In word and deed, fears of cyberwar appear to be growing. In 2013, Le Monde reported, “One Billion Euros to Face Cyberwar,” after the French Defense Ministry released a White Paper endorsing the development of offensive cyber weapons. France of course is not alone in its will to evolve in the cyber realm. According to Peter Singer of the New America Foundation, more than 100 of the world’s militaries have developed cyber warfare organizations, 20 of which are serious players.
On the other hand, in the U.S., the official rhetoric on the cyber threat has been toned down a notch since past years, when Leon Panetta, then serving as CIA Director, warned in 2011 that the “next Pearl Harbor” would be a cyberattack, and the Chairman of the Joints Chiefs of Staff Gen. Martin Dempsey stated in 2012 that “bits and bytes can be as threatening as bullets and bombs.” Still, the most recent CIA intelligence assessment in February once more identified cyberattacks as the greatest national security risk—as it has in the last few years—naming Russia, China, Iran, and North Korea as particularly threatening in this regard.
Moreover, current events have given way to a new flurry of rhetoric about cyberwar. In April, NPR reported: “Russia Wages Cyberwar against Ukraine.” And various recent commentaries have focused on last month’s hack of the U.S. Office of Personnel Management (OPM), widely blamed on China and now believed to have compromised the personal and security clearance information of some 22 million Americans. Thus, Moisés Naím explained in The Atlantic last month, “Why Cyber War Is Dangerous for Democracies,” while Singer and August Cole, writing in Politico, assured the skeptics about “The Reality of Cyberwar,” even if we have not yet seen the brunt of it.
In much of the noise surrounding the looming threat of “cyberwar” an important point often goes ignored: what does that even mean? While certain officials have been careful to avoid the term, instead referring to cyberattacks of varying degrees (as in the latest U.S. Cyber Defense Strategy), we hear ever more about cyberwar from the media and pundits. War may be “politics by other means,” but much more than that, it signals the ultimate breakdown of relations between states, whereby diplomatic discourse gives way to violence. Applying the term to the cyber realm leaves much room for discussion.
Cyberwar vs. War
When searching for a definition of cyberwar, one will not find broad consensus. “Cyberwar is not quite ‘war,’ not quite ‘cyber,’” observed Jeffrey Carr in Slate a few years back. “The problem, of course, is that no one can agree on what constitutes an act of cyberwar.” His point still stands.
In 2010, the U.S. Department of Defense officially defined “cyber warfare” as “armed conflict” conducted at least in part by “cyber means” or “military operations conducted to deny an opposing force the effective use of cyberspace.” A central concern with this definition (putting aside slight differences in meaning between warfare and war) is that it suggests that cyberwar only takes place in the context of a physical conflict or operation. The point is surely debatable, even if there are many examples of cyberattacks that do target military systems, as in the case of a report this month that a German missile on the Turkish-Syrian border may have been hacked by a foreign source.
Actually, many of the cyber Armageddon scenarios do not involve hostilities between militaries, but rather attacks on civilian infrastructure that runs on information technology, for example, the hacking of a city’s power grid or a nation’s air traffic control system. Indeed, these were two scenarios highlighted as “real” risks in President Obama’s speech at the February Whitehouse Cybersecurity Summit.
Going by the official cyber warfare definition, one is left wondering if the above two kinds of cyberattacks (on power grids and air traffic control) would constitute cyberwar, assuming they were perpetrated by a foreign power. Moreover, what about the likes of the OPM hack, which certain cyberwar-mongers have seized upon? One may be correct to say that such attacks do not rise to the level of cyberwar, but the reasoning behind such a judgement demands explanation.
Of course, the meaning of “war” itself defies easy definition. Nonetheless, there are a few basic elements to war that are generally accepted: 1) the hostilities are between state actors; 2) they cause measurable damage (lethal violence in the case of traditional war); and 3) the damage inflicted reaches a certain level of severity. Building on these three criteria, there are various parallels that can be drawn between the physical or “kinetic” and cyber domains, which help to clarify the meaning of cyberwar.
- The Adversaries in War are State Actors
One key aspect of war which distinguishes it from other forms of violence is that the warring parties are state actors. Thus, it is fair to say that for a cyberattack to constitute an act of war, it must be attributable to a state with at least a high degree of certainty.
At first blush, this criterion seems problematic for the cyber domain, given that cyberspace is often seen as a “stateless, global commons.” In addition, attribution of the perpetrator of a cyberattack may prove difficult, time-consuming, or even infeasible. For example, the 2013 Mandiant Report, which named a Chinese military unit as the source of a multitude of cyberattacks on American companies, was the fruit of six years of investigative work and could only determine that the attacks emanated from the building where the unit was housed. Moreover, a NATO report, which looked into cyberattacks that hit Georgia during the Russia-Georgia conflict of 2008, determined that there was a lack of proof that Georgia suffered injury at the hands of the Russian government. The report thus concluded that the law of armed conflict could not be invoked in this case.
That having been said, while full certainty about the culprit of a cyberattack is judged necessary for certain legalistic determinations, it is much less significant from an analytical perspective. After all, even a strong suspicion on the part of a victim state that another state was behind an attack could theoretically set off a chain reaction of cyberattacks and reprisals from the warring parties. In addition, the ability to trace attacks back to the source has been improving, as noted in the latest CIA Intelligence Assessment. For this reason, various countries building up their cyber commands now appear to be engaged in a cyber-arms race, seeking mutually assured cyber destruction. The latest U.S. cyber strategy acknowledges that cyberattacks can be deterred to some extent—and implicitly, identified—stating that the U.S. “must be able to declare or display effective response capabilities to deter an adversary from initiating an attack.” In other words, the cyber realm is far from “stateless.”
This is not to say that key threats in cyberspace emanate only from state actors. Regarding cyberterrorism, there were the jihadist hacks of the social media platforms of the U.S. military’s Central Command (CENTCOM) and the websites of the French TV station TV5Monde. On the cyber criminality front, “credit card theft that has hit almost every major retail firm.”
That the worst of cyberattacks may involve non-state actors is precisely the point. For this reason, Obama’s first cyber “czar” (White House Cyber-Security Coordinator) Howard Schmidt preferred to avoid the term cyberwar—going as far as to call it a “terrible metaphor”—given that most cyberattacks, in his view, resemble acts of criminality and terrorism, not war.
One could object to the above by noting that the state actor criterion for war is weakening. Indeed, long gone are the days of official war declarations. Now, wars are fought by drones and Special Forces against non-state actors in a “war on terrorism.” Nonetheless, even in these cases, unless a state gives its accord for another power to launch attacks on its territory, the attacks still involve a violation of state sovereignty. Wars on terrorism tend also to be wars on the governments that harbor them.
The analogies of this reasoning to the cyber realm are quite clear. As Naím points out in the previously mentioned article on the dangers of cyberwar to democracies: criminal networks in Russia and China enjoy the “impunity of their governments.” He added for comparison, “U.S.-based criminal networks don’t operate internationally knowing that they can rely on the protection of friends and accomplices at the highest levels of government.” This raises the question: will victim states strike back, launching a cyberwar against those harboring the cyber criminals?
Moreover, while the definition of war requires that states are the ones doing the attacking, more debatable is whether official militaries need to be the ones targeted by the attacks. In today’s “asymmetric warfare,” weaker parties often choose to terrorize civilians rather than compete with stronger military powers (although, there are terms other than war to describe this phenomenon as well, such as “state sponsored terrorism” and “crimes against humanity”).
The cyber realm is frequently cited as another branch of the asymmetric war strategy, by which a party with fewer means could inflict major damage on a stronger, more digitized adversary, including via attacks on the victim state’s private sector. There is thus legitimacy in arguing that a state-led cyberattack on a private company of another state—such as the attack on U.S.-based Sony Pictures, blamed by President Obama on Pyongyang—is in fact an act of warfare.
- War Causes Measurable Damage
According to the oft-quoted early-19th century war strategist Clausewitz, war requires lethal violence. Drawing on this wisdom, Thomas Rid argued in his 2013 book, entitled Cyber War Will Not Take Place, that the prospect of cyberwar is rather unlikely given that cyber weapons have not killed a single person.
First of all, the fact that it has not yet happened does not make it impossible for cyber weapons to lead to loss of life, either civilian or military. Going back to the power grid and air traffic control examples, the former could indirectly cause deaths by shutting down heating in the winter and cooling in the summer, while the latter could more directly result in mass casualties by downing airplanes. While the above examples may seem far-fetched, if these risks were to go ignored, the prospect of them occurring would be greater.
Moreover, Rid’s demand that all types of “war” require physical violence is too stringent. To be sure, some people take the word “war” too far. Aside from the war on terrorism, we hear of wars on drugs and crime and even global warming and obesity. “War” in these contexts is diluted in meaning, used merely as a term to generate attention and mobilize resources for a particular cause. But these are all wars on something, not wars plain and simple.
A better usage of the word “war,” analogous to cyberwar, is the concept of trade wars. These share the properties of the political and instrumental nature of war carried out by state actors, but are devoid of lethal violence. At the same time, they can involve measureable harm—economic violence—with similar properties to traditional wars in terms of the possibilities for attacks, retaliations, and escalation. A similar employment of “war” could be a futuristic robot war, in which robots do the fighting and suffer losses rather than actual people—a truly “zero dead war.”
Back to the trade war concept: what’s more is that they have the potential to escalate into real wars. The blockading of ports has been accepted under international law as an act of war, which could legitimately invite military retaliation by the victim state.
Estonian Prime Minister Andrus Ansip applied this concept to the cyber realm, asking, “What’s the difference between a blockade or harbors or airports of sovereign states and the blockade of government institutions and newspaper websites?” These remarks followed the 2007 cyberattacks on Estonian government, media, and banking services, believed to have been perpetrated by Russia. The attacks cost Estonia—Europe’s most digitized economy—many millions of Euros. This might not sound like much, but as John Arquilla argued in Foreign Policy, “A scaled-up version of this kind of cyberwar, to America-sized attacks, would cause damage in the hundreds of billions of dollars.”
Given this reality, new doctrines are emerging that justify military retaliation in the case of a cyberattack. French National Intelligence Coordinator Ange Mancini testified in 2013 that “cyberattacks should…be considered as acts of war,” implying that a proportionate military response would be justified. The 2011 U.S. military strategy states that cyberattacks may provide a casus belli for military retaliation, just as a traditional act of war. Moreover, last fall, NATO announced that a cyberattack on a member state could constitute grounds to invoke its collective defense mechanism.
Spying vs. War
On the other hand, one of Rid’s points about war requiring lethal force is to distinguish it from espionage, sabotage, and subversion. Regarding espionage, many of the accused acts of cyberwar in the media refer to industrial espionage or wide-scale hacking into systems to steal reams of information. For example, China was accused of stealing 50 terabytes of data—the equivalent of five Libraries of Congress—in penetrations of U.S. Department of Defense (DOD) systems. We are left wondering: is this spying or war?
The U.S. itself is frequently accused of listening into the communications of friends and foes alike, especially since the Snowden revelations. For many in the intelligence community, this is all just the “fair game” of the spy world. If that’s the case, then is China’s hacking also part of the fun? Of course, whether we call it war or spying, the problem is that China is not exactly seen as a friend by the U.S. defense establishment. Spying on its part is thus an American national security concern, but it’s not necessarily a breach of international law, as would be the case for a use of force. Acknowledging this, Michael Hayden, former NSA and CIA Director, said of the OPM hack, “This isn’t shame on China. This is shame on us.” After all, China’s spies were doing what one would expect them to do, while the U.S. government’s cybersecurity was lacking.
On the other hand, beyond cyber spying, China is more specifically accused of cyber industrial espionage, which amounts to another “s” word—stealing—the theft of intellectual property. The above mentioned 50-terabye data grab of the DOD, for example, reportedly included blueprints for the F-35 striker plane, allowing China to replicate the model. More to the point, the target of China’s spying is not just the military and diplomatic sectors, but notably the private sector. Indeed, the U.S. Department of Justice issued criminal charges against five Chinese military officers, accused of hacking various U.S. companies. Still to be determined is whether the OPM hack targeted government officials for purely diplomatic reasons or rather to steal their personal identifying information in order to gain access to their credit cards and bank accounts.
To be sure, according to a recent Wikileaks report, the U.S. engaged in “economic espionage,” targeting Brazil. Leaving aside the merits of the accusation, one response is that this still does not reach this scale of industrial espionage of which U.S. officials have accused China. At the same time, one has to admit that these kinds of distinctions between one form of espionage and another may be more of an American perspective than universally accepted as “rules of the game.” It is nonetheless still open for discussion if economic or industrial theft could indeed constitute an act of cyberwar.
- The Damage Must Reach a Certain Threshold of Severity
While the above discussion sought to tease out the difference between acts of cyberwar and spying, still to be resolved is how to distinguish cyberwar from sabotage and subversion. The answer is to establish a threshold of severity. Social scientists categorize wars in the Correlates of War Database only when they result in a minimum of 1,000 battlefield deaths on both parties to the conflict. For trade wars, vast trade barriers would not themselves comprise a war, even if they could result in one if they set off a tit-for-tat reaction with each party increasing its protectionist measures or starting a real war over the issue. In the cyber realm, it is even more challenging to determine at what point the line is crossed between cyber sabotage and actual cyberwar.
Already, pundits have claimed that there have been various cyberwars. For example, a 2013 Vanity Fair article declared “history’s first known cyberwar.” It referred to cyberattacks pitting the U.S., Israel, and Gulf States against Iran. After the U.S. and Israel unleashed Stuxnet, Iran is believed to have retaliated by targeting American banks and Gulf energy companies. Increasingly sophisticated attacks on Wall Street firms, presumably by Iran, only came to a sudden halt in March 2014, after progress was made in talks over Iran’s nuclear program.
More recently, reports suggested that Russia entered a cyberwar against the U.S. by stealing “huge amounts” of account data from JPMorgan Chase and other American companies in retaliation for the U.S. sanctions on Russia over the conflict in Ukraine.
One dissatisfying aspect of labelling the above two examples war—aside from the lack of attribution to state actors with certainty—is that they involved mostly low-intensity conflict. Suffice is to say that whether or not the Iran-U.S. attacks actually constituted a cyberwar, the impact was not the most alarming, even if Stuxnet is in a category unto itself in terms of the sophistication of the attack. It could be argued that Stuxnet was a better outcome for Iran than would have been the possible alternative: conventional strikes on its nuclear facilities.
On the other hand, others would argue that it is fair to call Stuxnet an act of cyberwar, even if not war itself. The question remains: where is the threshold? A 2013 paper by the Institut Français des Relations Internationales attempted to establish just that, ranking cyberattacks on a scale of 0 to 6 in severity, with only level 6 reaching cyberwar. Level 0 is an attempted system penetration, repulsed by nominal means (e.g. anti-virus software). Next, there are « incident, » « intrusion, » and « serious pirating » (levels 1 through 3), which should be responded to by system administrators or private cybersecurity companies. Finally, there are « attack” (level 4), including indirect attacks on state networks or the perturbing of an “operator of vital importance (OIV)” (for example, institutions that provide state services in energy and transportation); « serious sabotage” (level 5), including attacks that paralyse an OIV or disrupt the functioning of state systems; and finally a “major attack” (level 6), including attacks that seek to paralyze the ensemble of a state’s systems, particularly in the defence and security domain.
According to the author of the report Michel Baud, only the three highest levels of severity demand a response from state actors or institutions, and only a “major attack” is labelled in his diagram as cyberwar. In Baud’s view, the attacks which temporarily halted oil flows at Saudi Aramco only constituted serious sabotage (level 5). The 2007 attacks on Estonia, on the other hand, did indeed rise to the cyberwar level, given that “the government and society of this country were totally paralyzed for many days.”
Along similar lines, at the February Cybersecurity Summit, U.S. Defence Secretary Ashton Carter defined a “major cyberattack” that would invite retaliation from the U.S. His definition was different from that of Baud: for Carter, a “major cyberattack” is “something that threatens significant loss of life, destruction of property or lasting economic damage.” If one agrees that a “major attack” means cyberwar (or at least the start of one), then we have here a path to determining the level of severity required, even if “destruction of property” is rather broad.
What’s in a Name?
The above analysis laid out an outline for thinking through the meaning of cyberwar even if it leaves many questions unanswered. One skeptical concluding thought is that none of the above discussion actually matters. Whether or not one calls a series of cyberattacks “war,” there are always ways to conceive of legitimate and proportionate responses. The diplomatic and coercive toolbox of nation-states does not only become available once war is declared. Even if spying is not war, a victim government could arrest the spies. The more important issue, of course, is to define strategies to defend against, deter, or respond to cyberattacks, whatever one wants to call them. Cyberattacks or hacks do not need to be called war in order to generate resources to confront them. “A serious breach of economic or national security” should suffice.
At the same time, the analysis shows that certain cyberattacks should indeed be called acts of cyberwar. An important point, however, is that cyberwar is often not the same as kinetic war, centered on the military domain. Hence, cybersecurity responses focused squarely on building cyber military commands are insufficient, since many attacks target the private sector or civilian infrastructure. And if one calls attacks on private enterprise war, one also needs to bear in mind that many Silicon Valley executives would argue instead that the enemy is internal. Chinese criminals may hack their systems, but China is also one of their largest markets. Actually, Snowden’s revelations about NSA Internet spying is projected to cost U.S. cloud and outsourcing providers $47 billion, according to Forrester Research, by turning away clients in a number of overseas markets. The economic security of these companies was thus harmed by the NSA, pursuing traditional national security goals (even if the damage was mitigated in part by the expectation that other governments do the same or worse). Therefore, increased public-private partnerships are needed to address cybersecurity and cyberwar risks, in ways that do not alienate the very private sector companies that governments are seeking to protect.
Finally, defining cyberwar may be more than just an academic exercise in semantics. When it comes to international legitimacy and norms, war carries a heavy weight. And does it really matter if a foreign state shoots down an airplane with a rocket launcher or a cyber-weapon that confuses air traffic control? The means matter less than the harm inflicted. If we speak of national economic security, the harm does not strictly require physical damage. Therefore, why should the cyber domain not be one susceptible to wars? In fact, many would consider cyberwar the very future of warfare—though, this is a debatable point. Indeed, now that the key elements of cyberwar have been explained, a next question regards the risk of it occurring… a subject for another blog.
Nathalie Guibert, « 1 milliard d’euros pour faire face à la cyberguerre », Le Monde, 7 February 2014. News
Steve Ranger, “Inside the secret digital arms race: Facing the threat of a global cyberwar,” TechRepublic, 24 April 2014. Article
Jason Ryan, “CIA Director Leon Panetta Warns of Possible Cyber-Pearl Harbor,” ABC News, 11 February 2011. News
Martin Dempsey, Letter to the U.S. Senate Committee on Commerce, Sciences, and Transportation, 1 August 2012. Link
James R. Clapper, Worldwide Threat Assessment of the US Intelligence Community, U.S. Senate Armed Services Committee, 26 February 2015. Link
Aarti Shahani, “Report: To Aid Combat, Russia Wages Cyberwar Against Ukraine,” National Public Radio (NPR), 28 April 2015. News
Mike Levine and Jack Date, “22 Million Affected by OPM Hack, Officials Say,” ABC News, 9 July 2015. News
Moisés Naím, “Why Cyber War Is Dangerous for Democracies,” The Atlantic, 25 June 2015. Article
Jeffrey Carr, “What is Cyberwar?” Slate, 12 August 2011. Article
U.S. Department of Defense, The Department of Defense Cyber Strategy, April 2015. Link
U.S. Department of Defense, Joint Terminology for Cyberspace Operations, November 2010, “cyberwarfare” p. 8. Link
Connor Gaffey, “German missiles ‘hacked by foreign source,’” Newsweek, 8 July 2015. News
President Barack Obama, “Remarks by the President at the Cybersecurity and Consumer Protection Summit,” Stanford University, Stanford, California, 13 February 2015. Speech
Mandiant, Exposing One of China’s Cyber Espionage Units, 18 February 2013. Link
CBS News, “Russia tops list of nation-state cyber threats against U.S.,” 26 February 2015. News
Tim Starks, “The State Department’s Weary Soldier in America’s Cyber War,” Foreign Policy, 13 May 2015. Article
Hunter Walker, “The US Military Just Got Hacked By ‘ISIS,’” Business Insider, 12 January 2015. News
France 24, “France’s TV5Monde targeted in ‘IS group cyberattack,’” 9 April 2015. News
P.W. Singer and August Cole, “The Reality of Cyberwar,” Politico, 9 August 2015. Article
Ryan Singel, “White House Cyber Czar: ‘There Is No Cyberwar,’” Wired, 4 March 2010. Article
Andrew Phillips, “The Asymmetric Nature of Cyber Warfare,” USNI News, 14 October 2012. Article
Thomas Rid, Cyberwar Will Not Take Place, C. Hurst & Co., 2013.
Stephen Lendman, “Blockades: Acts of War,” Global Research, 18 August 2008. Link
John Arquilla, “Cyberwar is Already Upon Us,” Foreign Policy, 27 February 2012. Article
David E. Sanger and Elisabeth Bumiller, “Pentagon to Consider Cyberattacks Acts of War,” New York Times, 31 May 2011. News
French National Assembly, Committee on National Defense and Armed Froces, “Audition de M le préfet Ange Mancini, Coordonnateur national du renseignement,” 5 February 2013, p. 7. Link
Lolita Baldor, “Carter: NATO must bolster cyber defense before addressing cyber warfare,” Newser, 24 June 2015. News
Franz-Stefan Gady, “New Snowden Documents Reveal Chinese Behind F-35 Hack,” The Diplomat, 27 January 2015. Article
James Joyner, “Was China OPM Hack Fair Game?” Outside the Beltway, 19 June 2015. Blog
Ellen Nakashima, “U.S. decides against publicly blaming China for data hack,” Washington Post, 21 July 2015. News
BBC, “Wikileaks: US ‘routinely spied’ on Brazil,” 4 July 2015. News
Meredith Sarkees, “The COW Typology of War: Defining and Categorizing Wars (Version 4 of the Data)” 2010. Link
Michael Joseph Gross, “Silent War,” Vanity Fair, July 2013. Article
The Guardian, “JPMorgan Chase among US companies ‘targeted by Russian hackers,’” 28 August 2014. News
Michel Baud, « Cyberguerre: En quête d’une stratégie » Institut Français des Relations Internationales, Focus stratégiques no. 44, May 2013. Report
David Sanger, Pentagon Announces New Strategy for Cyberwarfare,” New York Times, 23 April 2015. News
Larry Dignan, “Snowden, PRISM fallout will cost U.S. tech vendors $47 billion, less than expected,” ZDNet, 2 April 2015. News