OTHER-THAN-INTERNET (OTI) CYBERWARFARE: CHALLENGES FOR ETHICS, LAW, AND POLICY

Almost all discussions of cyberwarfare, other cyber-attacks, and cyber-espionage have focused entirely on the Internet as the chief means of damage – the Internet as a ‘vector,’ using a term from the theory of infectious diseases. However there are a variety of means, some of which have already been used, that involve cyber-exploitation using vectors other than the Internet. Malware can be installed in the integrated circuits of computers and servers, but also in any devices attached to them – thumb drives, CDs, printers, scanners, and so on. One can also use various forms of electromagnetic radiation at a distance of meters or more to exfiltrate data or to infiltrate corrupt data. I call this large and diverse family of unwanted interference with the functioning of information processing systems other-than-Internet (OTI) attacks on information systems. Stuxnet, and probably the 2007 Israeli corruption of Syrian air defenses, were OTI attacks. Such OTI techniques are more difficult to develop than creating malware, requiring electronic manufacturing facilities or novel technologies, and are thus accessible only to larger corporations and technologically sophisticated countries. Particularly vulnerable would be countries (like the United States and Europe) whose information processing devices are mainly produced outside of the country. Once exploitations via the Internet become harder to perpetrate, OTI exploitations are certain to grow dramatically, eventually requiring equipment for critical uses to be expensively fabricated in (and transported using) secure facilities; expensive detection measures will have to be instituted. This will create challenges for policy, law, and ethics, as well as greatly increasing the cost of many electronic devices.