Contesting Cyberspace and the Coming Crisis of Authority
33
summit approved a Russian proposal defi ning “ information war ” as an effort by a state
to undermine another ’ s “ political, economic and social systems ” including “ mass
psychologic [sic] brainwashing to destabilize society and state. ”
40 The GCC states have
coordinated Internet policies perhaps the longest of the regional organizations. As far
back as 1997, the GCC member states met to address the challenges for national
security and “ traditional practices and religious beliefs ” of growing Internet connectivity. More recently, at the 2008 ITU Regional Cybersecurity Forum, held in Doha,
representatives from the GCC were joined by Arab League states to discuss coordinated
national security policies. The group issued a “ Doha Declaration on Cybersecurity ” at
the conclusion, which emphasized the need for greater harmonization around cyberspace controls.
41
Assertions of state power in cyberspace can exacerbate interstate rivalries and competition. After revelations of major breaches of the Indian national security establishment were made by the Information Warfare Monitor, for example, the Indian
government stepped up its cyberwarfare and exploitation capabilities.
42 Legislation
was even briefl y proposed that would have legalized patriotic hacking in India in
response to what was perceived to be a tolerance and exploitation of such activities
in China.
43 The Indian government also took measures to restrict imports of high
technology from China.
44 After the Operation Aurora attacks that compromised
Google, the U.S. National Security Agency was called in to investigate the matter, and
many inside and outside Congress pointed to the incident as a justifi cation for an
urgent expansion of offensive cyber capabilities.
45 Refl ecting these sentiments, retired
Air Force General Kevin P. Chilton argued that the United States should undertake a
major and very public exercise of its offensive cyber capabilities for deterrent effects
on other countries, presumably such as China.
46
The militarization of cyberspace that we have described has touched off an arms
race in the domain as governments and others rush to develop offensive capabilities.
But it is also cultivating a normative milieu where offensive actions taken against
adversaries and threats are given wider latitude and justifi cation. Although within U.S.
policy circles a tight lid is still kept on revelations of offensive cyber attacks, public
discussions, like those of General Chilton, are becoming much more common. Likewise, although distributed denial of service (DDoS) attacks can be traced back decades,
there has been a rash of more politically motivated ones, including those seemingly
undertaken by or in support of governments against opposition groups and by citizens
against states and corporations, such as the crowd-sourced Anonymous attacks directed
against Tunisia and Egypt, and Visa, Mastercard, and Paypal.
47 In early 2011, in what
will likely stand as one of the more brazen public hacks, Anonymous breached the
servers of a security fi rm that was investigating its actions, called HBGary. The group
defaced its Web site, took over the Twitter and LinkedIn accounts of some of its executives, and released more than 70,000 company e-mails into the public domain.
48
33
summit approved a Russian proposal defi ning “ information war ” as an effort by a state
to undermine another ’ s “ political, economic and social systems ” including “ mass
psychologic [sic] brainwashing to destabilize society and state. ”
40 The GCC states have
coordinated Internet policies perhaps the longest of the regional organizations. As far
back as 1997, the GCC member states met to address the challenges for national
security and “ traditional practices and religious beliefs ” of growing Internet connectivity. More recently, at the 2008 ITU Regional Cybersecurity Forum, held in Doha,
representatives from the GCC were joined by Arab League states to discuss coordinated
national security policies. The group issued a “ Doha Declaration on Cybersecurity ” at
the conclusion, which emphasized the need for greater harmonization around cyberspace controls.
41
Assertions of state power in cyberspace can exacerbate interstate rivalries and competition. After revelations of major breaches of the Indian national security establishment were made by the Information Warfare Monitor, for example, the Indian
government stepped up its cyberwarfare and exploitation capabilities.
42 Legislation
was even briefl y proposed that would have legalized patriotic hacking in India in
response to what was perceived to be a tolerance and exploitation of such activities
in China.
43 The Indian government also took measures to restrict imports of high
technology from China.
44 After the Operation Aurora attacks that compromised
Google, the U.S. National Security Agency was called in to investigate the matter, and
many inside and outside Congress pointed to the incident as a justifi cation for an
urgent expansion of offensive cyber capabilities.
45 Refl ecting these sentiments, retired
Air Force General Kevin P. Chilton argued that the United States should undertake a
major and very public exercise of its offensive cyber capabilities for deterrent effects
on other countries, presumably such as China.
46
The militarization of cyberspace that we have described has touched off an arms
race in the domain as governments and others rush to develop offensive capabilities.
But it is also cultivating a normative milieu where offensive actions taken against
adversaries and threats are given wider latitude and justifi cation. Although within U.S.
policy circles a tight lid is still kept on revelations of offensive cyber attacks, public
discussions, like those of General Chilton, are becoming much more common. Likewise, although distributed denial of service (DDoS) attacks can be traced back decades,
there has been a rash of more politically motivated ones, including those seemingly
undertaken by or in support of governments against opposition groups and by citizens
against states and corporations, such as the crowd-sourced Anonymous attacks directed
against Tunisia and Egypt, and Visa, Mastercard, and Paypal.
47 In early 2011, in what
will likely stand as one of the more brazen public hacks, Anonymous breached the
servers of a security fi rm that was investigating its actions, called HBGary. The group
defaced its Web site, took over the Twitter and LinkedIn accounts of some of its executives, and released more than 70,000 company e-mails into the public domain.
48