Is Cyberwarfare Fiction? 205
An anonymous reader writes "In response to calls by Russia and the UN for a 'cyberwarfare arms limitation treaty,' this article explains that 'cyberwar' and 'cyberweapons' are fiction. The conflicts between nation states in cyberspace are nothing like warfare, and the tools hackers use are nothing like weapons. Putting 'cyber' in front of something is just a way for people to grasp technical concepts. The analogies quickly break down, and are useless when taken too far (such as a 'cyber disarmament treaty').'"
Re:Warning, noobish question ahead. (Score:5, Interesting)
So that someone somewhere (probably higher up) can work from home.
Probably, anyways. You know how it is.
There is a difference between "war" and "terror" (Score:5, Interesting)
No you haven't; at least not in the sense that matters. Even if there is a country stupid enough to connect it's "off switch" to the internet, all they have to do is pull the ethernet cable and switch it on again. Even if you can break a small proportion of power stations, the rest will come on again. You are a "cybervandal" not a "cyberwarrior".
The real serious cyberwarfare people would do both. A disable the off switch (force it on) and b) drop a graphite bomb at a key place to do weeks worth of damage. That's proper "cyber" warfare.
Cyber"warriors" know the exploit for the radar station and disable the air defences as they fly in with real bombs.
Cyber"guerilla"s mess with account numbers in the fund transfer excels of most of the big companies in the place they target.
There's a whole load of resources which are needed for this stuff. Real test suites where you actually have the control systems of your enemies nuclear power plants; actual buildings where you can try messing up the air conditioning system, people who can actually write serious, fully EAL7 compliant defence systems. People who can write EAL7 compliant versions of exploits (have you seen the state of security software????). etc. etc. etc.
If you think your country's military doesn't have a valid role to play in a "cyberwar" then you haven't understood the difference between a "cyberterrorist" putting an "easter egg" into a flight control system and a "cyberwarrior" diverting all your civilians into the area where his nukes can strike them most effectively.
Don't you mean Information Warfare? (Score:2, Interesting)
Anyone who puts the word 'cyber' in front of something should probably be shot.
Moving along to more immediate activities, we are actively seeing 'Information Warfare' being executed on the Internet. The latest widely heard event was the Israeli-flotiilla debacle, and subsequent dis-information campaign from every possibly side. Ask someone who has stated they have been following it, and see what factual information they can give you, and have them list multiple non-governmental independent investigatory sources for validation. It isn't possible.
Russian government with a foot in the mouth (Score:4, Interesting)
This is not the first time Russian government reveals its unique idiotic approach to technology. As a former Russian citizen I am following the drama of Russian government politics in technology, which, synthetically speaking, is a laughing stock of Russian technoblogging community.
Basically, the technology policy of the Russian government does not differ much from:
1. New exciting promising technology discovered!!
2. ???
3. Profit (get recognition, re-establish mother Russia as a world superpower, look wise, etc)
Replace ??? with "flood zillions of roubles into this technology without any sense of balanced budget" (which was the case of "nanotechnologies") or in this case "propose a treaty to curb technology".
One would think that smartass KGB spy would do better than idiot Khruschev, but no... the result is the same: embarrassment and ostracism of Russia on the international level.
it's real (Score:3, Interesting)
In the same sense that nuclear war is real, cyberwar is real. We've seen both only in limited fashion. We know the technology exists and works. We've just never seen two well-armed adversaries thoroughly go at it.
There's a lot of fiction about full-scale nuclear war. That doesn't mean nuclear war itself is fiction.
Re:Cyber warfare: FUD for vendors. (Score:3, Interesting)
Re:Warning, noobish question ahead. (Score:5, Interesting)
I think it is because there are remote installations that need to be operated from a single location.
The power grid is a lot of generators (scaling from enormous powerplants to small scale wind/solar and other types of production, including stuff that can be switched on and off all the time such as gas engines).
Someone has to control the whole lot of it in order to balance power production and consumption.
I see no way that we can do that without actually connecting the whole lot to a network. It would be awesome if it was a completely independent network - but the internet is there anyway... why no use it in a secure way?
(Note: I am no expert - I just expressed my opinion, which happens to contain a lot of technical assumptions)
Re:Cyber warfare: FUD for vendors. (Score:3, Interesting)
They also run on their own closed-circuit network, so good luck causing trouble without physical access or making yourself pretty obvious digging up the cables.
Re:There is a difference between "war" and "terror (Score:3, Interesting)
Even if you can break a small proportion of power stations, the rest will come on again.
Many large power plants need quite a bit of energy to jump start from an 'off' condition (normally they never go 'off' just in lower power mode). Turning off all power plants at once would be a much bigger mess then you think. I don't think you ever could do it because of fail-safes, but if you could you would start a big mess.
Re:Maybe not today but in the future. (Score:3, Interesting)
People already have artificial body parts; the lens in my left eye is artificial, and is on struts so it can focus (I wrote about it here) [slashdot.org]. I know people with artificial knees and hips, and there are people with heart pacemakers. There is an RFID chip in my work's security card. However, these implanted devices aren't connected to the internet, and I can't see them being connected to the internet in the future.
I found Down and Out in the Magic Kingdom a good read, but I just don't see optical implants to connect to the internet ever happening.
Re:Warning, noobish question ahead. (Score:2, Interesting)
the internet is there anyway... why no use it in a secure way?
Simply put because there isn't really yet such a thing as a "secure" way. Our current systems are too new, too complex and put together too quickly to make them anything approaching what you would mean by "secure". First let's start by defining secure. I'll put it as "you would have to invest 10% of the cost of the network in order to destroy it". That's an arbitrary and quite low value. I should probably have used about 30% and talked about the value of the dependent systems, but it's still a good start. I can't find a good place to start, but given that wind power is projected at around 150 Billion [247wallst.com], let's use a Trillion dollars as the value. So to be secure, you want to make a person invest at least 100Billion dollars to attack the system.
100Billion dollars buys you a whole load of programmers. The kind that can actually analyse a VPN system and work out how to get into it. The ones that can work out how to tell passively which VPN system you are using.
Another analysis would be "weakest link" analysis. In this case, you say "what would it cost to do a physical attack" and make sure that a "cyber" attack costs more. However, a cyber attack can give you almost guaranteed anonymity, so you have to factor in the reduced risk of discovery which makes the attack more valuable. You will still find that an anonymous, whole grid surprise physical attack is almost impossibly expensive and unreliable. Again, you are probably talking billions of dollars. Doing the same thing with an attack via a VPN is likely to be much cheaper.
Fundamentally, by the time you are making your system secure enough to work on the intenet, it's probably cheaper to just start off with dedicated interconnections anyway. This is especially true for people like power grids who own a whole load of fibre optic cable (twisted together with their power lines) in any case.
Overall, whats clear is that currently not enough redundancy, stability and security are being put into the electric (or other) infrastructiure. You can't treat an electric grid as something that can be run purely by private industry because that means optimal use of resources, which means lack of redundancy. For stability and security there needs to be serious state / self defence interest in keeping it stable.
American cyberwarfare (Score:2, Interesting)