Cyberwar

It was the second time of trying to reach Paul Quinn-Judge on his mobile phone. Was there a landline we could use? "The landlines here just don't work. It would involve many hours of pain," said the analyst for the International Crisis Group, an NGO that advises governments on conflict resolution. Quinn-Judge lives in Bishkek, the capital of Kyrgyzstan. From 18 January until last weekend, the country had been pummelled by a massive distributed denial of service (DDoS) attack. Two of its four ISPs had been hit.

Surfing from inside the country, Quinn-Judge, who says that internet access inside the country is poor at the best of times, hadn't noticed any change. But intelligence experts in the west speaking directly with senior sources in the Kyrgyz ISP community said that the sustained attack had taken as much as 80% of its internet traffic to the west offline.

But who did it, and why? The country, nestled in the mountainous territory between China and oil-rich Kazakhstan, isn't a major player on the world stage. There's little oil or natural gas. It isn't at war with anyone, and its internet infrastructure is limited at best.

Strategic importance

Don Jackson, senior security researcher at the Atlanta-based managed services firm SecureWorks, thinks that the Russian government was behind the attack. Traffic came almost entirely from Russian networks that he says are controlled by former members of the Russian Business Network, which was a St Petersburg-based ISP said to have rented network capacity to cybercriminals without asking questions.

"The RBN, meaning not just the hosting company but its close circle of clients, has been called upon to do this kind of thing by the Russian government in the past," says Jackson. He asserts that the Russian government sanctions such activities at arm's length without wanting to be seen as directly involved.

"The fact that [Russia] allows it gives some kind of consent," agrees Jeffrey Carr, chief executive of GreyLogic, a company providing intelligence on hackers to government clients. "This is a convenient way for any government to include information warfare in their overall operations."

But why would the Russians want to hammer Kyrgyzstan's already underdeveloped network? The two countries have been quietly negotiating potential Russian investments in Kyrgyzstan. "The one thing that the Kyrgyz can bargain about is the American airbase just outside Bishkek at Manas," says Quinn-Judge. Russia wants the US off its doorstep. "The Russians expressed their willingness to write off the Kyrgyz debt to Russia," he says, "and also to look for investments for a major hydro-electric project."

The Kyrgyz president, Kurmanbek Bakiyev, visited Moscow on Tuesday to try to hammer out the investment deal for the cash-strapped country, currently in debt to Russia for around $180m. Meanwhile. Nato envoys were in Kyrgyzstan wooing top officials, proving the strategic importance of the Manas base and surrounding territories to its Afghanistan campaign.

Jackson thinks that the Russians are applying pressure to the Kyrgyz opposition, which has been critical of the suggested Manas closure, by silencing its online voice and leaving westerners unaware of its point of view.

An inside job?

Russia is certainly serious about cyberwarfare. The Russian colonel VI Tsymbal warned in 1995 that the country may use nuclear weapons against sources of cyberwarfare in the future, points out Carr. But he doesn't buy Jackson's assertion that the Russian government was behind the recent attack. He thinks that the Kyrgyz leadership hired Russian hackers as a means of quashing its own opposition.

"This is more about silencing internal dissent, and eliminating one of the primary communication channels for any dissenting group, which is the internet," he says. He adds that if the Kyrgyz government - which set up its own cybersecurity initiative earlier in January - really wanted to stop the attacks, it could have.

But Rafal Rohozinski, principal investigator for the OpenNet Initiative, which tries to stop online filtering and surveillance, dismisses both scenarios. "To say who's responsible is very premature," he says, arguing that for Russia, economic leverage is more powerful than a DDoS attack. Similarly, the Kyrgyz leadership has more powerful tools at its disposal, he argues. "These include legal measures that can stop the opposition publishing content on the internet that would be questionable by the Kyrgyz government."

Unknown parties and motives may be at play, argues Rohozinski, who recalls another DDoS attack that he says happened during the 2005 Kyrgyz presidential elections. "It turns out that it may have been a Kyrgyz journalist who sided with the opposition," he claims. "He ordered these DDoS attacks through Ukrainian hackers, as a way of creating a negative feeling around the government by making out they were attacking the opposition."

The disagreement about the perpetrator of the Kyrgyz attack demonstrates both the covert nature of such attacks, and the lack of visibility into the cyberspace of some of the more remote parts of the Commonwealth of Independent States (CIS). Yet cyberattacks are a more common trait in that part of the world than in other regions, says Rohozinski.

"It's an interesting combination of political sophistication - a clear understanding of the role of information in politics - and also the fact that you have an awful lot of very tech-savvy people," he says. "If you look at the size of hacker communities - not just script kiddies but those who write original software and exploits - there's a big centre of gravity in Russia."

The area has a long history of cyberwar, says Carr. He also runs Project Grey Goose, a distributed collective of volunteers who gather information from sources as diverse as Russian hacker forums and IP network traffic.

Carr points to Russian cyberattacks on Chechnya in 2002 as the first concrete example. "That was more of a true cyberwar. It combined server attacks with a kinetic force - a military invasion. And that was repeated in the Russian invasion of Georgia, in combination with an early network attack." He contrasts this with the 2007 attacks on Estonia, which were not accompanied by physical aggression.

That's one of the problems with cyberwarfare, says Carr. There isn't a clear, international consensus on what constitutes an act of war in cyberspace. That's pretty important, given that Russian officials have threatened to nuke those that try it.

One thing that's clear is that more cyberwar is being crowd-sourced. Grey Goose investigated hacking activity during Russia's recent conflict with Georgia, which was then fed into analytical software from Palantir Technologies and used for trends analysis. The resulting report, published last October, showed that a hierarchy of hacktivists were responsible for DDoS attacks on Georgia's computer networks.

This happened in the recent Gaza conflict, too. The hacktivist group The Patriot Team released a downloadable tool that launched DDoS attacks against perceived anti-Israeli sites from willing participants' computers.

Mobilising cyber propaganda

But DDoS is just one example of a broader set of information warfare techniques, in which rival groups vie to control the message reaching the rest of the world about a conflict. Another downloadable tool used during the Gaza crisis, called Megaphone, was designed to alert users to anti-Israeli editorials, giving users the chance to send rebuttals, in an effort to sway public opinion through the sheer volume of replies.

"What the use of information effects in this particular conflict achieved is that it created a space in time for freedom of action in the kinetic realm," says Rohozinski of the Gaza conflict. "[Israel] was able to pursue a military operation without being forced to stop before they accomplished its goals."

As the still-nascent cyberwarfare concept emerges, overt battles on the ground are becoming inextricably linked to an often more covert battle of ideologies that play out in the electronic realm. It's tempting to think of this in the same way that we thought of the cold war: another battle in which proxy wars and black ops were used to promote conflicting ideas.

What happens as this cyberwar spreads to the west? And has it already happened? The Center for Strategic and International Studies, a US thinkthank, recently released a set of recommendations on cybersecurity for the Obama administration. The bottom line? No one is currently in charge, and there is much work to be done. Let's hope that they finish it before the cyberwar begins to spread.

by Danny Bradbury