An attack on Poland in September seems to have been another one targeting a country involved in some kind of conflict or controversy with Russia, following Estonia in 2007 and Lithuania and Georgia in 2008. It is likely that disputes between Russia and its neighbors will continue to translate into cyber incidents in the future, as they have in the recent years, particularly as growing dependence on online services increases vulnerability of the civilian online infrastructure.

While these operations were not all-out attacks, it is likely that in some cases they were warnings or attempts to evaluate other states’ cybersecurity systems. It is likely that national governments as well as international alliances, such as NATO, will soon need to improve their methods of dealing with massive cyberattacks, following the steps of the US administration, which has already completed a cybersecurity review and is considering inclusion of the cyberattacks in laws of war and alliance agreements.

Poland

In mid October 2009, the Polish Internal Security Agency (ABW) informed the public that a month before a simultaneous large hacking attack, which had originated in Russia, had targeted a range of government websites in the country. The attack took place immediately following Russian President Vladimir Putin’s visit to Poland to commemorate outbreak of the World War II and amid the heated debate in the Polish parliament regarding the Russian aggression on Poland in 1939 and the Katyń massacre.

Already months before the attack, when Poland and the Czech Republic signed a missile shield agreement with the US, the Kremlin threatened the two countries with an “asymmetric response” to the construction of the shield’s elements. While the details of the attack are classified, the deputy head of ABW Colonel Paweł Białek said that the Agency’s cyberpatrols, which are in charge of protecting the cyberspace of more than 50 governmental and local agencies, had successfully averted the hacking attempt and that the public did not notice any disruptions.

The attack was not as serious as the one that targeted Estonia two years before, but it was likely a test the effectiveness of Polish cybersecurity. While minor attacks targeting various internet servers and websites, including those of state agencies are frequent, their scale and scope are much smaller than the one that targeted Poland in September.

Georgia

During the South Ossetia war in August 2008, Russian hackers carried out a series of attacks on Georgian websites, which aided the country’s military effort by severely disrupting Georgia’s communications capabilities. More than 20 sites, including those of Georgia’s president, the Defense Ministry, its banks as well as news websites were disabled for more than a week. While the investigation by a US-based nonprofit research institute, the US Cyber Consequences Unit, did not prove any direct link between the attacks and Kremlin, the timing of both military and cyber campaigns suggests that indirect coordination between the two was likely. The Russian and Turkish servers orchestrated a botnet attack which caused thousands of hijacked computers to try to access selected Georgian websites at once, effectively jamming them.

Estonia

The unprecedented scale of cyberattacks which targeted Estonia for three weeks in April and May 2007 accounted for the first such incident targeting a state. Being one of the most advanced e-societies in Europe, where almost all transactions, ranging from e-voting to receiving exam results, can be done electronically, Estonia’s high dependence on computers and the internet made it more vulnerable to a hacking attack than other European states.

At the end of April 2007 tensions between Russia and Estonia were running tense. Following a dispute about the relocation of a statue of a Soviet soldier from the center of the Estonian capital, Tallinn, a cyberattack on a massive scale disabled websites of Estonia’s governmental agencies, political parties, banks, newspapers and companies as well as the operation of the country’s emergency number. The paralysis of the country’s online banking systems brought a loss of €750 million ($1.1 billion) to the Estonian state, which translated into 3 percent of its GDP. The removal of the memorial on 27 April, which sparked massive protests by the Russian minority resulting in arrests and violent clashes, was a clear trigger for the attack.

The operation, during which selected websites experienced tens of thousands of visits, overcrowded their servers’ bandwidths, effectively jamming and disabling the websites. While the visits came from all over the world, during the initial phase of the attack the Estonian security officials were able to identify some of the internet addresses. They tracked many of the attacks to Russian websites, and some to Russia’s federal institutions.

NATO experts suggested that an attack on such massive scale could not have been carried out by a few hackers, and that there must have been coordination at the higher level. While the attacks began on 27 April, on the day the relocation of the Soviet statue, they peaked on 9 May, Russian Victory Day, which celebrates the defeat of the Nazi Germany, and when Putin gave a speech attacking Estonia.

The attack caused an alarm within NATO: Such an offense targeting a single member could have significant security implications for entire alliance. While Estonia raised the issue within the EU and NATO, cyberwarfare against one of the Organization’s members does not evoke the provisions of Article V of the NATO Treaty, as international agreements have not defined such action, despite causing severe damage to the operations of a state apparatus, as military action.

While it is difficult to prove clear role of the Russian government in the cyberattacks, the evidence discovered by NATO and the EU investigations as well as suggested by Estonia’s security officials points to the involvement of the Russian state in at least coordination of these operations. Several cybersecurity experts indicated that some of the techniques used during the Estonia attack were beyond the capacity of ordinary hackers.

While Estonia did not prove that Russia’s government was behind the attacks, the latter’s refusal to cooperate and investigate the Russian websites involved in the hacking likely indicates that there was some involvement from the Russian side.

Young Russians have earned the reputation for hacking skills, likely mainly due to mass scale unemployment and growing availability of the internet in the country. The recent increase in the hacking activity originating from Russia, while mostly resulting in minor cyber vandalism, has also resulted in some high-profile operations. In 1999, a series of attacks by Russian hackers disrupted NATO and Pentagon websites. This is not to even mention ‘regular’ credit card thefts, phishing activity as well as disrupting pro-Chechen or human rights or opposition websites in Russia.

Several Russian agencies, including the Federal Security Service (FSB) often employ hackers, who are considered among the best in the world. A known practice by FSB is giving the option of working for the agency instead of prosecution for hackers caught for cybercrimes.
Hackers are highly useful to state security agencies, as they can cause severe disruptions, but responsibility for their actions is easily
deniable.

Despite the accusations of the Russian cyberexperts that western press largely exaggerates the issue, the threat posed by these hackers to other states is likely a legitimate one.

International Relations and Security Network (ISN)

Creative Commons “Attribution 3.0 Unported”

The mission of Cyber Command is to protect the U.S. military’s networks and to be ready to launch offensive cyber attacks on a potential enemy. Those offensive cyber attacks have the potential to reach out from cyberspace into the physical dimension, causing giant electrical generators to shred themselves, trains to derail, high-tension power-transmission lines to burn, gas pipelines to explode, aircraft to crash, weapons to malfunction, funds to disappear and enemy units to walk into ambushes. Welcome to warfare in the twenty-first century.

We have become accustomed to the pilots of Predator and Reaper drones driving a few miles to their homes in Virginia and dinner with their kids after having “flown” aircraft all day on the other side of the globe, firing deadly Hellfire missiles into houses of terrorists in Pakistan. That looks like war as PlayStation: death by joystick, no risk of being shot down, no chance of capture. Now, with cyber war, we have another means of launching attacks on the other side of the world, this time with only a keyboard. In Vietnam and Iraq, U.S. pilots were shot down while attempting to bomb enemy air-defense missiles. Now, a cyber warrior might simply shut off an air-defense network or cause missiles to explode on their launch rails, not by using a laser-guided missile, but by activating a logic bomb. Cyber war could well mean fewer casualties, less physical destruction. Surely then, it is a good idea.

PERHAPS NOT. Much like sixty years ago when we first began to deal with strategic nuclear weapons, we have neither outlined a clear strategy nor had an open debate about how best to deal with this new capability and this new threat. As former–Secretary of Defense Robert McNamara discovered, without a real strategy for the use of strategic nuclear weapons, we risked annihilation of both ourselves and our enemies. The Strategic Air Command (SAC) had a simple plan: the United States would perceive when the Soviet Union was getting ready to attack us and then SAC would go first, launching all of its weapons against all of its possible targets in the Soviet Union, China and the Warsaw Pact nations of Eastern Europe. Horrified by that idea, McNamara commissioned work that developed a strategy of deterrence, including withholding attacks on cities, controlling escalation, minimizing crisis instability and initiating nuclear-arms control. Much of the development of that strategy was done in public, in speeches by then-President John F. Kennedy and McNamara, and in books by academics such as Herman Kahn, founder of the Hudson Institute, and MIT professor William Kaufmann. This is exactly the kind of discussion we need to have today. For it is not an overstatement to say that the body of work on atomic strategy initiated in the Kennedy administration probably prevented a nuclear war in which hundreds of millions may have died.

We sit at a similar historical moment. War fighting is forever changed. Though it will never produce the kind of death toll of nuclear weapons, we can see echoes of these same risks and challenges in today’s newest cyber-war battlefield. We’ve developed a plethora of gee-whiz technological capabilities in the past few years, but cyber war is a wholly new form of combat, the implications of which we do not yet fully understand. Its inherent nature rewards countries that act swiftly and encourages escalation.

AS IN the 1960s, the speed of war is rapidly accelerating. Then, long-range missiles could launch from the prairie of Wyoming and hit Moscow in only thirty-five minutes. Strikes in cyber war move at a rate approaching the speed of light. And this speed favors a strategy of preemption, which means the chances that people can become trigger-happy are high. This, in turn, makes cyber war all the more likely. If a cyber-war commander does not attack quickly, his network may be destroyed first. If a commander does not preempt an enemy, he may find that the target nation has suddenly raised new defenses or even disconnected from the worldwide Internet. There seems to be a premium in cyber war to making the first move.

And much as in the nuclear era, there is a real risk of escalation with cyber war. Nuclear war was generally believed to be something that might quickly grow out of conventional combat, perhaps initiated with tanks firing at each other in a divided Berlin. The speed of new technologies created enormous risks for crisis instability and miscalculation. Today, the risks of miscalculation are even higher, enhancing the chances that what begins as a battle of computer programs ends in a shooting war. Cyber war, with its low risks to the cyber warriors, may be seen by a decision maker as a way of sending a signal, making a point without actually shooting. An attacker would likely think of a cyber offensive that knocked out an electric-power grid and even destroyed some of the grid’s key components (keeping the system down for weeks), as a somewhat antiseptic move; a way to keep tensions as low as possible. But for the millions of people thrown into the dark and perhaps the cold, unable to get food, without access to cash and dealing with social disorder, it would be in many ways the same as if bombs had been dropped on their cities. Thus, the nation attacked might well respond with “kinetic activity.”

Responding, however, assumes that you know who attacked you. And, one of the major differences between cyber war and conventional war—one that makes the battlefield more perilous—is what cyber warriors call “the attribution problem.” Put more simply, it is a matter of whodunit. In cyberspace, attackers can hide their identity, cover their tracks. Worse, they may be able to mislead, placing blame on others by spoofing the source.

In 2007, the Russian government denied that it had engaged in primitive cyber war against Estonia that took out such things as the financial-services sector, and in 2009 claimed it was not responsible for largely identical activity against Georgia; though Russia did concede that some of its citizens, outraged over the conflict in Abkhazia, might have launched the denial-of-service attacks.

In July of this year, cyber attacks were launched against commercial and government websites in the United States and South Korea. The targets included the White House and Washington Post homepages. South Korean intelligence officials blamed the North. The attacks, however, seemed to originate inside South Korea.

For years, masses of data have been stolen from sensitive U.S. government and defense-contractor computers in attacks that investigators have code-named “Moonlight Maze” and “Titan Rain.” Which nation—or nonstate actor—has repeatedly performed the brazen cyber espionage has never been clearly established. What is clear is that cyber warfare poses new risks that we have yet to fully grasp.

THE UNITED States thinks that its cyber warriors are the best at offense, with the capability of shutting down enemy air defenses, electric-power grids, rail systems and telephony. The United States has probably already penetrated many such networks and laced them with trap doors (ways to get back in easily) and logic bombs (software that would wipe out everything on a network).

Such offensive prowess does nothing to defend our own networks from similar attacks, however, and the current U.S. defense systems protect only parts of the federal government, and not civilian or private-sector infrastructure. No nation is as dependent on cyber systems and networks for the operation of its infrastructure, economy and military as the United States. Yet, few national governments have less control over what goes on in its cyberspace than Washington. And these major lapses in our defense present a threat we ignore at extremely high cost.

The possibility of an electric-power grid being hit by a cyber attack is less far-fetched than one might think. A CIA official has admitted that at least one blackout outside the United States was already caused by a cyber attack. An Energy Department laboratory determined that a cyber attack from the Internet could weave its way into the digital control system of a generator and cause the device to self-destruct. Officials have privately confirmed media accounts that logic bombs have already been placed in America’s power-grid control systems, presumably by foreign cyber warriors.

And this problem goes deeper still. The “critical infrastructure” of the transportation, finance, energy and communications sectors are owned and operated by nongovernmental entities, corporations that have proven highly resistant to regulation. The Federal Energy Regulatory Commission (FERC) issued new cybersecurity guidelines to U.S. power companies in January 2008, requiring greater separation of the operations systems from the public Internet. But it took two years for these rules to go into effect (they start in January 2010), and many critics do not believe that the FERC has the ability to audit compliance. The leaders of those corporations, when asked about cybersecurity, almost uniformly believe that they should fund as much corporate cybersecurity as is necessary to maintain profitability and no more. They will defend themselves against cyber crime. Defending them against a cyber war, they all concur, is the job of the government.

Unfortunately, the government has no cyber-defense strategy. While the cyber warriors of Fort Meade may take comfort in America’s reputation as having the most potent arsenal of cyber weapons, they may be members of the national cyber-war team with the lowest overall capability. Indeed, America’s ability to defend its vital systems from cyber attack ranks among the world’s worst. Some countries, like China, have implemented plans allowing them to shut the limited number of portals that connect their cyberspace to the outside world. Other nations, like North Korea, have such limited cyberspace and cyber dependence that there is almost nothing to defend. America’s connectivity to the rest of the world is unlimited and controlled by no plan or agency. If, as a result of a cyber-war attack, our power grids failed, trains stopped and the financial sector froze, the government’s response today would make former–FEMA Director Michael Brown’s performance after Katrina truly look like one “hell of a job.”

While we do have Cyber Command, it has a defensive mission largely limited to protecting the Defense Department. Cyber Command says someone else needs to defend civilian entities, specifically, the Department of Homeland Security (DHS). Unfortunately, DHS has neither a plan nor the capability to defend private-sector infrastructure from a cyber attack. Thus, electric power, gas pipelines, rail and air transport, banking, food-distribution networks and other key systems are defenseless against nation-state cyber attacks.

This asymmetry, in which we are developing offensive capability but doing little to prevent a devastating cyber attack, began in the Bush administration. In the last year of his eight-year presidency, George W. Bush signed a national-security decision called PDD-54. That directive, still classified, ordered steps be taken to improve the security of the Department of Defense and other federal-government computer networks. Critics say it did almost nothing to address the weaknesses of the national infrastructure. President Obama launched a sixty-day review of cyber policy in March, but it resulted in no new major initiatives. He did announce the creation of a cybersecurity position within the staff of the National Security Council (NSC). But it has yet to be filled permanently. The new staffer will report not only to bosses in the NSC staff, but also to Director of the National Economic Council Lawrence Summers—who has vehemently criticized government cybersecurity efforts in the past as imposing costly burdens on U.S. companies, whose leaders supposedly know best what level and type of cybersecurity they need.

When pressed about America’s lack of cyber defenses, several officials privately suggested that there was no nation today that would want to hurt us like that. If that philosophy were applied more broadly to the defense budget, the nation could save hundreds of billions annually—and be left entirely defenseless.

THE FACT that legislators and policy makers do not understand the strategy issues surrounding cyber war may stem from the lack of public discussion, absence of academic contribution, minimal media coverage and insistence on unnecessary government secrecy. A multidepartment effort this year to develop a cyber-war-deterrence strategy produced a paper that is still labeled “secret.” The last time someone thought a secret could deter an opponent was when 1960s movie character Dr. Strangelove yelled at the Soviet ambassador that a deterrent weapon only works “if you tell us you have it.” America was not sufficiently deterred in that movie scenario (an air-force general launched an attack which resulted in escalation into global destruction).

In the absence of a public cyber-war strategy, we do not know today whether an air-force general could launch an effective cyber war. We have not had the basic discussion of whether the United States is better-off with the advent of cyber-war capabilities, or whether it is we who will be deterred in the future by the threat of cyber attack on our vulnerable infrastructure.

Although President Obama may not yet know it, his freedom to maneuver in the world is likely already restricted by those vulnerabilities. Perhaps in a crisis, someone will tell him. Or maybe he will learn it by looking out the window at a darkened city after he has ordered a bombing raid on Iran, or sent a carrier battle group to protect Taiwan, or done something to irritate the Dear Leader of Pyongyang.

Maybe then he will ask policy questions such as: How does deterrence work in cyber war when our capabilities are secret and our weapons undemonstrated? Should we, because of our own vulnerabilities to cyber attack, initiate cyber-arms-limitation talks, instead of our current policy of opposing them? Can arms control work in cyberspace when verification is so difficult? Strategic defense was not possible in nuclear strategy, despite Ronald Reagan’s best efforts, but does that also apply to cyber war? Can public discussion, international norms and established lines of communication result in some sort of risk-reduction process to address the issues of crisis instability that seem to be inherent in cyber war? Are the generals and admirals at Cyber Command more thoughtful than SAC’s leaders were at the advent of the era of strategic nuclear war? We would like to think so, but in the absence of public-policy development, the American people cannot know the answer to that or to the many other questions that the possibility of cyber war raises. It is time for that public discussion.

Richard Clarke was special adviser to the president for cybersecurity in the George W. Bush administration. He is now chairman of Good Harbor Consulting. His book Cyber War, coauthored with Robert Knake, will be published by HarperCollins in the spring.

Abstract: This paper is about the Russian military’s use of operational art to achieve its strategic objectives during the Russo-Georgian War of August 2008. In this brief war, the Russian military, in a quick and decisive campaign, overwhelmed Georgian forces to gain control of two breakaway republics, destroyed much of Georgia’s armed forces on land and sea, and caused NATO to reconsider its offer of membership to Georgia. This study focuses on the Russian military’s present conception of operational art, the relationship between operational art and strategy, and the ability of the Russian armed forces to apply it in a war, a matter of strategic importance to Russia. To accomplish this, this study examines the roots of Soviet thought and practice on operational art and points out the significant changes over time which have affected current thought and practice. The paper analyzes significant aspects of the campaign in Georgia that reflect not only Russia’s rich tradition of operational art, but also reflect Western thinking and new Russian thinking. The study examines the future of Russian operational art based on recently announced military reforms.