There Is No Cyberwar

crowfeather notes an interview with cybersecurity czar Howard Schmidt that Wired's Threat Level conducted this week. "Howard Schmidt, the new cybersecurity czar for the Obama administration, has a short answer for the drumbeat of rhetoric claiming the United States is caught up in a cyberwar that it is losing. 'There is no cyberwar,' Schmidt told Wired.com in a sit-down interview Wednesday at the RSA Security Conference in San Francisco. 'I think that is a terrible metaphor and I think that is a terrible concept,' Schmidt said. 'There are no winners in that environment.' Instead, Schmidt said the government needs to focus its cybersecurity efforts to fight online crime and espionage. His stance contradicts Michael McConnell, the former director of national intelligence who made headlines last week when he testified to Congress that the country was already in the midst of a cyberwar — and was losing it. ... There's been much ink spilled in recent years over the turf battles in D.C. over whether the NSA (representing the military) or DHS (on the civilian side) takes the lead role in cybersecurity. But... "I haven't seen that tension," Schmidt said. As for which will take the cybersecurity lead, Schmidt simply says it's a shared effort."

Comments

All this cyberwar bullshit

[sopssa]

I have actually always wondered about this. I remember how we had to write a school subject about "chinese superhackers" newspaper article in the early 2000's. The Google thing was also showed off to be a work of amateurs, not some Chinese superhackers working for their government. For me it just starts to look like trying to put fear into people for whatever personal reason. "Chinese hackers working for their country to break into US systems" sure sounds cool and creates fear in people, but is there any actual truth behind it? As it is now it's almost like cold war carried over to new technological area. It also looks to be a common thing here on slashdot too - without actually even questioning if theres any truth behind it.

Re:All this cyberwar bullshit

[Jurily]

Chinese hackers are indistinguishable from Chinese bored teenagers. Or American bored teenagers. Seriously, who cares where they come from?

Re:All this cyberwar bullshit

[Anonymous Coward]

If there's no "cyber-war", only online crime, what's in that for government?

Re:All this cyberwar bullshit

[oodaloop]

No, not much. Just a bunch of massive cyber attacks on the U.S. government's websites.

http://en.wikipedia.org/wiki/Cyberwarfare#History_of_attacks

Doesn't really matter if it's China behind any of it to call it a cyber war.

Re:All this cyberwar bullshit

[HungryHobo]

Ah a prime example:

In 1991, it was reported by somebody in the air force that a computer virus named AF/91 was created and was installed on a printer chip and made its way to Iraq via Amman, Jordan.[24] Its job was to make the Iraqi anti-aircraft guns malfunction; however, according to the story, the central command center was bombed and the virus was destroyed.[25] The virus; however, was found to be a fake.

of the others they mostly sound like boring old botnet activity or media sensationalism.

Sorry. No real "cyberwar" here.

Re:All this cyberwar bullshit

[oodaloop]

From the below article about the 2007 attack on the Pentagon: The Pentagon is exposed to "perhaps hundreds of attacks a day," and the department has back up systems in place, Gates said.

http://www.pcworld.com/article/133301/pentagon_shuts_down_systems_after_cyberattack.html

What would you call a regular series of attacks on our military headquarters using computers, hmmm? A compu-insurgency? Techno-terrorism? Cyberwarfare seems pretty apt to me.

Re:All this cyberwar bullshit

[jhoegl]

The "For whatever reason" makes me think of the cold war and the rhetoric cast back and forth during that whole thing. It is something so established in our society that even saying "socialist" gets you all kinds of irrational emotional rage about something people know nothing about.
So the reason? Because people in government positions want unlimited funds for fighting ghosts.

Re:All this cyberwar bullshit

[Anonymous Coward]

I think it's naive to believe or suspect it's not happening. I also believe it's naive to think governments don't sponsor it. Espionage, particularly from China, has been rampant in the corporate sector for longer than most of us have been alive. Government is an even bigger target with bigger payoffs. Using the Internet to do so makes it very accessible and completely deniable. I'm not a conspiracy freak but it's foolish to think it's not going on, even if it wasn't right in your face via the news.

A.C.

Re:All this cyberwar bullshit

[ArsonSmith]

There is a cyber war, but it's within our own government, and it's over who gets the budget dollars to fight it.

Re:All this cyberwar bullshit

[ArsonSmith]

My home router constantly has regular attacks on it. Have I ever thought I was on a cyber battlefield? No.

Re:All this cyberwar bullshit

[HungryHobo]

seriously: have you ever been an admin for any internet facing server?
Hundreds of attacks a day is nothing amazing.
That's background noise.

Re:All this cyberwar bullshit

[Krneki]

They do. Zee Internet Hackers are in your PC and in order to make you safe they need to monitor your connections. Of course providing them with your personal information will make the whole procedure way safer for you. They are going to ass rape you, without taking you to diner first.

Re:All this cyberwar bullshit

[oodaloop]

No, I have not been an admin. And I had previously read it was closer to tens of thousands a day, though perhaps that too is within the range of normal.

Re:All this cyberwar bullshit

[c6gunner]

My home router constantly has regular attacks on it. Have I ever thought I was on a cyber battlefield? No.

Pft. Damn hippie pacifist. I'll bet your router's covered in daisies!

Re:All this cyberwar bullshit

[HungryHobo]

If you're running a well know organisation? probably.
It depends what you consider an attack.

Is a portscan an attack?
Is sending a single packet to a port an attack or are we looking for more than worms trying to buffer overflows?
Is emailing one of the staff a virus an attack?
Is emailing one of the staff with a link to a virus an attack?
etc etc.

depending on what you consider an attack you could easily hit tens of thousands.

Re:All this cyberwar bullshit

[CodeBuster]

mod parent up please, this is exactly what it's about: budget and turf.

Re:All this cyberwar bullshit

[jank1887]

possibly a lot of funding for the civil side (FBI) but not for the military side. Hence the power struggle over definitions.

Re:All this cyberwar bullshit

[bsDaemon]

I would probably lump it in with signals intelligence, or perhaps counter-intelligence as well. While disabling infrastructure and/or command/control is definitely attractive, it may or may not even be advantageous to do so. These days, just for example, America and China are so co-dependent on each other economically that blowing up a factory or even disabling the electrical grid would actually end up doing reciprocal economic damage to the perpetrating party by taking out part of a market and closing off cash flow. It's b.s. but there it is.

However, gathering information (intelligence) as well as poising the well (counter-intel) by corrupting databases, etc, would be incredibly useful. Knowing what data the other side is making their decisions on, as well as being able to make change to that data to give your opponent a false impression in order to gain the upper-hand in trade negotiations or raw diplomacy would be friggin' awesome.

Of course, there are countries with which we don't have such strong economic ties to preclude an actual "military" type attack, or even an actual war. However, between the big players (and frankly, even our "allies" -- Israel is notorious for spying on its so-called friends, and god only knows what MI6 is up to, for instance) the likelihood for big-time industrial espionage against the US, from the US, or between each other, I would suggest it still high.

Assuming this, I suspect that top targets would really be Commerce, Treasury and State and that those are the locations which need to be hardened more. No one is going to seriously suggest the NSA itself is going to be attacked successfully. The Pentagon, maybe/maybe not. However, those are where the expertise in defense and attack lie Civilian departments are more vulnerable and sweeter fruit to most foreign countries anyway.

I could be wrong though, but I think that's a fair appraisal of the situation.

Re:All this cyberwar bullshit

[jank1887]

'hundreds of attacks a day'. What's an attack? is a port scan an attack? Is a botnet sending a virus payload in an email attachement an attack? How many of those 'attacks' are commercially driven, versus militarily driven? Likely we're dealing with standard internet 'crime' not 'attacks'. Wouldn't be surprised if 95% of what he called attacks involved the word V1AgArA.

Re:All this cyberwar bullshit

[Anonymous Coward]

For sure, when crimes are investigated, the investigation should focus first on the activity (is is a crime?), then on motive (boredom, profit, revenge, political?), then on who. You can't start by assuming a who, that would be profiling. and since cyberwar and other cybercrime use similar tactics, you can't investigate one without simultaneously investigating the other.

In another thread, someone here suggested Little Brother, by Cory Doctorow, about what us old timers would call civil disobedience. At the end, other books on the subject are recommended including one I had't read since my teen years, Steal this Book, by Abbie Hoffman. Mr. Hoffman doesn't mention cyberwar or cybercrime, but his comment on real world crimes can be reconsidered in light of our current technology and politics.

Re:All this cyberwar bullshit

[INT_QRK]

The coined term "cyberwar" is an abstraction. Like all abstractions, it's an imperfect model of a much more complex reality. It would be foolish to believe that capable nation states would not conduct surveillance and reconnaissance, and when conditions are favorable, offensive operations, and therefore defensive as well, in cyber-space as one would in any other physical medium (not that cyber-space is not physical -- it is). The same is true for criminality, organized certainly, but not exclusively, by demonstration, for example, here: http://www.ic3.gov/media/default.aspx. Why would one expect otherwise where there are risks and rewards in favorable ratios? So, offensive and defensive cyber-warfare is one very likely potential, if not an ongoing and evolving reality. So is cyber-crime. So are script kiddies. So are average people behaving typically well, badly, and all points in between in a complex environment. For policy makers, the challenge is in changing the risk to reward ratio. So, what is bullshit? Depends on your bullshit criteria and thresholds, I suppose.

Re:All this cyberwar bullshit

[gtall]

Regardless of whether there is a war or not, the Chinese hackers concentrated on Chinese civil rights enthusiasts. I find it doubtful a group of Chinese teenagers would care about that lot.

Re:All this cyberwar bullshit

[aztracker1]

I would say a portscan followed by attempts to login to various services with public interfaces without proper credentials not meant to be public could be considered an attack... I find my FTP server is attacked a couple hundred times a day, with various login attempts as accounts my FTP server software doesn't even have "Administrator" "root" etc... Though in that case, 3 failed attempts in 5 min, blocks the source IP for a day. It's still an attack, automated or not. There are similar efforts for any given RDBMS port, as well as other common services, such as email.

I don't consider a portscan itself to be an attack, or even seeing if an anonymous user is allowed via FTP, or accessing the web server (with typical calls)... But running a series of login attempts from an obvious dictionary or compromise script, is an attack. The severity is a secondary issue... It's the difference between an IAD going off (warfare), and a crazy guy on the side of the road saying "boom" in a soft voice repeatedly.

Re:All this cyberwar bullshit

[aztracker1]

IED

Re:All this cyberwar bullshit

[Anonymous Coward]

Exactly. There IS no spoon.

Re:All this cyberwar bullshit

[dimeglio]

Unfortunately War is being used as an euphemism for "hard fight against," "domination over" or "control of" rather than for the traditional meaning where one country attacks another to acquire its resources or a country forced to defend itself from an attack. War against crime, drugs, terrorism. It pleases those who are for it but also dilutes the meaning of war for those who have actually been in one.

In my opinion, if used to create fear or for political gain, it is obviously bull-shit and should be seen as so.

The solution to cyberwar/crime is very simple. Disconnect the US's from the rest of the world - just like Iran did. Some people probably think they might be better of this way.

Re:All this cyberwar bullshit

[flappinbooger]

Cold war, nuclear war, chemical war, biological war, conventional war .... cyber war. If a foreign government is sponsoring a coordinated attack against our assets, isn't that a "war"?

Just because it's waged with scripts, bots and other digital means and not with guns and bombs doesn't mean it can't be CALLED a war. Perhaps a cyber cold war.

Do you think that our government ISN'T working on digital defensive and offensive efforts???

Perhaps the federal cyber czar would call it a war if someone actually got in and did some noticeable damage....

Re:All this cyberwar bullshit

[stefanlasiewski]

I would say a portscan followed by attempts to login to various services with public interfaces without proper credentials not meant to be public could be considered an attack...

Is this an intentional cyberwarfare, or is a botnet simply doing what it's programed to do? In many of these cases, I doubt that the human controller behind the botnet cares about most of this activity. Your target isn't juicy enough, yet.

Re:All this cyberwar bullshit

[cayenne8]

"The solution to cyberwar/crime is very simple. Disconnect the US's from the rest of the world - just like Iran did. Some people probably think they might be better of this way."

At least disconnect the strategic things, like the power grid, utilities of all sorts..etc.

It seems like it should have in the past been, and currently be, just good sense to never have these types of critical systems in any shape, form or fashion connected to the public internet 'tubes'....

Just taking critical systems off the public grid would go a LONG way towards making things safe from a true 'war' scenario...

Re:All this cyberwar bullshit

[RavenChild]

Doesn't really matter if it's China behind any of it to call it a cyber war.

Reminds me of another war. Something about terror?

Just because we don't fight a country doesn't mean we are not at war with another entity. Or even the war on terror was brought about on a country to justify Washington calling it a "war."

Re:All this cyberwar bullshit

[Anonymous Coward]

Cold war, nuclear war, chemical war, biological war, conventional war .... cyber war. If a foreign government is sponsoring a coordinated attack against our assets, isn't that a "war"?

Just because it's waged with scripts, bots and other digital means and not with guns and bombs doesn't mean it can't be CALLED a war. Perhaps a cyber cold war.

Do you think that our government ISN'T working on digital defensive and offensive efforts???

Perhaps the federal cyber czar would call it a war if someone actually got in and did some noticeable damage....

Personally I would characterize what's going on as combination of cyber espionage and cyber crime. Although I could see scenarios where either the terms "cyber war" and " cyber cold war" would be appropriate, I agree with Howard Schimdt that what's currently happening isn't truly warfare.

Re:All this cyberwar bullshit

[oodaloop]

You mean the one where hundreds of terrorist groups around the world affiliated themselves with each other and declared war on the US? The one where they vowed not to stop until, "The flag of Islam flies over the White House"? Yeah, I've heard of it. Just because some people would prefer not to think about it doesn't mean we don't have enemies hellbent on killing us.

Re:All this cyberwar bullshit

[Anonymous Coward]

You should try it sometime. Just set up a local linux install at some point, and run SSH on a default port.

The real question is *WHAT* counts as an attack.

Mar 5 10:02:09 sshd[11605]: Invalid user test from 60.217.234.134
Mar 5 10:02:10 sshd[11610]: Invalid user test1 from 60.217.234.134
Mar 5 10:02:12 sshd[11616]: User ftp from 60.217.234.134 not allowed because not listed in AllowUsers
Mar 5 10:02:14 sshd[11635]: Invalid user oracle from 60.217.234.134
Mar 5 10:02:16 sshd[11693]: Invalid user nagios from 60.217.234.134

Is that one attack, or five? I think it's zero, but I'd concede one. So maybe an attack is a distinct IP. But there was a botnet just a few months ago that would try to connect to me from one distinct host every minute for over two weeks. I couldn't ban it. Should I count that as one attack, or X thousand?

And what about the portscan that precedes those? Is that a separate attack? It's really just recon from another host to feed into an ssh brute tool. Although being from another host and another country, I'm not sure *which* attack it's recon for. But hey, it was logged by the IPS which dropped it.

Do I count the typos from my own user in the login? No. Okay, so don't count brute attempts against valid names. Unless it's more than 5 in a row. Maybe.

Oh wait--maybe I only count *serious* attacks instead of ssh spam. Well, same question--do I count the IIS attacks against my apache install? No? Okay--do I count the phpBB hacks that get attempted even though I don't have it installed?

What about the backscatter I had last year that took our office offline when we were on a measly DSL modem, and somebody joe-jobbed us so badly we had over 3 MB/Sec of inbound bounce traffic on a 1M line? It made it impossible to work, and we couldn't get email--I had to move our mailserver to a co-lo and pay a few hundred bucks for space and storage. It wasn't a directed attack though (I think).

Problem is, there's *all* types of ways to count it, and no good standard for what constitutes an attack. I suspect a lot of the "attempts daily" figures in the thousands are sysadmins performing the equivalent of a general counting individual shots fired by the enemy in a battle.

In the fifteen years I've been IT conscious, I've observed a total of *three* REAL attacks directed at my systems. Hopefully I haven't witnessed more and failed to notice. I guess that indicates I'm at a pretty small shop/uninteresting target. But those "war" figures are probably a load of b.s.

Re:All this cyberwar bullshit

[HungryHobo]

as it stands any cyberwar launched by a government would be missed in the noise due to insignificance next to the legions of botnets, script kiddies, hackers, crackers and miscellaneous.

Re:All this cyberwar bullshit

[Squidlips]

Nice try at Chinese propaganda, but if it was only a bunch of bored teenagers then why did they try to steal information about Tibetan dissidents? Bored teenagers would be more interested in other targets.

Sorry, it was the Chinese government.

Re:All this cyberwar bullshit

[Kpau]

I certainly wouldn't dignify it as 'warfare'. Checked YOUR own logs lately (or do you keep logs)? Every IP is routinely "attackedf" a few hundred times a day. This is misuse of the word "war" as the "War on Drugs".... "We've always been at war with Oceania". Kudos for Schmidt. This was simply another instance of the previous administration talking out of its ass to further erode domestic privacy and create bogeymen while the *real* problems just saunter about.

Re:All this cyberwar bullshit

[Kpau]

Depends... there's a faction of Chinese (usually young) who are over-the-top irrational nationalists (fenqing) http://en.wikipedia.org/wiki/Fenqing They are exactly the type who'd chase down those who "demean China".

Re:All this cyberwar bullshit

[_Sprocket_]

You mean the one where hundreds of terrorist groups around the world affiliated themselves with each other and declared war on the US? The one where they vowed not to stop until, "The flag of Islam flies over the White House"? Yeah, I've heard of it. Just because some people would prefer not to think about it doesn't mean we don't have enemies hellbent on killing us.

Would that affiliation be Al Qaeda? And if so, why isn't it the "War Against Al Qaeda"? I agree with you that there is a real threat. But I have a problem with the general air around this so-called "War on Terrorism." A large part of that is how widely the term is applied. Identify a threat, label that threat (if you must), and handle the threat. Don't generate this general umbrella term that one can use to cover all manner of issues - related or otherwise.

Re:All this cyberwar bullshit

[EllisDees]

Did you forget a sarcasm tag?

No?

Wow.

Do you believe that any of these enemies have anything close to the ability to make that happen? The Soviet Union couldn't do it, and they had thousands of nukes pointed at us for 40 years. If you fear terrorism more than car accidents, you need to get your head checked out.

Re:All this cyberwar bullshit

[Anonymous Coward]

You know why the Soviets couldn't do it? Because they wanted to remain alive at the end.

Re:All this cyberwar bullshit

[oodaloop]

Uh, do car accidents have nuclear weapons? No? Didn't think so. Al Qaeda has gotten its hands on weapons-grade uranium (which really isn't that hard). Would you like to sit back and see what they do with it, or would you like to try to stop them?

Oh, and 9/11 didn't kill as many people as car accidents, but it did cause tens of billions in damage and exacerbate a recession for many years. They're proven that asymmetric warfare works and can have devastating effects with little investment on their part. They've also ramped up their attacks each time and warned us each time. And they've warned us they will use nukes on our turf. Yeah, car accidents are much more worrisome. We should make people wear seatbelts and put up clearly marked signs..oh, wait, we've done that.

Re:All this cyberwar bullshit

[corbettw]

Tens of thousands is nothing. The last time I worked on the frontlines, so to speak (now I support the tools that support the firewalls, rather than the firewalls themselves), at a medium-sized telecom company that shares a name with the OLPC laptop, we would get hit millions of times per day. And we'd shrug it off like it was nothing; because, well, it was nothing.

Re:All this cyberwar bullshit

[aztracker1]

I was mostly commenting on the severity. Of what is considered an attack vs. The gp imlying that something more typical or low kay not being an attack. A missile hitting a target being automated vs a person firing a rifle is still an attack even if automated, just differing severity/risk.

Re:All this cyberwar bullshit

[Jedi Alec]

Apparently it does work, because you are clearly willing to change your way of life because you feel "under threat".

Yes, 9/11 was pretty grim. Several buildings destroyed, a couple thousand people dead. Ofcourse a little while later the US attacked Iraq and blew up a lot more buildings and people. So should I be worried about terruhrists or about the next crazy leader in the US deciding he doesn't like *my* country? Sound irrational? So does changing how you live your life on the teeny tiny chance that some guy with a beard tries to blow something up when you happen to be near it.

Go back to being the home of the brave instead of a country of crybabies. If you change your life, the terrorists have already won. And while you're at it, get back some of those freedoms the terruhrists allegedly hate you for.

Re:All this cyberwar bullshit

[HungryHobo]

I'd look at it almost more like breathing in a virus vs someone trying to stab you.

both are attacks.
both could kill you.

but one is a sort of generalized low level risk for everyone and the other is someone being out to hurt you specifically.

Re:All this cyberwar bullshit

[EllisDees]

>Uh, do car accidents have nuclear weapons? No? Didn't think so.

Nope, but they have been, and will continue to be, far more deadly to Americans than terrorists. You can keep begging for big brother to keep you safe by occupying unrelated countries when that is what actually makes those people want to attack us. No, it's not because they hate our freedoms - it's because of our actions.

There is no cyberwar...

[H0p313ss]

... we have always been at war with Eurasia.

Re:There is no cyberwar...

[ixidor]

no mod points so here is your +1 funny

Re:There is no cyberwar...

[jwest]

Cyberwar is cyberpeace

Re:There is no cyberwar...

[BJ_Covert_Action]

Sounds like it's time to dust off the ol' Monroe Doctrine then. Do you think it would be taken more seriously in pdf or html format online? =)

Re:There is no cyberwar...

[newdsfornerds]

Your comment is doubleplus good!
Except that it would be East Asia.

Re:There is no cyberwar...

[H0p313ss]

Cyberwar is cyberpeace

Freedom is slavery, ignorance is strength.

Ain't that just China in a fucking nutshell.

Re:There is no cyberwar...

[Anonymous Coward]

I thought it was Eastasia...*konfused*

And he's right.

[ScrewMaster]

It's not a war if only one side is putting up a fight.

Re:And he's right.

[jimbolauski]

So that explains why the whitehouse banned the term war on terrorism.

Re:And he's right.

[DIplomatic]

I definitely agree. I make sure my house and car are locked and secure but I wouldn't say that I am waging a war against burglary.

Re:And he's right.

[maxwell demon]

Let's call it an asymmetric threat situation.

Re:And he's right.

[nEoN nOoDlE]

You would if you're trying to sell papers

Re:And he's right.

[city]

Or trying to convince the people of your neighborhood that your houses and cars are unsecure and that you are all losing war against burglary! Won't someone think of the children!

What a tool

[Anonymous Coward]

He's been in office THREE MONTHS and he's not only got a handle on this, but is proclaiming that nothing is going on. WTF?

Re:What a tool

[jimbolauski]

Well after the "CYBER SHOCKWAVE" exercise proved to be a failure, Schmidt must feel its time to go French on the cyber war front.

Re:What a tool

[camg188]

First line in the article summary:
"Howard Schmidt, the new cybersecurity czar for the Obama administration"

Re:What a tool

[_Sprocket_]

Well after the "CYBER SHOCKWAVE" exercise proved to be a failure, Schmidt must feel its time to go French on the cyber war front.

The "Cyber Shockwave" exercise was a farce.

This guy sounds out of touch

[onyxruby]

This guy sounds out of touch, like he is more concerned with the politics of appeasing China than the job of securing our country. Can we somehow get this guy removed from office for incompetence?

Re:This guy sounds out of touch

[jimbolauski]

Incompetence has never been a reason for dismissial in government why start now.

Re:This guy sounds out of touch

[Chris Burke]

I don't see how emailing your post to the white house could fail to do the job. I mean "sounds out of touch"? How can anyone read that and not know he's not suited for the job?

Seriously, focusing on online crime and espionage without re-engineering the internet to eliminate anonymity, instead of focusing on a Cyber-War buzzword with all the "but we're at war!" excuses for doing whatever they want? That's no way to exercise executive power! You're so right; how incompetent can you get?!

Re:This guy sounds out of touch

[jimbolauski]

The current administration is out of touch with the threat of cyberwar. When Russia invaded Georgia to control natural gas supplies Georgia's communications were shut down and mobilization efforts were hindered cyber war is an effictive tool and should not be dismissed so easily. The curent attacks on the US infrastructure are simply finding our many weaknesses and no matter of sticking our heads in the sand will stop it. The only way to stop it is to start taking a proactive approach, shoring up our weaknesses, and start doing the same to our enemies.

Re:This guy sounds out of touch

[Chris Burke]

The curent attacks on the US infrastructure are simply finding our many weaknesses and no matter of sticking our heads in the sand will stop it. The only way to stop it is to start taking a proactive approach, shoring up our weaknesses, and start doing the same to our enemies.

Huh, that sounds like a familiar sentiment. Where have I heard it? Oh yeah, TFA!

"We can't sit there and be waiting for the next intrusion attempts to take place," Schmidt said. "We need to become stronger in what we are doing so we are better able to resist the things that are being thrown at us."

Get it? "Shoring up our weaknesses" is exactly what he's talking about. What he's also saying is that you don't have to cry "Oh my god we're in a CYBERWAR!" and then use that to justify destroying privacy on the internet like McDonnel wanted to do.

Re:This guy sounds out of touch

[FlyingBishop]

That's not cyber-war. That's good old fashioned war. We are not at war with any technologically advanced power, there is no cyber-war.

Now, we should look at wartime cyber considerations, but looking at cybercrime will be far more productive, and probably yield lessons that will easily translate to a war.

Re:This guy sounds out of touch

[Anonymous Coward]

This guy sounds out of touch...

Maybe he's that way on purpose. Wouldn't be the first time a government spokesman was intentionally kept out of the loop. The rule is don't tell marketing anything you don't want the public to know. I'm sure the same rule exists in government.

Re:This guy sounds out of touch

[impeach]

"Incompetence..." This is such a dangerous assumption. Here's what Dean Baker recently wrote about the architects of the financial meltdown:

"The housing bubble and subsequent crash were the result of extreme incompetence on the part of the country’s top economic policymakers. Somehow these people could not see, or did not care about, the dangers of an $8 trillion housing bubble. Unfortunately, economic policymaking is not like most jobs where workers get fired when they make serious mistakes. In economics, they just keep getting promoted. Therefore, the people who sank the economy are for the most part the same group of people still designing policy today. Now this group of incompetent economists is telling the rest of us that we are going to have to endure five more years of high unemployment."

Yet we can know that they knew perfectly well what they were doing because they rewarded themselves with massive bonuses for the great job they did. Further, the global economic collapse and transfer of wealth to the elite is ocurring simultaneously around the globe - not as a domino effect. And remember, the first cyber security chief resigned, warning us of their plans for the coup.

Re:This guy sounds out of touch

[impeach]

maybe I should add, we know these guys are imploding the global economy by design, not because of incompetence. They insisted that they knew what they were doing and that the Congress did not, when they rushed the Banker Bailout bill through without allowing Congress a chance to work its full oversight. The Internet is the number one threat to their draconian designs. They have to seize and remake it.

Re:This guy sounds out of touch

[flappinbooger]

Sounds like you think you could do a better job?

Maybe you could. Maybe I could too. But would you want to do that job? It's like you'd be the president of the internet.

When some bureaucrat in washington gets a fake antivirus on their "secured" system, you'd get the blame.

"That onyxruby guy just isn't doing a good job. I've got a virus. I thought he was the cybersecurity czar. What does he do all day? Why isn't he protecting my hard drive? How could this happen? I'm going to write a scathing letter. He's been in office for three months now. How hard can it be? My nephew knows computers, he gets on that iTunes all the time and downloads those songs. He says all I need to do is go to Walmart and buy superduberspywareblaster for 10.99 and download that to my hard drive and take care of that virus. Now, there's this elected offical CZAR of all things, and I get me a virus on my hard drive. I can't play my Euchre now, I've got 39 trojans and 15 keyloggers and it says a hacker is stealing my passwords and credit cards. What is he going to do about it?"

Do you want that job? Besides, I don't think he actually does much on a computer at all, I think he's in conference rooms most of the day. Anyone have his credentials and background? Who's on his team? Does he have a team? What's the real purpose of that office, just generating policy? Is he just a posturing politician that knows how to spell TCP/IP? If you know something about "hacking" perhaps you'd be overqualified for the job!

So, wait...

[Androclese]

Are you telling me I planted my Cyber War Victory Garden and bought Cyber War Bonds for nothing?!

Re:So, wait...

[Anonymous Coward]

So tell me, who the hell do you have buried in the tomb of the Anonymous Soldier?

Re:So, wait...

[maxwell demon]

So tell me, who the hell do you have buried in the tomb of the Anonymous Soldier?

An Anonymous Coward, of course.

Re:So, wait...

[AndrewNeo]

I thought Anonymous was his name!

Re:So, wait...

[HungryHobo]

well played.

Re:So, wait...

[Anonymous Coward]

Anonymous Coward: I'm not dead.
The Dead Collector: 'Ere, he says he's not dead.
Large Man with Dead Body: Yes he is.
Anonymous Coward: I'm not.
The Dead Collector: He isn't.
Large Man with Dead Body: Well, he will be soon, he's very ill.
Anonymous Coward: I'm getting better.

Re:So, wait...

[Chris Burke]

Sadly yes, and not only that. Your HOA is about to come after you for having a bunch of PCBs sticking out of your yard.

***Hand Waive***

[bobcat7677]

There is no Cyber-War ...and these are not the droids you are looking for.

Re:***Hand Waive***

[Itninja]

Don't waive your hand! You're going to need it someday!

Re:***Hand Waive***

[ArcherB]

There is no Cyber-War ...and these are not the droids you are looking for.

But those WERE the droids you were looking for!
 
... and there certainly is a cyber war. However, it just falls under the espionage and sabotage categories. We have satellites and planes that specialize at electronic eavesdropping. We have *unknown* numbers of cyber spies constantly monitoring what emails and page traffic goes to and from what. Remember, ESCHELON is the one we in the public know about. How much is out there that we don't know about? How much of that is from other counties and pointed at us?

Re:***Hand Waive***

[Arthur Grumbine]

Hand waive? Well, if you're not using yours I guess I could find "uses" for an extra two.

We're on the cyber-frontier on the cyber-gan-trail

[BobMcD]

You can say there's no war because there's no structure. That's quaint. You're lying about it, if for no other reason that our own military's cyber 'forces'.

The risks are real and the burden is being carried by civilians. Just like it was out on the last frontier. Eventually larger and larger organizations will come into conflict and some will aptly begin to label that as 'war'.

Roll the bad analogies

[sakdoctor]

There is no war, but if you use IE, acrobat and flash, you are standing up in a front-line trench. It is only a matter of time before a bullet hits you in the head.

Ok, ratings out of 10 for this analogy.

Re:Roll the bad analogies

[crispytwo]

6/10

Not bad, but I think it would be more like matter of time before a bullet hits you in the hand.

There is no instant death, and probably you will just be really annoyed. And maybe if it happens again, you might do something about it to stop losing your finger.

From the general feeling I get, most people will let it happen over an over again, and try some additional software (armour), but not removing the culprit(s).

Meh

[Dracophile]

There is no spoon.

Re:Meh

[Anonymous Coward]

That's more apt at second thought than many might think...

It's not that there isn't something there that we can sense, it's that the construct as we describe it is completely fabricated by our own desire for narrative structure in life. We could easily divide "cyberwar" up into a number of other concepts and it would no longer exist in our reality. By comparison, spoons are a LOT harder.

Yeah, but...

[denzacar]

The chocolate rations went up.

A note for non-Americans.

[Anonymous Coward]

This is just a brief note to non-Americans, to help you avoid some potential confusion.

The following is from the article:
There's been much ink spilled in recent years over the turf battles in D.C. over whether the NSA (representing the military) or DHS (on the civilian side) takes the lead role in cybersecurity.

Keep in mind that in this context, "civilian" means "transnational corporations".

There is no backbone cabal

[Ltap]

Sounds familiar?

Fear is excellent for controlling people

[Anonymous Coward]

You don't need religion. You don't need dogma. You don't need issues.
They're all rooted in basic primal emotions..

You just need to instill fear in people, and they will give you that much more power, status and sex.
Best way to gain power and stop intelligent discussions is to start a war.

Thanks

[Anonymous Coward]

You've just given me an idea for Teenager Top Trumps.

Player1: Average fat +40kg
Player2: Average fat -30kg ...Awww

Player 1: Erm, Indoctrination 500
Player 2: Indoctrination 9000+
Woot!

Re:Thanks

[Jurily]

Are you suggesting Chinese are fat?

Re:Thanks

[Anonymous Coward]

I think the idea is that player 1 is the American hacker and player 2 the Chinese one.

Re:Thanks

[Anonymous Coward]

Woosh!

Re:Thanks

[Anonymous Coward]

Woosh!

All's quiet....

[tpstigers]

Does this mean that the Information Superhighway has NOT become the Information Western Front?

CyberWar becomes Fiber War

[GPLDAN]

The US owns the sea. the Chinese know this. Their sub technology is borrowed from the Soviets, and the Akula class is a barge underwater and it's all they got, and their Navy sucks.

The US has shown it possess the technology to splice underwater fiber cables and tap them. Google it, they've already done it in the North Sea.

And that is the trump card. China launches a major offensive against the world, they better have routes down through Korea, because every trans-pacific cable leading to the mainland will get cut in minutes.

Re:CyberWar becomes Fiber War

[HungryHobo]

http://www.rense.com/general64/fore.htm

There was an interesting war game played a while back: essentially it was nothing more than showing off how the US tactics couldn't ever possibly be defeated... which they proved by resetting the game after the opposing general "sank" most of the US fleet using nothing but a hodgepodge collection of small civilian boats.
Seems save scumming is fine even in war games.
The result was of course that the general playing the US side "won" since anything else would look bad.

...and at the same conference, FBI director says:

[daveschroeder]

FBI director warns of 'rapidly expanding' cyberterrorism threat

This "there is no cyberwar" business plays right into Singel's agenda that anything related to cyber war is really a conspiracy to kill the open internet.

All the "cyberwar" stuff may be overplayed, and no, we're not in a "war", per se, at the moment, but we are most certainly unprepared, as are many open, information-dependent societies...

Aptly?

[ink]

If it's a war, then the Constitution requires Congress to declare it. We have wars on poverty, drugs, terrorism; why do we need to further dilute what it means to be at war? I find Schmidt's comments refreshing; perhaps we could have a rational discussion about security without needlessly ratcheting up the fear machine. Traditionally wars had beginnings and endings -- that is to say, they had structure (not to be quaint). When we're eternally at war with concepts, it numbs the sentiment.

Re:Aptly?

[BobMcD]

You mis-read my intent with your well-meant objection to war on concepts.

I, too, agree with your disdain for those. I would likewise believe that China's government attacking a US corporate interest within our sovereignty would qualify as an act leading to a declaration of war.

I'm not saying we're at war with the concept. I'm saying if and when we're attacked by specific sovereign bodies this should qualify as acts of war just as if they were using tanks or bombs to do it.

I further assert that we know it is going on and we're not doing much about it.

Re:Aptly?

[ink]

I don't think this rises to the level of an attack on our sovereignty any more than our use of sattelite imaging and other espionage would be a declaration of war on China. If Congress disagrees, then they should declare war on China for these attacks. I personally know at least four people in "cyber security" for our government. Trust me, they aren't just sitting around doing nothing; they are actively engaged in both defensive and offensive systems engineering. If war comes of all this, then so be it -- but I don't think we should jump the shark with inflammatory labels.

Re:Aptly?

[Nerdposeur]

I find Schmidt's comments refreshing; perhaps we could have a rational discussion about security without needlessly ratcheting up the fear machine. Traditionally wars had beginnings and endings -- that is to say, they had structure (not to be quaint). When we're eternally at war with concepts, it numbs the sentiment.

I agree, but the fear machine has a short battery life. I was in the airport recently and saw that the terror threat level was orange. Ho hum, I thought. Orange should mean "more than usual." If the level is always something close to red, the whole system is meaningless. (Besides which, what the heck am I supposed to do if there's a code red - grab a gun and look for bombers?) I read "The Boy Who Cried 'Wolf!'" as a kid. Didn't everyone?

Re:Aptly?

[Anonymous Coward]

Don't forget Cancer. Poverty, Drugs, Cancer, Terrorism.

Re:We're on the cyber-frontier on the cyber-gan-tr

[HungryHobo]

In this case given that nobody is actually getting shot civilians in the form of sys admins and programmers are far better equipped to fight this one.
They're more numerous, they're just as skilled and they're on their home ground.

War against small...

[tarlss]

I think all that China is doing is not employing bored script kiddies. From all accounts these hackers have no day jobs. Our biggest online security threats come from people trying to trick folks into clicking links about viagra and SEE BRITTANY SPEARS NUDE!

Re:War against small...

[Anonymous Coward]

I think your links are broken, please repost

Re:War against small...

[gtall]

While Brittany Spears nude is certainly dirty warfare, I think what concerns the U.S. military most is that the Chinese bureaucrats running the asylum will think they'll be seen as having bigger penises if they invade Taiwan. The U.S. has a treaty to defend Taiwan. If we ever got into a hot war, there won't be any question of whether cyberwar will be part of it if nothing else than for Chinese hackers to keep the U.S. too preoccupied to properly respond. They needn't even be working for the Chinese government, just the usual bunch of nationalist nutjobs that went apeshit over China downing one of the U.S. fighters awhile back...and that's after they won one.

This is Good News

[interval1066]

This means we can fire Howard Schmidt since his position is not needed and we can put his salary towards the Fed. deficit.

War on X

[S77IM]

We had a War on Poverty, and poverty increased.
We had a War on Drugs, and drugs increased.
We had a War on Terror, and terror increased.

So, yeah, let's have a War on Cyber, and maybe cyber will increase too. Cybernetics? Cyborgs? Cyberspace? Cybering? I guess you take the good with the bad.

  -- 77IM

Re:War on X

[Anonymous Coward]

Just like Harry Browne used to say: "If we have a War on Abortion the way we have a War on Poverty and a War on Drugs, within five years men would be having abortions."

Re:War on X

[gtall]

Ah, you Sir get the Internet Award for Gratuitous and Absurd Use of Induction.

Re:War on X

[Anonymous Coward]

no Cybersex? :(

Re:War on X

[Ltap]

All we need now is a War on Sex. That's a cause we could ALL get behind, if these "War on X" trends continue!

Re:War on X

[bughunter]

Egad, then there must have been a secret War on Stupidity here in the US for the past 30 years.

I say it's time for a War on Peace!

Re:War on X

[Jedi Alec]

I put on my kevlar rob and reinforced wizard hat.

wat

[Anonymous Coward]

If only they could apply the same rationale to the "drug war".

He's right

[gmuslera]

In a war both sides are fighting... but so far, only the bot(net)s are attacking, and what the "attacked" front does efficiently is giving them more drones. Is not war, is harvest.

Yeah, right

[DoofusOfDeath]

The First Rule of Cyberwar is...

Re:Yeah, right

[impeach]

...to know friend from foe.

Re:Yeah, right

[jbezorg]

"never get involved in a botnet war in Asia"?

Wait, that's a classic blunder, not a rule.

Re:...and at the same conference, FBI director say

[houghi]

Watch out for the following: "They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety."

Let's see ...

[khasim]

What would you call a regular series of attacks on our military headquarters using computers, hmmm?

I'd call it "the daily life of a firewall". Seriously, check your firewall logs. Mine are being "attacked" every hour of every day and I'm not a military installation.

Re:Let's see ...

[Hurricane78]

Seconded. If you run something on it that tells a lot of people about your system, you will get ssh dictionary attacks, port scans, etc, 24/7. Even if it’s a small dyndns system.

Re:...and at the same conference, FBI director say

[DJoffe]

If you ask me, most of the rhetoric one hears from government officials is more about money than anything else; warning of a 'rapidly expanding cyberterrorism threat' is mainly scaremongering that translates to 'give us a bigger budget than ever'. Not saying there aren't vulnerabilities; certainly there are, just look at all the Windows botnets and viruses (and nowadays PDF seems to be a primary attack vector). If there was a "cyberwar" already being waged, it would probably already have been lost. But giving more money to some state department to employ a building full of people somewhere to 'tackle the problem' is hardly going to fix things like IE and Adobe's PDF reader.

There is no spoon!

[Anonymous Coward]

These aren't the droids you're looking for!

Re:...and at the same conference, FBI director say

[HungryHobo]

The internet is essentially a massive number of walled communities.
There is nothing that any potential adversary could do which isn't already being done by the botnet herders and we seem to be doing fine despite them.

In any case I see little or no way in which the government could do a better job than the current crop of sys admins.

"No Cyber(security) War" - Yeah, right. Impeach!

[impeach]

It sounds right out of When Mars Attacks, misdirection. We need Articles of Impeachment, before these people (run by the International bankers) can fully crash the global economy. Converting the Internet to their police state grid is just part of their plans. But while we can still communicate over the Internet, there is still time to impeach and throw a wrench in their plans.

IBM layoffs and coporate espionage

[FriendlyPrimate]

IBM has recently started directly laying off American developers and replacing them with Chinese developers working in the "CDL labs". They're doing this for code designed to run on System z mainframes, such as Rational HATS (half the team just moved to China in the past couple of weeks). The main reason why companies use System z at all is because it's supposed to be ultra-secure, and therefore it is used for the most sensitive of processes (like banks, etc...). How unrealistic would it be for a Chinese developer (either willingly, or coerced by the Chinese government) to plant security holes in IBM mainframe products? They did it with Google...isn't it logical that they'd also be trying to target IBM? It scares the heck out of me thinking how many Fortune 500 companies that use System z for their ultra-secure mainframes might be getting exposed to Chinese corporate espionage.

Re:IBM layoffs and coporate espionage

[Anonymous Coward]

I know the IBM Rational HATS team and product manager - just spoke with her today. Their development is still in RTP North Carolina and not moving over to China. They do have some QA analysts there though.

Constant break-in attempts not aggressive actions?

[zerosomething]

So does he just not getting the data from his IT people on the constant SSH scans and Remote Desktop attacks aimed at every computer on the network?. And we are suppose to think this isn't a concerted effort by foreign entities to take over US government property and steal information? I guess it's just a bunch of vitamin 'D' deprived adolescents doing it.

Anonymous Coward

[Anonymous Coward]

This is just a prelude to cost cutting. No cyberwar, no funding required.

NOBODY EXPECTS the ... GOOD GOD, WHAT IS THAT?!!!!

[Thud457]

just wait until they run into real missile-toting kangaroos!

News for Paranoid Cynics

[AP31R0N]

The problem with kneejerk cynicism and paranoia is that if (when) there is a real threat we might not be prepared to respond to it. We might choose to not respond. Maybe the boy shouldn't be crying wolf so often, but the village should at least think about what to do when the wolf comes calling.

Let's take as a given that there is no cyberwar. Does that mean that China, Russia and anyone else with an interest in hurting the US isn't working on a plan to attack us? They might be able to keep a secret. The plans we make to thwart a cyber attack might be useful in dealing with some unforseable problem.

Are we pretending that the internet is unimportant to our economy and culture just because we don't trust anyone over 30?

If a panel of Hitler, Stalin, Pol Pot, George Bush, a box of hair and Jeffrey Dahmer advised us to look both ways before crossing the street it would be good advice. We shouldn't dismiss what the gov't says out of kneejerk mistrust. Even if the gov't is out to get YOU (unlikely), they might be right about something anyway. Sure, we should question their motives and approach but on the merits of the claim... not by "is he wearing a suit".

Now if only...

[Hurricane78]

...he would re-release that same statement, with:
s/cyber.?war/terrorism/i

Then we would start to get somewhere... and maybe fix more important problems.

Re: Where are your sources?

[Anonymous Coward]

What amateurs use zero day exploits alongside rootkits? Tailoring their hacks to specific companies?

You should read the security considerations from iSEC https://www.isecpartners.com/files/iSEC_Aurora_Response_Recommendations.pdf regarding the "Aurora Response Recommendations". The truth is that every organisation has some people that are a liability on the internet.

Apparently Google found over 30 companies had been totally compromised - and over 100 had been targeted. Of course it's probably not the same gang, as Gary McKinnon said, there are loads of people from all around the world hacking into insecure systems. Some for fun, some to see secret / privilledged information.

Of course the new guy says, don't worry folks everythings OK, there is no war. That is because hacking is not about distruction, it's about knowledge. In the right hands, knowledge really is power.

Idiocy knows no boundary...

[Anonymous Coward]

Hmmm... State sponsored attacks, carried out from known state funded locations, with state controlled hardware, by personnel under the direction and pay of representatives of a state - what the heck other definition does one need?

Of course, this is the administration that doesn't see attacks on the US from a group funded by other governments as a war either, so I guess I shouldn't be surprised.

The military generally calls a spade a spade, so they will see it for what it is, a war. Just one in which no one has directly been killed - although we'll conveniently close our eyes to that pipeline that blew up because someone monkeyed with the sensor feedback mechanism...

No Cyberwar ?

[Hymer]

Just like there was No Such Agency back in the 1950'ties and 1960'ties ?

Re:Constant break-in attempts not aggressive actio

[Anonymous Coward]

It's more like this shit has been going on since the public internet exploded in 1994. (Actually before that even.)

What we really need is a more security conscious culture and more competent and caring admins in the govt. Not some attempt at eroding privacy and giving control to some politicians. (As that cyberwarwafe simulation attempted to convince us we needed.)

There was once a time in the 80s where one guy w/ a bug in his experimental self replicating worm code brought the entire internet to it's knees. There's always been people running attacks on various hosts on the internet and it will only grow as the technical competence of the world increases over time and as the population grows and there are more bored teenagers and full blown asshats out there.

"The Boy Who Cried Wolf", indeed.

[mister_playboy]

As a matter of fact, the Homeland Security Advisory System has never been set to either of the two lowest (out of 5) levels.

It's nothing but fear-mongering.

We're not at cyberwar

[OrwellianLurker]

America's infrastructure is under attack-- but it isn't an organized attack. Admittedly, some hackers have government ties. I'm more concerned about the ones without government ties. While China might hack to steal secrets, which is intolerable, but just another form of espionage common between countries, hackers without loyalties to countries can wage unrelenting attacks on our infrastructure.

So what do we do? We improve our fucking infrastructure. China is not going to attack our infrastructure and attempt to kill Americans and cripple our country. Why? For starters, they'd lose the money they invested in us. Additionally, their economy is hugely dependent on us. If America falls, China and most of the developed world falls. Lastly, how would America respond? In all likelihood, with nuclear weapons. Our best bet is to improve our infrastructure and when we trace back hackers to a government, we retaliate just as we do in all other forms of espionage- with political and economic sanctions.

Good ol' politicians spreading FUD. The stakes are higher, but the problems are still the same at the core.

'There is no cyberwar'

[Wodin]

Peace in our time?

FBI Report

[Anonymous Coward]

An official report released Friday said the number of attacks on Congress and other government agencies had risen significantly in the past year to an estimated 1.6 billion every month.

Only a war if both sides can fight

[SgtChaireBourne]

C'mon. The jackass is hired to be Microsoft's number on apologist. His office can now be abused to cover the situation up. If he admitted to the cyberwar that has been going for two years at least, then he'd open the door to an investigation of the situation the US finds itself in and how it got there. He and the other Microsoft party members would find themselves in very hot water, fast.

Besides, with all the Microsoft products permeating even military bases, it's not a war it's nasty beating.

It's only a war if it's possible to fight back. The US is permeated with Windows, which is a system designed to be taken over back door or outright bad design security hole. There's no reason why any Microsofter, from your average asshole MCSE on up to the party chairman Bill Gates should be walking free. It's one thing for them to be racketeering and destroying the US' ability to compete in research or industry. It's an entirely additional problem once it affects national defense and standing. From Bill's party, we've already had a sampler of navy ships dead in the water, power blackouts, disaster recovery clusterfucks, air traffic outages, and many hundreds of billions of malware damage.