The only workable deterrent is the threat of a proportional (or more than proportional) response.
Since hacking is usually hard to pin down definitively to a single actor, and it's difficult to justify a conventional armed response, you probably want a response that has similar properties.
If you assume that China is the perpetrator, then the best response to hacking attacks is to let it be known to the Chinese government that any hacking attempts will be responded to by attempts to destabilize communist party control (encouraging dissidents through side-channels, developing/distributing tech to bypass the great firewall, etc)
Perhaps some kind of cyber-warfare non-proliferation treaty akin to START. Nation states agree to not launch APTs against eachother, and pledge to prosecute any of their citizens that launch such attacks independently.
First of all, START isn't even about non-proliferation. Has nothing to do with it. It's a series of agreements between two superpowers that served mostly as a diplomatic tool to de-escalate Cold War tensions and provide political cover for military budget reductions. It's been wildly successful in that regard.
The actual Nuclear Non-Proliferation Treaty is entirely about non-proliferation, a pre-emptive attempt to keep the capability of nuclear warfare out of the hands of most nations. It has absolutely nothing to do with preventing nuclear warfare between those nations already possessing them.
We haven't had nuclear war because so far, nobody who either actually wants to end the world, or is stupid enough to think he can "win" a nuclear war, has been in control of nuclear weapons. Not because of some piece of paper saying "I promise I won't kill you". Hilter had one of those with Stalin, how'd that work out?
"Cyber warfare" doesn't have the problems of nuclear warfare. It's unlikely to end the world, it's relatively cheap, the tools are widely available, and unlike physical warfare which destroys economies, it's actually about the economy. It's about getting a leg up on the competition. It's about money, period. The world some non-technical people live in where "cyber warfare" is all about winning actual wars is a world of fantasy.
In human history, only one thing has reliably stopped wars, and that is the tying together of nations' economies so closely that war between them becomes economically impossible. This just doesn't work in "cyber warfare".
Comments
When will we take real, substantive action on this issue?
Got any new ideas? (seriously)
The only workable deterrent is the threat of a proportional (or more than proportional) response.
Since hacking is usually hard to pin down definitively to a single actor, and it's difficult to justify a conventional armed response, you probably want a response that has similar properties.
If you assume that China is the perpetrator, then the best response to hacking attacks is to let it be known to the Chinese government that any hacking attempts will be responded to by attempts to destabilize communist party control (encouraging dissidents through side-channels, developing/distributing tech to bypass the great firewall, etc)
Perhaps some kind of cyber-warfare non-proliferation treaty akin to START. Nation states agree to not launch APTs against eachother, and pledge to prosecute any of their citizens that launch such attacks independently.
What would you do when there are still targeted attacks launched via compromised systems from random unrelated countries used as proxies?
I have to say I find that pretty laughable.
First of all, START isn't even about non-proliferation. Has nothing to do with it. It's a series of agreements between two superpowers that served mostly as a diplomatic tool to de-escalate Cold War tensions and provide political cover for military budget reductions. It's been wildly successful in that regard.
The actual Nuclear Non-Proliferation Treaty is entirely about non-proliferation, a pre-emptive attempt to keep the capability of nuclear warfare out of the hands of most nations. It has absolutely nothing to do with preventing nuclear warfare between those nations already possessing them.
We haven't had nuclear war because so far, nobody who either actually wants to end the world, or is stupid enough to think he can "win" a nuclear war, has been in control of nuclear weapons. Not because of some piece of paper saying "I promise I won't kill you". Hilter had one of those with Stalin, how'd that work out?
"Cyber warfare" doesn't have the problems of nuclear warfare. It's unlikely to end the world, it's relatively cheap, the tools are widely available, and unlike physical warfare which destroys economies, it's actually about the economy. It's about getting a leg up on the competition. It's about money, period. The world some non-technical people live in where "cyber warfare" is all about winning actual wars is a world of fantasy.
In human history, only one thing has reliably stopped wars, and that is the tying together of nations' economies so closely that war between them becomes economically impossible. This just doesn't work in "cyber warfare".