The Pentagon’s flawed logic on cyberwar

The Pentagon is readying a new strategy that would treat cyberattacks from a foreign nation as acts of war.

The quote that caught my attention was the military official who told The Wall Street Journal: “If you shut down our power grid, maybe we will put a missile down one of your smokestacks.”

That’s all very well, but what would that particular official say if
Iran — which believes Israel and the U.S. to be behind the Stuxnet
cyberworm that sabotaged its nuclear program — applied the same logic
and felt entitled to strike back by putting a missile down an American
or Israeli smokestack?

What’s more, detecting the origins of cyberattacks is not yet a perfect science. The more sophisticated the cyberattackers, the cleverer they are at covering their tracks. A cyberattack that looks as though it came from Russia might actually be from some students in a garage in California.

A Pentagon official told The New York Times: “One of the questions we have to ask is, How do we know we’re at war? How do we know when it’s a hacker and when it’s the People’s Liberation Army?” That’s the whole point — we don’t.

Because of the lack of a collective understanding and its global nature, cyberwarfare looks like the kind of threat that should be regulated by some kind of international treaty. The alternative would be the law of the jungle. Yet discussions are in their infancy. At the U.N., a group of government experts are talking about information-sharing, which is a good first step. They want to pursue the dialogue to reduce collective risk and protect critical national and international infrastructure.

It’s right that the Pentagon, and other nations, are working out their own national strategies in dealing with what could be this century’s most potent and complex threat. It’s a murky situation where cybercrime, cyberwarfare and industrial espionage all intersect. What we need here are some global rules, including the protection of the innocent civilian whose computer might have been taken over from cyberspace.