have an economic school for information warfare (full-text).

France may also have a different perspective toward monitoring its citizens in cyberspace. Reports have surfaced that the French have their own version of Echelon (reportedly a U.S. effort — not officially verified — aimed at intercepting virtually all private global communications).[8] Frenchelon, as some have called it, reportedly is used to monitor and analyze French communications, especially in the Paris region.[9]

Germany[]

For the most part, the German perspective toward cyberwarfare is comparable to that of the United States and the UK.[10] It recognizes a legitimate role for offensive and defensive information warfare in pursuit of national objectives. Germany tends to be somewhat more systematic than the United States, however. For purposes of thinking about cyber threats and cyber responses, nation states are considered separately from non-state actors (such as political activists, international organizations, and the media), criminals (organized crime, hackers, etc.), and individual actors (including religious fanatics and special forces).

In two ways, however, German views toward information warfare may differ. Germany may include management of the media as an element of information warfare. In addition, Germany may be weighing a rationale for economic cyberwarfare similar to the French. This may be due to several reasons: Germany has assessed the potential for economic damage that can be done to German business and economy; Germany may have experienced significant economic losses to France over a case involving industrial espionage in cyberspace; and Germany may be seeking ways to mitigate the consequences of potential cyber attacks.

North Atlantic Treaty Organization (NATO)[]

Reportedly, there is a classified NATO definition of information warfare, but it is not publicly available. The development of such a definition is noteworthy given that at a NATO conference in early 2000, 17 different descriptions or definitions of IW were being used by the individual delegate countries. Generally, however, the NATO definition is believed to be compatible with the U.S. perspective.

Russia[]

Many Russians argue that the danger of cyberwarfare ranks second only to that of nuclear war. More than one senior Russian military officer has supported the notion that:

“ from a military point of view, the use of information warfare against Russia or its armed forces will categorically not be considered a non-military phase of a conflict whether there were casualties or not . . . considering the possible catastrophic use of strategic information warfare means by an enemy, whether on economic or state command and control systems, or on the combat potential of the armed forces . . . Russia retains the right to use nuclear weapons first against the means and forces of information warfare, and then against the aggressor state itself.[11] ”

Other Russians see a military role for cyberwarfare activities, where the goal is for competing sides to gain and hold information advantages over the other. This is accomplished by using specific information technology capabilities to affect an adversary’s information systems, decision making processes, command and control system, and even populace.[12] Some Russians believe that after conflict begins, “combat viruses and other information related weapons can be used as powerful force multipliers.”

More recently, on September 12, 2000, Russian President Vladimir Putin adopted the Russian Information Security Doctrine, which had been approved earlier at the June 23 meeting of the Russian Security Council. The new doctrine ostensibly provides the government with an enhanced legal framework for dealing with computer crime and assuring security in cyberspace. In another sense, this represents a partial attempt by Russia to deal with cyber threats it too faces from foreign and domestic sources.

United Kingdom (UK)[]

The UK view toward cyberwarfare is similar to that of the United States. Basically, it notes that information warfare refers to actions affecting others’ information systems while defending one’s own systems in support of national objectives.[13] Furthermore, the UK uses a legal framework based around a number of existing laws it believes largely can be applied to cyberspace activities.[14] This suggests that the U.K. views cyberattacks against individuals and corporations as civil and criminal issues that can be handled accordingly. More recently, the Regulation of Investigatory Powers Act 2000 (RIP), would allow the U.K. government to intercept and read e-mail, and require decryption of personal files on demand. The U.K. government says RIP puts

“ intrusive investigative techniques on a statutory footing for the very first time; provides new powers to help combat the threat posed by rising criminal use of strong encryption; and ensures that there is independent oversight of the powers in the Act. ”

United States[]

U.S. officials indicate that more than 20 countries have various kinds of information operations (IO) directed against the United States. The CIA has testified that adversaries are incorporating cyberwarfare[15] as a new part of their military doctrine. A declassified Navy threat assessment identifies Russia, China, India, and Cuba as countries who have acknowledged policies of preparing for cyberwarfare and who are rapidly developing their capabilities. North Korea, Libya, Iran, Iraq, and Syria reportedly have some capability, and France, Japan, and Germany are active in this field.[16]

The media and others often also warn of cyberterrorists waiting for the right moment to bring down the U.S. power, transportation, or communications grids. For example, at a hearing of the Joint Economic Committee on cyberterrorism that included the CIA (Feb. 23, 2000), Sen. Bob Bennett said, "attacks on American defense and industrial facilities in cyberspace are as real and dangerous as any conventional threat to economic prosperity and national security."

The U.S. government holds two major views on this subject. One view suggests that cyberthreats are primarily a national security problem in that major U.S. national interests and critical infrastructure are threatened. Historically, U.S. national military and diplomatic power has often been brought to bear to protect those interests. A case can also be made that cyberthreats to the United States similarly threaten U.S. national interests.

Another view holds that cyberthreats should be handled primarily by civil or domestic authorities. A major concern here is over a strong military role within the borders of the United States (as opposed to outside the borders). In addition, a variety of privacy and civil liberties concerns also raise concern over a stronger military role. In the past, threats to the United States from abroad could mostly be countered abroad. But today we live in an age where geographic borders are easier to broach and do not even exist in cyberspace. This represents a new challenge to decision makers.

“ This form of warfare may involve diverse technologies — notably for C3I; for intelligence collection, processing, and distribution; for tactical communications, positioning, and identification-friend-or-foe (IFF); and for "smart" weapons systems. . . . It may also involve electronically blinding, jamming, deceiving, overloading, and intruding into an adversary's information and communications circuits. Yet cyberwar is not simply a set of measures based on technology.[17] ”

Several forms of guidance help shape U.S. policy toward cyber attacks and cyberwarfare. A White House report on National Security Strategy notes "we face threats to critical national infrastructures, which increasingly could take the form of a cyber-attack in addition to physical attack or sabotage, and could originate from terrorist or criminal groups, as well as hostile states."[18] These annual reports play a major guiding role within the Executive Branch national security bureaucracy.

The Department of Defense plays a key role in defending U.S. interests in cyberspace. But much of what the military does in cyberspace today is an outgrowth of traditional views and approaches toward ensuring information security. The military has been further guided by Joint Vision 2010 (JV-2010), a broad long-term strategic concept for joint military strategy and planning purposes promulgated by the Joint Chiefs of Staff.

The Quadrennial Defense Review (QDR) stated that asymmetric forms of warfare, such as information warfare, will become increasingly prevalent in the world, adding:

“ because of the prevalence of such capabilities in the hands of potential future adversaries and the likelihood that such adversaries would resort to such means in the face of overwhelming U.S. conventional dominance, U.S. forces must plan and prepare to fight and win major theater wars under such conditions.[19] ”

In addition, Presidential Decision Directive No. 63 (PDD-63) established in May 1998 a national goal to protect the nation’s critical infrastructure by the year 2003.

Non-state actors[]

There is considerable evidence that some non-state actors and anti-government forces use cyberspace as another tool to wage their fight against various nations. For example, Mexico’s Zapitista movement uses the World Wide Web to elicit support for its cause.[1] Afghanistan’s Taliban militia in Afghanistan maintains a website with a range of material and even solicits contributions from abroad. Similarly, there is an Internet website for the Basque National Liberation Movement (a separatist movement in the region between Spain and France).

References[]

  1. ↑ Department of Defense, Quadrennial Defense Review Report (Feb. 2010).
  2. ↑ Cyberspace Operations Concept Capability Plan 2016-2028, at 68.
  3. ↑ Cyberwar is Coming!, at 30.
  4. ↑ Richard A. Clarke, Cyber War (May 2010).
  5. ↑ Virtual Criminology Report 2009; Virtually Here: The Age of Cyber Warfare, at 8.
  6. ↑ “U.S. Military Concerned about China’s Cyberwarfare Capabilities: General,” Agence France Presse, Mar. 28, 2001.
  7. ↑ Military Strategic Research Center, Beijing (May 1996).
  8. ↑ See Richard Best, "Project Echelon: U.S. Electronic Surveillance Efforts" (CRS Report RS204444) (Mar. 2, 2000).
  9. ↑ See "Frenchelon, the Large Ears Made in France" (full-text).
  10. ↑ The German section is taken largely from a paper presented by Andy Jones, "The European Perspective," at the InfoWarCon 2000 Convention (Sept. 11, 2000). Much of his analysis was taken from French and German language websites.
  11. ↑ V.I. Tsymbal, “Kontseptsiya ‘Informatsionnoy voyny’”, (Concept of Information Warfare), speech given at the Russian-U.S. conference on “Evolving post Cold War National Security Issues,” Moscow, Sept. 12-14, 1995, at 7 (cited in Col. Timothy Thomas, “Russian Views on Information-Based Warfare,” Paper published in a special issue of Airpower J., July 1996.
  12. ↑ Lester W. Grau & Timothy L. Thomas, “A Russian View of Future War: Theory and Direction,” J. of Slavic Military Studies. Issue 9.3 (Sept. 1996), at 501-18.
  13. ↑ In June 2000, the UK defined IW as “integrated actions undertaken to influence decision makers in support of political and military objectives by affecting others information, information based processes, C2 [command & control], systems, and CIS [critical infrastructure systems] while exploiting and protecting one’s own information and/or information systems.”
  14. ↑ These include: the Computer Misuse Act 1990, Telecommunications Act 1984, Telecommunications (Fraud) Act 1987, Obscene Publications Act (1959 and 1964), Protection of Children Act 1978, Criminal Justice Act (1988), Criminal Justice and Public Order Act (1994), Data Protection Act 1984, Data Protection Act 1998, Theft Acts (1968 and 1978), Forgery and Counterfeiting Act 1981, Copyright Design and Patents Act 1988, and Interception of Communications Act 1985.
  15. ↑ A number of terms are used to describe the various aspects of defending and attacking information and computer networks, as well as denying an adversary’s ability to do the same, or even dominating the information environment on the battlefield.
  16. ↑ "Navy Names Nations Posing Cyber Threats," Defense Week, Sept. 5, 2000, at 1. The Office of Naval Intelligence prepared the report.
  17. ↑ Cyberwar is Coming!, at 30.
  18. ↑ A National Security Strategy for a New Century.
  19. ↑ Department of Defense, Report of the Quadrennial Defense Review (May 1997).

Source[]

See also[]

Community content is available under CC-BY-SA unless otherwise noted.
Advertisement

Fan Feed