The Bloodless Battlefield: Cyber-War

Vernon Pratt
HSM 438
18 July, 2014
Professor Stephanie Lemmon

Digital battle is not only what is found on computer games, it is an all to real and costly form of combat in which the combatants and defenders alike do not suffer physical wounds but the effects of these cyber-battles can be just as deadly as any bullet fired from a gun or bomb dropped from an aircraft. Within this paper three separate cyber-warfare events are reviewed, each event is different from the other only in terms of the consequences, only the consequences were different.
What is “Cyber-Warfare”? One definition of cyber-warfare is, “cyberattacks are so inexpensive and easy to mount, with few fingerprints, they will almost certainly remain a feature of modern warfare.” (Markoff, 2008). Digital battles waged within the digital world of computer systems and the world-wide-web (internet). Cheap, “It costs about 4 cents per machine,” (Markoff, 2008), so cheap that the cost of one armored tank tread (one piece of the entire treack) could finance an entire cyber-war (Markoff, 2008).
The first cyber-warfare event, Estonia 2007: Following the fall/collapse of the Soviet Empire in 1990 formerly USSR controlled nation states returned to autonomous control; Estonia was one of these countries. Being released from Soviet control did not mean that the civilian population wanted to be free from the Russian government and tensions existed between pro-Estonian and pro-Russian citizens; it was these tensions that would inflame and erupt into nationwide civil unrest. The Estonian government tore down a revered military tribute statue that represent communist unknown Soldiers of that region. When anti-Estonian civilians became aware of the statues destruction rioting erupted. But a new form of civil unrest was also unleashed and that was Cyber-Warfare.
Now considered the first use of cyber-warfare on a grand scale Estonia, a country that was the most technologically advanced European country was brought to it’s digital knees by a series of cyber attacks (Landler & Markoff, 2007). For one month Estonian government, communications, and financial computer systems were degraded to a point of failure by denial of service attacks, “Aimed primarily at specific sites and networks, denial-of-service attacks block the access of legitimate users, rendering the entire site or network unavailable.” (IAR, 2014). The cyber-attackers used malware as the means to sustain and propagate the attacks through zombie systems around the world, some of which originated in the United States. One such zombie computer was identified as being within the Russian President, Vladimir Putin’s administration so early accusations were that the Russians were supporting the unrest to undermine the Estonian government.
The attacks lasted for a month, ending as abruptly as they started. Only one hacker was identified but many more are suspected from the very basic hacker to the ultra-sophisticated hacker. The resulting effects of the Estonian cyber-attacks was a “wake up call” for all nation states that their own computer systems are vulnerable and can be exploited in such a manner as to at the very least degrade to utterly destroy those systems control, “The aftermath of a cyber attack can impact anyone that uses the internet, whether it is an individual, business, or government that has been affected.” (Ashmore, 2009, p. 4)

The second cyber-warfare event, the Russian-Georgian War: Oil, Gas, Natural Resources, all were a reason for Russia to invade the country of Georgia with a coordinated military assault to seize control of Georgia’s rich mineral resources. While the described Russian invasion seems to follow past practice Soviet methods it did vary in one very important aspect, it is considered the first known use of cyber-warfare in conjunction with military air, sea, and ground forces, “This appears to be the first case in history of a coordinated cyberspace domain attack Synchronized with major combat actions in the other warfighting domains (consisting of Land, Air, Sea, and Space). “…” (Hollis, 2010, p. 2). The Russian military initiated a simultaneous cyber attack upon Georgian communications nodes to hamper military defenses and deny the civilian population of real-time information, “"It seems that 54 web sites in Georgia related to communications, finance, and the government were attacked by rogue elements within Russia ... So as tanks and troops were crossing the border and bombers were flying sorties, Georgian citizens could not access web sites for information and instructions.”” (Hollis, 2010, p. 2). The most prevalent cyber-warfare technique employed as distributed denial of service (DDOS) attacks of which not all were originated from military cyber-soldiers, civilian hackers were also involved. Russia’s use of civilian hackers was innovative and effective but it has been determined that this level of cooperation between state and civilian actors is very difficult to achieve which reduces the likelihood of similar future attacks by state actors, “First, for Russia or China to employ their people's patriotic 'hacker militia' to conduct a network attack against a target nation-state, they must engage them first - to motivate and 'sell' them on the concept; steer them toward appropriate targets; synchronize those cyberspace operations with combat activity in the physical realm; and discuss the most effective cyberspace tactics, techniques and procedures (TTPs) to be used.” (Hollis, 2010, p. 5). The result of the Russian invasion was 25,000 civilians displaced and a ceasefire treaty that remains unfulfilled by Russia. Russia gained what it wanted in terms of natural resources but it also proofed a new dimension of warfare. It must be noted that the Russian cyber campaign and the military invasion was very controlled and deliberate, so deliberate that after analyzing the tactics the evidence upholds that Russia’s control implied it could have done much more damage then and could unleash more at any given time; a cyber-bully threat.
The third and last cyber-warfare event, the U.S. State Department Far East Region cyber-attacks 2006: June 2006, U.S. State Department Far East Division was targeted by cyber infiltration malicious code, the exact source of the perpetrator(s) is not known but evidence strongly suggested the originating country was China, “Hackers in China broke into the State Department's computer system in Washington and overseas in search of information, passwords and other data” (Wright, 2006). The U.S. State Department relies heavily upon digital information systems for communications and information archives, “Over our unclassified network, we daily process about 750,000 e-mails and instant messages from our more than 40,000 employees and contractors at 100 domestic and 260 overseas locations.” (Reid, 2007).
The method of infiltration was previously unknown Microsoft program weakness that allowed hackers to imbed malicious code into a legitimate Microsoft document that once activated opened a digital backdoor to the network operating system, also known as a Trojan Horse as it was undetectable. Though the weakness was unknown the State Department’s reliance on digital technologies was recognized as a vulnerability and a cyber protection program was in place, a program that prevents or thwarts cyber attacks daily, “we block 500,000 spam e-mails, intercept 5,100 viruses and detect some 2,000,000 anomalous external probes to our network.” (Reid, 2007).
It was the State Departments early detection that prevented widespread contamination of the entire State Department computer systems, limiting the damage to the originating region. In addition to finding and quarantining the effect region the State Department’s cyber protection program was key to creating a fix or patch for the program weakness through real-time (near instantaneous) information from the government to the computer industries. In the end very little data was corrupted or stolen and there was no loss of communications within or without the State Department.
In conclusion, comparing the three cyber-attacks (Estonian Civil Unrest, Russian Coordinated Cyber-Warfare on Georgia, and the U.S. State Dept. system compromise) I find that Estonia’s highly evolved technologies being brought down by independent users was a warning event; nations who do not heed this event are doomed to future failure. Russia, using a coordinated military and civilian initiated cyber-attack in conjunction with military power has demonstrated just how effective such a tactic can work and they are prepared to use it. Lastly, the attempted infiltration of the U.S. State Department unclassified computer systems represents how a robust and constant cyber-protection program can identify, quarantine, and remedy cyber-attacks before they cause irreversible damage.

Resources:
Taylor, Robert W., Eric Fritsch, John Liederbach, and Thomas Holt. Digital Crime, Digital Terrorism for Ashford University, 2nd Edition. 2011. Pearson Learning Solutions Inc.. Upper Saddle River, NJ.
John Markoff. Before the Gunfire, Cyberattacks. 12 August, 2008. Retrieved from http://www.nytimes.com/2008/08/13/technology/13cyber.html?_r=0
Mark Landler and John Markoff. Digital Fears Emerge After Data Siege in Estonia. 29 May, 2007. Retrieved from http://www.nytimes.com/2007/05/29/technology/29estonia.html?pagewanted=all&_r=0
International Affairs Review (IAR). Denial-of-Service: The Estonian Cyberwar and Its Implications for U.S. National Security. 2014. Retrieved from http://www.iar-gwu.org/node/65
William C. Ashmore. Impact of Alleged Russian Cyber Attacks. 2009. Retrieved from http://www.bdcol.ee/files/files/documents/Research/BSDR2009/1_%20Ashmore%20-%20Impact%20of%20Alleged%20Russian%20Cyber%20Attacks%20.pdf
David Hollis. Cyberwar Case Study: Georgia 2008. 2010. Retrieved from http://smallwarsjournal.com/blog/journal/docs-temp/639-hollis.pdf
Donald R. Reid. Response to May-Julyh 2006 Cyber Intrusion on Department of State Computer Network. 19 April, 2007. Retrieved from http://2001-2009.state.gov/m/ds/rls/rm/83256.htm

Robin Wright. State Dept. Probes Computer Attacks. 12 July, 2006. Retrieved from http://www.washingtonpost.com/wp-dyn/content/article/2006/07/11/AR2006071101032.html