Other-Than-Internet (Oti) Cyberwarfare: Challenges for Ethics, Law, and Policy

Abstract

Almost all discussions of cyberwarfare, other cyber-attacks, and cyber-espionage have focused entirely on the Internet as the chief means of damage Á the Internet as a 'vector,' using a term from the theory of infectious diseases. However there are a variety of means, some of which have already been used, that involve cyber-exploitation using vectors other than the Internet. Malware can be installed in the integrated circuits of computers and servers, but also in any devices attached to them Á thumb drives, CDs, printers, scanners, and so on. One can also use various forms of electromagnetic radiation at a distance of meters or more to exfiltrate data or to infiltrate corrupt data. I call this large and diverse family of unwanted interference with the functioning of information processing systems other-than-Internet (OTI) attacks on information systems. Stuxnet, and probably the 2007 Israeli corruption of Syrian air defenses, were OTI attacks. Such OTI techniques are more difficult to develop than creating malware, requiring electronic manufacturing facilities or novel technologies, and are thus accessible only to larger corporations and technologically sophisticated countries. Particularly vulnerable would be countries (like the United States and Europe) whose information processing devices are mainly produced outside of the country. Once exploitations via the Internet become harder to perpetrate, OTI exploitations are certain to grow dramatically, eventually requiring equipment for critical uses to be expensively fabricated in (and transported using) secure facilities; expensive detection measures will have to be instituted. This will create challenges for policy, law, and ethics, as well as greatly increasing the cost of many electronic devices.

Reliable Old Wineskins: The Applicability of the Just War Tradition to Military Cyber Operations

“…However, nontechnical components of this method are likely to be inconclusive (i.e., using electronic and human intelligence sources to verify an attacker's identity) or are morally irrelevant (i.e., inferring from means and motive). See Dipert (2013). 42 I am obviously calling into question the legitimacy of punishing for retributive and utilitarian (i.e., deterrence and public order) purposes, and would argue that public safety and reform should be the guiding purposes.…”

A Triggering Mechanism for Cyber-Attacks in Naval Sensors and Systems

“…In that operation, according to the literature [ 7 , 8 , 9 ], the Israeli air force attacked a Syrian facility without being noticed, thanks to a malicious cyber mechanism installed in the Syrian radar system. One hypothesis raised in the literature [ 7 , 8 , 9 ] regards to the possibility that an Electronic Attack (EA)—i.e., an attack performed in the electromagnetic spectrum—was used to unleash a cyberattack capable of hindering the radar computational process. The EA, in that case, would have been used to send commands to the Syrian air surveillance system, by using the radar receiver as an open door for attack commands.…”

O encontro da Guerra Cibernética com as Guerras Eletrônica e Cinética no Âmbito do Poder Marítimo

“…Apesar das dificuldades para descobrir e dissecar ataques cibernéticos -por vezes mantidos sob sigilo -, o princípio de Efeitos Cinéticos é frequentemente identificado nos casos estudados. Dentre os ataques mais conhecidos, cujos efeitos produzidos/alegados reforçam a pertinência deste princípio, citamos o ataque associado à explosão no gasoduto transiberiano (REED, 2005;CLARK;KNAKE, 2010), o ataque cibernético que apoiou a Operação Orchard (ADEE, 2008;CLARK;KNAKE, 2010;DIPERT, 2013), e o worm Stuxnet (LANGNER, 2011;ZETTER, 2014) que impactou o programa nuclear iraniano.…”