The list of apocalypses is long: asteroids, disease, nuclear war — but the one that worries officials? Cyber-warfare. And it's challenging how we think about national security.
In 2012, U.S. Defense Secretary Leon Panetta called attention to a "Cyber Pearl Harbor." The catchphrase summarizes what government and defense officials have been saying for some time now: Foreign computer hackers are growing increasingly powerful in their ability to disrupt the nation's vital systems.
Pearl Harbor conjures up images of planes streaking across the morning sky, sinking ships and scrambling soldiers and airmen, all framed by those incongruous palm trees. But a massive attack on a centralized fleet sitting in the Hawaiian harbor isn't the best comparison. Instead, another World War II event provides a better metaphor understand the cyber-threats — and how to prevent it.
A Different Metaphor
Some experts take issue with the Pearl Harbor metaphor when it comes to cyber-warfare. "Nothing like this exists in cyberspace," writes John Arquilla, a defense analysis professor at the Naval Postgraduate School. Rather than Pearl Harbor, Arquilla says there is a better metaphor — the menacing attacks of the German U-boats, which bombed points up and down the United States' Eastern coast, easily targeted by their blazing harbor lights.
The harbor lights dotted the Eastern seaboard cities, targeted by German U-boats shortly after Germany declared war on the U.S. Early on, these underwater vessels were successful in part because President Franklin Delano Roosevelt's decision not to order a blackout. As a result, the brightly illuminated city and harbor lights created a helpful backdrop for the Germans to see their targets and aim with precision.
Even after continued attacks, local businesses shied away from instituting blackouts, fearing the move would hurt their recovery from the Great Depression. As a consequence, the Germans would sink over a million tons of cargo, hurting businesses directly. Eventually, the strategy to keep the harbor lights on proved unsuccessful and by mid-1942, the U.S. moved to black them out, finally curbing the German U-boat threat.
Today's e-threats are similar to the "harbor lights" situation, and in analyzing the vulnerabilities of the German strategy, we can find solutions to a cyber-war threat in 2013.
Think of cyberspace in terms of blinking lights that need protecting. What are the threats? In short, everything. In the movies, hackers can trigger exploding oil refineries, knock out power grids and crash planes without air-traffic control guidance. The reality is not as spectacular, but the threats are still very disruptive. And while most hacks from outlaw groups like Anonymous are criminal, the serious threats are often backed by nation-states.
Those threats are everywhere. The Internet, frankly, has too many targets to protect. Cyber-criminals target financial institutions like Citigroup and the IMF, infiltrate Sony and Gmail and hack into the Pentagon, FBI and Congress. Breaches already cost hundreds of billions of dollars in stolen R&D. And according to the NSA, hackers are planning to attack national utilities and infrastructure next.
The Pearl Harbor metaphor, where only a few big bases are targets, isn't a good comparison today. Everything on the Internet is well-lit and vulnerable to all types of attacks. In this way, an offensive plan, like the one the U.S. military outlined in its cyber-warfare responses, is the wrong way to approach the problem.
The Failed Response
Like WW2, the harbor lights of cyberspace remain blazing because legislators and military experts fear security measures are too costly and difficult to implement. Why can't they just protect everyone without blacking out the lights? For that, coordinating utilities, businesses, privacy security experts and privacy advocates are needed to fortify a universal defense. But that's akin to working with every citizen to build an interlocking shield — it's not happening.
U.S. political leaders haven't been able to build consensus on a strategy. For instance, in August, President Barack Obama published an op-ed imploring Congress to pass the Cyber-Security Act of 2012. "Ultimately, this is about security gaps that have to be filled," he said, highlighting the need for increased vigilance to protect national security.
"We need to make it easier for the government to share threat information so critical-infrastructure companies are better prepared," he added, emphasizing the need for collaboration. Unsurprisingly, the bill fell victim to partisan in-fighting, even after undergoing several major changes since. The problem? Finding a strategy all organizations can agree on, which assures civilian privacy rights, too.
Lawmakers, meanwhile, are looking at separate proposals like the Cyber-Intelligence Security Protection Act, or CISPA, to beef up critical infrastructure. But again, using the Pearl Harbor analogy, it only protects a few critical bases. Hackers need only to hit the countless other less-critical targets.
What about striking first? Maybe, but a wide-ranging strategy is needed, including the ability to ferret out the origin of the attack and the power to retaliate to deter future cyber-attacks. The fact is, digital terrorists dwell in a virtual ocean too deep to proactively attack. Simply trying to find them, or detect an enemy's fingerprints, is alone problematic. And hackers use increasingly sophisticated tools to cover tracks and stay anonymous.
A Way Forward
According to the Economist, cyber-threats can be lumped into one of five categories: strategic cyber-war, or direct attacks on an enemy's civilian infrastructure; cyber-espionage, which gives a digital facelift to age-old intelligence technique; cyber-disruption, such as the distributed denial-of-service attacks that briefly overwhelmed Estonian state, banking and media websites in 2007; and cyber-terrorism.
Instead of going on the attack, a defensive stance — to turn off the lights, so to speak, and "black out" sensitive cyber-targets — is needed. There are evasive routes, strong encryption and other tools to keep them secure that might work better than threats of retaliation. Basically, hunting down U-boats on the bottom of the Atlantic is a lot harder than turning off some lights. Or said another way, playing defense is sometimes easier than offense. But it starts by changing the approach to the problem.
Playing defense makes strategic and economic sense too. By beefing up the offensive cyber-weapon arsenal, every time the U.S. creates a virus for cyber-sabotage, hostile countries or rogue agents can create copycat programs, heightening the risk. In that climate, having a robust defense system is as crucial as boosting cutting-edge digital weapons.
In the year ahead, governments may not forget Pearl Harbor, but remembering the harbor lights is just as important. Taking a page from history won't eliminate every breach, but changing the approach to cyber-warfare may help turn the tide in a digital war with hidden enemies.
Photo courtesy of Flickr, ercwttmn
This article originally published at Mobiledia here