The media and some U.S. politicians called the 2020 Russian cyberspace intrusion into U.S. government agencies to steal information a cyberspace attack, though it was clearly an act of espionage and involved no denial of service or damage. (In other words, the event was cyberspace espionage and not a cyberspace attack.)<\/p>\n\n\n\n
Conversely, some politicians, many lawyers and some analysts want to call the 2014 North Korea destruction of Sony Pictures computers, the 2015 Russian denial of service attack against TV5 Monde in France, or the 2015 and 2016 Russian cyberspace denial of electricity in Ukraine a \u201cviolation of sovereignty,\u201d but not a cyberspace attack, nor even a use of force. This is troubling and trivializes such events. By the same logic, for instance, ransomware events are not cyberattacks.<\/p>\n\n\n\n
Historically, it is difficult to find a politician, lawyer or analyst who questioned the longstanding term computer network attack (CNA). They all accepted that such events involving creation of denial effects were CNA, since they involved actions that met the standard definition: \u201cto disrupt, deny, degrade or destroy information resident in computers.\u201d<\/p>\n\n\n\n
Likewise, it would be hard to find a notable example of a politician, lawyer or analyst questioning the even longer-standing term electronic attack (EA) \u2014 the use of electromagnetic energy \u201cto degrade, neutralize or destroy enemy combat capability.\u201d EA has long been considered a form of \u201cfires\u201d and a bona fide form of attack.<\/p>\n\n\n\n
But when the Department of Defense made a minor change in the term CNA to \u201ccyberspace attack,\u201d all of a sudden many changed the triggering criteria for attack to physical damage that one can see, or physical harm. What happened?<\/p>\n\n\n\n
This reasoning is likely tied to the international humanitarian law distinction of an armed attack requiring physical violence. But this doctrinal and policy timidity fails to account for the uniqueness of operations in cyberspace and is politically and logically harmful.<\/p>\n\n\n\n
The 2014 North Korean destruction of computers inside Sony Pictures was cyberspace attack and most certainly a violation of sovereignty. The 2015 and 2016 Russian denial of service on Ukrainian electric companies was cyberspace attack and most certainly a violation of sovereignty. In both cases, code was damaged, arms were used, service was denied, sovereignty was breached. The fact that Sony replaced the damaged computers (at a cost of tens of millions of dollars) or that electricity was restored in Ukraine 5 hours later is irrelevant. No one would claim that if the Russians destroyed a Ukrainian circuit breaker with a small charge, and the breaker was replaced 5 hours later, that no attack had been conducted. So why do some analysts claim a cyber weapon used to deny the breaker\u2019s circuits, later restored, was not an attack?<\/p>\n\n\n\n
The reason some don\u2019t claim this is because they are afraid of having to call many more such events attacks, particularly events that the U.S. government conducts. Ironically, failing to call these North Korean and Russian attacks what they really are makes it even harder (not easier) to respond to them. Former President Barack Obama, for instance, declined to call the North Korean Sony event an attack and instead called it a cyber nuisance. Such decisions are always political in nature, made in consideration of many factors, only one of which is the actual effect in cyberspace. These politicians and analysts may think they are helping U.S. policy by not doctrinally calling such events attacks. But overall they are hurting policy terribly, since they minimize the significance of such attacks (despite the size of the damage or denial of service) and consequently hamper and hamstring U.S. responses.<\/p>\n\n\n\n
Do we not call ransomware attacks \u201cattacks\u201d? We do, and we should, since they deny service. They are serious events; most often they enjoy the countenance of a state (e.g., Russia).<\/p>\n\n\n\n
What if a five-hour electrical grid disruption delayed the delivery of medication somewhere, which resulted in a death weeks after the cyberspace event? Would that not be an attack? Can attackers deny service to webpages, electrical grids, dams, air traffic control \u2014 all temporarily \u2014 and, as long as no one dies during the event, it would only be considered a violation of sovereignty or a nuisance?<\/p>\n\n\n\n
If a weapon physically tore apart a system, but it could be repaired, everyone would certainly call that an attack.<\/p>\n\n\n\n
If a weapon physically dissembled a system, but the system was reassembled 5 hours later, the same would be true.<\/p>\n\n\n\n
But if a cyberspace capability (a weapon; an \u201carm\u201d \u2013 a form of fires) disabled code, which was later repaired, many claim such an event alone is not an attack. This is illogical.<\/p>\n\n\n\n
These events involve \u201cfires\u201d and although the fires may be digital or small in size (even unseeable), logically, historically and doctrinally they fall within traditional understanding of \u201cattack.\u201d<\/p>\n\n\n\n
On the one hand, many are quick to call a cyberspace espionage event an attack. On the other hand, when cyber events deny service or make systems inoperable, many are reluctant to call these<\/i> events attacks, since such a label seems to imply some sort of escalation is warranted, if not mandatory.<\/p>\n\n\n\t