The Ashimmy Blog: Its a mad, mad, mad world

Regardless of whether you think the Aurora/Google/China incident was a simple hack or the most sophisticated thing since the cotton gin, I think it is going to mark a historical demarcation line. From this point forward the PA (post-aurora) era will have governments, corporations and individuals the world over recognizing that the new battleground is a cyber zone. This is a lesson that the folks in the US Department of Defense have recognized for a long time. While we were busy every year yelling about FISMA and so forth, the people on the front lines of this cyber cold war have been trying to stay afloat against a sustained assault on our networks that has been going on for years. They are not perfect, but the fact that a genuine disaster has not occurred as a result is no small testament to their diligence, hard work and intelligence.

Whether you take the position that Rich Mogull has laid out in his firestarter post on APT, namely that this is espionage and not warfare and we just need to deal with it or the NY Times approach that the Google/Aurora incident was part of the ongoing digital warfare that is underway, is I think irrelevant. When I boil it down, it is only a matter of degree. Espionage is an act of war, punishable by death. You can have cold wars and hot wars and then there are simmering wars. This new war is of a different type of war, but the stakes are no less dear. It is for control of the world.

We are in the 2nd decade of a new century. There are many countries who think that it is their manifest destiny to become the "America" of the 21st century. This war, like many before it is for economic dominance. This makes private corporations that are economic powerhouses targets. Don't think for a second that we here in the US are not gearing up for this type of war either.

For me the real issue is that the game and the rules have changed here. We have not yet come to terms with how this game should be played or even what the rules should be. We are still a cold war generation. Our rulers learned the game during the cold war rule set. We yearn for a deterrent that will put the brakes on an adversary going beyond what we deem to be the line.

In the good old cold war we had MAD. Mutually assured destruction was what we could bank on. The Soviet Union didn’t want to end the world anymore than we did. We and they knew that if we allowed things to go to far, there was no turning back. So we could have our little “hot wars” in Korea, Vietnam, Afghanistan without pushing either side too far. Only the Cuban missile crises really brought us to the brink.

Of course we let our surrogates fight the fight the world over. We supported them with weapons, money and training. So did the other side. There were lots of little skirmishes that did not directly have our troops involved, but were part of the game nonetheless. The bottom line is that there was an understanding of what would be tolerated and what would not be tolerated. The prodding and probing was as ritualistic as anything from the feudal societies of the middle ages.

In cyber warfare (sorry Rich it qualifies as warfare. The stakes are as high in terms of human life and resources as any other war. Especially when we are talking about critical infrastructure) there needs to be a tacit understanding of what will be tolerated and defended versus what goes to far. We need to decide what are the repercussions for going to far.

Having Google pull out of China is one remedy, but if one nation or faction or entity violates the rules of the game, the consequences need more bite. They should be ostracized by all the others. It should be made clear that the cost of undertaking such action, far outweigh the benefits. Whether the Aurora incident was with the knowledge of the Chinese government or not, the message has to be to “take care of your own”. They are responsible.

I don’t have the hard and fast answers as to what those consequences should be. But we need to set the rules now. Right now it truly is a Mad, Mad, Mad World. The game has changed. The players are making up new rules as they go. You can’t play a game without rules. That become anarchy. But the balance will be restored, it always does. We just need to make sure the rules are understood by all parties and that it is better to play by the rules than outside of them.