Why cyber war isn’t a game

War today is fought on five fronts – sea, land, air, space and cyber – and cyber, the real final frontier, is often misunderstood because it’s so new.

Cyber attacks aren’t virtual attacks. They can cause large-scale physical damage and death – and have been doing for years. Here are just a few examples

• 2007: Israel, during an airstrike on Syria, uses a cyber attack to disrupt the Syrians’ air defence networks.
• 2010: The Stuxnet computer worm is used to attack Iran, causing physical damage to over 900 uranium enrichment centrifuges.
• 2014: A cyber attack on a German steel plant wrecks a blast furnace.
• 2015: In Ukraine, a cyber attack on the power grid cuts off 200 000 people’s electricity for several hours, physically damages control systems and leaves 30 substations running manually for weeks.

Cutting off electricity shuts down the economy, transport, financial services, communications, hospitals, and traffic control systems. It can kill. This is a level of damage that could previously only be achieved by bombing.

And cyber attacks have the potential to do even worse. For example, a cyber attack on a chemical plant could wreck equipment and release toxic chemicals or gases that could kill thousands. The 1984 Bhopal pesticide disaster, which claimed over 8,000 lives, illustrates the magnitude of this risk.

Now consider what happens when these technologies are used in war. A hostile state could mobilise teams of hackers to attack multiple chemical plants, multiple points on the electricity grid, and other vital systems simultaneously, causing nationwide chaos – then launch a conventional attack while the military was unable to respond.

Not only Russia and China, but also lesser powers like North Korea and Iran, could devastate the UK through cyber warfare. In fact, cyber attacks are the cheapest and easiest way for weaker countries to take down stronger opponents.

But defending against them is not so easy. The military, the government, and business, all of which are vulnerable, must all cooperate. The UK has recently shown how seriously it takes this by investing £250 million in the new Cyber Force, a joint initiative between the Ministry of Defence and intelligence agencies.

This isn’t taking money away from “real” defence; it is real defence. To reiterate, cyber warfare can cause real-world devastation equivalent to bombing. It can kill thousands of civilians, wreck infrastructure and industry, and disable military defence systems, leaving us powerless against conventional attacks. Cyber defence is now an essential part of our defence strategy.