Hyperbole over the term "cyber attack" has led to a misapprehension that they are frequent, says James Andrew Lewis, director of the Center for Strategic and International Studies' technology and public policy program, in a July 11 commentary on the CSIS website.

"There have been many annoyances, much crime, and rampant spying, but the only incidents that have caused physical damage or disruption to critical services are the alleged Israeli use of cyber attack to disrupt Syrian air defenses and the Stuxnet attacks against Iran's nuclear facilities," he says.

A recent spate of activity by hacker groups Anonymous and Lulzsec--including penetrations of some government-affiliated organizations such as InfraGard and distributed denial of service attacks against federal websites--doesn't meet the attack threshold, Lewis says. "These were political actions--cyber demonstrations and graffiti--spun up by media attention and copycatting."

Cyber action isn't an attack until it causes physical damage or casualties, Lewis says. That means that DDoS efforts against Estonian and Georgian websites in 2007 and 2008 also weren't attacks, even if the latter example is an indicator of how Russia will use cyber warfare, he adds.

Some nations, including Russia, argue that information itself forms the core of a new kind of warfare, an argument Lewis dismisses.

"Publishing or sharing an idea is not the use of force. Though an expanded definition of warfare may serve the political interests of authoritarian regimes, it is not an accurate description of military action or attack."

An actual full-blown, no-holds bared cyber attack against U.S. infrastructure might be able to inflict damage on the scale of Hurricane Katrina, but even multiple, simultaneous Katrinas would still not guarantee victory for an opponent, Lewis says. Pure cyber war--keyboard versus keyboard--is unlikely, he adds, since that mode of attack isn't destructive enough to damage an opponent's will and capacity to resist.

For more:
- go to Lewis's July 11 commentary

Related Articles:
Lewis: Privacy precepts need revising in light of new cybersecurity measures 
Lynn: Norms for offensive cyber action are not different from kinetic 
United States and India agree to share cyber threat information