Retaliating against State-Sponsored Cyber War
On the first news day after the holiday weekend reporting on Lockheed Martin, WSJ reports that the US is moving towards making cyberattacks an act of war.
The Pentagon has concluded that computer sabotage coming from another country can constitute an act of war, a finding that for the first time opens the door for the U.S. to respond using traditional military force.
And they’re building into this policy an assumption that the biggest attacks must have state sponsorship.
Pentagon officials believe the most-sophisticated computer attacks require the resources of a government. For instance, the weapons used in a major technological assault, such as taking down a power grid, would likely have been developed with state support, Pentagon officials say.
This new policy won’t be subject to intelligence manipulation at all, nosiree!
The next time someone wants to invent a casus belli against Iran, they can just point to a particularly successful hack and (ignoring all questions about appropriate retaliation for Stuxnet…) claim the Iranians have done it and say it, like evidence of WMD, is classified.
They already presumably fabricated one Laptop of Death for Iran, why not another?
And then, declaring ourselves incompetent to retaliate via cyberspace (Stuxnet notwithstanding), they’ll have their excuse to roll out the war machine.
Oh great! Yet another reason for empire building!
I give us about another 10-20 years on this planet before the spasms of the ultra-patriarch take us out once and for all.
So, get your Medicare and social Security while you can. Spend it on something that will enrich your life and fug the rest.
I would consider a state sponsored attack against US computers an act of war. If it turns out that Stuxnet is state sponsored, I would consider that an act of war against Iran.
That said, if I were an anon hacker, I’d make sure my hacks came from servers that the government wants to get angry with. Then they won’t dig too deep, as they already have the answer they want.
The problem is correctly identifying the perp. China can certainly hide well enough to prevent definitive identification. So can Wikileaks. ;-)
I think the real problem here is going to be explaining why its an act of war when a oil exporting country does it, but not an act of war when WE do it.
If the MIC wants to go to war, they’ll find a reason. So this doesn’t give them any powers they haven’t already been granted.
Boxturtle (Is it an act of war if you just look, not change?)
I think there’s a oh-shit quality to this bit of news.
I’m thinking of MadDog’s posts yesterday that the Lockheed news was a Really Big Deal and that bricks were being shit throughout the Intel and Military-Industrial Complex.
This would be one of the CYA moves to respond to the yelling the folks are going to be subject to this morning in a number of offices and over a lot of phones. “It’s an act of war!” Nevermind we don’t know if it’s state-sponsored,
.
So there, we know it’s a state-sponsored gig because we’ve defined it as such, again without evidence. ‘Cause we don’t need evidence, by definition.
It’s also similar to treating Manning as a capital crime: bc if they don’t they have to admit how shoddy their defenses are.
As mainstream a publication as Vanity Fair seems to have no problem with the assumption that the US, Israel, or both, conspired to direct Stuxnet at Iran.
The Obama candidate promised a new level of government transparency that the Obama White House could never possibly hope to comply with, but it would be very, very interesting to see the policy that is formed about this issue while still trying to answer your very pertinent questions as to the hypocrisy of the whole thing.
Clearly this is a hole you could drive a Bradley Tank through. Evidence? We have it all and it’s classified and you can’t look at it and you’ll have to trust that We Know Best.
One the other hand, state-sponsored cyber attacks are certainly directed attempts to sabotage a country’s infrastructure…which pretty much defines an act of war.
But your point is a good one–do they realize that by calling cyber attacks an act of war, they’ve neatly painted themselves into an uncomfortable corner IRT US/Israeli attacks against Iran? It’s warfare.
Does the left hand have any clue what the right hand is doing in the Pentagon?
I sort of figure they just believe this is only operative going forward.
“Never mind that we’re believed to be responsible for the single biggest act of aggression in the cyberworld. That was before these rules were in place.”
I suspect they’re similarly making up rules as they go along on domestic hacks as law enforcement (cf Wikileaks). But someday soon they’ll declare the rule of law now operative in the cyberworld, too.
Look forward! Not backward! Says Obama, et al.
In that case, we should be bombing the banks and major corporations.
They just can’t resist the grand hypocritical gesture when it comes to security theater.
So by this reasoning the U.S. has already committed an act of war against Iran via the Stuxnet worm… or, if the U.S. denies any responsibility for Stuxnet, then how can the U.S. stand in judgement as to whether some other attack must be state-sponsored or not?
Answer: for this bunch, it’s easy.
Abrams… the tanks are Abrams. The Bradly is a light AFV with delusions of being an APC…
Yeah. Early morning. I slipped a few decades I think. Guess I’ll go run a 5k to clear my head.
Cheers!
You can spy on secret military installations and that’s not an act of war (it’s a crime), but cracking a computer is?
For all the supposed “intelligence” of our new military, this indicates a serious lack of thought. The legitimate sources of causus belli are well known and understood, and it’ll take more than an
edictfatwa coming out of the Pentagon to change this.I don’t know what idiot thought this one up, but it is just stupid enough congress might go for it.
Well, they’re saying you have to do damage for it to be considered an act of war. But granted, they consider the theft of data to be damage.
And never mind that we’ve long engaged in state-sponsored industrial espionage using the intertoobz.
Going by recent logic, the intent an attempt to damage is, under these terms, an act of war. Same as if the kid down the street plays with the idea of attacking the local army base–it’s darn close, in the current eyes of the law, as actual terrorism. So trying to break in to the system is equivalent to attempting to land an invading army in Long Beach. Pretty neat logic exercise, eh?
Especially since they know nothing about “the Internets”. Maybe their aides know how to use a computer, but our “elected” representatives? Most, probably haven’t a clue
I posted late to the last EW Lockheed post and been thinking about it overnight…
There are a slew of available and inexpensive USB-attached biometrics devices that could be used to add-on to all PC’s, replacing the RSA key. It’d take a test-and-standardize program for the hardware, a rewrite of the security check system to use the biometric input instead of the RSA key, and a one-time visit to the local security authority in the organization to establish the base-line biometric data (eye scan, finger print).
Could be reasonably fast, reasonably cheap, as everything except the internal security coding is off-the-shelf, and the internal security coding is well-understood.
Uh… been sleeping… but with the ability to duplicate and hack the biometric feed at will external to the dongle this doesn’t solve much and seems to ask for a man-in-the-middle attack.
Naps are good.
If the biometric dongle sends specific unique characteristic data to the security server, which matches it to the stored data, with a go/no go decision based on the match, it’s pretty secure. Now of course if a criminal kidnaps the person with the finger or eye, or collects that data in a sort of blue box that substitutes for the dongle, that’s a hole; however I can imagine the dongle with a unique identifier that tells the server it’s the dongle registered to that specific client, making it way more difficult to sub the biometric data. I honestly think it could be worked out and be far more secure than the RSA keychain.
This is just one more step towards the DoD taking over all of our computer infrastructure. It will guarantee that we are forever at war, which the MIC just loves. The fact that is one part nonsense (no, it doesn’t take a state to pull off a computer attack) and one part blindingly obvious (after Iraq, is there anyone in the world who doesn’t think the U.S. would attack anyone anytime we feel like it?) is part of its appeal to the warmongers.
Yeah, it’s that “must be state sponsored” I have the biggest problem with.
Not just because that’s what led us to ignore warnings pre-9/11. But because at a time when the US is accelerating the decline of the nation-state, at a time when corporations (and their close analogs, crime cartels) increasingly have the flexibility to outwit nation-states, this seems like willful stupidity.
There are two especially dangerous parts to this. First, they are likely to attribute certain kinds of attacks (so-called “patriotic hacks” like we saw in the Georgian conflict and often come from China) to states when the states really aren’t in control (these things are probably more of the “wink and a nod” variety). This could lead to armed conflict that neither we or our supposed advesary really wanted.
The other problem is that they will miss where the real threats come from (criminal gangs and politically motivated groups). I worry about the Randians more than the Iranians.
Alarmist. The Pentagon isn’t the US. While the Pentagon might conclude that computer sabotage coming from another country can constitute an act of war, thankfully the Pentagon doesn’t formulate policy or write laws, or at least it shouldn’t be allowed to.
The U.S. does have laws.
US Code TITLE 18 > PART I > CHAPTER 113B > § 2331
§ 2331. Definitions
(4) the term “act of war” means any act occurring in the course of—
(A) declared war;
(B) armed conflict, whether or not war has been declared, between two or more nations; or
(C) armed conflict between military forces of any origin;
A parallel might be economic sanctions, which harm a country but don’t include the armed conflict which is a necessary component of war.
Since when do our laws apply to “our” military — or our politicians, for that matter? The only time the law seems to matter is when it’s for the expedience of whichever current political party is in charge.
Since when do we accept an article from the Wall Street Journal as fact?
Since when do we accept that laws don’t apply and shouldn’t even be mentioned?
Since when do we accept that the Pentagon sets policy?
Since when was “kick-ass activism” dead?
We believe the WSJ when it is bylined “Siobhan Gorman” Heck. “Julian Barnes” might be reason alone, but Gorman’s pretty close to gold standard here.
And no, Pentagon doesn’t always set strategy. It does in Afghanistan, but not Libya, for example.
“Since when do we accept an article from the Wall Street Journal as fact?”
If you have proof that Gorman or Barnes are fabricating this story, by all means present it.
Actually, I can see hacking by another government as an act of war. What if, during the Cold War the Soviets hacked into our missile system and re-targeted the warheads? What if Pakistan hacked into our air traffic control with the express purpose of destroying planes and the people in them. How about a foreign country hacking into the computer in our cars and wrecking havoc in our daily lives? There are numerous other deadly scenarios which can be created.
The problem I see, simply put, is I don’t trust “our” military or “our” government with the potential power this invests in them.
And the arsenal of “unmanned” (computer-controlled) aircraft grows ever large.
Pentagon Looks to Double its Unmanned Air Force LINK.
isn’t here ANY sophisticated thinking at the top levels of our gov’t about provocations a major power will encounter ?
is our only response to provocations, “we”ll bomb you from 21k”?
Is Obama going to go to war with China?
He won’t even call them on their currency manipulation.
And when the NSA and TSA invade our space, or the Treasury confiscates/invades our private property without cause, should we consider it’s act one of war?
http://www.light-to-dark.com/Chertoff_And_The_Fourth_Amendment.html
WSJ used the word “sabotage”. In light of the LM hack, are we certain that no damage was done in some corner of the military?
This is a win/win situation for behemoth “defense” contractors such as Lockheed/Martin: domestic aerial surveillance, cyber wars, asymmetric wars, empire wars. What a deal. Provide hardware, software and contractors, just add war and stir.
Also there’s this in The New Yorker:
The Online Threat
Should we be worried about a cyber war?
by Seymour M. Hersh
November 1, 2010
Read more http://www.newyorker.com/reporting/2010/11/01/101101fa_fact_hersh#ixzz1NwoWnnfU
The problem with this would be that it would be extremely difficult to establish provenence as to the true country of origin. Aside from the ability to fake geolocation (like with the military internet persona program), someone could physically be in a country of origin, but it doesn’t mean they are acting on behalf of the country and in fact could be against the country…I’m thinking of foreign spies/saboteurs in some foreign country where they engage in cyberwarfare to make the foreign country appear hostile.
Then again this might be about militarizing things domestically in the US, like to treat Anonymous as not merely hackers but as enemy combatants who could be sent to Gitmo. We’ve got the War on Drugs, War on Terorism, why not add the War on Hackers as well as a few more “wars” to keep making things more and more militarizing and stripping more and more of our rights away.
Why stop at labeling cyber attacks an act of war? Why not call them attacks with “weapons of mass destruction”?
Of course, there is the flip side as others have pointed out. I have no doubt our government has engaged in cyber warfare when it’s convenient.
Of course they are. At this moment, I’ll bet that they are engaged in cyberwar with Wikileaks. And probably Anonymous, as well.
Bob in AZ
Will other countries adopt this same policy? Will other countries believe our government if they deny involvement when it is proven the hacking originated in the United States? Will they take aggressive military action on the U.S. at that point and be justified? What if the hacking originated in a country by someone who didn’t have that countries best interests but we had the Bush/Obama mentality of retaliation?
Is it possible we have developed too much machinery dependent on computer systems that need manual overrides? Or, is that too much 20th century thinking on my part?
Really great read. Even better if you’re a combat vet:
http://www.amazon.com/Military-Incompetence-American-Doesnt-Century/dp/0374521379/ref=sr_1_1?ie=UTF8&qid=1306864913&sr=8-1
This appears to be the end of bellum iustum and the concept of proportionality.
Consequently, the value of war and peace history has just been rendered moot.
Don’t be fooled! This pretense of an attack from the internet is fiction pure and simple. Infrastructures such as the power grid on not connected to the internet. it is just an attempt to grab more power for the sociopaths running the government by using fear as a control mechanism.
Dude, you have got to remember to take your meds. This kind of thing can cause a scene when you go off in Costco or Home Depot and you know how mortifying that can be.
Mods: Why was my comment #43 deleted? You should have deleted marksb’s comment #42 ad hominem attack.
You got it the old fashioned way, you earned it on the record; marksb is right, the crazy was piling up in the aisles. And, yes, the other comment was bounced too. After a point is is simply not responsible to have conveyed beyond the fringe legal theories as if they were fact; they are quite far from that and readers are entitled to coherent threads. It is truly nothing personal, just a desire to maintain quality of discussion.
What an Orwellian response and attitude. Seems ad hominem attacks are ok as long as they support the accepted party line.
I can see your comments in your comment history (which anyone can do) and this one…:
…is spectacularly counter-factual. Or would you prefer “Orwellian.” Here’s a two-year old article (as of this next August.) Read it.
And STUXNet worked on the Iranian valve controls too.
You simply don’t have facts on your side, ever, which is pretty much true of every libertarian I’ve ever met.
I don’t believe that article. It’s ludicrous. No administrator in his right mind would connect the power grid control systems to the billing or administrative systems. There is simply NO reason to do that. NONE!
I don’t know how the Iranian plant is arranged but it seems more likely that someone had to physically be there to do what they did. Not through the internet.
Who cares what you believe. Facts are facts. Xcel Energy is running this program:
http://www.xcelenergy.com/Save_Money_&_Energy/For_Your_Home/Heating_&_Cooling/Saver%27s_Switch_-_CO
They’re my provider, run in multiple states, and they’re controlling the grid over the Internet.
Face it, you just don’t have facts on your side. Rich in belief, poor in facts = ideologue.
So you’re saying that the “green smart grid” is putting people at risk and making the grid less secure? If so I agree the smart grid is the worst idea ever invented.
My previous comment still stands. The power grid control systems are NOT connected to the internet and your comment about consummer control doesn’t prove otherwise.
What you don’t understand, is I just impeached you as a witness by prior testimony.
Believe what you want, assert what you will; nothing of what you posted is factual.
The topic at hand on this thread is what counts, and that is a matter of law, nothing of your assertions; now I am happy with the record, and so, retire.
US bleeding secrets to cyber foes.
Y’all should read the RSA SecurID wiki. It’s pretty thorough and quite illuminating, especially in regard to vulnerabilities.
The family jewels were reported stolen in March of this year, and now we’ve seen the result with Lockheed, and everyone assumes, others. MadDog was right the other night–the secure system, isn’t anymore.
Yes I know everyone’s gone from this thread now.
Thanks for the link. It explained a lot.
The Internet is not inherently unsecure. The servers and clients on the Net are what determines the security level of the attached device. Thus, one could well run an extremely tight system if you based access on an extremely tight access program.
Smart grids are in their infancy and will no doubt take many forms in the future. Virtual Private Networks will be one, where a secure access net is “tunneled” through from the wide-open Internet. The secure level of the VPN is a factor of the tightness of access policies and permissions.
There’s a whole science to this and it gets hugely more complex than what we’re talking about around here.
And, FML, my apologies for going off on you like that. Sometimes my snark gene takes over. I would ask you to read more, believe less, and think about having thicker skin. We often disagree around here, but we’re here for the most part because we like to think out loud, get challenged IRT our thinking, and we tend not to take it too personally when we do find ourselves challenged.
Apology accepted. Personal attacks really don’t bother me. What does is having comments deleted, no explanations, no messages, just gone just cause they have a view some bloggers don’t agree with. Wouldn’t have believed that would happen is a place that calls itself progressive. That’s something I would expect from MSM or George W. Obama shutting down dissent like they do to whistleblowers and others.
You don’t get to have your own facts, regardless that some commenter offers his/her head to your guillotine.
Demonstrate facts. You haven’t and cannot present such in this thread to support your position as currently stated.
The comments were in another post as stated in my diary not this one. The comment here that was deleted wasn’t really important.