Towards the Infinitely Virtual World

Cyberspace combines randomly with both wire-based networks and the electromagnetic spectrum, and closely interweaves civil and military digital networks and information systems. This intangible environment has shaken up our daily lives as much as it has our traditional ideas of society, economy and ‘the state’ – the latter defined as a political entity which exercises sovereignty over physical territory. What, then, happens when it presumes to exercise sovereignty, or demonstrate its power over some fragment of invisible territory that is immaterial and ever-changing? What happens to it when its infrastructure and civil and military activities extend a little more every day into cyberspace?

Sun Tsu, Clausewitz and many other strategists throughout history had always forged their strategies for war from three factors: movement, projectile and fire. Until recently, the conduct of war had always implied the notion of movement of troops and vehicles of all kinds, armed with a range of projectiles (arrows, lances, bullets, warheads, missiles and so on) to cause chaos or destruction by kinetic effects or fire—all in a physical environment (land, sea or air) that is easily seen or imagined by the strategist.

Today, man’s dreams and individual designs take form in land, in the air, in and on the water and even in space, for the more fantastic among them, but never in cyberspace. Could Sun Tsu, Clausewitz and company ever have imagined a form of warfare that excluded physical territory, movement and fire?

Cyberspace is largely constituted of software interactions and packets of data travelling at the speed of light, and interconnects vastly-distanced, friendly or enemy information systems using the increasing mobility and ubiquity of digital networks (the concept of ATAWAD – any time, any where, any device). Furthermore, it is not really possible to occupy or to hold such an intangible environment, which is often compared with the sea, as one could with physical territory or airspace. It follows that the time factor is more important than that of space.

Unfortunately, strategic thinking has never yet been directly confronted with these electronic realities, and therefore has now to create new processes, yet without rejecting the well-tested fundamentals for one very good reason: cyberspace is becoming one more dimension of warfare, alongside those of land, sea, air and outer space. Many information warfare analysts and theoreticians focus perhaps too much on their core competencies and often neglect coercive or offensive use by armed forces of conventional weapons, and of the electromagnetic spectrum.

A Cyber-War Today, or Tomorrow?

A cyber-war, that is a real cyber-war using only cyber-weapons, has not yet occurred, any more than has a chemical war, despite the use of chemical weapons during the two World Wars and their frenzied development during the Cold War. Even during the First World War, chemical weapons were used as one type among many others and in the end were not decisive. The existence of cyber-weapons and the recurrence of cyber-attacks do not of themselves constitute a cyber-war. That said, wisely used and targeted cyber-weapons can cause chaos or destruction in the real world in the same way as those chemical weapons did.

So what is a cyber-weapon? Whether it is being handled by armed forces or by a computer hacker, a cyber-weapon is simply a piece of software, a program that aims to take control, paralyse or destroy an IT system. Worms, viruses, cyber-criminal kits and so on are neither more nor less than compilations of algorithms. Many commercial, or even free, network administration and security applications can easily be altered into cyber-weapons by a sufficiently determined and resourceful adolescent.

Compared to nuclear or conventional weapons, the development of cyber-weapons demands very little in the way of technical facilities, logistic backup, human or financial resources, and is a delight for those who would not seek them, be those people regular or non-regular players in the field. Yet is there any point in trying to regulate their production and use, since these shifty lines of code can be recovered and improved by third parties, to their great delight? Several months after the discovery of the Stuxnet worm, which used USB keys to propagate it and thus infect the control systems of a number of centrifuges in the Iranian nuclear programme, and of the transmission of its source code in among hackers, cyber-security experts were hardly surprised to see the arrival of Duqu, another similar worm, yet without the heavier consequences.

Are the Stuxnet and Duqu worms precursors of highly sophisticated methods of automated sabotage, or cybotage? Has the design, experimentation and demonstration of malware dedicated to cybotage of vital infrastructure become an international sport? Everything would seem to indicate that proliferation of cyber-weapons has barely started. These simple facts are going to change everything, politically, tactically and strategically.

The Comparative Advantages of a Cyber Attack

It is therefore evident that using a cyber-weapon, or launching a cyber-attack, has numerous advantages since it allows a state to avoid putting the lives of its troops in direct danger, and thus being confronted by the media and public who would not have the horror of seeing bloody corpses in smoking ruins.

Today the shady concept of cyber-warfare includes cybotage of a control or surveillance system, paralysis of a server, theft of sensitive information, cyber-espionage and numerous other on- or off-line nuisances (Stuxnet proved the point!). It is no longer really a case of hostile action per se, but one of provoking or remotely inducing a logical impact on the enemy system through a mal-intended piece of (software) writing. Hence it is hard to reconcile the concepts of the combatant, an act of war, material damage and human loss within the concept of cyber-warfare. The same goes for notions of necessity, concomitance and proportionality of retaliation in the context of the inevitable problem of deciding who committed the hostile act in this cyber-war and of the unforeseeable damage that might potentially be caused by a cyber-weapon.

Whereas a kinetic weapon produces a localised physical impact on a precise point or within a limited perimeter, a cyber-weapon produces a logical (in the computer sense) impact, which could propagate to information systems other than those targeted, by virtue of communications protocols and the close intermingling of digital networks, and therefore cause vast collateral damage.

Several weeks before operation Iraqi Freedom, the Pentagon considered using a cyber-weapon of its own invention against the Iraqi banking system, but the Bush administration was firmly against it for fear of a damaging domino effect that might have affected the Middle-Eastern and European banking systems. During NATO’s military campaign against the Gaddafi regime, a massive cyber-attack against Libyan surveillance radars was also considered but again the US (Obama) administration preferred to stick with conventional methods of destruction, and refused to cross the Rubicon.

If the United States is at least considering such things, why aren’t we?

The uncontrollable and incalculable dimensions of cyber-weapons and massive cyber-attacks have probably led to exercise of reserve among state and non-state actors alike. We couls almost take comfort in the fact that up to now, at least, cyber-warfare has remained confined to prospection or a conditional future. There is no doubt, however, that we will be greatly surprised and will enter a new world on the day that a state or non-state actor opens that particular Pandora’s box. ♦