Thursday, January 29, 2009

Cyberwarfare or Cybercrime?

A Russian "cyber militia" has knocked the central Asian country of Kyrgyzstan off the Internet, a security researcher said Wednesday, demonstrating that the hackers are able to respond even faster than last year, when they waged a digital war against another former Soviet republic, Georgia.

Speculation about why Kyrgyzstan's Internet infrastructure was attacked center around an investment deal that Russia is negotiating the country. Russia has indicated that it wants Kyrgyzstan to oust foreign air forces, including the U.S.', before it will agree to loan the country US$300 million and invest another $1.7 billion in its energy industry

I'm very interested in whether this type of thing ought to be considered cyberwarfare or cybercrime. If Russian hackers are taking actions in the lead up to an military invasion, then isn't that an act of war? But what if there is no military action? Is there a certain threshold regarding the scale that should be required before it becomes warfare? Does it depend on the nature of the targets? Should a military response be permitted to an entirely electronic attack?

These questions aren't rhetorical so feel free to respond. I'm interested in what people think about this issue.

HT: Otto


arethusa said...

If there's no war, might it not still also be cyberterrorism?

alan_howe said...

This is perhaps closest to a blockade, depending on what damage has been done to Kyrgyzstan's infrastructure. Blockades are acts of war as I understand things. However, the identity of who committed the act matters. Hezbollah's attack against Israel in 2006 was not the equivalent of Lebanon attacking. (That distinction would arguably not apply today.) Considering the "war on terror" and the confusion that phrase continues to cause, we might require that acts of war require nation-state involvement on both sides of the conflict. Western nations against al Qaeda is perhaps better classified as a criminal matter, specifically, terrorism.

Should note that recent reports say Russia has accommodated the US in routes through Central Asia to Afghanistan, making PCWorld's link to U.S. bases suspect.

dance said...

private citizens commit crimes; nations commit wars?

alan_howe said...

Maybe the reliably confusing "non-state actor" is a better choice than "private citizen." This may track with the Geneva Convention definition of combatants, which provides a distinction between legal and illegal fighters. Westphalian Rules apply?

FLG said...

But what if the state organizes and encourages the hackers?

With modern technology the distinction between private citizen/non-state actors and the state can be blurred. Let's say for the purposes of argument that the hackers are not in the Russian military or even state employees, but the Russian state organizes and directs them surreptitiously through, I dunno, a Facebook page. If this is a volunteer "cyber militia" organized by the state, then wouldn't is be an act of war?

FLG said...

Also, arethusa's point about cyberterrorism is a good one. But then the issue is still whether terrorism is a crime or an act of war.

alan_howe said...

Think of the pre-Internet age and nations sending saboteurs across borders. That is arguably an act of war, but it also provides "plausible deniability" to the instigator. Note also that the DoD suspects its networks were attacked by China or by Chinese. So, this problem is real and really impossible to solve in many cases. We may need to adopt the "law of the sea" to the cybersphere to help clarify wrong-doing.

Creative Commons License
This work is licensed under a Creative Commons Attribution-No Derivative Works 3.0 United States License.