IEEE Technology and Society Magazine - Fall 2014 - 16

using information, communications technology, and
When Does Cyberwar Occur?
networks, with the intention of disruption or destrucIt is virtually impossible to identify every cyberattion of the enemy's information and communications
tack that occurs. Some can operate undetected for
systems. It is targeted at influencing the
years. Others are brief, but still leave no
decision-making capacity of an oppodetectable trace. This section describes
It is virtually
nent's political leadership and armed
a European-based effort aimed at
impossible to
forces [1]. It is, therefore, distinguished
measuring the frequency and source
in two key areas. first, it recognizes that
of attempted infiltrations over a oneidentify every
there is a non-physical impact to cybermonth period. It also describes a few
cyberattack
war, and second, it recognizes the sigselected global examples of cyberatthat occurs.
nificance of political leaders in making
tacks. Growing concerns with the secuthis determination.
rity of Supervisory Control and Data
A pure military-target definition of cyberwar is no
Acquisition (SCADA) systems are discussed later in
longer realistic in the context of modern geo-political
this article.
instabilities and a global environment of asymmetrical warfare. When a smaller force is in conflict with a
Frequency of Cyberattacks
larger entity, an armed conflict will most likely not be
Deutsche Telekom AG (DTAG), a German Telecomsuccessful for the smaller force. In addition, the reality
munications company, established a network of 97
of the conflict proves that the determinations of when a
sensors to serve as an early warning system to provide
nation-state declares war, and the precursor interpretaa real-time picture of ongoing cyberattacks. Although
tion of events leading up to that determination, are decithe majority of the sensors are located in Germany,
sions made by its political leadership. As a result, the
DTAG also locates honeypots and sensors in other
terms cyberattack and cyberwar must be decoupled so
non-European countries. The top fifteen countries
that cyberattacks are not defined exclusively in terms of
recorded as the source of cyberattacks by the DTAG
the use or effect of physical force causing death, damsensors are listed in Table I. Approximately, 20% of
age, or destruction. Or, if the terms cyberattack and
the cyberattacks listed originated in the Russian fedcyberwar are going to continue to be synonymous, then
eration. The first four countries listed, including the
it's important to acknowledge that cyberattacks, and
U.S., Germany, and Taiwan, accounted for 62% of the
hence cyberwar, can include non-kinetic cyber activity
cyberattacks represented. These instances provide a
without a co-requirement of kinetic military action.
snapshot in time of attacks primarily targeted towards
a particular geographic area, in this instance, Europe.
On a broader international and historical scale, the
DCAF
Horizons 2015 Working Paper describes historiTable I
cal instances of what they identify as cyber conflict and
Top 15 Source Countries for Cyberattacks in
which clearly should be considered as cyberattacks.
May 2013 [5]
The attacks have been summarized in Table II. It should
Source of Attack
Number of Attacks
be noted that, for many of the cyberattacks described,
Russian Federation
1 153 032
the perpetrator is indicated as "alleged." This reflects
United States
867 933
the difficulty in ascertaining responsibility.
Germany
831 218
Of the fourteen cyberattacks described in Table II,
five occurred within the context of an actual kinetic or
Taiwan
764 141
"hot" war, one occurred within the context of a "cold"
Bulgaria
358 505
war, and the remainder occurred within the context of
Hungary
271 949
ongoing tensions between nation-states, or between a
Poland
269 626
nation-state and non-state actors that may or may not
China, The Peoples'
254 221
have been supported by another nation-state. The temRepublic of
poral trend in these identified conflicts is the utilization
Italy
205 196
of cyberattacks in the absence of a kinetic battle. When
Argentina
167 379
considered with the subsequent cyber occurrences
Romania
153 894
described in Table III, the trend is towards attacks
against a nation-state's critical infrastructure [24].
Venezuela, Bolivarian
140 559
Republic of

Brazil

140 281

Why Does Cyberwar Occur?

Colombia

124 851

Australia

120 157

for smaller nations, or terrorist organizations, the use
of DDoS attacks are much cheaper to launch than conventional warfare tools against an enemy possessing
IEEE TECHNOLOGY AND SOCIETY MAGAZINE

fALL 2014

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - Fall 2014