Slashdot Mirror
Measuring China's Cyberwar Threat
An anonymous reader writes with this excerpt from Network World: "A lengthy report prepared for the U.S. government about China's high-tech buildup to prepare for cyberwar includes speculation about how a potential conflict with the U.S. would unfold — and how it might only take a few freelance Chinese civilian hackers working on behalf of China's People's Liberation Army to sow deadly disruptions in the U.S. military logistics supply chain. As told, if there's a conflict between the U.S. and China related to Taiwan, "Chinese offensive network operations targeting the U.S. logistics chain need not focus exclusively on U.S. assets, infrastructure or territory to create circumstances that could impede U.S. combat effectiveness," write the report's authors, Bryan Krekel, Patton Adams and George Bakos, all of whom are information security analysts with Northrop Grumman. The report, "Occupying the Information High Ground: Chinese Capabilities for Computer Network Operations and Cyber Espionage," focuses primarily on facts about China's cyberwar planning but also speculates on what might happen in any cyberwar."
In computers and network security, every time someone uses 'cyber' in a serious, unironic manner, they lose credibility.
TFA uses it 9 times.
Our newest 'threat' we need to throw money at to 'combat'.
Instead of ohhhh... i dont know... not connecting important shit to the internet...
What's it gonna be called.. Thats the big question. 'War on Cyber' Doesnt sound catchy enough.
This is what I would add:
All speculation is geared toward ensuring that the report's authors
or their agents are beneficiaries in any efforts the US government would take to "mitigate" any China factor(s).
There are many different tasks and functions for which the military and government agencies use the public/commodity internet. There are also various levels of private networks for more sensitive requirements.
None of that, however stops the NSA from operating under the assumption that its networks are compromised.
Brookings just put out a great paper on a related topic, Cybersecurity and U.S.-China Relations (PDF). It's worth a read.
I'm sceptical of how much damage 'cyberwar' can really do sustainably. I suspect it would be a bit like Pearl Harbor - you make enormous damage the first day with a surprise attack, but it goes downhill from there.
I mean, I'm sure that the first day a lot of computers will go offline, and even factories will stop, etc. But what happens after a month when those computers have their OS reinstalled - with Linux or a commercial UNIX, or even, zOS if need be, and the data you've deleted has been restored from backup CDs, and everywhere there are billboards on the road proclaiming that whomever isn't updating their computer is giving Hitler a drive. Would it be as easy to go on inflicting damage then?
Has anyone in the US Military stopped to notice what critical supplies are manufactured solely in China today? I do not mean just armaments, but stuff that the US military would be utterly unable to move without. Stuff like light bulbs. Fuel filters. Glass containers.
Simple little things that the last US manufacturer closed down for either recently or as far back as 1980.
Do we still make toilet paper in the US? I suspect there may only be one factory that does and it will probably close down soon. It is much cheaper to have it made over there and shipped here.
We cannot possibly win a conflict with China - they would cut off our supply of manufactured items and the military would just grind to a halt.
Sure, they could probably shut down a couple of factories making classified munitions, but who cares? They figured out that troops don't fight without toilet paper in WW I and trust me, it hasn't gotten any better. They cut off our supply of toilet paper and the US population would storm Washington and demand an end to the conflict immediately. I am not kidding here.
One the things TFA mentions is how many of the targets wouldn't actually be military, but rather civilian contractors which the military needs to run day-to-day operations. This isn't a computer security problem, it's a cultural problem. The contracting / privatization craze has hit the military in a big way. I know this will sound like old-soldier grumbling, but when I was in (late 80s to mid 90s) we didn't have this problem, much. We had plenty of civilian contractors around, sure, but combat-critical logistics and maintenance functions were handled by people in uniform. Now we have a situation where units engaged in active combat can't function unless civilians who are not under oath and are not trained for the situation (and who are often paid much, much more than soldiers used to be to perform the same jobs; the "privatization saves money" argument is complete bullshit) decide to show up for work that day. The military needs to be able to handle its own operations in a war zone, and right now, it can't do that.
The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
"may" employed about 100 times ( order of magnitude, I lost count ). "would" exactly 59 times, in 109 pages of text ( not counting the appendix and refs/bibliography part).
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
Another (highly upstream) impediment to combat effectiveness is a change of attitude away from combat-based resolution. O, to have hackers so skilled, from any nation, that yang may cede to yin, at least for a few years, in our lifetimes...
(end lament)
Mod me double plus idiot if you will, but in our small company, our "critical computer" - the one hat has files I don't want to loose (yes, i do back ups), and the one I don't ever want hacked, it is NEVER connected to the internet. No wifi, no bluetooth, no cable, nada, zilcho. I even have independent power supply aside from plugging it into the wall.
Anything I need to introduce into the computer id done by a freshly formatted USB, and double checked and scanned first on a different machine running linux. When not in use, I physically turn it off and disconnect the power supply, and if the hackers can get into a machine with no power, well, I;ll just go back to pen and ink at that point. :)
Now seriously, I know you cannot turn off a computer that is running a nuke plant or a NORAD radar system, but why are so many critical systems connected to the internet? Or have online access of any kind? Back in the good old days of BBSes when I was a sysop and upgrading form a 9600 baud modem to a 28,800 like like a miracle (you know, this was back way when dinosaurs still roamed the earth, or so my kids see it as such :) ), the quickest way sometimes to block a hacker attack as to physically disconnect the phone line from the modem.
Again, mod me super simplistic idiot, but if I were operations manager for a nuke plant, and a major cyber attack was underway, to prevent a meltdown, wouldn't you be tempted to just take a pair of wire cutters and snip the physical connection to the internet?
Viktor Suvorov, "Inside the Soviet Army"? The laugh-or-cry gallows humour in that book is absolutely brilliant. You really feel with the author. It reminded me about Solsjenitsyns unsentimental yet gripping descriptions of the gulags.
Emotions! In your brain!
All of this talk about China winning any kind of conflict is hocus pocus. What China could do is cause a severe amount of damage to cyber infrastructure and repel any occupational force on the mainland. What they could not do is reach beyond their own border militarly, aquire enough energy to wage war, or find access to friendly markets once the war started. China may be a big economy but without the support of the world European and Japanese powers they would have an awful hard time keeping a stable economy. Additionally large swaths of the interior of China are in fact recent acquisitions(occupations) with populations just itching for a chance to strike back at the ethnic Han Chinese. The US arming the muslims and tibetans could create hell for China at home. Compare this to the strategic position of the US with its unabated control of all oceanic routes, being surrounded by mostly friendly nations, having a solid energy supply, and no significant domestic threats leads me to think the long term strategic implications for Chinese aggression are abysmal. Cyber war could be shut down quickly with the destroying of communications networks in china with EM weapons if need be.