Global information infrastructure: threats
Information and knowledge can equally be used for construction and for destruction, for good purposes and for bad ones. The global communications infrastructure, combined with universal access to it, creates both new possibilities and threats for national security and defence.
Manuel W. Wik discusses that issue, vital for us all.
Information is the key to all activities and knowledge is the core of strength. Information can be used for production as well as for destruction, for good and for bad purposes. Information has a profound significance for the security of individuals and nations and nobody can escape confrontation with this fact. We are now creating a global communications infrastructure that will offer an easy access to information which in turn creates new threats, not encountered earlier. To minimise the risks involved, it is important to disseminate awareness about these threats. The need for safety and increasing global interdependencies require co-operation between governments, enterprises and academia, within and among the nations. Foresighted and cautious development of global information infrastructure provides conditions for a peaceful democratic global evolution in the new millennium.
Information is the key to the realm of knowledge
Information is the key to all activities. Information is a vital asset that can be of more value than money, goods and labour. Information has many special features. It can be described as soft; it directly influences our minds and not our bodies. It can pass refinements from bits, symbols, data, information, perception, signification, knowledge, to wisdom. Its quality and value can range from nothing to everything in a given consistency. Information can be correct or false and hard both to evaluate and to value. It is non-linear: a small input can trigger a large output. It can travel at the speed of light and consumes hardly any energy. It can overcome distance. It can be given away and still be kept. Sharing information can make it more or less valuable. It can be given and taken openly or covertly. Sources can be identified or anonymous. Muscle and steel require access to territories and are stopped by physical borders. Information can travel in many ways and cannot be controlled and stopped easily.
Discrepancy between intended and perceived information is dependent on data transmitted, pre-knowledge of the interpreter, available time for interpretation, the interpretation process itself and the driving purposes behind it. There are many reasons why discrepancies appear. Misunderstandings are far too common due to the fact that messages are not clearly explained or sent in one context and received in another. A common picture reduces discrepancy. One danger is that we are only allowed to see what is illuminated and not what we really want to see.
Information deluge often results in numbing of the senses. To be fed by information is one thing. To be able to seek information and to treat it are two different things. It is not really information that man needs but communication and knowledge. There is an old Chinese proverb that fits: Give somebody a fish and he is satisfied for the day. Give somebody a fishing rod and he will be satisfied his whole life.
In decision-making groups, individual participants often have different information. The consequences of incomplete and asymmetrically distributed information are fundamental for the functioning of markets and the development of events, since an advantage in information can often be strategically used. For instance, a bank does not have complete information about a borrower's future income; an insurance company cannot survey how a policy-holder will take responsibility for his property; an auctioneer does not know beforehand the payment will of a bidder; the stock-market does not know the business a board of a company is planning; the police have difficulty in mapping the activities of a delinquent; defence already in peacetime is wallowing in a stream of secret and selectively given information. The world is full of situations with 'asymmetric information' and the consequences that follow from it.
The flow of information depends on its sources, transportation, processing and receivers. Today all these dependencies rely more and more on information technology. If technology fails to do its job, destruction, failings, delay, distortion, manipulation or the revealing of information may in turn result in loss of financial assets, labour, services, goods, or even life.
Knowledge is the core of strength in all activities and reduces the need for other resources like capital and labour. It is knowledge that is the key to success in the world of business, not money. What you know, rather than what you own, is the foundation for social, political, economic and military success. The intellectual resources are fundamental in all processes, although they are hard to measure and to quantify in financial and other reports.
Information and knowledge environments depend on both defensive and offensive activities. They both apply every day whether or not one is interested in information and knowledge for work or for pleasure, for government or for industry, for peace or for war. The power of information and the importance of it make it a prime tool in everyday work, a prime target in competition, and also in warfare.
Life changes with communications
The past is the root to the future, and the difference between past and future is change. The greatest change in our time has not been effected by states, international organisations or armies; it has been driven by the spread of information. Information is a catalyst and appears in all that touches our senses, and this catalyst can influence and change everything. Change is the rule, and flexibility is the tool. The only constant is change itself!
The present pace of change results in a journey without a known destination. The pace of change makes the difference between tradition and revolution. The rate of change, the kind of change, and the implications are all high. When change is dramatic and revolutionary, the past means nothing and the future means everything.
Many technical inventions such as the steam engine, the car, the aeroplane, the printing press, the radio, and the television have had quite an effect on human beings. However, none of those inventions have provided such enormous possibilities to communicate as the global communications infrastructure we experience today. One can expect that today's and tomorrow's communication possibilities will make life different and have a significant effect on human behaviour.
Information technology leads to an expansion and coupling of networks that is hard to control in all respects. More and more super highways for communications contribute to electronic layers on the globe and in space. Many new information and communications services facilitate life. Communication highways are becoming smart and networks self-healing; services include markets, finance, health, comfort, entertainment, and many other areas. Communication channels increase at an astonishing pace in numbers and size all the time, and the communication cost decreases. Connectivity multiplies on a world-wide basis, in the industrialised world it is almost the case that everybody is connected to everybody, resulting in everyone being dependent upon everybody else.
The emergence of Internet and cyberspace is a challenge to everyone. Constantly changing, they represent a great number of both good and bad sides. Some people might find cyberspace more thrilling and attractive to visit than the real world. Being open to everyone, like a kind of cosmopolitan broadcast system, and with no central organisation, makes borders diffuse and easily penetrable.
The architecture of cyberspace implies several severe security problems. One is travelling in cyberspace on the more or less fragile software vehicles without seeing much or anything of the journey itself. In an amusement park, going with a ghost train into a dark tunnel might be great fun. In the cyberspace tunnel you and your most valuable assets might get lost if you are not careful enough.
The Internet reflects most of the human activities and plays an international political role. It is both a tool for statecraft, a threat to authoritarian regimes, and a home for activists. It promotes cross-cultural understanding and trans-national political coalitions. Policy-making, diplomacy, public affairs and civil affairs programs are all influenced. The roles in international conflicts and crises remain unclear. Traditional mass media and mail services are eroded. Intelligence services are challenged by the ever changing open sources of information and even by the anonymity of the information source. It is to be hoped that the good sides of Internet will many times outdistance its use for evil purposes.
Information technology influences the structure of organisations
Technology is a force multiplier. Technical possibilities are rapidly changing over time. However, organisations are not as rapidly changeable, doctrines change even slower and man hardly changes (biologically) over time. The information revolution provides specific new technical capabilities, regardless of doctrines and strategies previously used. The new technical possibilities should be seen as disengaged from the past and seen in the light of the new and different possibilities - not only as a means to improve all that has been done earlier and which could now be done a little better. Information technologies enhance all kinds of competition and increase the speed of most activities, in several areas to extreme levels and towards real time. Development phases are pushed together, leading to simultaneous or concurrent work.
An imperative in the age of information is flatter and smaller organisational units. Small businesses propagate. However, network organisations can be big. There is an analogy with the technical architecture of building communication cell networks. The information revolution favours organisations in network designs. Business, government and military worlds migrate from traditional organisational structures to those based on networking.
Networks permit staff to communicate at all levels of hierarchy without first turning to central authorities. This can be regarded as a characteristic of democracy. It is also a sign of autonomy permitting central headquarters to support work without going into detailed management.
Management, decision and command need to be centralised for strategic purposes and decentralised for tactical purposes. The choice between centralised and decentralised management, decision and command is determined by the need for the highest possible pace. Thus, for actions at a high pace, this points unequivocally towards decentralisation. High pace of action is an imperative of the information age. However, questions may be raised when management, decisions and command are pushed to cyberspace and there is a virtual (but not a real) person behind it. There is also a risk in having local information available at top level, as top managers tend to be unable to let things be, just because they have the information and hence the possibility to interfere (micromanagement).
Doctrines and concepts
In the information era, conditions are changing at a high pace and doctrines ought to be reappraised accordingly. However, large regulatory organisations and systems resist changes and most organisations are well designed to solve yesterday's problems. Therefore it is difficult to receive support for new ideas and proposals for the reappraisal of doctrines. Political, administrative, and military systems are normally built on stability and slow changes and are now challenged by the high pace caused by information technology. Politicians are forced to make decisions about more and more complex matters faster and faster, driven by global mass-media spotlights.
Doctrines and policies governing development and application of information technology and especially software are a decisive part of a nation's knowledge strategy. In the future, doctrines for the civil and military parts of society are thought to have the same main elements to a great extent.
In the new millennium the strategic and political sanctuaries of the past will be gone. With the cold war and the power of nuclear weapons came the concept of common security. Today we will have to add the concept of common vulnerability due to the strong globalisation of the information infrastructure and the interdependence of information in the world. In a similar manner, as when one earlier developed a nuclear umbrella and discussed "star wars", one can presently discuss developing an information umbrella and "star peace" which can form the basis for mutual co-operation among nations and organisations. Unfortunately any information umbrella is likely to mean a demarcation line between those who are able to draw upon it and those who are staring at a fence. This, in turn, means new conflict reasons, if not carefully elaborated.
Information and knowledge strength globally affects security policies, market and finance domination and defence policy groupings, and this gradually makes national borders comparatively less important. The concepts of security and security policy will have to be reconsidered and the concept of democracy may involve new dimensions. The concept of neutrality must be regarded in connection with all the changes. Trade, financial assets, work-force, environment, policies, laws and many other areas must be shared in new ways. Information, knowledge and money travel without passports at the speed of light. The conventional maps of the world have to be rewritten constantly as the borders are diffuse and ever-changing. The global system is becoming increasingly complex and more knowledge is needed to keep track of all the changes.
A humane focus
It has been said here that man hardly changes over time. However, even if this is true fundamentally regarding biology, the increasing possibilities of communications and media will influence the behaviour of man. Information technology and infrastructure will increase the quality of education, the choice of education, and the interaction of students, and will promote the ability to learn more, also faster and more effectively. This will be a necessary part of life in the competitive environment.
It is anticipated that in the near future much will be done about man/machine adaptation. One should not man equipment but equip man, and this includes the software that goes with the equipment. Physical and logical interfaces must be more user-friendly and able to respond to higher speeds of multimedia. Computers will interact directly with the human eye and voice and not just with fingers on a keyboard.
Quality in all dimensions - not quantity - is the key to success in our time. The most important quality is human resources. The world around us has put the torchlight on technology, whereas the focus should be humane in the work of using the power of information. Human activity will always be less predictable than technical conditions. We must have a humane focus and exploit information technologies without becoming their slaves. There are great values in being culturally, socially, economically, politically and militarily competent in one's view of the world.
Information war and anti war
Besides the conventional "hard kill" threat the new emerging threat is "soft kill" and “soft war” characterised by unspecified and unquantified vulnerabilities and large uncertainties for both sides in a conflict. On the whole, threats and conflicts may be said to appear on three arenas or “battlefields”:
- The physical arena (land, sea, underwater, air, space)
- The information arena (electromagnetic space, cyberspace, and all other spaces where information can appear)
- The cognitive space (consciousness, the subconscious, perception, decision, knowledge, and wisdom space)
Information and knowledge are central sources for production and for destruction. The double-sided nature makes it possible to use for good and for bad purposes. Information has a profound influence on national security and defence and nobody will escape confrontation with this fact. Many people argue about the true meaning of "information" and also about "warfare". Many people have a personal idea about the meaning of the words, but it is much harder to arrive at a common understanding in all respects. The question of what war is becomes a difficult one to answer, especially in consideration of the soft kill. It depends if war can be fought by other means than what is traditionally thought of. Putting the two words together doesn't make things more clear or simple. Many arguments are applicable to describe ordinary daily competition. Warfare leads to thoughts of conventional war, which is not always what is meant.
According to one definition, information warfare is an activity to attain advantages as a result of asymmetric information and to use these advantages in strategic, operational, and tactical situations to win in conflicts by civil and militarily co-ordinated information and the use of advanced information technology. Asymmetric information is also used to achieve advantages in information competition. It implies using the right information and making the right decisions earlier than the competitor while at the same time protecting one’s own information.
As said before, information can be for better or for worse. It is just as important to talk about information that serves to create common understanding and peace. Why not talk about information "peace-fare" or information "peace-keeping" as an activity to create and to use situations with symmetric or identical information and knowledge to maintain peace and to prevent the development of conflicts?
Information warfare will evolve, sometimes in the spotlight, more often perhaps hidden from view. It will not always be obvious as to whether you are subjected to friendly actions, to competition, or you are being subjected to the ultimate level: information warfare. One of its aspects is that the aggressor doesn't want you to know that you are being subjected to an attack. The concept of information warfare will remain blurred.
Information warfare is a question of far more than just computer security. Information warfare integrates broad ties between social, cultural, economic, political and military activities to a whole. Such ties can be the basis for the handling of crises. This needs to be done as early as possible in a conflict in order to prevent its growth. The efforts to solve difficult conflicts must more and more be looked for at the political, diplomatic and human levels instead of in the traditional art of war. The art of peace must be developed.
The scope of offensive and defensive information warfare covers all arenas from global, international, national, and organisational to individual levels even including the human mind itself. Warfare occurs throughout a continuum of conflict from co-operation, competition, conflict, crises, war, post-conflict, and to peace. All areas of activities in society are covered such as political, diplomatic, economic, social, criminal, ideological, ethnic, religious, cultural, environmental, ecological, infrastructural, technical, military, and protection. Four main features of information warfare are: the powerful expansion of the field of activity, co-ordination and synchronisation of all important areas, the leverage through information technology, and an increased pace.
Defensive and offensive actions
Targets for defensive and offensive actions in the information and knowledge environment consist of four main groups of elements (both people and technical systems are applicable where suitable):
- Information sources and emitters of information;
- Information traffic, carriers and transmission paths;
- Information processors and systems;
- Information "receivers".
Each group consist of hardware and software and can contain single or multiple elements. A strategy for information competition and warfare must recognise, consider and break down all phases of handling information, such as the acquisition, processing, distribution and protection of information, while selectively denying or distributing it to adversaries or to allies.
There is a large family of defensive measures such as protection of information from being lost, (e.g. deprived by an adversary), protection from being collected and used by non-authorised bodies, protection from being distorted, protection from being delayed, and protection from being influenced by an adversary's information forced upon oneself. A number of protection methods concerning machines and people themselves exist. For computer systems there are methods aiming at guaranteeing authenticity, confidentiality, integrity, availability, and reliability. Among information technology security means are back-ups, fire walls, and encryption. For people there are methods for critical examination of information, methods to gain psychological strength against propaganda, and other methods.
There is also an equally mirrored and large family of offensive measures such as depriving an adversary of information, encroachment and collection (e.g. tapping of cables and networks, breaking passwords, using back doors). There are possibilities of distorting and manipulating information, delaying information to reduce its value, and influencing the adversary with one's own information. To inflict one's will on someone else is one of the key elements in information competition, in information warfare and in information "peace-fare".
Reasons for attacks
Ambitions to forestall armed conflict can lead to increased use of information warfare. Clearly our information and knowledge age has come to a point where adversaries find it attractive to attack the information dependencies in order to achieve their objectives - often by the leverage effect which information technology admits. Attacks can be directed against the hardware and software that is supporting information. This means that the diversity of wars escalates, just as there is an increasing heterogeneity and complexity for civil activities.
There are several numbers of reasons why attacks on the information infrastructure are attractive to adversaries. Many of these reasons for attack can be viewed in conjunction with their specific features. Actions can be undertaken covertly, anonymously, conveniently, at low cost and at a place of origin the attacker chooses. Criminal behaviour is blurred. Today there are prenational, national, postnational, transnational entities, multinational corporations, legal and illegal cartels, and legal and illegal governments all around the world. Even powerful states have difficulties governing their economic systems and are penetrated by immigrants, transnational organisations, electronic networks, flows of money, terrorists, weapons, drugs, culture, religion, pop music, ideology, media, and hackers, just to mention a few. Some argue that we are not ready for crises and chaos in the future just as we were not ready for World War I and II.
Conflicts can stem from reasons that build up antagonism between groups such as poverty, unemployment, drugs, famine, disease, migration, pollution, population growth, and other reasons. Targets include populations and technology itself. Attacks might be anything from more or less harmless intrusion, suppression of competitors, campaigns of slander, political and other types of disorder, blackmail, thefts, to extensive chaos. There will always be a number of insiders who for various reasons could be potential attackers or who could be willing to co-operate with attackers. Terrorist cells are becoming smarter and smaller. They can have low visibility and be locally initiated. Cells may be linked in wide networks, and become more technically sophisticated with time. An organisation that threatens a nation and doesn't have a territory or a definable system (of its own) to threaten constitutes an asymmetrical situation that might be hard to counter.
The national vulnerability for information attacks is growing rapidly among highly industrialised western nations. Attacks will be more attractive with time, due to the fact that the potential effects increase when society becomes more dependent on information and the number of targets possible for attacks increase. Careful selection of points of attack can provide bonus effects to the attacker due to leverage effects often associated with information infrastructure. Deregulation and competition might lead to decreased investments in extra safety and security measures which forces installation of many vital functions together with one another, thus forming larger targets.
Attacking the infrastructure
The distinction between the civilian and military sides of society is diminishing. Many things have dual use and the pace of development in the civil society is ahead of the military in several areas. High tech goods proliferate around the globe and may be found practically anywhere. Such goods can be put together to develop fearsome weapons, and recipes can be found on the Internet. Goods include evil software, microwave and other electromagnetic weapons, hobby shop types of unmanned aerial vehicles that can be converted to simple cruise missiles, and high-power explosives. Material and components to build biological or nuclear bomb devices may be found. This provides new terrorist or military capabilities that can be used by small, poor countries or by evil organisations. A terrorist group or state that doesn't have the technology can hire the technology and the people to do the job. Some people offer their services for this on the Internet.
The primary targets (that attacks could be directed against) are electric power, telecommunications, broadcast facilities, control lines and computer networks, which provide a number of vital functions in society. Domino effects are the consequences of functionally coupled systems. Electric power networks and communication networks are the blood vessels and the nervous systems of society without which catastrophe is near. When the networks break down, everyone goes down with them.
The real victims behind the information infrastructure foreground are people and their businesses, financial assets, goods and even lives. The effects of attacks and terrorism can range from upset to damage throughout varying periods of time, some of which are especially crucial. The impact varies depending on types of functions in the society. Lack of water, lack of control of emergency systems, lack of air, railway or road traffic control, and the lack of navigation aids can create disaster and affect health. Manipulated information broadcasted to the public or lack of information can create chaos. Lack of banking and other business services affect financial assets.
Certain attacks can be regarded as tactics in overall campaigns. Disabling one system will force functions into others. These might be easier to penetrate and tap or to manipulate. This in turn could force actions that expose more vulnerable targets or primary victims to even higher threats. Non-lethal actions might then become lethal. Information warfare attacks can be dynamic and interactive throughout information infrastructures and can lead to strategic levels of destruction.
Minor attacks of various kinds using information - more or less friendly and more or less known or even unknown - are being made everyday. Economic factors such as interest rates, equity and bond prices, and exchange rates are vulnerable to information competition and the kind of targeting that follows.
Computers as weapons and targets for attacks
Tomorrow's terrorists as well as war-fighting nations may be able to do more damage with a keyboard than with a bomb. It has been said that a selected group of some hackers and insiders might within a number of days bring an information high-technology nation to its knees.
An unseen and perhaps unknown enemy could deliver attacks via computer across phone lines. When an attack starts, who would know at the beginning if it were a sixteen-year old kid behind a keyboard somewhere operating domestically or a foreign intelligence service or a terrorist group?
Information technology enables cyber-war forces to stand off and use high-precision software from great distances just as military forces can use high-precision weapons like cruise missiles from great distances. System knowledge is the key to success of such attacks. Insider threats are far greater than the threats from hackers, although these are mostly spoken of. The new kinds of threats motivate wider intelligence and early warning.
It might be impossible to mobilise, deploy and sustain police or military forces during a major conflict in the event of information warfare attacks on information support functions that have low protection levels and are controlled by networked computers. On the contrary, groups of like-minded trouble-makers could be mobilised guided by the Internet and this has occurred several times.
Millions of poorly protected computers are inextricably connected together. When extensive computer "fire walls" do not exist, passwords for software can be registered without the owners knowing it and collected at some server on the Internet.
Functions can be altered in computer control systems for power, telecom, traffic control, media, water and sewage. Emergency telephone service numbers could be disabled, bank records wiped out, broadcast channels used at will to deliver threats, pipelines shut off. Virtually every element in the public network has been compromised at least some time. Sophisticated attacks have and will be performed by skilled people with some knowledge of the system to be attacked and with spectrum, digital and other analysers in order to be able to take over control of the system.
Embedded components and software can have functions of setting vicious forces into action. There are virus programs that when launched in networks can replicate themselves in thousands of computers, and there are programs that can evolve over time and that are influenced by chance, making it hard to find and to kill them. There are cruise viruses and other software that can capture passwords, steal specific information, and destroy a specific hard disk.
It seems that every measure to protect computer systems can be countered. The fact that attacks can have a major impact on a nation has motivated a number of nations to develop defensive measures. Likewise, offensive measures can be developed for new arts of war. However, nobody is willing to discuss such possibilities openly. New kinds of factories producing computer viruses would not be visible.
To attack a network with a cell structure without a core function, all cells must be attacked simultaneously. Examples could be to inject vicious and venomous software that multiplies to all computer functions in a network (and there are various methods for this), to broadcast false messages by media that cover immediate regions, or to incapacitate infrastructure by weapons of mass destruction (such as the effects of high altitude nuclear electromagnetic pulses). Structures that are not truly cell structures contain central functions, such as control centres (with software and hardware) for power and communications. These would be of prime interest for attack.
One must consider that reliability and availability of information services can never reach one hundred percent, and failures that degrade or negate functions appear from time to time. However, in cyberspace it is difficult to know if something that looks like a normal failure is a normal failure or if it is perhaps an intentional attack. One must even anticipate unintentional attacks.
Electromagnetic pulse weapons produce electromagnetic radiation or induce currents and voltages directly in cables and other conductors. Special high power microwave (HPM) weapons represent an increasing danger. Because of their short wavelengths they can steal past even the smallest slots and openings. Several of these weapons can be built into suitcases or other compartments that are small and normally would not draw attention. Other types could fit into normal vans.
The military is concerned about electromagnetic weapons. Most of these weapons may be regarded as non-lethal. Such types are thought to fill gaps between diplomacy and conventional war on the scale of conflict and may be discriminating. They should be seen as optional in weapon arsenals and not as substitutes to other weapons. Depending on the situation they could lead to lethal phases of a conflict and could encourage an adversary to strike harder. The effects of electromagnetic attack can spread far at a great pace, depending on information infrastructure, and can hit targets far away.
There are an increasing number of cases at which electromagnetic attacks have been performed outside the military. Most or all electromagnetic components necessary to build electromagnetic weapons can easily be found on the open market. Devices to damage, upset or tap information electronically can be of low cost. The present development of information technology leads to much smaller devices, including sensors, transmitters and analysers of various kinds.
Though some types of electromagnetic attacks might be unsophisticated, they can have a great impact and result in low reliability of services creating mistrust among customers. This may be just as harmful as some sophisticated and well directed attacks. The number of possible targets for electromagnetic attacks is increasing. Some of the targets contain components that are very vulnerable to external electromagnetic effects.
Depending on circumstances, attackers might be able to do their job outside physical boundaries of offices and other facilities. Only electromagnetic fields and not attackers themselves need to penetrate fences and walls. Terrorists might create chaos and catastrophes at airports by electromagnetic means without entering the premises and embarking flights. They might conveniently, covertly and safely direct their electromagnetic weapons against a computer centre upsetting those functions, depending on the computer system. Electronic locks can be electromagnetically manipulated or deciphered. Actions can stress or shut down alarm systems so that the alert capability is disengaged or decreased and access to desired locations can be achieved. One example involves actions taken in order to disable mobile telephones of guardsmen and policemen. Modern cars can be vulnerable. They are equipped with a number of microprocessors for various functions and have extensive cable installations. Microwave guns could be directed towards traffic on highways and create malfunctions of cars and thus jam traffic and cause accidents. Most of these things could be performed without ever being seen or heard.
There are devices that can radiate or conduct electromagnetic noise or pulses in more or less profound and powerful ways, thereby jamming or distorting information. The satellite global positioning system (GPS) can be jammed or its codes locally exchanged for false codes. Sophisticated systems exist that, for example, can take over radio and television networks, which could then be used for psychological actions.
Devilish software in the form of viruses, logic bombs or Trojan horses can be electromagnetically injected into computer networks that depend on transmission and reception of electromagnetic waves. There can be backdoors in software aimed at attacking built-in safety and security mechanisms. Microchips can have weaknesses that have been programmed beforehand or have hidden added functions. Many of these might be triggered by electromagnetic waves. Explosives can be installed in very small compartments or attached covertly to targets and released electromagnetically at great distances. Special codes can be transmitted by telephone, computer or broadcast networks.
Emission of electromagnetic waves from electronic systems can be picked up and analysed at a distance. The emission is often unintentional. Computer screens emit waves, and the pictures can be reproduced outside the original premises. Metallic and fibre optic cables can be tapped into. Conversation and other sounds can in many cases be listened to at a distance from houses, even if they have closed doors and windows. The sounds can be picked up with the aid of laser or other types of microphones. Activities can be monitored and studied by sophisticated means at great distances.
Civil and military defence
The threat changes its appearance, and for the infrastructure of most nations the very strong dependence on information is set in focus. This changes defence tasks. Formerly a nation was primarily defended by the military and war was about targeting precise points where facilities and platforms were located. In the future there will still be territories and concentrated hardware to protect and to defend. In addition, however, there will be knowledge assets, in many cases of far more importance than hardware. The exact location of such knowledge assets are not always known. A specific knowledge in question might be located at a number of different places simultaneously, it can also travel at the speed of light, much faster than any bullet can ever do, and it can be located in a number of nations simultaneously. How can such assets be targeted or defended?
The civil and military societies are interwoven. The civil society is constantly building and restructuring its information infrastructure and the way it procures, processes, distributes and protects its knowledge assets. Civilian techniques and civilian services are more and more taking over the leading of the development from the defence sector. This has a direct influence on how well military defence can carry out its tasks.
Much of the infrastructure including trade, industry, economy, ecology, politics, religion, and many other areas are more or less globally interwoven and share both strength and vulnerability. Commercial and defence vulnerabilities are not easily distinguishable. National security and military security are blurred.
In future conflicts, primarily functions and not facilities will be threatened. In addition to physical destruction other types of destruction will appear. Specific knowledge at the right moment can do more good or harm than a whole army. A bigger conventional force will not be useful when fighting an information war. The traditional way of military thinking with its implications, such as the division of military regions, will be less justified in the information age when borders are set by functions. The decisive map must show how and where information flows, not where military units are moving. For these and other reasons defence as well as offence are facing a new set of challenges. Policy processes in information warfare are lacking and there are still more questions than answers.
Some protection guidelines
Critical functions must be able to work during attacks, at least at some minimum level. Alternative systems and routines must be considered. Control functions must work independently of normal operation of infrastructure. Information systems are interactive and depend on one another in such a way that deficiencies at some point in a network can spread at the speed of light regionally, nation-wide or even globally. For this reason it will be of great importance to design the systems that control and support information infrastructure for reliability and availability. The strengthening of the infrastructure will be more of a global than an individual task, due to the evolution of the systems.
Quality of protection and insertion of alternative systems, such as backup systems for software and power, must be routinely checked. Detection and monitoring of incidents, release of warnings, repair and restoration must be well managed. Efforts must be made to track origins of attacks so that further incidents can be stopped. There are tough legal implications today on in what way tracking may be done, especially between countries. It is vital that personnel will be trained for emergency situations. Most infrastructure systems work very well for long periods of time without any greater incidents. This is unfortunate insofar as it makes people less aware of what to do in the event of failure.
How well a network can resist damage depends on its structure. If it only consists of series-coupled sections, it only takes one of those to destroy the whole function. One way of increasing resistance to damage is to arrange parallel functions or abilities for redundancy and diverse routing. This has long been a tested method. For instance, telecommunications networks can be designed with a number of different types of parallel transmission systems. Another example is to design central logical functions in such a way that it is possible to distribute them physically among different network resources.
Damage-resistant structures can consist of non-hierarchical networks with cells where each one has the essential functions of a command system. The cells can be coupled together between each other and, what is more, be given an overall control that can be moved from one cell to another, independent of the situation. Cells of an organisational nature can form networks and be bound horizontally as well as vertically. Such a structure gives resistance to damage, flexibility and speed in consideration of the prevailing situation. If some cells are chopped, the other cells are not affected but can continue to operate. The only way to hit such a structure completely is to target all cells simultaneously.
Electromagnetic attacks and terrorism should be regarded as part of a number of possible actions in information warfare. For this reason, an overall scheme is recommended to handle defensive actions. In such a scheme several methods will provide protection against more than one type of weapon or attack. Possibilities of looking for synergistic protection and mitigation effects should be taken into consideration.
Electromagnetic waves can be dampened by electromagnetic shielding and filtering enclosures and metallic cables. This can be good both for emission and susceptibility. Overvoltages can be handled by overvoltage protectors. Fibre optic cables can be installed in such a way that inspection is possible where tapping could occur.
Who is responsible for protection of the information infrastructure?
Government and industry share mutual vulnerability of the infrastructure. A broad understanding of government and industry co-operation is needed to consider security and safety in order to develop an infrastructure for countering emerging electronic and other threats, and building new kinds of defence. Strength will be gained through co-operation and networking, not through single operation and stove-piped working. Never before has there been such a need for strong collaboration among:
- Government (the foundation for law and social order);
- Enterprise (the foundation for employment, national economy and welfare);
- Academia (the foundation for education and knowledge).
For responsible people a key element to start with is awareness. One must be concerned about possible threats and how to encounter them. Managers responsible for the proper operation of vital functions should learn about the risks of attacks and make their assessments of potential risks in specific cases while considering possible outcomes and consequences of various types of attacks. Preparation for demanding circumstances is required because prediction of chaos and crises is not possible. Managers should also learn about defensive measures.
There are ways of protecting to a certain level against at least some of these attacks. It will become more and more important to do so, and it will be thought of as a kind of insurance against a set of anticipated risks and avoidable costs. Without adequate protection, vulnerability will increase. It is important to stress that only if risks can be measured in monetary terms, top business management will act with protective measures, as the incentive is otherwise lacking.
Instead of avoiding risks one must be able to master them. Development goes from risk avoidance to risk management. This involves the creation of contingency plans for catastrophe and simpler but useful routines and structures for operation, as well as protection of selected portions of a system. A number of rules should be set up. Management must also understand about the vital need for allocation of resources for mitigation in the event of attacks.
A summary of some golden rules for national and international IT security
The following paragraphs are abstracts reprinted with permission from SOU 2001:41 by The Swedish Commission on Vulnerability and Security (ISBN 91-38-21510-1).
An IT security strategy focusing on information security and the security of the national information infrastructure must aim to utilize existing and future resources in a coordinated fashion in order to ensure public confidence in information management. The objective of the IT security strategy is to facilitate the building of a secure information society for all.
The IT security strategy will lay the foundation for information security and for security as a whole. The strategy is one strand of the national strategy for protection against information operations. It is just as important to protect society against information operations in peacetime as it is to build up a military defence. Basic IT security must therefore be designed in such way as to facilitate the societal adjustments that will be necessary to ensure a rapid response to a serious information attack.
IT security is of great importance in all policy areas. Security can never be completely watertight, but the risks taken should be calculated and the remaining flaws should be known and acceptable.
All public authorities and public and private organizations and enterprises are responsible for maintaining an adequate level of security in their information processing operations. This means that they must be capable of identifying and evaluating the consequences of their IT dependence and dealing with the risks involved.
Assuring IT security is necessarily a cross-sectoral activity. It is essential to establish a holistic approach and a balance between the different sectors by coordination, cooperation and consultation across sectoral boundaries on the basis of confidence, competence and the best use of resources.
Vital functions in all sectors of society should as far as possible be protected from disruption and operate smoothly both during major societal crises and in war. Breakdowns or manipulations affecting these functions must be limited, infrequent, manageable and isolated and make as small an impact on society as possible.
There must be sufficient risk management capability. Alternative options are crucial when it comes to reducing vulnerability. Important systems and networks must be identified and evaluated in order to make it possible to deal with the problems associated with the vulnerability of the infrastructure. Continuous vulnerability analyses and comprehensive assessments should provide a basis for a prioritised list of proposals for measures, as well as implementation and monitoring and evaluation.
Public authorities must operate in a secure environment, internally, in the context of inter-authority collaboration, in their dealings with citizens and in international cooperation. They must offer high-quality service, be accessible by electronic means and be able to circulate and collect information through public communication channels. Their services must meet high standards of reliability, availability and security. Secure communications should be available within the country and with other countries. Electronic commerce must be carried on in a secure environment. In an information society for all the infrastructure on which information depends must be secure and accessible. Precautionary measures, especially when computer intrusion is detected, and reactive measures must be taken. These precautionary measures should detect any attempted intrusions and do so sufficiently promptly to allow enough time to prevent or limit the intrusion.
Confidence in new information technology goes hand in hand with confidence in the security of the technical systems, including confidence in the systems' ability to guarantee the confidentiality, integrity and accuracy of the information they contain. This is important in the context of public administration, especially from the point of view of the privacy and security of citizens.
A holistic approach must be adopted with regard to information security, which is necessarily a cross-sectoral activity. In the information age there has been a transition from sectors to networking, and this calls for a holistic view of society. Work on security becomes borderless when the boundaries between systems are blurred. The protection of a network is determined by the size of its largest mesh, and the network society must therefore have a common minimum level of security.
The private and public sectors must work together to improve this level of security so as to be able to resist the effects of coordinated attacks on several vital social sectors at the same time. Information assurance must be implemented on a cross-sectoral basis, since attacks are liable to be systematic and coordinated. Each component of the network must also be strong enough to prevent escalation.
Security-consciousness must characterize all development and change in the IT sector Security-consciousness is of crucial importance in the information society. Attention must be paid to security issues from the start in all development work in this sector. Adding security functions afterwards is problematic and expensive. Security standards are based on four pillars: people, rules, technology and organization A holistic approach takes into account the need of adequate security with respect to people, rules, technology and organization and of harmonized and balanced security levels. However high the level of technical security is, it cannot compensate for flaws in the other three security areas. Security-consciousness and competence are of crucial importance, and the same applies to rules and organization.
The imperative of knowledge
The partitioning and fragmentation of the world into groups living at a different pace, different production methods, different ideas of life, and different knowledge levels must be governed with the utmost care in the future in order to encourage peace and not to stimulate conflicts. Knowledge of the complex facts to do so is of prime importance.
A high degree of knowledge power reduces peril; low power increases it. A society with higher knowledge power than anyone else will never be in peril and makes it possible to use the power either for anti-war or for war. Knowledge strategy has to deal with acquisition, processing, distribution, and protection of information. The handling of all four functions has to be restructured and reconceptualized in order to serve the new millennium knowledge system of society. There has to be rethinking about how to deal with the immense flow of open-sources information. To be competent about current situations around the world, military intelligence also has to work in the direction of business intelligence, and business intelligence can profit from military sources.
To get an overview, information has to be evaluated, put together re-evaluated and not be partitioned. Those days are gone when the military were mostly concerned about calculating military forces and power. Today, the knowledge terrain also consists of information about economy, diplomacy, environment, religious views, culture, and levels of education, media, and other elements. This is a prerequisite for understanding about how to prevent conflicts and to stop development in desperate directions due to problems like famine, disaster, terrorism, and pollution.
Throughout the cold war, ideas were discussed to launch surveillance satellites to be shared among nations and to serve the purpose of collecting information to prevent the outbreak of a nuclear war. During the Gulf conflict, the coalition forces shared much of the same information. What is the future of anti-war coalitions?
Just as there are powerful resources to build armies to fight wars, there ought to be resources allocated to create anti-war. This implies methods to stop conflicts before they become wars. Until otherwise proven, there might be a number of new methods not yet thought about. They could evolve as a consequence of the new age of global information technology.
Technology will allow us to experience a volume of interest in real time, day and night with good resolution; a kind of ‘CNN-effect’. Information technology contributes in identifying changes and recognising patterns in actions, and through this can offer greater opportunities of interaction and operations at early stages. Reliable and speedy intelligence is fundamental in the information age.
Much has been said about the importance for a single nation's armed forces to have interoperability and such a common picture that a situation is viewed in a uniform manner in order to co-ordinate resources and to achieve coherence through understanding. Now it is time to expand this idea of a common picture and to project these views on the formation of a new kind of peace force and a new kind of preventive diplomacy by international co-operation. It must be carefully designed in order to be a democratic tool and in order to promote the stabilisation of democracy around the world. A global knowledge infrastructure would be the core.
The United Nations is established by nation states. In the new millennium non-national organisations are predicted to play increasing roles on the global arena. Hopefully this will influence and might strengthen, restructure and speed up future work to prevent conflicts. What future leverage effects could information technology have on The United Nations ability to be successful?
A system that globally gives visualisation, an overview, and a relevant common picture of current fields of confrontation and turmoil, abilities to exchange data and to promote a free flow of information around the network will enable nations to relate their pictures together and to get a common picture. This is the foundation for common understanding that could reduce tensions. Information technology in the next millennium will provide increasingly better opportunities to realise this. We could be on the threshold of a global revolution towards a safer world.
In the hands of democratic movements, media can prove to be of great importance. Instant broadcasts from scenes around the world have shown much power of influencing the outcome of events. Where undistorted information is disseminated without limits it will be difficult for official lies, hate propaganda, and single models of reality to remain for a longer time. But be aware that it is not only undistorted information that is of importance, it is also to know that there may be undistorted information available that is not told and hence hidden.
Future information technology applied on a global basis could provide the United Nations or some associated organisation with an overview and an effective instrument to monitor the situation around the world. This would be one of several inputs for the prevention of conflicts from evolving. Possibilities of strengthening abilities to form a different kind of "world peace force" primarily working with information technology tools and not with weapons should carefully be regarded. A new generation of co-operating diplomats will be performing information operations with information technology instruments, just like orchestra musicians playing a tribute to a better world.
"I hear a symphony…"
In a plan for strategic information operations, phases in chains of events can be laid for all important areas of society. The plan can consist of information operations for every single area and phase. In this connection it is essential that the applications for every individual area of society are co-ordinated for a given phase of event. Another way of describing it is to compare every single chain of events to a concert, all chains of events to a series of concerts, and the upholders of the different functional areas of society to the orchestra musicians. All the musicians must be able to play in the orchestra without dissonance and to keep time. For this it is of course a demand that the musicians have well-tuned instruments and that they have practised before they arrive for the concert. With the situation being as it is today the musicians very often sit alone. When they meet it happens that they fight over who is to play what. At present the orchestra is still waiting for its conductor and the annotation is not yet written down. Who is orchestrating this and when will the first performance be? Will we then have tuned the instruments and come to play well together before the audience is let in?
Let this be an appeal to the symphony orchestra. We are eagerly awaiting the concerts. We hope that the music will create harmony in the soul of man so that we can go towards a safer and more peaceful world in the future. The new millennium global knowledge infrastructure must be organised more around information than around weapon systems. Bullets and powder as carriers of destruction must be replaced by electrons and photons as carriers of messages. The striving must go from information to communication and towards such communication that creates mutual understanding and provides the foundation to avoid conflict and to build a peaceful society in the world. Global communications can bring us the music and create a better world.
I wish to thank Mr. Sten Sörenson, AerotechTelub, for his valuable comments and review of this version of “Global Information Infrastructure: Threats”.
The Swedish Commission on Vulnerability and Security: Vulnerability and Security in a New Era – A Summary. SOU 2001:41, Fritzes, ISBN 91-38-21510-1.
Manuel W. Wik
Manuel W. Wik is Senior Chief Engineer and Strategic Specialist on future Defence Science and Technology programs at the Swedish Defence Materiel Administration (FMV). He has assisted the Government Commission on Vulnerability and Security as a resource person related to IT security and protection against Information Operations. After retiring in 2001 Wik is active at FMV concerning Information Operations, Network-Based Defence, and standardisation of Immunity to High-Power Electromagnetic Transient Phenomena.
Manuel W. Wik is Fellow of the Swedish Royal Academy of War Sciences and Secretary of its Technical Military Sciences Department, Member of the Swedish National Committee of the International Union of Radio Science (URSI), Secretary of the International Electrotechnical Committee (IEC) standardisation Sub-Committee SC 77C, Chairman of URSI Committee on Nuclear Electromagnetic Pulse, Senior Member of IEEE EMC Society, and has been recognised as an EMP Fellow by the US Summa Foundation. He received the M. Sc. E. E. Degree from The Royal Institute of Technology in Stockholm in 1962. He was an active researcher at the Swedish National Defence Research Establishment in the areas of nuclear weapons effects. He later became Head of the Defence Materiel Administration Telecommunications Transmission Network procurement.
Manuel W. Wik has written numerous articles, contributed to books and given presentations in the fields of Nuclear Electromagnetic Pulse effects, Electromagnetic Compatibility, Intentional Electromagnetic Interference, Command, Control and Communications, Electronic Warfare, Information Warfare and Information Operations. He was born in 1936, is married and has one son.
Mr. M. W. Wik can be reached at:
Defence Materiel Administration (FMV), SE-115 88 Stockholm
Tel: + 46 8 782 67 32, +46 70 594 3801
Fax: + 46 8 782 62 32
This is an updated version of a previous article published in “Global Communications Interactive ’97” (page 280 – 287) by Hanson Cooke Limited (division of Highbury House Communications plc), ISBN 0946 393 893. Hanson Cooke Ltd (www.globalcomms.co.uk) holds the copyright of the previous article. The opinions expressed in the paper are the author's personal views and do not necessarily reflect official views. However, the Swedish State Secretary for Foreign Affairs found the article stimulating for further thinking, noticeably concerning possibilities to create effective pre-warning systems.