War-Gaming CyberStruggle, Circa 1999
Given recent debates over the size of the threat posed by cyberwar, I thought I’d mention the following simulation that was done by the RAND Corporation in 1999. The excerpt is from Brian Persico’s article Under Siege: The Jurisdictional And Interagency Problems Of Protecting The National Information Infrastructure, in the CommLaw Conspectus:
The object of the study was to assess the decision making process during a major hypothetical “information warfare” attack launched against the United States during a crisis in the Persian Gulf region. Based upon the RAND Corporation’s projected trends in the world’s geopolitical balance of power, the exercise’s scenario was based upon a fictitious split between members of the Organization of Petroleum Exporting Countries (“OPEC”) over levels of oil production. Simultaneous with the study’s fictitious disruption in relations, simulated infrastructure break-downs occurred in Saudi Arabia, Egypt, and the United States.
Reports that the banking system of the United Kingdom was compromised by hacking resulted in a sharp drop in worldwide stock markets as investors feared that fund transfer systems were compromised were also added to the simulation’s fact pattern. This drop, combined with massive increases in the price of oil, resulted in a looming worldwide economic collapse. In addition, a successful disinformation campaign led to media reports that the United States government was on the brink of an aggressive and unprovoked war in the Persian Gulf Region. Evidence was presented to the participants suggesting that these incidents were the result of coordinated attacks on critical NII components in support of a coup attempt in Saudi Arabia backed by Iran.
The scenario raises many interesting legal questions, including government counterspeech, catastrophe preparation, and emergency powers. It also reminds me of a fundamental point from the Top Secret America series in the Washington Post: information technology and threat assessment are core parts of today’s national security infrastructure. Tens of billions of dollars are spent each year to understand whether scenarios like this are likely to come to pass.