What Would a Real Cyberwar Look Like?

Thomas Rid slate.com Talk of combat in the fifth domain has become a fixture in Washington. But let's not use that as an excuse to quash a free Internet, says a war studies academic. Exactly two decades ago, the RAND Corp., an influential think tank, proclaimed that "Cyberwar is Coming!" In 2005 the U.S. Air Force declared it would now "fly, fight, and win in cyberspace." The future of war would surely play out in that fifth domain, on top of land, sea, air, and space. Dark warnings of "Cyber Pearl Harbor" soon became a staple of Washington discourse. Leaks revealed last week that the U.S. government spends a staggering $4.3 billion a year on cyberoperations. In 2011 American intelligence agencies reportedly mounted 231 offensive operations. The United States, it seems, is gearing up for cybercombat. What would an act of cyberwar look like? History suggests three features. To count as an armed attack, a computer breach would need to be violent. If it can't hurt or kill, it can't be war. An act of cyberwar would also need to be instrumental. In a military confrontation, one party generally uses force to compel the other party to do something they would otherwise not do. Finally, it would need to be political, in the sense that one opponent says, "If you don't do X, we'll strike you." That's the gist of two centuries of strategic thought. No past cyberattack meets these criteria. Very few meet even a single one. Never has a human been injured or hurt as an immediate consequence of a cyberattack. Never did a state coerce another state by cyberattack. Very rarely did state-sponsored offenders take credit for an attack. So if we're talking about war—the real thing, not a metaphor, as in the "war on drugs"—then cyberwar has never happened in the past, is not taking place at present, and seems unlikely in the future. That is not to say that cyberattacks do not happen. In 2010 the United States and Israel attacked Iran's nuclear enrichment program with a computer worm called Stuxnet. A computer breach could cause an electricity blackout or interrupt a city's water supply, although that also has never happened. If that isn't war, what is it? Such attacks are better understood as either sabotage, espionage, or subversion. Code-borne sabotage is a real risk. Industrial control systems run all sorts of things that move fast and can burn: trains, gas pipelines, civilian aircraft, refineries, even elevators and medical devices. Many of these are highly susceptible to breaches, and information about system vulnerabilities is easily available. to read more click here: slate.com