Cyber operations

Published July 8, 2023
The writer is an international lawyer at the Conflict Law Centre.
The writer is an international lawyer at the Conflict Law Centre.

JUST before midnight on Sept 5, 2007, Israeli aircraft entered Syrian airspace, bombed an under-construction nuclear reactor, and left four hours later without a shot fired at them. All the while, Syrian systems showed that there was nothing afoot, controllers saw a clear sky on their radars and no reason to scramble their air defence. The Israelis had cloaked their kinetic attack with a cyber one, having hacked Syrian radars with images of an empty sky. The Syrians woke up the next day and found out what happened. This may have been the first time cyber operations were used to enable an attack.

Soon after, code would be used as not only a ruse for a physical attack, but as the attack itself. In the Stuxnet attack in 2009, the US and Israel used a digital weapon against an Iranian uranium enrichment facility. In what could be the plot for a Hollywood thriller, the code was planted into the system by a Dutch mole, pretending to be a mechanic, through a USB. Soon after, Iranian scientists realised that while computers in the operating room were reporting that all centrifuges were functioning normally, some were spinning out of control and others were spinning too slowly, unbalancing them to the point that they exploded. Over 1,000 centrifuges were destroyed in the attack, a fifth of those at the site, setting Iran’s nuclear programme back two years.

This marked the start of an era of cyber combat in which war would be fought with bytes instead of bombs. Except it didn’t —- not really. Every year, war lawyers warn of the start of digital Armageddon, but their predictions have vastly overestimated the impact of cyber operations in warfare. Even the Russia-Ukraine conflict, which was billed as the world’s first cyber war, remains largely conventional. While cyberattacks have their uses, they are not great at killing enemy soldiers, destroying their weapons, or retaining control of territory.

What they are good for though is low-level harassment tactics — spying, stealing resources and spreading chaos. This is helped by the boundlessness of the internet, which makes it easy to mask a perpetrator’s involvement. Unlike with terrestrial, aerial, or nautical battlefields, it is unclear where borders are in cyberspace. This leads to a cat-and-mouse chase with no idea where the mouse is, given it is nearly impossible to know who is behind the machine or even where the machine is located. The internet is one big masquerade ball.

In the information age, data is the new oil.

And it is one we are increasingly immersed in. As the Internet of Things grows, it controls much of public life, making it easy to exploit. Our distribution networks for food, water, energy, healthcare, transportation, and businesses are increasingly digitised, and this always comes with the risk of breach. Pakistan is acutely vulnerable to this: while Nadra boasts of being the world’s largest singular citizen database, it has been prone to data hacks. Same with our banking sector: many Pakistani banks have been hacked and funds and data have been stolen.

In the information age, data is the new oil. The Pentagon has admitted that other states steal billions per year in technology from the US this way. In fact, for many states, especially Iran and North Korea, technology could be a great leveller, allowing them to exploit the resources of richer countries while evading responsibility. After Stuxnet, Iran heavily invested in building an army of techies that could be on par with the West. Same with North Korea. Sometimes these hackers act out of revenge. After the film The Interview was released, in which Seth Rogan and James Franco try to kill Kim Jong-un, North Korean groups hacked Sony and published its data online, including personal employee emails (in which a producer referred to Angelina Jolie as “a minimally talented spoilt brat”).

While these examples (barring Stuxnet) don’t count as cyberwarfare, the laws of war are woefully inadequate in dealing with cyber ops which don’t cause physical damage. Under these laws, currently, essential healthcare documents are protected so long as you can hold them in your hand, but not if the same data exists in cyberspace. This hardly makes sense in a world where so many essential services are computerised. So the thing that war lawyers have been warning against, which hasn’t yet happened, is also the thing we are least prepared for.

Last year, an American in his pajamas managed to turn off North Korea’s internet from his living room. It was done punitively, as he claimed to have been hacked by North Korea a year earlier and was frustrated by the lack of US response. While cyber Armageddon may not have happened, cyber pandemonium is more likely — cyber ops can inflict significant damage without boots, bullets, and bombs. A lone hacker in his pajamas could upend the state, and all without fighting.

The writer is an international lawyer at the Conflict Law Centre.

Published in Dawn, July 8th, 2023

Opinion

Editorial

Military option
Updated 21 Nov, 2024

Military option

While restoring peace is essential, addressing Balochistan’s socioeconomic deprivation is equally important.
HIV/AIDS disaster
21 Nov, 2024

HIV/AIDS disaster

A TORTUROUS sense of déjà vu is attached to the latest health fiasco at Multan’s Nishtar Hospital. The largest...
Dubious pardon
21 Nov, 2024

Dubious pardon

IT is disturbing how a crime as grave as custodial death has culminated in an out-of-court ‘settlement’. The...
Islamabad protest
Updated 20 Nov, 2024

Islamabad protest

As Nov 24 draws nearer, both the PTI and the Islamabad administration must remain wary and keep within the limits of reason and the law.
PIA uncertainty
20 Nov, 2024

PIA uncertainty

THE failed attempt to privatise the national flag carrier late last month has led to a fierce debate around the...
T20 disappointment
20 Nov, 2024

T20 disappointment

AFTER experiencing the historic high of the One-day International series triumph against Australia, Pakistan came...