1.5 Cyberwarfare & Cyber Terrorism★

# War Without a Single Shot

• In 2007, Estonia's banks, news sites and government went offline for weeks.
• No tank crossed the border. Not a single shot was fired.
• The whole attack came through the internet.
• So can a country lose a war without ever being invaded?

# Cyberwarfare

Cyberwarfare is the use of cyber attacks by a nation-state, or groups it backs, against another nation's computers and networks to cause damage, disruption or gain a strategic advantage.

Objectives

1. Espionage: stealing military, political and industrial secrets.
2. Sabotage: damaging physical systems such as power plants and factories.
3. Disruption: shutting down government, banking or communication services.
4. Propaganda: spreading fake news to confuse or divide the enemy's people.
5. Economic damage: hurting the other country's businesses and markets.

Forms

• DDoS attacks on government and banking sites (→ 2.17).
• Malware built to damage infrastructure (→ 1.6).
• Long, hidden spying campaigns (APTs).
• Disinformation campaigns on social media.

Real examples

1. Estonia (2007): weeks of DDoS attacks on government, bank and media websites.
2. Stuxnet (2010): a worm that secretly damaged about 1,000 uranium centrifuges at Iran's Natanz nuclear plant; widely attributed to the US and Israel. The first known cyber weapon to cause physical damage.
3. Ukraine power grid (23 December 2015): attackers using BlackEnergy malware switched off substations; about 230,000 people lost power for 1–6 hours. The first acknowledged grid blackout caused by a cyberattack.
4. NotPetya (2017): malware disguised as ransomware but built to wipe data; it started in Ukraine, spread worldwide and caused an estimated 10 billion US dollars of damage.

# Cyber Terrorism PYQ 5M · other

Cyber terrorism is the use of computers and the internet by terrorist groups or individuals to carry out politically, religiously or ideologically motivated attacks that cause fear, disruption or harm to people, property or a government.

Motives

• Political or religious goals · revenge · publicity for a cause · creating fear among the public.

Methods

1. Attacks on critical infrastructure: power grids, water supply, hospitals, transport.
2. Hacking and defacing government websites with threatening messages.
3. DDoS attacks to shut down important online services.
4. Propaganda and recruitment: videos and posts on social media and encrypted apps.
5. Financing: online donations, cryptocurrency, card fraud.
6. Planning and communication: encrypted chats, internet calls, online maps.

Illustrations

1. 26/11 Mumbai attacks (2008): the attackers took live instructions from handlers across the border through satellite phones and internet (VoIP) calls, and had studied their targets on Google Earth.
2. Ahmedabad serial blasts (26 July 2008): a terror group's email claiming the blasts was sent minutes before, through a resident's unsecured Wi-Fi network in Navi Mumbai, to hide the sender (→ 2.11).
3. Online recruitment by ISIS: propaganda videos and social-media accounts drew recruits from many countries.
4. A possible future attack: malware that switches off a city's power grid in peak summer, stopping hospitals, water pumps and trains at once.

Impact on a nation

• Loss of life and public fear · economic loss · damage to infrastructure · loss of trust in government.

Prevention and national response

1. IT Act Section 66F: cyber terrorism is punishable with up to life imprisonment (→ 5.5).
2. CERT-In (formed 2004; Section 70B): the national agency for handling cyber incidents.
3. NCIIPC (2014; Section 70A): protects critical information infrastructure (→ 1.6).
4. Monitoring of terror content online, and takedown of propaganda.
5. International cooperation: sharing intelligence and tracing attackers across borders.
6. Securing infrastructure: segmentation, backups, regular audits.

Cyberwarfare vs cyber terrorism vs cyber crime