Page 214

REVISTA IEEE 9

216 Journal of the Spanish Institute for Strategic Studies Núm. 9 / 2017 happen, for example, in a judicial process. It is very difficult for authorship to remain hidden when action takes place within a framework of pre-existing rivalry12. Thus, for example, it is logical, when South Korea finds itself under cyber-attack, to look to its neighbor to the north13, or when Georgia and Ukraine undergo cyber-sabotage, that they should suspect Russia. Therefore it is very debatable whether the use of cyber warfare is an activity free from cost to the user because of the impossibility of attributing responsibility14 . Regarding the supposedly low cost of cyber attacks, this is a case of erroneous perception whose origin is located in extending to the military use of cyberspace the modus operandi of cybercrime, which is largely based on the use of automated tools, cheap and easily accessible, to carry out hundreds of thousands of attacks against computers and devices having low or deficient security. These are “scalable” attacks, where the cost of the operation does not increase linearly with the number of objectives attacked, which permits the indiscriminate use of malicious software to capture data from the victims, take control of their equipment, or simply cause involvement in a scam. However, in the case of attack on individualized objectives equipped with good protection, or with unique characteristics, the reference is to non-scalable attacks, which demand a supplementary force for each additional unit, as well as having available intelligence resources which provide extensive knowledge of their objective, and the capacity to test the vector of attack before their use15. Although the economic cost of cyber warfare is far below what a State would have to invest in acquiring a complex arms system, its cost is not negligible. In an exercise carried out by the United States in 2002, it was estimated that the carrying out of a major cyber attack would require a budget of 200 million dollars, as well as a period of five years for its implementation16. In spite of the popular imagery, the possibility of taking control and causing damage or anomalous behavior in critical infrastructure (as might be a nuclear plant), using only a computer connected to Internet, is an unreal scenario. The true entrance threshold is found in the capacity to mobilize objective-recognition resources, human and signal intelligence, the use of operatives on the ground, multidisciplinary teams of technicians and experts equipped with 12  AXELROD, Robert, “A Repertory of Cyber Analogies”, in GOLDMAN, Emily O. and ARQUILLA, John (eds.) “Cyber Analogies”, Monterey, CA. Department of Defense Information Operations Center for Research, 2014. 13  INKSTER, Nigel, “Cyber Attacks in La-La Land”, Survival: Global Politics and Strategy, vol. 57, nº 1 (February-March 2015), pp. 105-116. 14  RID, Thomas and BUCHANAN, Ben, “Attributing Cyber Attacks”, Journal of Strategic Studies, vol. 38, nº 1-2 (2015), pp. 4-37. 15  LINDSAY, John R., “Proxy Wars: Control Problems in Irregular Warfare and Cyber Operations”, International Studies Association annual meeting, San Francisco (April 2013). 16  PURCHASE, Eric and CALDWELL, French, “Digital Pearl Harbor: A Case Study in Industry Vulnerability to Cyber Attack” in GHOSH, Sumit, MALEK, Manu and STOHR, Edward A. (coord.), “Guarding Your Business: A Management Approach to Security.” New York, Springer, 2004. http://revista.ieee.es/index.php/ieee

REVISTA IEEE 9
To see the actual publication please follow the link above