Not if or when, cyber war is happening now

This spring has seen an unprecedented number of events under the topic of cyber war. You may have missed it, but the House Intelligence Committee Chairman Mike Rogers (R-Mich.) said that the United States is unprepared for a cyberattack. Well, that is not new to most people who follow or are involved in cybersecurity. His follow-on assertion that a “catastrophic cyberattack” is expected within 12 to 24 months was new. But still, that was not the comment that raised the eyebrows of cybersecurity practitioners and political pundits. Chairman Roger’s stated, “We are today involved in a cyber war.”

Some call his remarks fear mongering. Some dismissed these comments as a thinly veiled effort to gain support for cybersecurity legislation currently under consideration by Congress. Others point to Roger’s unique insights due to the classified information he has access to as chairman of the House Intelligence Committee. But there is more.

Now consider in a recent “This Week” interview with Defense Secretary Leon Panetta who stated that, “There’s no question that if a cyberattack crippled our power grid in this country, took down our financial systems, took down our government systems…that that would constitute an act of war.”

In addition, there’s the news leaking out about the Defense Advanced Research Projects Agency’s Plan X that funds initiatives within the private sector, universities and even computer-game companies that develop technologies to improve the Defense Department’s cyber warfare capabilities. We must also point out that in the face of a total defense budget reduction of more than $1 trillion over 10 years, Deputy Defense Secretary Ashton Carter said cybersecurity is another area where DOD will spend more in the future.

How real is the cyber threat and are we over reacting? Some seem to think so, but there are clear indicators to the contrary. Is this more than rhetoric? You better believe it is. One of the most dramatic increases in the cyber threat to the United States comes from Iran. Since the Stuxnet incident of 2009-2010, Iran has accelerated the development of advanced offensive and defensive cyber capabilities. Iran put in place a robust program including education, research and development, cyber intelligence collection, exercises to evaluate their cyber capabilities and response and a number of other initiatives that were created to give the rogue regime a world-class cyber capability.

At the same time, an Iranian natural gas pipeline exploded and their main oil exporting facility were both shut down recently by cyberattacks. All that occurred before the most recent discovery of Flame, a cyber-intelligence-gathering piece of malware that severely infiltrated sensitive computers within Iran and other countries in the Middle East. Knowledgeable sources report that Flame collected untold amounts of intelligence during its 20-plus-month span of operations, and there are unsubstantiated reports that Flame has been active for five years or possible longer.

Iran is not taking this latest act of cyber aggression lying down. Brig. Gen. Hossein Salami of Iran's elite Revolutionary Guards has openly stated that it would fire missiles at all enemy bases in the region if the country is attacked. We have moved into uncharted territory. Does Iran consider Flame a cyberattack and was that a consideration in the brigadier general’s comment? It now appears that the Iranian leadership believes it is already under attack. Iran's Foreign Ministry said cyberattacks against the Islamic republic are launched by hostile governments as part of a broader "soft war" and will fail. This is the third year in a row that cyber weapons have successfully targeted infrastructure within Iran.

Now add to all of this the recent article that discloses the U.S. and our ally Israel’s involvement in the cyberattack on Iran’s nuclear program, and the likelihood of increased cyber hostilities seem to be a sure bet. When you look at all this in totality you cannot help but think that we are on the brink of an intense cyber war with Iran. No one knows for sure because no one has bothered to define what constitutes an act of cyber war. Many have posed this question, but there is still no definitive answer.