By Paul Rosenzweig
Friday, December 6, 2013
There is much to admire in Erik Gartzke’s recent Lawfare essay, Fear and War in Cyberspace. Indeed, I find myself in substantial agreement with it as a proposition reflecting the reality of today. But I wonder if Gartzke does not, too easily, dismiss the possibility of irrational actors in the cyber domain. His thesis, after all, is that threats of cyber war are overblown, precisely because rational actors will see that there is little benefit to initiating a conflict. He maybe right as a matter of risk assessment as of today (though I do wonder about disruptions that are tied to physical attacks) – but what happens when irrational actors get increased capabilities?
The honest answer is that we don’t know – and the reason we don’t know is that we have no actual experience with large scale cyber attacks. The two closest analogies we’ve seen (in Georgia and Estonia) were, as Gartzke says, properly classified as annoyances rather than large scale operational threats. We’ve seen Stuxnet destroy components of a single installation – but we’ve never seen what mass destruction might entail (or if it is even possible).
And so we are left with our imaginations – and they run wild at times. Thankfully, some are trying to more systematically game out what a cyber conflict might look like. How seriously you take the threat depends on how realistic you think more catastrophic scenarios are.
With that in mind, I was fascinated by two recent cyber war games – GridExII and an Israeli game. Their results may or may not be representative, but they certainly are worthwhile data points.
In early November, the US government ran an exercise it called, GridEx II. As the New York Times reported, the exercise simulated a large-scale cyber attack on the American electric grid. Of course an exercises is just a test, not the real thing. But even so, the results from GridEx II appear to be challenging:
By late Thursday morning, in this unprecedented continental-scale war game to determine how prepared the nation is for a cyberattack, tens of millions of Americans were in simulated darkness. Hundreds of transmission lines and transformers were declared damaged or destroyed, and the engineers were rushing to assess computers that were, for the purposes of the drill, tearing their system apart.
Continue reading at Lawfare › What Will Cyber Conflict Look Like?.