By Dr. Dale A. Lambert, Chief, Cyber and Electronic Warfare Division, Defence Science and Technology (DST) Group, Department of Defence
The Industrial Revolution introduced machines that could perform physical work previously only undertaken by people. Moreover, these machines could exceed human capability by delivering greater volume (e.g. Model T mass production), greater velocity (e.g. Adam Smith’s pin factory specialisation), and greater variety (e.g. modular assembly line reuse). As it matured, the Industrial Revolution gave birth to digital computers, machines that could perform mental work previously only undertaken by people. Digital computers of various forms have spawned a second revolution, the Digital Revolution.
• We are sensing almost everything digitally - there will be a trillion individual sensors in the world by the early 2020s.
• We are describing almost everything digitally –of the seven and a half billion people in the world, there are an estimated two billion Facebook users.
• We are distributing almost everything digitally, connecting all our physical and virtual devices into the Internet of things.
We are effectively replicating the world in digital form and potentially making it accessible to anyone, anywhere.
The Digital Revolution introduces an intervening digital layer between our physical layer industrial machines and our human layerselves. We no longer directly control our industrial machines. The digital layer now controls our industrial machines and we like to think we control the digital layer. Stuxnet provided the first public realisation that the digital layer is not controlled. The digital layer is a contested environment. The public realisation of this engendered a cyber security emphasis aimed at eliminating vulnerabilities through patches, formal verification, and the like. These are necessary ventures, but they only mitigate the problem. Vulnerabilities are features, not just flaws. A verified travelling salesman algorithm becomes a vulnerability in the context of too much data, because NP-hardness is a feature of that algorithm. The electromagnetic radiation emitted from a piece of hardware can be used to characterise what it is doing, and in the right context, this can be a vulnerability. Static protection cannot secure all features in all contexts. The dynamic contested digital layer is about understanding the strengths and weaknesses of our systems and components, reasonably protecting them, and then contextually exercising defensive and offensive manoeuvres to effect our intent. It is about being fight-ready (protect) and being able to fight-through (defend) and fight-back (attack).
The longer-term cyber security challenge extends well beyond patching flaws
The Digital Revolution has ushered in an era of Digital Warfare.
The physical and human layers are being impacted by their reliance on the digital layer that separates them.
To be fight-ready, our physical systems need to be protected, including from components sourced from untrusted supply chains. Physical-digital interdependence also requires fight-through and fight-back. Electromagnetic energy has long been used to disrupt or destroy an adversary’s electronic systems by understanding the rigid features (e.g. operating frequency) of those electronic systems. But the digital layer has rendered those features agile (e.g. frequency hopping) and so now an adversary applies machine learning to predict agile manoeuvres, and a cat and mouse contest ensues within the electromagnetic spectrum.
People often think of insider threats when considering the human-digital interdependence, and indeed to be fight-ready DST has a team of psychologists with instruments that can statistically predict insider risks. However, the impact of human-digital interdependence also extends to fight-through and fight-back. The two most dominant explanations of what truth is are the Correspondence and Coherence theories of truth. Correspondence says a statement is true if what it says about the world accords with the world. Coherence says a statement is true if what it says about the world accords with a set of (trusted) peoples’ beliefs. But we now source correspondence truth through the digital reproduction of the world, rather than the world itself, and we source coherence truth through the same digital layer as everyone else. Manipulate the digital layer and you manipulate what truth is taken to be. Contest in the digital layer has become a contest over truth.
So how did it come to this? It began as a communication problem in the 1940s. On the one hand we had expectant human users flushed with rich conceptualisations, while on the other hand we had complex electrical circuits like ENIAC that could be controlled by only a privileged few. The Von Neumann team reconceptualised the electrical devices as logical devices, introducing concepts like memory, stored programs and binary coding. The Digital Revolution was then propelled by an Automation Principle – if using the machine involved tasks that were mechanical, tedious, error prone or prevalent, then those tasks should be automated within the machine and thereafter interfaced to as if they were primitive operations of the machine. This invited machine evolution and a progression of machine languages, assembly languages, floating point arithmetic, higher-level languages, graphical user interfaces, desktop metaphors, speech interfaces, natural language understanding, automated reasoning, et cetera, followed. The Automation Principle reduced the communication problem distance by incrementally embedding human conceptualisation within the machine. Digital Warfare emerges from this progression. It is a corollary of embedding human conceptualisation, and therefore human nature, into our machines.
So what of the future? Like the Industrial Revolution, the Digital Revolution offers the benefits of greater volume (e.g. big data), greater velocity (e.g. digital streaming) and greater variety (e.g. new discovery through machine learning) and so Digital Warfare is increasingly becoming a contest conducted between autonomous machines. Autonomous Digital Warfare is in its infancy. As the Automation Principle pushes machines closer to the Automation Limit, where machines become functionally indistinguishable from people, the current pattern based machine learning approaches to autonomous cyber operations will be superseded by more sophisticated solutions with embedded human semantics. DARPA’s recent Explainable Artificial Intelligence program forecasts this development. The longer-term cyber security challenge extends well beyond patching flaws. In the context of digital reliance, the cyber security challenge for humanity lies with the conceptual morality that is embedded within our future machines.