Inside the new era of warfare: Exploring the 'cyber arms race' with Mikko Hyppönen

Not many security experts like the term 'cyberwar', and Mikko Hyppönen used to be one of them. But in the wake of recent attacks on critical infrastructure in Ukraine and a rise in the sophistication of nation-state hacking, something changed along the way.

"I have changed my opinion about cyberwar," Hyppönen told IBTimes UK. "I used to hate the word and I would always explain to people that whenever you hear or see headlines about cyberwar it's never war – it's typically spying or espionage – which is not war. Even if its nation states doing it, that's not war."

Hyppönen, who has been the chief research officer at Helsinki-based security firm F-Secure since the early 1990s, is well known in security circles for both his knowledge of malware and programming, and his straight-talking attitude when it comes to issues relating to state-sponsored spying, hacktivism and cybercrime.

He told IBTimes UK it was the hacking incident in Ukraine last year that changed his mind on the nuances of the much-criticised term. "When you look what happened in Ukraine, when you have two countries that are at war and you have an attack on critical infrastructure that is not stealing anything, but [instead] shutting down power for 200,000 people, that's not espionage, that's not spying – in my book that's cyberwar," he says.

To this end, Hyppönen believes we are now "at the very beginning of the next arms race". This – he argues – will bring clear advantages for the governments large enough to conduct cyber-operations, although it could mean trouble for the citizens caught in the middle.

"We have just got out of the last arms race, which was the nuclear arms race, and now we are entering the next one and it's in the very beginning," he says. "The benefits for governments are very clear. It's cheaper, it's more effective and it's easier to target than traditional attacks. Traditional attacks are not going to go away, they are just going to be additional – just like we saw in Ukraine, it's now part of the picture."

This stance on cyber-operations bolstering traditional wartime techniques is evidenced by the evolving public position of the US military. Most recently, officials admitted to deploying cyberattacks against the so-called Islamic State to disrupt the communications of those planning terrorism. The UK, meanwhile, is rapidly pouring money into cybersecurity schemes.

"One of the reasons governments like [cyber-ops] is because they are deniable," said Hyppönen. Referencing the legendary 'Stuxnet' virus that was deployed in an Israeli-American operation and used to sabotage Iranian nuclear ambitions, the F-Secure expert said that attribution is always a problem – even if the culprit can sometimes seem obvious. "With Stuxnet, I mean, everybody knows it was the Americans but we can't actually prove that," he said. "And that's exactly what they want – it's deniable all the way to the end."

"We are not supposed to f**k with those people"

The evolution of cyberwarfare has a number of key differences to the nuclear capabilities that came to define the Cold War era, Hyppönen believes.

"The biggest difference between this arms race and the previous arms race is that the power of nuclear weapons was in deterrent. You knew who had the nuclear weapons. There are still today countries that have nuclear weapons, including the UK. You know who they are because the countries that do have them conduct nuclear testing. So then you know 'we are not supposed to f**k with those people'. It's a deterrent. In this arms race, that doesn't work at all," he says.

As such, this new landscape is constantly shifting and unpredictable. "What is the cyber arms capability of, say, Argentina or Vietnam? We have no idea," he warns. "We are in the dark, so the power of cyber arms is not in deterrent, it's in actual use of the weapons."

Indeed, some nations, such as North Korea or Iran, have continued to ramp up use of cyberattacks in recent years. The hack at Sony Pictures in 2014 or the breach of the Office of Personnel Management (OPM) last year are only two examples of the sheer devastation a successful cyberattack can cause.

Looking forward, Hyppönen believes we will eventually need a cyber version of the 'Geneva Convention' to regulate the use of technical warfare – and even rules around cyber-disarmament. "One day we will have things like 'when you use cyber arms to attack an enemy the malicious software attacks must not work forever' or rules like when you are in the real-world saying 'you must wear the uniform and wear your flag'."

For now though, things are likely to get worse before they get better. Hyppönen warns, "All these things are way in the future."