MP3 - iTunes

Russian-controlled computers are said to have launched Internet attacks against Georgian government Web sites as early as July 20th, well before fighting on the ground began. The denial of service attacks - which flood targets with malicious data - curtailed Georgia's ability to spread its message and communicate with the outside world.

Russia, by the way, denies it was behind the attacks.

Georgia did manage to mount a small counterstrike on the Russian state news agency. According to Internet experts, the cyber attack on Georgia is the first to have roughly coincided with the bombs-and-guns kind of war.

Bill Woodcock is research director at the Packet Clearing House, a non-profit organization that works to develop global network infrastructure. Woodcock was part of a team that helped Estonia defend itself from a cyber attack last year.

The following is an edited transcript of our conversation.

WOODCOCK: Georgia is a very small country. They're very much outmatched in this fight, which means Russia's attack has been much more successful against Georgia than it was against Estonia. There are a few other interesting things. The cost of doing this attack is very, very low and the Georgians realized that and counterattacked. This is something we haven't seen so much -- a two-sided battle between two nation-states in cyberspace. Before it's been one-sided -- a country will attack another country but won't actually provoke a response.

GORDON: So why is this kind of warfare so inexpensive to wage?

WOODCOCK: All of these attacks are done using botnets, which are networks of compromised machines -- machines just like you might have in your home except that they're compromised by viruses that take control of the machine, often without any knowledge of the person who owns the machine. And after that, they're under the control of someone somewhere else. And that person uses those machines collectively to attack some target. The fees for which use of these botnets are rented out is as low as four cents per machine, which means that the whole attack might only cost a few hundred dollars or a few thousand dollars at most. By contrast, defending against these attacks is a far more expensive proposition. It means that you have to build national Internet infrastructure. It's not so much that there's a high dollar cost as it requires a commitment over time. People have to realize this is an issue -- they have to put in effort and attention in order to build a robust infrastructure that isn't so vulnerable to these kinds of attacks.

GORDON: That fact that it's cheap to wage but expensive to defend would suggest this is only the beginning of big cyber warfare that we'll see all over the globe. Is that fair to say?

WOODCOCK: That's a really unfortunate but likely scenario. As people observe how easily these attacks are done and how cost-effective they are, we are going to see a lot more of them.

GORDON: How would you classify American readiness to defend against a cyber attack from China or Russia or anybody else?

WOODCOCK: How well we are prepared to defend ourselves depends upon whom we're defending against because it really does come down to the numbers -- how much bandwidth is available on the defending side versus how much bandwidth is being used on the attacking side. If we have a lot of bandwidth available and we're only using a portion of it and someone with only a little of bandwidth chooses to attack us, that attack will go by essentially unnoticed. On the other hand if a country that had more bandwidth than us chose to attack us they could use a portion of their power while still retaining their ability to get their work done and it would swamp our connectivity. It would use up all of our capacity and we wouldn't be able to get anything done. So the question of whether we could defend ourselves against Russia, certainly we could defend against Russia which is much smaller than the United States still by most measures on the Internet. Against China, no, we wouldn't fare so well.