By JAMES STAVRIDIS AND DAVE WEINSTEIN
November 13, 2016
The world got a glimpse of the future in October when a large-scale cyber-attack prevented access to hundreds of key websites, including Twitter, the online New York Times, and Amazon. The "distributed denial of service" attack against the New Hampshire-based DNS provider Dyn, which blocked access to major online services for users as far away as Europe, fulfilled the direst predictions of technologists and security researchers alike.
The attack exposed the clear reasons for concern about the coming age of an Internet of Things, in which more household devices are connected to the Web. What's less immediately clear is what should be done to ensure the Internet's most likely future iteration remains safe.
To date, the vast majority of disruptive and even destructive cyber-attacks have been the work of militaries, foreign intelligence services, or other state-sponsored hackers. These actors are usually operating under some degree of political direction and interests and tend to moderate their use of malicious code for disruptive or destructive purposes.
But according to Director of National Intelligence James Clapper, America's top intelligence official, October's attack was likely the work of a non-state actor, and his assessment has been backed up by reports from the private cybersecurity firm Flashpoint.
This marks an important shift. The barriers to entry are becoming low enough that hackers no longer need the backing of a government to carry out crimes or even acts of warfare in cyberspace. These non-state actors are especially destabilizing because they are not subject to traditional means of diplomacy or law enforcement. They operate beyond legal jurisdictions and without regard for geographic political boundaries, so the instruments of deterrence that have largely kept nation-states from projecting disruptive or destructive cyber-force are increasingly obsolete.