As we discussed in the last lecture, the logical structure of cyberspace is a web-like one that is both a virtue and a vice. It’s a virtue because it allows almost 100 percent accurate communications around the globe instantaneously. But it’s a vice because the logic structure is about the communication of information and data —and only about communication. That focus on rapid, accurate, and effective communication—to the exclusion of other factors, such as security and identity has made cyberspace a dangerous place. In this lecture, we’ll take a closer look at this dangerous place and identify fi ve distinct gateways that create vulnerability for anyone who connects to the cyber network.
Instantaneous Action at a Distance
The history of human interaction is, essentially, one of increasing distance. Early in human history, such activities as armed confl ict, sales of goods, malicious acts, and espionage required physical proximity. But over time, this necessity for proximity weakened. In warfare, for example, humans moved from using swords to bows and arrows, siege cannons and artillery, airplanes, and intercontinental ballistic missiles.
The Internet is a quantum leap beyond that in capability. Now, action in the cyber domain occurs at the speed of light and crosses immense distances almost instantaneously. From your desktop, you can access a website in Japan, read a South American newspaper, or make reservations at a restaurant in Paris.
But what is easy for you from your home computer is equally easy for any malicious actor in the world who wants access to a computer, say, in America. Whether the object is warfare, terrorism, espionage, or crime, it is no longer necessary for malevolent actors to be anywhere near the venue of their actions.
The Asymmetries of Cyberspace
One of the unique features of the Internet is that the manipulation of bits and bytes does not require the development of a sophisticated industrial base, nor does it require a substantial fi nancial investment. In other words, the barriers to entry into the cyber domain are incredibly low.
Further, the structure of the Internet is such that, at least today, offense is much more effective than defense. As everyone knows, it’s almost impossible to avoid a virus infection on your computer. Firewalls and intrusion detection systems are only so effective.
That means that a small group of actors in cyberspace can have an incredibly large effect. A handful of intelligent hackers can compete in cyberspace against the most powerful nations in the world. The group known as Anonymous, for example, has taken down the CIA website and stolen internal e-mails from sophisticated security companies.
Another example of this asymmetry can be found in the e-mail almost everyone has received from a Nigerian scammer, offering millions of dollars as a windfall if the recipient would only front a small transaction fee. Given that almost everyone recognizes such scams as frauds, why do they continue?
The answer lies in the asymmetric nature of the Internet. Sending out 1 million scam letters is almost costless. Even if only one person in a million responds to the scam request, the disparity between the costs involved and the potential benefi ts to be gained from a successful scam make it highly profi table for the scammers to continue.
This asymmetry in cyberspace is a radical development. In the past, fraud required signifi cant opportunity costs—an investment of time, money, and energy by the con man. When a large investment is required, the actors want a relatively high degree of confi dence that they will be successful. But on the Internet, fraudulent actors can spend literally pennies with a realistic hope of reaping a financial reward.
Another way of looking at the problem of asymmetry is through the prism of national security.
o In the physical world, a country’s power is judged by its force
of arms. Few other countries can even come close to wielding the same nuclear power as the United States, for example. But the asymmetry of information power on the Internet changes that dynamic.
o Such countries as North Korea and Iran are perfectly capable of challenging and perhaps even dominating America in cyberspace. The limits lie not in a nation’s industrial base or the size of its economy but solely in the intellectual capabilities of its citizens.
Anonymity in Cyberspace
Another disturbing fact about cyberspace is that we are sometimes not sure of the identities of our opponents.
o The Internet was not designed to require identifi cation. As initially conceived, its only function was to transmitinformation across great distances rapidly. a time when there were only four nodes on the Internet, and everybody who used it knew one another.
o Today, there are more than 2 billion nodes on the net, representing nearly a third of the world’s population. It’s incredibly easy to hide in that large a network.
At the same time, the idea of anonymity on the Internet has become part of our culture. Many users, particularly in the younger generation, feel as though the freedom of the Internet is inherent to its development. In reality, that freedom is part of the architecture of the Internet and could be changed. Yet anonymity on the Internet has become a strong cultural norm, and it would be politically problematic to change the architecture of the system. The phenomenon of anonymity has also given rise to deliberately anonymous actors on the Internet. In addition to hackers operating collectively, criminal networks take advantage of the power of anonymity, operating almost with impunity around the globe.
o One reason identity thieves are almost impossible to deter is that their own identities are almost impossible to discover.
o Here again, the contrast with the physical world is remarkable. The requirement of physical proximity to commit a crime means that there are many opportunities to discover the perpetrator’s identity—fi ngerprints, license-plate numbers, and so on. This is not true on the Internet.
The lack of identifi cation—what’s called the problem of attribution—is one of the foundational diffi culties of the network. Not only does it create the difficulty of defending yourself from unknown attackers, but it also raises a barrier to effective cooperative action with people or entities that you might actually want to work with, such as your bank.
Identifi cation isn’t absolutely impossible to achieve, but it can be extremely diffi cult. In one case of cyber spying known as GhostNet, it took more than a year of exceedingly diffi cult forensic work to identify the source of intrusion.
Anonymity has an inherently contradictory nature. The Internet offers a potentially dangerous kind of anonymity, but as we’ll see in a future lecture, the footprints that the ordinary user leaves are indelible, and errors in judgment about what one views
