Exploitation Is Warfare

Cyber exploitation and intelligence gathering activities by foreign adversaries are continually referred to as cyber-attacks. This use of vernacular permeates from the media into the minds of those who ingest it. For this and other reasons, cyber activities which are not attack effects or battlefield preparation are constantly referred to as attacks or cyber warfare. We have established that this is incorrect. Title 50 activities are not acts of war whether they are committed by the United States or other nations and we need to remember that.

When a foreign spy is discovered in the United States, they are not shot; they are tried, convicted, and incarcerated or depending on their political or diplomatic status simply expelled. The US government itself has taken this same stance with cyber actors in its charging through the Department of Justice and Federal Bureau of Investigations of attributed uniformed hackers from China and other countries. This should further enforce the fact that for a cyber activity to fall within the legal and authoritative realm of warfare, it must actually be a fully attributed state-sponsored attack effect.

Even when conducted by uniformed members of a foreign country as part of state-sponsored cyber intelligence gathering, it is considered intelligence gathering under Title 10–type authorities and not Title 10 warfighting actions and authorities. As such, it would be outside the authorities of most national and certainly international convention for a state to respond to such exploitation or intelligence gathering activities with their own cyber-attack effects. This would certainly be viewed as an unprovoked warfighting action and potentially a declaration of open conflict.

Ease of Attribution

There is not a widespread appreciation for the sheer difficulty in attributing cyber activity. This is the case for exploitation, intelligence gathering, and attack effects launched within the cyber domain. Especially where cyber-attack effects, which are acts of war, attribution must be with absolute fidelity if a response is to be launched. We need to remember that a response to an act of cyber warfare can be a missile launch, invasion, or otherwise similarly weaponized warfighting action. Since that is the case and given the ease with which cyber actions can be masked and attribution undermined, convincing decision makers and politicians to declare war or approve warfighting activity based on an attribution of a cyber-attack effect would seem extremely unlikely.

There are essentially two ways in which a cyber-attack effect can elicit a warfighting response within a realistic time window. The state which launched the cyber warfighting action can openly admit the act as part of a declaration of hostilities against its enemy. The only other situation that responsibly allows for warfighting responses to a cyber-attack effect is when the attributed perpetrator is a state with which the victim and responding state is already in open conflict. These two scenarios revolve around open acknowledgment of motivation for the cyber-attack. Short of the perpetrator admitting it was a Title 10–type action, in cyber, there is essentially no way to know the intent of a cyber activity without it resulting in an attack effect or being admitted as an effort to bring one to bear. When part of a declaration of hostilities or ongoing conflict, motivation is admitted or assumed.

Return Fire

In cyber warfare there is no realistic concept of return fire. If we ignore the previous misconception and assume attribution is actually possible, there is still no feasible situation where it would happen so fast that cyber or other actions could subsequently be launched against the unit or asset which launched the attack effect. Remember, a tool which delivers an attack effect can be installed days, months, or even years prior to being executed. Further, even if the enemy hackers are discovered placing the attack tool, without execution having happened, there is no way to completely know, or more importantly prove, the motivation of that action. When the necessity for timeliness is combined with the near impossibility of attribution in the first place, return fire seems a laughable concept. Cyber-attack effects should be directed as a strategic decision as part of a greater and wider conflict, not as part of a tactical response to an ongoing firefight.

I like to compare the ridiculous concept of returning fire in the cyber domain to the following example. Imagine US patrol in Afghanistan accidently came across a Soviet-era land mine, placed decades earlier to deter afghan advances. The land mine is stepped on by one of the patrol members and it explodes. The mine was placed by Soviet soldiers who are potentially dead of old age and are certainly no longer even in the country of Afghanistan. What target might the surviving members of the patrol return fire against? This may seem like an exaggeration, but it would be just as easy for the members of that patrol to go back in time and return fire against the Soviet soldiers who placed the mines as it would for a victim of a cyber-attack effect to attribute, target, and respond in a tactical manner to the assets which launched the cyber-attack with their own cyber-attack capabilities.

Target Dictation

There is this idea that once targets are found in the cyber domain, commanders can simply direct them be attacked and it will be so. What makes the return fire scenario even more improbable is the fact that target dictation in the cyber domain happens as the result of vulnerabilities being present and weaponized exploits existing. Commanders and decision makers cannot dictate which targets are susceptible or which capabilities exist. So even in a scenario where we ignore that attribution is extremely difficult and successfully targeting for return fire next to impossible, we may still be unable to respond to that target with cyber-attack effects. Let’s assume attribution was essentially immediate and with enough fidelity to responsibly dictate a response against the enemy who conducted it. We must also assume that the enemy that conducted it has not simply been attributed but that the location from which it is obfuscating its communication pathways or accessing the internet to conduct cyber operations has also been located and with enough fidelity to adequately target it. For return fire to happen while the aggressors are still carrying out cyber-attack effects would also mean that the infrastructure identified as being actively used by the enemy is vulnerable to an exploit in the arsenal of the responding state and that an attack effect that is viable on the enemy device is available.

Resource Availability

In case we have not yet decided that cyber warfare is insanely difficult or potentially wholly unrealistic, there is more! In the same line as the misconception that targets in the cyber domain can simply be chosen based on a decision by a commander is the incorrect assumption that tools are readily available. I don’t just mean the exploit and attack tools, but also the ability to even communicate with a target once it is chosen or operate interactively on that target with an access tool if it can be exploited.

The difficulty in attaining the technological resources involved in cyber warfare coupled with the potential ease with which control or ownership may be lost would have to weigh so heavily on every warfighting decision it might paralyze the cyber operator and the commander alike. Let’s do some more assuming to continue illustrating the difficulty in cyber warfare these misconceptions help decision makers ignore. Let’s assume a cyber-attack effect was launched, and the victim not only attributed the perpetrator but identified the infrastructure they were actively using to launch more cyber-attack effects against other assets of the victim state. The commander picks that infrastructure as a target and cyber-attack effects as the appropriate response action. Let’s even assume the victim state has both a working exploit against those systems and an attack effect that will nullify the enemy’s cyber warfighting capability. The decision that is now faced by the commander is, is it worth it? Remember, using an exploit and/or an attack effect potentially risks the loss of control or ownership of that resource.

Imagine a patrol in enemy territory is engaged by enemy small arms fire. Now imagine that the patrol leader has to weigh the fact that if he or she responds in kind with small arms fire from their M-16 assault rifles, there is a chance that the M-16 weapon as a resource might be lost, not to the patrol, but to the entire state military. This is an unrealistic situation in the domain of land warfare, but in the cyber domain, it is very real, and assuming all other challenges leading to an ability to return fire or engage an enemy with cyber-attack effects were satisfactorily accomplished, there is still the question of whether or not the risk to the cyber resource itself is worth it in the given scenario. Would you be willing to risk an exploit and attack effect resource in a cyber return fire response against enemy cyber infrastructure if that same exploit and attack effect would be needed to shut down enemy air warning radar ahead of troop deployments and air strikes? I don’t think I would. This is further in support of the fact that cyber domain warfighting activity should be strategically planned and weighed at the theater or global level and not a part of tactical responses in ongoing battles as the potential implications of cyber resource utilization are so far-reaching.

Shelf Life

There are resource assumptions beyond the misconceptions about the general availability of cyber resources both in general and in a target-specific sense. There is a notional concept that these resources can be stockpiled and kept of the shelf so that when the time comes for use, the potential for their loss is less damaging to the overall cyber warfighting capability. The fact is that this is simply not the case. Even if a state had the ability to create stockpiles of different exploits, access tools, and attack effects, there is no guarantee that when the time comes that they are utilized, they are effective. There is an entire global industry sector dedicated to securing cyber systems from being subject to exploitation, unauthorized access, and attack.

An attack effect or exploit may still work and the vulnerability enabling their execution on the target may still be present, but the security industry may have developed signatures based on similar capabilities already seen or simply improve heuristics to the point that they detect the tools as malicious and stop them. Cyber security companies don’t care if a tool is an amateur hacker backdoor or a state created zero-day exploit. They are doing their best every day to stop all types and sources of potentially malicious cyber activity. This means that even if the ability to stockpile cyber resources were realistic, stockpiling them in the first place may be a wasteful endeavor. Aside from the security industry, there are also any number of other states, organized crime entities, and hacker groups trying to also develop cyber resources, which may be almost identical to what is stockpiled. These facts also further complicate that decision paralysis on whether or not to risk losing a cyber resource through its utilization as it may be lost at any time even if never utilized.

Static Targets

Just as there is a misconception that once developed, a cyber resource is readily available to be used until needed, there is an assumption that targets are static. I mean static in two ways. The first assumption is that once a resource is developed for use against a target, that target will remain in a state which allows for the cyber resource to function. The second assumption is that the target’s location will remain the same in the time between target determination and response execution.

Every key stroke, second of being powered on, and on off flip of a bit changes the state of a cyber system which makes them extremely volatile targets. Pretend every earlier misconception were true and a target has been attributed as enemy cyber infrastructure and exploits and attack effects exist for it and the decision has been made to use those tools against it and no security industry development challenges the tool’s execution. In the time it took to do all of this, the enemy may have moved infrastructure, or more likely left the system up, which was never theirs to begin with, and moved their tools and operation elsewhere on the internet. In this case the cyber-attack response by the victim may actually be taking place against a system owned by a non-combatant. If this system were grandma’s smart fridge, no big deal, if it was a machine in a hospital used to track medication dosages and allergies, we suddenly have a potential war crime and innocent casualties on our hands.

The previous scenario illustrates the challenge with the speed of target location change in the cyber domain. To show dynamic the state of cyber system targets, imagine the enemy systems were all using the Microsoft Windows 7 operating system and had been prepared several months ahead of time for a widespread attack to cut off power to military and government forces ahead of an invasion. Now, in those months Microsoft announced and implemented an automatic update of all Windows 7 and newer systems to the Windows 10 operating system. Now the targets with cyber-attack tools on them are no longer vulnerable to the attack effect or its executing exploit.

Next Hacker Up

In the Marines and many other military organizations especially, there is the concept of next man or woman up. If one Marine or soldier goes down or cannot perform their duty, there is an entire Marine Corps or Army full of troops ready and willing to take their place. While this is a stoic concept and useful in some settings, it is not a realistic scenario in the cyber domain of warfighting. I have heard with my own ears a senior leader say to highly trained and specialized cyber operators, “you are not special, I can replace you with any Marine.” While I appreciate the intent of warfighters not thinking they are better or special or deserving of accolades and special treatment over those in other military occupational fields, it is ignorant of certain facts. You can’t just replace a pilot, medical doctor, or special forces soldier with anyone from the larger forces. Cyber warfighters should be no different. The time it takes to develop the type of skills red teamers and penetration testers have which is needed to conduct cyber operations takes years and at least a commiserate level of knowledge if not formal education in computer science at the post-graduate level. The military and government services often struggle with this as they are organizations that rely on an ability to replace individuals, whether due to promotion, duty location rotation, or change in responsibilities. As such, cyber warfighters must be viewed as an extremely limited resource, especially given the ease with which they could find themselves employed outside of the military or federal service.

Open Conflict

Most of this book has covered the technological and conceptual challenges to war within the cyber domain as seen in a vacuum. While all true and applicable out of a vacuum, they do not capture the greatest potential challenge to using cyber as a warfighting domain. In an open conflict with another nation, such as another state or states, like happened in the World Wars, the cyber domain may not be available. There is a potential that the enemy has completely shut itself off from cyber communications with the rest of the world, making cyber warfare almost entirely ineffective. There is also the potential in a wide enough conflict that the cyber domain ceases to exist altogether. Imagine World War III, GPS and communication satellites are shot out of space with missiles, undersea cables are cut, nuclear weapons and EMPs are detonated. In such a scenario, pooling resources into cyber warfare seems foolhardy. I am not suggesting that the cyber domain and cyber operations aren’t extremely important, and still worth pursuit in an open conflict situation, but using what little access might be obtained in such a conflict is likely to be far more important as an intelligence gathering mechanism than a conduit for a one-time cyber-attack effect.