We don’t yet know for sure who used Israeli company NSO’s software to hack WhatsApp users – the messaging service’s parent company Facebook has said only that the culprit is an “advanced cyber actor” – but all signs point to it being a government. According to one analysis, NSO has 45 governments as clients including, amazingly, Saudi Arabia and the United Arab Emirates, even though officially these states don’t recognise Israel.
Whoever the culprit, the WhatsApp attack will surely be added to a long list of state-backed attacks that includes Russia’s 2015 takedown of Ukraine’s power grid, China’s persistent intellectual property thefts and North Korea’s attack on Sony Pictures over the film The Interview. And yes, the west does it too – the United States used a cyber-weapon to take down Iran’s nuclear programme in 2010 – the so-called Stuxnet attack.
This list is far from exhaustive. Simply put, there is now a baked-in assumption by governments that, despite technically being at peace, or in some cases even allies, everyone is trying to hack everyone else all.
And this is where state-backed cyber-attacks get scary: despite persistent low-level conflict, we still don’t really know how to treat them when their target is political or diplomatic, or how to handle them in a way that limits the risk of tit-for-tat escalation.
For example, as horrifying as the killing of Jamal Khashoggi was, it was a discrete event and the international community knew how to respond proportionally – though arguably inadequately – with diplomatic pressure, and the threat of an arms embargo against Saudi Arabia. This response was broadly predictable, and the Saudis would presumably have factored this into their considerations. The same could be said for recent tension between India and Pakistan: the stakes were fairly clear so both sides could predict how far they could push the other without it tipping over into a much broader war.
But what should be done about the WhatsApp attack if it’s identified as state-backed? It may appear to be a one-off incident that targeted a human rights activist, but it involved the exploitation of a security hole present on millions of devices. It demonstrates the attacker is able and willing to exploit such holes, which presents an enormous security risk. There’s no reason why the attacker couldn’t use the same technology to surveil countless other people. So how should it be treated? Would it be more appropriate to respond with a diplomatic protest, or would a like-for-like cyber-attack be proportionate? Would a military response be justified? The answer is that because no rules or norms have been established, nobody knows for certain.
Apply this question to some of the other attacks listed above and the question becomes even more vexed: if Russia takes down a power grid in another country, but doesn’t physically destroy anything, is that an act of war? If North Korea hacks and publishes a valuable film on the internet for free, would it be appropriate for the US government to be involved in responding, and if so … what on earth should it do?
And the inevitable consequence of this ambiguity is escalation. In fact, earlier this month Israel demonstrated this. Citing a “Hamas cyber-offensive” against Israeli targets, the Israeli Defence Forces bombed a building that was housing not men with guns, but hackers – in what is perhaps the first ever example of a so-called “kinetic” response to a cyber-attack.
So what can be done? I think we should take inspiration from the 19th century. The Geneva conventions are a series of international treaties that established a baseline of acceptable behaviour in warfare. Signed by the major powers of the time, they outlawed the use of chemical and biological weapons – and set standards for how prisoners and civilians should be treated. They didn’t end the horrors of war – but they have limited them. They have set international benchmarks by which state behaviour can be judged.
With cyberwarfare already a part of our lives, what we need now is something similar: the major powers should get together and agree the rules. Who is fair game for an attack? Who counts as a combatant? What would count as a proportionate response? These are not easy question in a field that blurs so many lines – but if we want to create a stable world, we need to agree on the answers.
• James O’Malley writes on politics and technology
Source: The Guardian
