August 10 (Originally posted by Mischa)
The Russian effort in Georgia has a powerful ally: hackers. (You were expecting maybe bear cavalry?) Several Georgian state servers, as well as the websites of the Office of the President, Ministry of Foreign Affairs, and Ministry of Defense have been hijacked, starting weeks in advance of the outbreak of war. The main government website is still down as of 10 AM today.
The specifics of the cyber-arms race are over my head, but Defensetech has a useful blurb on Russian capacity. It is difficult to fit these developments into conventional frameworks, as the lines between the state and private citizens are extremely blurry. Sixty percent of Russian cyber-crime, from porno to politics, runs through the shadowy Russian Business Network. RBN is essentially a hosting service for criminals. Moscow’s line on RBN has not been reassuring: “RBN doesn’t exist; well it does, but in England.” At one point, it disappeared outright. While formally a non-state organization, many tech and defense bloggers believe RBN is at the very least protected by political allies. Obviously it is near-impossible to conclusively prove such cloak-and-dagger allegations. That said, FSB ties would hardly be surprising.
The best-known cyber-attacks before this came in 2007, when Russian hackers hit Estonian websites to protest the removal of a Soviet-era statue. The Kremlin denied responsibility, and the attacks were eventually attributed to an “online flash mob.” The ringleader was caught, and fined $1,600. While the attacks were disruptive, they were small potatoes compared to the political chaos that could result from hacked elections. (Maybe not today, maybe not tomorrow, but soon.)
This strategypage.com piece delineates three types of cyber-warfare: limited stealth operations (LSO); cyberwar only (CO); and cyberwar in support of conventional war. It isn’t clear whether LSOs are “limited” by intent or simply capacity. CO is what happened in Estonia, and is likely to be carried out by non-state actors regarding single issues or targets. The final category, support cyberwar, includes traditional battlefield operations such as disrupting communications. The problem is the expanding definition of “targets” in the modern era, with the actual military increasingly relying on all manner of economic and political support structures. Cyber-warfare doesn’t just mean jamming the enemy’s radars; it means shutting down their stock exchange.
What we’re currently seeing in Georgia is the disruption of state websites by (possibly) private-sector hackers, simultaneous with old-fashioned Russian military operations. Such para-state hackery has the potential to screw up track-1 negotiations. What happens if two heads of state sign a cease-fire, but private citizens in each country continue trashing each other’s banks and government websites? What happens if an entity like the RBN ponies up to pay a hacker’s fines for working against foreign governments? Who faces charges, and in what jurisdiction?
All that said, time for a caveat: Much of the PANIC PANIC PANIC about the future of cyber-warfare is coming from individuals with a vested professional and financial interest in it. One commenter on Defensetech makes the point: Be wary of “threat” claims from people who make their living defending against those threats. A piece from the Council on Foreign Relations notes disagreements on the threat level from cyber-attacks.
Even if this trend is less dangerous than some claim, there is still reason to be wary. One of the major problems with the fight against terrorism is the lack of clear legal frameworks for it. Who are combatants? How do their rights compare to traditional, uniformed soldiers? When is the state a terrorist actor? Can it be one? Laws on terrorism are being written as we go along, often with horrible outcomes. Cyber-warfare lends itself to similar shell games with its intangible, asymmetrical nature, and the international community would be well advised to get on the question sooner rather than later.
mireille + mischa 
