|German Transrapid TR 09, photo by Állatka|
|Research Papers Published by Countries, 2009. Click to Enlarge.|
United States of America
|China’s share of world publications by sectors. Click to enlarge|
|India’s share of world publications by sectors. Click to enlarge|
|Year by Year growth of India compared to G8 nations, Thomson Reuters|
Germany, France, and Italy (and Spain)
On the issue of cyber security of critical infrastructures
There is a lot of talk in regards to cyberattacks nowadays. A regular user worries about its data and tries to secure by all means necessary. Yet, no one really thinks whether the power plants or nuclear facilities are well secured. Everyone assumes that they should be secured.
The reality, however, differs. According to many reports of cyber security companies, there is an increased risk of cyberattacks, targeting SCADA and ICS. Supervisory Control and Data Acquisition (SCADA) is used for the systems that control physical equipment – power plants, oil and gas pipelines, they can also control or monitor processes such as heating or energy consumption. Along with Industrial Control Systems (ICS) they control critical elements of industrial automation processes. Exploiting vulnerabilities of critical infrastructures can lead to the consequences of unimaginable scale. (These types of attacks are actually used in a cyberwar scenarios and hypothetical military settings).
There are many reasons why these systems are vulnerable for attacks. First of all, the main problem is that these systems have an old design; they were built before they were connected to any networks. They were later configured to connect via Ethernet, and that’s when they became a part of a larger infrastructure. The more advanced SCADA system is becoming, the more vulnerabilities are these to exploit. The updates should be regular and on time. Secondly, there is a lack of monitoring. New devices that are connected allow remote monitoring, but not all devices have the same reporting capabilities. There are also authentication issues (weak passwords, authentication process), however, this is supposed to restrict unauthorized access (See Common SCADA Threats and Vulnerabilities at Patriot Technologies, Inc. Online).
In these scenarios, there is no certainty to know what is going to backfire because of the complexity of communications and power networks. This is also called a cascading effect of attacks. Not knowing who is connected to who may cause major disruptions. The example of the US East Coast power blackout in 2003 proves this point (a failure in one element of the grid spreads across other electrical networks). However, given this, it is also complicated for an attacker to predict consequences, if an attack executed. This kind of attack can easily escalate into more serious conflict, so it might not be the best option for states to employ such methods.
Moreover, there is a risk to damage a critical infrastructure unintentionally. That is if a virus or worm did not intend to target SCADA but happen to spread there as well. The uncontrollability of the code may seriously impair the desire to use it, especially when it comes to nation-states. For instance, in 2003 a worm penetrated a private network of the US Davis-Besse Nuclear Power Station and disabled a safety monitoring system for 5 hours. In 2009, French fighter jets could not take off because they were infected with a virus.
Indeed, a scenario where an attacker gains access to a SCADA system and manipulates with the system, causing disruptions on a large-scale, might be hypothetical but it does not make it less possible in the future. However, the only known case so far, which affected an industrial control centre, is Stuxnet. It did not result in many deaths, yet it drew attention of the experts on the plausibility of future more sophisticated attacks. These potential upcoming attacks might cause the level of destruction, comparable to that of a conventional attack, therefore resulting in war.
Bradbury, D. (2012). SCADA: a Critical Vulnerability. Computer Fraud & Security, 4, p. 11-14.
Cyber impact on global security landscape
Computer and information development has brought us a new brand virtual world. Social networks where people share their personal details; online banking where they manage their financial activities, and many other things. Everything from personal identity and wealth, intellectual property to national security secrets have been placed in virtual domain. Many things already reside in and/or depend upon cyberspace; many more will soon join the virtual space. So it is not surprising that the information age is transforming global security landscape.
According to Kaspersky Lab, a multinational cyber security and anti-virus provider, these are boom times for cyber threats, cyberattacks and cybercrime (2015). Another leading cyber security company Symantec says that recent years have revealed unprecedented levels of ambitions among cyber perpetrators. 2016 alone has been marked by extraordinary multi-million dollar virtual heists, cyber attempts to affect the US electoral process, and some of the biggest distributed denial of service attacks (Symantec, 2017). While the disruptions caused by such cyber activities are enormous, attackers use rather simple tools and tactics, giving an asymmetric advantage to weaker actors.
At the same time digital technologies are now being incorporated into military planning and operations. Modern nuclear and conventional weapons systems are more complex than they are used to be. They rely and depend on digital technologies and information systems for launching, targeting, command and control, including technologies that govern safety and security. It is clear that future military conflicts will all include a digital aspect and cyber technologies.
Moreover, a malware Stuxnet, which affected an Iranian nuclear facility and was discovered in 2010, crossed the line between cyber and physical domain, showing that it was possible to use a code to damage a critical infrastructure. Before it, a general debate on how a critical infrastructure can be targeted and damaged through the information system has only been theoretical. After Stuxnet it was evident that cyberspace could be exploited and used to launch cyberattacks in order to cause physical damage.
The highly sophisticated piece of technology is one of the first uses of cyber offensive technology (or a cyber weapon) in history. Believed to be sponsored by a state, the malware introduced a new page in international security and showed that these capabilities can be developed and used against an opponent. It did not cause disruption (as any other cyberattack before it), it caused actual physical damage. Nonetheless, it is still unattributed and believed to be a part of highly-covert operation which has not been officially confirmed. There is no verified information available, everything is classified and the most of the sources are newspapers, claiming that the operation targeted Iran’s nuclear facilities and it was meant to slow down the Iran’s nuclear program.
Stuxnet resembles a similar dramatic change in warfare and reflects similar impact on international affairs after 1945 (the introduction of nuclear weapons, its first use in Hiroshima and the consequences in politics). Similarly to nuclear era, we are now in a new age, which is bound to be transformed. In order to be prepared for this change, these issues are to be addressed.
As General Michael V. Hayden, former Director of the NSA and of the CIA, highlighted, “Rarely has something been so important and so talked about with less clarity and less apparent understanding than this phenomenon” (2011, p. 3).
The first exploration into cyber warfare started in the 90s with the writings of Arquilla and Ronfeldt. In the beginning they were rather hypothetical assumptions, only discussed within a limited group of experts. 9/11 changed this perception, introducing a new view on the very definition of threat. After 2001 it became clear that cyber threats are to be addressed and taken into account seriously. The discovery of Stuxnet in 2010 only proved that point.
Generally, information about cyber technology is classified and that is why limits the research. Even though everyone knows that there is an arms race in acquiring and developing cyber technology, no one really knows anything for sure. Only the Western writings shed some light on what is going on in the field. Most of current writings in this field are done and elaborated by the Western researchers and military. Due to the transparency requirements, there are many NATO and national documents (redacted and/or edited for public use) that address these issues and communicate the main strategies in cyberspace. However, there is much less academic research on it. Some countries, like Russia, stay completely secretive about the issue with absolutely no information online, neither state nor public.
Considering that cyber technology has low entry costs and high chances for success, it is a powerful tool for states and non-state actors to prove their capabilities and show their authority. The development and pursuit of cyber capabilities, therefore, pose new risks for escalation; invite new threats and tensions that may cause new conflicts. These conflicts could destabilize international stability and jeopardize nuclear deterrence. Moreover, constant cyber threats in military installations, particularly those associated with nuclear, undermine constitutional confidence, generate new risks, and pose new challenges for deterrence theory.
Naturally, cyber issues have now become a main agenda for politicians and policy-makers. Building resilience, strengthening cyber defense and deterring such attacks occupy all minds in international relations. Yet, due to the high secrecy around cyber issues and general media hype over them, there are still many misconceptions and misunderstanding about cyberspace and cyber capabilities, especially when it comes military setting.
Kaspersky Lab. (2015). Top Cyber Security Threats to Watch Out For. [online] Available at: https://www.kaspersky.com/resource-center/threats/top-7-cyberthreats [Accessed on 22.02.2018].
Symantec. (2017). Internet Security Threat Report. [online] Available at: https://www.symantec.com/content/dam/symantec/docs/reports/istr-22-2017-en.pdf [Accessed on 22.02.2018].
Hayden, M. (2011). The Future of Things Cyber. Strategic Studies Quarterly, 5(1), pp. 3-7.
A new cyber arms race
Not long time ago cyber threats were not even on agenda in security, let along national security landscape. Now, the situation is different. Now, everyone recognizes the risks of hyper-connected world: from an individual in front of the computer to a high-level officer, operating a nuclear facility. As new tools are being developed, cyber-security occupies an important niche in decision-making and planning. As more and more people are securing their laptops, tablets, phones; the military started doing that too.
Just six years ago the US Defence Secretary warned about a possible Cyber Pearl Harbour. Cyber Pearl Harbour is a strategic surprise attack which could potentially incapacitate computational and communication capabilities, leading to a devastating impact on the country (Goldman and Arquilla, 2014, p. 13). This notion is usually fuelled by ongoing media reports that countries are in active pursuit of offensive cyber capabilities which could jeopardize any sector, penetrate any system and cause major disruptions. Regardless of the accuracy of these reports, every country understands that these cyber insecurities can be and, probably, will be exploited by an enemy. That is why many states are now allocating enormous amount of resources to develop defensive cyber means along with the offensive capabilities.
The number of cyberattacks is increasing. One can argue about its future potential targets, but it is clear that we should assume that cyberattacks will become only more sophisticated and, possibly, more deadly in the future. That is why vulnerabilities should be addressed, and the nations should be prepared to the cyber challenge.
Along the most well-known cyberattacks happened in Estonia (2007), Syria (impacted air defence systems 2007), Georgia (2008), Iran (Stuxnet 2009-10), The Saudi Arabia (Aramco 2012), Ukraine (2014), U.S. (electoral campaign 2016). Additionally, the world was quite agitated about WannaCry and Petya attacks in 2017. All in all, most of the recent attacks targeted commercial sectors, showing that there might be a constraining norm in regards to military sector and critical infrastructures.
This consequently might indicate that states might be pursuing more sophisticated technologies in order to target more sophisticated systems. It might as well suggest a possibility of on-going cyber arms races between the countries. However, there are clear limitations of cyber warfare, as no physical damage occurred and no people were killed. Even the damage inflicted on critical infrastructures was limited and failed to cause major consequences. However, financial losses as a result of cyberattacks can be rather substantial and might have a great impact on economically weaker states.
Based on the scale of current attacks, we can only assume that the technology will spread and get more sophisticated with the time. As Mazanec has outlined, cyber warfare capabilities will play a role in future military conflicts, as they are being integrated into military and state doctrines (2015, pp. 80-83). However, despite cyber challenges to national security, it does not necessarily reflect that deterrence methods and tactics will be applicable to cyberspace.
This technology is quite cheap, requires less resources and personnel, and therefore allows less economically advanced countries developing cyber. As a result, there is a clear asymmetry with weaker states competing with the world powers. Consequently, the threat is multiplied internationally. So the states are now in an unprecedented situation, because of the high level of uncertainty that cyberspace poses. This compels the states to adapt to the fast changing environment in international relations.
According to the report of McAfee, a global security technology company, 57% believe that cyber arms race is taking place now. The top officials in the West are convinced too. For example, NATO secretary general Stoltenberg said that cyber would become integral to any military conflict. Following this, NATO Defence Ministers have agreed that cyber will be a part of military planning and operations. It is clear that the West is fully aware of cyber developments and eager to use it in its actions.
Similarly, the Chinese Military Strategy of 2015 has also admitted that cyberspace will take a place in strategic competition among all parties. The Indian Army is also not falling behind and strengthening its cyber arsenal. General Rawat has recently said that India is now more concerned about developing these cyber capabilities than fighting on the border. The chain-reaction follows as in the case of the Cold War in pursuing the technologies and keeping up-to-date with the others states.
In this situation a leader faces similar challenges as in proliferation of any other military technology. There are four possible scenarios that make it difficult to calculate probabilities (According to Goldman and Arquilla, 2014):
1) We develop a cyber capability – They develop a cyber capability;
This is a frequent scenario and occurs when both countries have technological capability to develop cyber means.
2) We develop a cyber capability – They don’t develop a cyber capability;
There are certain problems in verifying if a country really lacks a capability to pursue cyber weapons. However, this case gives obvious advantage and leverage to a state that develops cyber capability.
3) We don’t develop a cyber capability – They develop a cyber capability;
From a political and strategic point of view, it puts a state into a disadvantageous position, therefore, making it undesired.
4) We don’t develop a cyber capability – They don’t develop a cyber capability;
It is more desirable; however, no direct experience exists. Usually if there is a possibility that a technology can be developed, it will be developed at least by some state.
Interestingly enough, there is not much concrete information available in regards to these developments, whether it is amount of arsenal, types of cyber capability, or just simple information on the notions. Information which is accessible is usually written by the Western authors (it is particularly covered by US officials/military and academia) or can be found in government’s documents. NATO common strategy, perhaps, contributes towards it. On a broader scale, cyber is treated as a state secret and specific information is classified. There is much information which is not available (for example, development of cyber weapons, its employment, reasons for its employment, legality of the use of cyber weapons etc.). In some countries, there is nothing to find at all.
The good example is cyber capabilities of Russia. There is no available information: no official statements, no official policy, no academic articles published, it goes to the extent that even media is not engaged in these issues. Alexei Arbatov (2018), an internationally recognized scholar on global security, has recently confirmed that even academic debate in Russia does not officially exist, only at the university level or informal. Notwithstanding, the Military Doctrine of the Russian Federation recognizes the fact that military threats and dangers are now shifting towards cyberspace (“informatsionnoe prostranstvo”).
Similarly to Russia, China also maintains secrecy concerning its developments in the military. According to the report of the Institute for Security Technology Studies (2004), available sources insist that Beijing is pursuing cyber warfare programs, but classified nature of specifics aggravates assessments.
This secrecy around cyber resembles the secrecy surrounding nuclear developments. All of this information was classified too, yet the principles of nuclear governance have managed to emerge even in the tight environment of the Cold War. Similar situation arose in regards to the use of drones. All the initial strikes of drones were classified, and only with time the debate started to evolve. At the moment it is quite vigorous.
As for cyber, it will certainly take time to talk freely about cyber capabilities and warfare. It will be different in different countries, but in the end the debate will open up as well as new technologies will come and cyber would have become a history.
Arbatov, A. (2018). Stability in a state of flux. Opinion presented at the 31st ISODARCO Winter Course – The Evolving Nuclear Order: New Technology and Nuclear Risk, 7-14 January 2018, Andalo.
Billo, Ch. and Chang, W. (2004). Cyber Warfare, an Analysis of the Means and Motivations of selected Nation States. Institute for Security Technology Studies, [online] Available at http://www.ists.dartmouth.edu/docs/cyberwarfare.pdf [Accessed on 27.12.2017].
Goldman, E. and Arquilla, J., ed. (2014). Cyber Analogies. Monterey: Progressive Management.
Mazanek, B. (2015). Why International Order is not Inevitable. Strategic Studies Quarterly, 9 (2), pp. 78-98. [online] Available at: http://www.airuniversity.af.mil/Portals/10/SSQ/documents/Volume-09_Issue-2/mazanec.pdf [Accessed on 28.01.2018].
 U.S. Department of Defense (2012). Remarks by Secretary Panetta on Cybersecurity to the Business Executives for National Security, New York City, [online] Available at: http://archive.defense.gov/transcripts/transcript.aspx?transcriptid=5136 [Accessed on 22.01.2018].
 McAfee (2012). Cyber Defense Report. [online] Available at: https://www.mcafee.com/uk/about/news/2012/q1/20120130-02.aspx [Accessed on 22.01.2018].
 Hawser, A. (2017). NATO to Use Cyber Effects in Defensive Operations. Defense Procurement International, [online] Available at: https://www.defenceprocurementinternational.com/features/air/nato-and-cyber-weapons [Accessed on 22.01.2018].
 NATO (2017). NATO Defense Ministers agree to adopt command structure, boost Afghanistan troops levels. [online] Available at: https://www.nato.int/cps/ic/natohq/news_148722.htm?selectedLocale=en [Accessed on 22.01.2018].
 Gurung, Sh. (2018). Army stepping up cyber security. The Economic Times, [online] Available at: https://economictimes.indiatimes.com/news/defence/army-stepping-up-cyber-security/articleshow/62482582.cms [Accessed on 23.01.2018].
 Here it means both offensive and defensive capabilities (Author’s note).
 The Military Doctrine of the Russian Federation (edited in 2014). Moscow: p. 4. [online] Available at: http://www.mid.ru/documents/10180/822714/41d527556bec8deb3530.pdf/d899528d-4f07-4145-b565-1f9ac290906c [Accessed on 23.01.2018].
On the issue of cyber security of critical infrastructures
5 Simple Additions That Will Give Your Kitchen a Makeover
Cyber impact on global security landscape
Reach a worldwide audience with the translation services
A new cyber arms race
Why You Should Consider Volunteering
Technological change and new challenges in war
Briefly about the Russian Political Discourse
How to name a business
A new cyber arms race
Business12 months ago
5 Points to Consider Before Starting a Website
China7 months ago
A Lovers’ Quarrel: What Now for India and China?
Business6 months ago
GESAB, innovation and design with 25 years of experience
Opinion7 months ago
Changing The Rules of the Game: What to Expect When Social Media Dictates the News
India10 months ago
Struggling over Water Resources: The case of India and Pakistan
Economy7 months ago
Creating Perceptions: What is Really Happening with the Indian Economy?
Environment6 months ago
A Choking City: What the Ongoing Toxic Week in Delhi Means for its People
India Russia Cooperation7 months ago
Diamond Diplomacy: India and Russia Natural Allies in Reshaping Diamond Industry