Blog reset

I am back from my summer hiatus. As promised, I will continue to throw my ideas and thoughts in here.

I have often found it interesting how some people fear the offensive side of cyber. 'Defense only' is the politically correct way of putting things, even though it is pure nonsense. Skills and knowledge to be a good defender is largely dual-use.

Look at it this way. Imagine briefing a general: "Sir, our defensive infantry brigades have dug in around the city, we can now deploy our offensive infantry regiment to attack the enemy." True, some units are better equipped and trained for offensive or defensive missions, but that does not mean that they lack the capability to do both.

Summer hiatus

I am taking some time off over the next month or so, enjoying the summer weather and gathering new ideas for the coming year. Therefore, posting will probably be hectic at best. Regular posting will resume in late August.

PowerPoint them!

There is an excellent essay at Don Vandergriff's blog about a horrible cyber weapon - the PowerPoint slide. In the essay T.X. Hammes analyzes how PowerPoint has weakened the [military] decision making process, as well as the ability to reason and write coherently. The main argument is that previously, staff had to provide a short, concise decision paper for the leader to read, think, discuss and decide, now the leader gets a barrage of information, very little time to think and discuss, and finally has to shoot a decision from the hip. However, he also makes a distinction that PP can serve as a very useful teaching tool.

I think the essay makes a valid point.

On definitions

A big problem in the field of cyber is the lack of commonly agreed definitions. I think cyber war and cyber terrorism are the worst, each having numerous conflicting definitions. So, in order to clarify my own thoughts, here is my attempt to pin down the meaning of some popular phrases in the context of national security:

• cyber attack - malicious use of information systems in order to influence the information, systems, processes, actions or decisions of the target without their consent,
• cyber conflict - a confrontation between two or more parties, where at least one party uses cyber attacks against the other(s),
• cyber war - a cyber conflict between state actors, where the critical information infrastructure is attacked,
  
• cyber terrorism - a cyber conflict where one party is using cyber attacks to cause fear, physical damage, and/or death among the civilian population of the other party.

Note that information collection, an activity usually limited to espionage, intelligence gathering and crime, is not included in the cyber attack definition. [TO DO: better explanation of the concept]

I am sure these definitions will change as my understanding of the topic grows.

ECIW 09 in Lisbon

I just got back from Lisbon and the 8th European Conference on Information Warfare and Security. This annual conference brings together 60-100 academics from across the world to present and discuss their research during the two-day event.

A paper that I wrote for the conference in the winter got published in the proceedings (see publications). The main idea of the paper is that there are three general ways to create an offensive capability in cyberspace:

• establish a unit/agency for that mission ("conventional" own forces approach)
• outsource the problem by hiring digital mercenaries, cyber criminals and the like
• develop or hijack a volunteer force, or a cyber militia, to attack convenient targets with little or no attribution for the state.

In reality, a combination of two or three is potentially more powerful than any single approach.

While thinking about the last two approaches, I came to some interesting conclusions. First, if a government uses volunteers or mercenaries to conduct an "illegal", or at least unethical, campaign against its political enemies, then there will be a rise in (cyber) crime in the state. This happens because the government cannot alienate the "friendly" attackers by arresting them for non-political crimes (such as sending spam, stealing credit card information or DDoSing commercial sites for blackmail). This also explains why cyber criminals seem to flourish in some states that also seem to have an aggressive stance in cyberspace.

The second idea was that in case of volunteer forces, the government would have to "exercise" these forces once or twice a year, in order to keep them "on mission". A volunteer offensive cyber militia will likely disband for more interesting pursuits, if they are not called to arms for several years. This means that the state would have to provide a steady stream of external or internal "enemies" to keep the militia occupied.