The pandora’s box of the digital age

Is the world sliding dangerously toward a catastrophic cyber conflict?Let us hope not; but let us also apprehend the threat, and focus on whatto do about it.One country after another has begun exploring options for bolsteringtheir offensive capabilities in cyberspace, and many other countrieshave already done so. This is a dangerous escalation. In fact, few othertrends pose a bigger threat to global stability.Almost all societies have become heavily dependent on the Internet, theworld’s most important piece of infrastructure – and also theinfrastructure upon which all other infrastructure relies. The so-calledInternet of Things is a misnomer; soon enough, it will be the “Internetof Everything.” And our current era is not a Fourth IndustrialRevolution; it is the beginning of the digital age, and the end of theindustrial age altogether.The digital age has introduced new vulnerabilities that hackers, cybercriminals, and other malign actors are already routinely exploiting. Buteven more alarming is the eagerness of national governments to conductcyber-warfare operations against one other.We have already reached the stage at which every conflict has a cyberdimension. The United States and Israel crossed the Rubicon in 2010 bylaunching the Stuxnet attack on Iran’s nuclear facilities. Now, there isno telling where ongoing but hidden cyber conflicts begin and end.Things were different in the old world of nuclear weapons, which arecomplicated and expensive devices based on technology that only a fewhighly educated specialists have mastered. Cyber weapons, by contrast,are generally inexpensive to develop or acquire, and deceptively easy touse. As a result, even weak and fragile states can become significantcyber powers. Worse still, cyber-war technologies have been proliferating at analarming pace. While there are extensive safeguards in place to controlaccess to sensitive nuclear technologies and materials, there is almostnothing preventing the dissemination of malicious software code.To understand the scale of the threat we face, look no further than the“WannaCry” virus that, among other things, almost shut down the BritishNational Health Service this past May. The virus exploited avulnerability in the Microsoft Windows operating system that the USNational Security Agency had already discovered, but did not report toMicrosoft. After this information was leaked or stolen from the NSA,North Korea quickly put the ransomware to use, which should come as nosurprise. In recent years, North Korea has launched numerous cyberattacks around the world, most notably against Sony Pictures, but alsoagainst many financial institutions.And, of course, North Korea is hardly an exception. Russia, China, andIsrael have also developed cyber weapons, which they are busy trying toimplant in systems around the world. This growing threat is preciselywhy other countries have started talking about acquiring offensive cybercapabilities of their own: they want to have a deterrent to ward offattacks from other cyber powers. Cyber security is regarded ascomplicated and costly; but cyber offence is seen as inexpensive andsexy.The problem is that, while deterrence works in the nuclear world, itisn’t particularly effective in the cyber world. Rogue actors – andNorth Korea is hardly the only example – are far less vulnerable thandeveloped countries to cyber counterstrikes. They can attack again andagain without risking serious consequences.Cyber attacks’ often-ambiguous origins make it even harder to apply arational theory of deterrence to the cyber world. Identifying theresponsible party, if possible at all, takes time; and the risk ofmisattribution is always there. I doubt we will ever see unambiguousproof that Israel is conducting offensive cyber operations; but thatcertainly doesn’t mean that it isn’t.In the darkness of cyberspace, sophisticated actors can hide behindoblivious third parties, who are then exposed to counterstrikes by theparty under attack. This method of avoiding detection will almostcertainly become the norm.In a world riven by geopolitical rivalries large and small, suchambiguity and saber-rattling in the cyber realm could have catastrophicresults. Nuclear weapons are generally subject to clear, strict, andelaborate systems of command and control. But who can control thelegions of cyber warriors on the dark web?Given that we are still in the early stages of the digital age, it isanyone’s guess what will come next. Governments may start developingautonomous counterstrike systems that, even if they fall short of DrStrangelove’s Doomsday Machine, will usher in a world vulnerable tomyriad unintended consequences.Most obviously, cyber weapons will become a staple in outright wars. TheUnited Nations Charter affirms all member states’ right to self-defence– a right that is, admittedly, increasingly open to interpretation in akinetic, digitised world. The Charter also touches on questions ofinternational law, particularly with respect to non-combatants andcivilian infrastructure in conflict zones.But what about the countless conflicts that do not reach the thresholdof all-out war? So far, efforts to establish universal rules and normsgoverning state behaviour in cyberspace have failed. It is clear thatsome countries want to preserve their complete freedom of action in thisdomain.But that poses an obvious danger. As the NSA leaks have shown, there isno way to restrict access to destructive cyber weapons, and there is noreason to hope that the rules of restraint that governed the nuclear agewill work in the cyber age.Unfortunately, a binding international agreement to restrict thedevelopment and use of offensive cyber weapons in non-war situations isprobably a long way off. In the meantime, we need to call greaterattention to the dangers of cyber-weapon proliferation, and urgegovernments to develop defensive rather than offensive capabilities. Anarms race in cyberspace has no winners. – Project Syndicate* Carl Bildt is a former prime minister and foreign minister of Sweden.