How do we counter cyber attack? That's the �500m question

Online threats were once a personal problem, but the evidence suggests they could now be as daunting as a nuclear strikeThe news that, according to the national security review at least, cyber attack comes second only to terrorism as the gravest security threat facing the nation will have come as a great surprise to most citizens. We are conscious of the annoyances of malware, viruses, worms, spam and phishing, but for most these are just minor irritations, not threats to the nation's survival.Yet the other day we had the foreign secretary gravely intoning why, in the midst of the most savage spending cuts in living memory, it is suddenly necessary to give an extra �500m to GCHQ to protect us against nemesis in cyberspace. At the same time, in America, we see the Pentagon setting up a whole new cyber command, USCybercom, with all the usual paraphernalia and awash with funding.What, you might ask, is going on?There seem to be two broad answers to the question. The cynical one is that this is just the latest development of the military-industrial complex that is the bane of industrialised economies. Changes in society and warfare patterns threaten the future prosperity of this colossal set of vested interests.Aircraft carriers, missile systems and tanks are of little use against ragged-trousered terrorists and so a new and sinister threat has to be manufactured to ensure reliable cash-flow for BAE Systems & co into the next century. In which case, cyber security will do nicely.And, say the cynics, the strategy is succeeding. According to the New Yorker journalist Seymour Hersh, the military-industrial complex in the US has morphed into "a military-cyber complex". Hersh says that the US government spends between $6bn and $7bn annually for unclassified cyber-security work and about the same on the classified part.The alternative explanation is that the threat really is more serious than many of us had supposed. The arrival of the Stuxnet worm was a salutary event because of its sophistication and the fact that it targeted a device that plays a critical role in innumerable industrial processes. Could it be that the threat truly has ratcheted up? Is there a real threat of "cyber warfare"? If so, what could be done about it?At a seminar in Cambridge last week, Dr Herbert Lin of the National Academies of the USA gave a sobering overview of the challenges posed by conflict in cyberspace. The central problem is that, in the online domain, the attacker has most of the advantages. Passive defences (better firewalls, anti-virus precautions etc) can have some effect, but they're never going to deter or prevent determined or sophisticated attacks.So what does a nation do?One answer is to seek lessons from the policy of nuclear deterrence. Many policy-makers see cyber deterrence as the only feasible policy in an offence-dominated domain. After all, we have lots of experience with nuclear deterrence and we know it worked. So maybe that's the way to go?Alas, no. As Dr Lin put it, while nuclear and cyber deterrence raise the same questions, the answers are different and much less satisfactory in the online case. Deterrence is a tool for dissuading an adversary from taking hostile action, but it depends on being able to identify the potential attacker. Nuclear deterrence worked for various reasons: only nation-states were potential adversaries; attacks would have been easy to detect and would have come from outside one's territorial boundaries. It was possible to demonstrate that one possessed the capability for devastating retaliation and it would have been easy to determine when hostilities had ceased.None of this applies in cyberspace. The resources to mount attacks are not the sole prerogative of nation-states. It may be difficult to distinguish an attack from incessant malware and cybercrime. Identifying the source of an attack can be problematic and an astute attacker might leave a false trail leading to a country that would regard massive retaliation as an act of war. There's no obvious way of demonstrating a capability for retaliation. There's no precedent for countries targeting nuclear strikes on companies. And there's no obvious way of establishing that hostilities have definitively ceased.The inescapable conclusion is that deterrence won't work in cyberspace. We need a better idea. The �500m we've just donated to GCHQ suggests that it won't come cheap.InternetJohn Naughtonguardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

internet internet world internet connections