Cyber threats, US-Russian strategic stability and future nuclear reductions by Dr. Andrew Futter, University of Leicester

1. www.le.ac.uk
War Games Redux?
Dr. Andrew Futter, University of Leicester
ajf57@le.ac.uk
Cyber threats, US-Russian
strategic stability and future
nuclear reductions

2. Introduction: when science fiction
becomes reality
• War Games (1983)…
– A scenario that is becoming disturbingly real…?
• Could hackers break into nuclear C2 and somehow cause a
nuclear launch or explosion/ or stop systems working?
• This threat has been exacerbated by the current downturn
in strategic US-Russia relations
– Makes the issue particularly pressing
• Global Zero Commission:
– “Questions abound: could unauthorized actors – state
or non-state – spoof early warning networks into
reporting attack indications that precipitate
overreactions? Could such hackers breach the firewalls,
the air gaps, and transmit launch orders to launch crews
or even to the weapons themselves? What if an insider
colluded with them to provide access and passwords to
the launch circuitry? Might they acquire critical codes by
hacking?”

3. What is cyber and what is at risk?
• “Cyber” is fundamentally contested…
– “Anything bad that involves a computer...”
– Ranges across different spectrums
• Perhaps best thought of as a context rather than as a set
of “weapons”
• Applies right across the nuclear weapons enterprise
– “US nukes under attack from a “full spectrum of
hackers”
– Russia now employs nuclear anti-hackers
• Age old problem of nuclear C2
– The “Always-never dilemma” and keeping forces
secure
– More focus in usability…
– Cyber as major challenge and impediment to A-C
and strategic stability

4. Cyber and US-Russia strategic
stability
• Despite the re-set and New START Treaty
relations have deteriorated markedly
– NATO, BMD, rhetoric, INF treaty
• Exacerbated by events in Ukraine
– Alert Russian forces; US missiles to
Europe…
– Nadir not seen since the 1980s
• Cyber creating new challenges and
vulnerabilities across C2
– And is making this much more worrying…
– These include both enabling and disabling
attacks
– It is not just about terrorist or outsider
hackers…

5. The logic of de-alerting
• Challenge particularly acute for US and Russia
– Though will impact all
• There are approx 1800 warheads on high-alert
– Some need only minutes to be fired
– “Anachronistic hang over Cold War”
– 2010 FE Warren Air Base…
• The nightmare scenario…
– Terrorists/ lone wolf hackers somehow
precipitate a nuclear launch
• Either directly or indirectly
• Methods of protection
– PALs etc…Air Gapping
• But these are not fool-proof – problems increase
with modernisation
• Particularly acute during a crisis
• “Keeping missiles off high alert could prevent
nuclear war” – General Cartwright

6. But, new problems for stability and
arms control too
• Cyber enablement and “terrorists” dominate the debate
– But cyber might also be used by the US and Russia against
each other
• Hinder, disable, prevent, undermine C2
• Challenge appears particularly acute for Russia
– C2 deteriorating, no early warning satellites, Stuxnet
– But concern for US too
• Not just cyber on its own
– In conjunction with other forces (BMD, precision strike
etc.)
– Unlikely precursor to a first strike but increasingly
concern…
• Net result, risk of disablement dominates
– Big problem for A-C, stability and cuts
– Kept forces alerted
– Risk of “use them of lose them” thinking…

7. Towards a new cyber-nuclear
security dilemma?
• Cyber further complicates strategic stability between nuclear
armed states
– Augments other strategic developments (BMD, PGS etc.)
• States unlikely to attempt to undermine nuclear C2 and launch
a first strike
– But the perception is real: could assured deterrence be
vulnerable?
– Concerns about US “full-spectrum missile defense” concept…
• Problems become magnified during a crisis
– Third party/ terrorist threat/interference
• US-Russia
– Alerted nuclear forces, pose serious risk
– Russia E-W problems
• “vulnerability to cyber attack … is the new wild card. Having many
far flung missiles controlled electronically through an aging and
flawed command and control network and ready for launch upon
receipt of a short stream of computer signals is a nuclear (surety)
risk of the first order” (Global Zero Commission)

8. Unintended escalation?
• It is often unhelpful to view cyber as a separate
“domain”
– Cyber will likely to used in conjunction with other
kinetic forces
– But, linking cyber and nuclear is complicated…
• Future conflict highly likely to include cyber
– Disrupt communications; DDoS; “spoofing”; direct
attacks
– Prevent access to information
– Increase pressure to act “use it or lose it”
– Compress the escalation ladder?
– Third party interference…
• The importance of perceptions and risk
– “A nuclear-armed state faced with a sudden burst
of holes in its vital warning and response systems
might, for example, press the preemption button
instead of waiting to ride out the attack and
retaliate.” (Cimbala)

9. Ways forward and options for arms
control?
• Harden C2 against outside attack
– Firewalls, redundancy, upgraded comms, cables, encryption, training, PRP
(the human element)
– More vulnerable as modernised…
• International cyber arms control (UN?)
– Build on BWC, prohibit certain attacks
– This will not be easy!
• Verification, attribution, definitions
• Specific C2 moratoria/ agreement?
– US-Russia or more broadly (P5?)
– Problems of third parties and verification
• Comprehensive strategic dialogue
– All issues on the table… its not just nukes
• Threats of disablement must be prioritized…
– No panacea… But only credible way back to A-C, stability and cuts?

10. Conclusions
• Cyber represents a significant new challenge
– Will effect all states, but particularly US and Russia
– It is exacerbating rather than fundamentally shifting
problems for C2 and strategic stability
• De-alerting and cuts are an obvious
solution but are far from straightforward
– This is because the cyber
challenge is twofold
– And because focus is on credibility
in the current climate
• Focus must shift to stability in the short term to protect against
cyber attacks in the medium to long term
– A “management strategy?”
– This wont be easy…but most sensible way forward
• Future political landscape is uncertain…