New technologies have revolutionised warfare, sometimes abruptly, sometimes only gradually: think of the gunpowder, aircraft, radar and nuclear fission and some have been working alongside computer information technology. The internet have transformed economies and given Western armies great advantages, such as the ability to send remotely piloted aircraft across the world to gather intelligence and attack targets within accuracy of a few meters range after travelled few thousand kilometers. However the spread of digital technology comes at a cost and it exposes armies and societies to “digital- 010010110” attack.
The threat is complex and potentially very dangerous and modern societies are ever more reliant on computer systems linked to the internet, giving enemies more avenues of attack. If power stations, refineries, banks and air-traffic-control systems were brought down, people would lose their lives. Yet there are few, if any, rules in cyberspace of the kind that govern behaviour, even warfare, in other domains. As with nuclear- and conventional-arms control, big countries should start talking about how to reduce the threat from cyberwar, the aim being to restrict attacks before it is too late.
Cyberspace has become one of the domains of warfare, after land, sea, air and space. Imagine the failure of the systems that keep the modern world turning and as computer networks collapse, factories and chemical plants explode, satellites spin out of control and the financial and power grids all come to a halt. That seems most threatening to all, yet most agree that infiltrating networks is pretty easy for those who have the will, means and the time to spare. Experts know this because they are such enthusiastic hackers themselves. Spies frequently break into computer systems to steal information by the warehouse load, whether it is from Google or defence contractors. The cyber-attacks on Estonia in 2007 and on Georgia in 2008 (the latter strangely happened to coincide with the advance of Russian troops across the Caucasus) are widely assumed to have been directed by the Kremlin, but they could be traced only to Russian cyber-criminals. Many of the computers used in the attack belonged to innocent Americans whose PCs had been hijacked. Companies suspect China of organising mini-raids to ransack Western know-how: but it could just have easily been Western criminals, computer-hackers showing off or disillusioned former employees. One reason why Western governments have until recently been reticent about cyber-espionage is surely because they are dab hands at it, too.
As with nuclear bombs, the existence of cyber-weapons does not in itself mean they are about to be used. Moreover, an attacker cannot be sure what effect an assault will have on another country, making their deployment highly risky. That is a drawback for sophisticated military machines, but not necessarily for terrorists or the armies of rogue states. And it leaves the dangers of online crime and espionage.
All this makes for dangerous instability. Cyber-weapons are being developed secretly, without discussion of how and when they might be used. Nobody knows their true power, so countries must prepare for the worst. Anonymity adds to the risk that mistakes, misattribution and miscalculation will lead to military escalation—with conventional weapons or cyberarms. The speed with which electronic attacks could be launched gives little time for cool-headed reflection and favours early, even pre-emptive, attack. Even as computerised weapons systems and wired infantry have blown away some of the fog of war from the battlefield, they have covered cyberspace in a thick, menacing blanket of uncertainty.
One response to this growing threat has been military. Iran claims to have the world’s second-largest cyber-army. Russia, Israel and North Korea boast efforts of their own. America has set up its new Cyber Command both to defend its networks and devise attacks on its enemies. NATO is debating the extent to which it should count cyberwar as a form of “armed attack” that would oblige its members to come to the aid of an ally.
But the world needs cyberarms-control as well as cyber- deterrence. America has until recently resisted weapons treaties for cyberspace for fear that they could lead to rigid global regulation of the internet, undermining the dominance of American internet companies, stifling innovation and restricting the openness that underpins the net. Perhaps America also fears that its own cyberwar effort has the most to lose if its well-regarded cyberspies and cyber-warriors are reined in.
Such thinking at last shows signs of changing, and a good thing too. America, as the country most reliant on computers, is probably most vulnerable to cyber-attack. Its conventional military power means that foes will look for asymmetric lines of attack. And the wholesale loss of secrets through espionage risks eroding its economic and military lead.
Maybe the economic crisis and oil spill saga are the least to worry for now, let's start looking at our IT infrastructure, our network lines, our fast speed cable, etc......... and who knows, the North and South Koreans may not be looking at "solid" weapons launching but "soft-launch" attack through the cyberspace.
Recently early July2010, DBS Bank's computer system broke down with a technology glitch and has disrupted business and raised some customers' hackles. But it is a timely reminder that systems can - and do - go down and such incidence could be linked to "cyber attack" or either techno fault and till the investigation result is out, it is either a good guess.
A quick scan of news headlines reveals the downside of the technological workhorses that businesses, governments and the general public have become so dependent on. 'Asia stock plunge raises alarm on trading'; 'Nikkei slump caused by bank system fault'; 'Computer glitch slows air travel'; 'FAA computer glitch delays flights across region'; 'Million users hit by Yahoo/Google/Baidu shutdown'; and on and on.
Computer failure has caused city-wide power outages, aborted rocket launches, forced large-scale vehicle recalls, and triggered airplane and train malfunctions and crashes. Seen in that context, the loss of access to bank ATMs and online banking facilities might not seem as critical. What if all these are triggered by someone out there who has hacked into the system vault and managed to carry out an attack on the software system ?
And what if, despite all reasonable effort, a system glitch occurs? The principle remains the same: a contract has been broken, trust has been breached, and immediate steps should be taken to redeem the contract and restore that trust. Restoring the system in the shortest possible time is an essential first step; but equally important is keeping the customer in the know - not in the dark - right from the beginning. An immediate announcement that the system is down, accompanied by an apology - it's not so difficult, really.
And going forward, the post-mortem, the search for the reasons for the breakdown, should be transparent. What were the exact factors that caused the crash? What could the organisation, and the technology provider, have done better? The customer deserves to know. Of course, prevention is better than cure. So, hopefully, the recent bank system breakdown will provide fresh impetus to other organisations to review their own networks and processes. Not just dollars would be saved - possibly lives too if the extent of hacking into the vault is tantamount beyond ones imagination.
