Cyber operations: the new balance

Joint Force Quarterly, July, 2009 by Stephen W. Korns

The daily tidal wave of ever more shocking revelations threatens to overwhelm, as if we are witnessing a recession in cybersecurity capabilities. Cyber attacks have resulted in government-wide computer infections and loss of information. The Department of State admits to losing terabytes of information. Likewise, DOD has lost a volume of information equivalent to twice the number of printed pages in the Library of Congress. Hackers so pervasively penetrated the U.S. Bureau of Industry and Security that the agency completely disconnected itself from the Internet. The White House itself has had to deal with unidentified intrusions into its network, and malware has even infected laptops aboard the International Space Station. Due to the overwhelming nature of these cyber threats, a 2008 Senate report indicated the cost to defend government networks could rise to as much as $17 billion. (21)

[ILLUSTRATION OMITTED]

The unprecedented growth in cyber threats has led policymakers and analysts alike to assert with increasing frequency that the United States is experiencing a new normalcy in cyberspace. As early as 2003, the Gilmore Commission's report on Forging America's New Normalcy predicted the onset of cyber new normalcy conditions, including cyberterrorism. (22) In commenting on the increasing sophistication of cyber attacks, the state of Michigan's chief information security officer recently noted: "I don't think this is just hype--this is the new normal." (23) Perhaps the clearest, most unambiguous recognition of cyber new normalcy is the CSIS 2008 report on cybersecurity, which invokes the spirit of Roosevelt's national emergency, Eisenhower's nuclear threat, and Bush's war on terror: "The U.S. must treat cybersecurity as one of the most important national security challenges it faces.... [T]his is a strategic issue on par with weapons of mass destruction and global jihad." (24) The following trends provide compelling evidence of this new normalcy condition in cyberspace.

Commoditization. Under old normalcy, individuals developed malware. Under cyber new normalcy, anyone can obtain malware at the "cyber drive-through window." The Internet is a profit-generating machine for criminal syndicates that have perfected malware-as-a-service. The Organisation for Security and Co-operation in Europe estimates that the cyber underground now rakes in a staggering $100 billion per year.25 Reflective of this trend, during the Georgian-Russian conflict, hackers posted downloadable malware on public Web sites with instructions on how to join in the cyber attack against Georgia. An Internet journalist investigating the issue concluded: "All I needed to do was to save a copy of a certain web page to my hard drive and ... voila: my browser was now sending thousands of queries to the most important Georgian sites, helping to overload them.... [I]n less than an hour, I had become an Internet soldier." (26)

Identification. Under old normalcy, when bombs and bullets flew, identification of the adversary was relatively easy. In cyber new normalcy, identification is the exception. In Here Comes Everybody, author Clay Shirky attributes "ridiculously easy group formation" as the Internet's defining characteristic. (27) The Estonian and Georgian cyber events serve as the quintessential examples of this state versus ad hoc cyber assemblage phenomenon. Although some initially declared the events as cyberwar, most in the international community now characterize these incidents as cyber crime via a proxy apparatchik of instantaneous cyber militia-mobs. At best, according to Estonian officials, it is terrorism. (28)