It may be years before we get the Franz Ferdinand hack, but one cyberattack has the potential to set off a global war the likes of which we’ve never seen. Think beyond power and Internet outages to banking failures, food shortages and poisoned water.
In the latest offensive, Chinese-backed operatives exploited vulnerabilities in Microsoft’s Exchange Server with vibrations felt around the world, mostly among small and medium-sized enterprises. Two months ago, the US administration pointed the finger at Russia for a major attack on software provider SolarWinds, which appeared to target government customers.
There’s no end in sight.
So far, despite dozens of cyberattacks among superpowers over the past two decades, the world has kept spinning on its axis and life for most people has continued on largely unhindered. That could change at any moment.
Trouble was already brewing in early 20th century Europe as various nations jostled for supremacy and started arming themselves accordingly. So, the June 1914 assassination of Archduke Franz Ferdinand, the heir presumptive to the throne of the Austro-Hungarian empire, was the match that lit the dry tinder of regional tensions, resulting in a war of attrition that left 20 million people dead.
A single event
The global war against terror, too, was catalysed with a single event. By the time al-Qaeda launched its attacks on the US mainland on 11 September 2001, the confrontation between extremist terrorist groups and the West was already fierce — the USS Cole was bombed in October 2000. The American response would expand from Afghanistan to Iraq, with territory less of an objective than control over populations, ideology and resources.
Now we are experiencing a new type of combat. Where state and semi-state actors wage war against victims both targeted and broad, where the specific goals are unclear — perhaps disruption, possibly theft of technology and information, or even general fear, uncertainty and doubt — and the primary weapons are lines of software code. This style of battle has victims whose identities are not always known and perpetrators who hide their work.
Witness China: The speed at which Beijing denies an attack is often inverse to its likely culpability. Or the US, for that matter. As far back as 2005, it collaborated with Israel to unleash the Stuxnet worm which hobbled Iran’s uranium enrichment programme. While neither has formally admitted to their role, they also haven’t been particularly vociferous in rebutting the charge.
There’s a perverse parallel to be drawn between cyber weaponry and nuclear armaments. After the US dropped two atomic bombs on Japan in 1945 and brought the war in the Pacific to a close, fears rose that more horrifically destructive attacks might follow as nations including the Soviet Union, the UK, France and China developed their own capabilities. Yet the reverse was true, giving rise to the concept of Mutually Assured Destruction as a reason why restraint was observed.
In the case of cyber warfare, though, nations appear unwilling to admit to their ability or deployment of such weaponry. As the New York Times wrote in 2012, then-President Barack Obama was reticent to publicise the US role in the Iran attacks for fear that doing so would allow other nations, terrorists or even hackers to justify similar action. It’s likely Beijing takes the same view by swiftly and repeatedly denying such offensives even when its fingerprints appear to be all over the attacks.
Indeed, Obama and Chinese leader Xi Jinping stood on the White House steps in 2015 to announce a truce on economic cyber espionage — a detente of seemingly limited scope. Yet that cessation lasted less than four years amid allegations that China renewed its attacks. The US and its allies are unlikely to have refrained from hacking, either.And so the cyber capabilities will grow and incursions continue, tit-for-tat. All you need is one such hack to have gone too far and to trigger an outsize response, one that results in a set of chain reactions with multiple and continuous cyber retaliations paralysing power grids, data transmission, agriculture, information flow, transportation systems and food supply chains. While it may lack the mushroom cloud of an atom bomb or explosive force of missile strikes, the devastation could be as widespread and even lead to military confrontation.
That’s why the best hope may be that the cyber equivalent of nukes are developed and obtained — and publicly acknowledged — by all major powers. These would be perceived to have the potential to overwhelm and cause so much upheaval and destruction that using them would be impossible. Yet their mere existence may once again give rise to the notion — and fear — of mutually assured destruction, and its paradoxical benefit: peace. — By Tim Culpan, (c) 2021 Bloomberg LP