Cold War Daily

North Korea’s exact role in the Sony Pictures hack is unclear but what’s certain is the cyber attack on Hollywood is part of a a much bigger trend. What’s unique about the Sony incident is the way the plundered documents have been splashed around the internet. But frankly these kind of malicious cyber intrusions happen all the time, with much less, or even no fanfare. And the trend is for governments to use third-party hacker groups to stage damaging attacks on businesses, governments and institutions. This has created a dilemma for modern Western governments – because they are not dealing with a traditional state-to-state political problem, but they’re also not dealing with purely criminal gangs either.

1) It’s not just North Korea. From a Western perspective, the US should “recognize that most malicious actions in cyberspace directed against the United States come from hackers in two countries: China and Russia,” writes James Lewis of Center for Strategic and International Studies. And those countries, along with North Korea and Iran, outsource their most aggressive cyber actions to create a new dynamic in the contested cyberspace. Today, China and Russia “encourage their hackers to go after networks, data and money in the United States, and they protect them from prosecution,” says Lewis. Criminal groups in Russia steal from Western banks while China uses military units to steal plans and intellectual property for everything from the “F-35 fighter jet (the Joint Strike Fighter) to the formula for house paint,” he says.

2) So this is war, then? Not exactly. In China’s case, while much of the hacking is done by the military, much is aimed at economic and trade rather than military targets abroad. A lot of Chinese hacking is done by freelancers and even government employees in their off-hours. In many cases, it’s not even clear what the relationship is between the government and the hacking gangs. This arrangement brings to mind the way the British used pirates to overwhelm the superior Spanish armada in the 1500s, write Jordan Chandler Hirsch and Sam Adelsberg:

[In the 1500s, during the England’s Elizabethan Era] the Spanish empire boasted a fearsome navy, but it could not dominate the seas. Poorer and weaker England tested Spain’s might by encouraging and equipping would-be pirates to act on its behalf without official sanction. These semi-state-sponsored privateers robbed Spain of gold and pride as they raided ships off the coasts of the New World and Spain itself, enriching the English crown while augmenting its naval power.

3) Why is the hacking such a challenge? Because the way it’s being used is a recipe for what cyber analyst Kenneth Geers calls pandemonium. “Governments today are confronted with a paradox: to disconnect from the global Internet is folly – and yet network connectivity provides adversaries with a medium through which to commit cyber crime,  cyber espionage, or even cyber war,” he writes. The problem is made worse by the fact that pre-internet based law enforcement jurisdiction “ends every time a network cable crosses an international border.”

Western governments’ last major great power geopolitical challenge was the Cold War, a time before the internet. Today, write Hirsch and Adelsberg

Neither the United States nor China can slice cyberspace into the reassuring structure of spheres of influence [such as those seen during the Cold War]. With no obvious borders for states to violate or defend, power in cyberspace is at once easier to exercise and harder to maintain, a battle of subtleties rather than hard-nosed deterrence.

4) So how are Western governments reacting? The US, publicly at least, has taken a nimble approach, bringing cases against foreign individuals accused of cyber crime including North Korean officials. Over the longer term, experts like Geers and CSIS’s Lewis see an international treaty about acceptable behavior online as the best way to stabilize the volatile situation.

Lewis says the Wild West frontier days of the internet “are over” and that now is the time for laws, rules and enforcement to be put in place to help weed out the kind of hacking threats faced by governments and businesses everywhere. He gives the example of the Western classic The Man Who Shot Liberty Valance, in which “a mild-mannered lawyer (played by Jimmy Stewart) supplants a larger-than-life cowboy (played by John Wayne) who pioneered the West.” Bottom line: what the world needs, is an inclusive, all-encompassing treaty on what exactly is kosher activity online, many Western experts say.

5) Wouldn’t a treaty hurt internet freedom? After all, isn’t the internet a place where ideas and content level the playing field with governments and powerful interests? Lewis acknowledges that the idea of “formal cooperation among governments is anathema to the old-school Internet community.” It would be a tough sell not just internationally but domestically. Look at the backlash over the Australian government’s meta-data retention laws or the prospect of creating a two-speed internet in the US in which companies can buy faster download speeds.

6) Good luck with that treaty idea. While China and the US recently made climate deal announcements side-by-side, what is the upside for China to cooperate on an issue that poses a greater threat to a US-led world order than Chinese-led one? The paradox is more stark when you look at rocky Russia-US relations. Why would Russia, which wants to block perceived American ‘imperialism’ at its border, strengthen the US’s hand by adopting Uncle Sam’s vision of a tamed internet? Further, Russian hackers are considered some of the most skilled in the world – why would Russia set aside that tool at a time like this?

7)  Because Russia and China have an internet problem too. Terrorism, dissent and news control are issues for the governments of China and Russia. Because of the internet’s roots in the US, coupled with revelations about the extent of the NSA’s capabilities, there is the perception of the internet in its current form is an extension of American power, and thus a threat to Beijing and Moscow’s aspirations. Russia, China and some ex-Soviet Republics have proposed an International Code of Conduct for Information Security that would favor information security, rather than network security, in maintaining an authoritarian preference for censorship. Another split in views over the future of the internet can be seen in the debate over governance at the International Telecommunication Union. Geers notes: “There are already hints of emerging alliances in cyberspace.”

8) But for now, the internet is a Wild West… The Wild West analogy, like the pirate analogy isn’t perfect. But they’re an approximation of the geopolitical situation online. And to extend the Wild West analogy it’s fair to say today’s cyber competition is less a showdown at high noon than an Indian raid by an endless parade of tribes that are impossible to identify, with motives that aren’t entirely clear. While the US will lobby for the case of laws on this frontier, the current state of affairs may benefit Moscow and Beijing too much to change it. That’s why the hope for an internationally acceptable treaty is a long shot. CSIS’s Lewis compares the need for a cyber treaty to the Bretton Woods agreements on “rules, norms and institutions to manage” created at the end of World War II. But today China is challenging a global system built on the Bretton Woods agreement.

The US-China cyber working group, for example, has halted cooperation. Besides, even if governments in Washington, Moscow, Beijing and Canberra forged an agreement, it’s the relationship between governments and underground and unofficial cyber gangs that matter. China relies on military hackers. Does China’s Communist Party exercise full control over the military? Russia relies on criminal hacking gangs. Can the Kremlin fully control them, or, like the rebels in Ukraine, are they on a long leash?

In fact, Hirsch and Adelsberg see a risk of Western countries trying to grapple with cybersecurity issue as if it were a Cold War-era geopolitical matter. “The cold war model of a struggle with calibrated boundaries, clear rules, and the threat of mutual assured destruction simply doesn’t fit cyberspace,” they write.

9) And if it’s a world of pirates? Pirates flourished until the end of the Thirty Years War in Europe, when the Treaties of Westphalia in 1648 was signed in Europe, effectively putting into place the foundations of the modern nation-state. At the same time, navies of the new world nations were stronger and capable of subduing pirate ships at seas. In other words, the decline of the pirates coincided with the rise of nation states with sovereign borders.

Today, however, rising powers, like China, are not based on the rule of law as much as rule of power. Russia, meanwhile, is willing to ignore internationally recognized borders to achieve strategic goals. All in all, a vastly different situation on the ground than the last Cold War, which ended with the Fall of the Berlin Wall in 1989.

Can Washington and other liberal democracies step into this Wild West, and like the lawyer Ranse Stoddard from The Man Who Shot Liberty Valance, see the power of law prevail over the power of force? Hopes for a treaty align nicely with a law-based government. But law-based societies begin at home and the current crop of Republicans who have just won back power in US Congress don’t seem to understand this.

Also, governments with kleptocratic tendencies that rely on bandits to attack targets in the West are effectively getting into bed with the kind of lawlessness that could destabilize the authoritarian regimes themselves, making the Western-favored rules-based order more attractive. But unfortunately, the world may need to see more chaos before that option looks attainable. Meanwhile, the digital frontier remains wild and Hollywood scripts, rather than giving a pop-culture example for the solving the problem, are themselves part of the booty today’s pirates have plundered.