Cyberwar: A guide to the frightening future of online conflict

What is cyberwar?

At its core, cyberwarfare is the use of digital attacks by one state to disrupt the computer systems of another in order to create significant damage or destruction.

What does cyberwarfare look like?

Cyberwar is still an emerging concept, but many experts are concerned that it is likely to be a significant component of any future conflicts. As well as troops using conventional weapons like guns and missiles, future battles will also be fought by hackers manipulating computer code.

Governments and intelligence agencies worry that digital attacks against vital infrastructure — like banking systems or power grids — will give attackers a way of bypassing a country’s traditional defences.

Unlike standard military attacks, a cyberattack can be launched instantaneously from any distance, with little obvious evidence in the build up. And it is often extremely hard to trace such an attack back to its originators. Modern economies, underpinned by computer networks that run everything from sanitation to food distribution and communications, are particularly vulnerable to such attacks.

The head of the US National Security Agency (NSA) Admiral Michael Rogers said his worst case cyberattack scenario would involve “outright destructive attacks”, focused on some aspects of critical US infrastructure and coupled with data manipulation “on a massive scale”. Some experts warn it’s a case of when, not if.

What is the definition of cyberwarfare?

Whether an attack should be considered to be an act of cyberwarfare depends on a number of factors. These can include the identity of the attacker, what they are doing, how they do it – and how much damage they inflict.

Like other forms of war, cyberwarfare is usually defined as a conflict between states, not individuals. Many countries are now building up military cyberwarfare capabilities, both to defend against other nations and also to attack if necessary.

Attacks by individual hackers, or even groups of hackers, would not usually be considered to be cyberwarfare, unless they were being aided and directed by a state. For example, cyber crooks who crash a bank’s computer systems while trying to steal money would not be considered to be perpetrating an act of cyberwarfare, even if they came from a rival nation. But state-backed hackers doing the same thing to destabilise a rival state’s economy might well be considered so.

The nature and scale of the targets attacked is another indicator: defacing a company website is unlikely to be considered an act of cyberwarfare, whereas disabling the missile defence system at an airbase would certainly come close. And the weapons used are important too: cyberwar refers to digital attacks on computer systems: firing a missile at a data center would not be considered cyberwarfare.

Cyberwarfare and the use of force

How these factors combine matters because they can help determine what kind of response a country can make to a cyber attack.

There is one key definition of cyberwarfare, which is a digital attack that is so serious it can be seen as the equivalent of a physical attack.

To reach this threshold, an attack on computer systems would have to lead to significant destruction or disruption, even loss of life. This is a significant threshold because under international law states are permitted to use force to defend themselves against an armed attack.

It follows then that, if a country were hit by a cyber attack of significant scale, they would be within their rights to strike back using their standard military arsenal: to respond to hacking with missile strikes. So far this has never happened – indeed it’s not entirely clear if any attack has ever reached that threshold. That doesn’t mean that attacks which fail to reach that level are irrelevant or should be ignored: it just means that the country under attack can’t justify resorting to military force to defend itself. There are plenty of other ways of responding to a cyber attack, from sanctions and expelling diplomats, to responding in kind, although calibrating the right response to an attack is often hard.

What is the Tallinn Manual?

One reason that definitions of cyberwarfare have been blurred is that there is no international law that covers cyberwar, which is what really matters here, because it is such a new concept. That doesn’t mean that cyberwarfare isn’t covered by the law, it’s just that the relevant law is piecemeal, scattered and often open to interpretation.

This lack of legal framework has resulted in a grey area: in the past some states have used the opportunity to test out cyberwar techniques in the knowledge that other states would be uncertain about how they could react under international law.

More recently that grey area has began to shrink. A group of law scholars has spent years working to explain how international law can be applied to digital warfare. This work has formed the basis of the Tallinn Manual, a textbook prepared by the group and backed by the NATO-affiliated Cooperative Cyber Defence Centre of Excellence (CCDCoE) based in the Estonian capital of Tallinn, from which the manual takes its name.

The first version of the manual looked at the rare but most serious cyber attacks, which rose to the level of the use of force; the second edition released earlier this year looked at the legal framework around cyber attacks, which do not reach the threshold of the use of force, but which take place on a daily basis.

Aimed at legal advisers to governments, military, and intelligence agencies, the Tallinn manual sets out when an attack is a violation of international law in cyberspace, and when and how states can respond to such assaults.

The manual consists of a set of guidelines — 154 rules — which set out how the lawyers think international law can be applied to cyber warfare, covering everything from the use of cyber mercenaries to the targeting of medical units’ computer systems. The idea is that by making the law around cyberwarfare clearer, there is less risk of an attack escalating, because escalation often occurs when the rules are not clear and leaders over-react.

Which countries are preparing for cyberwar?

According to US intelligence chiefs, more than 30 countries are developing offensive cyber attack capabilities, although most of these government hacking programmes are shrouded in secrecy.

The US intelligence briefing lists Russia, China, Iran and North Korea as the major “cyber threat actors” to worry about. Russia has a “highly advanced offensive cyber program” and has “conducted damaging and/or disruptive cyber-attacks including attacks on critical infrastructure networks”, it warns.

China has also “selectively used cyber attacks against foreign targets” and continues to “integrate and streamline its cyber operations and capabilities”, said the report, which also said Iran has already used its cyber capabilities directly against the US with a distributed denial of service attacks targeting the US financial sector in 2012-3. The report also notes that when it comes to North Korea: “Pyongyang remains capable of launching disruptive or destructive cyber attacks to support its political objectives.”

US cyberwarfare capabilities

However, it’s likely that the US has the most significant cyber defence and cyber attack capabilities. Speaking last year President Obama said: “we’re moving into a new era here, where a number of countries have significant capacities. And frankly we’ve got more capacity than anybody, both offensively and defensively.”

Much of this capability comes from US Cyber Command, lead by Admiral Rogers who also leads the NSA, which has a dual mission: to protect US Department of Defence networks but also to conduct “full spectrum military cyberspace operations in order to enable actions in all domains, ensure US/Allied freedom of action in cyberspace and deny the same to our adversaries”.

Cyber Command is made up of a number of what it calls ‘Cyber Mission Force teams’. The Cyber National Mission Force teams defend the US by monitoring adversary activity, blocking attacks, and manoeuvring to defeat them. Cyber Combat Mission Force teams conduct military cyber operations to support military commanders, while the Cyber Protection Force teams defend the Department of Defense information networks. By the end of fiscal year 2018, the goal is for the force to grow to nearly 6,200 and for all 133 teams to be fully operational. The US is believed to have used various forms of cyber weapons against the Iranian nuclear programme, the North Korean missile tests and the so-called Islamic State, with mixed results.

Other agencies — such as the National Security Agency (NSA) and CIA — have their own cyber attack capabilities too.

The UK has also publicly stated that is working on cyber defence and offence projects, and has vowed to strike back if attacked in this manner.

What do cyberweapons look like?

The tools of cyberwarfare can vary from the incredibly sophisticated to the utterly basic. It depends on the effect the attacker is trying to create. Many are part of the standard hacker toolkit, and a series of different tools could be used in concert as part of a cyber attack. For example, a Distributed Denial of Service attack was at the core of the attacks on Estonia in 2007.

Ransomware, which has been a constant source of trouble for businesses and consumers may also have been used not just to raise money but also to cause chaos. There is some evidence to suggest that the recent Petya ransomware attack which originated in Ukraine but rapidly spread across the world may have looked like ransomware but was being deployed to effectively destroy data by encrypting it with no possibility of unlocking it.

Other standard hacker techniques are likely to form part of a cyber attack; phishing emails to trick users into handing over passwords or other data which can allow attackers further access to networks, for example. Malware and virus could form part of an attack like the Shamoon virus, which wiped the hard drives of 30,000 PCs at Saudi Aramco in 2012.

According to the Washington Post, after revelations about Russian meddling in the run up to the 2016 US Presidential elections, President Obama authorised the planting cyber weapons in Russia’s infrastructure. “The implants were developed by the NSA and designed so that they could be triggered remotely as part of retaliatory cyber-strike in the face of Russian aggression, whether an attack on a power grid or interference in a future presidential race,” the report said

Cyberwarfare and zero-day attack stockpiles

Zero-day vulnerabilities are bugs or flaws in code which can give attackers access to or control over systems, but which have not yet been discovered and fixed by software companies. These flaws are particularly prized because there will likely be no way to stop hackers exploiting them. There is a thriving trade in zero-day exploits that allow hackers to sidestep security: very handy for nations looking to build unstoppable cyber weapons. It is believed that many nations have stock piles of zero day exploits to use for either cyber espionage or as part of elaborate cyber weapons. Zero day exploits formed a key part of the Stuxnet cyberweapon (see below).

One issue with cyberweapons, particularly those using zero-day exploits is that — unlike a conventional bomb or missile — a cyberweapon can be analysed and even potentially repurposed and re-used. Also, once used, the zero-day exploits are usually rapidly patched by software vendors, which makes it impossible to use them again. These weapons can also cause much greater chaos than planned, which is what may have happened in the case of the Ukrainian Petya ransomware attack.

What is Stuxnet?

Stuxnet is a computer worm that targets industrial control systems, but is most famous for most likely being the first genuine cyber weapon, in that it was designed to inflict physical damage. It was developed by the US and Israel (although they have never confirmed this) to target the Iranian nuclear programme. The worm, first spotted in 2010, targeted specific Siemens industrial control systems, and seemed to be specifically targeting the systems controlling the centrifuges in the Iranian uranium enrichment project — apparently damaging 1,000 of these centrifuges and delaying the project, although the overall impact on the programme is not clear.

Stuxet was a complicated worm, using four different zero-day exploits and likely took millions of dollars of research and months or years of work to create.

What are the targets in cyberwar?

Military systems are an obvious target: preventing commanders from communicating with their troops or seeing where the enemy is would give an attacker a major advantage. However, because most developed economies rely on computerised systems for everything from power to food and transport many governments are very worried that rival states may target critical national infrastructure. Supervisory control and data acquisition (SCADA) systems, or industrial control systems, which run factories, power stations and other industrial processes are a big target, as Stuxnet showed.

These systems can be decades old and were rarely designed with security as a priority, but are increasingly being connected to the internet to make them more efficient or easy to monitor. But this also makes these systems more vulnerable to attack, and security is rarely upgraded because the organisations operating them do not consider themselves to be a target.

A short history of cyberwar

For many people 2007 was when cyberwar went from the theoretical to the actual.

When the government of the eastern European state of Estonia announced plans to move a Soviet war memorial, it found itself under a furious digital bombardment that knocked banks and government services offline (the attack is generally considered to have been Russian hackers; Russian authorities denied any knowledge). However, the DDoS attacks on Estonia did not create physical damage and, while a significant event, were not considered to have risen to the level of actual cyberwarfare.

Another cyberwarfare milestone was hit the same year, however, when the Idaho National Laboratory proved, via the Aurora Generator Test, that a digital attack could be used to destroy physical objects – in this case a generator.

The Stuxnet malware attack took place in 2010, which proved that malware could impact the physical world.

Since then there has been a steady stream of stories: in 2013 the NSA said it had stopped a plot by an unnamed nation — believed to be China — to attack the BIOS chip in PCs, rendering them unusable. In 2014 there was the attack on Sony Pictures Entertainment, blamed by many on North Korea, which showed that it was not just government systems and data that could be targeted by state-backed hackers.

Perhaps most seriously, just before Christmas in 2015 hackers managed to disrupt the power supply in parts of Ukraine, by using a well-known trojan called BlackEnergy. In March 2016 seven Iranian hackers were accused of trying to shut down a New York dam in a federal grand jury indictment.

Nations are rapidly building cyber defence and offence capabilities and NATO in 2014 took the important step of confirming that a cyber attack on one of its members would be enough to allow them to invoke Article 5, the collective defence mechanism at the heart of the alliance. In 2016 it then defined cyberspace as an “operational domain” — an area in which conflict can occur: the internet had officially become a battlefield.

Cyberwar and the Internet of Things

Big industrial control systems or military networks are often considered the main targets in cyberwarfare but one consequence of the rise of the Internet of Things may be to bring the battlefield into our homes.

“Our adversaries have capabilities to hold at risk US critical infrastructure as well as the broader ecosystem of connected consumer and industrial devices know as the Internet of Things,” said a US intelligence community briefing from January 2017. Connected thermostats, cameras and cookers could all be used either to spy on citizens of another country, or to cause havoc if they were hacked.

How do you defend against cyberwarfare

The same cybersecurity practices that will protect against everyday hackers and cyber crooks will provide some protection against state-backed cyber attackers, who use many of the same techniques. That means covering the basics: changing default passwords and making passwords hard to crack, not using the same password for different systems, making sure that all systems are patched and up-to-date (including the use of antivirus software), ensuring that systems are only connected to the internet if necessary and making sure that essential data is backed up securely. This may be enough to stop some attackers or at least give them enough extra work to do that they switch to an easier target.

Recognising that your organisation can be a target is an important step: even if your organisation is not an obvious target for hackers motivated by greed (who would hack a sewage works for money?) you may be a priority for hackers looking to create chaos.

However, for particularly high-value targets this is unlikely to be enough: these attacks are called ‘advanced and persistent’. In this case it may be hard to stop them at the boundary and additional cybersecurity investments will be needed: strong encryption, multi-factor authentication and advanced network monitoring. It may well be that you cannot stop them penetrating your network, but you may be able to stop them doing any damage.

What is cyber espionage?

Closely related but separate to cyberwarfare is cyber espionage, whereby hackers infiltrate computer systems and networks to steal data and often intellectual property. There have been plenty of examples of this in recent years: for example the hack on the US Office of Personnel Management, which saw the records of 21 million US citizens stolen, including five million sets of fingerprints, was most likely carried out by Chinese state-backed hackers.

Perhaps even more infamous: the hacking attacks in the run up to the 2016 US Presidential elections and the theft of emails from the Democratic National Committee: US intelligence said that Russia was behind the attacks. The aim of cyber espionage is to steal, not to do damage, but it’s arguable that such attacks can also have a bigger impact. Law scholars are, for example, split on whether the hacks on the DNC and the subsequent leaking of the emails could be illegal under international law.

Some argue that it mounts up to meddling in the affairs of another state and therefore some kind of response, such as hacking back, would have been justified; others argue that it was just below the threshold required. As such the line between cyberwarfare and cyberespionage is a blurred one: certainly the behaviour necessary is similar for both — sneaking into networks, looking for flaws in software — but only the outcome is different; stealing rather than destroying. For defenders it’s especially hard to tell the difference between an enemy probing a network looking for flaws to exploit and an enemy probing a network to find secrets.

“Infiltrations in US critical infrastructure–when viewed in the light of incidents like these–can look like preparations for future attacks that could be intended to harm Americans, or at least to deter the United States and other countries from protecting and defending our vital interests,” said NSA chief Rogers in testimony to the US Senate.

Cyberwarfare and information warfare

Closely related to cyberwarfare is the concept of information warfare; that is, the use of disinformation and propaganda in order to influence others — like the citizens of another state. This disinformation might use documents stolen by hackers and published — either complete or modified by the attackers to suit their purpose. It may also see the use of social media (and broader media) to share incorrect stories. While Western strategists tend to see cyberwarfare and hybrid information warfare as separate entities, some analysts say that Chinese and Russia military theorists see the two as closely linked.