Smaller Nations Will Play Bigger Role in Cyber Warfare

A cyber security expert believes the coming cyber-wars will see the playing field levelled and traditional superpowers threatened by relative minnows.

Things were a lot simpler in the good old days of tanks, guns and planes, when you could judge your superiority - or otherwise - over your enemy simply by counting. Things are a lot different in cyberspace.

Trying to second-guess your enemies' cyber capabilities is an exercise in futility. Not only is it impossible to tell just what levels of resources your traditional enemies are putting into their cyber defensive and offensive strategies, threats from smaller countries previously not even on your radar will become just as much of a threat.

"There are a lot of open strategic military cyber questions in the world today and everyone is looking for answers," Jarno Limnéll, director of cyber security for Stonesoft, told IBTimes UK this week.

Limnéll says that suspicion is driving spending on cyber security to ever higher levels, with traditional superpowers like China, Russia and the United States all at the forefront of cyber-weapon development. The problem is, unlike traditional warfare, more resources does not necessarily equate to more power in cyberspace.

Smaller nations, traditionally side-lined in global conflicts, can now announce themselves on the world stage by simply finding a highly-skilled computer scientist who is more interested in money than doing the right thing.

Hackers

Limnéll has seen some hackers align themselves along patriotic lines, but he is also seeing the rise of the hacker-for-hire where talented hackers are touting their skills to the highest bidders.

The result of this trend is that smaller countries who can attract one great hacker suddenly become a nation to be reckoned with on the world stage. This trend will shift a seismic shift in the way power is distributed according to Limnéll.

He "strongly believes" that the traditionally "strong powers in the physical world will not control in the same way the cyber world." While he says that resources still matter, it is not the single defining factor in who has the upper hand.

Limnéll says the way nations deploy arms in the physical world and in cyber space will be completely different.

If for example the UK was looking to invade France and the UK had at its disposal a single highly-sophisticated tank or 1,000 regular tanks, the British Armed Forces would choose to use the 1,000 tanks.

The opposite is true in cyberspace says Limnéll:

"I don't want 1,000 average hackers, I want one excellent, talented hacker and this is the one issue I have seen in every part of the world, everyone is looking for this one hacker."

Shifting ground

To highlight the shifting ground in world politics, Limnéll talks about his own country, Finland, which is not renowned as being a major power in terms of traditional military capability. However the country has a strong heritage of technical capability and it "might even have capabilities in cyber that not even the great Russian state has."

To be a credible power in the world today there is no doubt that a strong cyber strategy is needed, and this means having offensive as well as defensive measures in place - something Limnéll believes many European nations simply don't want to address.

"In France, or even Finland, we cannot speak even at a strategic level [about] offensive cyber capabilities," Limnell says. It seems European sensibilities make hacking someone's system's taboo, a sensibility not shared by more of the rest of the world.

The European approach is in stark contrast to the US, where the Pentagon freely admits it is building cyber weapons, openly advertising for offensive cyber-weapons developers. The Pentagon has integrated cyber so much into its way of operating that is now has "formal career paths for civilian and military personnel who engage in offensive cyber actions."

Awareness

The past year has seen a huge increase in the awareness of cyber security, with terms like cyber-war and cyber-warfare being bandied about without much thought.

The majority of security experts believe we have yet to see the situation escalate as far as warfare, but what we have seen is a huge escalation in cyber-espionage and even a couple of incidents of cyber-sabotage.

President Obama this week as careful to play down the current situation:

"You always have to be careful with war analogies -- there's a big difference between them engaging in cyber-espionage or cyber-attacks and, obviously, a hot war. What is absolutely true is that we have seen a steady ramping up of cyber security threats," he told ABC in a television interview.

Limnéll says 2013 will not see the beginning of a full-scale cyber-war but this reality is not that far way. He believes that within the next two to three years we will unfortunately see an attack with "cataclysmic" results which could be the trigger for a cyber-war.

Warfare

Cyber is already part of modern warfare, usually deployed before any physical attacks take place. Limnéll points to a leaked document outlining a potential attack by Israel on Iran where the first wave of attacks were going to be in cyberspace, taking out Iran's critical infrastructure.

Asked about the current cyber capabilities of the UK, Limnéll said that like all nations it is hard to say with any degree of accuracy, such is the secrecy surrounding these developments. What he did say is that in relation to the top cyber nations (China, Israel, US, Russia) the UK is lagging behind somewhat.

However compared to its European counterparts such as Germany and France, the UK is at a similar level. Limnéll added that there is a huge opportunity for the UK to take a lead in Europe and become "a driving force for the whole of the EU."

The security expert who holds a doctorate in military science believes the example shown by the UK in how it has integrates its cyber security teams should be a blueprint for other countries.

The operational, strategic and technical teams dealing with the UK's cyber security are all located in the same offices which is the best way to approach the matter Limnéll believes:

"When you have this mix [of departments] it is the very best approach to the problem."

Limnéll concludes by saying that as well as building the capabilities, in order to use these cyber-weapons you also need intent. So far nation-states like China, the US and others have not shown that intent, but considering how cheap it is to build one of these weapons relative to building say a nuclear weapon, it may not be long before these cyber weapons get into the wrong hands.