Home / Blogs

Is The Term “Cyberwarfare” Overstating the Case?

At the Virus Bulletin conference last month, Andrew Lee from ESET gave a talk entitled “Cyberwar: Reality or Weapon of Mass Distraction?

In it, Lee talks about how the term “cyberwar” is thrown around a lot these days. However, he disagreed with the use of the term because it uses inflationary language and overstates the case; today’s “cyberwar” is not the same as a conventional ware. We read in the newspapers things like “Stuxnet is the new face of 21-st century warfare: invisible, anonymous, and devastating” and “Very respected scientists have compared nuclear arms race to cyber arms race.”

Really? Is it really a cyber arms race?

The Path to Cyberwar started with Kosovo in the late 1990’s. It was the first war where information and disinformation over the Internet became very important. NATO forces were often fooled by this information. They were so reliant on aerial surveillance that the Serbs put up fake tanks, fake heat sources so as to divert campaigns.

More instances:

  • In 2007 in Estonia, they came under attack although later analysis showed it to be more of a cyber riot by patriotic hackers (the Russian Nashi youth group).
  • A similar instance occurred in Georgia in 2008, and again in Kyrgyzstan.
  • However, in Iran in 2010, Stuxnet was first instant where there was some kind of destructive element to the attacks.
  • China is interesting; although they are building a lot of infrastructure, they are trying to develop by getting secrets from other places

But are these examples of cyber warfare?

While Stuxnet was called a “Digital Apocalypse” it was really “just” a DOS attack. Iran possesses weapons grade reactors, and that’s what Stuxnet damaged. No people were injured. It was not even close to a digital Hiroshima. The fallout of nuclear weapons is much, much worse than cyber weapons. Terms like these seriously devalue what real war looks like. A real act of war has to be violent, purposeful and political. Stuxnet does not meet this criteria.

It’s as if we in the security industry have been talking about viruses that could destroy hard drives for years. Now that we finally got one, we cry “APT!”

Below is what real warfare looks like:

Left: The aftermath of Hiroshima, Japan in 1945 / Right: Fallujah during the War in Iraq

All of this matters for multiple reasons:

  • Use of resources – Cyberwar isn’t just about malware, it involves militarization of civilians and civilian resources and these things may provoke a military response.
  • Politics – Furthermore, there is a possible politicization of public anti-malware efforts (e.g., should US companies issue malware signatures for US government malware?).
  • Special interests – In addition, cyberwar is being defined almost exclusively by and within the civilian sphere. You don’t hear the military talking on and on about the cyberwar. They go to great pains to reduce the kind of hype. It’s mostly by those who have a vested interest in selling something to government, or public.

Who are the possible targets in “cyberwar”?

The US has more to lose than anyone else because of the way its economy is linked to the online world. If you have the widest attack surface, your opponent’s strength lies in your weakness. People with no reliance on cyber are the biggest threats because they don’t need to worry about defense. They also don’t worry about the threat of retaliation because they don’t care about the loss of human life.

There is also the problem of “attribution pollution.”

What happens when you don’t know who the enemy is? Is it civilian? Military? False flag (i.e., a diversion to make it look like it came from someone else)? Furthermore, there is implausible deniability—if you did it, why would you ever admit it? Unless you are declaring war?

Ultimately, we must reduce the hype and increase our knowledge, and take responsibility for our own cyber hygiene: harden and strengthen defenses, include code review and test processes, educate people to the risks they face but with a practical slant that they can use.

Those are my notes from Lee’s session at VB. I thought it was a good talk with plenty to think about.

By Terry Zink, Program Manager

Filed Under


Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet



New TLDs

Sponsored byRadix

IPv4 Markets

Sponsored byIPv4.Global


Sponsored byDNIB.com


Sponsored byVerisign

Domain Names

Sponsored byVerisign

Threat Intelligence

Sponsored byWhoisXML API

Brand Protection

Sponsored byCSC