Digital doomsters

A Fierce Domain: Conflict in Cyberspace, 1986-2012. Edited by Jason Healey. CCSA/Atlantic Council; 354 pages; $24. Buy from Amazon.com

Cyberwar Will Not Take Place. By Thomas Rid. Hurst; 218 pages; £14.99. To be published in America in September by Oxford University Press USA; $27.95. Buy from Amazon.com, Amazon.co.uk

“CYBER” sounds scary. Cyber-criminals can empty your bank account; cyberterrorists are the stuff of Hollywood thrillers. Cyber-espionage involves stealing state secrets or intellectual property. You do not have to understand how computers work to be worried about the damage to you, your work or your country.

Yet businesses seeking to increase their sales, and officials and politicians who want more money and power, love tales of doom and gloom. Trade is booming for what some have dubbed the “cyber-industrial complex”. State agencies demand more power to fend off a dreadful attack by a foreign enemy—a kind of “digital Pearl Harbour”. Companies peddle security advice and software, often with a hefty price tag. The difficulty for the citizen and taxpayer is to decide: are people being too paranoid, or too complacent?

Two new books provide some useful perspective. “A Fierce Domain” is a collection of essays edited by Jason Healey, a former cyber-policy chief in the Obama White House. His main point is that this is not a new problem: the first big cyber-attack dates back to 1986, when a bunch of German hackers in Hanover, working for the KGB, sneaked into American military networks. Named “Cuckoo’s Egg”, it was caught only because a sharp-eyed official noted a tiny 75-cent billing error, revealing unauthorised use of a computer network.

Many more attacks have followed: Moonlight Maze, Solar Sunrise, Titan Rain and Byzantine Hades. None is a household name, though from the gripping accounts in Mr Healey’s book many readers will feel they all should be.

One especially damaging operation involved the theft of top-secret material from the most classified NATO networks. The attackers had used infected memory sticks, which were left lying around in car parks near sensitive buildings. Careless or thrifty officials picked them up, and some used them to copy material between classified computer networks and those connected to the internet. A clever bit of software then copied, encrypted, compressed and dispatched the material—probably, spooks think, to Moscow.

Mr Healey’s main message is to urge policymakers to be less secretive and more humble. Too many past attacks remain classified. Officials continue to burble the same warnings and assurances as they did 20 years ago; the public is left in the dark.

Thomas Rid is a German-born academic, now at King’s College London. He is one of Britain’s leading authorities on, and sceptics about, cyber-warfare. His provocatively titled book attacks the hype and mystique about sabotage, espionage, subversion and other mischief on the internet. He agrees that these present urgent security problems. But he dislikes talk of “warfare” and the militarisation of the debate about dangers in cyberspace. Computer code can do lots of things, but it is not a weapon of war. He criticises the American air force for using a “lobbying gimmick” with talk of “cyber” as a fifth domain of warfare, after land, sea, air and space.

However much the military brass may hype up the threat, states are in fact highly unlikely to use cyber-weapons against each other, Mr Rid argues. They are expensive to acquire, unreliable and fiddly. That does not mean they are useless. Malicious code, “malware”, can do shocking damage, destroying machines, starting fires, spewing pollution or jamming communications. Cleverer weapons could be more dangerous still, such as malicious code that adapts to its environment, rewriting itself to evade pursuers. They will be used, but as part of sabotage or terrorism rather than all-out war, he argues.

Both books leave the reader feeling gloomy. People worry too much about the wrong things, and not enough about the real problems. Digital weapons are growing more sophisticated; the response has been self-interested, slow and crude.