The Cyber War Winter Has Arrived
When Russia placed nuclear missiles in Cuba in 1962, they were, apparently, baiting the US to retaliate with full-scale nuclear war, and it nearly worked. However, the US had earlier placed nuclear weapons inside Turkey, which had then, understandably, up-set Russia and so Cuba going nuclear was their response!
More than 50 years later, we’re reaching a similar position. We’re at the edge of a balancing act that is tipping toward the world’s first war fought online.
In the past month, two major attacks on US government-related agencies, both allegedly perpetrated by Russian hackers, who may or may not be working with the Kremlin, have shown what could be the first publicly acknowledged cards in what has been a years-long tension between two world superpowers. A nation possibly revealing that it has gained access to U.S. systems and actively flaunting the ability to interfere with a presidential election is deliberate bait for our government to take stronger action.
Until now, nation-state cyber activity has amounted to little more than threats and conversations behind closed doors, as illustrated by last year’s anticlimactic US-China cyber pact meant to prevent nation-state hacking of private companies.
The agreement was met with security industry criticism for providing only the illusion of progress while leaving governments free to attack each other. And that’s exactly what they’ve done for years, nations have long been laying the groundwork for cyber combat, launching stealthy, ongoing attacks that have not (yet) been publicly uncovered.
But when one of these threats does come to light, whether by counter-attack or strategic leaking of information, the balance of terror is disrupted and calls for retaliation. Those claiming the recent Guccifer 2.0 and Shadow Brokers attacks are a warning from Russia are likely right, but what’s wrong is that we’re treating this like a new problem.
Powerful nations like the US, Russia and China laid the groundwork for attacks long ago as a “just in case” measure. We’ve seen this type of activity before with the revelation of Stuxnet, a virus thought to be the first public act of cyber warfare to cause physical damage (and that has been rumored to be linked to the Equation Group via technical details of the organization’s exploits).
And while the recent attacks are a significant indicator of what might be in store as tension with Russia escalates, this is just the start of publicly acknowledged cyber warfare. Further, what we are seeing now is not even the worst case scenario as future attacks will likely go beyond embarrassing government documents, beyond wreaking havoc in elections and instead target citizens directly.
As we saw last year in Russia’s attack on Ukraine’s power grid, governments with aggressive cyber initiatives have unprecedented, direct power over the citizens of other nations. Nations like Russia, China and the US likely already have a stronghold on some aspect of each other’s critical infrastructure. This could mean energy grids and oil plants, or it could mean nuclear power facilities, it’s all dependent on the weapons lurking below the surface.
What’s more, these critical infrastructure facilities are nearly all built with archaic software that doesn’t stand a chance against hackers backed by a cyber-savvy nation. Imagine trying to create a website using only Microsoft Word 97, that’s essentially what it’s like for these tools to try blocking modern threats.
So are we all doomed? Not yet, at least. From where we stand now, it’s likely that the US’s next move is to place sanctions on Russia similar to those used to shut down public cyber conflict with China last year. But while that may work to mitigate the current situation, it’s a band aid over a bullet hole. If government organizations don’t work fast to update critical infrastructure security tools and policies, there’s a significant chance we’ll be facing physical battles as the result of a cold war.
