The Coming Cyber-Cold War: US Pioneering Online Attacks

The US government is openly and actively engaged in a reincarnation of the Cold War. Physical assets such as spies and informants have been replaced with zero-day software exploits and network security analysts. Old-school intelligence gathering, while effective to some degree, pales in comparison with the scope of big-data firms such as Endgame and Palantir. Instead of war-ravaged proximity states in Eastern Europe or the Middle East, we have shadowy “actors in cyberspace” and network backdoors on the Internet. The development and expansion of cyber-security, and hence cyber-warfare – equivalent to an arms race – has been in the works for decades and is now a prime objective for the executive branch and the Department of Defense. As the US prepares to deploy weaponized malware and viruses against its enemies, it is forcing those enemies to respond in kind. We are witnessing the first stage of an America-led arms race that undoubtedly will result in a cyber cold war.

Think the world needs an alternative to corporate media? Click here to make a tax-deductible donation to Truthout and keep independent journalism strong.

Before Edward Snowden released details about foreign and domestic spying program PRISM, low-level and continuous cyber espionage was well underway. As far back as 2002, a three-year attack accessed and downloaded 10 to 20 terabytes of sensitive information from the Department of Defense in an operation titled “Titan Rain.” The culprit – whether an individual or a state – was never identified. In 2009, there were cyber attacks on the US water and sewage systems, as well as the national electrical grid. China and Russia are alleged to have accessed secure systems and mapped out the entire infrastructure of the country. More recently, the Obama administration was forced to admit that it had deployed Stuxnet against Iranian nuclear centrifuges and that the NSA attacked Tsinghua University, a research facility in China.

“Cyber warfare attacks” are the new terrorism, with risk to economic and national security elevated to Orwellian heights found post-9/11. At least that’s what US military commanders want the public to believe.

A top-secret document released by The Guardian titled “Presidential Policy Directive/PPD-20” confirms that all cyber operations, including attacks on other governments, are subject to executive approval. Those attacks or operations must be of vital interest to the US and fall within the sphere of national security, public safety, national economic security, safe and reliable function of critical infrastructure, or availability of “key resources.” Unsurprisingly, executive authorization goes out the window if “appropriate authorities” determine that there is an imminent threat or ongoing attack against US national interests. But the argument that enemies of the state are plotting a financial crash, or anything even remotely resembling such, is purposeful war-mongering according to some tech executives.

Joseph Steinberg, chief executive officer of Green Armor Solutions a private security corporation that secures access to online systems, says, “China’s government, like Russia’s, has no incentive to cripple the U.S. economy. It’s more of a way to get into our computer networks, spy on them and plagiarize whatever it is they are looking for.”

In 2005, the DoD put in place policies that outlined the rules of engagement for operating in and defending cyberspace. But with the exponential technological advancement of all things Internet, those policies are now far outdated. In a report to the Senate Armed Services Committee, Gen. Keith Alexander, who leads US Cyber Command (FY 2013 $182 million operating budget for 937 personnel), makes clear that the policy update is needed “to maximize pre-authorization of defense responses and empower activity at the lowest level.” This lowest-level activity would consist of commanders in the field, not spy agency directors, Congress or even the president.

It’s clear that cyber warfare has established itself as an “instrument of power” in societies and that governments are spending billions in researching how best to use it, whether against friend or foe. Case in point: The US is alleged to have spied on its EU allies.

Don’t Let NSA’s 4th Amendment Violation Center Open in Utah

But a directive is just that. It has little influence on the cyber industrial complex or the push for more and more government-funded contracts awarded to private corporations. As US conventional wars come to an end, the bottom lines of federal agencies and defense contractors are chained to sustaining a perpetual state of combat operations. So they’re placing their bets on governments’ want for cyber security and lobbying for passage of legislation that enhances US authority to deploy weaponized software against enemies.

There’s no doubt about it: This is a cyber cold war. President Obama confirmed the US’ inherent right to defense in his International Strategy for Cyberspace address by saying “When warranted, the United States will respond to hostile acts in cyberspace as we would to any other threat to our country.” General Alexander goes farther in his congressional testimony, “We reserve the right to use all necessary means diplomatic, informational, military and economic as appropriate and consistent with applicable international law.” The good news for the Obama administration is that there is little to no international law restricting cyber warfare and, hence, no laws it can be accused of violating.

The question of how to regulate such a thing, if it’s even possible, would require a level of international cooperation never before seen. And that’s the problem. Outside of prosecuting domestic violations of the Constitution, we are in uncharted territory. At least with the Cold War of past, there were established rules of engagement. Everyone understood what brinksmanship may entail and had a contingency plan for every contingency plan. With the elimination of borders, there has been an elimination of international law.

According to Mike Jacobs, former National Security Agency director, “If you are engaged in reconnaissance on an adversary’s systems, you are laying the electronic battlefield and preparing to use it.” Unreleased zero-day exploits in software allow governments to access networks and other systems of surveillance targets without the targets’ knowledge. US Cyber Command has the ability to trace the physical and online address of every device connected to the Internet – and attack if need be. Any target who moves locally or internationally is now unable to escape government or corporate surveillance. If the US considers this type of activity to be warfare, it’s fair to say that every other nation does too.

The unregulated nature of the cyber arms trade not only leaves open the possibility of technology falling into an opposition organization’s possession, but guarantees it. Once again, the US is leading weapons proliferation. Political inconvenience of a militarized conventional war also may play a part in the burgeoning cyber war. It is much more difficult for military commanders to justify the death of a sister or brother in combat operations widely understood to be about maintaining access to energy resources than a “victimless” attack on a foreign government to protect internal bank documents or dam vulnerabilities.

The government does acknowledge that the directive may raise unique national security and foreign policy concerns, and it states, “DCEO (Defensive Cyber Effects Operations) and OCEO (Offensive Cyber Effects Operations), even for subtle or clandestine operations, may generate cyber effects in locations other than the intended target, with potential unintended or collateral consequences that may affect U.S. national interests in many locations.” One issue with waging war in an unknown environment, often against unknown enemies, is that an actor is unable to predict with any accuracy how weaponized software may interact with different systems. Even the most professional attacks have been known to spiral out of control, which leaves open the risk that an attack on an enemy ultimately will affect those it was designed to “protect.”

Governments have not moved to apply international laws of war to cyberspace, although they call it warfare nonetheless. The Pentagon says the same rules of engagement apply, which is patently false because the US is under constant attack and also is attacking every day. Where is the open declaration of war? There is none. Instead the Internet is a militarized proxy, a theater for a new cold war. And anyone who wants to participate can. It took only 20 years for the parent of the Internet, the US military, to exercise overwhelming influence on its once-free and forlorn child. The Internet is now, or maybe has always been, an agent of the state.