Cyber Warfare Arguments seem to be crying out for a Web Scientist!

For the last few days, I’ve been wondering about what to cover in the first ‘real’ post of this blog. Today, thankfully, saw several related stories hit the BBC Website regarding cyber warfare – a topic which seems to be increasingly popular in the media. To further enhance the suggestion that I should write about this, I have spent the last few days reading and writing about cyber crime, and attempting to determine whether the entire notion of cyber crime is being over-hyped. This is what one security expert claims (Bruce Schneier of BT) is happening with cyber warfare – coincidentally the very same security expert whom I watched in a video as background material to the cyber crime argument.

While this story appears as the top story on the BBC Technology News page (as of 16^th Feb 2011), a story from the 15^th still appears on the page – almost as if it’s there to prove (or maybe disprove) Bruce Schneier’s point. It discusses the targets of the Stuxnet worm that was discovered last year, and thought to have attacked an Iranian power plant. There is still not any concrete proof that the worm itself was responsible for taking the power plant offline, and it is still unknown who created the worm and why. In Schneier’s video, he explains how the Stuxnet worm is thought to have infiltrated the power plant – and the media coverage since its initial discovery has always focused on its high level of complexity. This implies that it is unlikely to have been created as a criminal malware attack (Schneier points out that it didn’t make any attempt to steal money from victims), and is more likely to be a state produced weapon.  This certainly sounds like it should be classed as cyber warfare, but at the same time, when there are so many uncertainties, it cannot simply be assumed. 

Of course, one may be inclined to think that the story covering Stuxnet is exactly what Schneier is talking about – over-exaggerating one of a handful of reported cases that could fall in to the cyber warfare arena.  Additionally, it must be recognised that the Stuxnet piece relates to a report by Symantec, a security company, who will likely offer services to protect against such cyber threats. I can’t help but feel, however, that despite the small number of cases to date, some form of Web-based “warfare” (although I’m not sure if warfare is the correct word) is on the brink of occurring – if indeed it hasn’t already. There may even be events happening that are not reported, or not even known about so I personally don’t think it can be ruled out and ignored completely.

In addition to these two stories, a third news item is currently on the BBC’s Politics page, which reports on a former security adviser (Sir Richard Mottram) stating that cyber attacks should be considered as acts of war – as long as you can determine who was responsible. This is all very well, but we still need a proper, standard definition of what compromises a “cyber attack”. Then there is the problem of actually confirming from who and where the attack originated. How can such attacks be distinguished from disgruntled individuals who decide to target a certain organisation?

After reading these articles, I came across a blog post by the BBC’s Rory Cellan-Jones from earlier this month. He covers the same argument, about whether the small number of reported cases is leading to overhype of cyber warfare. He seems to take the same view as Schneier, and poses the question:

“And who is advising ministers on cyber security?”

He claims large international IT companies are likely to be doing so, and suggests that small start-ups rather than large IT suppliers should instead be offering the advice. When I read this however, I did not think “what kind of company should be offering the advice?”, but “what kind of person should be offering the advice?” This is a clear example of why Web Science is needed! A Web Scientist, fully appreciative of the numerous disciplines involved in such a case (politics, computer science, criminology for starters), and working with a security firm or researchers, seems like the ideal candidate for offering such advice.

As a Web Scientist in development, I am torn between the arguments offered. I personally believe that computer and network security is of the utmost importance to ensure a beneficial Web. At the same time, Schneier’s argument that there are no agreed definitions of the many terms used (cyber warfare, cyber attack etc.) makes me think that we can not explicitly say how bad the threat really is. I think a thorough Web Science study where all the disciplines concerned are taken into account needs to be carried out, not only to assess the potential implications of any such “cyber war”, but also to offer suggestions for finalising the definitions of these terms. Only then can the seriousness of any current events be put into context, and understood completely.