Jimmy R Najjar
Captain Denton
ROTC MS 1.5 Class (Book Report)
December 11, 2015 Cybersecurity and Cyberwar: What the world needs to know After everything that has been happening in the world, from the 9/11 takedown of the twin towers, to the shooting in Paris almost a month ago, the world has been drawn to attention to the extent of surveillance and cyber-espionage practiced by the US government, not only in relation to suspected terrorists but also in relation to the ordinary citizen. After reading Cybersecurity and Cyberwar, I feel like it comes at an interesting time in the history of security services world-wide, when the extent of inter-connectivity of every agency, corporation and individual makes cyber-surveillance easier to put into effect. The authors are experts in their field: Peter Singer is Senior Fellow and Director of the Center for 21st Century Security and Intelligence at the Brookings Institution, a former coordinator of Obama's defence policy task-force during the 2008 campaign and author of three other books on aspects of warfare. Allan Friedman is also a well-known expert in the field of information security and cyber-security, formerly Research Director for the Center for Technology Innovation at the Brookings Institution, and currently Visiting Scholar at George Washington University's Cyber Security Policy Research Institute. In other words, this is an authoritative text. In Cybersecurity and Cyberwar, Singer and Friedman attempt to fill this worrisome knowledge gap. The book is divided into three sections: “How it All Works,” “Why it Matters,” and “What Can We Do?”. In the first section of the book the authors briefly explain the basics of the Internet, from IP addresses to email. They also provide a history of the development of the Internet, as well as an overview of its international governance organizations. Their historical discussion points to a number of problems that will become important to preventing and regulating cyberwar and cybercrime. The authors note that the Internet is built around “a dynamic architecture” that promotes both flexibility and resilience. This architecture allows the Internet to function “without top-down coordination. But it also shows the importance of the Internet’s users and gatekeepers behaving properly, and how certain built-in choke points can create vulnerabilities if they don’t”. Such vulnerabilities include the Internet’s increasingly inextricable connections to critical infrastructure, and the fact that cyberattacks are often routed through a number of different countries and therefore different legal jurisdictions, making sorting out prosecution and the laws involved much more complicated. Despite the potentially dry, and certainly basic, subject matter, this section is written in an interesting, engaging, and sometimes humorous way that will be of interest both to beginners and to those with IT expertise who want to have a better understanding of cybersecurity vulnerabilities and threats. The second section, “Why it Matters”, begins with a discussion of terms and definitions. While this might seem mundane or even redundant, it points to several concrete and deeply worrying problems surrounding cybersecurity. As the above mentioned litany of incidents in 2013 indicates, terms like ‘cybersecurity’ actually comprise a vast spectrum of problems, from denial of service attacks and “hacktivist” activities like WikiLeaks’ release of classified documents, to malware, financial fraud, stealing patents, or securing critical infrastructure. As the authors point out, lumping these issues together under the catchall heading “cybersecurity” is as absurd as “treating the actions of a prankster with fireworks, a bank robber with a revolver, an insurgent with a roadside bomb, and a state military with a cruise missile as if they were all the same phenomenon simply because their tools all involved the same chemistry of gunpowder”. While cybersecurity generally refers to phenomena that involve the same set of tools and techniques, there is a massive variety in the actors and activities involved. The implication is not just that we need more policymakers to understand ‘cybersecurity,’ but that groups of scholars and policymakers must develop a deeper understanding of the various sub-fields encompassed by this vast field. In other words, we have much further to go in developing a deep understanding of the issues comprised by this term. Such multifaceted terminology is also troubling because, as the authors point out, even when governments want to collaborate on cybersecurity issues, a lack of common vocabulary to discuss and understand them makes such collaboration even more difficult. Following this, the authors delineate a sort of typology of the different problems encompassed by the term ‘cybersecurity’, hacktivism, cybercrime, cyber espionage, cyber terrorism, cyber war, and so forth—as well as the myriad of actors involved from hacktivists, criminal cartels and other non-state actors, to governments themselves. This section is both helpful and informative, providing real-life examples of threats and actors that animate the discussion and make it more accessible across different levels of expertise. Their short section on the hacktivist group Anonymous is particularly interesting. Your view of Anonymous and its activities may depend on where you stand—are they engaging in a new form of the time-honored practice of civil disobedience, or are they merely petty criminals? Whatever your position, the authors’ description of Anonymous’ activities, from facing off with a Mexican drug cartel to promoting Internet freedom, helps to illustrate the incredibly complex—and fascinating—problems and potentials that increasing networked connectivity brings. As complex, important, and worrisome as these issues are, the authors note that the overarching message is that we need to take the hyperbole often associated with commentary about cybersecurity with a very large grain of salt. Letting our fears of immanent catastrophe get the better of us will lead to policies that are sub-par, and even destructive in their own right. Yet that should not diminish the dramatically increasing importance of cybersecurity in a globalized world: “how we respond to this world of growing cyber threats will shape everything from our personal privacy and the future of the Internet to the likelihood of regional crises and even global wars. So we better get it right. The authors address how this could be achieved in the final section of the book, titled What Can We Do? This section is the most interesting portion of the book from a policy perspective, detailing policy frameworks and proposals for building a more secure Internet communications infrastructure. Singer and Friedman’s discussion revolves around the concept of “resilience,” one that is “both overused and underexplored”. The term resilience refers to systems and organizations that “are prepared for attacks and can maintain some functionality and control while under attack”. Rather than focusing on building solutions for very specific cybersecurity problems on an ad hoc basis, we should focus on building systems that are resilient, and therefore capable of resisting a variety of different types of threats. In other words, there is not one single ‘silver bullet’ solution to cybersecurity, but rather different frameworks for thinking that will help develop more robust approaches to achieving cybersecurity in different arenas over time. This must include tracking metrics to guide long-term organizational planning and investment, as well as war game-type exercises, with outsiders attempting to break into cyber defenses in order to discover insecure areas, amongst other techniques and best practices. One framework Singer and Friedman propose is based on the public health system in the US, a non-hierarchical network that is in part centered around the Centers for Disease Control (CDC). Rather than directing activities, the CDC provides research and acts as a coordinating hub for other state, international, and non-state actors in the public health system. According to the authors’ proposal, a cyber CDC would address some of the flaws in the system by shifting the focus from quick fix, short-term measures of responding to attacks towards a long-term mode of regional, national, and even international cooperation. Such an organization could also serve as a kind of epistemic community for the cyber world, acting as a sort of neutral middleman in intensely political environment. In another framework, the authors suggest thinking about cyber criminals like 16th century pirates: “much like the sea, cyberspace can be thought of as an ecosystem of actors with specific interests and capacities. Responsibility and accountability are not natural market outcomes, but incentives and frameworks can be created either to enable bad behavior or to support the greater public order”. Such policy recommendations for future systems of cybersecurity and Internet will be particularly interesting to scholars of IR and global governance, providing a number of compelling possibilities for future research into a field that is relatively understudied and under-theorized. In conclusion, after reading such a marvelous book, it will be an effective contribution to establishing a deeper understanding and a common base of knowledge around cybersecurity issues. Thus it will serve as a base for all citizens to begin to understand, approach, and deal with the important policy implications of cybersecurity and cyberwar.