Cyber Warfare

Twenty years ago, the concept of a country coming under attack not from land, air or sea but via telephone lines and communication systems was seen as science fiction. But today, when gaining access to a government Web site takes just a few mouse clicks, cyber-terrorism is a very real fact.

The alleged Russian attacks on Estonia's digital infrastructure in the middle of a diplomatic spat over the relocation of a Soviet-era monument in May sent NATO experts to Tallinn to investigate what some called the first direct attack by Moscow on a NATO member. Confusion over whether an attack was actually happening, however, allowed NATO to avoid formulating a response to the suspected cyber attack.

Then Germany joined the United States, France and Britain last month in blaming China for recent hacker attacks on sensitive government sites, including the Pentagon and the French defense ministry.

"I'm sure the Germans and Americans wouldn't have named China without having evidence," said Jan Hassel, an expert and author on the subject of cyber-terrorism. "The fact that China was singled out means that the countries apparently targeted by the Chinese wanted to send out a warning."

Beijing has denied all involvement in the alleged attacks, and the Western governments have been unwilling to publicize exactly what, if any, classified information was compromised.

Badly protected systems vulnerable to attack

"The increasing reliance on technology is making governments more vulnerable to cyber attack," Hassel said. "Many don't have adequate defense systems on their files and hackers will look for a weak link, maybe a person, maybe an application and focus on that, releasing viruses to disable the system through emails."

The Pentagon admitted hackers had gained access to an unclassified e-mail system in the office of US Defense Secretary Robert Gates but would not comment on a Financial Times report that the Chinese government was involved.

Britain's The Times also reported that the Pentagon suspected China's People's Liberation Army (PLA) hackers of preparing a plan to disable the US aircraft carrier fleet, a threat Hassel said has been exaggerated.

"It would not be possible for a hacker to steer a battleship," said Hassel. "The main threat would be the interception of communications. While unauthorized access to military systems is a real concern, we shouldn't get too carried away. There is still much of what makes up a 'nightmare' scenario which cannot currently be achieved by hacking."

Publicly accused are not alone

But by engaging in cyber warfare, as seen in the Estonian case, a country can obtain information about and destabilize rival nations faster -- and at a fraction of the cost of the spy networks or militaries that were once necessary.

Retired US Army officer and lecturer on asymmetric warfare Zachary Hubbard recently claimed in a report that the PLA had developed a sizable force of professional computer hackers trained to disrupt the computer networks of China's enemies.

Hubbard claimed that these hackers were trained to target banking and electronic commerce networks and electric power grids, transportation networks and oil and gas pipelines often making use of information publicly available on the Internet. China has denied the existence of any such force.

Cyber units at large in the world?

While China and Russia currently appear to have taken the lead in online espionage, it is highly unlikely they are alone since "no one is going to admit to [having] cyber units," according to Hassel.

"A lot of countries are doing it, and I would not be surprised if those accusing others of the practice are guilty as well," he said. "What is more likely is that governments are turning a blind eye to hackers targeting other nations, or even using freelance hackers while publicly condemning the practice.

"While we don't know whether there are any official military units in Europe charged with cyber missions, we have seen that certain exercises and war games carried out by the likes of China have included cyber attack scenarios," Hassel added.

Nations stumped over appropriate response

The official denials of any engagement in cyber espionage and difficulty in presenting hard evidence of an attack, however, have left countries wondering what action to take after falling victim to an attack.

In Europe, the Council of Europe's Convention on Cybercrime became the first, and only, international legal instrument in dealing with cyber attacks. But even that is regarded as ineffective as it applies only to signatory nations. The Convention has been signed by 38 Council of Europe members and five non-members -- Canada, Japan, Montenegro, South Africa and the United States.

"The Council of Europe's Convention allows the signatories protection against each other but does little if anything to provide a legal framework where an outsider could be held accountable," said Hassel. "European nations and the United States can expect to become increasingly targeted until a full international agreement on cyber attacks is in place."