6th European Conference - Academic Conferences

Theoretical Offensive Cyber Militia Models
Rain Ottis
Cooperative Cyber Defence Centre of Excellence, Tallinn, Estonia
rain.ottis@ccdcoe.org
Abstract. Volunteer based non-state actors have played an important part in many international cyber conflicts of
the past two decades. In order to better understand this threat I describe three theoretical models for volunteer
based offensive cyber militias: the Forum, the Cell and the Hierarchy. The Forum is an ad-hoc cyber militia form
that is organized around a central communications platform, where the members share information and tools
necessary to carry out cyber attacks against their chosen adversary. The Cell model refers to hacker cells, which
engage in politically motivated hacking over extended periods of time. The Hierarchy refers to the traditional
hierarchical model, which may be encountered in government sponsored volunteer organizations, as well as in
cohesive self-organized non-state actors. For each model, I give an example and describe the model’s attributes,
strengths and weaknesses using qualitative analysis. The models are based on expert opinion on different types
of cyber militias that have been seen in cyber conflicts. These theoretical models provide a framework for
categorizing volunteer based offensive cyber militias of non-trivial size.
Keywords: cyber conflict, cyber militia, cyber attack, patriotic hacking, on-line communities
1. Introduction
The widespread application of Internet services has given rise to a new contested space, where
people with conflicting ideals or values strive to succeed, sometimes by attacking the systems and
services of the other side. It is interesting to note that in most public cases of cyber conflict the
offensive side is not identified as a state actor, at least not officially. Instead, it often looks like citizens
take part in hactivist campaigns or patriotic hacking on their own, volunteering for the cyber front.
Cases like the 2007 cyber attacks against Estonia are a good example where an informal non-state
cyber militia has become a threat to national security. In order to understand the threat posed by
these volunteer cyber militias I provide three models of how such groups can be organized and
analyze the strengths and weaknesses of each.
The three models considered are the Forum, the Cell and the Hierarchy. The models are applicable to
groups of non-trivial size, which require internal assignment of responsibilities and authority.
1.1 Method and limitations
In this paper I use theoretical qualitative analysis in order to describe the attributes, strengths and
weaknesses of three offensively oriented cyber militia models. I have chosen the three plausible
models based on what can be observed in recent cyber conflicts. The term model refers to an abstract
description of relationships between members of the cyber militia, including command, control and
mentoring relationships, as well as the operating principles of the militia.
Note, however, that the description of the models is based on theoretical reasoning and expert
opinion. It offers abstract theoretical models in an ideal setting. There may not be a full match to any
of them in reality or in the examples provided. It is more likely to see either combinations of different
models or models that do not match the description in full. On the other hand, the models should
serve as useful frameworks for analyzing volunteer groups in the current and coming cyber conflicts.
In preparing this work, I communicated with and received feedback from a number of recognized
experts in the field of cyber conflict research. I wish to thank them all for providing comments on my
proposed models: Prof Dorothy Denning (Naval Postgraduate School), Dr Jose Nazario (Arbor
Networks), Prof Samuel Liles (Purdue University Calumet), Mr Jeffrey Carr (Greylogic) and Mr
Kenneth Geers (Cooperative Cyber Defence Centre of Excellence).
2. The forum
The global spread of the Internet allows people to connect easily and form „cyber tribes“, which can
range from benign hobby groups to antagonistic ad-hoc cyber militias. (Williams 2007, Ottis 2008,
Carr 2009, Nazario 2009, Denning 2010) In the case of an ad-hoc cyber militia, the Forum unites likeminded
people who are “willing and able to use cyber attacks in order to achieve a political goal.“
307