Cyber Threats to the Critical Infrastructure of the United States
I just happened across a free hosting service for PDF files, and I've been meaning to post my final paper from one of my International Relations classes online, so here it goes...
The paper is titled Cyber Threats to the Critical Infrastructure of the United States and can be viewed here (PDF). At the very least I think that the sources can provide a good starting point for anyone interested in Cyberwar and the vulnerabilities of our critical infrastructures to cyber-based attacks.
Here's a chunk from the intro (minus footnotes):
-----------------------------------------------------------------------------------
In the past twenty-five years three major changes have shifted the way the world operates. First, the Cold War ended and we found ourselves in a world with a lone “hyper power.” Second, advances in computers and the introduction of the Internet to the world brought forth the information revolution. Third, these two forces combined to create the economic globalization that we see today.
Many of these changes have surely made the world better place—they have lessened the likelihood of wars between major powers, they have opened the way for the greatest integration of the world’s economies and made those economies more efficient, and they have made libraries of information widely available at the click of a mouse. But, these changes have also brought with them new vulnerabilities to the national security of the U.S.
As our economy has grown in the information age, it has integrated itself using networks and computers in such a way that the economy of the United States is totally dependent upon the information and computing infrastructure, alongside of the traditional infrastructures of energy, transportation, banking and finance, and vital human services, to operate. However, the Internet was developed without security in mind. At first it was a tool of communication that DARPA created for information exchange among various military, governmental, and associated organizations, all of whom were assumed to be trustworthy. But, as the computer became a household item, DARPA brought the Internet to the public, and it was quickly incorporated into just about every aspect of U.S. society . Even the U.S. Department of Defense relies upon privately-owned Internet lines for around 90% of its communications. In essence we have erected our “immensely complex information systems on insecure foundations,” a fact has not gone unnoticed by the adversaries of the United States.
These changes challenge most of the conventional ways that security has been thought about in the past. No longer can the U.S. afford to worry only about total war with a major adversary. The U.S. must now look at a whole range of actors who want to do harm to the state and its people, and re-adjust its thinking and actions accordingly. The entrance onto the world stage of multiple non-state actors is at least partially due to the ability of smaller groups to use the Internet to network with both individuals and other groups over great distances and regardless of any boundaries. As John Arquilla and David Ronfeldt put it: “the information revolution favors the growth of such networks by making it possible for diverse, dispersed actors to communicate, consult, coordinate, and operate together across greater distances and on the basis of more and better information than ever before.” These groups have the ability to act on their own, but in coordinated ways, which often gives networked forms of organization a relative advantage over hierarchically composed organizations, which must rely upon a fairly strict chain of command and present a direct challenge to the security and preeminence of the nation state. As Bill Clinton succinctly stated in 1998 during a speech to the U.S. Naval Academy: “Our Security is challenged increasingly by nontraditional threats from adversaries, both old and new, not only hostile regimes, but also international criminals and terrorists who cannot defeat us in traditional theaters of battle, but search instead for new ways to attack by exploiting new technologies and the world’s increasing openness.” Possible enemies, as Arquilla and Ronfeldt convincingly put forth, are “likely to operate in the cracks and grey areas of a society, striking where lines of authority crisscross and the operational paradigms of politicians, officials, soldiers, police officers, and related actors get fuzzy and clash.” Arquilla and Ronfeldt have given this type of war, between nation states and network-enabled non-state actors, or between two groups of non-state actors, the term “Netwar.”
Traditional security concepts such as deterrence, linkage, and escalation, all of which assume the nation state as the only actor, as well as many other concepts that have been relied upon for our security discussions and decisions in the past, need to be re-evaluated to see if they are useful in this new world. No longer can security be “defined by armed forces standing between the aggressor and homeland.” Today attackers can get around and outflank traditional defenses. One must come to terms with such difficult questions as: Where are the borders that define internet? Who polices and patrols it and who has jurisdiction over it? Most importantly, Can we defend ourselves in it?
The information revolution has not only brought forth new actors to the world stage, it has changed warfare between states as well. The United States military has grown to its preeminence primarily as a function of the information revolution. The ability to selectively target enemies, to control what they know, and to communicate with the many different pieces of the armed forces during battle is the defining characteristic of the modern military, and is largely responsible for the U.S.’s ability to vanquish a second rate enemy in short order. To a large extent wars have become battles over knowledge, i.e. “who knows what, when, where, why, and about how secure a society or a military is regarding its knowledge of itself and its adversaries.” The Gulf War has been seen by many thinkers in many nations as a turning point in the history of war, a point which was cemented in the minds of military thinkers worldwide by NATO’s victory in Kosovo. The lesson that was taken by these two wars is that the distinction between first- and second-rate militaries is that of information superiority. In essence information has become another front that a country must fight on, as each side struggles for total information superiority. In the Gulf War, for example, the Iraqis could not even mount a miniscule fight against U.S. forces, despite their larger numbers of soldiers and their Soviet-made equipment. Other countries have taken from this that those who control information control the battlefield and that, if they want to effectively challenge the United States, they should not fight another Desert Storm.
Because the United States has such a preeminent military that no other nation is able to counter on its own terms, other nations have begun to look for asymmetric ways of attacking it—attacks where “the United States is vulnerable and presents less risk of conventional retaliation.” The United States is particularly vulnerable to this type of attack in the same area which has enabled it to create such a dominating military and economy—in and through the information and communications systems themselves. In particular it has become obvious to many potential adversaries of the United States that its Achilles heel may be its communication networks, since it is the one critical military component which most modern militaries depend. It is also notable that though cyber war capabilities may be difficult and expensive, the costs needed to start up an effective cyber warfare program are very low, relative to more advanced weapons systems, and the knowledge needed to attain Cyber Warfare results is relatively common, in relation to other military technologies. Currently 8 countries have Information War capabilities somewhat comparable to the United States, most notably Russia and China, and many more are attempting to start their own programs. If we were ever to find ourselves in a strategic conflict with these countries there is a very real possibility that they might resort to attacking our critical infrastructures via cyberspace.
--------------------------------------------------------------
You can read the rest of the paper here.
The paper is titled Cyber Threats to the Critical Infrastructure of the United States and can be viewed here (PDF). At the very least I think that the sources can provide a good starting point for anyone interested in Cyberwar and the vulnerabilities of our critical infrastructures to cyber-based attacks.
Here's a chunk from the intro (minus footnotes):
-----------------------------------------------------------------------------------
In the past twenty-five years three major changes have shifted the way the world operates. First, the Cold War ended and we found ourselves in a world with a lone “hyper power.” Second, advances in computers and the introduction of the Internet to the world brought forth the information revolution. Third, these two forces combined to create the economic globalization that we see today.
Many of these changes have surely made the world better place—they have lessened the likelihood of wars between major powers, they have opened the way for the greatest integration of the world’s economies and made those economies more efficient, and they have made libraries of information widely available at the click of a mouse. But, these changes have also brought with them new vulnerabilities to the national security of the U.S.
As our economy has grown in the information age, it has integrated itself using networks and computers in such a way that the economy of the United States is totally dependent upon the information and computing infrastructure, alongside of the traditional infrastructures of energy, transportation, banking and finance, and vital human services, to operate. However, the Internet was developed without security in mind. At first it was a tool of communication that DARPA created for information exchange among various military, governmental, and associated organizations, all of whom were assumed to be trustworthy. But, as the computer became a household item, DARPA brought the Internet to the public, and it was quickly incorporated into just about every aspect of U.S. society . Even the U.S. Department of Defense relies upon privately-owned Internet lines for around 90% of its communications. In essence we have erected our “immensely complex information systems on insecure foundations,” a fact has not gone unnoticed by the adversaries of the United States.
These changes challenge most of the conventional ways that security has been thought about in the past. No longer can the U.S. afford to worry only about total war with a major adversary. The U.S. must now look at a whole range of actors who want to do harm to the state and its people, and re-adjust its thinking and actions accordingly. The entrance onto the world stage of multiple non-state actors is at least partially due to the ability of smaller groups to use the Internet to network with both individuals and other groups over great distances and regardless of any boundaries. As John Arquilla and David Ronfeldt put it: “the information revolution favors the growth of such networks by making it possible for diverse, dispersed actors to communicate, consult, coordinate, and operate together across greater distances and on the basis of more and better information than ever before.” These groups have the ability to act on their own, but in coordinated ways, which often gives networked forms of organization a relative advantage over hierarchically composed organizations, which must rely upon a fairly strict chain of command and present a direct challenge to the security and preeminence of the nation state. As Bill Clinton succinctly stated in 1998 during a speech to the U.S. Naval Academy: “Our Security is challenged increasingly by nontraditional threats from adversaries, both old and new, not only hostile regimes, but also international criminals and terrorists who cannot defeat us in traditional theaters of battle, but search instead for new ways to attack by exploiting new technologies and the world’s increasing openness.” Possible enemies, as Arquilla and Ronfeldt convincingly put forth, are “likely to operate in the cracks and grey areas of a society, striking where lines of authority crisscross and the operational paradigms of politicians, officials, soldiers, police officers, and related actors get fuzzy and clash.” Arquilla and Ronfeldt have given this type of war, between nation states and network-enabled non-state actors, or between two groups of non-state actors, the term “Netwar.”
Traditional security concepts such as deterrence, linkage, and escalation, all of which assume the nation state as the only actor, as well as many other concepts that have been relied upon for our security discussions and decisions in the past, need to be re-evaluated to see if they are useful in this new world. No longer can security be “defined by armed forces standing between the aggressor and homeland.” Today attackers can get around and outflank traditional defenses. One must come to terms with such difficult questions as: Where are the borders that define internet? Who polices and patrols it and who has jurisdiction over it? Most importantly, Can we defend ourselves in it?
The information revolution has not only brought forth new actors to the world stage, it has changed warfare between states as well. The United States military has grown to its preeminence primarily as a function of the information revolution. The ability to selectively target enemies, to control what they know, and to communicate with the many different pieces of the armed forces during battle is the defining characteristic of the modern military, and is largely responsible for the U.S.’s ability to vanquish a second rate enemy in short order. To a large extent wars have become battles over knowledge, i.e. “who knows what, when, where, why, and about how secure a society or a military is regarding its knowledge of itself and its adversaries.” The Gulf War has been seen by many thinkers in many nations as a turning point in the history of war, a point which was cemented in the minds of military thinkers worldwide by NATO’s victory in Kosovo. The lesson that was taken by these two wars is that the distinction between first- and second-rate militaries is that of information superiority. In essence information has become another front that a country must fight on, as each side struggles for total information superiority. In the Gulf War, for example, the Iraqis could not even mount a miniscule fight against U.S. forces, despite their larger numbers of soldiers and their Soviet-made equipment. Other countries have taken from this that those who control information control the battlefield and that, if they want to effectively challenge the United States, they should not fight another Desert Storm.
Because the United States has such a preeminent military that no other nation is able to counter on its own terms, other nations have begun to look for asymmetric ways of attacking it—attacks where “the United States is vulnerable and presents less risk of conventional retaliation.” The United States is particularly vulnerable to this type of attack in the same area which has enabled it to create such a dominating military and economy—in and through the information and communications systems themselves. In particular it has become obvious to many potential adversaries of the United States that its Achilles heel may be its communication networks, since it is the one critical military component which most modern militaries depend. It is also notable that though cyber war capabilities may be difficult and expensive, the costs needed to start up an effective cyber warfare program are very low, relative to more advanced weapons systems, and the knowledge needed to attain Cyber Warfare results is relatively common, in relation to other military technologies. Currently 8 countries have Information War capabilities somewhat comparable to the United States, most notably Russia and China, and many more are attempting to start their own programs. If we were ever to find ourselves in a strategic conflict with these countries there is a very real possibility that they might resort to attacking our critical infrastructures via cyberspace.
--------------------------------------------------------------
You can read the rest of the paper here.
posted by Anonymous at 2:06 PM
<< Home