Articles by Jerry Brito

Tyler Cowen [asks on his blog today](http://marginalrevolution.com/marginalrevolution/2012/06/today-is-probably-a-funny-blogging-day.html):

>By the way, didn’t it just [come out in](http://www.washingtonpost.com/world/national-security/us-israel-developed-computer-virus-to-slow-iranian-nuclear-efforts-officials-say/2012/06/19/gJQA6xBPoV_story.html) *The Washington Post* that the United States helped attack Iran with Flame, Stuxnet and related programs? If they did this to us, wouldn’t we consider it an act of war? Didn’t we just take a major step toward militarizing the internet? Doesn’t it seem plausible to you that the cyber-assault is not yet over and thus we face immediate questions looking forward? Won’t somebody fairly soon try to do it to us? Won’t it encourage substitution into more dangerous biological weapons?

Those are good questions. Let’s take them in turn.

**If they did it to us, would we consider it an act of war?** I tend to agree with [Franz-Stefan Gady’s perspective](http://www.huffingtonpost.com/franzstefan-gady/the-cyberwar-hoax_b_1549927.html) that Stuxnet should not be considered an act of war. One of the most overlooked aspects of the great reporting done by the NYT and WaPo uncovering the details of Stuxnet is that the U.S. did not “hack in” to Iran’s nuclear facilities from thousands of miles away. Instead it [had to rely on Israel’s](http://jerrybrito.org/post/24193112996/nyt-reveals-the-backstory-on-stuxnet) extensive intelligence apparatus to not only understand the target, but to deliver the worm as well. That is, humans had to physically infiltrate Iran’s operations to engage in the spying and then the sabotage.

Espionage [is not an act of war](http://legal-dictionary.thefreedictionary.com/espionage) under international law. Nations expect and tolerate espionage as an inevitable political practice. Spies are sometimes prosecuted criminally when caught, sometimes traded for other spies, and often simply expelled from the country. Sabotage I’m less certain about, but I think it inhabits a similar space as espionage: frowned up, prosecuted criminally, but not an act of war *per se*. (I’ve been trying to find the answer to that question in vein, so if any international law experts would like to send me the answer, I’d appreciate it.)

So what do we have with Flame? It’s essentially spying, albeit in a frighteningly efficient manner. But, it’s not act of war. Stuxnet is similarly not an act of war if we assume sabotage is not. There’s little difference between Stuxnet and a spy infiltrating Natanz and throwing a wrench into the works. Stuxnet is just the wrench. Now, it’s key to point out what makes Stuxnet political sabotage and not terrorism, and that is that there were no deaths, much less civilian deaths.

**Did we take a big step in militarizing the Internet? Won’t somebody fairly soon try to do it to us?** Well, it’s already happening and it’s been happening for years. U.S. government networks are very often the subject of espionage–and maybe even sabotage–by foreign states. If something feels new about Stuxnet, it’s that for the first time we have definitive attribution to a state. As a result, the U.S. loses moral high ground when it comes to cybersecurity, and if someone doing it to the U.S. gets caught, they will be able to say, “You started it.” But they’re already doing it. Not that it’s necessarily a good thing, but the militarization of cyberspace is not just inevitable, it’s been [well underway](http://en.wikipedia.org/wiki/United_States_Cyber_Command) for some time.

Finally, Tyler asks, **Won’t it encourage substitution into more dangerous biological weapons?** The answer to that, I think, is a definitive no. “Cyber weapons” arecompletely different from biological weapons and even chemical or conventional, and certainly nuclear. For one thing, they are [nowhere near](http://jerrybrito.org/post/23994462855/the-united-states-is-more-secure-than-washington-wants) [as dangerous](http://jerrybrito.org/post/23994472311/how-scary-was-the-white-houses-cyber-simulation-for). No one has ever died from a cyber attack. Again, short of already being in a shooting war, these capabilities won’t be employed beyond espionage and surgical sabotage like Stuxnet.

That raises the question, however, if we’re in a shooting war with a Lybia or a Syria, say, will they resort to cyber? Perhaps, but as Thomas Rid has pointed out, the more destructive a “cyber weapon” the more [difficult and costly](http://jerrybrito.org/post/23994467276/why-anonymous-will-never-be-able-to-take-down-the-power) it is to employ. Massively so. This is why it’s probably only the U.S. at this point who has the capability to pull off an operation as difficult as Stuxnet, and then only with the assistance of Israel’s existing traditional intelligence operation. Neither al Qaeda, nor Anonymous, nor even Iran will be able to carry out an operation on the same level as Stuxnet any time soon.

So, Tyler, you can sleep well. For now at least. ;o) Yes, we should have a national discussion about what sorts of weapons we want our government employing, and what sort of authorization and oversight should be required, but we should not panic or think we’re a few keystrokes away from Armageddon. The more important question to me is, [why does one keeps $2.85 million in bitcoin?](http://jerrybrito.org/post/25726774959/someone-is-holding-2-85-million-in-bitcoins)

SHARE: 0 comments