Table Of ContentCYBER WAR WILL NOT TAKE PLACE
This page intentionally left blank
THOMAS RID
Cyber War Will Not
Take Place
A
A
Oxford University Press, Inc., publishes works that further
Oxford University’s objective of excellence
in research, scholarship, and education.
Oxford New York
Auckland Cape Town Dar es Salaam Hong Kong Karachi
Kuala Lumpur Madrid Melbourne Mexico City Nairobi
New Delhi Shanghai Taipei Toronto
With offices in
Argentina Austria Brazil Chile Czech Republic France Greece
Guatemala Hungary Italy Japan Poland Portugal Singapore
South Korea Switzerland Thailand Turkey Ukraine Vietnam
Copyright © 2013 by Oxford University Press
Oxford is a registered trade mark of Oxford University Press in the UK
and certain other countries.
Published by Oxford University Press, Inc
198 Madison Avenue, New York, New York 10016
Published in the United Kingdom in 2013 by C. Hurst & Co. (Publishers) Ltd.
www.oup.com
Oxford is a registered trademark of Oxford University Press
All rights reserved. No part of this publication may be reproduced,
stored in a retrieval system, or transmitted, in any form or by any means,
electronic, mechanical, photocopying, recording, or otherwise,
without the prior permission of Oxford University Press.
Library of Congress Cataloging-in-Publication Data
Rid, Thomas, 1975–
Cyber war will not take place / Thomas Rid.—1st edition.
p. cm.
Includes bibliographical references and index.
ISBN 978-0-19-933063-8 (alk. paper)
1. Information warfare. 2. Information warfare—History. 3. Information warfare—
Political aspects. 4. Cyberspace—Security measures. I. Title.
U163.R53 2013
355.4—dc23
2013014740
Printed in India
on Acid-Free Paper
CONTENTS
Preface vii
Acknowledgments xi
The Argument xiii
1. What is Cyber War? 1
2. Violence 11
3. Cyber Weapons 35
4. Sabotage 55
5. Espionage 81
6. Subversion 113
7. Attribution 139
8. Beyond Cyber War 163
Notes 175
Bibliography 199
Index 207
v
This page intentionally left blank
PREFACE
The threat of cyber war has captured the popular imagination. Hol-
lywood was quick to realize and express these fears for us. Films like
Wargames (1983) or, more recently, Die Hard 4.0 (2007) trod the
obvious narrative path: dark forces mobilizing arcane and complex com-
puter networks to wreak havoc, holding entire nations hostage and
unleashing nuclear war by hacking into the Pentagon’s vast and powerful
computer systems. Such fears have always touched a deep nerve. Most
of us use computers but don’t really understand how hardware and
software interact. A powerful embodiment of the pervasive human angst
of losing control to technology itself was HAL, Stanley Kubrick’s ter-
rifying, all-controlling machine aboard a spaceship in 2001: A Space
Odyssey (1968). As more and more of us as well as more and more things
go online, such fears cut deeper than ever.
Most people, young and old, carry a smart phone in their pocket at
all times. And a great many have become addicted to connectivity, inces-
santly, sometimes furtively, checking their email and social media
feeds—at the dinner table, on the beach, under the table at business
meetings, and not just dull ones. An entire generation has grown up
who believe that their personal and professional well-being depend on
digital devices and constant connectivity. If you are fiddling with your
touch screen before your morning coffee is ready, the chances are that
you intuitively understand that almost everything that enables the rest
of your day is controlled by computers: the water that flows from the
tap, the electricity plant that powers your kettle, the traffic lights that
help you cross the street, the train that takes you to work, the cash
vii
PREFACE
machine that gives you money, the lift that you use in the office, the
plane that gets you to Berlin or Delhi or New York, the navigation sys-
tem you will use to find your way around a less familiar city, and much
more besides. All these features of life are now commonplace, and unre-
markable—as long as they work. Just as commonplace and insidious is
the all-pervasive fear that malicious actors lie in wait, at all hours, to
assault and crash these computers and the software they run, thereby
bringing entire societies to their knees. Water will stop flowing, the
lights go out, trains derail, banks lose our financial records, the roads
descend into chaos, elevators fail, and planes fall from the sky. Nobody,
this adage has it, is safe from the coming cyber war. Our digital demise
is only a question of time.
These fears are diverting. They distract from the real significance of
cyber security: in several ways, cyber attacks are not creating more vec-
tors of violent interaction; rather they are making previously violent
interactions less violent. Only in the twenty-first century has it become
possible for armed forces to cripple radar stations and missile launchers
without having to bomb an adversary’s air defense system and kill its
personnel and possibly civilians in the process. Now this can be achieved
through cyber attack. Only in the twenty-first century did it become
possible for intelligence agencies to exfiltrate and download vast quan-
tities of secret data through computer breaches, without sending spies
into dangerous places to bribe, coerce, and possibly harm informants
and sources first. Only in the twenty-first century can rebels and insur-
gents mobilize dedicated supporters online and get thousands of them
to take to the streets, without spreading violence and fear to undermine
the government’s grip on power.
The ubiquitous rise of networked computers is changing the business
of soldiers, spies, and subversives. Cyberspace is creating new—and
often non-violent—opportunities for action. But these new opportuni-
ties come with their own sets of limitations and challenges, applicable
equally to those trying to defend against new attack vectors as much as
those seeking to exploit new technology for offensive purposes. This
book explores the opportunities and challenges that cyberspace is crea-
ting for those who use violence for political purposes, whether they
represent a government or not.
The rise of sophisticated computer incursions poses significant risks
and threats, and understanding these risks and threats and developing
viii
PREFACE
adequate responses to mitigate them is of critical importance—so a
short word on the evolving cyber security debate is appropriate here: the
debate on cyber security is flawed, and in many quarters its quality is
abysmally low. The larger debate takes place in technology journals,
magazines, on specialised web forums, and of course in the mainstream
media as well as in academia and on blogs and microblogs. It takes place
at countless workshops and conferences that bring together representa-
tives from the private sector, governments, intelligence agencies and the
military, as well as hackers and scholars from a variety of academic dis-
ciplines. It happens publicly as well as behind closed doors and in clas-
sified environments. No doubt: a number of deeply versed experts from
various backgrounds regularly produce high-quality research output on
cyber security, and this book could not have been written without using
their good work. But the wider one moves in political or military circles,
in think tanks, parliaments, ministries, and military academies, the
lower seems the density of genuine experts and the higher pitched the
hyperbole. The policy debate’s lagging quality is neatly illustrated by the
emergence of an odd bit of jargon, the increasing use of the word
“cyber” as a noun among policy wonks and many a uniformed officer.
As in, “I’m interested in cyber,” or, “What’s the definition of cyber?,” as
one civil servant once asked me in sincerity after I recommended in a
presentation in the Houses of Parliament not to use that empty yet
trendy buzzword as a noun. Note that computer scientists, program-
mers, or software security experts do not tend to use “cyber” as a noun,
neither do technology journalists nor serious scholars. I’ve come to be
highly distrustful of ‘‘nouners,’’ as all too often they don’t seem to appre-
ciate the necessary technical details—the phenomenon can be observed
widely in Washington, but also in London, Paris, Berlin, and elsewhere.
Improving the quality of the debate is all the more crucial. The public
deserves a far better informed, more nuanced, and more realistic debate
than that which has taken place hitherto. The public also deserves better
thought-out and executed policies and legislation on cyber security.
Cyber War Will Not Take Place was written with the ambition of offe-
ring the reader a solid yet accessible contribution to this debate, an
attempt to help consolidate the discussion, attenuate some of the hype,
and adequately confront some of the most urgent security challenges.
The book is designed to be a resource for students, analysts, and journa-
lists. The expert debate on cyber security, as well as taught courses on
ix
