Cyberwar countermeasures a waste of money, says report

When the writer of an infamous book for hackers says we should stop panicking about cyberwar it’s probably time to sit up and take notice.

“Governments should take a calm, disciplined approach and evaluate the risks of each type of attack very carefully rather than be swayed by scare stories,” says Peter Sommer of the London School of Economics.

Under the pseudonym “Hugo Cornwall”, Sommer published the infamous Hacker’s Handbook in 1985. Since then he has become a noted security researcher and expert witness. Now he has co-authored a report for the Organisation for Economic Co-operation and Development (OECD) which warns governments against swallowing wholesale stories about “cyberwar” and “cyberweapons”.

Published today, Reducing Systemic Cybersecurity Risk says that a true cyberwar would have the destructive effects of conventional war but be fought exclusively in cyberspace – and as such is a “highly unlikely” occurrence. Like others, New Scientist has often used the term.

Cyber-spying

“Analysis of cyber-security issues has been weakened by the lack of agreement on terminology and the use of exaggerated language,” the report says. “Cyber-espionage is not a few keystrokes away from cyberwar, it is a method of spying.”

Controversially, the OECD advises nations against adopting the Pentagon’s idea of setting up a military division – as it has under the auspices of the US air force’s Space Command – to fight cyber-security threats. While vested interests may want to see taxpayers’ money spent on such ventures, says Sommer, the military can only defend its own networks, not the private-sector critical networks we all depend on for gas, water, electricity and banking.

Co-authored with computer scientist Ian Brown of the Oxford Internet Institute, UK, the report says online attacks are unlikely ever to have global significance on the scale of, say, a disease pandemic or a run on the banks. But they say “localised misery and loss” could be caused by a successful attack on the internet’s routing structure, which governments must ensure are defended with investment in cyber-security training.

Jay Abbott, a security manager at the consultancy PricewaterhouseCoopers, agrees that the routing structure is indeed vulnerable. “Short of physically cutting the wires, it’s the best way to take down a country from the internet,” he says.