Two papers published at C6

I have updated the publications tab with two papers that were published in the proceedings of the upcoming Conference on Cyber Conflict. As is always the case, by the time they went to print I already had some ideas for changing them. Nevertheless, here they are:

• Lorents, P. and Ottis, R. (2010) Knowledge Based Framework for Cyber Weapons and Conflict. In Czosseck, C. and Podins, K. (Eds.) Conference on Cyber Conflict. Proceedings 2010. Tallinn: CCD COE Publications, p 129-142.[link]
• Ottis, R. (2010) From Pitch Forks to Laptops: Volunteers in Cyber Conflicts. In Czosseck, C. and Podins, K. (Eds.) Conference on Cyber Conflict. Proceedings 2010. Tallinn: CCD COE Publications, p 97-109. [link]

Any comments and feedback welcome.

Paper on Cyberspace

I presented a paper [link] at the 5th International Conference on Information Warfare and Security (ICIW) last week. This year the event was hosted by the US Air Force Institute of Technology, at the Wright Patterson AFB, Dayton, Ohio. If you ever get the chance, I recommend to spend a day or two at the Air Force museum in there (yeah, any less will not do).

Our paper (co-authored by Peeter Lorents) presented some of our work on the cyber terminology. Specifically, in the paper we defined cyberspace as "a time-dependent set of interconnected information systems and the human users that interact with these systems".

It was not our intent to come up with a universal definition (which could be useless), but something that provides a background for our future work. So, basically, it is more like a brick destined to become part of a wall, instead of the wall itself.

While we were at it, we came up with a couple of simple implications from our definition, which are explained in more detail in the paper:

• both offensive and defensive deployments can take place very rapidly in cyberspace
• it is not feasible to map cyberspace accurately
• both attackers and defenders must constantly reconnoiter or patrol the potential area of conflict in cyberspace.

The conference itself had some interesting papers from various angles and I look forward to reviewing a few of those here.

P.S. I moved the publications section to a tab at the top. Under that tab is now the full list, with some papers available via Google Docs.

On definitions

A big problem in the field of cyber is the lack of commonly agreed definitions. I think cyber war and cyber terrorism are the worst, each having numerous conflicting definitions. So, in order to clarify my own thoughts, here is my attempt to pin down the meaning of some popular phrases in the context of national security:

• cyber attack - malicious use of information systems in order to influence the information, systems, processes, actions or decisions of the target without their consent,
• cyber conflict - a confrontation between two or more parties, where at least one party uses cyber attacks against the other(s),
• cyber war - a cyber conflict between state actors, where the critical information infrastructure is attacked,
  
• cyber terrorism - a cyber conflict where one party is using cyber attacks to cause fear, physical damage, and/or death among the civilian population of the other party.

Note that information collection, an activity usually limited to espionage, intelligence gathering and crime, is not included in the cyber attack definition. [TO DO: better explanation of the concept]

I am sure these definitions will change as my understanding of the topic grows.