CAMBRIDGE – Until recently, cyber security has primarily interested computer geeks and cloak-and-dagger types. The Internet’s creators, part of a small, enclosed community, were very comfortable with an open system in which security was not a primary concern. But, with some three billion or so users on the Web nowadays, that very openness has become a serious vulnerability; indeed, it is endangering the vast economic opportunities that the Internet has opened for the world.
A “cyber attack” can take any number of forms, including simple probes, defacement of Web sites, denial-of-service attacks, espionage, and destruction of data. And the term “cyber war,” though best defined as any hostile action in cyberspace that amplifies or is equivalent to major physical violence, remains equally protean, reflecting definitions of “war” that range from armed conflict to any concerted effort to solve a problem (for example, “war on poverty”).
Cyber war and cyber espionage are largely associated with states, while cyber crime and cyber terrorism are mostly associated with non-state actors. The highest costs currently stem from espionage and crime; but, over the next decade or so, cyber war and cyber terrorism may become greater threats than they are today. Moreover, as alliances and tactics evolve, the categories may increasingly overlap. Terrorists might buy malware from criminals, and governments might find it useful to hide behind both.
Some people argue that deterrence does not work in cyberspace, owing to the difficulties of attribution. But that is facile: inadequate attribution affects inter-state deterrence as well, yet it still operates. Even when the source of an attack can be successfully disguised under a “false flag,” governments may find themselves sufficiently enmeshed in symmetrically interdependent relationships such that a major attack would be counterproductive. China, for example, would lose from an attack that severely damaged the American economy, and vice versa.