Since the 9/11 terrorist attacks, US authorities have been examining potential areas of vulnerability. One of these has been assessed as the United States' reliance on computer systems. This article was originally published on the FOURAYS website in late 1999, however it is now even more relevant.

US Prepares for Cyber War

While some military strategists predict that future wars will be a battle of technologies and seek to gain the technological upper hand, the reliance on high technology increases vulnerability to attack by less technologically dependent adversaries. In countries such as the United States the economy is becoming highly dependent on computer networks, controlling everything from funds transfer to monitoring the moisture content of wheat crops.

The military is also now highly dependent on computer networks for communications, administration, command and control, weapons guidance and a maze of other functions. In fact the internet which has been the catalyst for the sudden rapid growth in electronic information integration, was originally the child of the US military and was intended to provide a complex web of communications that could survive the loss of many links in a nuclear conflict yet still function. It's strength is now percieved as a potential weakness.

Cyber war is here – the United States military has already implemented a program to develop information warfare techniques and make them part of their offensive strategies. Information warfare is nothing new - propaganda and misinformation has been an integral part of war since the Roman Empire. In World War One the first widespread use of radio communications gave intelligence services a new source of information and by the end of the war electronic espionage was an established science.

In World War Two electronic warfare came of age. All combatants allocated considerable resources to eavesdropping and deciphering of their opponents radio traffic, prompting the development of specialised radio intelligence gathering and analysis units. One of the most famous of these was ULTRA, the British intercept unit at Bletchley Park dedicated to decrypting the German High Command’s Enigma codes. This proved vital in the early days of the Blitz and the subsequent Battle of the Atlantic where it provided valuable information about German U-Boat deployment and prompted the development of the first electronic digital computers.Electronic warfare and deception also played a major role in the workup to the Normandy invasion and has ever since been recognised as an essential part of the military’s arsenal.

With the increased access to the Internet and the widespread use of information technology, exposed electronic networks control a wide range of security, economic, social and political functions. This makes them key targets for cyber warfare.

Disrupting enemy information networks via hacking or computer viruses extends the distance from which an enemy can strike. Witness the disruption to America On Line in late 1998, when the entire network was closed down for several days by a simple e-mail virus that once turned loose, set off replicating chains of e-mails which quickly overloaded the network’s servers and caused a total system shut down. Similar mayhem was caused by the Melissa and Love viruses. These two destructive viruses spread around the globe and within days of their "release" wiped information from millions of systems – in many cases despite stringent virus precautions. Access to most systems and networks was gained in many cases using a simple ruse of attaching the disguised virus to an e-mail, and sending it to someone inside the organisation, the mail supposedly being from a trusted associate. By doing this the recipient unsuspectingly opened the attachment, turning the virus loose inside their own computer or network. In these cases the "attack" method relied on the recipient trusting the sender. There were many instances of highly trained computer professionals being caught out by this simple yet effective tactic.

In the early stages of the viral assault, most virus checker programs were useless against it. Like a human virus, computer virus software relies on prior knowledge of a potential virus, storing its profile in memory and comparing incoming data against it to create a match and sound a warning. If the virus hasn’t been profiled and stored, most virus checkers are can’t recognise it and therefore are useless against it. Therefore if one is unfortunate enough to be the first target of a newly created computer virus, chances are high you’ll become a victim. With future "cyber warriors" aiming their efforts at specific targets one could expect such virus programs to be custom made – and likely to be far more sophisticated than simple viruses such as Melissa or Love. Unfortunately, the methods of attack in many cases will remain the same, with human gullibility (and greed) being a prime point of entry.

Even without human assistance many networks are still extremely vulnerable to unauthorised intrusion – the problem being that most systems were never designed with security against viruses in mind. Even high security systems have their weak spots, too many nodes where intrusions can be made, too many people with access etc. The irony is the more sophisticated and technologically dependent a nation is – both in civil and military applications - the more vulnerable it becomes to cyber attack. This is an attractive proposition to a potential adversary, especially one less technologically dependent and therefore less vulnerable to cyber-reprisals. Merely because a nation is less technologically dependent or advanced as its opposition, doesn’t mean it doesn’t have (or can’t acquire) the technology to mount a damaging cyber assault.

Computer viruses, trojans and worms don’t need highly sophisticaticated research programs to create. The Love virus for example was reportedly created by a Philipino university student living in Manilla, so a small team of talented programmers could be expected to create a range of cyber weapons within a relatively limited budget. However, consider what might happen if a nation decided to devote significant resources to such a development program. The results would probably be way out of proportion to the effort expended. A few million dollars yields several billion dollars in economic damage to the opponent – an effective weapon indeed and one particularly attractive to terrorists or extortionists.

Military history is littered with examples of such economically out of balance weapons. A prime example is the submarine. Initially a cumbersome vessel with limited range, it cost a fraction of the amount needed to fund the construction of the battleships it went up against. Until its advent, the battleship was the supreme war machine, a visible symbol of a nation’s ability to project power that could only be deterred by a battleship of equal or superior size. However, the submarine introduced a new factor into the power equation – suddenly the battleship was vulnerable to a small and invisible adversary, requiring a total rethink of how these ships would operate, prompting the development of more armor, the deployment of escort vessels, anti-submarine weapons etc. The expenditure to counter these new underwater menaces was many times their cost.

In WW1 and WW2, German submarines were able to inflict losses far out of proportion to their cost of construction. In both wars, initially only a small number of submarines were deployed against the allies, yet in both instances they almost brought Britain to her knees such were the losses to her supply convoys. In WW2 Hitler was slow to capitalise on the advantages his U-Boats offered – despite the lessons of WW1. By the time Hitler was persuaded to scrap his surface fleet and concentrate on U-Boat production and deployment, the allies were well on the way to developing effective counter weapons. ASDIC, long range radar equiped patrol aircraft - such as the Liberator, Sunderland and Catalina, the escort carrier (or "jeep" carrier) and new anti-submarine tactics (as typified by Commander Walker of HMS Flower) eventually turned the Battle of the Atlantic in the allies favor.

Similarly the aircraft spelled the demise of the battleship. Costing a fraction that of a capital ship, it was capable of hunting down and sinking the largest and most heavily armored warship. The early loss of the British warships Prince of Wales and Repulse to Japanese aircraft off the coast of Malaya in 1942, convincingly demonstrated this, and throughout the war the increasing effectiveness of carrier borne aircraft sealed the fate of the big battleship.

In 1996 a Pentagon study on the growing cyber warfare threat warned of a potential "electronic Pearl Harbor," which led to a Presidential directive in May 1998 setting in motion a multibillion-dollar effort to defend the U.S. information infrastructure. The result of this according to Aviation Week and Space Technology magazine, is that the US Military is now drafting OPLAN 3600, a detailed information warfare strategy. The US Air Force is working on an organisational restructure that will give combat units the ability to conduct cyber war operations and react quickly to any perceived threat.

With cyber terrorists able to strike from any point on the globe, the ability to retaliate, particularly in what may be a restricted war or purely a terrorist attack, are limited. And how does one strike back? For example it’s known that Iraq, North Korea and China are working on cyber weapons. Unless an attacker is positively identified the options are limited. And even if their identity is know, retaliation in kind – due to the adversary’s lesser dependence on technology, may make that retaliation impractical.

To limit the effectiveness of cyber warfare against the United States, further studies are being conducted. The military is confident it can put in place measures to limit the damage of a cyber assault against its assets, however it’s not as confident about providing security for vital civil institutions. Gone are the days when war was declared and defences against sabotage and attack were hurriedly put in place – the anti-aircraft guns around a factory complex, the barbed wire and foot patrols around a power generation plant or hydro-electric dam. Now these installations can be subjected to pre-emptive strike, shutting the factory down by corrupting the assembly robotics software or dropping the power station off the grid, both done by a few well placed computer commands launched from a third world nation ten thousand miles away. Some cyber attacks may be of such a subtle nature that they go undetected until the moment of implementation. For example it’s possible to deploy trojans – hidden programs within a computer network – which activate on command or by date. They then implement their commands which in some cases may be nothing more than a few instructions which cause intermittent shutdown of a power grid , or a major disruption such as knocking out an entire telephone network.

In the civil sector it’s also possible for a well organised enemy cyber attack to lay the ground work many years in advance. For example it’s theoretically possible to insert additional commands into GPS firmware at the point of manufacture which on a certain date causes that system to fail or introduce subtle random errors. The possibilities are almost endless – combinations of attack methods being the most likely. Whilst industry is becoming more aware of the possibilities of software tampering, no one as yet can guarantee that their systems are totally immune to some form of cyber warfare.

Air Force Gen. Ralph E. Eberhart, head of the U.S. Space Command, which oversees the United States cyber war mission, said on March 28 this year, that Iran, Iraq, North Korea, and China (among others) are working on cyber-attack capabilities. "It concerns us when we see these capabilities out there," Gen. Eberhart said at a recent press conference. "We’ve become so reliant on computer systems for our information, that as we train and become more involved in contingency operations, we’ve come to take those capabilities for granted."

So where does that leave the US? One on hand computer technology has given the US the upper hand in many areas, on the flip side it’s opened a Pandora’s box of possibilities for an enemy to use the same technology as the big equaliser. The Pentagon is reported to be investing millions of dollars to raise security awareness levels and to "proof" their systems against such intrusion. Studies are underway to create advanced virus detection software – including software which will be able to detect viruses whose profiles haven’t been recorded by recognising potentially damaging program command structures.

Education also plays a vital role in this campaign – the human element being seen as one of the weakest links and a prime source of input. What is most worrying however, is the lag in implementing such measures being shown by some civil institutions. Being cost driven, many civil authorities and private companies are reluctant to invest in the systems and time needed to proof themselves against all out cyber sabotage – however recent experiences with relatively simple yet damaging viruses such as Melissa have demonstrated just how expensive that inaction can be. Fiscal incentives are being considered, however as one taxation official pointed out: "These shouldn’t be necessary – the losses incurred by not implementing adequate precautions to virus attacks have already been clearly demonstrated."

While there’s some truth in what he says, it’s also interesting to note the reluctance of a government department to forego revenue and to favor its own self interest. However even with subsidies and tax incentives, a future "cyber war" is likely to use "weapons" that have not been considered in the overall protection equation. The Pentagon is suggesting a more integrated approach to the problem, including sharing advanced disk encryption software – which in itself raises problems of security. Whatever the solution, the next few years are going to be interesting in this area as more nations become increasingly computer dependent and more adversaries develop the potential for engaging in cyber war.

end