A methodology for cyber operations targeting and control of collateral damage in the context of lawful armed conflict
Throughout history, the law of warfare has evolved to protect non-combatants and limit collateral damage. The same legal and ethical constraints apply to the conduct of cyber warfare, where it is similarly desirable to limit the effects of offensive actions to specific locations and groups. However, conventional wisdom suggests that this is extremely difficult, if not impossible to accomplish in the cyber domain. In this paper, we argue to the contrary. It is possible to constrain the effects of cyber actions to specifically desired, legitimate targets while significantly limiting collateral damage and injury to non-combatants. To this end we present a generalized methodology for analysis of the targeting and effects of cyber operations with respect to principles of lawful conduct in armed conflict. This methodology includes a framework of effects categories, target attributes and control measures to direct and constrain cyber operations. It also includes a process for evaluating these effects and controls against the principles for lawful conduct in armed conflict. We illustrate the methodology in action by applying it to W32.Stuxnet, software widely considered to be a cyber weapon. Our results indicate that it is entirely possible to analyze complex cyber war problems, identify legally authorized courses of action, and focus effects on desired targets while greatly minimizing collateral damage.
Malware is called malicious for a reason: The risks of weaponizing code
The allure of malware, with its tremendous potential to infiltrate and disrupt digital systems, is understandable. Criminally motivated malware is now directed at all levels and corners of the cyber domain, from servers to endpoints, laptops, smartphones, tablets, and industrial control systems. A thriving underground industry today produces ever-increasing quantities of malware for a wide variety of platforms, which bad actors seem able to deploy with relative impunity. The urge to fight back with “good” malware is understandable. In this paper we review and assess the arguments for and against the use of malicious code for either active defense or direct offense. Our practical experiences analyzing and defending against malicious code suggest that the effect of deployment is hard to predict with accuracy. There is tremendous scope for unintended consequences and loss of control over the code itself. Criminals do not feel restrained by these factors and appear undeterred by moral dilemmas like collateral damage, but we argue that persons or entities considering the use of malware for “justifiable offense” or active defense need to fully understand the issues around scope, targeting, control, blowback, and arming the adversary. Using existing open source literature and commentary on this topic we review the arguments for and against the use of “malicious” code for “righteous” purposes, introducing the term “righteous malware”. We will cite select instances of prior malicious code deployment to reveal lessons learned for future missions. In the process, we will refer to a range of techniques employed by criminally-motivated malware authors to evade detection, amplify infection, leverage investment, and execute objectives that range from denial of service to information stealing, fraudulent, revenue generation, blackmail and surveillance. Examples of failure to retain control of criminally motivated malicious code development will also be examined for what they may tell us about code persistence and life cycles. In closing, we will present our considered opinions on the risks of weaponizing code.
Mechanics of deformable directed surfaces
Abstract The paper develops a simple, yet complete and consistent non-linear dynamic thermo-elastic shell theory based on the concepts of a two-dimensional directed continuum. The constitutive equations are postulated in a general form. Stress-strain relations are derived using the equation of energy balance and the two entropy production inequalities, which are rewritten in a special form. The linear theory is discussed in detail. The structure of the stress-strain relations is presented in the most general form and then specialized to concrete examples, in particular, to the classical shell theory, using their invariance properties with respective to certain symmetry groups. The elastic moduli are determined by demanding the coincidence of the frequency dispersion surfaces obtained using the two-dimensional theory with the lowest foils of the corresponding surfaces resulting from the three-dimensional theory of elasticity.