Welcome!

Government Cloud Authors: William Schmarzo, Yeshim Deniz, Kevin Jackson, Carmen Gonzalez, Elizabeth White

Related Topics: Government Cloud

Government Cloud: Blog Feed Post

Cyber War and the Expanding Definition of War

Engaging with cybersecurity challenges is essential to ensuring war remains a continuation of politics by other means

Editor’s note: This post by  provides context on cyber conflict, an area of interest at the nexus of national security and technology. – bg

Recently, Dr. Thomas Rid of the War Studies department of King’s College in London published an article in the Journal of Strategic Studies titled, “Cyber War Will Not Take Place.” Rid’s essay relies upon a definition of war taken from the work of Carl von Clausewitz to assess whether cyber attacks can be accurately described as “stand-alone” acts of war. His conclusion is that we have yet to see any cyber attacks that, on their own, meet Clausewitz’s definition. What’s more, he predicts that we are unlikely to see stand-alone acts of cyber war in the future. Nonetheless, he does acknowledge that cyber threats are real and that various cyber tools and techniques are becoming increasingly important in international conflict, including those used for sabotage, espionage, and subversion.

At a time of increasing concern over prospective cyber threats, it is not surprising that Rid’s essay has added fuel to the ongoing debate between cyber security proponents and the so-called “cyber skeptics.” For example, cyber war expert, author, and CEO Jeffrey Carr has written a spirited response to Rid’s essay. In this post, I argue that Carr’s response misses a key component of Rid’s argument, that the debate between Rid and Carr is exemplary of an emerging debate over the definition of “war” more generally, and that the complexities of cyber conflict demand that we move beyond the kind of binary thinking exhibited in this debate.

First, Carr provides three examples of cyber attacks that he says meet the Clausewitzian definition of war provided by Rid because all three are “lethal, instrumental, and political.” His three examples:

  1. Kyrgyz Intelligence assassinates Gennady Pavlyuk. Kyrgyz intelligence cracked Pavlyuk’s email account and used the information they obtained to lure him out of the country under false pretenses resulting in his murder.
  2. Mossad assassinates Mahmoud Al-Mabhouh. Israel’s Mossad mounts an operation to assassinate Hamas leader Mahmoud Al-Mabhouh which includes infecting Al-Mabhouh’s computer with a trojan horse virus.
  3. Iran’s IRGC arrests 30 dissidents after cracking U.S. hosted webservers.

None of these are acts of war in the conventional sense of the term. These are 1) subterfuge in support of assassination, 2) espionage in support of assassination, and 3) espionage in support of political repression. In the first case, Kyrgyz intelligence supposedly assassinated one of its own citizens. That is not war as we typically understand it. In the third case, espionage was used to aid in carrying out an act of political repression. But neither of those acts by themselves (espionage nor arresting one’s own citizens) are war. The only example that might be considered war is the second case. But even here, given the ongoing state of violent conflict between the Israelis and Palestinians, which has included many assassinations, it is hard to see this event as somehow distinct.

But more importantly, Carr’s response misses a key component of Rid’s argument, namely, that it was about whether stand-alone cyber attacks have been or will be acts of war. Not only is it questionable whether any of Carr’s counter examples in their totality are “acts of war,” it is clear that in none of them can the cyber attack components be seen as stand-alone acts of war. The cyber attacks in each example were not the direct causes of the ultimate outcomes. Email hacking did not directly kill Gennady Pavlyuk. The trojan horse did not kill Mahmoud Al-Mabhoud. Cracked servers did not directly arrest those Iranian protestors. All of those actions (assassinations and arrests of political dissidents) have occurred, do occur, and will continue to occur without the aid of cyber attacks. The use of cyber attack tools and techniques in support of them in these cases does not make them nor the use of cyber tools and techniques “acts of war.”

Second, the debate between Thomas Rid and Jeffrey Carr is exemplary of an emerging debate that is less about the definition of “cyber war” and more about the definition of “war” in general. There is an emerging debate between expansionists and traditionalists. Expansionists argue that current definitions of “war,” either from the classic theorists like Clausewitz or the law of war, are inadequate and should be expanded to include a wide range of acts that traditionally would not be considered war. The traditionalists argue that existing definitions of war are more than adequate, that while the practice of war might change (including weapons and tactics) the fundamental nature of war does not: it is still about damage, destruction, injury, or death inflicted for political purposes, usually by state actors.

In this instance, Carr makes an expansionist argument when he claims that “traditional thinking about warfare has been made obsolete by our dependence upon cyber-space-time.” In a previous essay, he citedNATO study of the legal lessons learned as a result of the 2008 cyber attacks against the country of Georgia. That report concluded that the cyber attacks, by themselves, did not count as “armed attack” (the legal term for what we colloquially call an “act of war”) under current definitions in the law of war. In response, the authors proposed that “new approaches to traditional law of war principles need to be developed.” Therefore, they advocated that the advent of “new bloodless types of warfare” like cyber war mean that “the definition of ‘attack’ should not be strictly connected with established meanings of death, injury, damage and destruction” (p. 30). Because the cyber attack on Georgia (and practically all other cyber attacks to date) do not come close to meeting traditional definitions of war from law of war, theorists like Clausewitz, or even common understandings of the term, the response has been to call for the redefinition of war itself to include a whole host of “bloodless” acts.

Of course, Rid is taking a traditionalist approach in this debate. He is arguing that the fundamental nature of war has not changed and is using the work of a widely-cited, well-respected classic theorist to support his argument. Others, such as Maj. Gen. Charles Dunlap, Jr. (ret) have also taken the traditionalist position. Dunlap has argued convincingly that the law of war definitions of “armed attack” are more than adequate for evaluating cyber attacks. In doing so, he is following closely the analysis provided by Michael Schmitt more than a decade ago, which is the foundation for the “effects-based” approach to determining when a cyber attack rises to the level of armed attack, when it is war. In the traditionalist view, there are no “bloodless” acts of war. Violence, death, destruction, damage, injury are required. Even then, not every act of this sort is armed attack or war (see examples 1 and 3 above).

My own views are more in line with those of the traditionalists than the expansionists. I believe that it is dangerous (for many reasons that I will not elaborate here) to expand definitions of armed attack and war. I merely wish to call attention to the fact that the debate over the definition of cyber war is becoming a debate over the definition of war in general. This is an important distinction. The outcomes of this debate will have profound impacts on the future of politics, economics, security, and individual liberties.

Finally, because the outcomes of this debate will be so important, it is all the more disappointing that issues of cyber security are so often framed in such binary terms. For example, because Rid does not accept that all malicious cyber activity is “war,” Carr lumps him into the category of cyber war “skeptics.” He made a similar move with the authors of a recent OECD report that claimed that cyber attacks do not have the ability to cause systemic shocks that are global in scope. Nonetheless, in each case, Rid and the authors of the OECD report make it clear that they take cyber threats seriously. They merely seek to be more realistic in their assessments of the impacts of cyber attacks and more precise in their categorization of the varying types of malicious actions in/through cyberspace. To be fair, though Rid’s position is more nuanced than Carr admits in his response, Rid nonetheless invites Carr’s application of a binary, proponent/skeptic categorization because his essay largely framed cyber war as a yes/no question.

Effectively addressing the complex challenges of cyber security in a globalized world demand that the public debate about cyber security move beyond such framings. Are cyber attacks war? There needs to be room for answers like, “Maybe, it depends” and “No, but there are still serious challenges.” The truth will likely lie somewhere in the gray, muddled middle between yes and no, black and white. Engaging with the messy complexity of cybersecurity challenges is essential to ensuring that war remains a continuation of politics by other means instead of politics (and every other aspect of daily life) becoming a continuation of war by other means.

[Cross-posted from Forbes.com.]

Read the original blog entry...

More Stories By Bob Gourley

Bob Gourley writes on enterprise IT. He is a founder and partner at Cognitio Corp and publsher of CTOvision.com

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists will examine how DevOps helps to meet th...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
Every successful software product evolves from an idea to an enterprise system. Notably, the same way is passed by the product owner's company. In his session at 20th Cloud Expo, Oleg Lola, CEO of MobiDev, will provide a generalized overview of the evolution of a software product, the product owner, the needs that arise at various stages of this process, and the value brought by a software development partner to the product owner as a response to these needs.
SYS-CON Events announced today that A&I Solutions has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 1999, A&I Solutions is a leading information technology (IT) software and services provider focusing on best-in-class enterprise solutions. By partnering with industry leaders in technology, A&I assures customers high performance levels across all IT environments including: mai...
Most technology leaders, contemporary and from the hardware era, are reshaping their businesses to do software in the hope of capturing value in IoT. Although IoT is relatively new in the market, it has already gone through many promotional terms such as IoE, IoX, SDX, Edge/Fog, Mist Compute, etc. Ultimately, irrespective of the name, it is about deriving value from independent software assets participating in an ecosystem as one comprehensive solution.
SYS-CON Events announced today that EARP will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. "We are a software house, so we perfectly understand challenges that other software houses face in their projects. We can augment a team, that will work with the same standards and processes as our partners' internal teams. Our teams will deliver the same quality within the required time and budget just as our partn...
SYS-CON Events announced today that delaPlex will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. delaPlex pioneered Software Development as a Service (SDaaS), which provides scalable resources to build, test, and deploy software. It’s a fast and more reliable way to develop a new product or expand your in-house team.
SYS-CON Events announced today that Tappest will exhibit MooseFS at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. MooseFS is a breakthrough concept in the storage industry. It allows you to secure stored data with either duplication or erasure coding using any server. The newest – 4.0 version of the software enables users to maintain the redundancy level with even 50% less hard drive space required. The software func...
In his keynote at @ThingsExpo, Chris Matthieu, Director of IoT Engineering at Citrix and co-founder and CTO of Octoblu, focused on building an IoT platform and company. He provided a behind-the-scenes look at Octoblu’s platform, business, and pivots along the way (including the Citrix acquisition of Octoblu).
SYS-CON Events announced today that Outscale, a global pure play Infrastructure as a Service provider and strategic partner of Dassault Systèmes, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 2010, Outscale simplifies infrastructure complexities and boosts the business agility of its customers. Outscale delivers a secure, reliable and industrial strength solution for its customers, which in...
SYS-CON Events announced today that Outscale will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Outscale's technology makes an automated and adaptable Cloud available to businesses, supporting them in the most complex IT projects while controlling their operational aspects. You boost your IT infrastructure's reactivity, with request responses that only take a few seconds.
SYS-CON Events announced today that Systena America will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Systena Group has been in business for various software development and verification in Japan, US, ASEAN, and China by utilizing the knowledge we gained from all types of device development for various industries including smartphones (Android/iOS), wireless communication, security technology and IoT serv...
DevOps at Cloud Expo – being held October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises – and delivering real r...
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Busine...
In order to meet the rapidly changing demands of today’s customers, companies are continually forced to redefine their business strategies in order to meet these needs, stay relevant and continue to see profitable growth. IoT deployment and development is integral in this transformation, and today businesses are increasingly seeing the value of investing their resources into IoT deployments. These technologies are able increase ROI through projects such as connecting supply chains or enabling sm...
SYS-CON Events announced today that CollabNet, a global leader in enterprise software development, release automation and DevOps solutions, will be a Bronze Sponsor of SYS-CON's 20th International Cloud Expo®, taking place from June 6-8, 2017, at the Javits Center in New York City, NY. CollabNet offers a broad range of solutions with the mission of helping modern organizations deliver quality software at speed. The company’s latest innovation, the DevOps Lifecycle Manager (DLM), supports Value S...
SYS-CON Events announced today that Peak 10, Inc., a national IT infrastructure and cloud services provider, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Peak 10 provides reliable, tailored data center and network services, cloud and managed services. Its solutions are designed to scale and adapt to customers’ changing business needs, enabling them to lower costs, improve performance and focus intern...
Everywhere we turn in our industry we can find strong opinions about the direction, type and nature of cloud’s impact on computing and business. Another word that is used in every context in our industry is “hybrid.” In his session at 20th Cloud Expo, Alvaro Gonzalez, Director of Technical, Partner and Field Marketing at Peak 10, will use a combination of a few conceptual props and some research recently commissioned by Peak 10 to offer a real-world consideration of how the various categories of...
SYS-CON Events announced today that Super Micro Computer, Inc., a global leader in compute, storage and networking technologies, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Supermicro (NASDAQ: SMCI), the leading innovator in high-performance, high-efficiency server technology, is a premier provider of advanced server Building Block Solutions® for Data Center, Cloud Computing, Enterprise IT, Hadoop/...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend @CloudExpo | @ThingsExpo, June 6-8, 2017, at the Javits Center in New York City, NY and October 31 - November 2, 2017, Santa Clara Convention Center, CA. Learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.