A new strategy for improving cyber-attacks evaluation in the context of Tallinn Manual

Abstract

In this paper a systematic modeling methodology for evaluating the effects of cyber-attacks on States Critical Information Infrastructure (CII) is introduced. The analysis is focused on the United Nations Charter's normative scheme of the “use of force”, in order to define whether these attacks constitute a wrongful “use of force” under the principles of international law. By using the qualitative criteria for recognising the impact of cyber-attacks as proposed by the International Group of Experts in the Manual on the International Law Applicable to Cyber Warfare (Tallinn Manual) and by applying Multiple Attribute Decision Making (MADM) methods, cyber operations evaluation results are presented. For the analysis a case study of kinetic and cyber-attacks on Supervisory Control and Data Acquisition (SCADA) system is employed. Pros and cons of the Simple Additive Weighting (SAW) method and the Weighted Product Method (WPM) are evaluated. The weaknesses of applying the SAW method in cyber-attacks modelling, as well as the difficulty in defining an appropriate quantitative scale for the classification of such attacks when using WPM (due to the nonlinear relationship between attributes and overall score in WPM), lead us to present a new evaluation strategy. This new strategy combines the use of the above mentioned decision making algorithms and introduces a new grouping of Schmitt's criteria based on their properties for achieving an improved cyber-attacks modelling assessment. Different quantitative scales are applied in the distinct Schmitt's criteria groups in order to quantify them based on their characteristics. The correlation of the qualitative and quantitative methods of analysis leads to more accurate cyber-attack evaluation and classification.

Introduction

In the 21st century, cyberspace is the new frontier, a new world full of possibilities to help advance prosperity. Cyberspace and the rapid development of Information and Communication Technologies (ICTs) have fundamentally transformed the global economy and the way of life by providing billions of people across the world with instant access to information, to communication and to new economic opportunities. At the same time, national security, education, government, health, public safety, as well as sectors such as energy, transportation and communication are closely related to, if not dependent on, cyberspace and updated ICTs. The more the systems, infrastructures, societies and economies are becoming independent the higher their vulnerability and the complexity to deal with new risks and treats that menace the sovereignty of States and the well-being of societies and citizens (Albanese et al., 2013). The integration of new technologies that are enabled with Cloud Computing services is growing with an interlinkage of infrastructures which are amounting to a new dimension of vulnerability (Albanese et al., 2014). The increasing number of cyber-attacks on States' Critical Information Infrastructure (CII) are transforming cyberspace also into a battlefield, “the mouse and keyboard being the new weapons” and bringing out “cyber warfare” as the “5th dimension of war” (The Economist, 2010).

The wide range of cyber-attacks against Estonia's critical ICT's in 2007, following the country's spat with Russia over the removal of a war memorial, were the first large scale attacks that were meant to harm the functionality of the State and to cause a number of adverse effects on the operation of public administration and the economy. The specific assault quickly led to the cultivation of fear among citizens and to the destabilisation of the country's financial system, threatening Estonia's national security (Tikk et al., 2010).

A smaller range of cyber operations followed, such as the cyber-attacks against Georgia (June 2008), Lithuania (August 2008), Kazakhstan (January 2009) and Ukraine (March and May 2014). Meanwhile, Advanced Persistent Threats (APT) (Virvilis and Gritzalis, 2013a) clearly demonstrate the fact that cyber warfare is an increasingly alarming phenomenon. Examples of such include “Ghostnet” (Kassner, 2009), a large-scale cyber spying operation against the US; “Operation Aurora” (Zetter, 2010), a targeted malware attack against at least 30 major US companies – including Google and Adobe; “Stuxnet” (Farwell and Rohozinski, 2011), a zero-day malware leading to a sabotage against Iran's nuclear program; and “DarkSeoul” (Virvilis and Gritzalis, 2013b), a sophisticated malware that attacked South Korean financial institutions and the Korean broadcaster YTN (Sang-Hun, 2013).

In order to defend USA from cyber-attacks former US President Obama declared America's digital infrastructure a strategic national asset (The Economist, 2010). Such decisions reflect the need to address the challenges posed with regard to cyber-attacks that could be qualified as cyberwar actions. The continuous increase in both the number and the intensity of cyber-attacks on States' CII renders the research on defining and evaluating these categories of cyber-attacks into a pressing need.

A first range of questions relate to the adequacy and suitability of the existing “old” – developed over generations to be applied on attacks using kinetic weapons and armed violence – and the terminology used (such as force and aggression) to control “the brave new world of cyber warfare (Jolley, 2013). We have to bear in mind that terms themselves, such as CII, are steadily evolving due to the impacts of the advancing domination of online communications and cyberspace on the “real world” and ubiquitous computing. The difficulties to define and to identify the effects and impacts of a cyber-attack in order to be equated to an “armed attack” are obvious: if in the “traditional” jus ad bellum framework emphasis is given on human and/or material destruction, authors are arguing also for “unavailability” of CII as equivalent criterion (Tsagourias, 2012). Despite the progress made on regulation and research level to address the issues raised, there are still significant gaps in reaching a safe and definitive approach on when a cyber-attack constitutes “use of force” when the right to self-defence should be recognized (Robinson et al., 2015).

The paper contributes to the development of a systematic modelling methodology for evaluating the effects of cyber-attacks on States' CII in order to answer the question of whether these attacks have risen to the level of a “use of force” under the jus ad bellum, that body of international law that governs a State's resort to force as an instrument of its national policy. The threshold inquiry is crucial to assessing the level of violence between States in order to justify a lawful response. Because the UN Charter prohibits the unauthorized “use of force”, a State must be able to quickly and safely assess whether a cyber operation constitutes a “use of force” triggering the international condemnation and economic sanctions, (active) “cyber self-defense” – or an “armed attack” (with the use of conventional military weapons) as forceful response.

This is primarily achieved by adopting the “effects-based” or “consequences-based” approach, which focuses on the overall effect of a cyber operation to the victim-State, as well as by using the qualitative criteria for recognising the impact of cyber-attacks as proposed by the International Group of Experts in the Manual of the International Law applicable to Cyber warfare (Tallinn Manual). Furthermore, Multi-Attribute Decision Making (MADM) methods are also applied.

For the analysis, a case study of kinetic and cyber-attacks on Supervisory Control and Data Acquisition (SCADA) system is employed. The pros and cons of each MADM method are evaluated and cyber-attack evaluation results are presented. The weaknesses of each MADM method lead us to present a new cyber-attack evaluation strategy that combines the use of decision making algorithms of MADM methods and introduces a new grouping of the International Group of Experts criteria based on their distinctive features. The correlations of both qualitative and quantitative methods lead us to achieve an improved cyber-attack evaluation assessment and as a result a more accurate and complete cyber-attack classification.

The paper is organised as follows: In section 2 the related work in cyber-attacks modelling assessment is presented. Furthermore, a comparative evaluation of the proposed methodology with previous cyber-attack evaluation methodologies is critically discussed. In section 3 the review of the existing international legal framework of cyber warfare is presented. Then, cyber operations are being categorized, based on their intensity. Furthermore, the “effect-based” model assessment and the qualitative criteria, as proposed by the International Group of Expert on the “Tallinn Manual of International Law Applicable to Cyber warfare”, are described. In section 4 the descriptions of both Simple Additive Weighting (SAW) method and Weighted Product Method (WPM) are presented. Both methods are introduced as multi-criteria decision analysis ones for the evaluation of cyber-attacks. The pros and cons of each method lead us to propose a new cyber-attack evaluation methodology which includes both qualitative and quantitative methods of analysis and results to a more accurate and complete cyber-attack evaluation and classification. Finally, in section 5 the indicative results of the research are critically analysed.