The title of a Computing.co.uk article published on March 11 is provocative, to say the least: “Symantec CTO: World War III could start with cyber battle.” But that single word “could” soon sucks all the provocation out of what follows. Once you get past the headline and actually read the article, you discover that World War III could start with a cyber battle, but, then, it could also start with something else—or not “start” at all. As warnings go, this is about as lame as you can get. Recall that Paul Revere supposedly cried out to the militiamen of Middlesex The British are coming! The British are coming! not The British could be coming.
It was the absence of the “could” that made all the difference in 1775.
What Symantec’s Greg Day told reporter Sooraj Shah was that cyber tools “could be used [in warfare] a lot in terms of propaganda, disinformation and almost the preemptor to the physical element,” but he skipped over the parts that so worry the likes of Richard Clarke (Cyber War: The Next Threat to National Security and What to Do About It, HarperCollins, 2010), namely that “cyber war is real,” that it is “global,” that it bypasses the physical battlefield (“Systems . . . from banks to air defense radars . . . are accessible from cyberspace and can be quickly taken over or knocked outwithout first defeating a country’s traditional defenses”), and, most important of all, that “cyber war has begun.” Back in 2010, Clarke pointed out that nations were already avidly “hacking into each other’s networks and infrastructures, laying trapdoors and logic bombs.” From this, he reasonably concluded that cyberwar was “ongoing.”
Ongoing? How could Day have missed this detail—especially since he not only mentions February’s bombshell report from rival security company Mandiant, “APT1: Exposing One of China’s Cyber Espionage Units,” but even claims that “Symantec had also been tracking APT1 for six years”?
As a headline, “World War III could start with cyber battle” makes about as much sense as “World War II could start with Pearl Harbor”—had the latter “prediction” been published on December 8, 1941.
No one denies that nations, including the United States, are under continual cyberattack. Although it is not always easy to identify the sources of attack, we do know that many of the attacks flow—flow, as in a torrent—from China and Russia, whose governments support extensive offensive hacking and cyber espionage operations. In China, the military isdirectly involved (as the Mandiant report made clear), as are groups of ostensibly civilian “patriot hackers”; in Russia, the military fields Information Warfare (IW) units and also finances such “patriot hacker” groups as the “Nashi” youth organization, which was involved in the 2007 Russian cyberattacks against Estonia (as Jeffrey Carr documented in his Inside Cyber Warfare, O’Reilly Media, 2011).
“I don’t like using the word cyberwar,” former White House chief cybersecurity advisor Howard Schmidt said in a January 31 interview, and maybe Symantec’s Greg Day is of a similar persuasion. But given the fact that the ongoing torrent of attacks against the United States and other Western countries is hostile, global, destructive, costly, and sanctioned by foreign powers, what better name is there for it? How about World War III?