Despite David Sanger’s relatively unimposing stature, his extensive knowledge of East Asia, U.S. foreign policy, and more recently the debate on cyber warfare is enough to make anyone feel a little intimidated. An interview with Sanger by the Keck Journal touched on all three categories of his expertise but focused heavily on the last one, specifically, America’s involvement in cyber attacks.
Sanger views cyber attacks as a foreign policy tool. He compared them to the nuclear bomb, an “incredible weapon that we used before we thought about it,” and before that land mines, chemical and biological weapons, in order to point out a historical pattern where countries have used new technology before they realized its full destructive capacity. Only after journalists sparked public debate, Sanger argued, did the morality of these weapons come into question. Since such a discussion about cyber warfare has not yet been raised on the policy level, he emphasized that the U.S. and other countries need to reach a consensus not only on how to use cyber weapons, but why they are using them in the first place.
Sanger discussed three different cases of cyber warfare to shed light on the multifaceted issue: the U.S. and Israel’s joint cyber mission of Operation Olympic Games targeting Iran; the allegations against Russia concerning the “Snake” cyber attacks on Ukraine; and the controversy with Chinese company Huawei and the U.S. National Security Agency.
While Sanger acknowledged Olympic Games, in which the U.S. and Israel digitally tampered with the operating systems of Iran’s nuclear centrifuges, as being much less costly than sending in saboteurs (special forces) or conducting air attacks, he also expressed caution about the dangers of “the Internet of things”. He speculated that if terrorists or rogue governments wanted to attack cities, they could easily do so by shutting off cell phone networks, gas, electricity or even emergency responders, which would have huge human cost.
Meanwhile, Russia’s alleged connection to cyber warfare with the Ukrainian government highlights the perils of hacking done in preparation for future attacks. According to Sanger, “the hard part is getting the surveillance system” inside the government’s operating computers, but once that happens it is easy to attack at any time; in other words, the programs that have already been implanted into the Ukrainian system could be an invaluable asset to Russia if it felt a cyber attack necessary on Ukraine.
Finally, China and the U.S. are facing serious tensions over the NSA’s infiltration of a large corporation called Huawei, which is suspected to have ties to the Chinese government. Sanger commented that the U.S. has complained in the past when China hacked U.S. companies, but when the NSA was caught the excuse for American snooping became an issue of “national security” and “at least we don’t give information [on China] to American companies.” The problem is the difference in how countries view and go about protecting national security, which differs especially between China and the U.S. If what the NSA did to Huawei is just and legal, does the U.S. become fair game to the same kinds of foreign attacks on its systems?
With these cases studies in mind, Sanger has not yet seen any exchange of cyber weaponry among governments, although evidence of “exporting expertise” does theoretically exist between the U.S. and Israel. However, there are lots of commercial technologies sales that could be used for both offensive and defensive cyber attacks. In fact, what is happening in the fast-paced, high-tech cyber world is not so different from the arms race in the world of conventional weapons.
This brings up a different question: how effective is the relatively new cyber attack compared to conventional policy measures such as sanctions, diplomatic isolation, and military intervention? Sanger’s answer was very clear: “It depends on the target.” Some countries are more susceptible to cyber attacks and others are not. For example, the U.S. successfully used cyber offense in Iran, as the Operation Olympic Games brought the nuclear-aspiring state to the negotiation table. In contrast, “backwards” regimes that lack technological infrastructure are much less vulnerable to cyber attacks. For example, cyber attacks proved hardly efficient against Assad in Syria. Another example is Libya. The Libyan air defense network was outdated to the extent that it was not even connected to the Internet. In this case, it ended up being more efficient to resort to conventional forces rather than launching a cyber attack.
One major problem with having a debate on cyber warfare is that there are neither treaties nor norms on the international level regarding the use of cyber weapons. At least for the present, the world of Internet cyberspace can be compared to an anarchic state; countries with the technical capabilities to wield cyber weapons are doing so without regulation. The absence of international regulation on cyber weapons is more dangerous given the fact that more people have access to them. Unlike nuclear weapons or drones, which are for the most part wielded exclusively by governments, cyber attacks are easy to launch by anyone who has enough knowledge and incentive to do so. Non-state actors, including terrorist organizations, international criminal groups, and as Sanger frequently emphasized, teenagers, could readily launch attacks into cyberspace.
Academics around the world have been talking about setting international norms for cyber warfare, but whether the theoretical efforts will translate into actual implementation is uncertain. For one, the U.S. government has hardly been receptive to historical weapons treaties such as the Nuclear Test Ban Treaty. There are some UN committees involved, but they are slow to take action and cannot draft timely and relevant legislation due to the constantly changing nature of the digital world. In addition, Sanger notes that what has worked in the nuclear weapons arena is the concept of deterrence, and “deterrence is a lot harder in the cyber world,” primarily because of the deniability that cyber weapons provide. Sanger’s best answer to the issue is to have the U.S. start bilateral negotiations with other world powers, such as China, creating a model agreement for other countries to follow. Due to the two countries’ polarized views on the rationale and use of cyber weapons, however, the feasibility of this solution is questionable.
Increasing number of countries and non-state actors are finding cyber weapons as an economic and effective security tool. While the U.S. finds cyber weaponry a useful tool for promoting its national security, actions of like-minded countries with cyber capabilities pose a significant security challenge to the U.S. The very fact that the U.S. is actively engaging in cyber attacks could invite more countries into the cyber war, exacerbating national security concerns. How, then, should the U.S. behave? Is the benefit we are reaping from cyber attacks substantial enough to offset the harms we get from others that would attack us in the same way that we do? Sanger’s hope is that through national debates on the rationale and methods of cyber weapons, accompanied by diplomatic efforts to hold bilateral negotiations with big powers such as Russia and China, the situation in cyberspace will remain stable for generations to come.
