When Nation-States Create Computer Viruses: “Diplomacy by Other Means” or Pandora’s Box? (Part 6 of 8)
This 8-part blog series examines the legality, justifications, and consequences of nation-state involvement in the creation of computer malware such as Stuxnet and Flame.
Der Spiegel: You and your company are the winners of a new era in warfare.
Evgeny Kaspersky: No, because this war can’t be won; it only has perpetrators and victims. Out there, all we can do is prevent everything from spinning out of control. Only two things could solve this for good, and both of them are undesirable: to ban computers — or people.
Human Life on the Run
To open, I ask you to remember the inhabitants of Emeniar-7 from the Star Trek episode mentioned in post #3. The episode presents a rather extreme example of a world where the ongoing belligerent activities of two civilizations’ computers have a radically disproportionate impact on the lives of their citizens. There, the warring computers were set on autopilot and left to duel it out. The only thing left for the people to do was to walk into the incineration machines when they were notified they had died in the virtual attack.
One hopes that the principles of cyber-attack and cyber-defense never take on this automated character, but the fictional scenario serves as a useful outer boundary of the notion of “human life on the run” from its computer technology–of humankind as less the master than the slave of its creations. A less hyperbolic and far more likely scenario for humankind is that over time the escalatory effect which I described in Post #4 makes the Internet into a sort of proxy battleground. Lower-level attacks and counterattacks by various nations and interest groups—all sanctified by a loose reading of what is permissible under international law and fueled by ever-increasing rationalizations about what is acceptable–make the online world into a “Wild West” or Dodge City.
In the “cyber-wild-west”, normal citizens are inconvenienced every day by malware and other forms of online attack. They are denied access to their bank accounts or other needed websites, forced to spend hours clearing malware from their computers, and so on. Over time, the severity of the attacks grows more serious as citizens are harassed with power outages or faced with higher prices when attackers disrupt oil and food distribution systems. Perhaps citizens are injured when attackers surreptitiously tamper with hospital information systems. The mind can conceive of many such scenarios which fall far short of extreme risks like “causing a nuclear plant meltdown,” but which are painful, disruptive, and dangerous to the lives of civilians—many of whom probably don’t agree with the foreign policy of their governments.
As importantly, war conducted in cyberspace becomes an abstraction and objectifies the victims. Like air strikes, missiles, or drone strikes, cyber-attacks lose the personal dimension and turn the victims into mere abstractions to be harassed, injured, or killed. The very idea of conflict loses its immediateness, as now conflict is carried on virtually, albeit with real consequences to faceless victims. A consequence of this viewpoint is that abstraction allows “war” to be conducted without naming it such. Nations can then engage in belligerent acts in cyberspace as an ongoing thrust-and-parry without any sort of national policy debate.
All of these concepts are lurking beneath the surface of the Star Trek episode. Part of the plot has Kirk staging a coup d’etat on one planet to force its leaders to disobey their obligation to require citizens to walk into the incinerators. This, according to treaty, would enable real weapons to be used by the other side. Kirk insists that only the prospect of actual death, destruction, and misery will serve as the impetus for the warring planet to negotiate (after 500 years) and end the war. It is this more subtle aspect of the Star Trek episode that is salient to the problem of abstraction and objectification. Kirk’s position, then, is that abstraction and objectification helps conflicts persist that might otherwise be negotiated away. In short, abstraction creates a sort of moral buffer zone that lets us justify actions that we might think twice about if the victims were in front of us.
Yes, in Earth’s likely scenario people won’t walk into incinerators, but what we should be asking ourselves is whether we as humans truly want to live life “on the run” from our technology, in fear of the next way it might be turned against us?
The Militarization of Cyberspace
However, modifications to the human experience of cyberspace occur in other ways that are less direct than the daily experience of hacks, denials-of-service, and disruptions to supply chains. Over time, as nations increasingly use cyberspace as a place to spar, a certain view of cyberspace begins to take shape. That viewpoint places military uses and military objectives at the forefront.
As Bruce Schneier has said, “military problems beg for military solutions.” In the past weeks we’ve seen abundant evidence of how a mindset of militarization nibbles away at the Internet’s fundamental character. One major example which bears further discussion is the Cybersecurity Act of 2012, which purported to enlist businesses in “rapid information sharing” programs with government, as well as government certification of its systems. It also contains language which gives implied authority to the President to “declare a cybersecurity emergency” and “direct the national response,” including, presumably, disconnecting critical networks (a term which is undefined) from the Internet. This is a re-hash of an idea which has been floating around since 2010 called the “Internet Kill Switch.” It would give Executive Branch control over the Internet so that it could be shut down centrally, if necessary.
Military control over the Internet should seem to all but the most trusting citizens like an extreme and frightening power. It gives the government broad authority to turn off the means of communication and dissent in response to its own assessment of a national emergency. The citizenry has seen, on occasion, how a centralized national power such as this begs to be used. A telling recent example occurred last August, when San Francisco’s BART shut down cell phone service in several stations to disrupt civilians from protesting the recent shooting of a homeless man. The action took place the very same day that British Prime Minister Cameron announced he would consider shutting down wireless access in parts of London to disrupt rioting youths. And, perhaps not coincidentally, the “Internet kill switch” idea resurfaced in our Congress early in 2011 on the very same day Egyptians experienced a blackout of the Internet ordered by Mubarak to try to quell the demonstrations which eventually led to his overthrow.
Such is the flavor of a militarized cyberspace. Gradually, the Internet is subtly molded to conform to its own avatar as a place of battle. Cyberspace begins to look less like an utopic international library or Athenian public commons than like Beirut or Jerusalem—where the virtual equivalent of stacked sandbags, barbed wire, and the distant sound of gunfire are omnipresent in the daily civilian experience.
It would indeed be regrettable if the long march of technological advance over human history culminated in a reality that, in the end, resembled the same war zones of the past. It is as important to outlaw the militarization of cyberspace as it was to ban the militarization of space itself in the Outer Space Treaty of 1967. Hopefully, some alternative to permanent cyber-conflict can be devised. Next time, we will examine the efforts of scholars and international bodies to create ways of restraining conflict in cyberspace.