Coming to terms with cyber warfare

Tallinn, ESTONIA — Given the number of times that the terms "cyber war" and "cyber warfare" show up in the media, one would think that policymakers have settled on a working definition.

Yet, defining cyber warfare is a hard problem, military and computer-security experts told attendees at the Cooperative Cyber Defence Center of Excellence (CCD COE) Conference on Cyber Warfare. Under one lexicon, current attacks affecting the Internet are either reflection attacks, so named because the conflict mirrors a conflict in the real world, or espionage, said Mikko Hyppönen, chief research officer for antivirus firm F-Secure. True cyber warfare is rare, he said.

"The vast amount of practical work being done in data security is not fighting cyber warfare, but fighting cybercrime," Hyppönen said. "When we go to cyber warfare, the definition of what we are talking about gets really muddled."

Even after the attacks on networks of former Soviet states of Estonia and Georgia in 2007 and 2008, respectively, policymakers and technologists still disagree over the degree to which such incidents constitute cyber warfare. Earlier this year, one security researcher labeled the incidents little more than Internet censorship.

Yet, the Estonian government feels differently. Paraphrasing Prussian military philosopher Carl von Clausewitz, Johannes Kert, an advisor to the Minister of Defence for Estonia, said that the political motivations are what matter.

"It's the continuation of 'politics by other means,'" Kert said. "The traditional mindset is that only hooligans and criminals are using Internet attacks. But we see the last couple of years, especially in Eastern Europe, massive cyber attacks whose motivation is political."

Still, another expert stressed that true cyber warfare should not be defined by the means — that the attack took place in cyberspace — but the ends. Amit Sharma, deputy director and scientist at the Ministry of Defence in India, argued that cyber warfare needs to have a doctrine similar to nuclear deterrence.

"More people are putting the emphasis on the means," said Sharma, who is currently pursuing research at the United Kingdom's Defence Academy. "But (the question is) do they have the means to create a strategic paralytic effect (as the end result)?"

It's no wonder, then, that the CCD COE intends to create a lexicon of definitions as quickly as possible, according to Kenneth Geers, a scientist with the group and the conference organizer.

"These definition and concepts are amazingly challenging in cyberspace," Geers said. "And they are going to require very focused attention."