The United States is completely unprepared to fight a cyberwar
slate.com
slate.com
Despite their "cyber-war" offensive units, I venture that the Chinese are just as vulnerable, if not more so.
At least the military culture in the US allows admission of shortcoming and failure.
Try talking about the weakness of Russia or China against "cyber" attacks in those countries and see how long it is that you get to remain alive and out of jail.
And while I think the US may be initially surprised by the enemy capability were a "cyber" blitzkrieg to eventuate, I think the experience the US has with conducting war and the adaptability of US forces would far outweigh the advantages of initial surprise.
US wars since WWII are no indication of US behavior in an engagement where it matters. Not that Vietnam, Korea, Iraq, Afghanistan, etc did not matter to the people who lived there, far from it.
But they were not really wars where the US felt its very survival under threat, or really had much skin in the game. Things are different in such a war.
Traditionally the US military, especially the Army, has started out the greenest and learned the fastest. The tragedy of Vietnam is that the learning part was short-circuited.
In the case of a "cyberwar", or more likely it being part of a greater action, say "The Battle of the Taiwan Straits" or whatever, things would be messy but it's silly to say that we're either 100% unprepared or sitting ducks.
As for "skin in the game", one analysis I like is that the intensity of the nation's commitment to a war goes like this, based on the three cultural groups that matter in this area:
The Jacksonians are always ready and willing to fight.
Next are the New England Moralists.
And if the Midwestern Pragmatists decide that fighting the enemy is better than continuing to do business with him, well, it's all over (for the enemy).
You can find at least one good essay out there discussing this.
Part of it is that the defense will be active and I have some faith in our ability to respond to and recover from attacks.
But what you're saying and most especially implying could well be true, but we won't really know unless and until we're seriously attacked.
I do say that we won't start to get serious about this sort of thing only after a particular software bug or vulnerability kills thousands of Americans.
What I have a fair bit of insight into is the industrial and commercial infrastructure which this article about Clarke is talking about. When Clarke suggests that a foreign actor could cause targeted blackouts, he's simply not wrong. If you want to allude to defenses, I'm going to have to ask you to be specific, because I don't know what you're talking about. Shutting the whole Internet off might not totally remediate the threat.
Ad hoc, on the fly ... hard if your part of the grid isn't up ... I'm just saying that in a timetable measured in hours to days the defenses against such an attack won't be entirely static.
Now, we'd need some software examples to really support this, it scales very differently than the hardware repairs that I cited above. I can't think of any off hand ... was the Patriot clock drift problem "solved" by frequent enough rebooting?
Anyway, my point is that the months problem you refer to is happening in situations that are not existential, right? I don't think you can be confident we'll be as slow when the stakes get really high.
If you ask around your social circle for someone who's done SCADA work, you may find someone who can enlighten you with specifics.
Another thing that pops into my head is people trying to organize, only to have real-life enemy intelligence agents read the plans on a forum and thereby develop countermeasures, and/or disrupt, sabotage, or steal what is developed in order to use it against them.
Not to mention people tweeting troop movements, etc. :P
War might not be pretty, but it sure is fascinating.
The word gets used as if it's well defined, but I have never heard a non-metaphorical description. "A war fought in cyberspace"? That means nothing. "A shootout on the info superhighway"? That means even less.
And yes, I've read about Titan Rain, Ghost Net, Operation Aurora, Coolswallow, Giving Wings to the Tiger, The Dark Visitor, Estonia's "Web War One" and more. All of this talk of "cyberwar" strikes me as merely a modern-day regurgitation of Cold War Boogie Man Stories, like Missile Gaps, and Bomber Gaps, Bears in the Forest, and Yellow Hordes, and stoic Spetznaz supermen. The emergent behavior seems to be lining up a successor magic funding word to "terrorism", should bin Laden die.
Point in case:
"Cyberwar refers to conducting military operations according to information-related principles. It means disrupting or destroying information and communications systems. It means trying to know everything about an adversary while keeping the adversary from knowing much about oneself. It means turning the "balance of information and knowledge" in one's favor, especially if the balance of forces is not. It means using knowledge so that less capital and labor may have to be expended."
Has anyone here read it yet and willing to add their own two cents?
The power grid, in particular, is not a fantasy scenario.
http://arstechnica.com/microsoft/news/2010/01/microsoft-want...