The Cyber-Attacks and Fears of Cyber-War to Come

Following the drone and flag incident that plagued what should have been a friendly and peaceful football match, the majority of Serbian news media websites were the victims of a direct distributed denial-of-service (DDoS) attack by hackers apparently working for Albanian interests, causing all but one such media website and associated servers to go offline for hours before being restored.

Such attacks, where malware on thousands of computers is enlisted by hackers to tie up targeted website servers and cause them to freeze or crash is considered “distributed” because it comes from a vast variety of specific computers in this fashion and “direct” because it happens in sync as a concentrated attack. For servers of news media, banks, and other sites where the public requires constant access to ever-changing data, such attacks can be devastating in terms of the loss of consumer trust and money they cause.

“On Tuesday, after 9 pm, websites of all relevant media in our country were targeted by a massive organized hackers’ attack, and only one remained intact” Zoran Zivkovic, president of the Association for Information Security of Serbia said, according to a recent InSerbia article. The one that “remained intact” apparently had very strong security in place able to defend against such a powerful and organized effort at attack, however, the other media networks’ servers were less fortunate and fell to the attack. An attack of this caliber has not been seen before in Serbia or the entire region, and this fact alone is a serious cause for concern. Mr. Zivkovic and other security analysts have noted that an attack of this level of sophistication, duration, and the ability to take out a great deal of bandwidth would require resources beyond even what the Albanian government itself has in place, however, it is possible, probably even likely, that Albanian agents—whether truly governmental or from a splinter political movement—paid for hackers to construct and carry forth this complex attack.

A year ago, in September of 2013, InSerbia published an editorial I wrote that was a critique of a book by political scientist Prof. Thomas Rid, a London-based scholar who believes that cyber-war is not “real” war. Indeed, Prof. Rid’s book is entitled “Cyber War Will Not Take Place”, so his thesis her is pretty clear even before one opens up the book’s cover. Prof. Rid, having his expertise in political science and military history, spends most of his book describing the differences between real, conventional, warfare and what some scholars and professionals call “cyber-war”.

He concludes that while cyber-crime is a real issue, cyber-war is not. As I stated in my 2013 article, I believe he is quite wrong. My editorial, entitled “The Coming Threat of Cyber War”, lists how cyber-attacks and other elements of intelligence-gathering or disruption commonly associated with hacking or cyber-crime could be employed on a tactical level for the gain of governmental, terroristic, or paramilitary entities. Now, we see a drone fly into a major sporting event bearing a flag that caused great disruption in that event and following that action, the systemic, organized, denial of service attacks that took down most of Serbia’s online news media presence. This is severe, this is cause for worry, and regardless of exactly who orchestrated these actions, it is motivated by politics and not the type of fiscal gain we find motivating most common crime. Indeed, as noted above, whomever cooked up this plot probably had to spend—not make—quite a bit of money on it.

I have long believed that someday, somewhere, someone would launch an attack large or small that could not be defined as anything except an action of cyber-war. This is one such example of an attack. It meets the criteria I set forth in my article for a bona fide cyber-warfare attack, per its motivations, its enlistment of operatives either dedicated to a cause or in the pay of people dedicated to such a cause, and its coordination with other actions to bring about terror or social strife. There is evidence of involvement in at least the drone-flag action at the highest levels of the Albanian ruling class and this incident happened at a key athletic event at a crucial time in Serbian-Albanian relations. Truly, it was political in catalyst yet outside the bounds (by far) of accepted, polite, political or diplomatic discourse. The fact it was followed by cyber-attacks on Serbian media outlets greatly underscores that these attacks were part of a concentrated, directed, extra-political action. Though no shots were fired, it was closer to the dirty deeds of warfare than possibly closer to the proper techniques of diplomacy and we all know it.

Some observers have worried that the drone that flew into the match bearing the flag could have instead carried a biological or chemical weapon, or a small bomb. That is a valid concern. Likewise, while these DDoS attacks were mainly an annoying situation for a few hours upon one evening, it is very likely future attacks could seek to undermine governmental websites, steal sensitive data, disable communications such as email or even telephony, or disrupt power grid functions.

From what I know of the extant technology in place for internet and all levels of telephonic communications in Serbia, it is a combination of new upgrades that are quite up-to-date and much older, often Cold War-era Yugoslav systems. When we look at back-up systems and physical security going beyond what’s possible with just contemporary software, we find even more legacy systems from the 1980s and 1990s. This is cause for great concern. This is proof that Serbia is decently at risk for extensive, complex, and highly-disruptive cyber-attacks. And the fact that hackers apparently backed by the Albanians would undertake a cyber-attack is proof enough that the Albanians and others who are anti-Serbian are willing to use these weapons to wage their battles. That to me sounds a lot like “cyber-war”, and it’s cause for Serbia to take all measures possible to ensure at the national and corporate levels alike there is a more robust presence of cyber-security, because now we are not just dealing with criminals who might wish to steal our credit card numbers, but with political operatives that wish to silence our media, ruin football matches, and in general inspire dread and terror.

I have long been interested in what is now known as cyber-security, going back as far as the later 1980s when kids were into dial-up services, modems, weird stuff one could conjure with software like dBase III or HyperCard, and the amazing world of telephone systems. “Hackers” were people who were more interested in breaking into computer systems to learn how they worked and in some cases, to exploit their weaknesses either for personal satisfaction or actual financial or other gain. “Phreakers”, a less-common term but an earlier one, were the kids who were trying to con the phone system into free calls via a series of dial-tones that replicated legitimate ones these systems produce; while this technology over the course of the past decade has been greatly reduced as has the interest of hackers in phone systems, the general issue of telephone systems involved in the operations of the internet is still very key because in most nations, telephone company central offices still handle most internet traffic—even that for the government and military, though such at times goes through specialized and more-secure facilities.As the internet became more and more popular and vital to so many areas of life and as technology swung towards a fully-digital, fibre-optic-mediated means of transmission, we saw hardware improvements as well as the software improvements the consumer is more familiar with come into play. What hackers have known for decades is that “hacking” isn’t just being able to break into a computer system or deny it service via an attack on its bandwidth, but all means of gaining entry or control of all facets of the software and hardware aspects that facilitate computer communications via the broad internet or specific, more-isolated, intranets.

I want to stress that in the Balkans and Russia—probably elsewhere, too—there’s something of a climb to make in conveying that cyber-security is, on a national level or beyond just a corporate level, a serious concern. Many information technology security professionals will argue over their own favorite approaches to making systems more secure and robust, however, that is only one level of the battle. Before we can debate what silver bullet is best to shoot the werewolf, we have to convince the powers that be that indeed there are werewolves in the first place. We have a cultural split, with many of the Thomas Rid types, the academics, the retired colonels and such saying “this is a small police matter, a crime of theft at worst” versus the other cultural outlook, one I’m loathe to call “the hacker culture” for how Hollywood this sounds, but the IT professional culture, at the least. And there are academics who are very disturbed about the prospect of cyber-conflict, as well: RAND researchers and authors John Arquilla and David Ronfeldt have been worried about cyber-war and writing very thoughtful and in-depth work on the concept since around 1996, so this cannot be seen as a fully new issue, either. The fulcrum is this: Scholars of conventional war are looking at what they believe war to be and not to be, and while not denying that cyber-attacks can be costly and problematic for society, they’re seeing these attacks as a totally different creature than actual warfare, with no lives lost, no rockets slamming into buildings, no stray bullets hitting innocents. Yet what is missed is that for centuries warfare has been predicated on doing actual harm—the whole option of virtual harm was not even a concept. The closest analog would have been burning books, a removal or withholding of information. Now, withholding or destroying data or the access to data networks constitutes a very real apex of damage to how post-industrial society functions, and to hamper or destroy crucial parts of society for political gain does seem like warfare, or at the least, the same creature with different fangs.

Serbia will do well to take the recent DDoS attacks as a grave lesson: all websites, all internet presences, all channels of computer-mediated communications as well as all telephony beyond what we normally consider as computer communications will require astute stewardship and protection, because there are enemies—whether state-actors or otherwise—who will exploit any digital weakness they can find.