CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for AdamElkus

AdamElkus

My Infosec Wish for 2013: A Balanced Cyberwarfare Debate

CybersoldiersI can already hear the chuckling. “Cyber warfare? Balanced? And I’d like partisanship in Washington to end, a double date with Mila Kunis and Scarlett Johansson, and some fries with that!” Yes, my desire is utopian, but the fact that I would have to qualify it with a self-deprecating remark suggests the distance that we have yet to travel before we can get more value out of our present conversation on the topic of cyber warfare.

First, let’s start with the unfortunate fact that little is really new. As CTOVision head honcho Bob Gourley notes, we’ve had so many “cyber wake up calls” as to render the phrase meaningless. If these are wake-up calls, someone keeps hitting the snooze button. We know that our SCADA systems are vulnerable, and have been vulnerable for a while. We know that air-gapping will not protect our systems, and that our systems can be attacked through their subsystems. We also understand that espionage and covert operations pose a fundamental attribution problem worsened by the fact that investigation requires cooperation from governments with something to hide. Anonymous and other decentralized hacking collectives? Predicted and analyzed 20 years ago. Finally, we also (should) get that everything from vendors to human psychology provides a multitude of attack surfaces for a potential attacker. Clearly, we’ve had plenty of forewarning for the calamities we’re suffering and have yet to suffer.

But knowing is unfortunately not, as I learned from watching GI JOE cartoon shows, half the battle. On one hand, much cyber warfare conversation these days boils down to endless repetition of civilization-destroying “cyber-doom” scenarios involving genius hackers that never face intelligence, targeting, and weapon customization problems inherent in any kind of attack capable of causing meaningful kinetic damage. That might be what James Bond faces in Skyfall, but it’s not a realistic idea of the future threat. Cyberhype is endemic, and clouds meaningful assessment of dangers and the resources necessary to combat the problem. Much of what we know in other fields about the dynamics of coercion is completely overlooked in even sound technical assessments that neglect the motives and politics of potential attackers. Attribution, for example, is variable upon an actor’s desire to coerce vs. steal or damage. But while cyber-doom is not on the horizon, attention to the intersecting fields of cyber warfare, cyber conflict, and the broader issues of cyberpower yields some discomforting realizations.

For starters, the line between espionage and warfare is never clear to policymakers in practice. Solar Sunrise occurred in the middle of a standoff between the United States and Iraq, and policymakers faced uncertainty over whether the intrusion was part of the geopolitical drama. Long range cyber-reconnaissance can identify weak points. The ability to cause damage to civilian and military infrastructure may not coerce on its own but can cause cumulative damage when combined with other sources of national power. Zero-day markets and a vigorous underground may not challenge the dominance of custom-designed single shot weapons built by states but add an unstable element to the mix. Knowledge that one’s networks are vulnerable to other powers may help tilt the overall balance in larger peacetime strategic competitions. While no piece of malware has yet killed anyone, military cyberpower has helped states coordinate and employ fearsome conventional weapons.

Stuxnet, while unique, also is at times underrated. As Jason Healey noted, Stuxnet had features of autonomy and mirrors an environment in which computational agents are delegated increasingly broad cognitive powers. The way we make war often mirrors the way we make wealth, and future cyberweapons are being dreamt up in an environment characterized by the rise of a “Second Economy” built on a vast and increasingly automatic infrastructure. Cyberspace, once the humble child of the 19th century telegraphic revolution, is increasingly conquering almost every aspect of everyday life and even reaching inside the human body. It’s not surprising that many cybersecurity ideas are drawn from science fiction, even if they often mislead. Science fiction is, after all, a vehicle for commenting on destabilizing changes in the present.

The ground is shifting. DARPA’s Plan X heralds the rise of military-industrial cyber weapon complexes with streamlined cyberweapon acquisition and deployment, and potentially new kinds of cyber weapons that move beyond the network base of contemporary cyber offense and defense. Trends in computing may shift towards biological and analog computing, complicating current technical assumptions. Big data as a form of cyberpower can aid in uncovering patterns of vulnerability that targets may be entirely unaware of. New methods of password cracking challenge old assumptions about password strength and the user vector for targeting. Finally, if the operational repertoire of cyber warfare in and of itself is limited, cyberpower’s capacity to intersect with other operational environments and modify their features makes attack endlessly customizable.

The idea that the offense is dominant should be held to rigor. But so is the idea that eternal principles of cyber conflict and geopolitics can be derived from the study of an extremely limited set of cases. History is important, and is sadly overlooked in the information security and warfare fields. The Cyber Conflict Studies Association, thankfully, is seeking to remedy this. Certain essential aspects of security and war never change, and a disruption-focused tech industry ignores this at its own peril. But assumptions based on modern Internet Protocol technologies will fail to be of strategic value when attackers bypass them or the technologies change. Want an example? Take a gander at the vulnerabilities inherent in your own car. The answer is not an “everything is new” attitude, but a richer and more detailed effort to think about what precisely cyberspace is. A solid understanding of cyberspace, separate from the domination of any one kind of technology, can not only inform about the nature of cyberpower and cyber threat but also hedge against technological change. That conversation is far from finished, and hopefully 2013 will auger a more useful debate about war and other forms of conflict in cyberspace.

What Does It Mean to Disconnect?

Are we too connected to our gadgets? Many journalists and social thinkers seem to think so. Are we all too fixated on emailing, tweeting, just plain staring at our screens to participate in the world around us? The answer may be more complex than that, but you won’t find it in posts like this recent effort from TechCrunch:

[O]ur obsession with technology, the right and wrong of it, the speed with which we have to create, consume, and engage with it, is not sustainable. People aren’t meant for this, not forever. It’s an imperfect state of being. We humans are always looking for balance. Today’s parents are realizing that they can’t achieve work/life balance with their children, for example. The same goes for technology. Tech/life balance is a similar myth. There’s no such thing, not really. You’ve just gotten used to it in the same way a coffee drinker gets used to caffeine. The effects are still there, but you don’t feel them until the drug is gone.

These sentiments will likely resonate with many tired of seeing iPhones whipped out during dates and family events, but we should recognize that they are based on emotion rather than careful analysis. As Nathan Jurgenon observed on Twitter, the post equates disconnecting from technology with not looking at a screen. Online and offline are synergistic—Facebook is, after all, populated by real beings rather than machines. Our entire motivation for going online is the real-life social and professional networks embedded into our technologies. I post a cat picture, for example, in part because I know that certain people on my FB field will find it enjoyable. I’m also motivated to log on because I care about the people in my network and use Facebook as a means of following their lives. I may see Alex Olesker and CTOVision alum Dillon Behr in person, but social networks are also an important way for me to keep in contact with them. It doesn’t replace in-person contact, but as Jurgenseon says, “[I]f we can fix this false separation and view the digital and physical as enmeshed, we will understand that what we do while connected is inseparable from what we do when disconnected.”

This leads us to the more troubling implication of the recent trend of “disconnect” pieces: they confuse disconnecting from technology with disconnecting from social and professional networks. The TechCrunch post bemoans the way that the demands of modern work life and social life motivate people to constantly plug in. But is the problem technology, or modernity itself? There is nothing said in the post that sociologists like Georg Simmel or Zygmunt Bauman have not said better over a hundred year period: modernity is fast-paced and constantly demands stimulation and attention. And what is the solution? Unmaking the structure of modernity is not really a reasonable option for most workers and consumers. The TechCrunch post at least looks at some technological solutions for making automated agents take on the burden of connection, but that’s not without significant problems either.

Having Internet-of-Things automated agents handling one’s life does not constitute disconnection. People will still monitor their agents, as they cannot isolate themselves from the social and professional consequences of what those agents do. There is something also highly bizarre about the idea of handing progressively larger and larger slices of one’s social and professional lifeworlds to robots in order to combat technological alienation from everyday life? It may be more efficient, and less stressful, but let’s not pretend that it somehow means a decoupling of information technology from our social life. Wouldn’t that also alienate us more? To take an example from the online dating industry, it’s one thing to use OKCupid’s sophisticated matching systems to help us find a mate, another to entrust those systems with handling replies to messages sent from prospective suitors.

If people highly value their work life and social networks, why should they be ashamed of using technology to interact with them? Calls to unplug and the fetish-making of being “offline” should be seen for what they really are: a fantasy of solitude that privileges the individual’s absolute desire to be free from the demands of the outside world. Is selective disconnection good or helpful? Sure, everyone could use a break. But the assumption that taking a break is somehow revolutionary has to go, as it inevitably privileges solipsism. Taking a break does not mean that you escape from the consequences of larger networks you are personally embedded in. The IRL fetish is at heart an urge to have the control necessary to be an island whenever you want to be. Sherry Turkle , for example, can run off to Cape Cod to completely withdraw from family, friends, colleagues, and the rest of the world. Not everyone has that luxury, but not everyone needs or wants it.

Assumption of Breach and Defense Planning

Given the explosive (and thinly sourced) nature of Bill Gertz’s allegations (China! Carriers! Nukes!) in his latest Free Beacon post it is important to watch the story as it develops. At first glance, the story doesn’t quite seem to match the hype. A spear-phishing attack against an unclassified network is not exactly uncommon. But the uncertainty surrounding the story and the actual dynamics of the incident itself are rather unsettling.

Of course, formative cybersecurity incidents like Moonlight Maze have never really been conclusively resolved and are just as hazy. The post does highlight an emerging reality that will likely be incorporated into defense planning: presumption of breach. Within the cybersecurity industry, security planners assume that an determined attacker is capable of entering an opponent’s security system–air gap or not. Consequence management, forensics, and remediation become the focus, rather than an attempt to create an iron wall around one’s security system.

Given what we know about extensive Chinese and Russian targeting of our defense infrastructure and political-military communications, we must at some level assume breach when thinking of our general counterintelligence picture. Geopolitical competitors have acquired large amounts of data and penetrated some critical systems over the years. Open-source reporting has also consistently revealed a persistent People’s Liberation Army (PLA) doctrinal focus on American command, control, and communications. Although there are instrumental objectives at play, such as gaining information and/or controls that may be of use in a future crisis, one also wonders if the main effect is actually more complex.

Assumption of breach introduce an element of uncertainty into defense planning. How much does a potential opponent know about critical information, and what can they do in a potential crisis? While there has been a lot of speculation, there is very little hard analysis of what kinds of capabilities could be targeted and what a potential opponent could know about US command and control, intelligence, communication and logistics networks. This is without bringing up the issue of critical infrastructure, which may or may not be off-limits to a potential attacker depending on political motive.  Nuclear command and control, however, would be an entirely different matter presuming Gertz’s account is true.

Either way, to assume breach is to acknowledge that penetration of very sensitive networks is not only possible but likely ongoing and undetected. Moonlight Maze, for example, was only accidentally discovered. This doesn’t mean that, Battlestar Galactica-like, an adversary would be able to disrupt and/or destroy US combat power in one full swoop with a cascade of computer network attacks and electronic warfare operations at the beginning of hostilities. It does mean that there is significant uncertainty about just how much penetration has happened and/or is ongoing, what has been learned, and what can be done.

Could such uncertainty over adversary information and capabilities itself induce caution, and perhaps a slackening of political will? Warfare is full of considerable uncertainty arising from the operation of one’s own complex military machine, that of the opponent, and third parties. Adding one more volatile element to the mix could be a tipping point. Of course, we’ve known about the weaknesses of US systems since Eligible Receiver and US strategic postures still remain the same. But assumption of breach in situations involving nuclear-armed great powers will inevitably be factored into defense planning.

How such uncertainty politically and organizationally manifests will be difficult to predict. Some political scientists studying military doctrine might say that it would result in a greater tendency towards offensive doctrines and weapons, but uncertainty and vulnerability has also motivated caution even in the face of institutional pressures. Only time will tell. There is little evidence to indicate that psychological uncertainty itself is an objective of espionage and long-range cyber recon, but it certainly could be a side effect.

UPDATE: The White House has confirmed that an spear-phishing attempt against an unclassified network did take place, but clarifies that it was isolated and no data exfil occurred. If that’s the end of the story, then that’s great news. But is it?

Also see:

Japan, China, and the Tech Supply Chain

My amigo Alex Olesker has a nice roundup at OODA Loop of why China and Japan are feuding over a pile of rocks in the South China Sea. So why, you might ask, is this relevant for technologists? Well, consider this story from August:

Chinese tech hub and boom town Shenzhen is set to increase the minimum wage of workers there by 13.3 per cent in early 2013, causing a few sweaty palms in the technology supply chain. Shenzhen and the wider Pearl River Delta area in southern China is one of the most concentrated technology manufacturing hubs in the world. Samsung, Apple, HP, Dell and Nokia all have kit built here by the big Taiwanese ODMs such as Foxconn and Wistron.

If a wage hike that did not even effect a giant like Foxconn caused jitters in the tech world, one wonders what military clashes might do, particularly if they have synergistic effects with continuing labor unrest. Cheap labor is really only the beginning of the story with Asia’s role in the tech supply chain. Rare earth materials, which are crucial to high-tech products like smartphones and flat-screen TVs, are also harvested from the Asian mainland. 90% of rare earth minerals originate from China. If you’re curious about exactly how this process works on a micro-level basis you can read this rather gory report from CNET about your smartphone’s journey from a mine in Inner Mongolia to your waiting hands in the US. In 2010, China suspended exports of rare earths to Japan in the middle of another maritime border dispute, damaging Japan’s technology industry. But the economic consequences of Chinese-Japanese hostility are far greater today because of the extent of Japanese investment, China’s slowing economy, and possible region-wide effects.

Whatever the resolution of the South China Sea crisis, its dynamics should highlight the fact that the supply chain has been globalized. While the risks of a globalized supply chain have been chiefly conceptualized in cybersecurity terms, disruption of that chain as part of a geopolitical crisis also poses some economic uncertainties. A Japan-China clash would certainly be bad enough, but damage to the tech sector would be inevitable if US involvement triggered heightened geopolitical tensions between Beijing and Washington.

For more on these topics see the CTOvision Guide to National Security Technology and

Cyber Offense, Defense, and Economics

The Center for Strategic and Budgetary Assessments (CSBA)–known for its assessments of the precision-strike revolution and work on Air Sea Battle–is tackling the intellectual challenge of cyber strategy. Its new report, Cyber Warfare: A ‘Nuclear’ Option? has not gotten much play in the blogosphere but has a number of interesting ideas. CSBA challenges dogmas on both sides of the cyber debate while retaining a welcome sense of humility about its ability to predict the future.

The report’s author, Andrew Krepinevich, was one of the people in the early 90s that explicitly predicted cyber operations and tactics as a precursor to and element of major war. In his late Cold War work on the military-technical revolution (MTR), Krepinevich predicted that future conventional wars might start with an effort by both sides to use information warfare to suppress each other’s systems. So his thoughts on the cyber weapon are definitely of interest to policymakers and enterprise CTOs.  Having read a lot of dreck lately on all things cyber strategic-related, I was pleasantly surprised to find a historically informed argument that stakes a middle path between endemic cyber hype and underestimating the threat of state and non state cyber operations.

First, Krepinevech takes a fairly nuanced view of strategic bombing in World War II. While infrastructure attacks were not sufficient to break the will of the enemy in the European Theater of Operations, they did impose massive costs on the Germans. From the sheer density of air defense personnel tasked to the damage inflicted on crucial industries, strategic bombing did achieve effects–albeit at a high cost. Still, German forces had to be ground down the old-fashioned way, and at the time of surrender large combat units still remained in the field. The ability to realize prompt destruction only arrived with the atomic bomb, but its use as a battlefield weapon was at best ambiguous after Hiroshima and Nagasaki. Though the United States always planned to deploy nuclear weapons to stop the Soviet hordes should they break through its defenses, it used nuclear weapons primarily to advance its position in a bipolar international system.

Instead of raising the specter of a catastrophic “Cyber Pearl Harbor,” the report raises the possibility of cost-imposing infrastructure attacks that progressively raise the financial losses involved in patching vulnerabilities and adapting to compromises with wide-ranging implications. Thus, while a countervalue cyber attack may not cause a societal collapse it could nonetheless cause problems that would advance an attacker’s political objective. Infrastructure failures that mesh with features of modern society such as the dependence on electricity for refrigerated food would represent formidable advantages for the defender if coordinated together. Krepinevech, echoing Sam Liles’ recent work on the evolution of cyber weapons, suggests that future weapons might not necessarily depend on exploits as we currently understand them. With a large enough botnet, an attacker could potentially crack even secure codes and enable attacker control. The CSBA report notes that officials are right to be concerned about vulnerabilities, but need to understand the distinct features of the weapons at hand. While not absolute weapons, the risks are real.

Much of the report rehashes vulnerability assessments and incidents (Aurora, Operation Shady RAT) that cyber observers will be well-familiar with. But James Hasik picks up some of the report’s implications for the defense industrial complex:

As we saw in the Stuxnet case, cyber weapons can, with enough information, be targeted at individual pieces of equipment within individual facilities. And as we also saw, those things can escape into the wild, given just “one idiot with a thumb drive” (as I read the line once on Ars Technica). It’s also notable that the surgicality is likely inversely related to the cost of the weapon: the more targeted, the more expensive (see below for more on costs). This is mostly the reverse from physical weapons—guided bombs and missiles, for example, are more expensive by the round, but by saving on all those unguided rounds that would go astray, and the extra aircraft to deliver them, they actually turn out to be more economical than dumb bombs. It’s not necessarily that way with cyber weapons. … As frequently as computer operating systems are updated, money sunk into developing a cyber weapon should show a high depreciation rate. That rate can even go stepwise as major desktop and industrial operating system upgrades roll out. Some military aircraft and ships may last for decades, but cyber weapons will likely have much shorter shelf-lives.

The costs of offense, when measured against the combined costs of defense and consequence management reveal some unique tradeoffs. On one hand, attackers seeking to cause damages that will generate strategic effect will require a substantial monetary investment in intelligence, targeting, and testing. But the weapon’s shelf-life will be short. But defenders still face formidable costs in protecting infrastructure and conducting consequence management across interagency boundaries. Hence, while it is true that offense still is dominant in one side of the equation, the operational value of weapons are also complicated by their relatively short shelf lives and some of the uncertainties involved in whether or not they achieve desired effects on the target. Krepinevech’s comments on the latter are also thought-provoking, if disturbing:

It may, therefore, be difficult for the leadership of one cyber power to determine when, in the mind of its enemy, it has crossed the line between cyber operations that are “acceptable” and those that will trigger a major escalation in the intensity of cyber activity that could lead to catastrophic attacks.

He concludes with a sensible call by the strategic studies community to examine cyber warfare with the same intensity it examined nuclear warfare during the Cold War. The community of analysts with a background in strategy and war studies looking at the issue is fairly small—but is nonetheless steadily growing. I will look forward to any future insights Krepinevech has on the subject.

How Cyberpunk Revived Cybersecurity

This post was cowritten by Adam Elkus and Alex Olesker

Our last post looked at the downside of how cyberpunk and digital dualism helped contribute to a distorted understanding of cyberspace and bad policy. Yes, it might seem a bit ridiculous at first glance: would we blame Jules Verne for faults with naval submarine warfare doctrine and operations? But the idea of a separation between cyberspace and “real” life, originating with science fiction, has been an overall malignant influence on cyber policy. Yet we aren’t going to completely throw our cyberpunk toys away. There are a variety of ways in which cyberpunk foresaw the future of cyber operations.

First, we should explain a bit about what cyberspace is. Just like terrorism, something as vast as cyberspace will perhaps never be conclusively defined. In the simplest terms, technologist and CTO Bob Gourley defines cyberspace as our interconnected information technology. Dan Kuehl of the NDU iCollege offers a more in depth definitions in his chapter in Cyberpower and National Security : “a global domain within the information environment whose distinctive and unique character is framed by the use of electronics and the electromagnetic spectrum to create, store, exchange, and exploit information via inderdepedent and interconnected networks using information-communication technologies.” As Kuehl argues, interdependent and interconnected information networks and systems are composed of three interrelated dimensions: physical platforms, systems, and infrastructures that provide connectivity, massive amounts of informational content, and human cognition that results from greatly increased access to content and increased decision power. Cyberspace as it exists today is a designed environment built for the use of information, interaction, and communication, but to call it a “man-made” environment is to misunderstand it entirely. Kuehl and Sam Liles both note that cyberspace’s physical characteristics come from forces and phenomena that exist and occur in the natural world. The fact that humans need manmade devices and technologies to exploit cyberspace is little different from other “man-made” environments like….the sea, air, and space.

Because technologies and systems operate through and on cyberspace, this makes two national security related exploitations of cyberspace possible: information-based warfare and information warfare. Commonly conflated, they are in fact very different. Network-centric warfare, for example, utilizes cyberspace to create greater speed, decision power, and decisiveness. The current American system of precision-targeting, unmanned aerial vehicles, networked platforms, and command and control relies on cyberspace, just as late 19th century warfare exploited embryonic cyberspace in the form of telegraphic networks. Information warfare, in contrast, is an umbrella term for the use of information to destroy information in the form of electronic warfare (EW) and computer network operations (CNO). As Kuehl notes, cyberspace exists as a blending of electronics and electromagnetic energy, and the first major exploitation of cyberspace occurred with the transmission of information in the form of dots and dashes over a wire. The “Victorian Internet” morphed into something greater with the invention of wireless, the telephone, radio–and decades later–the electronic computer. Kuehl argues that cyberspace is unique because it employs the electromagnetic spectrum as a means of movement, and any definition of cyberspace must begin not with the activities that take place within the domain but rather on the physical characteristics that set it apart from others.

We increasingly interact with cyberspace through augmented reality. As Liles observes, this was one major aspect of cyberspace that William Gibson’s work in fact did accurately predict:

For quite some time the reality of cyber has been over laid upon the physical reality. … Numerous iPhone applications exist to allow the person to interact with the cyberspace around them. From tours, to GPS navigation with advertisements included the two spaces are shore and sea interacting at that beach. Augmented reality is why unmanned aerial vehicles can work. Augmented reality is the heads up display in a fighter jet giving friend and foe recognition for targeting devices. Information through a variety of  interfaces is placed into the physical reality. As seamless we already see the physical reality being modeled and data places into the cyberspace why shouldn’t the opposite be true? What hasn’t existed until the smart phone and now special glasses is a mechanism for accessing the information realm. Though with geo cacheing and a variety of games that is changing.

Augmented reality, as Liles notes, allows users to overlay information in graphical form, increasing the sensory abilities of the user. With AR, soldiers can make friend or foe identification with the aid of big data, salesmen at corporate mixers can make more carefully targeted networking, and police officers could rapidly access arrest records on everyone they encounter in a neighborhood. My own personal use of AR has changed my life just with GPS on my iPhone, allowing me to track down elusive hole-in-the wall sushi joints in San Francisco.

The use of augmented reality leads us into three useful points about cyberspace and national security. First, just because an action is targeted against someone’s cyberspace does not mean the competition should be viewed symmetrically. Talk of Iran retaliating for Stuxnet in cyberspace misses the point: Iran, a sponsor and frequent source of terrorism, has abundant and more efficient means of killing people it doesn’t like besides code. The ability of the United States to dominate the escalation ladder also complicates Iran’s ability to use force against the United States in cyberspace for political objectives, and there would be little point for Iran to employ force against the US unless it somehow desired a shift in the US’ political behavior. Might Iran do so through cyber-proxies? Perhaps, but due to the importance of force as communication, proxies would have to somehow be able to communicate Iran’s desire for a shift in US policy towards Iran without the US deciding to utilize its abundant conventional advantages to retaliate against Iran. What happens in Vegas may stay in Vegas, but what happens in cyberspace is not guaranteed to stay in cyberspace. This doesn’t mean Iran will not retaliate in a significant manner, but it would have to do so in a way that would either constrain the US from retaliating or minimize the possible damage from such retaliation.

Second, the importance of information power is to augment existing capabilities. As Martin Libicki argues, operational cyberwarfare can heavily augment the effect of conventional operations and weapons. EW platforms in previous conflicts fried electronics and jammed communications, depriving military forces of the ability to communicate. Similarly, computer network operations will deny, disrupt, corrupt, and confuse important adversary capabilities. The DARPA program Plan X’s emphasis on hardened cyber systems for the projection of weapons and a “map” of systems and networks for targeting reveals just how existing cyberweapons will be more useful as an operational weapon rather than necessarily a strategic weapon for destroying civilian targets. This should not surprise us–as Sean Lawson points out, infrastructure attacks against the civilian population during a time of total warfare did not bring Germany to heel and the history of disaster research should give us optimism about surviving “cyber-doom.”

This is not to deny that cyber operations will make future operations look very different on the tactical level. And this is where cyberpunk actually has been very influential. In the cyberpunk anime franchise Ghost in the Shell, the action focuses on a combined spec ops and cyber warfare unit called Section 9. Section 9’s operatives are principally selected for their ability to carry out traditional domestic intelligence and direct action skills such as criminal investigation and special operations. However, Section 9 extensively uses cyberspace to both enhance and carry out their operations. Because of the manner in which information networks have colonized every aspect of life (including basic biology) in Ghost in the Shell‘s not-so-distant universe, cyber exploitation and attack is necessary for basic police investigation and national security operations against enemies of the state. Hacking and control of weapons and even cyborg body parts is common, as is the commandeering of surveillance cameras and facility systems for tactical operations.

Sound far-fetched? The special operations site SOFREP ran an interesting feature by Uri Fridman that would suggest otherwise. Special operations direct action will leverage cyber exploitation and attack on enemy systems in a way already pioneered by Red Teamers combining physical penetration with hacking to test sensitive facilities:

In past operations where my team was involved, we supported those units in two different phases.

  1. We provided the initial digital recon of the target, including inside information about sentry schedule, different access routes (those that were locked during the night hours and those open but monitored), number of personnel inside the facility during the different times of the day, hardware and software information, provided a complete site casing including detailed sketches based on the design blueprints extracted from a computer, and a week’s worth of daily activity logs hour per hour.
  2. We also acted as a direct action support team, providing real time information about what the target was doing inside the premises, location of sensitive computers, disabling alarms and other security features in real time, etc.

All that information was carefully analyzed and compared with the intel gathered by the unit’s own intel guys and was found either at the same level or, in most cases, more accurate.

Despite our criticism of “cyber war”, computer network operations, and more broadly information-based operations, are already an important facet of conflict. And as tactics grow even more dependent on information systems, the ability to attack, degrade, disrupt, influence, and gain unauthorized access to information systems will have an even greater tactical impact. What’s important to note is that this impact will not be independent, as cyberspace does not exist independently. Ghost in the Shell provides a more likely prediction of cyber’s increased role in conflict, with information stolen from adversary networks a key part of tactical as well as strategic planning and hackers supporting operations like artillery, ready to disrupt the enemy in the heat of an engagement.

In short, while the world obsesses over “cyber-doom” scenarios for strategic cyberwar, cyber capabilities are trickling down to the tactical and operational levels where they will most likely be actually be employed. Maybe you won’t see Advanced Persistent Threats shutting down nuclear power plants, but what if they launch an assault on military logistics to slow American response to an invasion? Maybe Anonymous won’t kill the Internet, but are American forces prepared to operate in information-degraded environments on the battlefield after the enemy fuses EW and CNO on the tactical level? These are realistic problems rooted in existing and emerging capabilities. Cyber warfare is coming, but it may look as different from the popular perception as bombing in World War II did from H.G. Wells’ dreams of aerial warfare.

The Strongest Tribe: Issues of power in cyberspace

Cyberspace is our interconnected information technology. Mikko Hypponen has a mea culpa about Flame that is worth reading. The F-Secure chief believes that antivirus companies, including his own, failed to detect Flame and that this failure has broader implications:

The truth is, consumer-grade antivirus products can’t protect against targeted malware created by well-resourced nation-states with bulging budgets. They can protect you against run-of-the-mill malware: banking trojans, keystroke loggers, and e-mail worms. But targeted attacks like these go to great lengths to avoid antivirus products on purpose. And the zero-day exploits used in these attacks are unknown to antivirus companies by definition. As far as we can tell, before releasing their malicious codes to attack victims, the attackers tested them against all of the relevant antivirus products on the market to make sure that the malware wouldn’t be detected. They have unlimited time to perfect their attacks. It’s not a fair war between the attackers and the defenders when the attackers have access to our weapons.

In short: all of the AV gear in the world is not going to protect you when a well-resourced state intelligence service is trying to execute a zero-day exploit against your systems, just like even the most expensive private security would not save your life if the Navy SEALs came for you like they did for Bin Laden. This is significant, not only for network defense, but also for the way we think about power and security online. Simply put: states are dominant in cyberspace. States are the primary threats precisely because of their greater resources and ability to generate political and military outcomes. State power, is of course, not total in cyberspace, just as there are many offline disruptions of power and sovereignty that still nonetheless leave states as the primary actors within the international system.

Richard Stiennon reinforces this message with his latest Forbes blog on the consequences of Stuxnet. Operation Olympic Games, Stiennon argues, risks creating a tension between the worldwide IT industry, which focuses on providing cyber defenses to all, and the US government, which seeks to develop offensive cyber capabilities for covert action and military operations. Stiennon predicts that the US government, should it desire, may clamp down on AV vendors in order to deprive likely targets of defensive capabilities. Law enforcement and intelligence agencies have demanded backdoors in everything from encryption to social network profiles. Finally, the SOPA/PIPA mess also illustrates the degree to which governments have far-reaching powers to regulate cyberspace. Cyberspace is often analogized to the Wild West, but one forgets that in the real West the US government eventually developed formidable political, military, and law enforcement coercive powers to enforce its writ.

While this might seem like common sense, it runs against one of the Web’s strongest prevailing mythos. In 1996, John Perry Barlow declared that cyberspace itself was independent and could never be tamed by government:

Governments of the Industrial World, you weary giants of flesh and steel, I come from Cyberspace, the new home of Mind. On behalf of the future, I ask you of the past to leave us alone. You are not welcome among us. You have no sovereignty where we gather. We have no elected government, nor are we likely to have one, so I address you with no greater authority than that with which liberty itself always speaks. I declare the global social space we are building to be naturally independent of the tyrannies you seek to impose on us. You have no moral right to rule us nor do you possess any methods of enforcement we have true reason to fear.

Now, some caveats: Barlow did not mean that cyberspace was literally independent. But the basic utopian spirit of his declaration spread throughout the technorati. Glib slogans like “Information wants to be free” and “the Internet routes around censorship” melded with a myth of “Twitter Revolutions” during the 2009 Iranian election crisis and the Arab spring. The idea that there is something sacred in information freedom is the closest thing that can be called a motivating principle for Anonymous. But Barlow’s successors confused an admirable normative idea of how information power should be–the Internet should not be hobbled by government regulation–into an assessment of the actual relationship between state and non-state entities in the information sphere. In other words, Barlow’s declaration of independence of cyberspace is looking more and more like the cyber equivalent of Paris Commune today. Beautiful and admirable, for sure. But also incredibly fragile.

Does this mean that government is in firm control of cyberspace or should exercise complete control? No to both questions. As Tim Stevens observed, cyberspace provides opportunities for infringement of sovereignty every nanosecond. Anonymous’ success at the expense of the feds and the constant foreign criminal and intelligence service intrusion in both government and corporate systems. And the prosperity cyberspace has delivered is imperiled, or at least heavily complicated, by a tight government rein and the second and third-order effects of offensive cyberwarfare efforts. But as a statement of day-to-day truth, Uncle Sam is the “strongest tribe” in the Internet’s Wild West where it counts.

More Reading:

For more on these topics see the CTOvision Guide to National Security Technology and

How Cyberpunk Killed Cybersecurity

This post is cowritten by  and Alex Olesker.

Before we begin, please understand just how hard it is for us to write this blog. I’ve read Neuromancer countless times, enthusiastically used Snow Crash in undergrad to talk about the future of international relations, and watched both Ghost in the Shell movies and the Stand Alone Complex (seasons 1 and 2) countless times. I am psyched for the Robocop remake and even (if you get me started) rave about obscure movies like Strange Days. I’ve convinced countless friends and significant others to watch Blade Runner and used to have a Tachikoma toy. And recently, Alex and I rewatched a large chunk of the series and compared the “Laughing Man Incident” to the birth of Anonymous.

But as I was discussing with Alex one day, we both came to realize that the movies, television shows, and manga comics that inspired us to write and work in this area were also holding us back. That’s right. Cyber is, as we’ve discussed before here at CTOVision, a very future-oriented field. It’s not surprising that our basic perceptions of it would also be formed by science fiction. But this has some adverse effects for defense policymakers, CTOs, and other people interested in cyber. I wrote a piece for Mike Tanji’s site a long time ago about the problem of “legacy futures” in cyberspace. Essentially, legacy futures are old visions of the past that no longer keep pace with the present. But they act as a deadweight drag on the policy process because they have essentially colonized our imaginations. This manifests itself not only half-baked ideas like “cyber arms control” that rely on Cold War legacy futures that compare code to nuclear missiles, but also in fundamental aspects of how we think about cyberspace.

In his essay, “The Myth of Cyberspace,” PJ Rey argues that William Gibson conceptualized cyberspace in a fundamentally wrongheaded way that still influences cyber policy:

Gibson’s cyberspace is an imaginary setting where information takes on some of the properties of matter. Yet, cyberspace is transcendent; it requires leaving behind the body and the physical world that contains it. When hackers “jack in,” they are no longer conscious of the physical world. The hacker trades a physical body and environment for one constructed of digital information. It is important to note that, as the cyberpunk genre evolved, it increasingly wrestled with forms of consciousness that blended sensory inputs from physical and digital sources. Nevertheless, cyberspace, as an ideal type, involves total separation of physical and digital.

The logical implications of this metaphysical perspective on cyberspace are a perspective of “digital dualism.”  The problem for digital dualists is that, despite sci-fi visions of hackers floating in an ethereal cyberspace that is completely distinctive from “meatspace,” our digital interactions are fundamentally embodied.  As Sam Liles has often noted, we interact with other people in cyberspace through devices. Cyberspace is only as much of an artificial or “man-made” environment as the sea is. And just like nations control the sea around them, real world experiences, laws, and regulations create digital outcomes, as SOPA opponents unhappily discovered. Mexicans killed by cartel henchmen for their social media use also are a data point that suggests that there is no real separation between cyberspace and “meatspace.” Rey has an excellent discussion in his article on how the entire market of location-based services on mobile devices and the way people can be tracked through geolocating is in and of itself proof that we are embodied in cyberspace.

As Rey suggests, Bruce Sterling is more realistic in describing cyberspace as a function of a human need to overcome the alienation induced by long-range communications. We want to imagine something in between the space in which our telegraph, telephone, or Google Chat conversations occur. Such a space does not really exist, but we have a psychological need to fill that space to overcome our sense of alienation at conducting a conversation with someone else we can neither see nor directly interact with. Cyberspace is a fantasy, but it’s made real in our minds and actions by us treating it as such.  Rey again explains it:

The fantasy of cyberspace is “serious” because it is cognitively necessary. It relieves us of the burden of having to parse the seemingly infinite complexity of the systems that make such communication possible. This kind of fantasizing is a counterpart to what sociologist Anthony Giddens calls the “bargain with modernity.” Giddens believes that our modern lives are characterized by an endless series of risks (e.g., driving a car, stepping into an elevator, taking medicine, etc.) because it is not possible for any one individual to understand all the minute complexities of the myriad technological systems we depend on every day, we must place our trust (and our very lives) in the hands of experts. Trust is our basic conscious mechanism for dealing with such complexities; denial is its unconscious counterpart. Fantasy gives substance to this denial. Part of the seductiveness of the cyberspace fantasy is that, by denying the complex, mutually determining relationship between our society and the Web, it makes our lives and our everyday judgments simpler.

Now Rey has the cultural implications of digital dualism down cold. What are the policy implications? The first is the inability to see the very real similarities between all things “cyber” and everything else. Most petty crimes are never solved, so why should we be surprised that cybercrimes go mostly unpunished? Is there a very big difference between someone stealing your bike from the local DC bikeshare because they had figured out a vulnerability that not even the lock manufacturer suspected and a zero-day exploit? And when it comes down to who should have organizational responsibility for law enforcement or military aspects of cyber conflict, the myth of cyberspace as a corporeal thing that we enter into via digital, disembodied avatars has immense consequences.

The conception of cyberspace as a separate plane also perverts our analysis on real risks and mitigation. Just as the real strategic value of the sea is its ability to effect events on land through embargoes, bombardments, transport, and other such means, a serious cyber attack won’t disable World of Warcraft to kill digital orcs, it would disable a hospital intensive care unit to kill real patients. The reverse is also true as the physical world can affect what happens in cyberspace. Digital dualism is the fallacy behind air gapping’s poor track record. Often, the most critical networks such as industrial control systems, are not connected to the Internet and hence thought invulnerable to cyber attack. Yet as cyberspace is not a real place, you can’t actually leave an air gap, and because human beings and machines interact with both “air gapped” and connected networks, attacks still get through via removable drives, personal devices, and temporary connections. One recent example was the virus that attacked the U.S. drone fleet in September, which got into the “air gapped” cockpits via USB drives.

Along with misrepresenting the threat, remaining stuck in the cyberpunk view of cyberspace makes us miss the solution. As pioneers in cyber law enforcement have learned, just because the crime was committed electronically does not mean that the investigation has to be limited to cyberspace. Just as some of the most notable hacks are the result of social engineering, most major cyber crime investigations hinge on physical evidence, informants, and undercover officers. Similarly, while attribution may be complicated in cyberspace, it tends to be much simpler in meatspace. we can safely assume that the party which most stands to benefit is behind a cyber attack, and it will be easy to track who’s behind a “cyber Pearl Harbor” because they will be the ones massing their troops at the border.

This isn’t to deny that there are important differences between cyberspace as a domain of conflict from other forms–hence our earlier giggling at the idea that the arms control community could treat bits of code like missiles or biological weapons. You aren’t going to have Hans Blix do on-the-spot inspections of Russian and Chinese internet cafes or the UN Security Council discussing the finer points of 4chan posts with Guy Fawkes mask-wearing Anonymous hackers. But digital dualism disables us from using our best weapon against cybercriminals and enemy cyberwarriors–the common sense we’ve developed through dealing with similar technologies, crimes, weapons, and strategic situations. And for that reason, maybe it’s time that we save our mirrored shades and Depeche Mode CDs for VHS 80s’ retrospectives and look with fresh eyes at cyberspace.

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]