Cyberwar Myths

The Washington Post published an opinion piece today on some common misconceptions about the endless cyberwar we have been in for years now.

Myth 1 - Cyberwar is overhyped and impossible: Contrary to the myth, cyberwar is both real and possible. It does influence geopolitical conflicts contrary to the myth. The common argument that squirrels cause more blackouts than cyberattacks is based on flawed reasoning. Very few cyberwar attacks are intended to cause blackouts or power plants to explode. Instead, most are designed to quietly obtain information or conduct espionage. Some do cause physical damage, but that hasn’t been the main focus so far.

Myth 2 - Cyberwar is mostly about big, destructive attacks on infrastructure and military targets: That is false. As noted above most cyberattacks are designed to quietly obtain information or conduct espionage. The WaPo comments: “Consider, for example, the extensive Chinese economic and military espionage campaign that has hit thousands of American firms and government agencies, prompting the Defense Science Board to warn that more than two dozen U.S. weapons systems have been compromised. Or take Russia’s activities in 2016. Those hacks did not do physical damage to a single computer yet injected themselves into the core of the American political debate.”

Myth 3 - The purpose of cyberwar attacks is easy to know: This is a big issue. WaPo writes: “The motivations behind other very destructive cyberattacks, like 2017’s NotPetya and WannaCry operations, remain opaque. In still other cases, like Russia’s 2018 operation against the Olympics in South Korea, nations have seemed to try to disguise themselves with false flags — the opposite of clear signaling.”

An excellent current example is Russian interference in the 2020 election to help Bernie Sanders. The Russians could be doing that to help the democrats nominate the candidate they believe the president has the best chance of winning against. Alternatively, they could be doing that to exacerbate divisions within the democratic party, making whoever is nominated weaker against the president. They could even be doing that to poison or discredit the Sanders campaign in the belief that Bernie would be a seriously threatening candidate against the president.

Myth 4 - A cyberattacker’s identity cannot be determined: This is also an important myth to dispel. WaPo writes: “In reality, governments like the United States are very good at figuring out who conducted cyberattacks, in part because they use their own hacking capabilities to spy proactively on other nations’ hackers. Even outside of classified settings, there is a robust private sector of industry analysts who study cyberattacks and piece together clues about who perpetrated them and how; examples include studies of Russian information operations, Chinese economic espionage, North Korean bank hacking, Iranian attacks on Middle East rivals, and U.S. espionage and counterterrorism hacking. From these sources, it’s possible to put together clear, convincing and compelling narratives of the past 20 years of cyber-conflict — and to find some great stories of spy vs. spy competition in the digital age.”

Many Americans still falsely believe that the Russians did not provide any significant help in the president winning the electoral college in 2016. The president himself continues to assert this blatant lie. To make matters worse, he is now acting to squelch the flow of information about current Russian election interference the from the US government to the public. He believes it is not in his interest for the American people to know what foreign adversaries are doing to US elections. Since the Russians are acting to help the president get re-elected, his attempts to squelch information flow to Americans is completely understandable. This action is full in accord with the president’s view of how politics should be done for his benefit, even if it damages democracy and the rule of law.