Today. We're very, very fortunate to have with us our very long time friend and colleague, Professor George Lucas.
George holds one of the great chairs in military ethics, I think it's fair to say,
in the United States, the chair and ethics at the United States Naval Academy in Annapolis.
And he's also professor of ethics and public policy at the Naval Postgraduate School in Monterey, California.
His topic today will be an extraordinarily topical one, permissible preventive cyber warfare.
Thank you, David. Good afternoon, everybody. And thank you.
Had a great honour to be with you. Despite the exotic topic this afternoon,
I need to warn you first that I'm not going to show you any fancy film clips of killer robots
running amok or of the devastation of the globe in a cyber conflagration of some kind.
In fact, if there's any residual confusion on this, I'm going to have to disappoint those of you who may have been confused on this point,
though I do come from California, at least part of the year.
I do work on robots and cyber war. And my name is George Lucas.
Despite all of the other things, you know, I'm not the guy.
I figure when I saw this great audience this afternoon. Oh, they're surely expecting that it's.
It's my neighbour to the North American family. No such luck.
And if you doubt that, because I've been told that we bear some physical resemblance to one another,
I have to say that I take a bit of umbrage at that. He's quite old.
His beard and hair are grey and he's let himself go.
But if you still doubt it,
I can you can use some of the techniques we'll talk about this afternoon and you can check the meagre balance of my retirement account.
And that will absolutely prove to be on shadow of doubt. I am not here.
So the title of the talk today was entitled was intended to be provocative by suggesting that there might be occasions when a cyber war,
if there is such a thing as a cyber war, some doubt that there is,
but that if there is, there may be some occasions on which it's justified can be justifiably fought or pursued,
and those may even include cases of what normally would be considered unethical and illegal wars.
Preventive wars of self-defence. A better title than the one that I've picked, however,
would probably have been to borrow a the example of my colleague Henry Chu and also another colleague,
Rob Asaro at the New School for Social Research in New York, both of whom published papers with the titles.
In Henry's case, is a just preventive war possible?
As a question. Rob published a paper called Is a Just Robot War Possible?
So this would be really the question we're addressing. Is it just cyber war possible?
To answer that, I begin with the caution of the great theorist of conventional warfare, Baron Carl von Clausewitz,
who warned at the end of that magisterial work of his that every age has its own unique kind of war,
its own peculiar preconceptions, its own limiting conditions.
And that's what we want to look at this afternoon.
What are those unique conditions, those preconceptions, those limitations that attend to cyber conflict?
I'm going to suggest sort of to give you an outline in advance.
And where I want to go with the talk is that there are several really unique and
troubling features about cyber war to which we need to attend more carefully.
The first is the one that always strikes us as so extraordinary that and which were only recently coming to terms with in the last few
years with the warnings we've been getting from a number of quarters about our vulnerabilities in the cyber sector of the cyber domain,
and that is that any otherwise ordinary object or artefact or mundane process or conventional procedure, industrial or otherwise,
if it involves computers controlling or guiding it in any way running software and is connected to the internet,
then that object, that process, that procedure can in principle be weaponized.
So the most ordinary kinds of things that we take for granted from cell phones to ATM machines to our own laptops, to, of course,
more extraordinary and complex systems and procedures such as a nation's energy grid or its financial system or its system of traffic regulation or.
Or air traffic control or maritime security.
The logistical, food supply, health care, any of these things in principle can be weaponized.
That is can be turned against the people who rely on them, depend upon them, and generally take them for granted and use to harm them in some way.
The nature of that harm and the degree to which such harm is possible is another one of these questions that we need to wrestle with in cyber war.
So point one is, if everything can be weaponized, cyber war is a ubiquitous kind of warfare.
And the other piece of it that is ubiquitous is the claim that anyone,
any of you sitting here, any individual in the war, in his pyjamas, in his bedroom,
or a home office or any organisation, criminal, legitimate, commercial,
otherwise, or nation state, anyone can engage in cyber war or that's the claim.
So cyber war is ubiquitous in two senses. Anything can be weaponized and anyone can utilise those weapons.
So that's a rather at first glance, a kind of startling and frankly, frightening prospect.
And there have not been there's been no reluctance on the part of a number of people to frighten us with what
those prospects are and try to convince us that the harm that can be done is very real and very severe.
And in extraordinary circumstances, if any of you have seen, for example,
this book by the former national security adviser to President George Herbert Walker Bush,
Richard Clarke, cyber war, the next threat to national security and what to do about it.
That's an example of a knowledgeable and a very dramatic presentation of what
the prospects of cyber warfare and the degree of our vulnerabilities to afar.
It's a scary scenario, particularly as he begins to describe the kind of violence and destruction that could in principle occur in cyber war.
Chlorine gas escaping from chemical plants near urban areas.
Trains going off the tracks. Cars running into each other.
And intersections. Planes falling from the sky. On and on it goes.
These pictures are designed to show what some of the comparative devastation would
be in a nuclear attack on the level of Hiroshima over on the far side here,
compared to a cyber attack on infrastructure like a dam.
In this case, what I've portrayed are the Glen Canyon and Hoover Dams in United States, which in principle, again, if you listen to these arguments,
can be subject to a cyber attack that would cause the major electric generators to overheat and finally explode, damaging the dam.
The water pressure would would would unleash a torrent of torrential flood and the energy releases.
There would be orders of magnitude more than a nuclear explosion and result
in untold death and destruction and immiseration of the civilian population.
So that is the kind of of the portrait that's painted.
And the other piece of this that I think that you need to keep in mind is the claim that this is all
going to be done presumably by well by folks in the employ of al-Qaeda reporting to Ayman al-Zawahiri.
They're the current leader, perhaps from us.
Two or three people from a small flat in Hamburg are trying to pull this off, or even worse, the worst nightmare of all.
It'll be your next door neighbours, teenage son up in his bedroom who's going to do all this?
And it's at this point that I want to say that we need to take a deep breath, step back,
and having been alerted to our vulnerabilities, think a bit more carefully about just how severe those are.
I think a lot of this has begun to move from appropriate warning and caution to a kind of cyber hysteria
and threat information that probably doesn't do anybody any good and may actually do some harm.
It may inappropriately allocate resources.
It may inappropriately allocate power from one branch of government to another.
It may protect certain areas of research and defence and security from the normal kind of budget scrutiny that all the rest of us are going through.
So there's self-serving elements to this that need to be carefully borne in mind,
as well as the realistic assessment, which we have yet to come up with a realistic assessment of the threats.
I think there's a reason behind that I have failed to mention thus far that I think is important to keep
in mind why this might be as confusing and as then essentially conceptually inchoate as it is right now.
And that is that most of the warnings have come from and also most of the weapons and strategy have been developed by people.
Whose primary vocation is in the intelligence and security communities rather than in the military percent.
That's not to say the military are interested deeply, but initially uniformed military personnel were deeply sceptical of the threats of cyber war.
They pooh poohed them and ignored them for a long time and finally were persuaded that they were real.
And now, of course, the way we often do, we're going gangbusters and throwing money at it like there's no tomorrow.
And again, it's because there is a realistic assessment of threats, particularly when you're involved.
As my organisation, United States Navy is, and something called, with the last decade been called net centric warfare,
suddenly realising that all your advanced technologies from predators to satellite communications to unmanned autonomous systems of other sorts,
could be hacked, devised and and compromised and used against you or interfered with, and in various significant ways is deeply unsettling.
But I call your attention to the intelligence dimension that is the espionage dimension of this,
because the people that are involved in that kind of work come at the nature of inter-state conflict in international
relations with a very different set of assumptions than do people who are trained primarily as military combatants.
For example, the law of armed conflict is not seem to apply to the intelligence community,
doesn't have any real bearing on what they do, nor do they pay much attention to it, whether they should or not.
So another question is just what are the, if you will,
the cultural presuppositions that go into thinking about this kind of conflict and how to how to prosecute it, if you will, or defend against it.
The assumptions are those of the espionage agent or the covert agent and the intelligence and reconnaissance personnel, not the combatant.
And I think that's important. And another problem that comes up is that the distinction between all the things I've listed up here,
ranging in kind of continuum from mischief and vandalism to self-interested crime to espionage, sabotage and terrorism all the way up to war.
Those boundaries are not very clear in the cyber realm.
And if you listen to people like Clarke and many others who've written on this,
one minute they're talking about something that looks like full scale warfare with massive loss of life and harm.
The next thing you know, they're talking about really extraordinary acts of espionage,
which are the data theft of data of a classified sort about national security or commercial trade secrets, one of which is spying,
the other of which is commercial espionage or crime kind of trade infringement and patent infringement and so forth, say, well, wait a minute,
those are sort of aren't they covered by sort of different conceptual frameworks for thinking about them ethically and legally?
Different legal regimes apply to these, but we move around with a kind of reckless equivocation in these areas that I think is not helpful.
And in particular, I think the threat that so often raised of cyber terrorism,
that is of al Qaeda or some other organisation engaging in the kind of attack bringing down the Glen Canyon Dam,
if you will, or the the Hoover Dam or the Three Gorges Dam in China.
That's probably unlikely. And we can talk about why I believe that and whether it's a valid view.
But I think for the moment one needs to keep these distinctions carefully in mind and recognise that then for some of them,
the ones that are sort of at the beginning of the list, the ones we're most familiar with,
vandalism and hacktivism and mischief making as well as organised crime.
We have a fairly robust legal regime in domestic law and now in international law through this Buddhist
Budapest Convention on cybercrime in 2001 to try and keep up with cyber criminals and cyber vandals,
track them down, find them and bring them to justice and cooperate across borders where in cyberspace there aren't any borders.
It makes it very hard. But crime fighting has always been hard and international crime fighting especially.
And we're doing all right in that area, I would suggest where we haven't done much thinking and reflecting is in the area where
David and his colleagues called us to convene this morning to talk about the other end,
if you will, of that continuum, the espionage, intelligence, covert action, sabotage, cyber war side.
That's the part that I think is is needing some attention. A very nice article on the ethics of cyber war.
I think the best one to come out so far,
one of the few and of the few I think the best is by my colleague Randall Deibert at the University of Buffalo.
In the U.S. the ethics of cyber warfare, which you'll find in last December's issue of the Journal of Military Ethics.
Now, what Randy Dyker does is run.
He's very technically sophisticated about how cyberwar works more far more so
than most of us who come at the ethics side of the question or the legal side.
And so he's able to talk in knowledgeable detail about what some of the challenges are and argues discouragingly in his
article that conventional just war thinking and international law are completely inadequate and have to be thrown aside,
ignored or radically revised in order to keep up with the new challenges of cyber warfare.
I happen to think once again that's an exaggeration, that's part of the hysteria,
but I think it's an important position to recommend from the legal side.
One of those recent pieces. There's actually a fair amount of good work out on cyber warfare and information warfare.
And the law is a fellow by the name of Duncan Hollis at Temple University has written some interesting papers.
A colleague in the Navy War College,
a retired general whose work Henry Schuster knows Michael Schmidt has written some papers on ethics and law in cyber war recently.
Steven Bradbury, who was the deputy legal counsel in the Office of Department of Justice,
gave the keynote address at the annual Harvard National Security Forum,
and his paper on developing legal frameworks for defensive and offensive cyber operations will be forthcoming.
And it's a good survey. And one paper on quality retention is has just come out this last last month in
October by a colleague at King's College London by the name of Thomas Read and he
far more than I am actually I think briefly I enjoyed the role of being the cyber
sceptic or a naysayer who said this is all a lot of poppycock and hyper inflated.
Chicken Little Sky is falling stuff. Thomas Read is even more so than I am.
He denies that any cyber wars can have or ever will occur, and that what goes on here in this discussion is, again, this massive equivocation.
The problems are crime and espionage, not war.
Okay. I think that is too extreme, as you'll see in a moment.
But that's kind of a quick survey of some of the literature. There's not a lot out there.
What kinds of ethical questions does it raise?
Well, the United States, in my own case, was criticised for not having a very well thought through cyber strategy.
I think the same debate was had here in the U.K. and so both governments quickly do,
as governments do, get groups together, committees and so forth, and churned out documents.
I brought with me a couple that have come out in just the past few months.
This is a picture of the title page of one of them from the Department of Defence,
its Department of U.S. Department of French Strategy for Operating in cyberspace.
Which one of the draughters who would not allow his name to be used but was quoted widely in the press when this came out, saying,
basically, our cyber strategy, folks, is this you shut down our power grid, maybe we put a missile down one of your smokestacks.
Seems with all the subtlety and finesse of which my I and my countrymen are famous, this seems to have sort of put a rather a fine point on things.
Of course, it leaves the question of whose smokestacks will we put those missiles down?
Given that it's very hard, as you are, I'm sure no, to determine exactly who has done what and with which and from where and to whom.
How many missiles would we propose to put down? That's not addressed in the Defence document.
Of course the real problem is just the kind of harm done in a cyber attack,
something about which we are very unclear what is the nature and the severity of harm that can be done in cyber war?
I showed you the graphic pictures that look like conventional bombing attacks, but we're talking more like freezing your bank account.
Or as one other sceptic put it, it would be like the Russian army invaded the U.S. and then they shot in line and said,
we're going to keep you from renewing your driver's license in Hong Kong.
You know, and they went, oh, wait a minute, how is that an act of war?
How is that that harmful? So things like this all go on in a confusing way here.
So how many missiles, if any, are an appropriate response to that?
And indeed, does that kind of thing even constitute a grounds for this kind of tough, rough,
obviously deterrent oriented talk about it can what the military likes to call kinetic response,
what we would call bombs and destruction and loss of life and the one that interests me and.
Interestingly, I think has interested the people who are working in the intelligence community on developing cyber defence and cyber weapons.
They're the first to raise this question. Some of the weapons and tactics we're being asked to develop seem deliberately to target civilians.
That's wrong, isn't it? That's against the law, isn't it?
This is a computer scientist, you know, who doesn't really know much about international law, and that's not his or her field.
But they are raising these questions very interesting ways.
So obviously that one are we are we are required as those are you familiar with the sort of underlying tenets of international law?
I highlighted all those questions from the defence document and read because they correspond to
some areas if one summarises the sort of underlying principles of the law of armed conflict.
There are five of them, three of which seem to have been addressed in those preceding sets of questions.
How what military objective would be served by a cyber attack or a response to it?
How proportionate would such an attack be and how would that be determined,
given that we don't know what harm means in the cyber realm and how discriminate would we require such attacks to be or responses to be?
When we turn to the area with which I'm personally more familiar, which is just war theory itself,
that philosophical discussion down through the centuries that sort of forms the back historical background and the intellectual
foundation for international humanitarian law in the Geneva Conventions and military regulation and the Hague Conventions.
That a decision of war requires a compelling cause or justification.
Among other things, public declaration by a legitimate authority and has to be undertaken as a lab only as a last resort.
Well, stop right now. We see already that cyber war presents a real problem, at least for the second and the third of these.
We have no public declaration. We have plausible deniability.
People smiling and saying we didn't do it. It was loyal citizens of the republic who launched an attack on Estonia,
had nothing to do with the state and the extent to which therefore their authority is legitimate to undertake such an attack,
let alone whether the cause is just are difficult to examine.
And of course, the great fear in cyberwar, given its sort of strange features, is, again, as we were discussing in our roundtable this morning,
because it can be undertaken at least in some under some conceptions without a lot of physical harm or loss of life.
Might that make it easier to resort to war, cyber war as a form of conflict resolution, not as a last resort, but as the first and preferable resort.
So like most recent military technologies, the problem is that the cyber war dilemma really raises this threshold question.
That is, will all these new technologies, robotics and predators and non-lethal weapons and so forth,
India, and just make it easier for nations to fight because they won't see the costs attached to it.
So those are problems. On the other hand, when we look at how war is conducted in the conventional sense,
the restraints there of military necessity and proportionality and the discrimination of combatants and non-combatants.
The interesting thing about the cyber realm is that it offers a lot of promise in those very precise
weapons that can be used only against purely military targets with little or no collateral damage,
and to be very discriminant, very proportionate. So those are the things I think that needs to be examined.
Well, how would we go about doing it? Well, we have a methodology and applied ethics.
We tend to when we face these new and somewhat unfamiliar areas,
whether they were have been in medicine or business or whatever the areas were in decades past,
that applied philosophers like your colleagues here have taken one.
You start with your sort of pre theoretic intuitions, your best reasonable positions about what you think constitutes acceptable behaviour.
You test those in actual and in hypothetical cases, and you engage in what the philosopher John Rawls called reflective equilibrium.
That is, we essentially argue with each other dialectically about what reasonable behaviour would seem to constitute under the circumstances of
trollies hurdling at defenceless people or persons devouring one another's kidneys on a desert island or whatever the case may be.
That seems to be the convention of of philosophers.
That's actually not unlike somewhat more frivolous, perhaps, but not unlike what what goes on in international law.
This is what John Randolph, the fellow I mentioned, this paper I mentioned earlier, recommended.
What we need to do is sort of see what people are actually doing and how they're going about it and how the.
Reacting to what they do or what others do to them,
and follow the principle of the evolution of customary law by looking at the boundaries of acceptable and unacceptable practice.
So in a way, I think the methodologies of applied philosophy, international law work together very well on this problem.
Let's see what's going on. Let's try out a few cases.
Let's look at some actual experiences. And in this case, I'm going to now propose we look at four cases of cyber war.
And I believe they've been instructive that some of them, not all of them,
have been carried out within what might be broadly seen as the bounds of both international humanitarian law and the law of armed conflict,
as well as the constraints of just war theory.
The four conflicts I have in mind and I need to play this for you so that you'll be clear that not all agree that these were acts of war against them.
My colleague at King's College would say none of these rose to the level of warfare.
These were conventional wars. This wasn't a war at all. This was just sort of propaganda and this was sabotage.
Okay. I'm going to argue that these were recent cases that we have discussed.
They're in the literature. You can look them up online if you're not already. I'm sure those we're interested in this already know a lot,
probably more than I do about some of these conflicts and the full scale attack on Estonia in 2007.
Presumably, as I put with the question mark by the Russians,
likewise Russia against Georgia in the battle over the secession of Ossetia in July
of 2008 are somewhat less well known because neither victim nor the combatant,
neither none of the sides wanted to admit this had happened.
But Israel attacked in a conventional way a suspected nuclear weapons site in Syria on the 6th of September 2007.
All of these, by the way, are dramatically described in Richard Clarke's book, if you would like.
If you're not familiar with them, I'd recommend grabbing a copy off the local newsstand where it will be,
you know, in the airport bookstore and it will be prominently featured.
And and it is he has a real gift for describing not just the details accurately,
but also the sense of drama that surrounds this and a kind of excitement and the exotic feature of this attack.
The middle to were conventional military altercations that were preceded by cyber.
Attacks of some kind. The first and the last were purely cyber attacks involving no conventional exchange of kinetic forces at all.
Okay. So they're interesting cases. And let me talk about each in turn just very briefly.
Again, keeping in mind these principles of just war theory, justifiable rationale,
last resort, proportionality and discrimination in the conduct of war.
I would submit that the one you're probably most familiar with, the attack on Estonia was a violation of all of these principles.
That is, it lacked a just cause. Moving a military statue from the centre of town in a sovereign republic to a place of honour in a military cemetery.
Hardly cause is sufficient as an act of war.
The attacks were then badly motivated.
They were not a last resort. No, no.
Real attempts other than hooliganism were were were mounted to try and reverse the government's decision about the statue that compromises war.
It was a successful diplomatic negotiation, actually, that took place before all of this.
And there really wasn't any reason for these acts of aggression other than a kind of hooliganism against against Australia.
And they were indiscriminately and disproportionately directed at the civilian population.
Now nobody was killed.
To my knowledge, there's no deaths have been directly attributable to the denial of services that were involved in these attacks.
A lot of inconvenience was suffered, but I don't know that any great harm of a lasting and enduring sort comparable to conventional war.
This is why Thomas Wren doesn't think this was a war.
And this is also why Naco would asked under Section five of the collective security arrangements, refused to come to the aid of Estonia.
While this doesn't rise to the level of war. So it's disputed. What it is, is without a just cause.
Wasn't a last resort. Was disproportionate, extreme and indiscriminately directed at civilians.
So I think it fails the test. By contrast the next two and that earlier last Russia's attack on Ossetia and the and the Israeli attack on.
Sorry. Russia's attack in Syria and Georgia. And the Israeli attack in Syria.
These strike me as falling within the boundaries of acceptable practice as defined here.
That is, they were part of conventional wars which had legitimate political differences that could justify use of force in those cases.
On our conventional understanding in recent history of when that is acceptable practice.
They were directed entirely at military targets. No civilians were targeted.
No civilians were killed. No civilian infrastructure was damaged.
So they were both discriminate and proportionate.
And both attacks occurred after lengthy negotiations in both cases and in the Syrian Israeli case under the table, so to speak.
You know, Syria denying that it was building with North Korea's help, a nuclear reactor, very much like in Iran.
Now, you know, the denials occurring, the denunciations from the other side.
So it wasn't as though diplomatic initiatives weren't. I tried.
So I think those two are reasonably within the realm of conventional understandings, both of international law and of the law of.
I'm sorry. I have just war.
Now, Stuxnet is the one that's probably probably half the people in the room are experts on Stuxnet and others have never heard of it.
So a very quick rundown of the details as they have emerged over the last year or
so is this is a cyber worm that was developed by we do not know who we presume,
whoever smiles the most broadly and remains silent whenever the topic is broke.
It spread from computer networks while various theories about how it got around.
One is that some secret agent took a thumb drive and plugged in an Iranian computer somewhere, which is the way in which this often happens.
I think that's probably not plausible or accurate in this case, that the worm was developed,
released in Indonesia from all likelihood in launching it spread.
It spread to countries in computers all over the world, slowly,
unlike a virus which multiplies quickly, a worm kind of, as its image suggests, crawls around,
slowly goes from one computer to the next and makes its way around the world in
the Internet and finally found to be residing on computers in all these countries.
But it did no harm. It stayed.
A note on the computers on which it was detected. Unless the programs that constituted the worm detected a particular kind of software,
proprietary software produced by the Germans company in Germany, now configured to an array of nuclear centrifuges.
And not just any nuclear centrifuge, not even just any Siemens nuclear centrifuge,
but a particular mathematical array of it, particularly the German side, 984 to be exact.
If you on your personal computer are running an array of 984 Siemens computer centrifuges, nuclear centrifuges,
spinning and producing fissionable material for a nuclear weapon, this worm is a problem for you.
If you're not doing that, it even if it's on your computer, it doesn't do anything.
It just sits there and makes itself inert.
And it is apparently set to destroy itself on the 24th of June next year.
So this is know this took like a year for people like this gentleman, Ralph Langer, who is a German cyber security expert.
He's the one who's credited with first had discovered this worm moving around the Internet and
calling attention to it and the warnings that were levelled by him and others as to what it meant,
what it was doing were wildly disparate as time went on.
Finally, it turned out it did seem to be a weapon, a very sophisticated weapon, as he credited it,
that very primitive weapon that targeted only the nuclear centrifuges involved in the
in Iran's presumably internationally sanctioned and illegal nuclear weapons program.
Didn't kill anybody, didn't break anything, certainly didn't hurt or targeting civilians.
So it was a rather remarkable piece of software.
Those are the four attacks that we know of. And what I think and here I'll wrap up and give us some time for for discussion.
I hope that they suggest some emerging norms for cyber war from the practices that we find acceptable and unacceptable and by
extrapolation and extension and interpretation of what we know at present about how conventional war should be conducted.
A cyber war would be permissible if the weapons, the cyber weapons aimed primarily or exclusively at military infrastructure,
if they degraded and adversaries ability to undertake highly destructive defensive operations.
That one's key, because that's the just cause you're cause would be to keep an adversary nation from doing something of a conventional sort,
like building a nuclear weapon and using it. Then in the process of trying to prevent that and and arguing for justification in terms of
that goal or intention that neither deliberately targets nor ultimately harm civilians,
nor civilian infrastructure, and that it is undertaken as a last resort in the required sense.
That is, every other reasonable option is first and exercised and tried without a deal, and further delay would only make things worse.
For those of you who know the work of Michael Walzer on pre-emptive self-defence,
you know that those are the conditions he uses to extend ever so slightly the notion of pre-emption from immediate,
imminent harm to, oh, we've we've worked hard to get rid of this.
It's not getting anywhere. It's a real threat. And waiting is only going to make matters worse than you're entitled to defend yourself.
So that suggests that this would cover in this case,
a cyber case with these conditions meant above would cover preventive as well as defensive measures in the traditional sense.
Okay, so I'm done. I just want to leave you with some some things to think about.
One is that one of the.
Well, these are sort of lists of problems that we have to come to terms with, and we really don't know how to make sense of them.
Some of you may know that that the question was raised whether the U.S. could use a cyber attack as Syria I'm sorry,
as Israel did against Syria to take down its air defence forces before Naito began the bombing missions to protect civilians in that country.
Apparently, the U.S. decided not to do that. There were two arguments given.
One was that we really you know, cyber weapons are time intensive and they're one off.
That is, we they are uniquely designed for a particular target.
It takes time to do that. And expertise, knowledge.
It isn't like we've got a shelf full of them sitting here somewhere and we just pick one up, stick it in the rifle and shoot it.
So they're not like conventional weapons our way.
So we really haven't had time to prepare a cyber weapon or more sinister account would be we have some on the shelf and they would work,
but we wouldn't want to reveal their existence and use them for such a relatively trivial reason, partly because it would show what our capacity is.
And partly because once they. Used to can't use them again. Okay.
Now, that last comment ties into a criticism by Ralph Langer, this German cyber security expert about Stuxnet.
He regards this as a very reckless, indiscriminate attack, not because of the damage it did itself in in the immediate situation,
but because now it's out there on your computer very possibly,
and a hacker who couldn't do this on their own life's expertise and download the software reverse engineer it, study how a weapon was put together.
It becomes a kind of open source weapon.
And he's even claimed recently in the press that he sees elements of Stuxnet reappearing and being used to do similar kinds of damage,
as was done to the centrifuges now to, say, industrial infrastructure in other countries by terrorists.
I think that's a mistake as well for a variety of reasons.
But let me just set that aside. We have to think about that as a problem.
Generally,
the design of these as effective weapons requires so much time with so much expertise that the scenario of the kid or the terrorist doing this,
I think is implausible and extreme. The kid or the terrorists can do a lot of trouble, make a lot of trouble.
They can engage in vandalism, they can engage in crime, destruction of property, theft of property, the denial of service.
They can shut down local power grids and do all kinds of things, as kids can do in conventional ways now, as terrorists can do.
But when it comes to designing a weapon to do what Stuxnet did, that probably took a couple of years and hundreds, if not thousands of experts.
And it required something that your neighbour's 14 year old kid probably doesn't have first.
He doesn't have good grades in physics and engineering because he's been screwing around on the Internet and Facebook.
Secondly, last time I checked, a centrifuge will not fit in the upstairs bedroom or the terrorist the part flat in Hamburg.
And what's often what people fail to understand is you have to have access to the hardware that you're planning to attack in a genuine cyber attack,
be able to experiment on it and work with it. That takes time and expertise, and usually that's a collective enterprise.
So in a way that I think is guardedly hopeful,
this keeps cyber weapons of the serious sort that people are terrifying us with more at the level of the state centred,
state centric conflict of violence, which means it's amenable to governance,
treaty regulation, an agreement based on self-interest, which vandalism and terrorism or not.
There are interesting and competing philosophies of cybersecurity in my own country.
The two documents that came out, one came out of the Department of Defence I've already mentioned and surprise, surprise,
it sounds like it was written in the People's Republic of China in the sense that it's extremely defensive
in its very concern for dominance on the one hand and protection of infrastructure and of security measures.
Whereas a document written in part by a colleague from the program here who's now
working in President Obama's office and for the State Department is called the sorry.
This is the world peace, the Internet, the International Strategy for cyberspace.
This is President Obama's document.
This one is open, hopeful, aspirational, almost to the fault of naive attack in the sense that it believes in the end, transparency, openness,
the developmental capacities of the Internet with far opposite any of these vulnerabilities,
and encourages the nations and peoples in the world to work in that direction.
So which philosophy ought to reign the one that's concerned, lest my retirement account be drained?
Or the one that argues in the end, what we want is the greater industrial and economic productivity,
the learning, education and human welfare that the Internet can produce.
Finally, I think I'll assert that I think this discussion has been dominated by our intelligence community thus far.
That means that the conceptions that are brought to bear in thinking about what's acceptable and unacceptable are from the get go,
very different than what most of us would presume.
And the distinctions between genuine acts of war and these acts that are very much at the edge of war intelligence,
espionage, reconnaissance, surveillance, sabotage, covert action are blurring.
And we don't know what to do about that. And I think I know what to do now is shut up and see what questions you have.
Thank you very much for your attention.