4 ms·

The title is, unfortunately, link-baity, misleading, and really misses some of the most alarming parts of this doc. The article from The Guardian[1] is more ba

The title is, unfortunately, link-baity, misleading, and really misses some of the most alarming parts of this doc. The article from The Guardian[1] is more balanced in presenting the actual news. This doc[2] is directed at how to handle state-sponsored and other war-time cyber attacks, offering a set of guidelines that indicate targets that are expressly advised to be off-limits--such as "sensitive civilian targets such as hospitals, dams, dykes and nuclear power stations". It is wrestling with how to understand and apply the Geneva Conventions to cyber attacks (e.g., see Rule 80). Where do civilian hackers come into play? When they're among those "who participate in online attacks during a war". Yes, that is worrisome and potentially alarming if applied too broadly. While abuse of these guidelines concerns me (greatly), this is not a new issue in the art of contemporary war. Consider the French Resistance during WWII--a heavily civilian-populated paramilitary resistance force that not only engaged in intelligence theft & trafficking, but also were highly regarded and notorious for coordinating and executing sabotage against power grids, transportation infrastructure, and telecommunications networks. I think it could be argued that the Resistance is a historical analogue to contemporary hackers/hacktivists engaged in cyber attacks during a state of war. This document is essentially wrestling with the legalities and rules of war that should apply where the contemporary equivalent is concerned. Of course, I'd guess a lot of us would have greater sympathy for Resistance-style hackers engaged in acts of sabotage than, say, state-sponsored hackers who are targeting domestic nuclear facilities. The real meat of the NATO document appears to be circling this line of thinking: < The manual suggests "proportionate counter-measures" against online attacks carried out by a state are permitted. Such measures cannot involve the use of force, however, unless the original cyber-attack resulted in death or significant damage to property. Okay. Prohibition against launching missiles and invasion forces as retaliation for hacking that did not result in death or significant damage to property? Check. (of course, we need to be careful about how we define 'significant damage to property'). This is, however, where the document gets far more interesting and alarming than the OP article mentions. Specifically, note Rule 22 and commentary: > "An international armed conflict exists whenever there are hostilities, which may include or be limited to cyber operations occurring between two states or more . . . To date, no international armed conflict has been publicly characterised as having been solely precipitated in cyberspace. Nevertheless, the international group of experts unanimously concluded that cyber operations alone might have the potential to cross the threshold of international armed conflict." We've now hit the point that state-sponsored digital operations are recognized as having the potential to initiate armed international conflicts. Not only that, but we have a formal declaration that international armed conflict may be limited to 'cyber operations occurring between two states or more'. That is the more alarming bit of news here. [1]: http://www.guardian.co.uk/world/2013/mar/18/rules-cyberwarfare-nato-manual http://www.guardian.co.uk/world/2013/mar/18/rules-cyberwarfa... [2]: http://bit.ly/YTbtRd http://bit.ly/YTbtRd

pfraze 14y ago
I agree that it's alarming to think of cyber-warfare escalating to a war, but I don't think it's unrealistic or uncalled-for. I'm concerned that a cyberattack could be misinterpreted (not really an attack, or originating from another body) but that's an education and sophistication problem, not an error in the legal premise.
- bobwaycott 14y ago
  I, too, do not think it is unrealistic or uncalled-for. My sense of 'alarming' is anchored a bit in a historical position--i.e., we've now reached the point in history where an action taken on a computer in a room in some corner of the world can be the trigger for formal war declarations, and is officially recognized as such. We thought blitzkrieg was a challenge about 75 years ago. This is a huge shift.
ctdonath 14y ago
Viable scenario: a state-organized effort perpetrated solely thru data networks shuts down a nation's entire power grid (electric, gas, etc.), and in a manner where re-activation thereof will be slow & expensive (transformers blown, gas pipes ruptured, etc.) with extensive major civilian consequences (dominating digital economy offline, health/rescue services disrupted/overwhelmed, traffic congestion skyrockets, etc.). Think Stuxnet for the electric company. The perpetrator is identified. Variation: this is detected beforehand, but very little time remains (hours/minutes) before "detonation". Polite diplomatic channels are in no way fast enough. The cyber-attack is traced to 10,000 malware-hijacked PCs in a handful of concentrated residential neighborhoods. Discuss.
- knowaveragejoe 14y ago
  Too many variables uncounted for in the second scenario. For example, do we know what is going to be targeted and through what method it would be attacked? How many legitimate users need web access to this critical service? Assuming that knowledge, there's plenty that could be done if we have forewarning. Take those neighborhoods offline at the ISP level. Alternately, block the zombie IP ranges via firewall at the receiving end. I think the real danger is that we won't have such forewarning, and in the slim chance we did we won't have that crucial knowledge(what specifically is the target and attack vector?).

pfraze 14y ago

I agree that it's alarming to think of cyber-warfare escalating to a war, but I don't think it's unrealistic or uncalled-for. I'm concerned that a cyberattack could be misinterpreted (not really an attack, or originating from another body) but that's an education and sophistication problem, not an error in the legal premise.

bobwaycott 14y ago
I, too, do not think it is unrealistic or uncalled-for. My sense of 'alarming' is anchored a bit in a historical position--i.e., we've now reached the point in history where an action taken on a computer in a room in some corner of the world can be the trigger for formal war declarations, and is officially recognized as such. We thought blitzkrieg was a challenge about 75 years ago. This is a huge shift.

ctdonath 14y ago

Viable scenario: a state-organized effort perpetrated solely thru data networks shuts down a nation's entire power grid (electric, gas, etc.), and in a manner where re-activation thereof will be slow & expensive (transformers blown, gas pipes ruptured, etc.) with extensive major civilian consequences (dominating digital economy offline, health/rescue services disrupted/overwhelmed, traffic congestion skyrockets, etc.). Think Stuxnet for the electric company. The perpetrator is identified. Variation: this is detected beforehand, but very little time remains (hours/minutes) before "detonation". Polite diplomatic channels are in no way fast enough. The cyber-attack is traced to 10,000 malware-hijacked PCs in a handful of concentrated residential neighborhoods. Discuss.

knowaveragejoe 14y ago
Too many variables uncounted for in the second scenario. For example, do we know what is going to be targeted and through what method it would be attacked? How many legitimate users need web access to this critical service? Assuming that knowledge, there's plenty that could be done if we have forewarning. Take those neighborhoods offline at the ISP level. Alternately, block the zombie IP ranges via firewall at the receiving end. I think the real danger is that we won't have such forewarning, and in the slim chance we did we won't have that crucial knowledge(what specifically is the target and attack vector?).