Cyber Warfare

by

Julian Richards

• LAST REVIEWED: 11 January 2018
• LAST MODIFIED: 11 January 2018
• DOI: 10.1093/obo/9780199743292-0076

Introduction

Since the mid-1990s, discussion around the prospect of cyber war has become an increasingly hot topic. Many countries now place defense against cyber attacks at the highest level of priority in their national security strategies. The normative view of the threat is that, for those countries with a high level of dependence on information technology (IT) and networked infrastructure, a major cyber attack has the potential to level the playing field of military capability to devastating effect, whether it emanates from a hostile state or a non-state actor such as a terrorist group. Many seized upon events such as the cyber attacks against Estonian networks in 2007 as early salvoes in the new global cyber war. Critical perspectives, however, suggest that cyber activity is fundamentally different from activity in the physical world, and cyber attacks cannot be classified as acts of war as such. There is further suspicion that the level of threat has been overly militarized when its civil dimensions (such as cyber crime) may be more important, and that military and corporate interest groups may be hypersecuritizing the threat for their own gain. Much of the analysis has been conducted in the United States, the dominant military power and one of the most network-dependent countries in the world. Perhaps not surprisingly, many of the normative views of the military cyber threat point the finger of blame squarely at China and, to a lesser extent, Russia, suggesting a new Cold War. Throughout the debate, most accept that cyber threats are real and are growing in complexity and potential impact. Analyzing the nature of cyber threat in the military realm delivers a number of complexities. Much has been written about the legal aspects of “acts of war,” from both offensive and defensive perspectives, and how existing domestic and international regulation may be poorly designed to deal with cyber attacks. Governance of cyber capabilities and cyber defenses is proving to be a complicated affair, cutting across traditional boundaries of public/private, civil/military, and national/international. It is also the case that advanced states wish to be able to develop their own cyber capabilities for both intelligence gathering and strategic action against adversaries. How to deliver deterrence in a cyber context has been considered extensively, with parallels often being drawn with the rise of the nuclear threat in the 20th century. Analysis of case studies of what may constitute cyber attacks will be important in this fast-moving subject area. These case studies are examined from the perspectives of specific incidents in space and time and of specific technologies being used and how to counter them. Generally, cyber war is proving to be a very interdisciplinary subject, spanning technical, legal, sociological, and political realms. This makes it a vibrant new subject, but also a challenging one for academia, since the subject does not easily sit within a single identifiable department. Within the general domain of Security Studies, most of the socio-political analysis has been rooted either in conflict studies, especially the changing nature of postmodern conflict, or in securitization theory and the manner in which the threat is emerging from political discourse. But these are not the only directions from which the subject is being or should be approached.

General Overviews

Given the heightened interest in cyber threats generally, a number of books have emerged recently on the perceived threat of cyber war. Most of these are written by US authors and take a US-centric perspective on the issue, noting the fact that the particular dependence on networked infrastructure in the US military and in society in general could prove to be the country’s greatest weakness in the event of conflict. Many commentaries are also concerned with how the US government should position its cyber defense strategies, with many taking a critical view of progress made in this area. The normative view presented by most books in this field is that the threat of cyber war has gone beyond a hypothetical possibility and is present today. Clarke and Knake 2010, through the former’s position as a National Coordinator on Security, Infrastructure Protection, and Counterterrorism under four former US presidents, promotes this view and warns that US cybersecurity policy is not yet fit for purpose. Geers 2011, working from a position within NATO’s Cooperative Cyber Defence Centre of Excellence in Estonia, agrees that the threat is a major one to international security. Kramer, et al. 2009 presents a similar thesis with some policy recommendations, as does Rosenzweig 2013. Carr 2010 and the edited volume Latham 2003 provide some deep analysis of the nature of the cyber war threat and its complex intermingling with other threat vectors such as crime, activism, and terrorism. Denning 1998 (one of the earliest academic commentaries on cyber threats) and Healey 2013 provide a similar analysis of the changing nature of threat in this area, drawing some interesting parallels with information warfare through history. Green 2015 offers a multidisciplinary look at the question from the standpoints of law and international relations, suggesting that “warfare” is a useful term to cover a spectrum of aggressive cyber activities. Singer and Friedman 2014 emphasizes the importance of the coming “Internet of Things” in delivering new threats, and also the central significance of the United States and China to the global cybersecurity picture. Meanwhile, on the critical front, Rid 2013 challenges the normative view of cyber war, while Richards 2014 is similarly skeptical about whether any of the events seen so far constitute acts of war.

• Carr, Jeffrey. Inside Cyber Warfare. Sebastopol, CA: O’Reilly Media, 2010.

  A comprehensive and valuable overview of the threat landscape that notes the complex blurring of boundaries between different types of cyber threats and activities.

• Clarke, Richard A., and Robert K. Knake. Cyber War: The Next Threat to National Security and What to Do about it. New York: HarperCollins, 2010.

  A detailed and pessimistic assessment of the threats from cyber war to the United States and its ability to formulate suitable policy responses.

• Denning, Dorothy E. Information Warfare and Security. New York: ACM, 1998.

  From a professor of computer science at Georgetown University, a data-rich overview of cases that draw some interesting parallels with cases of information warfare in history.

• Geers, Kenneth. Strategic Cyber Security. Tallinn, Estonia: CCD COE, 2011.

  Published by the US representative at NATO’s cybersecurity center in Estonia, this study suggests the cyber threat has evolved from a computer security issue to a major strategic threat to national and international security.

• Green, James A., ed. Cyber Warfare: A Multidisciplinary Analysis. Abingdon, UK: Routledge, 2015.

  A useful multidisciplinary set of essays on the notion of cyber warfare, encompassing such issues as attribution, regulation, and the applicability of traditional Just War models of analysis.

• Healey, Jason. A Fierce Domain: Conflict in Cyberspace, 1986 to 2012. Vienna: Cyber Conflict Studies Association, 2013.

  A fascinating historical account, from a former cyber warrior in the US Air Force, that concludes with the assessment that a deadly cyber attack has not yet been seen.

• Kramer, Franklin D., Stuart H. Starr, and Larry Wentz, eds. Cyperpower and National Security. Dulles, VA: Potomac, 2009.

  A useful edited volume written in response to a requirement, from the US Under Secretary for Defense, to establish national security policy guidelines in the face of cyber attacks.

• Latham, Robert, ed. Bombs and Bandwidth: The Emerging Relationship between Information Technology and Security. New York: New Press, 2003.

  An edited volume containing chapters, by many of the leading scholars in the field, that explore the changing boundaries between actors and sectors in traditional notions of security with the advent of the information revolution.

• Richards, Julian. Cyber War: The Anatomy of the Global Security Threat. Basingstoke, UK: Palgrave Macmillan, 2014.

  DOI: 10.1057/9781137399625

  A condensed overview of the question of how cyber war can be defined, taking a cautiously critical line that suggests it has not yet been seen in terms of a traditional understanding of acts of war.

• Rid, Thomas. Cyber War Will Not Take Place. London: Hurst, 2013.

  A skeptical assessment of the threat of cyber warfare, yet accepts that cyber threats of a different nature are real and potentially serious.

• Rosenzweig, Paul. Cyber Warfare: How Conflicts in Cyberspace Are Challenging America and Changing the World. Santa Barbara, CA: Praeger, 2013.

  Attempts to outline the seriousness of the risks while emphasizing that there are also many benefits and opportunities in the Information Age.

• Singer, P. W., and Allan Friedman. Cybersecurity and Cyberwar: What Everyone Needs to Know. New York: Oxford University Press, 2014.

  An accessible overview of cybersecurity as a subject, stressing the risks of a lack of understanding about the complexity of cyber technologies amongst senior decision-makers.