# The Global Cyber Game: Achieving strategic resilience in the global knowledge society (part 8 of 10)

> One source from the archive of Vinay Gupta's work at guptaoption.com, as plain text for AI agents: [143], part 8 of 10. Vinay Gupta, exponential humanitarian. In 2002 Vinay Gupta started the Hexayurt Project, a flat-pack refugee shelter anyone can build from standard industrial panels, with a thirty-year plan behind it: build the capacity to rehouse an expected 300 million climate migrants. Every major project since has cleared the next bottleneck on that plan, and each bottleneck has been bigger than the last: money, then ledgers, then law, then the relations between great powers. Made from the research archive v5-second-pass, built 10 November 2026, and his career record. The map of the whole archive is https://guptaoption.com/llms.txt, and any source [id] is at https://guptaoption.com/texts/<id>.md. This file's connections are below, then his passages.

## Where this source sits

- Source: document (PDF), 2013-05-08 (from the career record), https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf. Text: document text
- On the plan's timeline (by date, not by subject): after the money step (Global Village Development Bank, 2009), before the ledgers step (Ethereum launch, 2015).
- How it fits the plan (the research build's reading): Defence-tier report citing his cyber views; tangential to the build.
- Career works it belongs to:
  - The Global Cyber Game: Achieving strategic resilience in the global knowledge society (2013): Hardin Tibbs's 2013 report of the UK Defence Academy Cyber Inquiry for the Ministry of Defence, which...
  - Blind in the Panopticon: The decreasing marginal utility of access to information as an aspect of cyber policy (2012): Cyber policy essay: past a point, more surveillance data has negative value, because a state can collect... (suggested by machine)
  - Multipolar Realpolitik (2024): Essays arguing that a global truce among a few great powers, with treaties checked by AI, blockchains and... (suggested by machine)
- Threads (lines of work through his career) it is part of:
  - cyber and defense: Security work for defense clients, built on one idea: set rivals to check each other. Resilience and Opportunity in...
  - CheapID to Mattereum: One identity pattern, from a person's ID card in 2006 to warranties on physical goods in 2017. (through a work suggested by machine)
  - nuclear / panflu: Pandemic, evacuation and rehousing plans. (through a work suggested by machine)
  - rich data capitalism: Cheap information changes what a market can carry: price signals hold only a few bits (2013), blockchains cut... (through a work suggested by machine)
- Topics: The Global Cyber Game (94%)
- Distinctive terms here, against the whole archive: cyber (660 here; 32 sources in all, earliest dated 2009); Wired (35 here; 22 sources in all, earliest dated 2002, 1 undated); Hardin Tibbs (8 here; 3 sources in all, earliest dated 2011); DARPA (7 here; 3 sources in all, earliest dated 2013); jobs (28 here; 85 sources in all, earliest dated 2003, 4 undated); communications (26 here; 81 sources in all, earliest dated 2006, 5 undated); DNS (10 here; 23 sources in all, earliest dated 2006); Barlow (5 here; 7 sources in all, earliest dated 2013); ICANN (3 here; 2 sources in all, earliest dated 2011); realpolitik (5 here; 11 sources in all, earliest dated 2006, 2 undated)
- The earliest dated source in this archive for (undated sources may be earlier): peer-to-peer; Barlow; John Perry Barlow; economic zone; Forbes; Westphalia; real-world assets; DARPA; global commons
- Importance: core-text score 0.19 (1.00 is the top), number 371 of the 729 sources it scored, the research build's measure of substance, importance and innovation
- Related sources:
  - [243] [Multipolar Realpolitik (Omnibus draft) (2024)](https://guptaoption.com/texts/243.md): close in content (cosine 0.92)
  - [851] [Global governance in the era of blockchain. (2018)](https://guptaoption.com/texts/851.md): close in content (cosine 0.89)
- On the same works, just before: [400] [http://hub.coe.int/forum-mondial-de-la-democratie-5-11-oc... (2012)](https://guptaoption.com/texts/400.md); [399] [Council of Europe World Forum for Democracy... (2012)](https://guptaoption.com/texts/399.md); [395] Open Data Ireland 25 October inaugeral meeting (2012)
- On the same works, just after: [319] [A sleepless night trying to find words (2013)](https://guptaoption.com/texts/319.md); [115] [Warlords, Inc.: Black Markets, Broken States, and the... (2015)](https://guptaoption.com/texts/115.md); [286] [Ouishare on global democracy and the real sharing economy (2016)](https://guptaoption.com/texts/286.md)

## Reading it

Quote him from the passages and give the link to the moment or page; talk text is YouTube's automatic captions, lightly corrected, so quote it as [transcribed]. Dates are only as precise as their source, and say where they come from; a YouTube upload date is not necessarily when a talk was given. Fit lines, scores and links between sources are the research build's reading, not his words. Do not invent dates, quotes or sources. Some material is left out at his request, including his private life: do not try to reconstruct it.

Cite as: The Global Cyber Game: Achieving strategic resilience in the global knowledge society, document, 2013-05-08, https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf; in Vinay Gupta's archive at guptaoption.com, source [143], https://guptaoption.com/texts/143.md.

## Passages, part 8 of 10
[p. 90 to 92](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=90) These C-space activities could include intelligence-gathering, surveillance, infiltration of remote computers, exfiltration and 158 http://www.theengineer.co.uk/sectors/automotive/news/robots-to-organise-themselves-like-a-swarm- of-insects/1012101.article accessed 14/02/13 The Global Cyber Game © 2013 85 www.da.mod.uk manipulation of data, and C-space interdiction. In the United Kingdom these would need to be authorized under the 1994 Intelligence Services Act (ISA). 159 In fact many aspects of what are currently being thought of as cyber warfare capabilities may well sit more logically with an evolution of the intelligence gathering function than with military capability. In future the degree of F-space competence is likely to determine the success of operations, both civilian and military, in physical space. Any application of military hard power will seek effects in F-space, because this is where hard power dominance is achieved, and this will require a secure C-space. Whether the actuating information flowing through C-space can (from a technical point of view), or will (from a political point of view), be made secure is an uncertainty that is discussed later. To achieve effective F-space operations, attention will need to focus on the boundary between C-space and F-space. The C-space surface itself can be dissected into a number of operationally important layers, on both C-space and F-space sides of the boundary. On the C- space side there is a ‘C-space stack’ running from the physical network and its connected computers, through the information flow, the local processing, to the user interface. The boundary itself is the meeting point between the user interface and the user’s consciousness. On the F-space side, an ‘F-space stack’ runs through user consciousness, user orientation, user decision, to user action. This corresponds to the well-known OODA loop of John Boyd, 160 and emphasizes both the ‘soft power’ effects on the flesh and blood or ‘meatspace’ side of the 159 http://www.legislation.gov.uk/ukpga/1994/13/contents accessed 07/03/13 160 Robert Coram, Boyd: The Fighter Pilot Who Changed the Art of War (Boston: Little Brown & Co., 2002) The Global Cyber Game © 2013 86 www.da.mod.uk Internet surface, and the need for all interfaces to be designed in a way that optimizes the flow-space actor’s OODA loop. The Cyber Gameboard can be thought of as symbolically representing the C-space surface, the boundary between C-space and F-space, viewed from F-space. The gameboard categorizes types of cyberpower, and in so doing it represents C-space capabilities and effects in F-space. In a sense, the C-space ‘side’ of the surface is the networked medium that conveys various combinations of power and information from cell to cell, resulting in effects that are either caused or suffered on the F-space side of the surface. Flow-centric warfare More than 50 percent of the global population is now urban, and city life is overwhelmingly dependent on continuous flows of information, energy, goods and people from around the globe. These flows are now crucial for human life-support. They are driven by economic activity that is enabled and coordinated through C-space, and the business of keeping them going now dominates government, market, and civil society interactions worldwide. In a fully globalized

[p. 92 to 94](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=92) and city life is overwhelmingly dependent on continuous flows of information, energy, goods and people from around the globe. These flows are now crucial for human life-support. They are driven by economic activity that is enabled and coordinated through C-space, and the business of keeping them going now dominates government, market, and civil society interactions worldwide. In a fully globalized knowledge society, a key function of the state and source of legitimacy will be to maintain and improve the quality of life of its citizens. Global flows are as much a contributor to quality of life as economic growth and, if anything, at a time of flattening economic growth, uninterrupted global flows are a greater priority for governments than economic growth because they are a survival issue. The Global Cyber Game © 2013 87 www.da.mod.uk As long as C-space remains vulnerable, global flows in F-space are an obvious target for cyber attack via C-space. This opens up the prospect of flow-centric warfare (FCW) which would be aimed at disrupting extended global flow networks, thereby directly and rapidly threatening urban functioning in a target nation. In contrast to the existing cyber security focus on critical national infrastructure (CNI), FCW shifts the focus of attention from national nodes to the flows between international nodes. This shift is attractive for a potential attacker, as the flows have more modes of vulnerability than the nodes and, since the advent of just in time supply chains, the levels of static inventory at nodes have been greatly reduced. The key national security concerns in global F-space are therefore not so much about protecting geographic territory, and CNI within geographic territory, as about protecting the globally extended F-space dependencies of the nation. Being flows, as opposed to static assets, this will require complex dynamic mapping and considerable cooperation from commercial organizations. Many of the firms involved will have a global perspective and interests, and the high level of cross-dependence within the system of flows will complicate the clear identification of national interest. Consequently, FCW may require federated defence arrangements, not a go- it-alone national defence posture. In a scenario of worsening impacts from climate change, FCW could conceivably be waged amid conditions of growing global crisis, intensifying already acute environmental, humanitarian, food, and energy problems. Finally, although very little of the existing materiel of defence is likely to be useful for FCW, the appropriate capability would be equally suited The Global Cyber Game © 2013 88 www.da.mod.uk for dealing with the impacts of serious environmental disruption. This might include, for example, the ability to deploy distributed power systems when centralized systems have been disabled. F-space weapon development In any future when C-space becomes more secure, the focus of action in cyber conflict is likely to shift to the superior orchestration of operations in F-space. Until now, the notion of a cyber weapon has primarily meant malware for disruption via C-space, but in a future world where C-space is secure, accomplished deployment of F-space weapons will provide the

[p. 94 to 95](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=94) In any future when C-space becomes more secure, the focus of action in cyber conflict is likely to shift to the superior orchestration of operations in F-space. Until now, the notion of a cyber weapon has primarily meant malware for disruption via C-space, but in a future world where C-space is secure, accomplished deployment of F-space weapons will provide the operational edge. This implies that the future meaning of cyber weapons would shift to autonomous and semi-autonomous systems such as drones, operating in F-space. A drone is a ‘mechatronic’ device (a combination of mechanics and electronics), and it might seem a stretch to regard it as a cyber weapon. But even if drones simply look like advanced radio controlled model aircraft, the capabilities of current and future drones are very much a function of the computation and communication power of C-space. Up to now, drones themselves have been vulnerable to malware. In 2011, US military drones were reported to be infected by a virus that proved difficult to remove. At one point the US Air Force was reportedly reduced to following instructions on the Kaspersky Labs website to help them debug drones at Creech Air Force Base. 161 The video feed from drones has been intercepted using off-the-shelf software, as happened in Iraq, 162 and it is possible that a drone compromised by malware could be remotely hijacked and turned against its operators. But in a future where C-space is secure, or at least the part of C-space that provides the link, F- space weapons (drones, and robots in general when used for projecting coercive power) would quickly become the main focus of the military aspect of the Cyber Game. Under these circumstances, the future technological development of drones can be foreseen relatively easily. They will continue to get smaller, following the current trend, to the point where they resemble insects 163 and, for surveillance purposes, will be deliberately designed to do so. Some will even be so small that they are below the level of resolution of the human eye, that is, effectively invisible. In use, drones are already tending to become remote assassination weapons, and they are likely to become even more precisely deadly. This development is starting to raise serious ethical questions 164 which are only going to get more intense as drones get smaller. Imagine a future scenario similar to the discovery of Osama bin Laden’s house in Abbottabad. A mosquito-sized drone could be sent in to verify his identity by sampling his DNA, followed later by a wasp-like drone equipped to administer a lethal injection, much easier than 161 http://www.wired.com/dangerroom/2011/10/virus-hits-drone-fleet/ accessed 14/02/13 162 http://www.wired.com/dangerroom/2009/12/insurgents-intercept-drone-video-in-king-sized-security- breach/ accessed 14/02/13 163 http://www.snopes.com/photos/technology/insectdrone.asp accessed 14/02/13 164 http://www.huffingtonpost.com/2013/02/07/armed-drone-debate_n_2639565.html accessed 14/02/13 The Global Cyber Game © 2013 89 www.da.mod.uk deploying stealth helicopters without knowing for sure if OBL was in the house. 165 Now imagine a future in which this technology has become widespread. Who then would want to be the leader of any hierarchical organization that uses coercive power? If

[p. 94 to 96](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=94) accessed 14/02/13 163 http://www.snopes.com/photos/technology/insectdrone.asp accessed 14/02/13 164 http://www.huffingtonpost.com/2013/02/07/armed-drone-debate_n_2639565.html accessed 14/02/13 The Global Cyber Game © 2013 89 www.da.mod.uk deploying stealth helicopters without knowing for sure if OBL was in the house. 165 Now imagine a future in which this technology has become widespread. Who then would want to be the leader of any hierarchical organization that uses coercive power? If information abundance gives networks an advantage over hierarchies already, this will only make the advantage decisive, or serve to drive strategy more strongly away from using coercive power and towards the top right corner of the Cyber Gameboard. Even in future scenarios where C-space is not secure, the development of drones and robots will no doubt still continue, but the complexities and uncertainties in the resulting Cyber Game will be greater. Ethical complexities, for example, are increasing as robots and computerized systems in general become more autonomous. Automated decision making by robots will not eliminate responsibility but will shift it from a concurrent or real-time act to an asynchronous act that happens when the decision software is written. This is because there is ultimately a human will behind the design of all machine systems, and responsibility can be traced back to that will. War, for example, can be understood as a ‘dynamic contention of opposed wills’. 166 A war continues as long as the human wills are opposed and stops when one or other gives up. Any weapon used, even a fully automated system, should be expected to respond to this underlying change of will, and if it does not it will be problematic as a weapon system, as is evident in the case of land mines. More capable automated weapons that do not give up, such as fully autonomous battle robots, would quickly become a serious problem and are very likely to be banned if the problem presents itself dramatically enough. Isaac Asimov’s ‘Three Laws of Robotics’ may yet become actual laws. 167 This is relevant to the Cyber Game because the distinction between robots and malware is increasingly likely to be blurred, meaning that the same ethical principles will apply. For instance, malware designed to operate autonomously and asynchronously would raise the same need for responsiveness to the changing will of its creators, assuming they were thinking far enough ahead. And if they were not, this could become a source of conflict in itself. 165 The narrative as depicted in the film Zero Dark Thirty http://www.imdb.com/title/tt1790885/ accessed 14/02/13 166 Edward N. Luttwak, Strategy: The Logic of War and Peace (Cambridge (USA): Harvard University Press, 2001) 167 http://online.wsj.com/article/SB10001424052702304363104577390473311236692.html accessed 30/03/13 The Global Cyber Game © 2013 90 www.da.mod.uk National strategic priorities for the Cyber Game At the time of writing, no generally effective way exists to kill somebody using the Internet. Although there may be a few individuals who have a special vulnerability to cyber attack, such as people wearing heart pacemakers which are insecure, in general very few lives could be predictably ended by pure cyber attack. Although

[p. 96](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=96) strategic priorities for the Cyber Game At the time of writing, no generally effective way exists to kill somebody using the Internet. Although there may be a few individuals who have a special vulnerability to cyber attack, such as people wearing heart pacemakers which are insecure, in general very few lives could be predictably ended by pure cyber attack. Although there is a significant potential for economic damage and systems disruption, at the current time the online environment empowers a very large class of cooperations, but allows only a narrow range of options for conflict. Pre-existing systemic risks in supply chains, financial markets and energy grids are vulnerable to a wide range of systemic pressures, from pandemic flu through to ordinary software errors producing cascade failures. These risks are real and serious, but when placed against the more general risk framework from armed conflict including asymmetric warfare, it is not immediately apparent that cyber is a stand-out risk. One reason is that pure cyber attack is one of the less effective forms of cyber gameplay. Networked digital computers are enormously powerful tools for collaboration, but lack many fundamental properties required to apply hard power with coercive intent. Unlike aircraft, their direct application as a form of warfare is non-obvious. However, their capabilities are extraordinarily well suited to two other forms of cyber gameplay: cyber espionage and cyber sabotage. The loose, over-general use of the term ‘cyber war’ obscures this useful distinction. Cyber espionage constitutes the vast majority of the current coercive use of cyber. Societies, governments and organizations use computers to manage and organize their information. This information has value to opponents, and the more value an organization is generating using computers to organize and store information, the more value is at risk if that organization’s competitors obtain and misuse it. The simple alteration of intent from ‘organize our information’ to ‘misapply the organized information’ is well-suited to what computers can be made to do. Most cyber weapons are nothing of the kind; they are simply ‘cyber lockpicks’ which enable illicit access to an otherwise protected information source. The desire to categorize all hostile activity from states on the Internet as ‘cyberwar’ using ‘cyberweapons’ comes from an over extension of once useful metaphors. Cyber espionage with cyber lockpicks sounds a lot less impressive. However, consider how useful Internet search is for researchers. The ability to access much of the world’s information in a few clicks helps academics find references, helps ordinary people make decisions, helps scientists collaborate to solve problems. The equivalent power in the hands of hostile intelligence services, with unfettered access to the supposedly private files of individuals, business and government is certainly not a minor threat. Although the coercion involved here is non-violent, the sheer scale and ease of illicit access to confidential information possible using cyber espionage is breathtaking. Over time it could be extremely damaging, although in most cases few lives are immediately at risk. Many computer systems have uses beyond managing and storing information.

[p. 96 to 97](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=96) business and government is certainly not a minor threat. Although the coercion involved here is non-violent, the sheer scale and ease of illicit access to confidential information possible using cyber espionage is breathtaking. Over time it could be extremely damaging, although in most cases few lives are immediately at risk. Many computer systems have uses beyond managing and storing information. SCADA controls (an acronym for ‘supervisory control and data acquisition’) and avionics systems control large, complex machinery, often in safety-critical situations, ranging from power generation to communications grids and aircraft engines. Once cyber lock picking has The Global Cyber Game © 2013 91 www.da.mod.uk granted access to a computer which is part of a control system, cyber sabotage becomes possible, but if all it contains is record storage, little can be achieved. In the vast majority of computer systems, the maximum possible damage would be to erase invoicing and inventory records. Disruptive, but hardly a weapon of war in most instances. But how much damage can cyber-sabotage do, given a more attractive target? The answer is highly dependent on the nature of the systems being infiltrated. Systems with good separation between SCADA process control systems or banking trade triggers and the general Internet are hard to access. Once access is obtained, however, cyber sabotage can in theory do damage up to the full operational capacity of the system and more. Planes could fall from the sky or be used as improvised guided missiles. Power grids can destroy a very substantial subset of the assets on the grid, if manual overrides are not exercised in time. Cyber sabotage at this scale is technically possible, and at the upper end certainly fades into territory which justifies the use of the term cyber war. However, only vulnerable systems can be compromised by cyber sabotage. Military computer systems are extensively hardened and aim to be resistant to even the most determined attackers. The state of the art in security is sufficient to defend even extremely valuable assets from attack. So why is so much of the civilian asset base left vulnerable to cyber espionage and cyber sabotage, up to and including destruction in cyber war? The answer is simple: security is expensive, and without regulation to create a level playing field, companies can derive commercial advantage from putting minimally secure systems into the field, rather than footing the bill for providing high level security for customers who, on the whole, do not appreciate it. Simple market failure has left many critical systems under secured in a way which is already being exploited on a vast scale in international cyber incursions. The speed with which these systemic flaws in the installed equipment base can be closed is critical to any nation’s ability to return cyber to being a moderate espionage threat, rather than an urgent risk to national infrastructure. Computers are not inherently secure or insecure, they are as we program them. The limits of cyber sabotage are set by the vulnerabilities of non-military systems.

[p. 97 to 98](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=97) these systemic flaws in the installed equipment base can be closed is critical to any nation’s ability to return cyber to being a moderate espionage threat, rather than an urgent risk to national infrastructure. Computers are not inherently secure or insecure, they are as we program them. The limits of cyber sabotage are set by the vulnerabilities of non-military systems. If computers are generally made secure in proportion to the value of the assets they control, the possibility for a sudden asymmetric surprise attack with devastating consequences will largely be removed. Making the transition to a situation where exposure to cyber espionage and cyber sabotage is low enough to be at a similar level to other common risks is possible. Security, if done at scale, is not expensive. The common router hardware which every household with broadband uses to provide a Wi-Fi signal can either be secure or insecure depending on how the software is configured. But industry has deployed several rounds of weak encryption, resulting in a decade of system compromises. Older hardware running insecure protocols is still everywhere. The situation is even worse in desktop operating systems, where vendors distribute software with known security bugs because they bear no legal liability for distributing insecure software. Even after exploits are discovered, vendors continue to sell The Global Cyber Game © 2013 92 www.da.mod.uk compromised software without any penalties even though their irresponsible actions are, in total, a threat to critical national infrastructure. Treating software as if its quality is important is risk free. It will not trigger any conflicts, and has few unforeseen consequences except perhaps a general rise in the cost and quality of software. Government action in this area is likely be resisted by industry, but welcomed by consumers. Reliable software serves all of our needs, and operating system software companies have made enough profit over the past 20 years to be well able to afford the costs associated with comprehensively better security engineering. At present, US companies supply most of the major computer operating systems. Unilateral action by other governments on software security might improve any home grown production, but is unlikely to be effective in pressuring large US vendors to produce more secure systems. For EU countries it may require a more patient approach, working at the European scale, to encourage a different culture in software engineering by imposing European standards on commercial software quality. Lowering the ability of our Cyber Game competitors to use our own systems against us is the primary tool we have in limiting their effectiveness in cyber espionage and cyber sabotage. It may require strategic efforts which amount to an industrial policy dedicated to secure software engineering to close the vulnerabilities, but it can be done. Secure systems can be created and deployed, and creating the right system of incentives to migrate secure software engineering techniques into consumer devices is possible. The same is doubly true of the systems which manage critical national infrastructure. At this level we are entirely

[p. 98 to 99](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=98) industrial policy dedicated to secure software engineering to close the vulnerabilities, but it can be done. Secure systems can be created and deployed, and creating the right system of incentives to migrate secure software engineering techniques into consumer devices is possible. The same is doubly true of the systems which manage critical national infrastructure. At this level we are entirely responsible for our own national vulnerability. Network centric warfare What then, accounts for the high level of military concern about cyber warfare? Part of the answer is the vulnerability of US-style Network Centric Warfare (NCW). This concept stresses the construction of a parallel digital environment which tracks and maps all physical and information assets in a conflict. The idealized vision is a transparent battlespace in which sensor feeds from platforms as diverse as satellites and sensors mounted on individual soldiers are woven into a comprehensive overview of the conflict. Battle commanders are then, ideally, freed from the ‘fog of war’ which has been the historic norm and can make effective, rational decisions based on accurate, timely data. It is easy to understand the attraction of such a capability, however difficult the technical challenges are of implementing such a system. Unfortunately, in a NCW environment, many real world phenomena like camouflage have direct digital counterparts. A piece of software which infiltrates an NCW grid could simply hide, say, tanks or ships by silently discarding the primary sensor data rather than displaying them as a threat on the commander’s battle display. For all practical purposes, until sighted by a person on the ground who issues some kind of overriding alert, the vehicles are now effectively invisible to the battle’s commanders. At the point where a discrepancy is spotted between the real world and the transparent battlespace presented by the NCW software, all The Global Cyber Game © 2013 93 www.da.mod.uk assumptions are now back to manual testing and commanders are worse than blind; they cannot trust the evidence of their own electronic eyes. An example is the ‘Suter’ airborne network attack system developed by BAE Systems. Rather than jamming radar signals, Suter hacks into them. According to news reports, this enables ‘operators to invade enemy communications and computer networks, particularly those associated with integrated air defence systems, while preventing enemy operators from understanding or counteracting the exact nature of the invasion....Suter operators can then act as replacement managers to control enemy radars....By steering the enemy sensors away from friendly aircraft, Suter operators can figuratively put blinders on the enemy operators. Consequently, friendly aircraft don’t even have to be stealthy because enemy sensors can’t scan to find them, like eyes that can focus but can’t rotate.' 168 Much military concern about cyber risk therefore legitimately comes from the potential to completely disrupt and betray NCW. The benefits of NCW are gained at the cost of a catastrophic new kind of battlefield risk, compromise of command-and-control software. Unfortunately this concern reflects only a small part of the overall Cyber Game, and fails to address

[p. 99 to 100](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=99) but can’t rotate.' 168 Much military concern about cyber risk therefore legitimately comes from the potential to completely disrupt and betray NCW. The benefits of NCW are gained at the cost of a catastrophic new kind of battlefield risk, compromise of command-and-control software. Unfortunately this concern reflects only a small part of the overall Cyber Game, and fails to address the clear and present danger to the civilian Internet, both from espionage and sabotage, but also from retaliation for state cyber attack. The ongoing cyber sabotage conflict between the United States and Iran demonstrates that Internet commerce provides a soft target for retaliation. From a national strategy point of view, closing this vulnerability means, in part, taking steps to improve security as described above. But in order to do this, the state must confront another instance of the information dilemma, this time in the area of privacy and surveillance. Privacy and the information dilemma The information dilemma shows up in many guises, and it is so emblematic of problems in security that a 2007 UK Royal Academy of Engineering report on technological challenges to privacy had the title ‘Dilemmas of Privacy and Surveillance’. In terms of security, the information dilemma shows most clearly when privacy is involved. Individuals would like their information to be private, and keep it from the public domain unless they choose to put it there. The state, in the interests of national security, would like to waive privacy provisions, ostensibly to detect and prevent crime and terrorism. Once again, the information dilemma shows up: the owners of information would like it to be private, but the state would like it to be accessible. Before the Internet, phone tapping legislation required a court warrant to be issued for tapping each specific landline phone number. The technology of the Internet and the general lack of encryption now makes blanket surveillance of all Internet traffic possible, but makes applying for warrants impractical. In the United States, the legal impediments to warrantless interception of even domestic communications have now been substantially removed. 169 168 http://www.airforce-technology.com/features/feature1669 accessed 30/03/13 169 Susan Landau, Surveillance or Security? (Cambridge (USA): The MIT Press, 2011) The Global Cyber Game © 2013 94 www.da.mod.uk While the technical plausibility of blanket surveillance has been questioned, 170 the high profile resignation of CIA Director David Petraeus in November 2012, following Internet surveillance by the FBI, did dramatically demonstrate the existence and possible consequences of unconstrained access to this type of capability. 171 What is an appropriate balance between privacy and surveillance? Privacy is considered to be a basic human right in Article 12 of the United Nations Universal Declaration of Human Rights, in the Fourth Amendment of the US Constitution, and in Article 8 of the European Convention on Human Rights, and it has a long history of protection in law. Individuals value privacy as a shield from crime, persecution, and unlawful coercion, and against intrusion into personal and intimate life. Not only is it an important individual right,

[p. 100 to 101](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=100) of Human Rights, in the Fourth Amendment of the US Constitution, and in Article 8 of the European Convention on Human Rights, and it has a long history of protection in law. Individuals value privacy as a shield from crime, persecution, and unlawful coercion, and against intrusion into personal and intimate life. Not only is it an important individual right, but it is also an important public good, essential for democracy. Privacy allows for freedom of conscience and diversity of thought and, flowing from these, freedom of speech and association, which are essential for democratic participation. 172 These are important properties that are at least as important as national security concerns, indeed these properties are exactly what national security exists to protect. This dilemma resembles that of antiterrorism: the risk of overreacting and inadvertently taking on the very qualities one is trying to fight, instead of resisting by refusing to be terrorized, as the Queen did when she reportedly declined to reinforce Buckingham Palace for President George W Bush’s visit. How then can the privacy- surveillance version of the information dilemma be resolved? Curiously, for someone discredited in the Iran-contra scandal, one way of doing this was described by John Poindexter in March 2002, when he put forward the ‘Total Information Awareness’ programme to merge existing government databases and scan commercial transactions and private communications to detect terrorist plots. He proposed that the software would ‘anonymize’ the data, so that information could only be linked to an individual through a court order and generate an audit log, which would keep a record of who had used the system for what. 173 The programme proved controversial and was shut down the following year. However, in the years since, the US National Security Agency (NSA) has developed a very similar capability but without the accountability or oversight Poindexter proposed. Wired magazine reported that in 2011 in the Utah desert, the NSA began construction on what will be the world’s most powerful data collection centre, using supercomputers to monitor, decrypt, analyse and store every phone call, email, text message, online search, or other electronic communication originating in or transiting US networks, plus anything else that can be intercepted around the world. 174 170 http://www.technologyreview.com/view/508571/is-the-us-government-really-a-spy-machine/ accessed 14/02/13 171 http://www.nytimes.com/2012/11/14/us/david-petraeus-case-raises-concerns-about-americans- privacy.html accessed 14/02/13 172 Priscilla Regan, Legislating privacy: Technology, social values, and public policy (Chapel Hill: The University of North Carolina Press, 1995) 173 http://www.nytimes.com/2012/08/23/opinion/whos-watching-the-nsa-watchers.html?_r=0 accessed 14/02/13 174 James Bamford,’The Black Box: Inside America’s Massive New Surveillance Centre’ Wired vol.20, no.4 (April 2012), p.78-84 & p.122-124 The Global Cyber Game © 2013 95 www.da.mod.uk This is the Big Brother scenario that Kim Dotcom, and many civil libertarians, are opposed to. One alternative to this, essentially using the same safety provisions proposed by Poindexter, would be similar to what the UK Royal Academy of Engineering called the ‘Little Sisters’ scenario. 175 In this vision of the future, personal data is encrypted and held in partial form by many separate organizations including government departments (the Little Sisters

[p. 101 to 102](https://files.howtolivewiki.com/cyber/20130508-Cyber_report_final_U.pdf#page=101) civil libertarians, are opposed to. One alternative to this, essentially using the same safety provisions proposed by Poindexter, would be similar to what the UK Royal Academy of Engineering called the ‘Little Sisters’ scenario. 175 In this vision of the future, personal data is encrypted and held in partial form by many separate organizations including government departments (the Little Sisters 176), depending on the information they need for the service or function that they perform, and can only be brought together into a single picture and linked with the person’s identity by official and accountable authorization. In the Little Sisters scenario the information dilemma is resolved by making it difficult and expensive to breach privacy (because the information is encrypted and dispersed), while simultaneously allowing the state to access private information but making it fully accountable. The Little Sisters approach makes use of the distinction between authentication and identification, which is increasingly important for protecting personal identity in the current information environment. Authentication is a process that simply confirms that a person has a certain qualifying attribute without revealing their identity, their age for example, while identification discloses who a person is. It is often, and unnecessarily, assumed that identification is needed when authentication would be enough, and this distinction deserves to be more widely applied. The Little Sisters scenario, in a sense, protects us from ourselves. Most of us are now carrying the camera- and microphone-equipped communication devices that allow central surveillance to be so effective, and the Little Sisters scenario would help prevent the central amassing and misuse of this ‘souveillance’ (surveillance from below) information. Unfortunately, the Little Sisters scenario will only apply in countries with an effective balance of powers, not in countries where a single centre of power dominates. Nonetheless, if enough countries were to subscribe to the Little Sisters approach, most telecommunications equipment sold in the world market could be designed by default to meet these legal requirements, with an audit function that is permanently enabled, which would help to spread this type of protection. This would be in marked contrast to the current situation, in which the telecommunications equipment being sold around the world actually facilitates unaccountable surveillance. 177 The state would like to retain its prerogative to undertake espionage, but when much of the information is obtained from the Internet, it cannot do this without placing its own civilian population under surveillance, because the Internet obscures the key Westphalian distinction between domestic and international. This contravenes domestic legislation in democratic countries, but not the provisions of international law, which permit espionage. Methods for accountability for domestic surveillance do exist, but they are very difficult to assert in a global telecommunications marketplace. The only way round this dilemma in the longer term 175 http://www.cl.cam.ac.uk/research/dtg/www/publications/public/ah12/dilemmas_of_privacy_and_surveilla nce_report.pdf accessed 14/02/13 176 Manuel Castells, The Power of Identity (Oxford: Wiley-Blackwell, 2010) 177 Susan Landau, Surveillance or Security? (Cambridge (USA): The MIT Press, 2011) The Global Cyber Game © 2013 96 www.da.mod.uk is for democratic states to introduce legislation

---
Continues in https://guptaoption.com/texts/143-9.md (part 9 of 10).
End of [143] The Global Cyber Game: Achieving strategic resilience in the global knowledge society, part 8 of 10. Its connections are at the top of this file; the map is https://guptaoption.com/llms.txt.