DECEMBER 15, 2009

Cyberweapon Proliferation Treaty? No, Not Really.

When I was in school, many years ago, I remember running through drills to prepare us for an attack from the Soviet Union. Sitting in the basement (ahem, shelter) of my school we wondered why these drills were even necessary. If you simply watched the news during those years, or had gone to the theater to see WarGames, the evidence was mounting that no basement would really protect us from the seemingly thousands of nuclear warheads pointed at us. Year after year the United States and the Soviets simply kept building up the enormous arsenal of weapons and the term "nuclear proliferation" became part of our everyday vernacular.

Times have changed and due to the Treaty on the Nonproliferation of Nuclear Weapons the production of these types of weapons has abated. However, the idea of weapons proliferation is seemingly still on the minds of U.S. and Russian leaders. Over the weekend the New York Times reported on high-level talks between the two nations, which included the United Nations arms control committee. According to the article, the talks were being held, in part, to discuss proliferation of cyberweapons.

This would certainly be a shift for the U.S., who had ignored the call for these talks in the past. However, it is important to figure out what is actually being discussed by the two countries. According to the second paragraph:

Officials familiar with the talks said the Obama administration realized that more nations were developing cyberweapons and that a new approach was needed to blunt an international arms race.

Yet, if you read the article a bit more closely it seems that the talks are actually more around the threat posed by organized cybercrime syndicates. In fact the headline itself simply talks about Internet crime. Travel down the article and you'll find a tiny bit of information on the actual goals the U.S. may have in these talks:

A State Department official, who was not authorized to speak about the talks and requested anonymity, disputed the Russian characterization of the American position. While the Russians have continued to focus on treaties that may restrict weapons development, the United States is hoping to use the talks to increase international cooperation in opposing Internet crime.

We all realize that newspapers will shift the angle of the story to the most "newsworthy", and the very idea of cyberweapon proliferation seems to grab the imagination of many folks. Ultimately, I believe, the talks are more focused on Internet crime than on cyberweapons, because that is where the focus should be at this point. The cyberweapon angle is just the more exciting piece of the story. Remember just a few weeks ago after the cyberwarfare piece on 60 Minutes, people jumped on the most dramatic parts of the story, many of which have been proved, at least partially, false. The one fact we do know is that there are severe vulnerabilities within the U.S. critical infrastructure. Now is not the time to be putting together a treaty on the military use of cyberspace when we still have so much work to do hardening our own critical infrastructure from cyberattack.

---

Speaking of hardening the security of networks and data centers, don't forget to register for tomorrow's BreakingPoint webcast on security evasions.

---