Keywords

1 Overview

The aim of Working Group 9.10: ICT Uses in Peace and War is to provide a focused effort from multiple stakeholders to seek solutions to questions and areas of investigation in the primary field of study of the group. The group provides a platform to facilitate discussion, collaborative research, and development and presentation or publication of the research, lessons learnt, use cases, risk/impact assessments, and case studies [1].

The scope of the working group includes the effect, threats, and influences posed by ICTs at international, national, societal and individual levels, with particular relevance to activities of maintaining peace and during times of conflict. The scope also extends to how the various hierarchical levels of society perceive these threats, impacts and influences. Emerging from this, the following themes are considered core (although not exhaustive) to the working group, and are listed in alphabetical order:

  • Artificial intelligence and machine learning in conflict and cyber security

  • Autonomous weapons systems

  • Cyber warfare

  • Cyber security awareness

  • Forensic applications and solutions

  • Governance and standards

  • Hacking, cracking, and other technical challenges

  • ICT, critical infrastructure, and society

  • ICT impacts on international relations and international security

  • ICT strategies from a holistic, peaceful, and humane perspective

  • ICT uses to prevent conflicts and contribute to peace

  • ICT uses from a military perspective

  • Legal, ethical, and social issues related to information security

  • Promotion of democratic practices through ICT use

  • Research and education on the impact of ICT in peace and war

  • Social aspects of critical infrastructure protection

  • Social networking

  • Socio-technical aspects of ICT uses in peace and war

  • Strategic information security

  • Threat assessments

  • Vulnerability assessments

The activities of the working group have included specialist tracks and round-table discussions at international conferences and collaborative research amongst its members.

2 History

Working Group 9.10 is the youngest of the working groups under Technical Committee 9 (TC 9), and was formally established in 2014 by Louise Leenen, with Leigh Armistead as vice-chair and Brett van Niekerk as secretary. At the beginning of 2020, Joey Jansen van Vuuren stepped in as vice-chair, Leigh Armistead moved to secretary, and Brett van Niekerk moved to chair the group. The working group has membership hailing from 18 countries.

The primary activities of the working group are specialist tracks at international conferences, such as the International Conference on Cyber Warfare and Security (ICCWS), the European Conference on Cyber Warfare and Security (ECCWS), and the IFIP TC 9 Human Choice in Computing (HCC). In 2015 and 2019, the working group chair was also co-chair of ICCWS. In 2020, the chair and vice-chair were co-editors for a special issue of the Journal of Information Warfare related to themes of the working group. There have also been numerous papers in journals and conferences that were collaboration amongst two or more members of the working group.

Other notable achievements from member of the working group include four making the Top 50 Women in Cybersecurity in Africa list in 2020 [2], and the chair and two members collaborating and winning the Global Cyberpeace Challenge policy and strategy track in 2021 [3].

3 Themes

Communications have played an important role in adverting crises and during conflict. The Allied effort to break the German and Japanese encryption during World War II and the implementation of a ‘hotline’ between Washington, D.C. and Moscow following the Cuban missile crisis illustrate this importance. The key theme in terms of current trends that is related to the working group relates to cybersecurity, and the increasing prevalence of cybersecurity in international security.

3.1 Cybersecurity and Cyber Operations in International Security

A Brief History of Major Cyber-Attacks.

With the growing prevalence of computers and the Internet, it was not long before espionage and computer attacks were being seen. This section provides a summary, while not exhaustive, that illustrates the major trends of cyber-attacks in an international security context.

Initially, there was primarily espionage related activity, such as MOONLIGHT MAZE (1998) and TITAN RAIN (2003) [4, 5]. The first major disruptive attacks were denial-of-service attacks against Estonia (2007) and Georgia (2008) [6, 7]. The attacks against Georgia were of particular interest as they came prior to a physical military operation [7].

Whilst there was concern about the possibility of a cyber-attack against critical infrastructure which was driving research into cybersecurity, there was little to confirm these fears until the Stuxnet attack was uncovered in 2010, where the malware was used to target and damage centrifuges in Iran’s nuclear enrichment facility. This particular attack is often cited as an example of the possibilities of cyber-warfare due to its relative sophistication and its ability to create physical damage by affecting industrial control systems [8, 9]. In December 2015, another cyber-attack attributed to state-baked actors (known and Sandworm) resulted in physical affects: in December 2015 the Ukrainian power grid experienced outages due to the BlackEnergy malware [10, 11].

Where Stuxnet and BlackEnergy targeted ‘traditional’ industrial controls systems, hyper-connectivity of devices, known as the Internet of Things (IoT) also began to pose security risks due to numerous insecure devices accessible over the Internet. The most notable incident was the Mirai botnet, which controlled compromised CCTV devices for the purposes of DDoS attacks. Two major attacks were attributed to Mirai botnets: in October 2016 the infrastructure and service provider Dyn was targeted, resulting in widespread outages of major social media and webpages in the U.S. [12]; and then against one of Liberia’s major telecommunications organizations, effectively blocking the nation’s Internet access [13].

In 2016, a group calling themselves the Shadow Brokers emerged, trying to auction cyber-attack tools, claimed to be stolen from a nation state. After the auction failed, the group leaked various tools online [14]. One of these, EternalBlue, was used in the two 2017 ransomware worm incidents: WannaCry and NotPetya, both of which were attributed to nation-states [15, 16]. These two incidents were of particular importance as they were the first ransomware variants with worm capability; they were also notable due to the disruption they wreaked on hospitals and major international organizations. During 2020, amidst the COVID-19 pandemic, ransomware again became consistent problem as they affected hospitals that were already burdened by the growing infections [17, 18]. Whilst these attacks were not attributed to state or state-backed actors, it illustrated how disruptive non-state actors could be when interfering with already constrained social systems. In addition to these attacks, there were reports of state of state-backed espionage targeting medical research, particularly those related to vaccine development [19].

In December 2020, reports began emerging of numerous organizations that had been affected by a cyber-attack; it was eventually discovered that a vendor providing network management solutions, SolarWinds, had been compromised, and the software updates deployed malware allowing the attackers to gain access to their targets [20]. This attack is the best illustration of a supply-chain attack at the time of writing and is notable in the number of major technology and government departments that were compromised by the attack. A few months later, another major attack was discovered, exploiting a vulnerability in Microsoft Exchange servers. While organizations hurried to patch their systems, numerous hacking groups, including those associated with nation-states, were leveraging off the vulnerability to conduct espionage and data exfiltration [21].

In January 2022, Russian forces entered Ukraine in what was termed a ‘special military operation’. There was an expectation of significant cyber-operations; however, initially there appeared to have been limited activity in the cyber domain. Details began emerging of the various cyber incidents related to the conflict, and a tracker by the CyberPeace Institute has recorded 918 cyber incidents as of 13 January 2023 – a year into the conflict [102].

Where this section gave an overview of cyber-attacks related to international security, there is also a diplomatic perspective. The next section discusses the international relations aspects to cyber-security.

Developments in Cyber Diplomacy and International Law.

With the growing prevalence of activity on the Internet that has negatively impacts security, be it nation-state, criminal, or other actors, there have been attempts for the diplomatic and international law communities to respond to the growing threats. This section provides an overview of the efforts and studies that focus on these perspectives.

The first major attempt for international coherence was the Council of Europe’s Convention on Cybercrime, more commonly known as the Budapest Convention. The focus was to provide a degree of consistency to the response to cybercrime, and also provide mechanisms for mutual assistance and collaboration amongst nations in their investigations into online criminal activity [22]. The African Union also established a Convention on Cybercrime and Personal Data Protection, known as the Malabo Convention [23].

While the Budapest and Malabo conventions focused on collaboration to mitigate cybercrime, gaps remained in how international law applies to cyber-operations, in particular those relating to conflict and human rights. Two in-depth academic studies, known as the Tallinn manuals, discuss a number of considerations in applying existing international law to cyber-warfare and cyber operations [24, 25].

At the United Nations, a series of Group of Government Experts (GGEs) were convened to consider “Developments in the Field of Information and Telecommunications in the Context of International Security” and then “Advancing responsible State behavior in cyberspace in the context of international security” [26]. There have been six completed GGEs from 2003 to 2021 [26]. The 2013 report confirmed the applicability of international law to cyber space, and the 2015 report proposed a series of norms of responsible state behavior in cyberspace [27, 28]. In addition to this, an Open Ended Working Group was convened, which was notable for its inclusivity through a multi-stakeholder approach, as well as achieving a consensus report in February 2021, with a second in progress from 2021–2025. There is also a proposed Program of Action that is considered an upcoming process at the time of writing [26].

Other processes and initiatives provide similar discussion, and often feed into the UN processes. For example, the Global Commission on the Stability of Cyberspace (GCSC) proposed a series of norms and definitions [29] as discussion and input to the UN OEWG process. The Paris Call for trust and security in cyberspace is a multi-stakeholder initiative by the French government that has gained support from over 1000 entities, and advocates nine principles [30], which are similar in concept to the norms proposed by the GGE and GCSC. There are a number of other NGOs and initiatives that focus on related issues, such as The Geneva Dialogue on Responsible Behavior in Cyberspace [31], The Cybersecurity Tech Accord [32], Global Partners Digital [33], and the Global Forum on Cyber Expertise [34]. While this list is not exhaustive, it illustrates the recognition of the global importance of these issues. In addition to the norms and principles for good/responsible practice, these processes and initiatives also focused on confidence building measures and capacity building.

The norms and processes described in the preceding paragraphs are voluntary (i.e., non-binding), and a number of discussion around cybersecurity and international law are still open to interpretation. For instance, determining a use of force, act of war, or proportional responses in cyberspace is still uncertain. In practice, there has often been public attribution (usually denied by the alleged perpetrators) [15, 19] and sanctions against individuals implicated [35, 36]. An example of a retaliatory cyber-attack is a report that Israel targeted a major Iranian port in response to an alleged Iranian cyber-attack against an Israeli water system [37].

Key Works Related to Cybersecurity at National and International Levels.

A number of selected works related to cybersecurity are presented below in alphabetical order of the title.

Books:

  • @War by Shane Harris [38]

  • Countdown to Zero Day by Kim Zetter [9]

  • The Cybersecurity Dilemma by Ben Buchanan [39]

  • Cyberwar and Information Warfare, edited by Daniel Ventre [40]

  • Cyber Conflict: Competing National Perspectives, edited by Daniel Ventre [41]

  • Cyber Espionage and International Law by Russel Buchan [42]

  • Cyber Mercenaries by Tim Maurer [43]

  • Cyber Operations and International Law by François Delerue [44]

  • Cyber Persistence Theory by Michael Fischerkeller, Emily Goldman, Richard Harknett [106]

  • Cyber Strategy by Valeriano, Jensen and Maness [45]

  • Cyber War versus Cyber Realities by Brandon Valeriano and Ryan C. Maness [46]

  • Cyber War: The Next Threat to National Security and What to Do About It by Richard A. Clarke and Robert K. Knake [47]

  • Dark Territory by Fred Kaplan [48]

  • Global Information Warfare by Andrew Jones and Gerald L. Kovacich [49]

  • The Hacked World Order by Adam Segal [50]

  • The Hacker and the State by Ben Buchanan [51]

  • Information Operations Matters by Leigh Armistead [52]

  • Information Operations: Warfare and the Hard Realities of Soft Power, edited by Leigh Armistead [53]

  • Information Warfare, 2nd ed., by Daniel Ventre [54]

  • Information Warfare: Separating Hype from Reality, edited by Leigh Armistead [55]

  • Information Warfare in the Age of Cyber Operations by Christopher Whyte, Trevor Thrall, and Brian Mazanec [109]

  • Inside Cyber Warfare by Jeffrey Carr [56]

  • Modelling Nation-state Information Warfare and Cyber-operations, edited by Brett van Niekerk, Trishana Ramluckan, and Neal Kushwaha [103]

  • No Shortcuts: Why States Struggle to Develop a Military Cyber-Force by Max Smeets [104]

  • Offensive Cyber Operations by Daniel Moore [105]

  • Russian Information Warfare by Bilyana Lilly [107]

  • The Tallinn Manual and The Tallinn Manual 2.0, edited by Michael Schmitt [24, 25]

  • The Virtual Battlefield by Christian Czosseck and Kenneth Geers [57]

Conferences and journals:

Other resources:

  • CyberPeace Institute portal on cyber incidents during the Ukraine conflict [102]

  • EU Cyber Direct Cyber Diplomacy Atlas [110]

  • Geneva Internet Platform Digital Watch Portal [26]

  • The Hague Centre for Strategic Studies Cyber Arms Watch [111]

  • United Nations Institute for Disarmament Research Cyber Policy Portal [112]

3.2 Online Influence Operations and Activism

An Overview of the Theme.

The growth of ICTs gave civil society, NGOs, and activists a greater voice. The first notable occurrence was the Zapatista movement, which changed from an insurgency to an online movement in 1994 [58]. Later occurrences saw mobile devices and social media begin playing a role in anti-government protests and similar movements. Initially, the use of such technology occurred in Iran, Moldova, Urumqi (in China) and Mozambique [59, 60]. Subsequently, social media activity was also apparent in documenting a military intervention in Zimbabwe, as well as supporting subsequent protests [61].

The two most notable examples are the Arab Spring events and in Ukraine. In 2010 mass government protests supported by the use of social media spread across North Africa and the Middle East, resulting in changes of government [62]. In the Ukraine, the scenario was more complex; initially, pro-EU protestors ousted a pro-Russia government; in these protests social media was used for communication, but also specifically arranging legal, medical, and other supplies for the protestors [62]. Following this, pro-Russian protests, supported by media and other influence operations began opposing the interim pro-EU government. Ultimately, the situation led to the annexation of the Crimea and a conflict in the Eastern Ukraine; this provides a good example of hybrid warfare, where media influence and cyber-attacks were effectively used as a pre-cursor to military actions [62].

Activism and influence operations can be related to information and cyber-security. An interpreter at the UK’s General Communications Headquarters (GCHQ) leaked information on how the U.S. intended to spy on UN members prior to a vote on sending troops to Iraq [63], and a contractor for U.S. intelligence agencies leaked sensitive National Security Agency information [64]. WikiLeaks published numerous communications and documents from the military operations in Afghanistan and Iraq, as well as U.S. diplomatic communications, leaked by an intelligence analyst [65]. All of these major leaks were the result of internal actors breaching security; and these leaks have provided insights into the secret activities of governments’ intelligence and cyber-operations.

WikiLeaks also released information obtained through cyber-attacks, such as from Sony Pictures, and emails from the Democrat’s 2016 presidential campaign [65]. This latter incident is often associated with concerns of a broader influence operation to influence the elections, where messages across a broad range of social media was reportedly used to create divisions in the U.S. [66]. A PR firm, Cambridge Analytica, was embroiled in a scandal based on their messaging to influence voters based on data gathered about them on social media [67]; prior to this, Bell Pottinger was exposed using cynical and malicious messaging in South Africa, ultimately resulting in the collapse of the company [68].

During the COVID-19 pandemic in 2020, there were various attempts at disinformation and influence. Some disinformation campaigns were attributed to nations, particularly surrounding the origins of the virus [69]. Other nations used social media as a propaganda mechanism, targeting countries in an attempt to improve their image in conjunction to providing aid to those countries [70]. A disturbing trend was a handful of world leaders to also providing disinformation [71, 72].

The response to disinformation and influence operations has not yet achieved the growth that has been see for cyber-security. The Carnegie Endowment for International Peace hosts a Partnership for Countering Influence Operations [73]; this group is a partner to the Disinfodex, an online database of information about known disinformation operations [74]. Large tech firms also release dataset, such as Twitter’s data on information operations [75]. National responses to disinformation, especially during the pandemic, was to pressure social media companies to enhance their efforts [76], or to outlaw disinformation and misinformation, which raised some debate due to concerns over restrictions on freedom of speech [77].

Key Works and Resources Related to Influence Operations, Disinformation and Online Activism.

A number of selected works related to cybersecurity are presented below in alphabetical order based on the title.

  • Active Measures by Thomas Rid [78]

  • Atlantic Council’s Digital Sherlocks programme and 360/OS conference [113, 114]

  • Carnegie Endowment for International Peace Partnership for Countering Influence Operations [73]

  • Influence and Escalation by Rebecca Hersman, Eric Brewer, Lindsey Sheppard, and Maxwell Simon [108]

  • Information Wars by Richard Stengel [79]

  • Special Issue on Countering Influence Operations, Journal of Information Warfare, edited by Alicia Wanless and James Pamment [80]

  • This Is not Propaganda by Peter Pomerantsev [81]

  • The World Information War, edited by Timothy Clack and Robert Johnson [82]

  • Towards Responsible AI in Defence: A Mapping and Comparative Analysis of AI Principles Adopted by States by Alisha Anand and Harry Deng [116]

3.3 Artificial Intelligence, Autonomous Systems, and Surveillance

An Overview of the Current Issues within the Theme.

With the increase of ‘smart’ or ‘intelligent’ systems that are connected, there are a number of concerns raised. In terms of commercially available devices, concerns usually revolve around privacy and the extent of information these devices and the manufacturers collect; this applies both to home automation and mobile devices [83]. When similar technological concepts are extended to physical security applications, such as facial recognition in CCTV surveillance, both privacy and accuracy become problematic. As surveillance systems are not in an ‘ideal’ environment there is the likelihood for incorrect matches; this becomes particularly problematic when incorrect matches are used as evidence for criminal or other legal proceedings [84, 85].

When such technology is employed in military and intelligence contexts, there are concerns that autonomous and semi-autonomous systems can potentially attack incorrect targets [86]. A fully autonomous system is defined as one that can perform target identification and selection, as well as attacking the target, with no human control [86]. As can be seen from the list of key works below, the majority of research and focus on this topic revolves around the ethics and law of using artificial intelligence and autonomous systems.

Key works and resources related to AI, autonomous systems, and surveillance.

A number of selected works related to cybersecurity are presented below in alphabetical order based on the title.

  • Army of None by Paul Scharre [87]

  • Autonomous Weapons Systems: Law, Ethics, Policy, edited by Bhuta, Beck, Geiβ, Liu, Kreβ [88]

  • Autonomous Weapon Systems and the Law of Armed Conflict by Tim McFarland [89]

  • Genius Weapons by Louis A. Del Monte [90]

  • Killer Robots by Armin Krishnan [91]

  • Killer Robots by U.C. Jha [92]

  • Lethal Autonomous Weapons, edited by Galliott, MacIntosh, and Ohlin [93]

  • Organization for Economic Co-operation and Development (OECD) AI Policy Observatory [115]

  • Wired for War by P.W. Singer [94]

4 Future Directions

The themes relevant to the working group have numerous possible future directions. This section will provide an overview of current and future events that are likely to drive the issues and research considered by the working group.

From a technical cyber security perspective, research in current and future attack trends [95], vulnerabilities, as well as improving detective and preventative controls will continue as future research avenues. As the Fourth Industrial Revolution continues and more technological innovations are introduced (such as 5G and quantum computing), the interactions between cyber security and the other pillars of 4IR will continue to evolve and require research [96]. There are already indications that the 4IR is evolving to the Fifth Industrial Revolution, which will increase the security challenges [97, 98]. In addition to the cyber-security perspective, the application of emerging technologies in conflict, peace, and security settings will require investigation, including the ongoing legal and ethical debate on autonomous weapons systems.

From the cyber diplomacy perspective, there are a number of initiatives at the time of writing: The UN Human Rights Office of the High Commissioner is developing a report on cyber mercenaries [99]; the mandate for the OEWG was extended for 2021–2025, with the GGE scheduled to completed in 2021 [26]; the next phase of the Paris Call is continuing in 2021 with a series of working groups [100]; and a second additional protocol for the Budapest Convention is in the consultation phase [101]. The number of initiatives in this area indicate that there will continue to be significant research and investigations continuing for the foreseeable future.

As disinformation and influence operations continue, there is likely to be ongoing discussion and an increasing number of forums considering disinformation and influence. There is also likely to be research aligning the detection and mitigation of influence operations with existing cyber security techniques. As with cyber security, emerging technologies are likely to increase the sophistication and reach of influence operations.