Is Cyber a new warfare? Debate (catch all)

Quote:

---

Originally Posted by Presley Cannady

Cyberwarfare is conducted on the same substrates as electronic warfare. And since even most EW applications are digitally managed, why bother the distinction? The only difference is the degree of abstraction in you accept in implementing your attack or defense: cutting a wire or shielding a receiver versus blocking a port and installing an SSH server.

---

That is a very self limiting view of cyber. A very network centric view of cyber. Yet cyber is much more than just the network. It is found in the operating systems, the thinking of users, and much more. It is is the electro magnetic spectrum. Since cyber really comes from command and control (as discussed by Norbert Wiener fifty or so years ago, and we can see cyber going back centuries it is not just an Internet fad. Even William Gibson realized when coining cyber space that there was more to cyber than just the network.

Quote:

---

Originally Posted by selil

That is a very self limiting view of cyber. A very network centric view of cyber.

---

On the contrary, I don't assume a network at all; and certainly EW doesn't. The only thing assumed is a substrate for signals governed by the laws of electromagnetism.

Quote:

---

Yet cyber is much more than just the network. It is found in the operating systems, the thinking of users, and much more. It is is the electro magnetic spectrum.

---

This was precisely the point I made when I stated "[c]yberwarfare is conducted on the same substrates as electronic warfare."

Quote:

---

Since cyber really comes from command and control (as discussed by Norbert Wiener fifty or so years ago, and we can see cyber going back centuries it is not just an Internet fad. Even William Gibson realized when coining cyber space that there was more to cyber than just the network.

---

Is EW any less unrelated and concerned with control than cyber?

Those of you following issues of cyberwar likely subscribe to the Dailydave Newsletter, and Dave Aitel--a veteran of the NSA and CEO of Immunity, Inc.--recently posted a link to a work-in-progress presentation entitled "The Three Cyber-War Fallacies." In it, Aitel seeks to debunk the following three claims:

Quote:

---

1. Cyberwar is asymmetric.
2. Cyberwar is non-kinetic.
3. Cyberwar is not attributable.

---

These are all provocative claims worth examining, so I wanted to see if anyone here wanted to debate one or more of these. At any rate, read through the presentation. It makes for interesting reading even in its unfinished form.

I don't subscribe to "Daily Dave" I've got enough to chew on already. I looked at the presentation, but I don't know much about cyber warfare but for grins and giggles.

Quote:

---

1. Cyberwar is asymmetric.
2. Cyberwar is non-kinetic.
3. Cyberwar is not attributable.

---

Of course cyber war is asymmetric. If you put "cyber" and "war" together than cyber is the modifier of war. War is inherently asymmetric otherwise it is a stalemate. That is as Clausewitz, Sun Tzu as you can get. Why would you engage in conflict it it was symmetric? That is why peer competitors rarely are aggressors towards each other.

The technical dimension or "cyber" expertise adds another dimension to the conflict spectrum of cyber. This technical dimension is also an element in the semantic layer of the cyber warfare domain. Of course that is if you take a multidimensional approach to cyber and don't try and smash it in with big war analogies and such. This also requires a spectrum approach rather than "silo" approach to cyber.

Cyber is kinetic. Stuxnet isn't only the proof, but dozens and dozens of other examples exist in the SCADA realm. Stuxnet is actually proof that "all ur air gaps belong to us". That is what is cool about Stuxnet.

As to attribution? Yes another fallacy. The best logic breaker on this one though is from other areas of forensics. How long does a full DNA screen take in a competent forensically sound manner? Weeks? At least days? How long does it take to do computer forensics on an attack? Weeks? At least day? But, the Internet is anonymous? <bs> It is only that way to a very few people, and you can detect those kinds of attacks too.

So. Three myths? I don't know if they are myths or just simple misunderstood. They may have had a bad childhood.

The point about the "OODA" loop is kind of out of left field. The OODA loop is nothing more than another explanatory model for the decision cycle. Decision sciences is filled with them, (SPA- search predict act; IPDE - identify, predict, decide, execute). The 1950s were rife with them as ways of managing risk or industrializing management processes. OODA isn't really anything special just something most military folks understand. So seeing "This isn't an OODA loop" has me fussy.

Quote:

---

WASHINGTON—The Pentagon has concluded that computer sabotage coming from another country can constitute an act of war, a finding that for the first time opens the door for the U.S. to respond using traditional military force.
The Pentagon's first formal cyber strategy, unclassified portions of which are expected to become public next month, represents an early attempt to grapple with a changing world in which a hacker could pose as significant a threat to U.S. nuclear reactors, subways or pipelines as a hostile country's military.

---

Read more: http://online.wsj.com/article/SB1000...#ixzz1NxpKALeP

I keep asking and it never gets an answer:

What does "cyber" mean?

If cyberspace is a domain, then we should be able to describe cogently what is meant by a cyber (sic) "war".

Wouldn't "cyber-style" attack (absent any other useful definition) be the tipper that leads to a response decision, vice a whole "war"?

Quote:

---

Originally Posted by Brett Patron

I keep asking and it never gets an answer:

What does "cyber" mean?

If cyberspace is a domain, then we should be able to describe cogently what is meant by a cyber (sic) "war".

Wouldn't "cyber-style" attack (absent any other useful definition) be the tipper that leads to a response decision, vice a whole "war"?

---

Cyber literally means command and control. Less literally the domain in which all of that happens. Now describe sea without self referencing it or using a synonym.

Quote:

---

Originally Posted by selil

Cyber literally means command and control. Less literally the domain in which all of that happens. Now describe sea without self referencing it or using a synonym.

---

No. Command and Control means "command and control". Otherwise the Air Force wouldn't have changed all their Comms folks into "Cyber Warriors".

Seriously? Literally means? Where is the "literal" part?

It's not called "the sea". It's called the "maritime domain" which is defined in JP 1-02 as "The oceans, seas, bays, estuaries, islands, coastal areas, and the
airspace above these, including the littorals."

And that is both "littoral" and "literal".

Again, without a cogent definition of "cyber" this is a moot exercise.

I know...broken record....but just putting a word in front of another doesn't not necessarily modify.

As a non-expert who can barely handle basic HTML I understand cyberwarfare to entail attacks upon networked resources via the use of networked resources (which is to say that blowing up a server room would not count as cyberwarfare).

Quote:

---

Originally Posted by Brett Patron

Again, without a cogent definition of "cyber" this is a moot exercise.

I know...broken record....but just putting a word in front of another doesn't not necessarily modify.

---

Aitel's project here is getting towards that definition.

Quote:

---

Originally Posted by selil

Of course cyber war is asymmetric. If you put "cyber" and "war" together than cyber is the modifier of war. War is inherently asymmetric otherwise it is a stalemate. That is as Clausewitz, Sun Tzu as you can get. Why would you engage in conflict it it was symmetric? That is why peer competitors rarely are aggressors towards each other.

---

Still processing the other bits of your post, but from what I gathered, Aitel is arguing that attacking or gaining access to computers is wrongly considered to be "asymmetric" in the same way, say, a ASBM being launched against a carrier is--that is, a "cheap" system of tactics/weapons used against an "expensive" system. Instead, there are these massively expensive parts of the cyberwar picture that are getting overlooked in "maintenance" and "analysis."

What's the differance, if any, between "cyber"-warfare and old fashiooned Electronic Warfare? Isn't "cyber" warfare merely an extension of electronic warfare using an examded medium/technological base?

Sorry, don't really go in for neologisms unless they're absolutley necessary.

Quote:

---

Originally Posted by selil

Of course cyber war is asymmetric. If you put "cyber" and "war" together than cyber is the modifier of war. War is inherently asymmetric otherwise it is a stalemate. That is as Clausewitz, Sun Tzu as you can get. Why would you engage in conflict it it was symmetric? That is why peer competitors rarely are aggressors towards each other.

---

You're taking it a little too broadly. Yes, any conflict can, in some form, be described as "asymmetric", but given that, it's a simple matter and common practice to select for conflicts which are more extreme in their asymmetry. Your statement is comparable to saying that it's pointless to describe any person as "tall", because all people are taller than ants. Within the range of asymmetry that can be seen in warfare, some types of warfare are more asymmetric than others, and those are the ones we call "asymmetric warfare".

Quote:

---

Originally Posted by ganulv

As a non-expert who can barely handle basic HTML I understand cyberwarfare to entail attacks upon networked resources via the use of networked resources (which is to say that blowing up a server room would not count as cyberwarfare).

---

I'm not the one to ask for a precise definition, but I'd say blowing up a server room could count as cyberwarfare. It depends on why you did it. If you blow up the room to kill the guy in it, maybe it's not really cyberwarfare; if you did it to take down the network the room serves, maybe it is. If you blow up the room to kill the IT techs who are preventing you from infiltrating your target network... maybe that counts too. I'm not sure it's actually all that necessary to strictly define what cyberwarfare means; as the practice grows, it will be integrated more completely into other forms of warfare (and other forms of warfare will be integrated into it).

Quote:

---

Originally Posted by motorfirebox

I'm not the one to ask for a precise definition, but I'd say blowing up a server room could count as cyberwarfare. It depends on why you did it. If you blow up the room to kill the guy in it, maybe it's not really cyberwarfare; if you did it to take down the network the room serves, maybe it is. If you blow up the room to kill the IT techs who are preventing you from infiltrating your target network... maybe that counts too. I'm not sure it's actually all that necessary to strictly define what cyberwarfare means; as the practice grows, it will be integrated more completely into other forms of warfare (and other forms of warfare will be integrated into it).

---

Is a commando sent to raid an airfield sent to do aerial warfare? Does it matter if a jump and/or forward air control is involved? However someone might answer those questions—and it would not surprise me if a body of literature debating such questions exists as I have seen much critical ink spilled in academia over less interesting questions—the fact would remain that without a thing called aerial warfare there would be no such thing as a raid on an airfield.

Quote:

---

Originally Posted by ganulv

Is a commando sent to raid an airfield sent to do aerial warfare? Does it matter if a jump and/or forward air control is involved? However someone might answer those questions—and it would not surprise me if a body of literature debating such questions exists as I have seen much critical ink spilled in academia over less interesting questions—the fact would remain that without a thing called aerial warfare there would be no such thing as a raid on an airfield.

---

Lets bear in mind...although there is an "air domain" both the maritime and land domains do claim a portion of the air above them for their operations as well. Further, there is almost always "inter-domain" operations, especially once you are considering actions beyond the most tactical level. So the example above does not really track with the question at hand.

(On a humorous side note: an AF Space officer, when asked where the air domain ends and space domain begins, replied, "when your air-breathing engine stops working, you're in space".

Quote:

---

Originally Posted by Tukhachevskii

What's the differance, if any, between "cyber"-warfare and old fashiooned Electronic Warfare? Isn't "cyber" warfare merely an extension of electronic warfare using an examded medium/technological base?

Sorry, don't really go in for neologisms unless they're absolutley necessary.

---

Up until cyberspace was declared a separate domain, the answer was "nothing". "Cyber" was covered under "Computer Network Operations" part of IO doctrine. The designation of this domain has truly disrupted many things; things that were really not thought through before such designation was made.

Quote:

---

Originally Posted by Erich G. Simmers

Aitel's project here is getting towards that definition.

---

Until it's in JP 1-02 and explained via a stand alone Joint Pub (e.g. JP 3-12), it would be just another opinion, however well researched.

Right now, JP 1-02 does not even fully recognize cyberspace as a warfighting domain. I just looked at the just released JP 1-02..it ain't in there. However there is a term called "full spectrum superiority" that makes a pretty interesting distinction (emphasis added):

Quote:

---

full-spectrum superiority — The cumulative effect of dominance in the air, land, maritime, and space domains and information environment that permits the conduct of joint operations without effective opposition or prohibitive interference.

---

Quote:

---

1. Cyberwar is asymmetric.
2. Cyberwar is non-kinetic.
3. Cyberwar is not attributable.

---

All "asymmetry" means is not taking on an adversary they way that adversary battles you. If you saw the movie "Tin Cup", the protagonist challenges an opponent to a golf round using only garden tools. Was it a "war"? Yes. Was asymmetry applied? Yes. The effects desired were achieved. It could easily be argued that the protagonist entered the contest at equal or greater skill. But rather than contest the ground (so to speak) with traditional "weapons" he used irregular ones.

Kinetic/non-kinetic; Lethal/Non-lethal are all going to blur as more things from which kinetics and lethality derive are computerized, have an IP address, or are controlled remotely using portions of the electromagnetic spectrum.

Attribution will come more from the will to say who than the ability to discover who. If a bunch of "religious extremists" plan, resource, and conduct their ops from a country (say, Outer Slabovia), there is usually no difficulty declaring that country a "state sponsor of terrorism". Yet if that same bunch were to conduct hacking and what not from IP addresses emanating from that same country, all manner of contortions are done to say it is "unattributed".

A mentor of mine sent this to me and I thought it was worth sharing...just to keep things in perspective...

It's War!

http://www.youtube.com/watch?v=yyeKYQdYISg