“When do you decide you want to bomb an adversary’s electrical
company? It’s the same answer for when you would launch a cyber-attack on their
electricity sector – it is just a question of how you do it”.
Buky Carmeli, former Director, Israeli National Cyber Security
Authority, August 2018
Crash!
Alphen,
Netherlands. 29 August. Buky Carmeli, former Director of the Israeli National
Cyber Security Authority, has called for “…a strategic paradigm shift in
thinking about cyber operations” in order to place them squarely at the centre
of deterrence and defence. He also warned about the growing danger from a
“cyber doomsday weapon”. His message
mirrors what Generals Allen and Breedlove, Admiral Zambellas and I called for
in our recent paper Future War NATO
in which we suggested threat must be seen as a continuum across a new spectrum of
violent escalation from hybrid war to hyper war (including space war) via cyber
war.
Imagine this.
0812 hours the electricity grid crashes. A few minutes later internet and phone
systems – fixed and mobile – also crash. At first people are bemused, almost
resigned, but confident that in a short time their lives will be restored to
normalcy. As time passes and nothing happens bemusement becomes concern. They
search their FM and AM radios for news, but nothing. A day passes and they have
neither news nor power. Just in time
delivery systems of food and medical supplies fail, still no news. With fridges down people consume much of the
food they have bought before it goes rotten.
Questions are asked as neighbours begin to talk to each other. What is
happening? Is there any news? Panic
begins to seep into their consciousness and in the absence of information
rumours abound. With citizens isolated from the state and from each other
authority, order and control begins to steadily collapse. Slowly, word spreads of cyber-attacks and
sabotage across the country and still no news from government.
Fantasy? At 0812 hours my house and much of the
surrounding region lost power. The internet and phone systems crashed along
with much of the road and rail network. Power was restored at 0917 hours, which
was impressive given the size of the outage but worrying also in that the cause
was failure in one high-tension wire and an entire region of the country lost
power. For sixty-five minutes my wife and I were completely isolated – no
phone, no internet, no information. In a real national emergency sirens would
have blared out their sombre call to crisis. What crisis? What to do? What
action to take? To whom to speak and how?
Double Dutch
defence?
When power
goes down in the Netherlands it is often whole swathes of the country that is
effectively taken out. Yes, the Dutch,
like many European states are very good at talking about security. For example,
the impressive Hague Security Delta is a leading security cluster that involves
all leading stakeholders engaged in assuring societal security and
stability. And yet, what happened here reveals
that for all the talk the country’s critical infrastructure and by extension
society is extremely vulnerable to mass disruption. Worse, talking a lot about such threats seems
to be fast becoming part of the problem.
For politicians ‘threat’ remains far too abstract, as if simply funding
research is a form of defence in its own right and thus a way of delaying doing
anything much about it. New concepts are developed, such as hybrid war, cyber
war and hyper war (yes, guilty as charged) and people like me talk sagely and
not-so-sagely about what needs to be done to make society more ‘robust’ and
‘resilient’ in the face of emerging threats. It is not enough.
This weekend
I had dinner with a close friend of mine who also happens to be the best Dutch
strategic analyst. He made two important points. First, the Dutch do not really
know the extent of the vulnerability of their power grid to attack. This is
partly because that have never really tried to find out and partly because they
rely for much of their power on the German national grid. Second, the Dutch
have made little or no effort to prepare their population for a sustained
outage generated by an attack. The Dutch are not alone. Much of the rest of
Europe is equally vulnerable and ill-prepared. National government is
ill-prepared and local government by and large wholly unaware what real civil
defence would mean and entail in a prolonged emergency.
What is the
threat?
So, what is
the threat? In an August article for The
Jerusalem Post, Carmeli confirmed that offensive cyber capabilities were
becoming an ever more important part of the strategic arsenals of major
military powers such as Israel. Indeed,
what Carmeli had to say should be sobering news for all Europeans. Russia and China
have ‘cyber-compromised’ Israel far more than Iran or Hezbollah. He pointed to
the number of cyber-attacks on Israel mounted daily by states, groups and
companies and called for cyber-defence to be seen as part of broader national
defence. Carmeli also warned against making a false distinction between war and
peace. “Cyber is an endless battle – you are always playing chess with the
other side”.
Carmeli then
went on to hint at the importance of offensive cyber capabilities. Of the
democracies only the US, UK and Israel have really begun to develop such
capabilities. Critical to the debate about the changing character of war he
suggests that launching a potentially catastrophic cyber-attack should only
take place in conjunction conventional attack.
Too many
European leaders are in denial about the possibility of future war and the role
of cyber-attacks therein. The experience my wife and I had together with well
over 100,000 other Dutch households is precisely how a twenty-first century war
could start. A carefully planned disinformation and disruption campaign that
would proceed or parallel any military campaign of destruction. Defeat could happen at a stroke simply because
government would be powerless to respond, and society would simply have no idea
how to respond. Resiliency?
War at our
seams and the new civil defence
War at the many
vulnerable seams of our societies is now the chosen weapon of enemies. In the
twenty-first century there can be no ‘defence’ if a new and purposeful balance
is not struck between defence and deterrence, protection and projection. The mistake all European governments make is
to see the security debate and the defence debate as separate. They are not.
Rather, they are part of a continuum of effects (including cyber) that must be
generated if the citizens of twenty-first century democracies are to live their
lives reasonably free from the fear of externally-generated violence by states
and non-states alike, quite possibly in harness. The very nature of
twenty-first century warfare is such that neither security nor defence can be
generated unless governments actively treat their citizens as partners in their
own security.
What is
needed is an entirely new concept of civil defence that works in tight
conjunction with information, cyber and military defence. First, re-established civil defence would
restore the broken link between people protection and legitimate power projection
aimed at deterring aggressors. Second,
civil defence would reinforce deterrence by demonstrating the ability of
society to recover. Third, active civil defence would help restore the big
partnership between power and people vital to security and defence.
Hardening
democracies
To achieve
what will to some appear to be an oxymoron – hardened democracies – specific
investments will need to be made to harden those critical infrastructures upon
which freedom from the fear of aggression and violence depends. Above all,
governments must embark on a much more systematic campaign of education so that
people are made aware of the threats and would critically know what to do in a
genuine emergency when the siren sounds. Contemporary security and defence is
not simply about investment, much though it is needed. It is about a
fundamental change in the political culture of many European democracies so
that ‘sec-def’ is treated with more than political lip service and citizens
treated as more than overgrown children.
Now, I am not
suggesting a major shock war is going to break out in Europe tomorrow. However,
as I suggest in my new piece for Internationale
Politik about Germany’s role as a strategic peacekeeper, such a war is no
longer beyond the realms of possibility. For those of us schooled in the
consideration of the worst case it is simply time again for those in power to at
least think about war. Why? History suggests over-mighty, predator-lkie
illiberal states and groups with extreme motivations see irresolute, distracted
and weak liberal states as prey creating the ‘best’ conditions for strategic shock.
Recognise it?
Julian
Lindley-French
