tions do hold for many of the acts of
cyber espionage and cyber attack we
have seen to date.
Would these conditions be true for
a cyber attack that might plausibly be
regarded as an act of war? Perhaps, but
perhaps not. For example, cyber attackers may make technical mistakes
that leave behind clues about their
identity on some of the systems they
have compromised. They may use a
technique that has been seen before.
They may have discussed their plans
on a bulletin board that is being monitored. An intelligence official who provided to the perpetrators information
useful for conducting the attack may
discuss his actions on an intercepted
phone call. Political circumstances
(such as international tensions) may
suggest a particular national actor that
might gain a significant advantage
from conducting such an attack. Although they do not guarantee it, all of
these possibilities increase the likelihood attribution could be established.
Policymakers have some experience
with many kinds of crises, but their
understanding of the cyber world is,
with some exceptions, sketchy and incomplete. Nevertheless, in the event of
cyber crisis, they will make decisions
with whatever information and knowledge they have. Computer scientists today are in a position to play an important role in helping to shape national
and international policies regarding
What might such a role entail? The
issues are complex, from both technical and policy standpoints, and are
worthy of serious intellectual atten-
are in a position to
play an important
role in helping to
We are in
the earliest stages
of an ongoing
policy debate about
matters of war and
peace in cyberspace.
tion. Some interesting issues include
˲ Attack assessment. Knowing that
a nation or even a particular facility
is under serious cyber attack is highly
problematic given the background
noise of ongoing cyber attacks occurring all the time. What information
would have to be collected, from what
sources should that information be
collected, and how should it be integrated to make such a determination?
˲ Geolocation of computers. Given
that computers are physical objects,
every computer is in some physical
location. Knowledge of that location
may be important in assessing the political impact of any given cyber attack.
˲ Techniques for limiting the scope
of a cyber attack. Associated with any
bomb is a lethal radius outside of
which a given type of target is likely to
be unharmed—knowledge of a bomb’s
lethal radius helps military planners
minimize collateral damage. What, if
any, is the cyber analog of “lethal radius” for cyber weapons?
˲ How could a penetration of an adversary’s computer system be conducted so that the adversary knows the penetration is an exploitation rather than
˲ Given a continuing and noisy background of criminal and hacker cyber
attacks, how would two nations that
agreed to a “cyber cease-fire” know the
other side was abiding by the terms of
˲ How might catalytic cyber conflict
between two nations be avoided? (
Catalytic conflict refers to conflict between
two parties initiated by a third party,
perhaps by impersonating one of the
˲ How can small conflicts in cyberspace between political/military adversaries be kept from growing into
The first four listed items address
technical issues that are important to
parties on either side of a cyber attack
or exploitation (that is, as victim or as
5 The last three items are
some of the 50-plus policy-related questions relevant to conflict in cyberspace
described in a 2010 report of the U.S.
National Research Council,
4 and the
reader should notice that all of them
transcend the individual concerns of
any particular nation and require a
degree of familiarity with concepts of
computer science and information
technology that is second nature to
most Communications readers.
We are in the earliest stages of an ongoing policy debate about matters of war
and peace in cyberspace, and the voice
of professional computer scientists
should be heard in that debate. Whatever one’s views on the topic, dialog
and discussion within the computer
science community about this matter
can help policymakers make more informed decisions in this area.
1. Gorman, s. Cyber combat: act of war. Wall Street
Journal (May 31, 2011); http://online.wsj.com/article/
2. Mahnaimi, u. Israeli military plots to cripple Iran in
cyberspace. Sunday Times (aug. 7, 2011).
3. Markoff, J. a code for chaos. New York Times (oct.
2, 2010); http://www.nytimes.com/2010/10/03/
4. national research Council. Proceedings of a Workshop
on Deterring Cyberattacks: Informing Strategies and
Developing Options for U.S. Policy, national academies
Press, 2010; http://www.nap.edu/openbook.
5. national research Council. Technology, Policy, Law,
and Ethics Regarding U. S. Acquisition and Use of
Cyberattack Capabilities, W.a. owens, k. W. dam, and
H.s. lin, eds., national academies Press, 2009; http://
6. reed, t. C. At the Abyss: An Insider’s History of the
Cold War. ballantine books, new york, 2004.
7. White House. International Strategy for Cyberspace,
May 2011; http://www.whitehouse.gov/sites/
herbert Lin ( email@example.com) is chief scientist at the
Computer science and telecommunications board of the
national academies, where he has been study director of
major projects on public policy and information technology
including the 2009 nrC study Technology, Policy, Law, and
Ethics Regarding U.S. Acquisition and Use of Cyberattack
Capabilities and the 2010 NRC Proceedings of a Workshop
on Deterring Cyberattacks: Informing Strategies and
Developing Options for U.S. Policy. Prior to his nrC service,
he was a professional staff member and staff scientist for
the House armed services Committee (1986–1990).
Copyright held by author.