When considering the terrain of cyber space we have a tendency to make that terrain as limited as possible. Most people equate the Internet to the world wide web. The world wide web though is a much smaller entity than the Internet. The world wide web is that address space on the Internet that is available through the domain name servers (.com, .org, .net) using the hyper text mark up language. A much generalized explanation but good enough for this discussion. Though many consider the Internet to be the “big” picture it is still only one part of a much larger system.
The Internet is the computer and telecommunications network available through the internet protocol suite. This is a very large network and much of the worlds devices are available through this medium. Even then there are larger deeper networks that physically dwarf the Internet in reach such as the deep space network. The deep space network is the system of satellites, radios, computers, and connections that allow for telemetry from devices like the Mars rover to be reached by earth. Limiting our scope though to the earth there is still the fact that the Internet is smaller than the totality of cyber space.
The military refers to something called the global information grid. Much like the Internet was borrowed from the military early on we are going to borrow this term. The global information grid is the totality of information devices, processes, people, things, sensors, channels, data, voice, radio, Radar, and all that stuff I haven’t even brought up. Whereas the Internet is constrained by the Internet protocol suite the global information grid is inclusive of special custom protocols.
This is important as constraining the environment may make it easier for us to understand but it does not allow for the totality of the risks associated with cyber warfare. When Gibson in 1984 was discussing the concept of cyberspace his example was a global reaching environment including mind-machine interfaces. Many considered this to be the Internet but that was in error. The scope is much larger and as such the attack vectors are much larger too.
The people that examines these issues have for a long time considered the scope and challenges. Attacking the weak technology used for keyless entry of vehicles is an example of something that exists in cyber space but not on the Internet. Other examples include wireless pacemakers. By falsely constraining cyber warfare, that conflict that exists in cyber space, to the Internet alone kinetic results can be expected to be minimal. As such the actual vulnerability to infrastructure attack is much higher than simplistic risk metrics and models might suggest.
This issue has also created significant issues with doctrine and military thought on what cyber warfare might look like. I have in the past challenged Joint Publication 3-13 “Information Operation” as not going far enough. Within that document it covers the idea of computer network attack, computer network exploitation, and computer network operations, but usually people stop there. You can further expand the topic under JP 3-13 to electronic warfare but the scope and span of the problem is much larger. The definitions under each topic need to be expanded or the there needs to be a new doctrinal type document for cyber warfare.
When we consider cyber warfare simplistic attacks such as denial of service make a big splash in the media. The availability of a service or the integrity of a web page are but the frosting on a mile high cake of technologies. Cyber hooliganism is not cyber warfare. Consider that there is more to the technologies subject to attack than the computer you are reading this on. In most modern cars there is a substantial number of device specific computers from the ignition system to the airbag deployment device. Consider a cyber attack against the airbag deployment device where it is activated as you are driving down the Interstate. Consider the deactivating the ignition system of your vehicle when you least expect it.
Some of these attack vectors use the Internet as a portal to access other devices on the global information grid. Though the technologies in question are not on the Internet their command and control functions are available through devices that are on the Internet. This is why those who say that cyber warfare does not represent a threat, does not have kinetic results, or can not see the risks have to be educated in a meaningful way. The totality of the issues is much larger than the Internet and cyber warfare is not constrained by the Internet. Gateway and portal devices are rarely realized by information assurance and security experts for the danger they pose.