Cyber warfare developing into larger threat for U.S., it’s allies

As a rule, the US tends to avoid international treaties to solve big international problem especially when it comes to war, but when it comes to cyber war, America might want to reconsider.

That’s according to Abraham Sofaer from the Hoover Institution who says in this field of war, America may not have the advantage it is used to — or perhaps thinks — it has.

Cyber warfare is the term used when one state tries to take down another state’s technical infrastructure. The stuxnet worm, intended to cripple Iran’s uranium enrichment program, is a much discussed example. It’s hard to say when cyber “incursions” reach the threshold of “war,” Sofaer said, because it can be almost impossible to identify combatants.

“People can come up with things that we can’t even think of,” Sofaer said. “There are very bright Iranian kids, Chinese kids, Russian kids and they are being funded by their governments. I’m not suggesting that they are on their own. They are coming up with ways that threaten.”

More developed countries like the U.S. are more vulnerable to cyber attacks because they’re more exposed. But so far there aren’t any clear international alliances being developed to counter the threat.

“My sense is that its more like the wild west out there,” said Kate Jastram, of the UC Berkeley Law School. “I think its really critical as we move into cyber operations that we are clear about what boundaries are going to be put around this activity.”

Cyberspace is an open field for military planners as well as lawyers. Lt. Col. Peter Hayden, deputy legal counsel to the Chairman of the Joint Chiefs of Staff, said the Defense Department just told Congress it had officially moved beyond kinetic warfare, involving physical force.

“The department has the capability to conduct offensive operations in cyber space, to defend our nation, allies and interests,” Hayden said. “If directed by the President, the Department of Defense will conduct offensive cyber operations in a manner consistent with the policy principles and legal regimes the department allows for kinetic operations, including the law of armed conflict.”

The main debate now focuses on how to apply the existing body of international law on warfare and protecting civilians to cyber war.

“The important thing is that cyber attacks may have humanitarian consequences, so it is really fundamental that they are regulated by the law which already exists,” said Anne Quintin, from the International Committee of the Red Cross.

Quintin says the humanitarian consequences of a cyber attack could include damage to infrastructure like power grids and toxic waste facilities. Many legal scholars wonder whether the word “attack” is even appropriate. Cyber “events” can range from hackers trying to infiltrate commercial or government computers for fun, to terrorists trying to cripple air traffic control systems.

And then there’s the question of how bad the threat actually is. Some, like Abraham Sofaer from the Hoover Institution, contend the cyber security industry has a strong interest in stoking fears of cyber “war”.

“Because they want to hype the situation, create massive income for themselves, giving advice to companies and the government about how to protect themselves from this terrible war,” Sofaer said. “I’m quite suspicious about the hype. And if you sit down and you make a list of how many real serious attacks we’ve had in the last decade, it wouldn’t exceed 10.”

But don’t tell that to Estonia or Georgia. Both former Soviet republics suffered crippling attacks on their Internet infrastructures in the last five years. All fingers pointed at Russia.

In cyberwar, there’s no satellite photos of tanks or troop movements and little can be done to prove whether a state has launched an attack.