Time for a Cyberweapons Treaty?

MANY QUESTIONS remain about the alleged North Korean hacking of Sony Pictures and the U.S. response. But the Christmas controversy, apparently triggered by the Seth Rogen-James Franco satire film The Interview, has made one thing perfectly clear: A lot has changed on the internet since Al Gore didn’t invent it.

Back in the days of Gore, the net was an attempt to provide a secure and resilient military communications network during our Cold War with the Soviet Union. But by the turn of this century, it had become an unrivaled public forum for democratic activism and an absolute paradise for shoppers and porn addicts. Now the internet is getting back to its military roots. It is both the weapon and the battleground for United States’ simmering low-level wars with not only North Korea, but China, Iran, Russia, and anyone else who gets in the way.

For several years there has been a steady trickle of back-page news stories about cyberwarfare. The Chinese military seemed to be hacking U.S. government and business sites for military and industrial espionage. Two years ago the Chinese were said to have hacked The New York Times in revenge for that paper’s reporting on the financial corruption of China’s leadership. North Korea has allegedly attacked banking networks in South Korea. Attacks said to originate in Russia have hit U.S. and European energy companies. In 2009, the ante was upped when the U.S. and Israel unleashed the Stuxnet virus to sabotage the Iranian nuclear program. The virus destroyed Iranian centrifuges, but it also escaped to the broader internet and sabotaged computers at the U.S.-based Chevron oil company.

Stuxnet was just the beginning. According to a document released by Edward Snowden, reported in The Guardian, in October 2012 President Obama issued a secret policy directive ordering U.S. agencies to develop strategies and targets for Offensive Cyber Effects Operations. In the future, Obama ordered, the U.S. should take the offensive in using internet-based hacking and sabotage “to advance U.S. national objectives around the world.”

ALL THESE CYBERWAR stories were arcane and uninteresting for most people, until one came along that involved celebrity gossip, revelations of Hollywood racism, and a potential threat to our inalienable American right to spend Christmas laughing at fart jokes. Then we got a round-the-clock frenzy of media-induced irrational fear.

But a healthy fear of cyberwar is not irrational. As the Stuxnet sabotage of industrial centrifuges demonstrated, monkeying with the software can cause real damage in the physical world. Someone could take out our electric power in a similar fashion, wreaking widespread chaos and death. And we could do that to some other hapless people whose government ours dislikes.

So, two big lessons from the Sony hacking: First, everyone everywhere needs to stop writing stuff in workplace emails that they aren’t willing to see published. And second, the U.S. needs to pull back from its commitment to offensive cyberwar. Instead we should begin an international arms control process for cyberweaponry like the one that has helped avert another use of nuclear weapons for the past 69 years.

In response to the Snowden revelations on offensive cyberwar, internet security expert Bruce Schneier wrote, “We’re pursuing policies that are both expensive and destabilizing and aren’t making the internet any safer. ... We’re ignoring resilience in favor of offense. ... It’s time to stop the madness. Yes, our military needs to invest in cyberwar capabilities, but we also need international rules of cyberwar, more transparency from our own government on what we are and are not doing, international cooperation between governments, and viable cyberweapons treaties.”