Inside Cyber Warfare - Jeffrey Carr [23]
Nonproliferation treaties work because the components of creating a nuclear device are highly restricted and closely monitored by the IAEA as well as by various governments that have their own agencies monitoring such activities (e.g., US Nuclear Emergency Support Team [NEST]).
Unfortunately, the genie is already out of the bottle when it comes to the components of cyber warfare. Everything that an attacker needs is in wide distribution and freely available or available at a reasonable price. That pretty much kills the effectiveness of any proposed nonproliferation-type treaty aimed at keeping states from engaging in or developing a cyber warfare capability.
While there has been some hyperbole on the part of military officials in Russia and the United States around the issue of scale and proportionality in response to a large-scale cyber attack,[2] neither nation has a policy to deal with it.
Can a cyber attack rise to the level of a nuclear attack? Not in and of itself, but a sufficiently large-scale cyber attack that takes down critical networks and in turn results in systemic failures of safety systems at nuclear power plants could have devastating consequences, including loss of life.
* * *
[2] For example, “Russia retains the right to use nuclear weapons first against the means and forces of information warfare, and then against the aggressor state itself” (Col. V.I.Tsymbal, 1995); cyber warfare is “a close third behind the proliferation of weapons of mass destruction and the use by terrorists of a nuclear, biological, or chemical weapon” (former CIA Director John Deutch, 1996).
The Antarctic Treaty System and Space Law
Cyberspace has frequently been compared to outer space, as both are boundless and unregulated. Surprisingly, there is no prohibition against using outer space as a weapons platform unless it involves the use of nuclear weapons, which is prohibited by international treaty, and/or such weapons are placed on a planetary body such as the moon, which is also prohibited. The void in between, however, is still unregulated.
One of the obstacles in applying this analogy to cyber attacks is that few nations have or can reasonably expect to have the ability to wage war in outer space, whereas over 120 nations have the ability to wage war in cyberspace. Another problem is a difference in the threat potential of a cyber attack compared to launching a nuclear weapon from space. There is no one cyber attack that can be compared to the devastation caused by one nuclear weapon, although theoretically the use of a mega-sized botnet like Conficker C involving millions of zombie computers might come close to delivering a network equivalent.
An alternative to banning a type of weapon in a domain is to ban all weapons in a domain, similar to the Antarctic Treaty System (ATS). Under that treaty regime, Antarctica is off-limits to all types of military development by any nation and is to be used only for peaceful purposes. This won’t analogize for cyber warfare because it’s impossible to differentiate between code used for peaceful purposes and code used for malicious purposes.
Another problem with the Antarctic analogy is that no recognizable boundaries exist in cyberspace and there are very few reliable ways to artificially create them. Recently, an attack against US government websites originated from a server on US soil via a VPN connection with a server in the UK that controlled a number of command and control servers scattered among other nations that in turn directed a botnet to attack South Korean and US government websites. The South Korean Intelligence Service, along with the press and Rep. Pete Hoekstra (R-Michigan), were convinced that the attacks originated in North Korea. The congressman called for the US military to lauch a counter cyber attack against the North Koreans. Had the congressman had his way and the actual source of the attack