The 36 Stratagems for Cyber Attacks

No one can say for certain who wrote these 36 martial proverbs; however, some Chinese historians date them as far back as the Southern Qi dynasty (479–502), which was about 1,000 years after Sun Tzu wrote The Art of War. The 36 stratagems have a darker connotation than The Art of War, focusing solely on acts of trickery, mischief, and mayhem—more the province of spies than soldiers. This makes the ancient document an inspiring resource for today’s Chinese nonstate hackers, who rely on creating ruses to trick unsuspecting Internet users into leaving the safety of their firewalls for dangerous terrain. It’s also interesting to note that, unlike Russia, since 2011 China has never engaged in military action where cyber warfare was a component, allegedly opting instead for acts of cyber espionage:

Stratagem #3: “Kill with a borrowed knife”

This stratagem advises “Attack using the strength of another (in a situation where

using one’s own strength is not favourable).”

This could just as easily apply to the use of botnets as a means to launch DDOS attacks.

Stratagem #8: “Openly repair the gallery roads, but sneak through the passage of Chencang”

This stratagem advises “Deceive the enemy with an obvious approach that will take a very long time, while surprising him by taking a shortcut and sneak up to him. As the enemy concentrates on the decoy, he will miss you sneaking up to him.”

Use backdoors or Trojan worms when attacking a network.

Stratagem #10: “Hide a knife behind a smile”

This stratagem advises “Charm and ingratiate yourself with your enemy until you

have gained his trust. Then move against him.”

This could describe phishing schemes or other social engineering attacks.

Stratagem #15: “Lure the tiger out of the mountain”

This stratagem advises “Hold out baits to entice the enemy.” This refers to luring an opponent from a position of strength, such as being protected by a firewall and updated anti-virus program, to a position of weakness or vulnerability.

One way to accomplish this is with the adoption of social engineering techniques to get the target to accept a fake email as genuine and open a compromised attachment or click on an infected link.

Stratagem #17: “Tossing out a brick to get a Jade gem”

This stratagem advises “Bait someone by making him believe that he gains something and obtain something valuable from him in return.”

This could equate to a social engineering technique used to get the target to click on a link or visit a website where information will be covertly collected without his knowledge.

Stratagem #30: “The honey trap”

This stratagem advises “Send your enemy beautiful women to cause discord within his camp.”

In contemporary computer parlance, this could refer to a honey pot, which lures visitors to a rigged site that collects information about them.

The 36 stratagems, like The Art of War, still plays a large role in shaping Beijing’s military strategy. Western policymakers should be familiar with both historical documents if they wish to understand the strategy underpinning the Chinese threat landscape.

Six Criteria for Evaluating Cyber Attacks as Armed Attacks

Michael N. Schmitt’s Six Criteria

The meaning of these criteria are as follows:

1. Severity looks at the scope and intensity of an attack. Analysis under this criterion examines the number of people killed, size of the area attacked, and amount of property damage done. The greater the damage, the more powerful the argument becomes for treating the cyber attack as an armed attack.

2. Immediacy looks at the duration of a cyber attack, as well as other timing factors. Analysis under this criterion examines the amount of time the cyber attack lasted and the duration of time that the effects were felt. The longer the duration and effects of an attack, the stronger the argument that it was an armed attack.

3. Directness looks at the harm caused. If the attack was the proximate cause of the harm, it strengthens the argument that the cyber attack was an armed attack. If the harm was caused in full or in part by other parallel attacks, the weaker the argument that the cyber attack was an armed attack.

4. Invasiveness looks at the locus of the attack. An invasive attack is one that physically crosses state borders, or electronically crosses borders and causes harm within the victim-state. The more invasive the cyber attack, the more it looks like an armed attack.

5. Measurability tries to quantify the damage done by the cyber attack. Quantifiable harm is generally treated more seriously in the international community. The more a state can quantify the harm done to it, the more the cyber attack looks like an armed attack. Speculative harm generally makes a weak case that a cyber attack was an armed attack.

6. Presumptive legitimacy focuses on state practice and the accepted norms of behavior in the international community. Actions may gain legitimacy under the law when the international community accepts certain behavior as legitimate. The less a cyber attack looks like accepted state practice, the stronger the argument that it is an illegal use of force or an armed attack.

See Schmitt, supra note 16, at 913–15; see also Wingfield, T. 2000. The Law of Information Conflict: National Security Law in Cyberspace. Ageis Research Corp. 124–27 (examining Schmitt’s use of force analysis).