Inside Online Combat's Future

The Russia-Estonia cyberwar may not have done all that much damage, physically. But, as the biggest, best-publicized instance of large-scale, state-on-sate online combat yet (although definitely not the first), it can teach us a lot about what digital battles might looks like in the years to come, DANGER ROOM pal Cyrus Farivar writes in today's Slate.

*For one thing, cyberwarfare is efficient. Even the smartest of smart bombs takes out adjacent buildings and kills innocent bystanders. When you wage war online, there doesn't have to be collateral damage: It's possible to target a single Web site at a time. *

It's also elementary to focus a cyberattack on the upper crust. In targeting
Estonia's online seats of political and economic power, the perpetrators sent a threatening message to a country where cabinet-level discussions happen online, and documents are signed by digital signatures. Linnar Viik, the architect of many of Estonia's e-government services and now a government IT consultant, told me that there have been no panicked calls by politicians to completely shut down these online services. If these attacks had happened during March's national elections, however, a lot of bureaucrats might have rethought the country's dependence on e-government...

Perhaps the most telling lesson here is how difficult it is to catch the perpetrators of online terrorism. Covering one's fingerprints and footprints online is relatively simple, compared with getting rid of physical evidence. IP addresses can be spoofed, and an attack that appears to come from one place may actually originate somewhere else.
As such, the Kremlin (or anyone else) can plausibly deny that they had anything to do with the attacks, even if the Estonians' server logs show that the attacks first originated from Moscow. If the Russians don't want to hand over data or documents—or even pick up the phone, for that matter—there's not much that Estonia, or anyone else, can do to figure out the real story.

Brave New War author John Robb sees this type of campaign as similar to the U.S. Air Force's operations against Iraq, "and the systems disruption
[attacks on critical infratructure] we see from global guerrillas around the world. In all cases the aim of the attacks is to disrupt the target society, leaving it prostrate and unable to function as a modern country."

Another interesting aspect of this campaign is that it is being conducted by a combination of government agencies and outsourced talent from the
Internet black marketplace (and many hackers joy riding for free since the Russian government declared open season on Estonia). The end-result is that the free form, open source nature of this campaign has allowed the Russian government a level of deniability. We see similar developments going on in China. It's important to point out that this is different than the trend towards states adopting fourth generation warfare as their primary defensive strategy against conventional attack
(Iran/Syria/Venezuela/etc.). In this case, Russia (and it seems China too) has adopted the offensive power of global guerrillas.

Far be it for me to argue with either Robb (or Farivar). But, before we get too hysterical, it should be said -- repeatedly -- that only computers were harmed by the strikes. Flesh-and-blood human got off easy.