Should the US Go Offensive In Cyberwarfare? 276
The NYTimes has a piece analyzing the policy discussions in the US around the question of what should be the proper stance towards offensive cyberwarfare. This is a question that the Bush administration wrestled with, before deciding that the outgoing president didn't have the political capital left to grapple with it. The article notes two instances in which President Bush approved the use of offensive cyberattacks; but these were exceptions, and the formation of a general policy was left to the Obama administration. "Senior Pentagon and military officials also express deep concern that the laws and understanding of armed conflict have not kept current with the challenges of offensive cyberwarfare. Over the decades, a number of limits on action have been accepted — if not always practiced. One is the prohibition against assassinating government leaders. Another is avoiding attacks aimed at civilians. Yet in the cyberworld, where the most vulnerable targets are civilian, there are no such rules or understandings. If a military base is attacked, would it be a proportional, legitimate response to bring down the attacker's power grid if that would also shut down its hospital systems, its air traffic control system, or its banking system?"
Offensive? (Score:5, Funny)
It could be the Blackwater of Online Warfare.
Re:Offensive? (Score:5, Funny)
Re:Offensive? (Score:5, Funny)
Re: (Score:2)
Thanks, now I have tea all over my screen.
Re:Offensive? (Score:5, Informative)
Re:Offensive? (Score:5, Insightful)
But we INVENTED a lot of this stuff. What does the NSA do, exactly? Yeah, they intercept international communications and develop systems to do this, but is that really all they do... really?
I sure as hell hope not...
Re: (Score:2, Informative)
What does the NSA do, exactly?
Spy on Americans?
Re: (Score:3, Interesting)
What does the NSA do, exactly? Yeah, they intercept international communications and develop systems to do this, but is that really all they do... really?
Hmm... Now that you mention it, I'm surprised I've not heard more conspiracy theories that the NSA is behind Conficker (or other worms, but Conficker seems the best bet since it's really well-designed and hasn't yet revealed its purpose) and that the government tends toward pro-Microsoft legislation so that there are more vulnerable, poorly-secured computers throughout the country/world for them to use to their advantage.
I'm not saying it's true, I'm just thinking that the NSA is doing a damn good job sinc
hasn't yet revealed its purpose (Score:3, Informative)
It's a spambot [washingtonpost.com]and scareware downloader [washingtonpost.com].
Re: (Score:3, Interesting)
1. What makes you think they don't already have a backdoor into every copy of Windows shipped?
2. Maybe Microsoft is really just a patsy in this whole affair, and the government just fosters their monopoly so they'll continue churning out shitty, security-hole-ridden software. I mean, it can't be good to have incredibly rich, influential civilians in on this level of conspiracy, so maybe the NSA doesn't deal with them directly at all...
Well, that's enough for my daily d
Re: (Score:3, Interesting)
I'm also fairly sure the NSA puts a decent amount of research into quantum computing, which can fairly easily break any encryption scheme in use today, if you line up enough qubits for enough time.
Re:Offensive? (Score:5, Informative)
1. What makes you think they don't already have a backdoor into every copy of Windows shipped?
In effect, this has been freely admitted by Microsoft, and we've discussed it several times here on slashdot. It came up a month or so back in a story about someone who found that, even with all the automatic update stuff turned off, some "system" updates happen in Vista anyway. Turning off all the auto-update stuff doesn't stop these updates from happening. In the discussion, it has come out that this has been true since at least the early releases of XP.
In various security-related forums, it has been pointed out that this "feature" is a classical backdoor. It allows anyone with the right connections inside Microsoft to get their software installed in any machine via the automatic update mechanism. If you think that the security folks in various government agencies (in the US and other countries) don't know about this, you're rather naive. After all, it has been discussed here and in several other public net forums.
This is also a good thing to bring up when someone makes the claim that all other OSs are just as vulnerable as MS Windows. With linux and the *BSDs, we have the source available (and we can compile them ourselves if we like), so we can (and do) examine the code for such things. We can be reasonably sure that, when backdoors have been slipped into these open-source systems (and it has happened), the fact has become public very quickly and there were fixes available. With MS Windows, we don't have the source (though some agencies in the US and PRC governments have it), so we can't examine the code or recompile it. And when the stories come out about the automatic downloading of new software by Windows, Microsoft isn't even apologetic. Those backdoors are there intentionally; they're not going away; you and I have no defense against them.
Except to not use Microsoft products, of course.
(Actually, it has been pointed out that you can make MS Windows secure, but one of the requirements is that you never connect it to any kind of network. This includes removing hardware such as wifi, bluetooth, IR, USB, etc. devices ;-)
Re: (Score:3, Insightful)
6920 616d 206e 6f74
what the US should do (Score:4, Insightful)
Re: (Score:3, Interesting)
If the "owner" or "user" of the computer is tricked, bribed or forced to install such malware, what computer is there that will protect itself?
Sorry, but if you have untrained and inexperenced people doing administration on computers, you are going to have problems. No matter what the computer operating system is, if the "administrator" installs malware on it and follows whatever procedures are required to install the software, it is compromised. Period.]
Linux, MVS, VM, Windows, Solaris, OS X, whatever.
Re: (Score:3, Interesting)
If the "owner" or "user" of the computer is tricked, bribed or forced to install such malware, what computer is there that will protect itself?
Sorry, but if you have untrained and inexperenced people doing administration on computers, you are going to have problems. No matter what the computer operating system is, if the "administrator" installs malware on it and follows whatever procedures are required to install the software, it is compromised. Period.]
Linux, MVS, VM, Windows, Solaris, OS X, whatever. It doesn't matter. The only thing that has any chance of helping is to get the administration power out of the hands of inexperienced and untrained people. Give them "appliances" that cannot be subverted because nothing can be installed on them.
When was the last time you had to update the anti-virus software on an iPod? How about having to reboot your refrigerator because it locked up?
If all people need is web browsing and email, they need something that will do that and nothing else. No possibility of viruses, worms, trojans or whatever else. Just something that gets the job done without the possibility of anything bad happening.
I agree with most of your reply, but your analogies seem a little flawed. My refrigerator doesn't call my friend's refrigerator in Sweden and show pictures of his latest backpacking adventure, nor does my iPod go on msn so (s)he can talk with his/her girlfriend on the web cam. I have already stopped crossing the street to avoid getting hit by a car, I change my underwear on a daily basis *just in case* it does happen and the paramedics have to take my clothes off, and I also have recently begun not even t
Re: (Score:3, Interesting)
But other people don't suffer at the hands of your ability to operate a refrigerator and if they did (you cook them a meal) you are liable for food poisoning. A computer should be no different, users need to be held accountable for the damage their stupidity causes.
Ok I'll throw in a free car analogy.
If you don't know how to drive a car, yet you choose to anyway you are held liable if you crash, even though you didn't know what you where doing you would still be charged. Same goes for any other bit of machi
Re: (Score:2)
Re:what the US should do (Score:5, Funny)
CLI baby. Go back to X windows from a command line. if the user doesnt want to do anything but what they have to on the computer, they won't be doing things that they shouldn't.
I think that's the most retarded comment of the day.
Re: (Score:3, Informative)
Re:what the US should do (Score:4, Insightful)
If the "owner" or "user" of the computer is tricked, bribed or forced to install such malware, what computer is there that will protect itself?
OLPC with Bitfrost will do exactly that just fine. Just because most other OSs don't even try to prevent those issues doesn't mean you can't.
Re:what the US should do (Score:5, Interesting)
The only issue here is: should the OS trust the sysadmin?
No. The OS should only trust the combination of a verified sysadmin and a verified program.
That is what is sorely lacking in the security models coming from the mainframe era. It is based only on the level of trust of the user, but completly ignores the programs that the user runs.
Remember the story about the trojan horse. The problem wasn't that the people who pulled the horse into the city weren't trusted, because they were. The problem was that they didn't adequatly guard/check the horse which was an untrusted object.
Computer security needs to make it easier for those who want to use the computer to run programs but also want to be security minded. And that means increasing the ability to set access rights of program.
I should be able to do stuff like give any executable in the "notsotrusted" directory no internet access, as well as read only access to the documents folder, except for documents accessed via the operating system file dialog. And these access rights should work together with user access rights, so you would need both to be allowed access.
Of course, that is mostly me dreaming, because I don't think I'll see it in a very long time if ever. In the meanwhile I'll just keep use sandboxie or other sandbox programs to keep the least trusted programs seperated from the rest. It does work pretty well, but the lack of integration with the operating system is noticable.
Re: (Score:2)
What the US should do is stop connecting 'computers' to the Internet that can so easily be hijacked in phishing/malware/spam attacks.
That's somewhat less satisfying than dropping napalm on them. More effective, sure, but do you really want to live in a world where spammers AREN'T burned alive? Cause I don't.
spammers ? burned alive ? that's why... (Score:2)
And me waiting all this time for the '+10inches - Garanteed - Swedish Pump + 15 Original Cyalis' package to be delivered...
Re: (Score:2)
I agree,
we already have enough problems with asshats abusing the internet. We don't need the United States Government as well.
Abso-freakin'-lutely! (Score:5, Interesting)
Starting in 2002 we gave away our dominance in software technology to other nations. The policy of China was to subsidize tens of thousands of students studying in the computer sciences. In 2002 American companies subsidized this policy of China by shipping over American jobs so that Chinese students could gain the necessary and hard to obtain experience of working on real systems. American programming jobs were shipped to India, China, and Russia and subsidized these nations in their ability to build expertise in software technology.
Now very few American students are enrolled in the computer sciences departments of America to provide the expertize necessary for threats to American computer systems, while other nations have tens of thousands that can obtain all of the benefits of software technology. American students will not enroll in the computer sciences when the policy of America is simply to ship programming jobs overseas. Now many American systems are dependent upon offshore foreign programmers. There have already been incidents where offshore foreign workers were bribed to provide account information on bank customers.
The reality is that major American system may have already been compromised by bribes to offshore foreign workers to insert malicious code into the American systems where they have direct access. Hollywood movies show complex schemes and supposedly sophisticated attacks to access computer system when the reality is that you can simply walk in the front door with a bribe and have complete access. It is meaningless to protect these systems from attacks over the internet when they may already have been seriously compromised.
=Smidge=
Re:Abso-freakin'-lutely! (Score:5, Insightful)
And yet that's not the policy of America. That's the policy of *some* American companies.
Mostly because US workers are not worth what they cost to employ.
The solution is not a phobic restriction on offshoring (protectionism), the solution is to bring domestic wages in line with offshore wages. Ideally this is done by increasing the global standard (and cost!) of living, but at some point we might just have to realize that our ridiculous wasteful standard of life is unsustainable if we want to compete economically with the rest of the world.
Re:Abso-freakin'-lutely! (Score:5, Informative)
Yes, you have a point about our standard of living but it's not only our standard of living that has caused this problem, it's also the deterioration of the quality of k-12 education in the US - especially in math.
When I did my undergrad, more often than not, kids who didn't know standard mathematical identities, were Americans. I don't see how someone who doesn't understand logs and exponents inside out can do well in a (respectable) comp sci program. Why should US companies hire mediocre US comp sci students when they can hire higher quality students overseas at a cheaper price?
Re: (Score:2, Insightful)
...it's also the deterioration of the quality of k-12 education in the US - especially in math.
While your deterioration theory is interesting, and math education is inadequate, I'm fairly sure you're hearkening back to a past that never was.
I seem to remember that inadequate math education was offered as "proof" as to why the Soviets beat the US into space with Sputnik.
Re:Abso-freakin'-lutely! (Score:5, Insightful)
No it's not. The policy of America is to promote globalization and free trade which in the long run is thought (rightly or not) to be beneficial to the USA. If that's what you are doing then it does make it kinda hard to use legislation to stop American companies from doing what they want which is hiring labor where its cheapest. Either you are for protectionism in which case we will lose in the long run because US companies won't be able to compete, or you are for liberalization of trade (including labor) in which case US workers will have to compete for jobs on equal terms with Chinese, Indians etc
Re:Abso-freakin'-lutely! (Score:4, Interesting)
And there is the problem: who really thinks this?
The fact is that GATT and NAFTA had, and have, very little to do with "free" or "fair" trade. Subsidies and trade barriers remain on both sides of all borders, and in the main, they were giveaways of many trade advantages that the U.S. naturally enjoyed, to the eventual detriment of U.S. citizens and businesses.
However, your statement that the U.S. cannot compete is simply false. BEFORE these "trade giveaways", we competed just fine. Isn't it amazing that we have had trouble since?
Further, the "cheap" labor markets have also, over time, gained a well-deserved reputation for sub-standard products, whether those products are toys or software. That is not to say that there are not competent programmers and producers elsewhere. Of course there are. But I am referring to trends and averages. Further, "cheap" labor and production has led to environmental degradation that would not be tolerated within the U.S. So these multinational and outsourcing corporations are responsible for harming their cheap laborers even as they improve their income.
Globalization of the economy (as opposed to plain trade) is a bad, bad, disastrous idea. Diversity is essential for the survival of organisms, and that is a valid analogy to economies and cultures as well. Nationalism will not (had better not) be broken down, because if it is, woe to the people of Earth.
Re: (Score:3, Informative)
And there is the problem: who really thinks this?
I do.
The US lost its trade dominance in the '70's, long before the original FTA with Canada (later expanded into NAFTA).
GATT was around from 1948 to 1994 (before being replaced by the WTO). The period from 1948 to the late 60's was a boom period for the US, in part driven by world trade.
So by trivial empirical examination the current US mess has nothing much to do with free trade.
The real problem is that your dollar is the reserve currency and has been for t
Re: (Score:2)
There have already been incidents where offshore foreign workers were bribed to provide account information on bank customers.
You seem to be implying that there haven't been cases of American workers doing the same. Is there any reason to think this implication is accurate?
Re: (Score:3, Insightful)
There have already been incidents where offshore foreign workers were bribed to provide account information on bank customers.
The reality is that major American system may have already been compromised by bribes to offshore foreign workers to insert malicious code into the American systems where they have direct access.
Do you honestly think American workers don't do the same? It's almost as if your argument is that American workers are inherently more ethical than foreign ones and that therefore offshor
Re:Abso-freakin'-lutely! (Score:5, Interesting)
Yes, the jobs are right there in the careers section of the web site and as long as tech companies want to claim there's a shortage of qualified candidates, they'll remain there unfilled.
Re: (Score:2)
Yes, the jobs are right there in the careers section of the web site and as long as tech companies want to claim there's a shortage of qualified candidates, they'll remain there unfilled.
Bugger the mod points, I'm going to come out and say it -- that's one bloody insightful comment. Despite all the signals and oblique references, up until now I hadn't thought of the method of simply advertising and not filling jobs might be a cheap way to gain political capital for the agenda of chasing cheap technical labour. Serious facepalm. I know I learned something here because I suddenly feel rather stupid.
Re:Huh? (Score:5, Insightful)
We did ALOT!
We gave craploads of money to teachers unions and then made high school easy to pass without learning anything so the teachers did't look to bad
We passed onerous environmental and labor laws encouraging companies to abandon the US.
We ran around and screamed and yelled that everyone should be coddled and no one should be fired.
We did alot. We are getting exactly what we paid for.
We have strong unions getting massive benefits at the cost of the consumer and the citizen. Because smartly, the businesses pass on the true costs of what we wanted right back to us. If you don't like what you got, then look at us. Not "Evil big business".
Re: (Score:3, Insightful)
Nonsense. We passed sensible environmental laws, which just about everybody in the developed world today finally recognizes are necessary. The developing countries have environmental policies that they know are not long-term viable, which they allow in the name of industrialization. But it is generally acknowledged that they are creating a global problem.
"We ran around and screamed and yelled that everyone should
Re:Huh? (Score:5, Interesting)
We did ALOT! (sic)
WHO gave "craploads" to teachers unions? Those vastly over paid teachers? Or are you claiming some secret back door from the government because THAT would be worth a laugh. The people we do know got a crap load of money were the banks, investment companies, etc., who have spent the last 20 years sending their back office operations, research departments, telemarketing and customer service offshore.
You scream about letting the market work but when it does, you don't like it. You complain about taxes, pay the teachers dirt and wonder why you didn't get wonderful results. Oh, wait! You have "studies" showing that increased school budgets don't bring better results. Amazing, just amazing how that argument is never used against CEOs and investment bankers. Boo hoo, if we don't pay them enough the best and brightest will run off to Dubai!
You blame some poor schnook doing their best for 35k/yr because they can't compensate for the sins of parents who pass on to their kids the attitude that the "piece of paper" is the only important thing. Or a society that wholly devalues and is embarrassed by academic achievement. Or the array of ipods, text messaging, facebook, and other trivialities that mommy and daddy buy for their precious offspring and allow them use without consequence.
You set up and continue a dysfunctional system of local schools supported largely by community property taxes so that the difference between going to a public high school in Bethesda, MD and Washington, DC is comparable to going to school at Choate Academy and a village in Angola. And then you bemoan 50% drop out rates and the that 2/3rds of school children can't find their state on a map.
Yeah, blame it on the teachers unions. That's really where the problem is.
We passed onerous environmental and labor laws encouraging companies to abandon the US.
Right those nasty workers and their unions again. Imagine them wanting to work in places with basic safety measures and living in communities that aren't poisoned by their employers. Because, oddly enough, it NEVER seems to be the CEO's house that sits atop the toxic waste dump.
We have strong unions getting massive benefits at the cost of the consumer and the citizen.
Oh Lordy, do I EVER know what you mean! Who would have thought that 7% of the private sector that belongs to unions could cause SUCH problems. My god, they show up in doctor's offices now! You just can't get reservations at Spago anymore. And skiing at Vale, well don't get me started!
Re: (Score:2)
The giveaway in software technology was on the part of traitorous corporations that decided to outsource, in the name of short-term profit, and without regard to the very economy that made them big in the first place.
The American economy pressured them to do it. They reduced costs for goods sold to American consumers*, because their consumers demanded it, and they returned increased profits to their (primarily) American investors.
The problem with free trade is that its benefits are disparate and hard to quantify (e.g. an extra 0.5% on GDP annually, slightly lower inflation), while its downsides are specific and easy to see (a closed factory).
*A comparison between the effects of labour competition and reduced goods price
Re: (Score:3, Insightful)
That's not "the American economy". That's corporate greed. The economy per se did not change, but corporate policies (and the laws governing them) did. QED. "The problem with free trade is that its benefits are disparate and hard to quantify (e.g. an extra 0.5% on GDP annually, slightly lo
no brainer (Score:5, Insightful)
If a military base is attacked, would it be a proportional, legitimate response to bring down the attacker's power grid if that would also shut down its hospital systems, its air traffic control system, or its banking system?"
no.
putting vital systems on the Internet (Score:5, Funny)
What country would be foolish enough to connect its power grid, hospital systems, air traffic control and it's banking system to the Internet.
Re: (Score:2, Informative)
What country would be foolish enough to connect its power grid, hospital systems, air traffic control and it's banking system to the Internet.
The US, apparently.
Get used to it. (Score:3, Insightful)
What country would be foolish enough to connect its power grid, hospital systems, air traffic control and it's banking system to the Internet.
What country would be foolish enough to connect its power grid, hospital systems, air traffic control and it's banking system to the telephone network?
What country would be foolish enough to connect its power grid, hospital systems, air traffic control and it's banking system to radio receivers?
And so on.
You gotta communicate with 'em SOMEHOW. Are you proposing the b
Re: (Score:2, Interesting)
Re: (Score:2)
Physically bombing a country's electricity and transport infrastructure seems to be fair game, so why shouldn't a cyber attack be the same.
We might find it is preferable to break in in such a way that they don't know it has happened, and monitor what is going on. I'm sure that already happens, but this is a tactical decision.
Re: (Score:3, Insightful)
In World War II, the U.S. bombed civilian targets in Germany and Japan, the rationale being that stopping the Third Reich and the Japanese empire justified the cost in lives and suffering. We had 50 years to think about that decision before the U.S. became involved in the Kosovo War in 1999. Then, the U.
Re: (Score:2)
Actually, no. I should note as a counterexample that the bombing by Germany of Rotterdam pretty much caused the Dutch to surrender to the Germans. As well as causing panic in France that materially aided the German advance (French refugees blocked roads that would have been necessary for any serious French counterattack
Re: (Score:2)
If the internet needed a whole new set of moral and legal principles, than your moral and legal principles weren't well generalized to begin with.
Re: (Score:2)
That would assume that taking out the power grid would in fact do those things. Hospitals have generators, as do ATC systems. Banks I'm sure would be able to keep working behind the scenes, even if they couldn't open their doors to customers.
The way I see it, we should use cyber warfare as a life saving measure. Basically, don't use cyber attacks unless you would use an equivalent military strike to get the same effect if the cyber option wasn't available. There are times when destroying or disabling a
Re: (Score:2)
I believe it was Powel that said, "you break it, you buy it". So, rebooting a couple of computers, reinstalling some software, sure seems a much cheaper deal than trying to rebuild a power grid.
I would assert it would in fact be unethical, to bomb the power grid if you could simply do it with cyber attack.
Re: (Score:2)
An attack results directly in the death of American citizens. Such a response would only indirectly result in the death of citizens if at all.
Whereas such an assault would cost lives and physical damage, the response would simply be an inconvenience. After all, what hospital or air traffic control system doesn't have battery backups. Making life miserable for an opponent is a sure way to curb future agression, and disabling an enemies civil infrastructure is a benign way of doing this.
No cyber-waterboarding or cyber-torture (Score:5, Funny)
I can just imagine the streaming video of masked men slowly lowering a powered-up motherboard into water while yelling "why did you portscan us?"
Re: (Score:3, Funny)
Comment removed (Score:5, Interesting)
Re: (Score:2)
Basic facts about war, foreign policy and economics will always be with us.
I'm not sure what these "basic facts" you mention are. They can't include "there will always be wars" because there have not always been. They can't include "nations will always have competing interests" because the very idea of a nation is a recent one. They can't include anything about corporate interests or the financial system because again, those are recent and flexible institutions, and while it is true that a system of full
Re: (Score:3, Insightful)
What you seem to be saying is: Russia and China don't need to build up an army, because they have no reason to be afraid of us. On the other hand we DO need to be afraid of them, because they have a history of being imperialists and aggressors.
The truth is the good old USA has a long history of being imperialist and an aggressor. How do you think we got Florida? Or Texas, or California
Re: (Score:3, Insightful)
The answer is no. (Score:5, Insightful)
At least, not until provoked, and then only at resources demonstrably being used in actual operations against the US.
The reason is that we don't want politically motivated cybervandalism to be legitimized.
This is what I had against the whole neo-con "spread democracy" program. I'm all for spreading democracy, but it won't work unless you spread the values and institutions necessary to make democracy work. One of those is freedom of thought and expression. It makes no sense to promote democratic government in a country where you are conducting psyops campaigns and are complicit in or actually performing suppression of free speech.
Re: (Score:2)
At least, not until provoked
I would consider all those "Tr3y canadian C1alis rol3x3s FREE!" sufficient provokation to justify military action. Not only do they spam me, they're full of typos! It's offensive on all levels!
(Yes, I do know it's not so much typos as it is trying to get past filters, I don't care)
Proactive offence vs passive defence (Score:5, Insightful)
Besides, I would rather these units proactively dismantle bot-nets, spynets, and spam-nets to protect our infrastructure than to constantly force the private companies to deal with the criminal and 'not-so-criminal-china-warfare' tactics going on today.
Let's think about this one for a second... (Score:4, Insightful)
Seriously, if any military official takes more than two seconds to realize that it is clearly insane and has not learned one thing from our struggles in Iraq and Afghanistan. Alienating the populace of a nation like that has no benefit and is outright counterproductive. An attack on civilians like this works only in the context of strategic, conventional total war. We haven't fought a conventional war in 50 years. For any foreseeable conflict that U.S. could be involved in, it would be only sane to scrap the idea of attacking civilian infrastructure of any kind, information infrastructure included.
Re: (Score:3, Insightful)
"We haven't fought a conventional war in 50 years."
There were those two wars against Saddam Hussein (I put it this way to distinguish the initial part of the Iraq War from the counter-insurgent part).
Re: (Score:2)
I believe the context here is "total" war. I.e. a war where people are already 100% against you, and nothing is gained from restraint. The last time that this was remotely true was WW2, and even then the Total war was stopped before reaching its logical conclusion: 100% annihilation of the enemy.
Since when does the government... (Score:2)
Since when does the gov ask NYT or slashdot readers what to do? And, would we really expect that the CIA would be making public announcements about their actions and intentions?
"Cyberwar" by definition involves at least two warring parties, doesn't it?
And, the internet is an interesting beast, requiring a computer to be connected to it in order communicate. Once connected, there's the potential for an exploit, given the complexity of software + hardware and the human vulnerability to coercion (mandatory htt [xkcd.com]
What makes you think they haven't? (Score:2, Insightful)
Just because you don't read about it doesn't mean it doesn't exist.
You seriously think the country with the worlds largest and longest established sigint program doesn't use it for offensive purposes?
Absolutely (Score:2, Insightful)
Nothing prepares you for war like lots of practice.
"Just like the atomic bomb" (Score:4, Insightful)
Just as the invention of the atomic bomb changed warfare and deterrence 64 years ago, a new international race has begun to develop cyberweapons and systems to protect against them.
I agree. And just like the atomic bomb, exactly two of these might ever be used in actual warfare.
Think it through:
1) North Korea kills several power plants with cyberweapons.
2) US kills North Korea with conventional weapons.
Sure, if you're Estonia or Georgia you may have problems. You don't have one of the most powerful military forces in the world at your disposal. But here in the US we have all sorts of muscle that we use against people that we feel are misbehaving.
In fact, I doubt highly that we would prevent such an attack were the enemy foolish enough to launch one.
Stop an excuse to go to war? This nation? I think not.
Re: (Score:3, Funny)
You make it sound like you have a choice in the matter. Yours is the nation that brought the world Norton Antivirus; of course you're not stopping an attack.
Re: (Score:2)
Is this really the time for Bush quotes?
Against whom? (Score:2)
disconnected (Score:2, Interesting)
Morality is a luxury item (Score:2)
"Should" is a moral question. Moral questions are a luxury afforded by rich societies with no pressing needs (in other words, no cause for survival except continued convenience). The real question is "Do we need to?" and my answer is that if you have enemies, you always need to keep track of them.
I may be channeling Niccolo Machiavelli here... stupid cheap acid I bought back in my sophomore year.
Re: (Score:2, Insightful)
Re: (Score:2)
I may be channeling Niccolo Machiavelli here... stupid cheap acid I bought back in my sophomore year.
No, it's a very old concept:
'Keep your friends close, and your enemies closer.' by some old Chinese guy, many centuries ago...yeah, I had one of 'those' Sophomore years too....
And i thought. (Score:2, Funny)
This was about Arlen Specter.
No, and for a simple reason... (Score:2, Insightful)
We will lose that offensive.
We are the ones who come up with copy protections and it takes some kid in Scandanavia a few hours to crack it.
We will quickly be destroyed by the cyber armies of 13 year olds with 22 hours of sunlight and Mountain Dew in their grasp.
Re: (Score:2)
Solution is simple: stop exporting Mountain Dew!
Internet geography =! world geography (Score:4, Interesting)
Even if could be attacks lauched by other countries government internet addresses, but how you separate government willing to do that attack from some individuals there just checking the waters without autorization?
What is worse, what were the biggest internet attacks till today in general? From Morris worm to Conficker, passing thru all the spam in the middle, all were done by individuals and groups not related with government. There was the cyberattack to Estonia (?) some years ago, that was done more by individuals than from a government.
With nuclear bombs at least you have them enclosed in silos, military security, isolated. You need a small army to try to get one if not get disabled before. But a clever kid could take for its own benefit (from turning it to you or launching a big attack at your name) your entire botnet from the safety of his home.
But i have to agree that the 1st cyberattack from America was a big success. Crippled most of the computers of the world, caused lots of damages to other countries and still is active doing its work. But still, you cant say for sure if was launched by the government or Microsoft Corporation.
What a pointless question. (Score:4, Funny)
US was one of the first to go offensive (Score:4, Insightful)
Or did everyone already forget ECHELON [europa.eu]? Or does it only count if you actively break into other systems, rather than only intercept everyone's personal, business and political Internet communications?
And it would really surprise me if they didn't break into other systems yet. It's not like they first asked for public approval for ECHELON before starting to set up and use it.
That's intelligence gathering (Score:3, Interesting)
Which, like it or not, is treated very differently. There is a tacit agreement among nations that spying isn't a cause for war. Many nations try to spy on each other and while the spys themselves have little to no protections, the spying itself doesn't result in major stir ups. Remember that not long ago Aldrich Ames, a CIA counter-intelligence officer, was convicted of spying for the Russians. While he went to prison for it, the US certainly didn't go to war with Russia, or for that matter even get mad and
it's a tremendously bad idea (Score:2)
they are utilizing probably a tenth of their hacking capacity. they are hitting sparse targets for capital gain or espionage.
What would happen if they decided to hit us for real?
*Aimed* is the crucial word. (Score:5, Interesting)
Israel's policy, which America supports, is that firing a missile into a block of flats full of civilians is okay, if they think a terrorist is in the building. The attack is not aimed at the civilians, they just happen to be there. I'm sure the same mindset would apply in this case.
Re: (Score:2)
There's also precident in international law (Score:3, Informative)
For example if you read the Geneva Conventions, you find that various places are "off limits" for war. Hospitals and religious places would be the big ones. The rules say you need to take care not to attack them. However, there's a flip side to the rule: You also need to take care not to use them for military purposes. So if there's a church and it is used by people as a church, no problem, that church is off limits. However if an army decides to set up shop in there are use it as a base, it just became fai
What is stopping them? (Score:2)
In a word (Score:2)
Yes.
It's no different than any other logistic target. If another country strafed an interstate or shot down one of our satellites, we'd consider it an act of war. Just because it involves a computer doesn't mean the principle or effect is any different. Enough of this "cyber" crap, a violation of a law, a treaty or an understanding is just what it is, whether it happened electronically or not.
We're not children! (Score:2)
If a military base is attacked, would it be a proportional, legitimate response to bring down the attacker's power grid if that would also shut down its hospital systems, its air traffic control system, or its banking system?
Give me a break.
If a US military base is attacked by a foreign government, whether physically or online, it is an act of war, and should be treated as such. A military response may be appropriate, and that could include an online attack as one component of the military strategy.
If a US military base is attacked by foreign teenagers in their parents' basements, it is a criminal act carried out by individual citizens, and should be treated as such. The perpetrators should be prosecuted by their own governme
Re: (Score:2)
Sure... but the difficulty is in knowing whether the attacker is the foreign government, or the foreign criminal. Unlike in the physical world, correct attribution of cyber attacks is much more challenging.
I agree with you that this whole "proportionality" idea makes no sense in war. Wars are not a game of tit-for-tat, they're a serious conflict with serious consequences. When the Japanese bombed Pearl Harbor, the US didn't say "oh, well I guess I'll bomb one of their naval bases, and then we'll be even"
Get some REAL IT guys, run a secure OS (Score:2, Flamebait)
If the government would quit running fucking Windows, hire some IT guys who know their ass from a hole in the ground; maybe we wouldn't have so many problems on the cyber front.
Seems like a bad idea (Score:2)
Because going on the offensive worked so well in Iraq, Afghanistan, Somalia, Vietnam, etc...
Richard Clarke's stance (Score:2, Interesting)
Root'em all!!! (Score:2)
Let Linus sort'em out!!!
CyberConfusion (Score:2)
From the article:
I always find it disturbing when these issues are treated like physical security issues. Part of that is because it is often physical security specialists that are brought to task. It is an environment that they often seem to be completely unprepared to deal with.
The issue is that information security and physical s
Why would you assume... (Score:2)
Remember, "cyberwar" means "control war" (Score:2)
All I see here is pretext. The notion I have heard expressed that hackers can do the same damage as nuclear weapons is absurd to the ears of anybody with an ounce of intelligence. Massively exaggerated threats can only mean one thing; a power grab.
They want to have spyware built into every piece of hardware and software out there. They want to turn every single bit of data processing equipment of any kind into part of their foreign and domestic intelligence network. They want to take the vast amounts of dat
farm it out to the ultranationalist partisans (Score:4, Interesting)
that's what russia and china do
there is no need to encourage them, merely track them and get out of the way of any of their initiatives. and when the shit hits the fan and another government complains, the government can play dumb: it really wasn't their doing, there's no financing or chain of command. the only crime is one of omission: watching someone do something wrong and not stopping them. the nationalist partisans steer clear of their own nation's computers out of fealty (perhaps protecting them too), they obediently report to the government any stupendous finds (nuclear plant blueprints, warfare plans, etc.) simply for the renown, and in times of great duress, are predisposed to fall under the umbrella of government control. all at the same time, they are complete free of cost, and of the highest technical proficiency and motivation. their motivation is simply passion
this is already happening, for years. before 9/11 there was the hainan island incident:
http://en.wikipedia.org/wiki/Hainan_Island_incident [wikipedia.org]
this spy plane bump and crash brought american partisans and chinese partisans at full war online. how do i know this? because one of my windows boxen in new york at the time got hacked. its front page was replaced with the chinese flag and the text "fuck poisonbox! hacked by chinese". i traced the attacking ip to a technical college near beijing. who is poisonbox? i researched it: he was an american partisan hacker(s) laying waste to various chinese servers at the time
i found an article about the proceedings still online from that era:
http://attrition.org/security/commentary/cn-us-war.html [attrition.org]
there is no debate here, it's already happening, done by partisan hackers, in loose affiliation with their governments and the government's turning a blind eye to the hijinks
someone out there, perhaps reading this comment, has the makings of a great book or movie, with years of hardcore cyberwarfare already under their belt. they could be in any number of countries where ultranationalism rages (turkey, greece, israel, pakistan, india, etc.)
Re: (Score:2, Funny)
They will take a look at it as soon as they finish playing with their airplanes.