The US Government, like most others, is openly building upoffensive cyber capabilities, but the arms race is on beforethe world has even seen a real cyber attack, says Robert Clark,operational attorney for the U.S. Army Cyber Command. With all due respect to all my friends out here doing this,we ve never seen a cyber attack because I m looking at a veryspecific definition of what a cyber attack is, Clark on Tuesdaytold the AusCERT conference in Queensland. Stuxnet was not a cyber attack. Estonia, nope. Georgia, nope. The cyber attacks on Estonia and Georgia could not be consideredreal because neither could be tied back to a nation-state. If you can t tie it back to a nation state, you can t call it acyber attack because the law of armed conflict applies betweenstates, not individuals, said Clark. China remains the poster-child for industrial and nationalespionage, but Clark noted that while espionage on domestic turfcarries tough penalties, espionage is not illegal underinternational law and was rife. The question of where and when touse cyber force, however, is more complicated. Stuxnet, thought to have been developed by Israel with the aid ofthe US, was definitely a game changer , said Clark, but it toofailed to qualify for one reason. Iran didn t call it an attack. They didn t step up and say, We ve had a cyber attack . Why? I don t know, said Clark,explaining that a critical criterion for an attack is the target'sdeclaration that the incident is, in fact, an attack . The nation state that gets attacked gets to announce and decidewhether they have suffered a use of force or an armedattack. In turn that might influence how to define a proportional response. Still, Stuxnet did satisfy two other conditions of armedconflict , including physical destruction of a system and,assuming Israel was behind it, a proportional response to an imminent threat . Under the law of armed conflict, you have to have necessity,proportionality; it s got to be a non-discriminatory weapon, whichmeans it s got to be a targeted weapon, said Clarke. [Stuxnet] was very discriminatory because it was looking for thatone SCADA system, that Siemens machine, with the Iranian subsystemand the Finnish aspect in there. Symantec researchers in 2010 detailed the trigger for Stuxnet was at least 33 frequencyconverter drives made by Fararo Paya in Iran or by Finnish companyVacon. Because it was unlikely to find Iran s equipment anywherebut Iran, the finding suggested the malware was designedspecifically to target Iran's facility. And if it wasn t there, this thing goes off the box June 24th2012, or it would just go away or just lay there dormant, doingnothing. So it was a very discriminatory device. Was Stuxnet proportional if it was an attack by one state onanother? I don t know. Which one is better: dropping a 20,000 pound bombon the dang thing or knocking it out with a cyber attack? So nodeaths, just destruction very proportional to the threat beingfaced, said Clark. #auscert2012 Follow @CSO_Australia and sign up to the CSO Australia newsletter . I am an expert from surgicaladhesivetape.com, while we provides the quality product, such as China Corn Plasters , Waterproof Wound Dressing, Porous Capsicum Plaster,and more.
Related Articles -
China Corn Plasters, Waterproof Wound Dressing,
|