Cyber-security - turning a threat into an opportunity for Poland
Dr Joanna Świątkowska says that a comprehensive, multi-dimensional strategy in necessary for cyber-defence, and for Poland, the need for national defence is an opportunity to build an export business in cyber-security.
Dr Joanna Świątkowska, CYBERSEC programme director, European Cybersecurity Forum
As recently as 2007, the authors of Poland's National Security Strategy claimed that the country does not face any serious military conflicts. Seven years later, the diagnosis is significantly different. The main reason for such a change is the conflicts that have taken place in international security – with Russian aggression against Ukraine at the forefront. This hybrid conflict which happened just over the Polish eastern border baffled the international community. Once again, it turned out that Western countries were not necessarily able to keep up with the evolving threats.
An extremely important element of the fighting in Ukraine was actions that took place in cyber-space. The use of cyber-space had a multi-dimensional nature and provoked diverse effects. By means of cyber-tools, hackers were stealing data; they were conducting information warfare and carrying out cyber-attacks targeted at Ukraine's critical infrastructure. This conflict showed us a new type of threat that can be realistically used against modern states. Due to its geographical position and economic and political conditions, Poland is especially exposed to a repeat of this hybrid attack strategy based on digital tools. On the one hand, such a threat posses a major challenge, but on the other hand, paradoxically, it is also an opportunity.
Elasticity as the biggest advantage of hybrid action
From a Polish perspective, open military conflict is not the most likely scenario or threat faced. Poland is a member state of NATO and any decision to launch a military attack on a large scale would be extremely risky from the aggressor's point of view.
From the perspective of potential rivals, a less risky and, at the same time, more effective method, is to conduct hybrid action leading to the most significant weakening of their opponent. It would be far more difficult to conduct the Ukrainian scenario in Poland as its linguistic minorities are incomparably smaller and the strategy of “little green men” could not be carried out easily and naturally. Circumstances could therefore lead to a change in the strategy of attack. Hybrid warfare against Poland would, most likely, take a modified form of action, clearly focused on conducting attacks in cyber-space. The main objective would not be seeking a conventional conquest of the country, but the weakening of its security and internal stability. It is worth discovering the nature of the hybrid actions in order to answer the question: “Why would this kind of strategy be very effective?”
General hybrid actions are:
- conducted prior to conducting kinetic war;
- focused on creating chaos and political, military, economic and social destabilisation;
- conducted by state and non-state actors;
- focused on taking advantage of opponent's weak points.
cyber-led actions are an ideal tool to conduct a conflict short of going to war. The situation in which an aggressor weakens an opponent by conducting effective, large-scale cyber-attacks on critical infrastructure, is a very attractive scenario. For instance, conducting a cyber-attack on an electrical system could temporarily paralyse the functioning of the entire state and its citizens. Consequently, it will create chaos, huge financial losses, decline in citizens' trust in government and the loss of the state's image in the international arena. The actor affected by such an attack will be oriented mainly towards stabilising the internal situation, minimising losses and reconstruction. It will be weaker and discouraged from taking actions on the international arena. Achieving the effect of behavioural changes, in accordance with the plans of the aggressor, without using costly actions in terms of finance and political consequences is extremely attractive.
Hostile actions in cyber-space can be conducted directly via special state units or with assistance of indirect groups of hackers performing outsourced tasks. Disposal of political responsibility and gaining profits at the same time is very tempting. A digital form of the “little green men” can be engaged even more easily than in the real world.
Digital means provide the ability to impact an opponent effectively via the use of modern information warfare. The internet enables you to share simplified, very often attractively formulated emotional content with an unlimited number of peers in a very short period of time. Disinformation, manipulation of facts, trolling – these are the perfect tools for destabilising countries, introducing social tensions, causing disputes, unrest, lowering of trust, influencing perceptions and, in consequence, altering specific actions. It is another method to affect a rival in a negative manner and to lower their security and stability.
All the advantages theoretically resulting from hybrid tactics are oriented towards digital tools. In the right circumstances, the effects can be even more beneficial.
Scenarios in the event of cyber-attacks on Poland
Given its history, Poland is strongly engaged in the political situations beyond its eastern border. Polish actions aiming at strengthening a pro-European course in Ukraine raised concerns in Moscow. Hence, it is not difficult to imagine a situation where, in the event of an escalation of the conflict, the Russian Federation would carry out tactics aimed at causing a state of chaos in Poland, which would create internal problems, leading to a reduction in Polish international activity. The use of cyber-space could be extremely effective in this field.
Growing vulnerability of Poland to cyber-attacks is related to trends and changes in the economic structure of the country. Industry maks a major contribution to Poland's economy. Since the 1990s, the value of industrial production in Poland has been steadily increasing. The main aim of the Polish government in the coming years is to get involved even more strongly and effectively in the processes related to the 'fourth industrial revolution'. A broadly understood digital world is the driving force and the heart of that revolution. The Internet of Things, automation of industrial processes, data processing and many other phenomena that bring new technologies are changing the way of functioning for modern enterprises and, indirectly, entire economies, societies and states.
We live in a reality where the physical world intertwines with the digital world. It has an impact on many spheres of human activity, including issues related to security. In today's world, effective cyber-security becomes a foundation for political, economic and social stability. For developed economies, a most important aspect is to provide cyber-security for industrial control systems. For Poland, while taking a course towards Industry 4.0, it is necessary to understand that cyber-attack might be a new option for potential aggressors.
Hostorically Poland has been torn by conflicts and hostilities, and has often had difficult international relations with its neighbours. It is a country with social divisions, often based on political ideology. It is a fertile ground to lead an information warfare provoking existing tensions and inducing even greater animosity, conflicts and chaos. The actions taken in cyber-space, which belong to information warfare, are already visible and they are likely to occurr very often in the future. Poland is especially vulnerable to its effects. All entities responsible for security and stability need to realise that in case of intensification of geopolitical tensions, it will be one of the tools used for the purpose of weakening Poland.
There is also a third scenario – an open military conflict. As previously mentioned, for now, it is a highly unlikely situation. If it happened that Poland became engaged in a military conflict, cyber-attacks would play a supporting role to conventional actions. They would most likely occur in the first phase of the conflict with the intention of multiplying the effect of the conventional methods and also to making their use easier. Cyber-attacks would be aimed mainly at military targets and civil critical infrastructure.
What should we do?
One of the most basic requirements to provide cyber-security is to understand the threat. A state's circumstances, direction and trends, from which follows, its weaknesses and vulnerabilities and, lastly, its rival's interests and tactics which help to predict possible directions of threats and so enable it to take countermeasures.
Polish decision-makers need to understand that cyber-space is a domain of war which can be especially exploited by rivals. Cyber-threats can take different forms and shapes, and they can be used in various ways, hence, it is necessary to take wide range of measures to strengthen cyber-security. Taking the following steps is crucial:
1. First, it is necessary to strengthen the cyber-security of critical infrastructure. We should pay particular attention to cyber-security of industrial control systems. We should follow existing international standards and introduce national solutions. It is recommended that cyber-security of industrial systems should become a national speciality area of expertise. This will greatly contribute to the idea of development of a European market for cyber-security products and services, one of the highest priorities within the EU. Paradoxically, the circumstances and challenges can have the efffect of mobilising Polish economic operators, who have not previously been sufficiently active in the field of cyber-security. Bearing in mind Polan's potential given its knowledge and skills base, it can be an opportunity for Poland to develop this export sector.
2. Second, we need to understand that in order to effectively counteract the threats that come from cyber-space, we need to have a comprehensive, multidimensional strategy. These activities should be built on the DIMEL model according to which, in order to achieve the objective, we should use all available instruments and resources: D – Diplomacy, I – Information, M – Military, E – Economy, L – Legality. In the case of information, we should realise
that there are countries, which use it for malign purposes, for instance, manipulation.we should launch a well-functioning system of strategic communication based on thoughtful, consistent messages and information activities focused on both individual societies and the whole international community.
3. Lastly cyber-threats constitute a serious danger for a country's defence operation. Military forces need to fully adapt themselves to function in cyber-space. There is a need to develop national defensive and offensive potentials. Poland should also catalyse external processes. It is recommended that Poland support the launch of a serious discussion on the possibility of developing offensive capabilities of NATO (Also see “NATO Road to Cyber-security"). The Warsaw Summit confirmed that cyber-space constitutes another domain for conducting military conflicts. NATO will always remain a defensive organisation and the decision to expand its potential for offensive mechanisms will not change its attitude. The option of potential responses through offensive actions in cyber-space can not only serve as an effective deterrent mechanism of defensive dimension, but, paradoxically, it can also serve as a more humanitarian and more proportional measure of counteraction.
Future conflicts are strongly connected with the even greater use of cyber-space. Recent incidents in Europe have proved it and this trend will only grow. Cyber-security is not only a determinant of stability, but it also provides prosperity and economic development. Countries like Poland, which happen to function in a region affected by specific political tensions, should deeply perceive and understand the multiple dimensions and the variety of threats. The sine qua non of success is to make all resources and instruments operational. This is the reason why cyber-security must be treated not only as a necessity, but also as a strategic action and an opportunity.
Following this idea, The Kosciuszko Institute – a Polish think thank – initiated the European Cyber security Forum – CYBERSEC, believed to be the largest conference devoted to this subject in the CEE region. The CYBERSEC mission is to support and help to develop strategic decisions related to cyber-security within the EU and NATO, and the aim of the annual event is to build a platform for co-operation between key stakeholders in cyber-space. The second edition of CYBERSEC began today and runs 26-27 September 2016 in Kraków.
Contributed by Dr Joanna Świątkowska, CYBERSEC programme director, European Cybersecurity Forum