Man in the Middle

The internet provides us with a huge bunch of opportunities as well as with many threats. One threat, according to what you can read when it comes to governments funding “Cyberdefence Agencies”, seems to be a Cyberwar. I believe that although there are many threats coming with the internet something like a Cyberwar is a non-existing threat.

To support my arguments let us first have a look at the definition of Cyberwar. Depending on which language you choose for Wikipedia the definition of Cyberwar is a little different. Most people seem to agree on the following definition:

Cyberwar – a war which is conducted substantially in the cyber or virtual domain.

This definition compares the Cyberwar with a conventional, kinetic war which in my eyes leads to a couple of problems. Military doctrines of retaliation and deterrence have no real meaning in the virtual world of the internet. The same you can hardly win, loose or hold ground in a space which has no clear boundaries.

But it comes even worse. Whereas in the real world opposing forces know each other it is not that easy to determine if an attack in the internet is really another state attacking you or just a bunch of script kiddies in this state running a DDOS attack against one or several server in your country. At the same time it is possible that the final force attacking your infrastructure is not at all in the country from where you see the attack coming but only uses these routers to hide their origin. In a word, you will have a hard time if you finally want to identify your enemy in the internet, especially when the attack is short. An ongoing attack will eventually identify the forces behind the attack.

The next problem arises when we think further. A war is conducted using weapons.

A weapon is a tool used with the aim of causing damage or harm (either physical or mental) to human beings. In human society weapons are used to increase the efficacy and efficiency of tasks such as hunting, fighting, the committing of criminal acts, the preserving of law and order, and the waging of war.
– Wikipedia–

Apart from some unlikely incidents I think everybody would agree when I say that it is nearly not possible to harm a human using whatever sort of cyber weapon. Independent of which sort of cyber weapon you deploy the damage will most likely stay in the virtual world, damaging software infrastructure and therefor interfering with services provided by the internet.

When I am already thinking about cyber weapons, I have a hard time to find one which really qualifies as weapon at all. Viruses, Worms or whatever doesn’t qualify as weapon. It is like spreading a disease. It cannot be controlled and directed towards an enemy, it might as well kill you own kin once set free.

Another argument against the occurrence of a cyber war lies in the velocity of the development in IT. It would take an enormous effort to build up an arsenal of cyber weapons and maintain them. The whole industry is constantly closing up the network infrastructure implementing security measures and correcting bugs. Keeping up with this development would mean that your arsenal of weapons has to be constantly extended with new weapons because the old ones don’t work any more.

My conclusion is that at the time being we are not able to fight a real Cyberwar. We cannot certainly identify who attacks us and we have no real cyber weapons for an attack and the damage we can do is only of temporary impact. Most likely important infrastructure will simply be disconnected from the internet to protect it in the case of an ongoing attack.

—

This assumption shall not fool anybody about the means of cyber supported warfare. Naturally it makes absolutely sense to combine a real world attack with the corresponding means in the internet. A temporary black out of your enemies communication can support and hide a real world attack and the temporary aspect of such an attack is in this case unimportant.

The usage of the internet for espionage, terrorist attacks or even such a direct sabotage as with the Stuxnet virus do not qualify as Cyberwar. The same applies for the misuse of the internet for criminal purposes.