Empty playbook
Security in cyber domain is considered as an integral part of National and Alliances´ security nowadays. Today, more than 100 of the world’s militaries have some sort of organization in place for cyberwarfare and over 40 countries worldwide have published their National Cyber Strategy. Cyber threats are also prioritized in many countries´ national threat assessments. For example the latest worldwide threat assessment of the US Intelligence Community states that cyber threats to US national and economic security are increasing in frequency, scale, sophistication, and severity of impact, and Security Strategy of the Czech Republic emphasizes how cyber attacks can cause particular failures of communication, energy and transport networks, transport processes and industrial and financial systems, resulting in considerable material damage. In short, the danger of disruptive and even destructive cyber-attack is estimated to be grown.
The debate on both the impacts of cyber attacks and how to response to attacks is active but precedents are missing. Strategies and political speeches are always (at least partially) declaratory and vague by nature, and beyond these declarations the practical reality of cyber security as a matter of national security issue is difficult. Obtaining reliable attribution is one of the most frustrating aspects of cyber, deterrence is hard to establish, and because there are no international treaties or norms about how to use digital weapons, there are no rules about how to fight cyber conflict. Also defensive, intelligence or offensive cyber capabilities are difficult to assess, because governments are holding their abilities very secret, and cyber capabilities cannot be calculated in the same way as tanks or fighter planes.
The Sony Pictures Entertainment case indicated well how it is difficult to even decide if cyber attack should have been called “cyber vandalism”, “act of war” or “cyber terrorism.” It has to be also kept in mind that we are already living in so digital dependent world that a technical glitch can halt trading in New York Stock Exchange and force all flights of the United Airlines to be grounded – on the same day. It is not only the question of national security and how governments should protect private companies, but also how attacked companies are able to deal with cyber attacks. CEO of the Sony Picture Entertainment Michael Lynton has summarized the current challenge well: "There's no playbook for this, so you are in essence trying to look at the situation as it unfolds and make decisions without being able to refer to a lot of experiences you've had in the past or other peoples' experiences. You're on completely new ground."
Cyber security has evolved from a technical discipline to a strategic concept and conflict in the fifth domain of cyberspace blurs and perhaps enlarges the definition of “war,” to encompass espionage, sabotage, opinion influencing, and intellectual property theft. It gives nations and non-state actors new ways to pursue their political goals on the world’s chessboard. This new theater of operations, where nations must operate proficiently to keep pace with their adversaries, has no military antecedents since there have been no wars between first-class militaries in the cyber era. We are entering a dangerously unstable and suspicious era, and we are doing so without a roadmap of tested command and control fundamentals. The more ominous cyber capabilities grow, the more troubling are the command and control knowledge gaps. There is a great deal still to understand about the escalation patterns and ripple consequences of cyber war, particularly where aggression is likely to cross spheres from the virtual world to the real one. For cyber strategists today, every significant conflict or political event on the planet is a figurative classroom.
Jarno Limnéll
Professor, Cybersecurity
Aalto University
Finland
Biting the hand that feeds IT
