Without Computer Scientists In Policy Debates, Nations Are Vulnerable to Cyber Attack

If the type of catastrophic cyber attack that makes for Hollywood blockbusters were to actually happen today, the response would be led by policy makers, politicians and military officials who may not have the expertise and training to deal with such an event.

That’s why computer scientists need to take a more active role in helping shape U.S. policy on cyber conflicts and national security, according to an article in the June issue of Communications of the ACM, an academic journal.

“Policymakers have some experience with many kinds of crises, but their understanding of the cyber world is, with some exceptions, sketchy and incomplete,” writes Herbert Lin, the chief scientist at the Computer Science and Telecommunications Board of the National Academies. “Nevertheless, in the event of cyber crisis, they will make decisions with whatever information and knowledge they have. Computer scientists today are in a poistion to play a role in helping shape national and international policies regarding cyber conflict.”

Most of the time, when popular media refers to a “cyber attack,” what they’re really talking about is espionage. The goal of such attacks is to gather information, ranging from technical documents and political memos to Social Security numbers and money in bank accounts.

There are, of course, cyber attacks that do fall more closely toward the definition of war, Lin writes – most notably the 2010 Stuxnet worm that the U.S. government used to disrupt control systems at an Iranian plant that was being used to enrich uranium. Lin argues that the imagined, worst-case scenarios – power outages affecting hundreds of millions of people and airplanes crashing as a result of a hacked air traffic control system – are unlikely.

“Still, policymakers are paid to make contingency plans even for unlikely events – and the policy question is this: If a catastrophic cyber attack against the U.S. … did occur, should the U.S. regard it as an act of war?” Lin writes.

This is where computer scientists can help in the debate, since, unlike conventional acts of war, there are unique factors for cyber attacks. What does an act of war mean, for example, if the person who initiated it can’t be identified?

Lin outlines several places where computer scientists could aid in assessing and responding to such an event, including:

Determining who, if possible, is behind an attack;
Determining the location of the computers used in the attack;
Helping to limit the scope of the attack;
Enforcing a “cyber cease-fire” that may be undermined by hackers and independent actors;
Avoiding cyber conflicts altogether;
Containing small cyberspace conflicts and preventing them from growing into bigger ones.