State Sponsored Cyber Conflict: Politics By Other Means Requires Political as well as Technical Solutions

Vats of newspaper ink have been spilled about what are generally accepted to have been State Sponsored Cyber-attacks against companies and governments around the world.  Some of these attacks include the DDoS attacks against the U.S. Banking System; attacks against Japanese Banks and other companies operating in China; the attack against the Saudi Aramco computer system; the infiltration of the networks of The New York Times, The Wall Street Journal, and The Washington Post by China; Stuxnet; and the regular reporting of advanced persistent threats achieved by multiple countries into other country’s cyber networks. These events demonstrate a gap between current cyber security practice of addressing symptoms such as an attack or infiltration, and the actual chronic problem confronting the entire cyber domain: State Sponsored activity in cyber is an attempt to achieve a political outcome. Cyber Security is a component of National Security and must be addressed as such rather than in isolation.

The problem is not simply a technical problem resolvable with a technical solution.  No matter how many firewalls, NetFlow tools, network infiltration reports, trainings on how not to click on spear fishing attacks, and attempts to stop social engineering take place, the problem will continue to exist.  Every effort at countering the problem through these technical approaches will continue to meet with at best mediocre temporal success with diminishing returns over time. Cyber-attacks by State Sponsors may be slowed, but will not be stopped technically. These events represent political initiatives by the state sponsor, and thus are a political problem that will only be overcome through all levers of politics. 

Although Cyber is a relatively new domain for warfare, it is still just another way to achieve politics by other means. Looking at each of the cases mentioned above one can draw a direct link between a political objective by the state actor sponsoring the cyber event to the event itself.  For the DDoS attacks against the U.S. banks this was a way for (presumably) Iran to inflict harm on the United States economy in a tangential enough way to counter the sanctions on Iran without suffering a kinetic response. The attacks on Japanese banks and other companies operating in China was due to an ongoing territorial dispute and very negative history between China and Japan over the Daiyu/Senkaku islands. The attack against Saudi Aramco was an attempt by (presumably) Iran to do economic harm to Saudi Arabia due to Saudi support of the rebels in Syria who are fighting against an Iranian supported regime. The infiltration of major U.S. newspapers (which most likely did not stop at the ones listed here, or even in the U.S.) was an attempt to both find sources for information that could discredit Communist Party leaders in China, and to potentially blackmail the newspapers into refraining from reporting negatively on China in exchange for continuing their operations. Stuxnet, as has been widely reported, was an attempt to stall the Iranian nuclear program. The list goes on, but the point should be clear.  Each cyber event was an attempt at achieving a particular political outcome.  These attempts were likely not the only means by which the state sponsor chose to attempt that outcome, but simply one of possibly several domains in which actions were taken to achieve the desired results.

There is a parallel in history that demonstrates the point I am making very well.  Before World War II much ink was spilled discussing the threat that bombers posed to countries.  The experience of World War I showed that aircraft could have a devastating effect on a country.  The inter-war years brought out new technology and capabilities to the point where most public opinion was that the new threat posed by the Bomber was unprecedented and that war should be avoided out of fear of the destruction that bombers would cause.  What was missed in these calculations, especially for France in its preparations for World War II, was that bombers were a tool used in a new domain of warfare (the air), but that the strategic objectives of the country (a stable Europe) far outweighed the threat of this one tool. France and the United Kingdom surrendered Czechoslovakia for fear of a war, driven by a fear of German bombers. When war did come, and the German bombers were dropping their payloads over France and the United Kingdom, they caused extensive damage, but a funny thing happened.  Yes, they were somewhat effective, but they did not destroy the country or its ability to fight.  Even the allied 24hour bombing of Germany later in the war did not destroy that country, or even reduce its production capability to support the war effort until 1945 when the country was occupied by ground troops.  The fear instilled in this one new domain had been proven to be far beyond the value that domain had as compared to the other domains of achieving strategic political outcomes.  Today the bomber is a component of the nuclear triad for several countries, but a fading one as new means by which to achieve the same or better results are available.

What this says is that addressing cyber through technical means, although very important on a tactical basis, is not an answer at the operational or strategic level.  Operationally, companies and countries need to at least understand who is interested in them and why; opening this situational awareness far beyond the cyber network into every aspect of the organization’s or country’s operations wherever these take place.  Strategically, organizations and countries need to focus on the outcomes they desire to achieve.  The means by which they achieve those outcomes will include the cyber domain from here on out. Yet, there are multiple other domains, to include: Public Affairs, Diplomacy, Defense, Disaster Response, Development, Track 1.5 and Track 2 interactions. Addressing political differences through all of these domains at the same time, depending on which set is most effective for that particular issue and time, will be a far more effective approach to solving cyber security problems in the long-term than any technical only approach.

It is only through integrating the technical approach tactical solutions available with the operational and strategic level perspectives of achieving desired outcomes through all means available, can an organization or country truly attain security; with the cyber component playing a contributing, but not exclusive, role.

Protecting Borders Requires Holistic Intelligence

My first job out of graduate school was as the Program Manager for the Export Control and Related Border Security (EXBS) Program of the U.S. Department of State.  This program’s objective was to prevent the proliferation of Weapons of Mass Destruction (WMD) by empowering countries around the world to create effective export control laws and implementing regulations while at the same time develop or improve their capabilities of monitoring and stopping illicit material crossing international borders.  A key component of this program was intelligence on who was attempting to smuggle these items, how they were attempting this smuggling, and the motivations of these actors.  Without this intelligence, all we would have been doing was responding to events that happened to be noticed at the borders. Intelligence empowered an effective defense against smuggling, in this case, of the most deadly weapons in the world.

This can be a metaphor for cyber security.  Current practices in cyber security are often focused internally.  They look for indicators of compromise, the existence of malware, or the presence of advanced persistent threats.  Very few organizations are looking beyond the border of their own networks. Only a few organizations have even contemplated or are attempting to understand who is on the other side of these threats.  Every cyber event has a human element to it.  Yet very little research has been done on who these actors are and their motivations.  Tactics, tools and procedures (TTP’s) are better understood, but often these are not correlated with the threat actor themselves, but just generalized to the cyber threat ether.

Any effective program meant to stop the proliferation of items must have intelligence on who wants to conduct that proliferation, why they want to do so, and how they intend to do so.  This is true for WMD and it is true in the Cyber domain.   Otherwise, all anyone can do is respond to what they happen to notice.  What kind of defense is that?