WASHINGTON – It may be wishful thinking, but it’s just possible that Vladimir Putin has done us a great favor. He has alerted us to the true threat of cyberwarfare in a way that — again, just possibly — might prompt us to view it as a serious national danger and begin to take effective countermeasures.
Of course, Americans are aware of the hazards of cyberattacks. Every few weeks, it seems, we’re confronted with a high-profile hacking that, typically, involves the theft of massive amounts of personal or corporate data. A recent example is Yahoo’s disclosure that in 2013 it was hacked and lost data on about 1 billion users.
But the standard response to these breaches has been subdued. We see cyberattacks “as mostly annoyances — inconvenient, maybe even a little disruptive, but nothing we can’t live with,” says Jeffrey Eisenach of the American Enterprise Institute. Actually, this complacency is not entirely misplaced.
So far, cyberattacks have not endangered our economy or way of life. The breaches mainly represent a new form of crime, whose costs are exasperating but manageable. The truth is that most cyberattacks fail.
“For most major companies, there are thousands or even millions of daily attacks. Only a small number of them succeed in getting into the attacked system — and even a smaller number succeed in getting information out of these systems,” says Robert Knake, a cyber expert who worked in the Obama White House and is now at the Council on Foreign Relations. A report by Verizon lists 2,260 incidents with confirmed data loss in 2015.
Other studies make the same point. A 2014 report by the Center for Strategic and International Studies puts the worldwide cost of cybercrime at $400 billion. Although that’s a lot of money, it’s only about one half of 1 percent of global output, estimated at $78 trillion in 2014 by the International Monetary Fund.
Until now, the internet has mainly created new avenues for old behaviors. Roughly nine of 10 computer breaches involve theft or business espionage, finds the Verizon study. For individuals, these can be devastating. For companies, they represent unfair competition that, for some firms, may be fatal. Still, in an imperfect world, these are familiar evils.
What Putin and Russian hackers allegedly did shatters this pattern. Their hacking — as interpreted by both the CIA and the FBI — qualifies as state-sponsored aggression. It does jeopardize our way of life. It undermines the integrity of our political institutions and popular faith in them. More than this, it warns us that our physical safety and security are at risk. Hostile hackers can hijack power grids, communication networks, transportation systems and much more.
You cannot do a cost-benefit analysis of something that imperils society’s economic and political foundations. The plausible cost is infinite. The rise of cyberattacks, says a recent report from the American Enterprise Institute, ranks with three great strategic shifts in military history — first, the rise of sea power; next, the advent of air power; and the opening of space.
The emergence of cyberspace “poses the most daunting challenge yet ... [because] its implications are more sweeping,” AEI asserts. It touches almost every aspect of society and alters the nature of global conflict. (Omitted, inexplicably, from AEI’s list is nuclear power.)
There are steps we could take to protect ourselves.
We could move some vital data networks offline — that is, we could build systems independent of the internet. This would not offer airtight security but would probably make it harder to hack many power, transportation and financial networks.
Another possibility is to impose security standards on the “internet of things” — the label for connecting cars and home appliances to the internet. Now, lax security means that expanding the internet of things encourages more hacking by multiplying access points. A presidential commission has recommended standards.
It’s also possible to streamline agencies overseeing cyberspace. The National Security Agency has the ability to protect important domestic systems but lacks the legal authority to do so, argues AEI. Meanwhile, the Department of Homeland Security has the authority but lacks capability. A partial merger would make sense, says AEI.
But we won’t act until we understand the seriousness of the threat. Americans are of two minds about the internet. They love its gadgetry, from social media to smartphones. Meanwhile, they hate its threat to privacy and the dangers of hacking. Putin’s gift to America is forcing us to face the contradictions. He has shown conclusively that the internet is a potent instrument of national power that can be wielded against us.
Congress intends to investigate the Russian hacking. Fine. But if the investigation focuses only on Russia, it will fail before it starts. The problem is not just Russia’s bad behavior. It’s the nature of the internet. If we don’t acknowledge that, we will increasingly become its victim.
Robert Samuelson is a columnist for The Washington Post. © 2016 The Washington Post Writers Group.