Inside Cyber Warfare - Jeffrey Carr [26]
After discussing the iteration of international law in the question of attribution, Tikk breaks it down to a more basic legal principle: that of agency (i.e., has a person acted as an agent of a state, and do his actions equate to actions by the state?). Also, could the state have acted to prevent the harmful actions of the private party if it chose to?
In the case of Georgia and Estonia, Tikk and her team concluded that there is not sufficient evidence to prove state involvement, which is a requirement for the agency argument.
International agreements are being discussed as this book is written that will clarify the legal standing of nations and nonstate actors in cyber events, conflicts, and war.
Is This an Act of Cyber Warfare?
The following sections address cyber attacks that have occurred since the Russia-Georgia conflict of August 2008, all of which have been characterized by various media sources as acts of cyber war. The question that this chapter aims to address is: how accurate is that depiction?
South Korea
On the July 4, 2009, weekend and continuing into the following week, a DDoS attack took down US and South Korean government and commercial websites for indeterminate periods of time. The South Koreans believed the government of the Democratic People’s Republic of Korea (DPRK) or its agent was responsible, whereas no formal opinion as to attribution was expressed by any US officials.
Iran
During the disputed Iranian presidential elections of June 14, 2009, hundreds of thousands of irate Iranians protested the results. One of the forms of protest was the use of DDoS attacks directed against Iranian government websites, using the popular social software service Twitter as an organizing platform.
Tatarstan
In June 2009, the president of Tatarstan’s website was knocked offline and Internet access was lost in an attack he attributes to the Russian Federal Security Service (FSB).
United States
On April 21, 2009, the Wall Street Journal reported that security around the Pentagon’s multi-billion-dollar Joint Strike Fighter project was compromised and several terabytes of data were stolen by unknown hackers presumed to be from the People’s Republic of China.
On July 4–6, 2009, a relatively small-scale ).DDoS attack of unknown origin was launched against about 25 US government websites, some of which became inaccessible for several days, including the Federal Trade Commission and the Department of the Treasury, while others on the target list, such as the White House website, were unaffected. A second and third wave of these attacks were launched in the following days against South Korean government websites (see
Kyrgyzstan
On January 18, 2009, a DDoS attack shuttered two to three of the nation’s four ISPs for several days, denying Internet access to most of the population during a time of growing political unrest. It is still unclear who was responsible, but at least three theories have been floated around:
It was the Russian government in an attempt to force the Kyrgyzstan president to close the Manas Air Base to US traffic.
The Kyrgyzstan president hired nonstate Russian hackers for the purpose of denying the Internet as a medium to opposition parties.
It was the result of a power struggle between competing ISPs.
Israel and the Palestinian National Authority
Along with Israel’s military action against Hamas bases in the Palestinian National Authority in December 2008 (designated Operation Cast Lead), literally thousands of Israeli and Arabic websites were defaced, both government and civilian. (See Chapter 2 for a thorough look at the Gaza cyber war.) Hackers involved allegedly included members of the Israeli Defense Forces and Hamas, which makes this one of the few cyber events that involved official state involvement.
Zimbabwe
As reported by Concerned Africa Scholars on December 2008, in a paper entitled “The Glass