It's like we, as a society, were on a two-lane road.
The left lane was the physical world, and the right lane was the cyber world.
Now, here we are, passing a sign that says "Lanes Merge Ahead."
And while that seems to be generally okay in an everyday living kind of sense, what does it mean on the battlefield? And when will the impacts of a virtual battle and a physical one be treated the same way?
Iran takes down U.S. drone, U.S. responds with cyber attack
One recent piece of evidence that traditional war and cyber war are merging happened on June 20, 2019.
Iran fired a surface-to-air missile at an unmanned U.S. surveillance drone flying over the Strait of Hormuz and brought it crashing out of the sky.
This is not a drone you see flying above your neighborhood, obviously. It's the RQ-4A Global Hawk surveillance drone with a list price of at least $131 million.
According to the United States Air Force:
"The RQ-4 Global Hawk is a high-altitude, long-endurance, remotely piloted aircraft with an integrated sensor suite that provides global all-weather, day or night intelligence, surveillance and reconnaissance (ISR) capability."
U.S. responds to Iran with cyber weapons
Shooting this drone down, a physical act, was expected by many to lead to a physical military response by the United States.
Instead, President Trump told the world that he had called off a physical military response shortly before it was to happen and he would increase sanctions, instead.
What he did not tell the world is what The Washington Post revealed two days later.
The President gave U.S. Cyber Command the green light to launch a cyber attack against Iran, and the U.S. hit Iranian computer systems that control missile and rocket launches.
In other words, an act of physical warfare (shooting down the drone) led to an act of cyber warfare (a cyber attack) in response.
U.S. steps up its use of cyber consequences
During 2018, the U.S. dramatically shifted the way it talks about cyber warfare and cyber attacks. We were there as former Secretary of Homeland Security Kirstjen Nielsen issued a warning at an annual cybersecurity conference:
"I have a newsflash for America's adversaries. Complacency is being replaced by consequences," she said. "Cyber is not just a target, it is also a weapon."
It appears the United States has just used cyber as a weapon against Iran.
[RELATED: Israel Responds to Cyber Attack with Bombs]
U.S. warning: cyber attack on Iran led to cyber attacks on U.S.
And we've discovered something else is happening when we respond to physical aggression with a cyber response. In the case of Iran, it has apparently shifted the battlefield into the cyber realm.
And we're not done fighting.
This is why the U.S. Department of Homeland Security issued a special alert about an increasing number of cyber attacks from Iran. Attacks which are not only going after U.S. government agencies, but also U.S.-based businesses:
"These efforts are often enabled through common tactics like spear phishing, password spraying, and credential stuffing. What might start as an account compromise, where you think you might just lose data, can quickly become a situation where you’ve lost your whole network."
We recently interviewed USAF Col. (Ret.) Cedric Leighton about Iran.
We spoke to him after his keynote at a SecureWorld cybersecurity conference, and none of what's happening surprises him:
"Although the Iranians are primarily regionally focused, they are also going after the United States. If tensions continue to increase with Iran, we can expect more cyber events to originate from Iran and from the IRGC cyber army."
When will cyber war be treated like 'regular' war?
And when it comes to the merging of traditional war and cyber war, the SecureWorld media team recently came across a thought-provoking perspective on this by the World Economic Forum:
"A worrying indicator is the barrage of cyber attacks to which Ukraine has been subjected since 2014, giving rise to suspicions that Russia is using Ukraine as a test-bed for disruptive attacks of ever greater sophistication, such as CrashOverride, an autonomous exploit designed to enable the remote closing down of electricity-generation systems.
Physical damage arising from activities initiated in the cyber domain is already a reality. Fatalities, at the very least as a second-order consequence of persistent and large-scale digital disruption, may not be far behind."
And when cyber attacks on the United States or other countries result in injuries and deaths, will we treat it as an act of actual war—or like it's just another hack in which bad actors have upped their game?
Will it truly rise to the level of war as defined by various treaties, conventions, and constitutions around the globe?
Technology: a modern war fighter's powerful tools
Remember when war was focused on the physical attributes of your military abilities? Rapid shifts away from that into the cyber realm are continuing as we head toward 2020.
This U.S. General Accounting Office infographic talks about AI, Quantum Computing, and autonomous flying machines, for example:
What is a cyber warfare worst case scenario, anyway?
We suppose cyberwar could mean different things to different people, and we know more than a few who are experts on this concept. That includes Major General (Ret.) Brett Williams, the former Director of Operations at U.S. Cyber Command.
Here's what he told us about his "worst case" cyberwar scenario during our interview at SecureWorld Detroit.
"My concern is a real campaign, right, that may include simultaneous or near-simultaneous attacks against the financial sector, the energy sector, maybe into the air traffic control system, and at the same time it's combined with some type of activity in the real world."
That's scary, isn't it?
And it appears to be a growing possibility as traditional warfighting methods and cyber warfighting methods are used interchangeably to settle disputes.
[RELATED: Search our 'cyberwar' tag for 20+ stories on this topic]
(Drone photo credit: United States Air Force)
