Cybersecurity

IN CYBERWAR, THERE ARE NO RULES

Why the world desperately needs digital Geneva Conventions.

These days, warfare is conducted on land, by sea, in the air, across space, and now in the fifth battleground: cyberspace. Yet so far, the U.S. government has fumbled on cybersecurity, outsourcing much of that area of conflict to the private sector in accordance with the Trump administration’s most recent National Security Strategy—leaving the country exposed to foreign attack.

Those third parties operate under exactly the same incentives as any pharmaceutical company. If a company’s service is the treatment of symptoms, preventive medicine is a threat to its business model. Meanwhile, pundits, policymakers, and publishers take as gospel what they’re told by so-called cybersecurity experts who have more social media followers than relevant credentials in the field, which is how hysterical “The Hackers Are Coming for Us” editorials find their way into otherwise respectable publications.

Increased fear, uncertainty, and doubt surrounding cybersecurity have led to a world where we cannot tell what has and hasn’t happened. The nature of cyberwarfare is that it is asymmetric. Single combatants can find and exploit small holes in the massive defenses of countries and country-sized companies. It won’t be cutting-edge cyberattacks that cause the much-feared cyber-Pearl Harbor in the United States or elsewhere. Instead, it will likely be mundane strikes against industrial control systems, transportation networks, and health care providers—because their infrastructure is out of date, poorly maintained, ill-understood, and often unpatchable. Worse will be the invisible manipulation of public opinion and election outcomes using digital tools such as targeted advertising and deep fakes—recordings and videos that can realistically be made via artificial intelligence to sound like any world leader.