Could online attacks spark a war?
There were unnerving scenes here in Washington DC in May.
Long lines of cars formed at the few petrol stations that still had fuel. Others had posted signs outside their premises advising motorists that their pumps were empty.
There was a sense of panic, reminiscent of the early days of the pandemic when supermarket shelves were left bare by shoppers bulk-buying essentials.
At the height of the crisis, 80% of Washington’s petrol stations were without fuel and there were similar problems in Virginia, North Carolina, South Carolina and Georgia.
A cyber attack on the Colonial gas pipeline had forced the company to shut down its operations triggering widespread fuel shortages and panic buying in the southeast of the United States.
Colonial had been hit by a ransomware attack and paid the $4.4 million ransom demanded by the hackers. Some of the money was later recovered by US investigators.
The disruption to fuel supplies was a stark example of an attack in the virtual world having real world consequences.
On Wednesday, US President Joe Biden signed an order entitled: “Improving Cybersecurity for Critical Infrastructure Control Systems.”
It directed federal agencies to develop cybersecurity performance goals for critical infrastructure.
“We expect those standards will assist companies responsible for providing essential services like power, water, and transportation to strengthen their cybersecurity,” according to a statement from the White House.
“Recent high-profile attacks on critical infrastructure around the world, including the ransomware attacks on the Colonial Pipeline and JBS Foods in the United States, demonstrate that significant cyber vulnerabilities exist across US critical infrastructure, which is largely owned and operated by the private sector.”
The US Department of Homeland Security has issued security directives for critical pipeline owners and operators requiring companies to report cybersecurity incidents and to implement specific measures to protect against ransomware attacks.
The day before signing his directive to beef up cybersecurity, President Biden warned that if the United States ended up in a “real shooting war” with a “major power” it could be the result of a significant cyber attack on the country.
Some experts view the current situation as the new Cold War only this time, on top of nuclear weapons, the threat of hacking and cyber terrorism also looms.
“I think it’s more than likely we’re going to end up, if we end up in a war – a real shooting war with a major power – it’s going to be as a consequence of a cyber breach of great consequence and it’s increasing exponentially, the capabilities,” Mr Biden said during a visit to the Office of the Director of National Intelligence (ODNI).
He made reference to Russia and China as growing threats to American national security after recent cyber attacks were linked to agents in both countries.
Earlier this month, the US accused China of carrying out a massive hack on Microsoft and charged four Chinese nationals in connection with the cyber attack.
US Secretary of State Antony Blinken said it was part of a “pattern of irresponsible, disruptive and destabilising behaviour in cyberspace, which poses a major threat to our economic and national security.”
He accused China of fostering an ecosystem of criminal contract hackers who carry out both state-sponsored activities and cyber crime for their own financial gain.
“The Chinese government, not unlike the Russian government, is not doing this themselves, but are protecting those who are doing it, and maybe even accommodating them being able to do it,” Joe Biden told reporters at the time.
The US condemnation of China came as part of a joint statement with allies including the European Union, Britain, Australia, Canada, New Zealand, Japan and NATO.
Beijing denied the accusations and responded by highlighting America’s history of hacking.
“It is well known that the US has engaged in unscrupulous, massive and indiscriminate eavesdropping on many countries including its allies,” the Chinese embassy in Australia said in a statement.
“It is the world champion of malicious cyber attacks,” the embassy added.
At the end of last year, Russia was linked to a major hack targeting software made by US firm SolarWinds.
Several US government agencies and companies were breached.
Moscow has denied any involvement in the attack but it has further raised tensions with the US.
So could cyber attacks between world powers spark, as Joe Biden put it, “a real shooting war”?
It is a scary prospect. Some experts view the current situation as the new Cold War only this time, on top of nuclear weapons, the threat of hacking and cyber terrorism also looms.
There have been calls for an international cyber agreement that would set the ground rules for what is and isn’t allowed. A treaty that would state which areas are off limits when it comes to cyber attacks and hacking, such as critical infrastructure like electricity grids and fuel pipelines.
It has been suggested that such an agreement could be loosely modelled on the Cold War arms treaties that were signed between the US and the Soviet Union, but some analysts argue that when it comes to the cyber world, any peace deal would be far more difficult to enforce.
April Falcon Doss is a former National Security Agency official who now heads a technology programme at Georgetown University Law School.
“If the question is whether or not a signatory to a nuclear arms control treaty is building up their nuclear stockpile, there will almost certainly be some evidence, factory production, storage of nuclear weapons. There will be satellite imagery or there will be on the ground reports,” she told National Public Radio (NPR).
It is, however, a very different story when it comes to cyber weapons.
“Detecting their development is much harder because you don’t have big stockpiles of missiles sitting around and there’s nothing that’s visible in that sense,” Ms Doss said.
We can only hope that this modern-day Cold War remains in the virtual world. If it does escalate, lines at service stations and empty petrol pumps will be the least of our worries.