The Security Blog

Over the past month, quite a lot of people weighed in on the issue of what is, and what is not, a Cyberwar.   Here are some of what was said:

Winn Schwartau (yes, it is a real name), the person generally credited in creating the concept back in 1994, defined Information War as:

an electronic conflict in which information is a strategic asset worthy of conquest or destruction.

(Catchy, but I think too limited for today’s possibilities)

Another one of my respected colleagues, Bruce Schneier, called it

Warfare in cyberspace.

(I do not agree  about the "in cyberspace" part.  I think the definition needs to be much wider.)

The US Army weighs in with this…mouthful of a definition

The premeditated use of disruptive activities, or the threat thereof, against computers and/or networks, with the intention to cause harm or to further social, ideological, religious, political or similar objectives or to intimidate any person in furtherance of such objectives.

Wow, now in 25 words or less?

PC Magazine goes the extra mile by defining it as:

equal to information warfare : Also called "cyberterrorism" and "cyberwarfare," it refers to creating havoc by disrupting the computers that manage stock exchanges, power grids, air traffic control and telecommunications. While the term often deals with attacks against a nation, it may also refer to attacks on organizations and the general public. For example, devastating viruses may be considered information warfare.

(I disagree: one could have an information warfare by dropping leaflets, for example.  Nothing Cyber about that.)

The online dictionaries at Webster and at Reference.com:

an assault on electronic communication networks

(I don’t agree:  can an assault on a non-networked device, can be from an electronic device)

and Wikipedia calls it

the use of computers and the Internet in conducting warfare in cyberspace.

(Nope.  Same narrow definition)

So, I decided to try defining it too:

Cyberwar is the act of ongoing electronic attacks and reprisals carried out by nation-states against others.

Note that I define the players.  I believe that if it is not nation-states, it is not "war".  If it is, for example, terrorist, you could adjust it to call it a cyber guerrilla war, I guess, or Cyberterrorism, but not Cyberwar.

What do you think?

Permalink

Two further, conflicting, usages of electronic data are emerging in the Iranian situation.  In the first, a website is using digital picture evidence to show how Lebanese, arabic-speaking, and non-Iranian-military forces are being use to repress the freedom seeking protesters in Iran.

The site lebasshakhsi.blogspot.com/ is providing pictorial evidence (some examples above) of "security forces" who are Lebas-Shakhsi (without uniform) beating peaceful demonstrators.  It follows those pictures with documentary evidence to the foreign nature of those forces.    Being foriegn here, in addition to the terms emphasised above means a few different things.  For example:

• That the regime was prepared ahead of time for "troubles" with these elections and even expecting trouble;
  
• That the regime believed it could not reliably call on its own, Persian, forces to fire on their fellow citizens;
  
• That the Lebanese-based Hizballah forces were willing to potentially sacrifice their own fighters to do favors for the Iranian regime; and
  
• That Hizballah has no particular like to the average Persian in the street, and willing to beat them and kill them.
  

[-----------------------------------------------------]

On the opposite side, the Iranian Regime has sites, such as xxxxx (name withheld per request) that use a technique called "crowdsourcing" to show faces of individual protesters and to ask the public to "come and tell us who they are".  Of course, using language such as

Unfortunately,… hypocrites, monarchists and counter-revolutionary and terrorist groups in cyberspace and the media are nothing but [trying to] disrupt the country social security and not for any other purpose to achieve this aim to …"

to try and encourage voluntary snitching on protesters.  That, if followed by a "call to their national responsibility"

Therefore, all users hereby and Iranian families are expected if [they know of] the personal data of any of the following photos and any news and information including photos, films, articles, news, email, web address, or complaints about the flow of disturbance of trade and [of the ] demand of each group in cyberspace actions [which] are destructive to stimulate activity through the site [...should email the information to the authorities]

Conflicting use of digital information.

Permalink