By Robin Newman-Grigg
The days of marching troops or driving tanks to an empty field and exchanging fire are nearing an end. Today, nations are more economically interconnected than ever before, and conflict carries the guarantee of pain for their citizens. Conventional wars between major powers that involve destroying and killing risk too much. Nuclear weapons make the thought of a major war between great powers virtually inconceivable.
In the 21st century, kinetic war has evolved into something much different: Today, we begin fighting in the shadows. The wars that Canada and her allies fought in the hills of Afghanistan and now fight in the skies of Iraq bear no resemblance to the days when war was formally declared on other states.
Kinetic war, it seems, has turned into global police work, with Canadians deployed to fight piracy around the horn of Africa and running counter-terrorism missions in the Arabian Gulf.
Guns and bullets will no longer be used to control land, sea, and air; we are now fighting a different war, whether we are aware of it or not. When it comes to enemy states, the West fights cyber wars for control of the cyber domain and the systems that reside in it.
If a nation’s roads can be compared to the veins in our bodies, the cyber domain is our nerve cells. According to Rafal Rohzani, principal of the SecDev Group, cyberspace is “a synthetic domain that we’ve created that impacts on all our other domains in terms of where we operate.”
So far, we are on the defensive and remain vulnerable.
“We’re not England, where ultimately things can move from one end of the country to the other end by lorry. We’re talking about a country that spans one-sixth of the world’s surface, where if communication becomes unreliable, or fails at any level, Vancouver and St. John’s may as well be on different planets,” Rohzani says.
Last June, for instance, officials with the National Research Council (NRC) said the Communications Security Establishment Canada (CSEC) had detected a breach in their systems. Following this news, the Government of Canada attributed the incident to the Chinese government.
What is most surprising about the NRC attack isn’t that sensitive government systems were broken into (again), but rather the degree of certainty that accompanied the blame. What makes cyber war so attractive as a tool is that it not only costs less than a fighter jet, but it also allows the attacker to remain relatively anonymous. The Canadian military can’t fight a war when they don’t know the attacker, and that has made us vulnerable.
“The challenge the West has is we are extremely sophisticated. Our economy is very much dependent on having all of our systems working well,” says John Adams, Adjunct Professor at Queen’s University.
But who is in charge of defending those systems in Canada, you may ask? Who is fighting our cyber wars?
The best answer to that question is “our military,” but it’s not really that straightforward.
Dubbed “network operations,” or NetOps, the Canadian Forces are indeed preparing for cyber war in the fifth combat domain, but it’s not secret that much work remains to be done. In a 2013 interview, Brigadier-General Greg Loos said, “we are aiming to operationalize the cyber domain and that will ultimately yield a range of capabilities.”
Meaning, of course, that the cyber domain has not yet been truly operationalized and that until it is, the capabilities of the Canadian Forces in cyberspace will remain limited.
“I’m not sure that the DND knows for sure how to address the issue,” says Adams. “They’re doing an awful lot of thinking.”
The main challenge the CAF seem to have trouble overcoming is policy. Attempts thus far to bring cyber war under the national defense umbrella have been bogged down by semantics.
Consider the word “war.”
“Nobody really knows what cyber war is yet,” says Adams. No one has ever died in a cyber war and rarely are objects physically destroyed, so is it really a war?
Rohzani says “the reality is that in most instances, the use of cyber falls outside of the definition of formal warfare.” This is the crux of the issue. State-to-state war is becoming informal, and militaries are struggling to understand their place in this brave new cyber world.
While the CAF debate whether (and how) to get involved in the cyber domain, cyber war rages on. Call it network operations or hacking, bloodless wars are being fought every day for control of the cyber domain and, as we saw last issue, threaten the nation’s ability to conduct business and defend itself.
“We have pretty well all of our critical infrastructure connected in one way of another to a common telecommunications infrastructure, it’s relatively centralized in this country. Invariably, the risk of a cascading failure can be pretty critical,” explains Rohzani.
Yet, progress on cyber war remains slow.
In 2007, the Idaho National Laboratory conducted an experiment now known as the Aurora Test, which showcased exactly how a cyber attack could, through manipulating circuit breakers, cause a diesel generator to shake itself apart.
This is the trend. Increasingly, cyber war is becoming about generating effects in real space through the cyber domain, rather than purely within cyber space itself. Using their control over the cyber domain, attackers can cause physical damage to hardware. It may not have the grandeur of a bomb explosion, but the same result is achieved. If an enemy aircraft dropped a bomb on the Canadian power grid, would that be sufficient to label it an act of war?
Granted, this picture may seem bleak, but Canada is not completely without her cyber defenders. “There is no debate who is responsible for government systems and for any system the government considers important. It is CSEC,” says Adams.
CSEC is responsible for, among other things, gathering foreign signals intelligence as well providing the government with advice and services aimed at protecting its networks and information. CSEC responds to attacks and intrusions, and is far better equipped to do so at this juncture than the CAF.
CSEC is not a military organization, and it has a relatively small percentage of uniformed personnel in its employ. The American National Security Agency (NSA), for instance, is approximately 50 percent civilian and 50 percent military, and is run by a four-star general.
Yet, despite dealing with attacks attributed to China and hacking into foreign governments, CSEC denies being involved in any cyber war. “Canada has no policy for offense,” says Adams. “Right now, there is nobody with authority to retaliate in that area. Even active defense is tricky. Active defense could easily be interpreted as an offensive act.”
While policy challenges continue to hold back meaningful progress on the cyber war file, the chances of being attacked are increasing at an escalating rate. Because it is so difficult to assign responsibility to a specific entity for a cyber attack, the use of cyber weapons is becoming more attractive.
During the Cold War, everyone knew who had the nukes; if they were used, we knew who used them. This allowed for strategies around mutually assured destruction to take shape. There is no mutual assurance of destruction in cyber war, since we cannot attribute blame with certainty. As long as the response to cyber attacks is weak, and as long as the costs associated with carrying them out remain low, hitting first and hitting hard with cyber weapons is the rational move in a conflict.
“We’re really talking about technical operations occurring within the cyber domain, occurring at a threshold below that which would be considered to trigger laws of armed conflict,” says Rohzani.
This means that, as cyber weapons develop, we may find ourselves incapable of mounting a defense or retaliation. Without competitive offensive capability, or even a serious mandate for it, Canada is being left behind in this new domain.
Thankfully, there are at least some things in cyberspace going our way. Like nuclear weapons, on a purely technical level, Canada has the ability and talent to generate capable cyber options. The same things that incentivize the use of cyber weapons by small and middle state powers apply to Canada as well. If we chose to project power in the world, cyber would be the way to do it.
At the end of the day, defense in all areas is about both defense and offense. When it comes to cyber, a good right hook may be more useful than a block.
Let’s hope DND agrees with that sentiment sooner rather than later, because whether we like it or not, war is changing.