IEEE Technology and Society Magazine - Fall 2014 - 20

operate electrical grids, open and close dams, as well
as regulate a host of other unseen yet vital, critical
infrastructure operations. It was the SCADA system
in Iran's nuclear centrifuge facility that was successfully targeted by Stuxnet. The danger for highly
industrialized countries is that their computerized critical infrastructure makes them vulnerable to similar
attacks. The United States has one of the most developed, computerized critical infrastructure systems in
the world, making it highly vulnerable [8]. Cyberattacks are not the only danger to these systems. Among
the SCADA attacks worldwide that have made it to
court, many have been found to be the work of a disgruntled employee with no political motivation [24].
A recurring question is whether there may be
instances where DDoS attacks could be considered
acts of war. for those requiring a military context,
it has been argued that cyberwar can be understood
through the context of maritime commerce warfare
[16]. Waterways are the most efficient mechanism for
transporting tangible goods. The Internet is the most
efficient mechanism for transporting intangible goods.
Therefore, just as naval blockades and attacks on shipping lanes were considered acts of war in both World
Wars because they prevented the transport of tangible
goods, DDoS attacks block the transport of intangible
goods [16]. This definition, while still analogous to
traditional warfare, provides a definition for cyberwar,
which circumvents the co-requisite of a kinetic battle.
Manipulation of increasingly automated information systems, insecurity of the supply chain, and crossplatform malware are among the emerging cyberthreats
identified for 2013 [17]. The ability to manipulate
automated information systems is a direct threat to the
security of any nation's supply chain. few people are
aware of the extent to which agribusiness, the process
by which food is harvested, transported, and sold in
stores, is automated. When combined with a "just in
time" marketing system designed to deliver produce
and supplies to the stores with little or no surplus,
manipulation of a distributor's information system can
result in deliveries not being made. This can potentially
lead to food shortages in some locales. Cross-platform
malware has also become more common. This can be
partially attributed to the rapid increase in the number
of smart phones and other hand-held, mobile devices,
along with the emergence of applications. Many of the
applications are designed to infect the device and transfer the malware wirelessly to other devices. Unrelated
to cyberattacks, but also present, are internal end-user
vulnerabilities confronting critical infrastructure.

Government versus Government (within the context of a kinetic battle)
■■ Asymmetrical warfare: Non-state actor versus
the agencies or contractors of its own, or another
government
■■ Government against another Government's critical infrastructure (non-kinetic battle)
■■ Criminally inspired hackers versus individual
users
As previously stated, cyberattacks between nationstates can occur within the context of kinetic and nonkinetic battles. This overlap is illustrated in fig. 1. In
the case of the nation-state of Georgia, described in
Table II, while the cyberattacks occurred as adjunct
to a kinetic war with the Russian federation, it was
believed that Russia had hired virtually every criminal hacker in Europe, both to assist in perpetrating
the cyberattacks, as well as to deprive Georgia of an
opportunity to retaliate in kind [18].

Heuristic Classification of Cyberattacks

Angelyn flowers is a Professor and the Graduate Program Director of the Homeland Security Program at
the University of the District of Columbia, Washington, DC. Email: aflowers@udc.edu.

Cyberattacks are launched at multiple levels. This
list is not intended to be hierarchical, or all-inclusive.
Among the levels where cyberattacks can occur are:
20

■■

Non-Kinetic Cyberattacks Increasing
Non-kinetic cyberattacks appear to be increasing both
in frequency and in severity in terms of the potential
damage they cause. It is particularly feared that terrorists fighting an asymmetrical war against a larger,
more powerful opponent, will utilize this attack
mechanism. They may or may not occur within the
context of a traditional kinetic war. Nation-states have
also been accused of utilizing cyberattacks, both during, and in the absence of a kinetic battle. An important emerging distinction is that political leaders and
military leaders do not necessarily utilize the same
definitions. Political leaders are more apt to consider
non-kinetic cyber-operations, targeting government,
financial, or other critical national infrastructure as
cyberattacks, and hence cyberwar, even in the absence
of the use of force, injury, death, or physical damage.
At present, the greatest difficulty nation-states and
organizations face is identifying perpetrators with confidence. In the absence of an admission, all that is initially available is speculation. To date, despite frequent
allegations by nation-states as to who did what, or rhetoric from the political leaders of those nation-states, no
nation-state has yet responded to a non-kinetic cyberattack with a kinetic operation. While the future of
cyberwarfare in the 21st century will likely show cyberattacks that occur, not in conjunction with traditional
armed conflict, but rather stand alone in a non-kinetic
battle, it is equally as likely that these increased nonkinetic battles will have kinetic repercussions.

Author Information

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

fALL 2014

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - Fall 2014