Schneier: mandate cyber weapons self-destruct

If cyber is the new space for dog fights, then the world, and in particular the US, needs to adopt a treaty that mandates the weapons self-destruct, says security philosopher Bruce Schneier.

Whoever is behind Flame, the latest poster child of state-sponsored cyber warfare, got part of the equation right, according to Schneier’s roughly sketched framework outlined in a post on US News.

The fat, targeted and now widely-considered ‘sophisticated’ Flame malware contained a “SUICIDE” module that let its controllers instruct it to self-destruct.

If cyber war is going to be fought, then nations that wage it should agree to terms that include the technical capability to stop the fight when that cyber-scuffle comes to end, in Schneier’s view.

Like weapons designed to kill in a battle scenario, cyber weapons should be designed to minimise the harm to innocent bystanders— or civilians and other non-participating civilian organisations.

“Banning cyber weapons entirely is a good goal, but almost certainly unachievable. More likely are treaties that stipulate a no-first-use policy, outlaw un-aimed or broadly targeted weapons, and mandate weapons that self-destruct at the end of hostilities,” wrote Schneier.

Schneier has made basically the same argument before in an opinion piece published in the Financial Times in 2010.

However, one of the key differences today is that back then there weren’t two real example—even though they were (by today’s accounts) either in-development or making their way to their intended targets.

A new point Schneier makes is that there’s a misconception, particularly within the US military, that because it has a technical offensive edge, it is not in its interest to enter into treaties that might limit its capacity to use these tools.

But this thinking is not right, he says.

“We might have an offensive advantage—although that's debatable—but we certainly don't have a defensive advantage. More importantly, as a heavily networked country, we are inherently vulnerable in cyberspace.”

Follow @CSO_Australia and sign up to the CSO Australia newsletter.

• Tweet