A pure "cyberwar" is never going to happen. That's one conclusion of a major report on cybersecurity (PDF) from the Organization for Economic Co-operation and Development (OECD). Authored by two UK professors, the report argues that Internet attacks and espionage will be key components of all future conflicts, but that the world is unlikely ever to see a cyberwar with "the characteristics of conventional war but fought exclusively in cyberspace."



The report lays out the argument:



The reasons are: many critical computer systems are protected against known exploits and malware so that designers of new cyberweapons have to identify new weaknesses and exploits; the effects of cyberattacks are difficult to predict—on the one hand they may be less powerful than hoped but may also have more extensive outcomes arising from the interconnectedness of systems, resulting in unwanted damage to perpetrators and their allies. More importantly, there is no strategic reason why any aggressor would limit themselves to only one class of weaponry.



Instead, cyberweapons like trojans, viruses, and denial of service attacks will "shortly become ubiquitous"; indeed, the apparent recent success of the Stuxnet virus at crippling Iran's nuclear enrichment program shows just how successful such attacks can be.



The report is part of OECD's "Future Global Shocks" series, in which thinkers from various disciplines assess whether events in their fields might become as damaging to the world as the recent financial crisis or a global pandemic. Single online events, such as a major DDoS attack, are unlikely to have such worldwide effects, but the combination of something like a botnet DDoS attack, a major EMP, and specific attacks on SCADA or other computer-controlled machinery, and some form of real-world "kinetic" attack might well shock the world.



"Contrary to much recent writing, single hazards and threats in the cyber domain will probably not propagate into a full-scale global shock," says the report. "However there are several plausible scenarios which if realised will have significant impact at the level of the nation state as well as causing long-term damage to businesses and individuals." Most likely among these is "cyberweaponry acting as a disrupter or force multiplier."



As for defending against such attacks, the report outlines a host of national and international strategies, but it makes clear the old Cold War doctrine "you won't attack us because you know we'll destroy you in return" doesn't work in today's online world; it's simply too difficult to know who is behind the most sophisticated attacks. Mere deterrence is therefore "unlikely to be effective."

Instead, cyberweapons like trojans, viruses, and denial of service attacks will "shortly become ubiquitous";