Two recent articles have me thinking about the wide disparity of what people mean with the term “cyberwar”. I don’t like this term and don’t usually consider myself as working in or around cyberwar, as I don’t have anything to do with things like Stuxnet. You could make the case that we’re using “war” here in the sense of “war on drugs” (an apt comparison in more than one way), I suppose. Generally speaking, however, it’s less of a war and more about espionage or crime, depending on the actors and their motives.
Espionage EVERYWHERE
So when the excellent blog Sources and Methods ran an article a few days ago entitled Top 5 Things Only Spies Used To Do (But Everyone Does Now), it grabbed my attention because the activities listed all pertain to our more-or-less normal lives online. We don’t necessarily live in an age of “too many secrets” anymore, because the volume of open data has grown so rapidly that we have difficulty quantifying it. Instead, analysis and transparency have become our watchwords.
In Wheaton’s list of 5 things, a few really stood out to me. #4 “Shake a tail” stems from the idea that we all use various methods of countersurveillance now (using incognito mode or NoScript in our browser, for example). I do a lot of this, but it seems to me like we could turn this comparison around. Surveillance methods that might have seemed purely indicative of police states and the Warsaw Pact 50 years ago have become standard business practice today, to say nothing of the issues around government surveillance here in the West. I’m not sure that #3 is completely a new thing, as most password usage now has much more in common with the millennia-old use of locks and keys rather that Prohibition-era speakeasies. But the widespread use of encryption technology is an interesting comparison.
I take a little issue with #2 on the use of an “agent network”, in the sense that our usage easily surpasses the idea of “a group of humans who we have vetted and recruited to help us get the information we want”. That’s just a subset of our agent network now; tools like Paper.li and The Tweeted Times help us filter through large amounts of these data, not to mention Google Alerts and other intelligent agents that scour the Internet on our behalf with nothing more than an algorithm and parameters we’ve given it. Ironically, a lot of the countersurveillance privacy notions we may use in #4 above directly combats people using their own agent network against us.
While stating that our use of satellites now includes capabilities “that were not even dreamed of by the most sophisticated of international spies a mere decade ago” includes a bit of hyperbole, certainly many of the things we might consider normal in a few years would have seemed like pure science fiction not too long ago.
Cyberwar in Syria
Right next to Wheaton’s article, my browser had a tab open to US Training Syrian Opposition In Cyber Warfare, Online Security. I might quibble with Wheaton on a few insignificant details, but this article on Syria missed the mark in ways that disappointed me greatly.
First, the article essentially equates “PC encryption mechanisms, government firewall workarounds, and the safe use of mobile phones” to cyberwar. This is highly inaccurate, particularly given the parallels with the intelligence techniques we just discussed. While claims that the CIA provides logistical support (tech, weapons, and training) to the Syrian opposition are in line with the traditional roles of that agency, I don’t think that helping dissident groups in China or Syria is “warfare” in any meaningful sense of the word. While drug dealers definitely do use disposable cell phones, that’s because the use case is essentially the same. In fact, from the point of view of a government, the users themselves are pretty much the same: people doing illegal things that someone might construe as a threat to their national security. US government sponsorship of Tor may be the most ironic thing I’ve read all day, actually, but this only highlights the idea that any given tech itself isn’t ethical or unethical. Our usage of it certainly can imply ethical concerns, but even then that depends on your own framework.
Either way, for all our discussion about cyberwar and defending assets, it strikes me that involvement with some of these projects could go a lot further in the service of someone’s ideals than simply publishing exploits on Full Disclosure.
