Guy-Philippe Goldstein: How cyberattacks threaten real-world peace

Translator: Elisabeth Buffard Reviewer: Veronica Martinez Starnes

Good afternoon.

If you have followed

diplomatic news in the past weeks,

you may have heard of a kind of crisis

between China and the U.S.

regarding cyberattacks

against the American company Google.

Many things have been said about this.

Some people have called a cyberwar

what may actually be

just a spy operation --

and obviously, a quite mishandled one.

However, this episode reveals

the growing anxiety in the Western world

regarding these emerging cyber weapons.

It so happens that these weapons are dangerous.

They're of a new nature:

they could lead the world

into a digital conflict

that could turn into an armed struggle.

These virtual weapons can also destroy the physical world.

In 1982, in the middle of the Cold War

in Soviet Siberia,

a pipeline exploded with a burst of 3 kilotons,

the equivalent of a fourth of the Hiroshima bomb.

Now we know today -- this was revealed

by Thomas Reed,

Ronald Reagan's former U.S. Air Force Secretary --

this explosion was actually the result

of a CIA sabotage operation,

in which they had managed

to infiltrate the IT management systems

of that pipeline.

More recently, the U.S. government revealed

that in September 2008, more than 3 million people

in the state of Espirito Santo in Brazil

were plunged into darkness,

victims of a blackmail operation from cyber pirates.

Even more worrying for the Americans,

in December 2008 the holiest of holies,

the IT systems of CENTCOM,

the central command

managing the wars in Iraq and Afghanistan,

may have been infiltrated by hackers

who used these:

plain but infected USB keys.

And with these keys, they may have been able

to get inside CENTCOM's systems,

to see and hear everything,

and maybe even infect some of them.

As a result, the Americans take the threat very seriously.

I'll quote General James Cartwright,

Vice Chairman of the Joint Chiefs of Staff,

who says in a report to Congress

that cyberattacks could be as powerful as

weapons of mass destruction.

Moreover, the Americans have decided

to spend over 30 billion dollars

in the next five years

to build up their cyberwar capabilities.

And across the world today, we see

a sort of cyber arms race,

with cyberwar units

built up by countries like North Korea

or even Iran.

Yet, what you'll never hear

from spokespeople

from the Pentagon or the French Department of Defence

is that the question isn't really

who's the enemy, but actually

the very nature of cyber weapons.

And to understand why, we must look at how,

through the ages, military technologies

have maintained or destroyed

world peace.

For example,

if we'd had TEDxParis

350 years ago,

we would have talked about the military innovation of the day --

the massive Vauban-style fortifications --

and we could have predicted

a period of stability in the world or in Europe.

which was indeed the case in Europe

between 1650 and 1750.

Similarly, if we'd had this talk

30 or 40 years ago, we would have seen

how the rise of nuclear weapons,

and the threat of mutually assured destruction they imply,

prevents a direct fight between the two superpowers.

However, if we'd had this talk 60 years ago,

we would have seen how the emergence

of new aircraft and tank technologies,

which give the advantage to the attacker,

make the Blitzkrieg doctrine very credible

and thus create the possibility of war in Europe.

So military technologies

can influence the course of the world,

can make or break world peace --

and there lies the issue with cyber weapons.

The first issue:

Imagine a potential enemy announcing

they're building a cyberwar unit,

but only for their country's defense.

Okay, but what distinguishes it

from an offensive unit?

It gets even more complicated

when the doctrines of use become ambiguous.

Just 3 years ago, both the U.S. and France

were saying they were investing militarily in cyberspace,

strictly to defend their IT systems.

But today both countries say

the best defense is to attack.

And so, they're joining China,

whose doctrine of use for 15 years has been

both defensive and offensive.

The second issue:

Your country could be under cyberattack

with entire regions plunged into total darkness,

and you may not even know

who's attacking you.

Cyber weapons have this peculiar feature:

they can be used

without leaving traces.

This gives a tremendous advantage to the attacker,

because the defender

doesn't know who to fight back against.

And if the defender retaliates against the wrong adversary,

they risk making one more enemy

and ending up diplomatically isolated.

This issue isn't just theoretical.

In May 2007, Estonia was the victim of cyberattacks,

that damaged its communication

and banking systems.

Estonia accused Russia.

But NATO, though it defends Estonia,

reacted very prudently. Why?

Because NATO couldn't be 100% sure

that the Kremlin was indeed behind these attacks.

So to sum up, on the one hand,

when a possible enemy announces

they're building a cyberwar unit,

you don't know whether it's for attack

or defense.

On the other hand,

we know that these weapons give an advantage to attacking.

In a major article published in 1978,

Professor Robert Jervis of Columbia University in New York

described a model to understand

how conflicts could arise.

In this context,

when you don't know if the potential enemy

is preparing for defense or attack,

and if the weapons give an advantage to attacking,

then this environment is

most likely to spark a conflict.

This is the environment that's being created

by cyber weapons today,

and historically it was the environment in Europe

at the onset of World War I.

So cyber weapons

are dangerous by nature,

but in addition, they're emerging

in a much more unstable environment.

If you remember the Cold War,

it was a very hard game,

but a stable one played only by two players,

which allowed for some coordination between the two superpowers.

Today we're moving to a multipolar world

in which coordination is much more complicated,

as we have seen at Copenhagen.

And this coordination may become even trickier

with the introduction of cyber weapons.

Why? Because no nation

knows for sure whether its neighbor

is about to attack.

So nations may live under the threat

of what Nobel Prize winner Thomas Schelling

called the "reciprocal fear of surprise attack,"

as I don't know if my neighbor

is about to attack me or not --

I may never know --

so I might take the upper hand

and attack first.

Just last week,

in a New York Times article dated January 26, 2010,

it was revealed for the first time that

officials at the National Security Agency

were considering the possibility of preemptive attacks

in cases where the U.S. was about

to be cyberattacked.

And these preemptive attacks

might not just remain

in cyberspace.

In May 2009, General Kevin Chilton,

commander of the U.S. nuclear forces,

stated that in the event of cyberattacks against the U.S.,

all options would be on the table.

Cyber weapons do not replace

conventional or nuclear weapons --

they just add a new layer to the existing system of terror.

But in doing so, they also add their own risk

of triggering a conflict --

as we've just seen, a very important risk --

and a risk we may have to confront

with a collective security solution

which includes all of us:

European allies, NATO members,

our American friends and allies,

our other Western allies,

and maybe, by forcing their hand a little,

our Russian and Chinese partners.

The information technologies

Joël de Rosnay was talking about,

which were historically born from military research,

are today on the verge of developing

an offensive capability of destruction,

which could tomorrow, if we're not careful,

completely destroy world peace.

Thank you.

(Applause)