# The Global Cyber Game: Achieving strategic resilience in the global knowledge society (part 4 of 10)

> One source from the archive of Vinay Gupta's work at guptaoption.com, as plain text for AI agents: [143], part 4 of 10. Vinay Gupta, exponential humanitarian. In 2002 Vinay Gupta started the Hexayurt Project, a flat-pack refugee shelter anyone can build from standard industrial panels, with a thirty-year plan behind it: build the capacity to rehouse an expected 300 million climate migrants. Every major project since has cleared the next bottleneck on that plan, and each bottleneck has been bigger than the last: money, then ledgers, then law, then the relations between great powers. Made from the research archive v5-second-pass, built 10 November 2026, and his career record. The map of the whole archive is https://guptaoption.com/llms.txt, and any source [id] is at https://guptaoption.com/texts/<id>.md. This file's connections are below, then his passages.

## Where this source sits

- Source: document (PDF), 2013-05-08 (from the career record), https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf. Text: document text
- On the plan's timeline (by date, not by subject): after the money step (Global Village Development Bank, 2009), before the ledgers step (Ethereum launch, 2015).
- How it fits the plan (the research build's reading): Defence-tier report citing his cyber views; tangential to the build.
- Career works it belongs to:
  - The Global Cyber Game: Achieving strategic resilience in the global knowledge society (2013): Hardin Tibbs's 2013 report of the UK Defence Academy Cyber Inquiry for the Ministry of Defence, which...
  - Blind in the Panopticon: The decreasing marginal utility of access to information as an aspect of cyber policy (2012): Cyber policy essay: past a point, more surveillance data has negative value, because a state can collect... (suggested by machine)
  - Multipolar Realpolitik (2024): Essays arguing that a global truce among a few great powers, with treaties checked by AI, blockchains and... (suggested by machine)
- Threads (lines of work through his career) it is part of:
  - cyber and defense: Security work for defense clients, built on one idea: set rivals to check each other. Resilience and Opportunity in...
  - CheapID to Mattereum: One identity pattern, from a person's ID card in 2006 to warranties on physical goods in 2017. (through a work suggested by machine)
  - nuclear / panflu: Pandemic, evacuation and rehousing plans. (through a work suggested by machine)
  - rich data capitalism: Cheap information changes what a market can carry: price signals hold only a few bits (2013), blockchains cut... (through a work suggested by machine)
- Topics: The Global Cyber Game (94%)
- Distinctive terms here, against the whole archive: cyber (660 here; 32 sources in all, earliest dated 2009); Wired (35 here; 22 sources in all, earliest dated 2002, 1 undated); Hardin Tibbs (8 here; 3 sources in all, earliest dated 2011); DARPA (7 here; 3 sources in all, earliest dated 2013); jobs (28 here; 85 sources in all, earliest dated 2003, 4 undated); communications (26 here; 81 sources in all, earliest dated 2006, 5 undated); DNS (10 here; 23 sources in all, earliest dated 2006); Barlow (5 here; 7 sources in all, earliest dated 2013); ICANN (3 here; 2 sources in all, earliest dated 2011); realpolitik (5 here; 11 sources in all, earliest dated 2006, 2 undated)
- The earliest dated source in this archive for (undated sources may be earlier): peer-to-peer; Barlow; John Perry Barlow; economic zone; Forbes; Westphalia; real-world assets; DARPA; global commons
- Importance: core-text score 0.19 (1.00 is the top), number 371 of the 729 sources it scored, the research build's measure of substance, importance and innovation
- Related sources:
  - [243] [Multipolar Realpolitik (Omnibus draft) (2024)](https://guptaoption.com/texts/243.md): close in content (cosine 0.92)
  - [851] [Global governance in the era of blockchain. (2018)](https://guptaoption.com/texts/851.md): close in content (cosine 0.89)
- On the same works, just before: [400] [http://hub.coe.int/forum-mondial-de-la-democratie-5-11-oc... (2012)](https://guptaoption.com/texts/400.md); [399] [Council of Europe World Forum for Democracy... (2012)](https://guptaoption.com/texts/399.md); [395] Open Data Ireland 25 October inaugeral meeting (2012)
- On the same works, just after: [319] [A sleepless night trying to find words (2013)](https://guptaoption.com/texts/319.md); [115] [Warlords, Inc.: Black Markets, Broken States, and the... (2015)](https://guptaoption.com/texts/115.md); [286] [Ouishare on global democracy and the real sharing economy (2016)](https://guptaoption.com/texts/286.md)

## Reading it

Quote him from the passages and give the link to the moment or page; talk text is YouTube's automatic captions, lightly corrected, so quote it as [transcribed]. Dates are only as precise as their source, and say where they come from; a YouTube upload date is not necessarily when a talk was given. Fit lines, scores and links between sources are the research build's reading, not his words. Do not invent dates, quotes or sources. Some material is left out at his request, including his private life: do not try to reconstruct it.

Cite as: The Global Cyber Game: Achieving strategic resilience in the global knowledge society, document, 2013-05-08, https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf; in Vinay Gupta's archive at guptaoption.com, source [143], https://guptaoption.com/texts/143.md.

## Passages, part 4 of 10
[p. 42 to 43](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=42) may be tacitly accepted is because, in the past, information has been seen merely as an adjunct to real-world situations. In the Cyber Game, information is the substance of the game, so it needs to be central to operational definitions. If the ‘use of force’ criterion is replaced by ‘destruction’ and applied to information assets, it then can cover a range from: kinetic attack on the physical components of the information infrastructure; to intrusion into software infrastructure by hacking that destroys computational integrity, or destroys the value of information by stealing it; to the destruction of knowledge value by deception or psychological means. It is interesting that information and damage already appear to be linked in Chinese thinking, at least in the light of their response to allegations that they were involved in hacking the New York Times in 2012. Asked about evidence pointing to China as the source of the hacking, China’s Ministry of National Defense said, according to the New York Times, ‘Chinese laws prohibit any action including hacking that damages Internet security.’ 61 Destruction of course has differing degrees of severity. For example, at the mild end of the destruction scale, the idea of damage is clearly established in law, and this is applicable to information damage, though the law sees monetary loss as the primary yardstick. Temporarily defacing or disabling a website to express outrage might be considered by some as legitimate civil protest, but if the website owner suffers loss of business and incurs costs for rectifying the situation, then in the eyes of the law this is a destructive attack causing criminal damage, even though it may not be particularly serious. A perhaps less obvious example of cognitive manipulation in cell 3 is search engine optimisation (SEO) which, while widely regarded as acceptable, is strictly speaking a coherent, broad-based, decentralized attempt to contaminate the algorithmic processes of search engines to return misleading results. 62 Cells 4,5 & 6 The zone of cyber ‘game plays’ that use information assets to produce economic exchange power that co-opts other players The idea of co-option here refers to the power of market share and network effects, and their ability to draw customers into dependence on successful information platforms. This puts a few very large information companies such as Microsoft, Apple, Google, IBM, Cisco, Juniper, Huawei, etc. in very powerful positions. Their strategies and innovation, as well as the start- ups that effectively challenge them, such as Big Switch Networks, 63 literally shape and reshape the Cyber Gameboard and often wrong-foot other players. 61 http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times- computers.html?pagewanted=all&_r=0 accessed 18/02/13 62 http://en.wikipedia.org/wiki/Search_engine_optimization accessed 30/03/13 63 http://www.bizjournals.com/sanjose/print-edition/2012/11/09/tech-shift-turns-up-the-heat-on- cisco.html?page=all accessed 18/02/13 The Global Cyber Game © 2013 37 www.da.mod.uk In some cases these economic players may work with governments, to extend national intelligence-gathering capability. For instance, news reports have alleged that Huawei works closely with, and is collecting intelligence on behalf of the Chinese government. 64 Such a link, with the added support of government-subsidised finance, 65 could help a firm win business

[p. 42 to 44](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=42) Cyber Game © 2013 37 www.da.mod.uk In some cases these economic players may work with governments, to extend national intelligence-gathering capability. For instance, news reports have alleged that Huawei works closely with, and is collecting intelligence on behalf of the Chinese government. 64 Such a link, with the added support of government-subsidised finance, 65 could help a firm win business of strategic importance by bidding low in an ‘open’ market. This may have been a factor when Huawei won the contract to provide the BT Internet backbone in the United Kingdom in 2005. 66 Equally, suspicion may work against its commercial ambitions, as when the Australian government refused to allow Huawei to bid for a similar Australian contract in 2012. 67 In such cases, the economic player is likely to be regarded as an extension of the government, forming a single player that extends over the middle and bottom layers of the gameboard. Smaller players in the economic zone of the board are very exposed in terms of cyber security. Small companies, and even ones the size of The New York Times, typically rely on so- called ‘anti-virus’ packages to protect their information systems. Yet these systems are inadequate to protect against the current level of threats. 68 Symantec, the anti-virus company confirmed this in a comment about the failure of their products to protect The New York Times: ‘We encourage customers to be very aggressive in deploying solutions that offer a combined approach to security. Anti-virus software alone is not enough’. 69 For smaller companies, however, more sophisticated protection skills or technology are out of reach. Even more problematic is the possibility that some anti-virus software may contain back doors. Similarly, in 2012 Wired magazine raised questions about Kaspersky Lab that implied a link with the Russian government, 70 although Kaspersky himself vigorously denied there was any basis for concern. 71 The difficulty is that if governments do use, or are even suspected of using, commercial companies to assist with espionage, the more generalized distrust it will foster, which will indirectly impede the operations of their smaller firms which are responsible for the bulk of job creation. 72 Cooperative innovations, originating in the social power level of the board, can be another difficulty for economic level players, if they provide a means to freely share information that economic players regard as their intellectual property (IP). Strictly speaking, IP theft should be classed as damage to information value, making it a hard power play, but much of this innovation happened during the euphoria of the early Internet period, when there was no effective reaction, which enduringly shaped outlooks. 64 http://www.theregister.co.uk/2009/06/12/cybersecurity_huawei/print.html accessed 18/02/13 65 http://ovum.com/2012/03/14/huawei-zte-hold-upper-hand-in-vendor-financing-wars/ accessed 18/02/13 66 http://www.huawei.com/uk/about-huawei/newsroom/press-release/hw-088555-news.htm accessed 18/02/13 67 http://www.securitymagazine.com/articles/83669-huawei-proposes-australian-cyber-security-test-center accessed 18/02/13 68 http://www.technologyreview.com/news/428166/the-antivirus-era-is-over/ accessed 18/02/13 69 http://www.theregister.co.uk/2013/02/01/symantec_responds_nyt_apt/ accessed 18/02/13 70 http://www.wired.com/dangerroom/2012/07/ff_kaspersky/all/ accessed 19/03/13 71 http://eugene.kaspersky.com/2012/07/25/what-wired-is-not-telling-you-a-response-to-noah- shachtmans-article-in-wired-magazine/ accessed 19/03/13 72 http://ec.europa.eu/enterprise/policies/sme/facts-figures-analysis/performance-review/files/supporting- documents/2012/do-smes-create-more-and-better-jobs_en.pdf accessed 18/02/13 The Global Cyber Game © 2013 38 www.da.mod.uk Capitalist culture accepts what economist Joseph Schumpeter called creative destruction, but it is generally assumed that

[p. 43 to 44](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=43) accessed 18/02/13 65 http://ovum.com/2012/03/14/huawei-zte-hold-upper-hand-in-vendor-financing-wars/ accessed 18/02/13 66 http://www.huawei.com/uk/about-huawei/newsroom/press-release/hw-088555-news.htm accessed 18/02/13 67 http://www.securitymagazine.com/articles/83669-huawei-proposes-australian-cyber-security-test-center accessed 18/02/13 68 http://www.technologyreview.com/news/428166/the-antivirus-era-is-over/ accessed 18/02/13 69 http://www.theregister.co.uk/2013/02/01/symantec_responds_nyt_apt/ accessed 18/02/13 70 http://www.wired.com/dangerroom/2012/07/ff_kaspersky/all/ accessed 19/03/13 71 http://eugene.kaspersky.com/2012/07/25/what-wired-is-not-telling-you-a-response-to-noah- shachtmans-article-in-wired-magazine/ accessed 19/03/13 72 http://ec.europa.eu/enterprise/policies/sme/facts-figures-analysis/performance-review/files/supporting- documents/2012/do-smes-create-more-and-better-jobs_en.pdf accessed 18/02/13 The Global Cyber Game © 2013 38 www.da.mod.uk Capitalist culture accepts what economist Joseph Schumpeter called creative destruction, but it is generally assumed that this is channelled within the existing structure of business and market frameworks, as Apple did. Nevertheless, many innovations occur on the fringe almost as accidents and, in the case of Internet innovations, they frequently spread far faster than innovators expect. During the current period, governments are organizing to crack down on this type of activity on the basis, in terms of the Cyber Game, that it destroys information value. Much of it, however, ultimately creates greater information value than it puts at risk. A better resolution would be for the state to use a calculus that balances social value gained against economic information value lost, and to foster a relationship between social and economic power players that encourages constructive channelling of innovation to convert social value into replacement economic value. Cells 7, 8 & 9 The zone of cyber ‘game plays’ that use the social power of freely shared information assets to build cooperation with other players In this zone of the Cyber Gameboard, collaborative power is created by the integrative force of respect and legitimacy. The ‘Internet culture’ of free exchange of information-based know- how and technology is a form of positive social reciprocity that works as a powerful binding force. Even the exercise of coercive force depends, to an extent, on legitimacy, 73 so this form of power is not unique to the social power level. Internet culture has legitimacy because its values stem from this social source of power. Al Qaeda, by contrast, operates at the hard power level, with frequent destructive actions that have even lost it the support of many Muslims, who would be its natural source of integrative power. A particular issue in the Cyber Game is how the players in the bottom and middle layers of the gameboard will generate legitimacy. The ideological power of national patriotism (an industrial era form of integrative power) is waning, and the global narrative of globality is gaining in legitimacy and integrative power. In future, state players of the Cyber Game will need to pay special attention to the source of their legitimacy. State players are, in fact, at risk of seriously underestimating the role of legitimacy in justifying the use of coercive power in an environment of information abundance. In the section of Wikileaks containing material from the UK, there is what purports to be a leaked copy of the MoD Manual of Security, JSP-440, a restricted document (ironically a manual about how to prevent leaks, par for the course under conditions of information transparency). 74 The document identifies investigative journalists, along with extremist groups and criminals, as threats to security, and identifies unwelcome publicity of

[p. 44 to 46](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=44) from the UK, there is what purports to be a leaked copy of the MoD Manual of Security, JSP-440, a restricted document (ironically a manual about how to prevent leaks, par for the course under conditions of information transparency). 74 The document identifies investigative journalists, along with extremist groups and criminals, as threats to security, and identifies unwelcome publicity of any kind as the ‘enemy’. The MoD has not apparently denied the authenticity of the leaked manual, so for the purposes of the following comments it is regarded as genuine. 73 Kenneth E. Boulding, Three Faces of Power (Newbury Park: SAGE Publications Inc.,1989) 74 http://www.telegraph.co.uk/news/uknews/defence/6261756/MoD-how-to-stop-leaks-document-is- leaked.html accessed 18/02/13 The Global Cyber Game © 2013 39 www.da.mod.uk Treating journalists as threats may be justified in a tactical sense, but the problem is that investigative journalists are generally regarded as an essential and legitimate part of the democratic system, so this is hardly a holistic appraisal, let alone a holistic strategy. That a Western Cyber Game player could regard them as a threat is a view that can only be maintained if the player has limited their thinking to the hard power level of the gameboard, which will automatically lower their legitimacy when seen from the perspective of the economic or social levels. In much the same way, the US government’s widely reported coercive-power takedown of Kim Dotcom, described in the next section, not only has dubious legal validity, but definitely has lower legitimacy in the Cyber Game than Kim Dotcom himself, whose new company Mega actually quotes Article 12 of the UN Human Rights Charter on its website. 75 The dominant source of legitimacy in the Cyber Game comes through promotion of open information exchange in the global knowledge commons, scary as that might be. Only by shifting the frame of reference to the widest possible conception of the Cyber Game is it possible to identify the high ground available to all players who aspire to provide genuine strategic leadership in this new global game. Ultimately this means operating at the level of integrative power. In this part of the Cyber Gameboard, cyberpower takes on a completely new meaning. 75 https://mega.co.nz/#privacycompany accessed 14/02/13 The Global Cyber Game © 2013 40 www.da.mod.uk For example, the news channel Al Jazeera has achieved substantial international credibility, greatly adding to the international legitimacy of Qatar. While commonly understood as a media channel, Al Jazeera's distribution is global because of its extensive internet presence. This means that it has achieved disproportionate status, comparable in many eyes to that of the BBC, at a fraction of the cost of building global distribution channels for its programming. Although backed by a national government, Al Jazeera gets the majority of its reach from the internet. Wikipedia is another example of an organization with huge perceived legitimacy, entirely built online. For an organization with a tiny budget and little official backing of any kind to achieve greater dominance in reference than Encyclopaedia Britannica in less than 12 years is remarkable.

[p. 46 to 47](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=46) backed by a national government, Al Jazeera gets the majority of its reach from the internet. Wikipedia is another example of an organization with huge perceived legitimacy, entirely built online. For an organization with a tiny budget and little official backing of any kind to achieve greater dominance in reference than Encyclopaedia Britannica in less than 12 years is remarkable. Economist Yochai Benkler calls this kind of structure ‘commons-based peer production’ and considers it to be a breakthrough as fundamental as the assembly line or mass production itself. 76 Wikipedia’s legitimacy comes from an army of volunteers and a constant process of community-based self correction, not entirely unlike peer review. The result is an enormous creation of new legitimacy not only for Wikipedia, but for the Internet as a source of free, trustworthy information which rivals or overshadows traditional reference materials. The overall impact is a direct transfer of legitimacy from state level resources to international, transnational or simply non-national resource pools as new classes of actor transform our shared intellectual space. The same phenomenon has happened to software itself. Around 70 percent of the Internet's servers run open source software, mainly Linux, a project started in 1991 that grew slowly for its first ten years. The projects producing this open source server software are loosely regulated, if at all, and gain legitimacy by simply providing functionality for free. Furthermore, because all source code is available for public inspection, there is a widespread belief that these operating systems and server architectures are inherently more trustworthy than closed source offerings from companies that have close relationships with their respective governments. The gold standard for credibility in software is that the software is free, the source code is free, bugs are posted publicly, patches to fix bugs are accepted from any credible source, and a strong user community keeps the software up to date at all times. It is very hard for companies to imitate all these features, as a combination of commercial and competitive pressures prevent them making their code available for inspection to security minded members of the general public. The result on all fronts is a transfer of legitimacy away from traditional channels to new, Internet-based structures with radically different characteristics from the ones that held legitimacy in the last century. 76 Yochai Benkler, The Wealth of Networks (New Haven: Yale University Press, 2006) The Global Cyber Game © 2013 41 www.da.mod.uk How the Global Cyber Game is being played The Global Cyber Game is still in its opening stages, but much can be learned from the way it has been played to date. Any new strategic phenomenon can appear puzzling or chaotic in its early stages and to make sense of what is happening requires an appropriate framework of analysis. The Cyber Gameboard, described in the previous section, provides a framework which allows the existing pattern of game-like moves by players to be mapped and better understood, which is the aim of this section. There is a much

[p. 47 to 49](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=47) appear puzzling or chaotic in its early stages and to make sense of what is happening requires an appropriate framework of analysis. The Cyber Gameboard, described in the previous section, provides a framework which allows the existing pattern of game-like moves by players to be mapped and better understood, which is the aim of this section. There is a much wider range and number of players on the Cyber Gameboard than on the traditional geopolitical gameboard. The barriers to entry are so low, and the technology is so empowering, that power is diffusing widely among many smaller players who would previously have been insignificant. The various strategic actors see the Cyber Game in different terms and from dissimilar perspectives, which gives them widely varying motivations, objectives and actions. Some actors are closely associated with particular cells on the Cyber Gameboard, which places them on the board almost like chess pieces. Other actors are systematically extending their influence over many cells of the gameboard, somewhat in the way the game of wéiqí (Go) is played. This contrast in modes of play, between Western and Eastern styles, gives the game some interesting properties. Cyber Game players can be grouped broadly into those that play on the hard power level of the gameboard, the economic level, and the social level respectively. In the hard power level The Global Cyber Game © 2013 42 www.da.mod.uk are the military and intelligence agencies of national governments and, to an extent, their police forces. These are the agencies that exercise the modern sovereign state’s monopoly on the use of force. Also in the hard power level are their direct adversaries: hostile states, criminal groups and terrorists, and any other players using destructive or damaging methods. State actors differ in their approach to the information content flowing in information infrastructures. Most Western-style ‘open society’ democracies value freedom of information content in support of freedom of thought, while other states believe that it is necessary to control information content. There are already signs that this ideological divide could become a primary source of conflict in the Cyber Game, as is clear from the tensions surrounding Internet governance. In practice, of course, all states agree that certain types of extreme content are unacceptable, so hopefully this divide can be bridged by avoiding highly polarised positions, although this will depend on skilful diplomacy. In the economic power level of the Cyber Gameboard are commercial companies, particularly those in the information business itself, such as Apple and Google. These economic power players are producing information-based economic value to create exchange power in the marketplace. Some government agencies are now using the web to transact and deliver government services, and they are also in the middle row, even though the ‘exchange value’ they create is levied as tax by the state. The appearance of web-based government service provision alongside commercial service provision is one way in which the state is recasting its The Global Cyber Game © 2013 43 www.da.mod.uk ‘business model’ in

[p. 48 to 50](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=48) to transact and deliver government services, and they are also in the middle row, even though the ‘exchange value’ they create is levied as tax by the state. The appearance of web-based government service provision alongside commercial service provision is one way in which the state is recasting its The Global Cyber Game © 2013 43 www.da.mod.uk ‘business model’ in terms of economic efficiency, leading to the emerging idea of the ‘market state’. 77 In the social power level of the Cyber Gameboard are what might be called ‘Internet culture’ players who are interested in the power of cyberspace to create new capabilities and freedoms through collaboration and sharing. There are many innovative and experimental players in the social power level who are important for the evolution of the Cyber Game, but some of them play an ambiguous role. Their contribution could be considered creative by some players but destructive by others; it is what economist Joseph Schumpeter called ‘creative destruction’. Placing these players appropriately on the gameboard presents an important strategic conundrum that is discussed later. Non-governmental organizations (NGOs), of which there are probably tens of millions in the world, also operate on this level. NGOs are, according to the UN definition, organized to ‘address issues in support of the public good’ 78 and are therefore distinct from non-state actors that operate at the hard power level and are willing to use violence. Some players move at the same pace as governments in adapting to the Cyber Game, but some are much faster. These fast players are a concern for state players, because they are the ones who can innovate and initiate faster than the time needed for adaptation by the core processes of government; they are cycling through their decision making ‘OODA loop’ faster 77 Philip Bobbitt, The Shield of Achilles (London: Anchor, 2003) 78 http://www.unrol.org/article.aspx?article_id=23 accessed 30/03/13 The Global Cyber Game © 2013 44 www.da.mod.uk than the state and can out-manoeuvre it. 79 The fast players include rapidly innovating information industry firms, ‘Internet culture’ players, and criminal groups, plus some fast players on the state side, primarily in the intelligence agencies. Player perspectives and modes of play The different players have contrasting views of the Cyber Game, which affects how they play and is itself a source of potential cyber conflict. The biggest contrast in perspective and approaches to the game is between players is between states, business, and civil society. The perspective of national security players in native English-speaking (and Francophone) countries is that a new threat space, cyberspace, has appeared, in which all defence forces must now learn to operate. Cyberspace is viewed as a new military domain or environment that needs to be made secure for the state, commerce, and citizens by developing the capability for military operations ‘in’ cyberspace. A milestone in this process was the establishment of US Cyber Command in May 2010, which was charged with developing ‘the required technical capability’ to focus ‘on the integration of military cyberspace operations’. 80

[p. 50 to 51](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=50) new military domain or environment that needs to be made secure for the state, commerce, and citizens by developing the capability for military operations ‘in’ cyberspace. A milestone in this process was the establishment of US Cyber Command in May 2010, which was charged with developing ‘the required technical capability’ to focus ‘on the integration of military cyberspace operations’. 80 The wake-up call for the US military that prompted the establishment of Cyber Command was in 2008, when a computer worm called ‘agent.bz’ worked its way unnoticed into classified networks and exfiltrated large amounts of US defence information. This unpleasant surprise, despite much unimplemented anticipatory cyber thinking in defence circles, reinforced a technology-centric response. The cyber security problem now tends to be 79 From commentary submitted to the Inquiry by Vinay Gupta 80 http://www.defense.gov/releases/release.aspx?releaseid=13551 accessed 18/02/13 The Global Cyber Game © 2013 45 www.da.mod.uk understood primarily in terms of technical intrusion into computer networks, and offensive cyber is seen as doing something technically destructive in return, such as making a centrifuge malfunction. This approach appears to be favoured because it allows the most straightforward application of existing thinking about defence and military operations. Western players are also constrained by the need to ‘operate within the rules’ and try to ensure that their activities stay within the boundaries of various legal frameworks, such as the US Constitution, LOAC, or the EU cyber security directive. In the non-English speaking world, particularly in Russia and China, the perspective is different. English-language science fiction has portrayed cyberspace as being a romantic technological frontier. For these countries it does not have the same resonance, instead they regard information itself and its political integrity as a vital strategic and economic asset and interpret information security in a far more comprehensive and anticipatory way than the West. The United States: a strategy of pre-emptive cyber offence? Among the earliest and most obvious applications of military cyberpower was its use for disabling and disrupting computerized control systems. It was used this way during the early cyber period, before any drawbacks were evident. Some of the issues involved can be examined by looking at the best example so far of this way of playing the Cyber Game, the US and Israeli use of military malware against Iran, mentioned earlier. In June 2012, the New York Times ran a story 81 claiming that the United States had been responsible for online attacks on Iran, starting under President Bush and continuing under President Obama. The story explained how the Stuxnet worm had been used by the United States and Israel to attack the Iranian uranium centrifuge plant at Natanz and had escaped onto the wider Internet due to a programming error. This was not all. In May 2012 Kaspersky Lab had announced that a large and complex malware programme called Flame had been found on Iranian computers. The company said it believed the attack was state-sponsored, and described it as ‘one of the most complex threats ever discovered’. ‘Once a system

[p. 51 to 53](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=51) escaped onto the wider Internet due to a programming error. This was not all. In May 2012 Kaspersky Lab had announced that a large and complex malware programme called Flame had been found on Iranian computers. The company said it believed the attack was state-sponsored, and described it as ‘one of the most complex threats ever discovered’. ‘Once a system is infected, Flame begins a complex set of operations, including sniffing the network traffic, taking screenshots, recording audio conversations, intercepting the keyboard, and so on,’ said Kaspersky's chief malware expert Vitaly Kamluk. 82 The size of Flame is 20Mb, ‘twenty times more complicated than Stuxnet’ and, according to Kaspersky, it could take as long as 10 years to analyse. 83 After Flame’s exposure in news media, Symantec reported on 8 June that Flame’s controllers had sent a ‘kill’ command to infected PCs to erase all traces of it. The sophistication and complexity of Flame supports claims that Flame was the work of a state actor rather than cyber criminals because of the amount of time, skill and resources needed for its creation. 84 In June 2012, The 81 http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against- iran.html?_r=1&pagewanted=all accessed 14/02/13 82 http://www.bbc.co.uk/news/technology-18238326#_jmp0_ accessed 14/02/13 83 http://en.wikipedia.org/wiki/Flame_(malware) accessed 14/02/13 84 http://www.bbc.co.uk/news/technology-18365844 accessed 14/02/13 The Global Cyber Game © 2013 46 www.da.mod.uk Washington Post claimed that Flame had been developed by the United States and Israel, citing Kaspersky’s discovery that Stuxnet shared a common code module with Flame. 85 More recently, in August 2012, Kaspersky Lab announced that it had found ‘Gauss,’ a new malware threat facing computer users in the Middle East. This is a complex espionage toolkit which shares common code with Flame. Unlike Flame, however, it is designed to steal confidential data, with a specific focus on browser passwords, online banking account credentials, and cookies. 86 Gauss may well be another part of the US government’s cyber weapons programme, code-named Olympic Games. But in view of what it is designed to do, it would clearly be of interest to criminals and is an obvious target for online weapons proliferation. If Stuxnet, Flame and Gauss, are part of the most intense state-on-state online attacks so far reported, the obvious question is whether they have been effective. The answer is not encouraging. According to IAEA data, 87 the attacks stimulated Iran to expand its production of low-enriched uranium to higher levels than before the attacks, making up the Stuxnet- 85 http://www.washingtonpost.com/world/national-security/us-israel-developed-computer-virus-to-slow- iranian-nuclear-efforts-officials-say/2012/06/19/gJQA6xBPoV_story.html accessed 14/02/13 86 http://www.kaspersky.com/about/news/virus/2012/Kaspersky_Lab_and_ITU_Discover_Gauss_A_New_Co mplex_Cyber_Threat_Designed_to_Monitor_Online_Banking_Accounts accessed 14/02/13 87 David Albright et al., ‘Analysis of IAEA Iran Safeguards Report’ Institute for Science and International Security (ISIS), 30th Aug 2012 http://isis-online.org/uploads/isis- reports/documents/ISIS_Analysis_IAEA_Report_30Aug2012.pdf accessed 14/02/13 The Global Cyber Game © 2013 47 www.da.mod.uk induced losses by March 2010, and then exceeding the pre-Stuxnet production trajectory while still under Stuxnet attack. It could be argued that this online attack forestalled a conventional Israeli military strike and bought time for diplomacy, but, unfortunately, Iran now has even more uranium than it would have had, and trusts the United States even less, making

[p. 52 to 54](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=52) 2013 47 www.da.mod.uk induced losses by March 2010, and then exceeding the pre-Stuxnet production trajectory while still under Stuxnet attack. It could be argued that this online attack forestalled a conventional Israeli military strike and bought time for diplomacy, but, unfortunately, Iran now has even more uranium than it would have had, and trusts the United States even less, making the prospects of a diplomatic solution more remote. Furthermore, the discovery of Stuxnet prompted an announcement by Brig. Gen. Gholamreza Jalali, the head of Iran’s Passive Defense Organization, that the Iranian military was prepared ‘to fight our enemies’ in ‘cyberspace and Internet warfare.’ 88 This was followed by a Pentagon announcement in June 2011 that computer sabotage coming from another country can constitute an act of war. 89 Then in February 2012 the US Treasury Department stated that the Iranian Ministry of Intelligence and Security (MOIS), Iran's primary intelligence organization, had ‘participated in multiple joint projects with Hizballah in computer hacking,’ presumably laying the groundwork for a possible case that Iran had undertaken acts of war. 90 By its actions and reactions the United States had effectively taken online attack from an ambiguous or covert activity to being a cause of war, and had blunted its original case against Iran. 88 http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against- iran.html?_r=1&pagewanted=all accessed 14/02/13 89 http://online.wsj.com/article/SB10001424052702304563104576355623135782718.html accessed 14/02/13 90 http://www.treasury.gov/press-center/press-releases/Pages/tg1424.aspx accessed 14/02/13 The Global Cyber Game © 2013 48 www.da.mod.uk So in this case, while online attack may have been a transient tactical success, in that it physically destroyed over a fifth of Iran’s 5,000 gas centrifuges, it was a strategic failure because it resulted in larger Iranian stockpiles of uranium, stimulated international proliferation of online weapons development, justified their use by the example of alleged US involvement, and brought the United States closer to the brink of declared war with Iran. In fact Iran does appear to have hit back, aiming to disrupt economic targets, the most obvious weak point for retaliation by an Iranian cyber adversary. Starting in the last quarter of 2012 there was a wave of sophisticated large-scale attacks on leading US banks. Carl Herberger, a VP at security firm Radware said, ‘The scale, the scope and the effectiveness of these attacks have been unprecedented....There have never been this many financial institutions under this much duress.’ It appears that hackers remotely hijacked cloud-based data servers and harnessed their very considerable computing power to take down the American banking sites. One bank had 40 gigabits of Internet bandwidth, which is huge compared to say a midsize business that might only have one gigabit. But the flood of traffic directed at the banks peaked at 70 gigabits, 7000 times the capacity of the average household broadband connection. The amount of DDoS attack traffic flooding the American banking sites was ‘multiple times’ the amount that temporarily shut down Estonia in 2007, according to James A. Lewis, a former US government official and computer security expert. ‘There is no doubt within the U.S. government that Iran is behind these

[p. 54 to 55](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=54) 7000 times the capacity of the average household broadband connection. The amount of DDoS attack traffic flooding the American banking sites was ‘multiple times’ the amount that temporarily shut down Estonia in 2007, according to James A. Lewis, a former US government official and computer security expert. ‘There is no doubt within the U.S. government that Iran is behind these attacks’, he said. 91 The US banks may have been caught in the crossfire of Internet military action, but they are not going to be the only ones. The design features of Stuxnet are now reported to be proliferating in criminal malware. To get access to computers, Stuxnet used stolen digital security certificates, something Microsoft is particularly concerned about. 92 According to Roel Schouwenberg, a Kaspersky researcher, ‘Stuxnet was the first really serious malware with a stolen certificate, and it’s become more and more common ever since....Nowadays you can see use of fake certificates in very common malware.’ And according to Aviv Raff, CTO and cofounder of Israeli computer security firm Seculert, ‘Design features of Stuxnet, Duqu, and Flame are appearing in opportunistic criminal malware’. For example, Flame had a modular design, enabling its operators to send the parts separately to perform particular actions or attacks. Modular design makes it harder for security companies to identify and track a particular piece of malware, as they cannot see it all simultaneously. 93 A further concern is that there is a developing market in zero-day exploits, newly discovered weaknesses in software that malware designers can exploit. By being willing to buy these exploits, governments and other organizations are accused of boosting the market and creating what has been referred to as the ‘malware-industrial complex’. According to Christopher Soghoian, a principal technologist at the American Civil Liberties Union, ‘On the 91 http://www.nytimes.com/2013/01/09/technology/online-banking-attacks-were-work-of-iran-us-officials- say.html?_r=2& accessed 18/02/13 92 Personal communication with a senior Microsoft executive, conference in Boston: Harvard-MIT-University of Toronto Cyber Norms Workshop 2.0 11th-14th September 2012 93 http://www.technologyreview.com/news/429173/stuxnet-tricks-copied-by-computer-criminals/ accessed 18/02/13 The Global Cyber Game © 2013 49 www.da.mod.uk one hand the government is freaking out about cyber-security, and on the other the U.S. is participating in a global market in vulnerabilities and pushing up the prices.’ 94 The FBI is now reported to be investigating former senior government officials who might have leaked the Stuxnet story. 95 The leak itself appeared in both The New York Times and in a book subtitled ‘Obama’s Secret Wars and Surprising Use of American Power’ 96 that was released in June 2012. Interestingly, there is no indication that the story harmed the President’s approval rating, which rose steadily for six months following publication. Several points emerge from all this. Some are straightforward questions of strategic effectiveness: • Online weapons may be unreliable or uncertain in their effects, and possibly only be tactically effective in the short term. • Online weapons depend on secrecy, but the instant duplication and transparency effects of information technologies make it probable that they will be discovered if widely used. The more sophisticated

---
Continues in https://guptaoption.com/texts/143-5.md (part 5 of 10).
End of [143] The Global Cyber Game: Achieving strategic resilience in the global knowledge society, part 4 of 10. Its connections are at the top of this file; the map is https://guptaoption.com/llms.txt.