On June 15, 2011, Richard Clarke published an Op-Ed piece in The Wall Street Journal with the title “China’s Cyberassault on America.” Note that he used the word “cyberassault” in the title, steering away from the highly-charged term “cyberwar,” although he does use that term in the body of the article. Of course, reporters picked up on “cyberwar” in such articles as Don Reisinger’s “Clarke: U.S. lags in ‘guerrilla cyberwar’ with China” at http://news.cnet.com/8301-13506_3-20071200-17/clarke-u.s-lags-in-guerrilla-cyberwar-with-china/#ixzz1PSPXnSWB
There has been an ongoing discussion as to how to define an act of “cyberwarfare” and how a government should respond to such an event. Clearly the issue of attribution remains key as attackers can easily misrepresent the source of a cyberattack. This issue was raised to a higher level with the recent announcement that the U.S. military will soon release its cyber warfare strategy … see, for example, Al Pessin’s article “Pentagon Prepares Cyber Warfare Strategy” at http://www.voanews.com/english/news/usa/Pentagon-Prepares-Cyber-Warfare-Strategy-122904119.html
Dick Clarke, whom I have known personally for more than a decade and for whom I have the greatest respect, makes the point that the discovery of Chinese explosives intended to blow up the national electricity grid would be considered an act of war, but a cyber attack with the same potential impact might not. However, I happen to think that we have always had the same attribution issues with physical acts of war. How many major wars have been started with fabricated or misrepresented information or events often falsely attributed to “the enemy”?
In Clarke’s example, the fact that unexploded bombs may be marked “Made in China” doesn’t prove that Chinese operatives planted the explosives. And even if those who laid the explosives were found to be Chinese nationals, it doesn’t necessarily mean that they are sponsored by government. I think that we have similar problems of attribution in both the physical and cyber worlds and we need to be very careful about placing blame.