A methodology for cyber operations targeting and control of collateral damage in the context of lawful armed conflict
Throughout history, the law of warfare has evolved to protect non-combatants and limit collateral damage. The same legal and ethical constraints apply to the conduct of cyber warfare, where it is similarly desirable to limit the effects of offensive actions to specific locations and groups. However, conventional wisdom suggests that this is extremely difficult, if not impossible to accomplish in the cyber domain. In this paper, we argue to the contrary. It is possible to constrain the effects of cyber actions to specifically desired, legitimate targets while significantly limiting collateral damage and injury to non-combatants. To this end we present a generalized methodology for analysis of the targeting and effects of cyber operations with respect to principles of lawful conduct in armed conflict. This methodology includes a framework of effects categories, target attributes and control measures to direct and constrain cyber operations. It also includes a process for evaluating these effects and controls against the principles for lawful conduct in armed conflict. We illustrate the methodology in action by applying it to W32.Stuxnet, software widely considered to be a cyber weapon. Our results indicate that it is entirely possible to analyze complex cyber war problems, identify legally authorized courses of action, and focus effects on desired targets while greatly minimizing collateral damage.
Developing Simulated Cyber Attack Scenarios Against Virtualized Adversary Networks
Cyberspace is recognized as a critical domain in modern warfare. The ability of military forces to maintain and secure their own operational networks, while simultaneously degrading or denying the ability of adversaries to operate their networks, is a critical strategic objective for military planners and leaders. Conducting effective offensive cyber operations (OCO) against sophisticated adversary networks requires the ability to develop, test, and rehearse cyber-attack actions before they are employed operationally. This requirement is well understood and practiced in the physical warfare domains, where ships, aircraft and tanks can exercise their capabilities against physical targets; it is not, however, well refined in the cyber domain. This research introduces a framework to address this need, and demonstrates a prototype for cyber-attack scenario development and rehearsal in a virtual network environment. By extending the earlier work of the Naval Postgraduate School’s Malicious Activity Simulation Tool (MAST), a distributed client-server based software tool designed to launch inert malware attacks on live networks, we were able to demonstrate cyber-attack scenarios based on temporal specificity and target discrimination as attack parameters. Our prototype accurately models an adversary network in a virtual environment, providing the ability to develop cyber-attack actions to achieve specific cyber effects against hosts on the intended target network. The architecture allows cyber forces to rehearse specific cyber actions prior to launching a cyberattack, in order to provide a more accurate assessment of the efficacy of these actions against a realistic model of the target network. This framework allows military forces to better train and prepare for cyber operations to help achieve cyber superiority in modern warfare.
Using Fuzzy-Delphi technique to determine the concession period in BOT projects
BOT projects are affected by several risks and uncertainties. One of the most important issues in this type of contract is to determine the length of concession period considering these uncertainties. The previous studies have developed several models to determine the concession period. However, the uncertainties are not taking into account in most of the previous works. Moreover, none of the previous researches has the capability to aggregate the opinions of different experts being involved in a project regarding the values of the uncertain input parameters. In this research, a Fuzzy-Delphi technique is implemented to determine the length of concession period considering uncertainties. Using the proposed Fuzzy-Delphi technique, the values of different uncertain factors affecting a BOT project is determined considering opinions of a group of experts. The NPV value is calculated considering the resulted aggregated values of uncertain input parameters. Finally, the concession period is determined using fuzzy approach. A case study is conducted to evaluate the performance of the proposed methodology. It is shown that the concession period is determined more effectively using the proposed approach.