I was recently invited to participate in a cyber security dinner discussion by a few members of a well-known Washington, DC, think tank. The idea was that we could enjoy a fine wine and a delicious meal while allowing our hosts to pick our brains about this “cyber warfare stuff.” It seems that the new threatscape emerging in cyberspace has caught them unprepared and they were hoping we could help them grasp some of the essentials in a couple of hours. By the time we had finished dinner and two bottles of a wonderful 2003 red, one of the Fellows in attendance was holding his head in his hands, and it wasn’t because of the wine.
International acts of cyber conflict (commonly but inaccurately referred to as cyber warfare) are intricately enmeshed with cyber crime, cyber security, cyber terrorism, and cyber espionage. That web of interconnections complicates finding solutions because governments have assigned different areas of responsibility to different agencies that historically do not play well with others. Then there is the matter of political will. When I signed the contract to write this book, President Obama had committed to make cyber security a top priority in his administration. Seven months later, as I write this introduction, cyber security has been pushed down the priority ladder behind the economy and health care, and the position of cyber coordinator, who originally was going to report directly to the President, must now answer to multiple bosses with their own agendas. A lot of highly qualified candidates have simply walked away from a position that has become a shadow of its former self. Consequently, we all find ourselves holding our heads in our hands more often than not.
Cyberspace as a warfighting domain is a very challenging concept. The temptation to classify it as just another domain, like air, land, sea, and space, is frequently the first mistake that’s made by our military and political leaders and policymakers.
I think that a more accurate analogy can be found in the realm of science fiction’s parallel universes—mysterious, invisible realms existing in parallel to the physical world, but able to influence it in countless ways. Although that’s more metaphor than reality, we need to change the habit of thinking about cyberspace as if it’s the same thing as “meat” space.
After all, the term “cyberspace” was first coined by a science fiction writer. My own childhood love affair with science fiction predated William Gibson’s 1984 novel Neuromancer, going all the way back to The New Tom Swift Jr. Adventures series, which was the follow-up to the original series of the early 1900s. By some quirk of fate, the first Tom Swift Jr. book was published in 1954 (the year that I was born) and ceased publication in 1971 (the year that I left home for college). Although the young inventor didn’t have cyberspace to contend with, he did have the “Atomic Earth Blaster” and the “Diving Sea Copter.” In an otherwise awful childhood, the adventures of Tom Swift Jr. kept me feeling sane, safe, and excited about the future until I was old enough to leave home and embark on my own adventures.
Now, 38 years later, I find myself investigating a realm that remains a sci-fi mystery to many leaders and policymakers of my generation, while younger people who have grown up with computers, virtual reality, and online interactions of all kinds are perfectly comfortable with it. For this reason, I predict that the warfighting domain of cyberspace won’t truly find its own for another five to eight years, when military officers who have grown up with a foot in both worlds rise to senior leadership roles within the Department of Defense.
This book exists because of an open source intelligence (OSINT) experiment that I launched on August 22, 2008, named Project Grey Goose (Figure 1). On August 8, 2008, while the world was tuning in to the Beijing Olympics, elements of the Russian Federation (RF) Armed Forces invaded the nation of Georgia in a purported self-defense action against Georgian aggression. What made this interesting to me was the fact that a cyber component preceded the invasion by a few weeks, and then a second, much larger wave of cyber attacks was launched against Georgian government websites within 24 hours of the invasion date. These cyber attacks gave the appearance of being entirely spontaneous, an act of support by Russian “hacktivists” who were not part of the RF military. Other bloggers and press reports supported that view, and pointed to the Estonian cyber attacks in 2007 as an example. In fact, that was not only untrue, but it demonstrated such shallow historical analysis of comparable events that I found myself becoming more and more intrigued by the pattern that was emerging. There were at least four other examples of cyber attacks timed with RF military actions dating back to 2002. Why wasn’t anyone exploring that, I wondered?
I began posting what I discovered to my blog IntelFusion.net, and eventually it caught the attention of a forward deployed intelligence analyst working at one of the three-letter agencies. By “forward deployed” I refer to those analysts who are under contract to private firms but working inside the agencies. In this case, his employer was Palantir Technologies. “Adam” (not his real name) had been a long-time subscriber to my blog and was as interested in the goings-on in Georgia as I was. He offered me the free use of the Palantir analytic platform for my analysis.
After several emails and a bunch of questions on my part, along with my growing frustration at the overall coverage of what was being played out in real time in the North Caucasus, I flashed on a solution. What would happen if I could engage some of the best people inside and outside of government to work on this issue without any restrictions, department politics, or bureaucratic red tape? Provide some basic guidance, a collaborative work space, and an analytic platform, and let experienced professionals do what they do best? I loved the idea. Adam loved it. His boss loved it.
On August 22, 2008, I announced via my blog and Twitter an open call for volunteers for an OSINT experiment that I had named Project Grey Goose. Prospective volunteers were asked to show their interest by following a temporary Twitter alias that I had created just for this enrollment. Within 24 hours, I had almost 100 respondents consisting of college students, software engineers, active duty military officers, intelligence analysts, members of law enforcement, hackers, and a small percentage of Internet-created personas who seemed to have been invented just to see if they could get in (they didn’t). It was an astounding display of interest, and it took a week for a few colleagues and I to make the selections. We settled on 15 people, Palantir provided us with some training on their platform, and the project was underway. Our Phase I report was produced about 45 days later. A follow-up report was produced in April 2009. This book pulls from some of the data that we collected and reported on, plus it contains quite a bit of new data that has not been published before.
A lot happened between April 2009 and September 2009, when the bulk of my writing for this book was done. As more and more data is moved to the cloud and the popularity of social networks continues to grow, the accompanying risks of espionage and adversary targeting grow as well. While our increasingly connected world does manage to break down barriers and increase cross-border friendships and new understandings, the same geopolitics and national self interests that breed conflicts and wars remain. Conflict continues to be an extension of political will, and now conflict has a new domain on which its many forms can engage (espionage, terrorism, attacks, extortion, disruption).
This book attempts to cover a very broad topic with sufficient depth to be informative and interesting without becoming too technically challenging. In fact, there is no shortage of technical books written about hackers, Internet architecture, website vulnerabilities, traffic routing, and so on. My goal with this book is to demonstrate how much more there is to know about a cyber attack than simply what comprises its payload.
Welcome to the new world of cyber warfare.
The following typographical conventions are used in this book:
- Italic
Indicates new terms, URLs, and email addresses
Constant widthUsed for queries.
Constant width italicShows text that should be replaced with user-supplied values or by values determined by context.
Note
This icon signifies a tip, suggestion, or general note.
This book is here to help you get your job done. If you reference limited parts of it in your work or writings, we appreciate, but do not require, attribution. An attribution usually includes the title, author, publisher, and ISBN. For example: “Inside Cyber Warfare, Second Edition, by Jeffrey Carr (O’Reilly). Copyright 2012 Jeffrey Carr, 978-1-449-31004-2.”
If you feel your use of code examples falls outside fair use or the permission given here, feel free to contact us at permissions@oreilly.com.
Please address comments and questions concerning this book to the publisher:
| O’Reilly Media, Inc. |
| 1005 Gravenstein Highway North |
| Sebastopol, CA 95472 |
| 800-998-9938 (in the United States or Canada) |
| 707-829-0515 (international or local) |
| 707-829-0104 (fax) |
We have a web page for this book, where we list errata, examples, and any additional information. You can access this page at:
| http://shop.oreilly.com/product/0636920021490.do |
To contact the author and obtain information about GreyLogic and Project Grey Goose, visit the website at: http://greylogic.us.
To comment or ask technical questions about this book, send email to:
| bookquestions@oreilly.com |
For more information about our books, courses, conferences, and news, see our website at http://www.oreilly.com.
Find us on Facebook: http://facebook.com/oreilly
Follow us on Twitter: http://twitter.com/oreillymedia
Watch us on YouTube: http://www.youtube.com/oreillymedia
Note
Safari Books Online is an on-demand digital library that lets you easily search over 7,500 technology and creative reference books and videos to find the answers you need quickly.
With a subscription, you can read any page and watch any video from our library online. Read books on your cell phone and mobile devices. Access new titles before they are available for print, and get exclusive access to manuscripts in development and post feedback for the authors. Copy and paste code samples, organize your favorites, download chapters, bookmark key sections, create notes, print out pages, and benefit from tons of other time-saving features.
O’Reilly Media has uploaded this book to the Safari Books Online service. To have full digital access to this book and others on similar topics from O’Reilly and other publishers, sign up for free at http://my.safaribooksonline.com.
I’d like to thank Tim O’Reilly, Mike Loukides, Mac Slocum, and all of the great people at O’Reilly Media for supporting my work and making the difficult process of writing a book as stress-free as possible. I’d also like to thank my research assistants, Tim, Jennifer, and Catherine, for the hard work they put into researching the content for Chapters 16 and 17, which, while not complete, is the most comprehensive body of work on this topic that I believe exists anywhere in the public domain today.
Get Inside Cyber Warfare, 2nd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
