Missing in Action: Cyber Dictionary?

092215-640x400

As published on Norse on September 22nd, 2015.

I recently stumbled over an old issue that has shown no signs of being resolved: the lack of a normalized lexicon on Cyber Security. We can’t seem to start agreeing on terminology, even though the cyber security industry is rapidly professionalizing globally and the need for a universally understood set of concepts is beginning to show. The best example of this problem is that there are at this moment roughly 28 definitions for the concept we know as “cyberspace”, with the most recent draft definition apparently being:

Cyberspace defined

Cyberspace is a global and dynamic domain (subject to constant change) characterized by the combined use of electrons and electromagnetic spectrum, whose purpose is to create, store, modify, exchange, share and extract, use, eliminate information and disrupt physical resources. Cyberspace includes: a) physical infrastructures and telecommunications devices that allow for the connection of technological and communication system networks, understood in the broadest sense (SCADA devices, smartphones/tablets, computers, servers, etc.); b) computer systems (see point a) and the related (sometimes embedded) software that guarantee the domain’s basic operational functioning and connectivity; c) networks between computer systems; d) networks of networks that connect computer systems (the distinction between networks and networks of networks is mainly organizational);e) the access nodes of users and intermediaries routing nodes; f) constituent data (or resident data).Often, in common parlance, and sometimes in commercial language, networks of networks are called Internet (with a lowercase i), while networks between computers are called intranet. Internet (with a capital I, in journalistic language sometimes called the Net) can be considered a part of the system a). A distinctive and constitutive feature of cyberspace is that no central entity exercises control over all the networks that make up this new domain. – Mayer, Martino, Mazurier & Tzvetkova (2014)

This is a considerable problem for the eventual advancement of the practice, because ‘cyberspace’ isthe root term from which the entire “cyber-everything!” craze stems, and we can’t even seem to agree on what that is, exactly. How can we properly define derivative terms from a core concept that we don’t universally agree on? What is Cyber Security if nobody agrees on what Cyber is?

Cyber-anything

The result is that cyber-anything is, essentially, a rough approximation of what we mean to say. Developments in the industry haven’t yet reached the point where this is a problem for real scientific advance because there is still so much to discover. But in the long run, if the profession is to mature and be advanced beyond the point of the initial growth spurt we are currently experiencing, people will have to perform research. Thanks to that same ill-defined cyberspace, desktop research is often largely based on searching for keywords in existing research (thank you Google Scholar!). And herein lies the rub.

As said, it’s not just cyberspace that we can’t conceptually agree on. We also can’t seem to agree on the use of other terms. For instance, the terms ‘cyber security’, ‘information security’ and ‘cyber defense’ are used liberally, and are generally used to define the same set of concepts, but not always. The term ‘defense’ (singular), ‘security measure’ and ‘security control’ are all used to describe roughly the same concept as well.

Cybersecurity strategy

Give yourself the challenge to figure out what cyber security strategy means. Some quick research will show that some authors used this term in describing “security one-liners”, such as the security principle‘Reduce Attack Surface’, whereas others use the term to describe entire frameworks. There were also authors who did not use the term “strategy” where it might have made good sense to do so.

To answer any research questions on the subject of cyber security strategies, it is necessary to first be clear on which interpretation is used. We need to know where we are now to determine where we want to go. As an industry, we have an obligation to the rest of the world to be clear in what we mean by the words that we use. Many people complain about the use of the term ‘cyber warfare’. The most common heard complaint was that talk about war incites war, and that the resultant ‘militarization’ of the internet is an undesirable state. Whether the lack of a universal lexicon is to be blamed for this, is almost certainly overstating it, but it doesn’t help either. The press loves ‘sexy’ language, and military lingo sounds very impressive. It sells. It makes for bad reporting, but when considering that we, as an industry haven’t provided them with anything better to use, maybe they are not the only ones to blame here.

The future

If the Internet has proven anything, it is that there can be cooperation on a global scale. Perhaps one of the custodian organizations of the Internet, such as the IETF, can be used as a vehicle for the development of a universal set of concepts, who knows? But it certainly is high time we get started, before the future catches up with us.

 

Debating Cyber Warfare – More Questions from .GOV (Part II)

In continuation of the series I promised you on high-level debates surrounding Cyber Warfare, here is the next article in a series of three. This article will be the longest in the series due to the multi-parted nature of the question. Of course the answers given to each of the questions are merely my opinions on the matter. Please feel free to comment or contact me with relevant remarks.

Question                
In how far, and in what way, are existing international Legal frameworks relevant to behavior in the Cyber domain; specifically in relation to cyber violence? 

  • [Ad Bellum] Under what circumstances can a cyber threat be considered use of force or threatening use of force, in the sense of article 2, section 4 of the UN Charter? Under what circumstances can a cyber attack be considered an armed attack  that justifies violence in self-defence based on article 51 of the UN Charter?
  • [In Bello] When does humanitarian law of war apply to behaviors in the Digital domain? Must these be linked to kinetic use of force? How would this, during such application, be given shape to the Law of War’s  principles of distinction and proportionality, and the requirement of taking precautions for safety?
  • How would Civil legal concepts such as Sovereignty and Neutrality be given shape in the Cyber Domain?

Relevant UN Charter articles:

  • Article 2, Section IV:
    All Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations.
  • Article 51:
    Nothing in the present Charter shall impair the inherent right of individual or collective self-defence if an armed attack occurs against a Member of the United Nations, until the Security Council has taken measures necessary to maintain international peace and security. Measures taken by Members in the exercise of this right of self-defence shall be immediately reported to the Security Council and shall not in any way affect the authority and responsibility of the Security Council under the present Charter to take at any time such action as it deems necessary in order to maintain or restore international peace and security.

An Answer – the Right to Self Defence
Although Cyber gives a new dimension to Warfare, it is my opinion that the general application and behavior apply in the same fashion as they do under conventional warfare. It is important that one should look to the effects of cyber attacks rather than the method or the individual components therein. In the end it is the damage dealt that bears relevance to those it is inflicted upon rather than the method. For this reason the thresholds that have bearing on the various articles in the UN Charter  we have set for conventional warfare do not necessarily change because of innovation in technology, nor do  international agreements automatically become void. Under the current UN Charter, each member state has the right to actively defend itself when attacked (or threatened with attack) and I feel this right remains relevant when discussing cyber warfare. I would like to point out though, that what is typical for Cyber Warfare, but uncommon in kinetic operations, is the problem of Attribution. Not knowing who will attack, is attacking or has attacked you complicates the situation considerably. It makes all action and reaction susceptible to a fair margin of error and so any response should be carefully considered before execution.

Humanitarian principles
As far as humanitarian principles in warfare go, it is certainly conceivable that cyber attacks may directly or indirectly lead to injury or loss of life. For instance, when a cyber attack on a power plant successfully blacks out an area, this can cause all kinds of damage. Some of the more obvious risk area’s are those that affect Hospitals and Emergency Services such as Police and Ambulance services, but this is not a new aspect of warfare. Knocking out power and communications is always something that must be done with utmost care, and this advance in technology doesn’t change that. In this case a well-placed cyber attack may very well be preferred over a kinetic attack that does permanent damage. Principles of distinction between military and civilian targets, as well as proportionality should still apply when discussing the use of cyber attacks.

Civil-Legal principles
The debate surrounding legal concepts such as Sovereignty and Neutrality are the subject of much debate amongst technical, political and legal experts from many nations, and any answers to these questions are most likely susceptible to change as insight is gained over time. Many people take the approach that Cyberspace does not have physical borders, but this is not exactly true. While Cyberspace as a concept may be regarded as unbound by geography, it is held up by very real, physical networking equipment. Data flowing from one system to the next does actually cross physical space through cables, routers and maybe even airspace via satellites or Wi-Fi connections. As such, this data may be subjected to all kinds of rules and regulations imposed by the owners of the networking equipment in between points of departure and arrival. And what to say about being used as a proxy during a cyber attack? Without international understanding of the ‘rules of the game’, you may be involuntarily drawn into conflicts because one of the parties routes his cyber attacks through your networks, or even using systems that are hosted on your soil. Regardless of what position you take, it’s clear that concepts such as Sovereignty and Neutrality have a place in the debates surrounding Cyber Warfare.