Offering a novel view on cybersecurity and cyberwar

Tim Compston, Features Editor at Security News Desk, catches-up with P.W. Singer, the author of ‘Cybersecurity and Cyberwar’, and Ghost Fleet – ‘a novel of the next world war’, for his thoughts on how states are turning to the cyber domain as part of their current and future military planning.

P.W. Singer, who as well as writing a number of cyber-related books is a Strategist at New America, reckons that no other issue has grown more important to the 21st Century, more rapidly, affecting more people in government but also in regular civilian life, than cybersecurity, yet he suggests that: “There is no issue, arguably, less understood.”

Singer goes on to say that, to date, work on this area has been caught between two poles, either being framed as highly technical and tending to be focused on the hardware and software, but not dealing well with the wetware – the people side of things, or at the other end of the spectrum verging on the histrionic: “‘Get scared’, ‘cyber war is coming’, ‘the power grid is going down’ there is nothing you can do or you can ‘give me lots of money and I will solve all of the problems for you’.”

A realistic approach

In light of the cyber knowledge gap, Singer tells me that what he has sought to accomplish through the ‘Cybersecurity and Cyberwar book’, his articles and testimony to Congress, is to deliver a thoughtful, reasonable, and realistic account: “I point out that there are real [cyber] threats, there are real issues, and real dangers, here. They are not going away and we have to get serious about them.”

Cyber conflict
Away from the civilian aspect, Singer adds that today the cyber world permeates all facets of military operations: “The military depends on it in a fundamental manner so, for example, in the US, 98 percent of military communications goes over the civilian-owned and operated Internet.” Alongside this, Singer explains that cyber has also become a new domain for conflict. This is evidenced, he says, by on-going activities like cyber espionage and, looking ahead, the fact that in the future ‘outright war’ cyberspace would become a battlefield: “Cyberwar is not just about the stealing of secrets but the deployment of Stuxnet-style weaponry against military assets and to take down things like GPS,” says Singer.

Turning his attention to a number of recent lower level conflicts involving a cyber dimension, Singer says: “In the war against ISIS, for example, the US military has already openly said that we are conducting offensive cyber operations against them.” Commenting on events involving Ukraine and Russia, in relation to Crimea, Singer argues that Russia won the cyber part of the conflict before the physical part even began: “It [Russia] owned in both virtual and physical terms the Ukrainian communication networks so when the Russians made their move in Crimea they shut down everything from Ukrainian Government and media websites to the communications of individual Ukrainian military units in the field.”

Military questions
Despite cyber being such a crucial area for armed forces in the West, Singer suggests that fundamental questions are still being wrestled with and debated: “What kind of organisational training and equipping do I need in this space? It is kind of comparable to when we first got aeroplanes. Then there was the question of do we need an army air corps or do we need an air force?” Alongside this, Singer points out that militaries who find themselves with new potential cyber weapons are then wondering how, where, and when they should be deployed. Cyber warfare also poses, according to Singer, a number of command and control questions: “Who should be in charge? How should this be integrated or not with my other military assets and units, to legal laws of war questions. What kind of weapons, what kind of attacks are allowed in this space, which are not?”

Attack attribution
I ask Singer how it is possible to distinguish between a cyber activity between states which bubbles along under the surface and what could be described as cyberwar. He responds that in the cyber world things are not necessarily as clear cut as in the physical: “In every other space the timeline of an attack is typically quite short. The Japanese launched the planes from the carrier and the planes got the bombs on Pearl Harbour and it was like ‘okay we are at war’. In cyberspace the average time between initiation of an attack and detection of it from the victim’s perspective is 205 days.” Added to the timing aspect, Singer stresses that attributing blame comes into play, something which isn’t necessarily clear cut: “Okay, I know that I am under attack, who is doing it? And again, this is where you see the difference with the debate.”

Ghost fleet
On the subject of a full blown cyberwar, Singer also points me in the direction of his new book, Ghost Fleet: “This is about actual war with an actual state power. Ghost Fleet is a different kind of book from Cybersecurity and Cyberwar in that it is a novel, it is a Tom Clancy, Michael Crichton-style techno thriller in terms of the writing. It is fictional, because it is about a war which has not happened yet, but it is like a non-fiction book with over 400 note references.” Singer highlights the serious amount of research that went into Ghost Fleet by emphasising every single technology, every single type of attack and trend is pulled from the real-world: “It plays out on the basis of okay if there is a war with a Russia or a China, which had cyberwar elements to it, this is what would happen.

With talk of a new Cold War in the air, Singer is quick to highlight the fact that, although it seems hard to believe now, in the last Cold War the Internet simply didn’t exist: “Today if you are looking at a scenario of NATO vs Russia or US vs China there are crucial cybersecurity and cyberwarfare elements to it.”

Intellectual property
One of the challenges for the US or China in an arms race, stresses Singer, is the ability to secure intellectual property: “It is very hard to win an arms race when you are paying the research and development costs of the other side.” Singer illustrates his point by referencing the Joint Strike Fighter, the F35: “This is the most expensive weapons project in the whole of human history. The US and its allies will spend over $1 trillion on this programme and part of why we are spending that is this idea that we would have a weapon that is not just slightly better but, literally, a generation of technology ahead of it.” In the Ghost Fleet footnotes, Singer says it is documented that the F35 design was hacked on at least three different occasions: “That is why the Royal Navy doesn’t have F35s yet and China is already flying its J31 which is essentially a clone.”

Hardware hacks
To conclude our discussion, Singer suggests that it is not just the software, but the hardware that drives increasingly sophisticated systems, that military planners need to worry about: “The difference with hardware is that it is an actual thing, it is baked into a system. What does it mean, for example, to be flying a fighter jet where over 80 per cent of the microchips are made by an adversary?” Singer says that beyond the problem of sourcing parts, potentially, in a time of war, in his words: “These spare parts can turn traitor against you.” Singer reckons that, ultimately, a hardware hack is incredibly difficult to detect: “It is like trying to find a needle in a field of haystacks and, by the way, the needle is a piece of hay until it activates.”

[su_button url=”https://www.securitynewsdesk.com/newspaper/” target=”blank” style=”flat” background=”#df2027″ color=”#ffffff” size=”10″ radius=”0″ icon=”icon: arrow-circle-right”]For more stories like this click here for the SecurityNewsDesk Newspaper[/su_button]