OMG! Cyber War! Cyber War! We're Doomed! (Or Not.)

"Stop the apocalyptic rhetoric. The alarmist scenarios dominating policy discourse may be good for the cybersecurity-industrial complex, but they aren't doing real security any favors," write former Reason intern Tate Watkins and Mercatus' Jerry Brito today at Wired.

The dynamic duo—who have debunked the cybersecurity threat in Reason's pages as well—lay out the mechanism whereby threats of cyber war are systematically inflated by the devout fearful and those who stand to gain—panicked Internet Baptists and their military-industrial-complex bootlegger buddies:

Rhetoric about cyber catastrophe resembles threat inflation we saw in the run-up to the Iraq War…

The media may be contributing to threat inflation today by uncritically reporting alarmist views of potential cyber threats. For example, a 2009 front page Wall Street Journal story reported that the U.S. power grid had been penetrated by Chinese and Russian hackers and laced with logic bombs. The article is often cited as evidence that the power grid is rigged to blow.

Yet similar to Judith Miller's Iraq WMD reporting, the only sources for the article's claim that infrastructure has been compromised are anonymous U.S. intelligence officials. With little specificity about the alleged infiltrations, readers are left with no way to verify the claims. More alarmingly, when Sen. Susan Collins (R-Maine) took to the Senate floor to introduce the comprehensive cybersecurity bill that she co-authored with Sen. Joe Lieberman (I-Conn.), the evidence she cited to support a pressing need for regulation included this very Wall Street Journal story.

And now, some alarming large numbers in a paragraph studded with the names of defense contractors:

The U.S. government is expected to spend $10.5 billion a year on information security by 2015, and analysts have estimated the worldwide market to be as much as $140 billion a year. The Defense Department has said it is seeking more than $3.2 billion in cybersecurity funding for 2012. Lockheed Martin, Boeing, L-3 Communications, SAIC, and BAE Systems have all launched cybersecurity divisions in recent years. 

Check out the smartypants academic version of Watkins and Brito's report.

Read lots more skeptical approaches to cyber war (plus a great deal of hate for the word cyber in any context).

Comments

[R C Dean]

That is the weakest badge/logo EVAR! Seriously, it looks like someone's 13 year old cousin drew it after an epic D&D session.

[Scruffy Nerfherder]

Mock not the iron fist of cyber-heroes

[SugarFree]

Up yours, hippie. It's got red lightning! RED LIGHTNING!

[Scruffy Nerfherder]

But it doesn't have curved swords

[SugarFree]

But it does have mistletoe. Which creates a lot of sexual harassment claims. Which is good for the economy.

[Scruffy Nerfherder]

Is that mistletoe? I thought it was hemlock.

[SugarFree]

Either way, someone is getting kissed under it.

[Scruffy Nerfherder]

Reminds me of the famous last words of Socrates

"I drank what?"

[Plato]

Warmed santorium w melted marshmellows...which aint marshmellows

[Res Publica Americana]

What about the obvious visual reference to fetish gauntlet fisting?

[SugarFree]

Only someone with a sick mind like yours could come up with something that that.

[Scruffy Nerfherder]

SF, I think you're just jealous

[SugarFree]

Either way, someone is getting kissed under it.

[Res Publica Americana]

Don't pretend you weren't turned on by the thought.

[SugarFree]

"Clang clang went the trolley
Ram ram ram went the glove"

[Karl Hungus]

If it doesnt have a rampant colt or Zeus preparing to throw a bolt of lightning, then it's just gay.

[Brandon]

Anybody else read Tom Clancy's "Net Force" series? That was the first thing I thought of when I saw the logo.

[Rich]

They didn't even leave room for the rest of "(PBUH)".

[En passant]

The US Air Force is all about lame unit patches.

[Mike M.]

That, and box lunches.

[BakedPenguin]

...it looks like someone's 13 year old cousin drew it after an epic D&D session.

Lightning bolt! Lightning bolt! Lightning bolt!

[Raston Bot]

is that gauntlet even grounded?

[Static electricity]

bwahahahahahahahaha....no

[cci]

happy Valentine's day! Do you wanna look for some bilover to hook up tonight?===Datebi*c/O'm=== is a site for bisexual and bicurious singles and friends.Here you can find hundreds of thousands of open-minded singles & couples looking to explore their bisexuality.sign up for free.

[John]

I would be curious what the various IT people on this board think. But it always seemed to me that the solution to cyber attacks was to compartmentalize the IT infrastructure so that if one part is attacked, the damage can be contained. There is no excuse for building a power grid that can be taken down or severely damaged by a cyber attack.

But oddly that kind of solution never seems to be on the table. It is always about giving the government more power over the internet and hiring more IT contractors to write more and more sophisticated and intrusive security software. That tells me this whole thing is about money and control.

[Scruffy Nerfherder]

That tells me this whole thing is about money and control.

Oooooh! That's a bingo!

[Lt. Aldo Raine]

You just say "bingo".

[Scruffy Nerfherder]

How fun!

[Sparky]

More often than not, the IT departments get very little say in how things are done. Generally it's someone at the operational level that decides how things will run then tells IT to get to it.

[jasno]

The internet is a mesh network - it was designed from the get-go such that you can't just turn a part of it off. That's a good thing.

I'm torn.. I've been on the fringes of the hacker community for years, so I have to laugh when I hear shit like this. We've been telling you people for years that your shit isn't secure, and the response was often jail-time. On the other hand, I oppose any effort on behalf of the government or commercial entities to regulate the internet - often simply for the reason that it just won't work. Like SOPA, many of the things they're proposing are only feel-good solutions that could be easily worked around.

As someone who has worked in embedded software for years, I can also say that security is rarely a concern in many commercial products. The world is full of insecure network gadgets that could be exploited by almost anyone for fun, mischief or profit. Just look at the credit-card payment system, or wireless phone networks - two major infrastructure pieces that are full of security holes. Credit card theft is rampant, and any idiot can now buy the gear to impersonate a 3G cell tower. Such things demand fixes that are beyond the comprehension of political entities.

[Brandon]

Interesting. "the mechanism whereby threats of _______ are systematically inflated by the devout fearful and those who stand to gain"

Insert any word you want in the blank, and you've pretty much summed up our current government.

[SugarFree]

"blood-thirsty corn cobs"
"orgasmic stoplights"
"poop goggles"

[Sparky]

I'll take the one in the middle.

[Fahrid Bahloup]

"systematic inflation by the devout fearful and those who stand to gain"

[Scruffy Nerfherder]

The reality of cyber-security is that it boils down to people. Most attacks that do actual damage (theft) involve social engineering.

You can throw all the money you want at it, but it still won't secure a system against some dumbass who picks up a USB stick in the parking lot and puts it in his computer.

[Dumbass]

HEY!! That USB stick was in the Cyber Command parking lot!

[John]

DOD is insane about passwords. They make you have incredibly long and complex ones that have to be changed all of the time and drive the average user bonkers. A few years ago, they looked into it and found out that nearly all of the breaches had been the result of IT people not even having a password on the admin accounts.

[Scruffy Nerfherder]

Reminds me of Feynman's book on the Manahattan Project. All of the top secret stuff was kept in a colonel's safe that still had the original combination from the factory and was readily retrieved by calling the safe manufacturer with the serial number, no questions asked.

[Sparky]

It's generally pretty easy to paw around somebody's desk and find the sticky note they wrote their password on. The problem is the assholes in charge don't understand that making the password complex means people writing it down somewhere. More places should be changing to smartcards in the near future which will eliminate some of that.

[John]

And there is only a cursory background check on the cleaning people. Just a get a job cleaning offices at the federal agency you want to hack and eventually you will find a trove of passwords and you are off to the races.

[Zeb]

"nearly all of the breaches had been the result of IT people not even having a password on the admin accounts."

I woudl have guessed that they were because everyone wrote their long, impossible to remember passwords on their monitors.

[Res Publica Americana]

We have to ban the Internet, or the hackers have already won.

[fresno dan]

We have to visit every porn site (twice daily) or the terrorists have won!
Despite grave danger to myself, my altruistic nature demands that I spend all day, every day, at porn sites...FOR FREEDOM!!!

[Scruffy Nerfherder]

laced with logic bombs

Kind of a like an argument with your spouse

[SugarFree]

Cyber Command

"Is this where y'all keep them robot hookers? I'll take two Daryl Hannah's and one Ashley Scott."

[fresno dan]

Daryl Hannah now?! or Daryl Hannah in Splash?

[SugarFree]

Technically, Daryl Hannah in Bladerunner.

[Dustin Jorman]

lol, you gotta be kidding me dude that's like totally insane man. Seriously?

http://www.Dot-Privacy.tk

[fresno dan]

Cry :\http:%@^^ and let slip the semi colon parenthesis of war!!!

[kool]

Dammit! I don't know C++ or python! I'm totally macrofucked.

[Colonel_Angus]

I know its nice to let military groups design their own heraldry, but a lot of them just suck. They should be a little boastful and intimidating, not look like preschool pictures. Cute clouds.

[R C Dean]

One of our docs is a surgeon for the military. No idea what unit, but their patch features the heart, lungs, and esophagus. The embroidery is very nice.

I approve.

[Loki]

Lockheed Martin, Boeing, L-3 Communications, SAIC, and BAE Systems have all launched cybersecurity divisions in recent years.

As a rule of thumb you can always spot where the next over-inflated threat is going to come from by just watching what direction the defense contractors move toward. In recent years they've been putting a lot more emphasis on IT security stuff than on more "traditional" defense related projects such as Aerospace.

Which of course means if you were dumb enough to get an Aerospace Engineering degree anytime in the last 10-12 years you're pretty much fucked because odds are you'll never get to use it to work on the kinds of projects you wanted to when you started college. I'm not talking about anyone in particular*...

*walks away casually whistling, back to my shitty job at a major aerospace company.

[Rob McMillin]

The entire point of framing Internet security as a "cyberwar" is to evade First Amendment protections that would otherwise stubbornly present themselves to state censorship.

[Rob McMillin]

Also, in the Life Imitates Art Dep't:

The USAF Space Command shield and insignia.

Star Fleet shield and insignia.

[Mark]

Nope, no risk here.

Chinese Hackers Suspected In Long-Term Nortel Breach
http://online.wsj.com/article_.....DMyWj.html

Seriously, while the government will spend too much, with too little result, the recent hacks by Anonymous and China reveal IT security is a serious concern for governments and private industry.