Introduction There is a long track record of concern around man-made cascading chain reactions that could quickly expand out of control, causing a cataclysm. In 1942, for example, in the midst of the Manhattan Project, before Trinity, the first fission explosion test, physicists Teller and Oppenheimer expressed concern that the bomb they were building might ignite Earth's atmosphere, in a cataclysmic fusion chain reaction, that could destroy the planet. (Horgan, 2015). Novelist Kurt Vonnegut's 1963 novel, Cat's Cradle, with its point of departure in the atomic bombing of Hiroshima, posited a crystalline structure of solid water, 'ice nine', stable at room temperature (Vonnegut, 1961). Introduction of just one ice nine seed molecule anywhere on Earth would lead to a crystalline replication chain reaction that would remove liquid water from the entire planet, destroying in the process all life on Earth. (Rovner, 2017). In 2008, in the run up to the inauguration of CERN's Large Hadron Collider (LHC), beneath Geneva, lawsuits were filed as far away as Hawaii, seeking to block the particle smasher, over concerns that this most highly targeted of endeavors, which aims particle beams along extraordinarily narrow geometries, might set off unintended reactions, spawning black holes, which might then swallow the entire Earth. (Muir, 2008). Each of these theses involved a hypothetical cascading process that might spread exponentially, out of control, leading to wide-spread destruction. While CERN's LHC is operating today, without apparent black hole production, and Earth's atmosphere has not ignited during fission or fusion explosions, and ice nine has not yet seized up Earth's waterways, there is one domain today which has been proven ripe for uncontrolled spread of destructive change; the internet, and all its connected computers. WannaCry spread to 300,000 computers in 9 hours in May 2017, a spread that was attenuated only by the confluence of two unlikely and fortuitous developments; 1) inclusion of an apparently unintentional kill switch in the 'Franken-attack' package, and 2) discovery and activation of that kill switch, by a UK researcher. 1.1 Mechanisms of collateral damage in cyber attacks1 This paper posits that there are two mechanisms in particular, by which cyber-attacks systematically escape the, targeted detonation space, leading to collateral damage. These each have a parallel with respect to convention weapons systems, yet in both cases the scope for collateral damage as a ratio to intended (targeted) damage inherently substantially higher in cyber space. These mechanisms are illustrated here using the widely known Stuxnet, WannaCry, CCIeaner, and NotPetya cyber incidents. These mechanisms are: ■ 1) Loss of confidentiality in weapons design, illustrated with Stuxnet, a highly-targeted attack, and WannaCry, an opportunistic campaign. ■ 2) Loss of integrity in targeting, illustrated using NotPetya, and CCIeaner, targeted attacks. 1.2 Loss of confidentiality in weapons design Digital design's attractiveness arises primarily out of its natural facility for design reuse. Digital signals are n. fundamentally more efficient than analog schemes, evidenced for example by the lower bandwidth required f analog television, vs. digital. This 'cut and paste' re-usability aspect comes into play with many beneficial outcomes, such as speedy application development. However the same dynamic means that sophisticated malware, developed by well-funded teams of cyber warriors serving national governments, even those of allies is easily repurposed for unintended use, by adversaries large and small. Note that while cyber-attacks will in the first instance target computers and networks, the capacity to injure or kill humans is immense. The compute disabled or repurposed may be those that control air traffic, electric grids, dams, electric cars, food and watt supplies, and other necessities of civilian life. I Stuxnet, delivered by USB key to the air-gapped Iranian nuclear facility at Natanz in 2009, narrowly targeted SCADA industrial control systems built by Siemens. Its creators crafted sophisticated targeting systems to 'insure? that Stuxnet would only damage its intended target, the centrifuge cascades deployed at Natanz, and wou‘ leave other SCADA installations unaffected. (Mueller). The Iranian President at the time, Ahmadinejad, was photographed at Natanz in 2008, and these photos, which were published on his website, showed a monitor in the background with coded information concerning the unique layout of the centrifuge cascades in that location. This information was coded into Stuxnet, aiming to limit Stuxnet's damage to that one unique site, and forestall damage anywhere else. Stuxnet was a pioneer in several aspects; it utilized four 0-day exploits, rootkits, and stolen digital certificates. It auto-updated following deployment, and it invoked deep knowledge of the Siemens equipment it was targeting. (Mueller). Stuxnet employed multiple modes of self-replication, leveraging vulnerabilities ranging from* autorun.inf, to MS10-161 print spooler which allowed Stuxnet to 'print' itself to files on target machines. The, command and control servers were named with football (soccer) related machine names, and corresponded' using encrypted data streams. These servers were eventually rendered impotent by 'friendly' security, researchers, who first detected and sought to analyze and defeat Stuxnet. Stuxnet had a built in kill switch, triggered by a run date subsequent to June 24, 2012, an apparent attempt by its authors to limit collateral damage, on the theory that by this date the campaign's targeted operational objectives would have been achieved, or defeated. Stuxnet concealed its presence and activity using rootkits, and by manipulating reports and records produced by the target systems. The authors appeared to intend for it to run stealthily and for an extended period, slowly causing centrifuge failure that might be misinterpreted as normal hardware lifecycle malfunction. (Mueller). Stuxnet was effective; it is estimated that approximately 1000 centrifuges were destroyed, about 11% of the population installed at Natanz. (Mueller). And, while it replicated to thousands of machines worldwide, it was effective in that timeframe in detonating only in the target setting; only at Natanz, only on machines controlling Siemens Step7 SCADA PLCs, in the unique Natanz cascade arrangement, running certain OS versions. Stuxnet was perhaps the most highly targeted and carefully constrained cyber-attack yet seen; it employed extensive target-verification procedures. In fact, Stuxnet appears to have been designed to comply with most norms of international law and rules of war. Yet, it did not die at Natanz, nor did it die on June 24th, 2012. Stuxnet spread to over 100,000 computers in far flung locations, in the timeframe of original dissemination. Of more concern however, is the subsequent transfer of its techniques, knowledge, code, and design attributes, to myriad other cyber-attack teams. One illustration of this, is that the most commonly generally exploited vulnerability in 2016, 6 years downstream, was CVE2010-2568, one of the original Stuxnet vectors, patched in 2010 (Cimpanu, 2017). Such 'leakage' can also occur with conventional military hardware. For example, unexploded ordinance, such as a cruise missile, can be dissected and reverse engineered by adversary forces. However, it is much more likely to happen with a digital payload, where replication is easy and there is no natural rate of erosion leading to eventual neutralization. In addition, the export control regimens, such as ITAR and EAR, in place are effective for the parts supply chain for conventional weapons procurement and production. In contrast, the export of digital weaponry is an inherent product of its purposeful use, such as with Stuxnet, and in addition can occur through theft and dissemination, as was the case with EternalBlue, in WannaCry and NotPetya. WannaCry spread extremely rapidly in part due to its inclusion of the EternalBlue exploit, widely attributed to the U.S. National Security Agency (NSA). EternalBlue was leaked by the Shadow Brokers hacker group in April 2017, shortly before the WannaCry campaign the following month. EternalBlue was also utilized in NotPetya in late June, 2017. EternalBlue exploits a vulnerability in Microsoft's Server Message Block (SMB) protocol, CVE-2017-0144 (ref Common Vulnerabilities and Exposures catalog). EternalBlue allows for execution of arbitrary code remotely on a target machine. WannaCry's collateral impact was enormous, for example causing the National Health Service in UK to redirect ambulances away from impacted hospitals. Rule 56 of the Tallinn Manual, produced by NATO's CCD COE to define rules of cyberwarfare including protection of civilians, prohibits targeting of hospitals and other services necessary for sustenance of civilian life (Artese, 2015). The NSA had 'stockpiled' this and other zero day exploits, however did eventually notify Microsoft once it realized its vault of exploits had been compromised. Microsoft released a patch for EternalBlue in March, 2017, and associated security bulletin MS17-010. Only in-support versions of Windows received patches at that time. Microsoft notably skipped a patch cycle the month before, in February 2017. On May 12th 2017, WannaCry was released, and its enormous spread in the first few hours prompted Microsoft to release emergency patches, even for unsupported OSs including Windows XP and Windows Vista. The current vulnerability ecosystem is certain to produce bad outcomes: ■ Unlike traditional manufactured products, SW producers have established a paradigm of shipping flawed product, with the aim to patch it later. This difference is illustrated by vastly different outcomes for General Motors, for example, sued and fined for its ignition switch flaw, vs. Microsoft, neither sued nor fined for its Kerberos implementation vulnerable to Mimikatz's harvest of plain text passwords from memory, and the subsequent loss of many billions of dollars via IP exfiltration. The financial incentive is for SW vendors to ship now, then test and patch later. ■ These flaws are then researched and stockpiled by well financed cyber warfare teams working for the ~ dozen nation-states with active cyber warfare programs. While the intention may be defensive, the weaponized outputs of this research eventually, either through use and dissemination (such as with Stuxnet), or through theft (such as with WannaCry), will be available for use by other actors, on unintended target populations. U.S. taxpayer, firms and individuals, that finance NSA, were among the victims of WannaCry, for example. Many Russian organizations became victims of NotPetya. ■ A functioning market has developed for zero-days, which can be bought and sold freely. This creates a financial incentive for sophisticated actors to attack and breach the repositories of NSA and other researchers and weaponizers of vulnerabilities. Other niches have been created, such as for dissemination portals such as Wikileaks. ■ Vendors such as Microsoft, Apple and others have financial incentives to move older products out of support, ending the flow of patches to the legitimate user base. However, the continuing flow of patches for newer products, that often have a shared code base with older versions, provides a steady stream of information to cyber-warfare teams on what those unpatched vulnerabilities in the older products are. ■ Finally, users, individuals and organizations, are slow and sloppy in applying patches, even when available. The EternalBlue patch had been out for two months prior to the launch of WannaCry, for example. The most frequently invoked vulnerability of 2016, was patched in 2010, following its use in Stuxnet. Windows XP, of support since 2014, is still the third most populous OS on the planet (as of Sept. 2017). The recent Equifax breach of 143 million individuals' financial information, arose from an Apache Struts vulnerability that has been zero day, and patched, months earlier. These demonstrate clearly that the paradigm of patching as product quality assurance protocol is not functioning well, across the internet at large. This ecosystem, if unchanged, insures the continuation of the trend towards ever larger breaches, based on even more powerful hacking tools, in the hands of ever more varied and malicious groups. 1.3 Inherent loss of integrity in targeting, illustrated using NotPetya, and CCIeaner, widely believed to be targeted attacks Methods of target verification in digital attacks are inherently incomplete and usually ineffective. / NotPetya, launched on June 27, 2017, hit banks, airports, power utilities, and others, heavily in Ukraine, Russia» and parts of Western Europe (Bosspm, 2017). Losses were extensive, for example shipping company MaersK reported a loss of up to $UD300M as a consequence of the attack in their third fiscal quarter. FedEx's TNT unit was severely disrupted and reported a material financial impact. NotPetya was initially thought to be related to a prior attack, 'Petya', however on deeper inspection it was learned that this attack was not what it first appeared to be. First reports of NotPetya appeared at about 6:00 AM ET on June 27th, referencing power utilities with systems down. At 8:00 AM ET Symantec tweeted that Petya code was responsible, and that EternalBlue was being utilized. At 10:00 AM Kaspersky Labs tweeted that the latest ransomworm was in fact 'Not Petya', and they named it accordingly. By this time, according to Kaspersky, 2,000 organizations had been infected with the 'ransomware'. Later analyses concluded that the ransomware motive was a deception, that ransom collection was not an aim of the exploit. There were reports of victims that had paid a ransom without receiving a decryption key. NotPetya used multiple exploits, and invoked Mimikatz, the plaintext credential harvesting tool. By noon ET on June 27th, the Ukrainian Police had confirmed that MeDoc, tax software widely used in Ukraine, was an infection vector for 'patient zero'. A similar SW update vector was employed with CCIeaner. Subsequent analyses have concluded that NotPetya was a targeted attack, intended to harm Ukrainian companies. The association with MeDocs served as a target verification method. After all, who but a Ukrainian company would utilize Ukrainian tax preparation software? It turned out that companies from all over the world were connected in one fashion or another, to networks containing MeDocs, and with conduits for contagion that wrapped all the way back to the likely sources' own neighborhood. Digital missiles can boomerang. Australian companies, for example, had Ukraine subsidiaries, and so had to file Ukrainian taxes. Ukrainian companies had customers, and so had established site-to-site VPNs with organizations around the globe. EternalBlue is able to traverse LANs and WANs, and did so on June 27th. Target verification appears to have been ineffective, considering that TNT Express in Europe, Cadbury factories in Tasmania and Victoria, and law offices 12,975 km away from Ukraine, were among the hosts of 16,000 computers in 64 countries affected. CCIeaner, some analysts have concluded, was a targeted Advanced Persistent Threat campaign, targeting South Korea. The campaign was a sophisticated, multilayered attack that leveraged a popular freeware program, CCIeaner, which ironically was designed to assist with keeping unwanted applications off machines, whose vendor had become compromised. The update to V5.33 carried malicious code to an estimated 2,000,000 computers across the globe. Attackers seem to have made a mistake in the attack list for CCIeaner, with a target company noted as ".sk", apparently believing ".sk" to be the designation for South Korea. However, the domain .sk actually belongs to The Slovak Republic, so it appears the 'targeted' attack was off in this instance by some 8,231 km (Google Maps). No purely kinetic weapon, bullet, missile, or bomb, is yet able to produce direct victims at physical offsets measured in the thousands of kms, as CCIeaner has done. Protocols exist for use of kinetic and cyber weapons, to insure that targets are chosen and campaigns waged with an eye towards minimizing collateral damage to non-combatants. For example, art.57(3) (Rule 56 of Tallinn Manual; NATO CCD COE) requires that targets should be selected that will create the minimum danger to civilian lives and objects. (Artese, 2015). Even when cyber campaigns are designed with such protocols in mind, such as appears to have been the case with Stuxnet, we've seen that damage escapes the planned field of battle quickly, and by quite a 'distance'. In most cases less care is taken, such as we've seen with WannaCry, NotPetya, and CCIeaner, and the epidemic spread is faster and wider. Novelist Stephen King's Dark Tower image of 'too many shaky hands holding lighters near too many fuses' is an apt metaphor. Our highly interconnected network, of in excess of 10 В [Billion] highly vulnerable computers and devices, the internet, is the 'ice nine' cataclysm venue of our time, in terms rapid, exponentially growing, uncontrolled spread of damage, intended and unintended. 2. Discussion and conclusions The first codified international treaty aimed at protection of sick and wounded in warfare, the 1864 Geneva Convention, was inspired by the need to protect hospitals from attack during hostilities. It is ironic therefore to witness the severe impact of WannaCry on NHS (UK National Health Service) hospitals. Since the establishment of the Red Cross, and the Geneva and Hague Conventions, (LOAC, or Laws of Armed Conflict), humanity has managed, at least, to avoid cataclysmic self-destruction with weapons categories including conventional, chemical, biological, and nuclear. Treaties have been at least somewhat effective in controlling the militarization of space, and the proliferation of nuclear weaponry, and other weapons of mass destruction. With the advent of a potent new weapons category, cyber, we find ourselves without analogous arrangements, no 'Cyber Red Cross' to protect innocents during outbreaks. No Geneva or Hague conventions to regulate behavior or use of such weaponry. Conventional, chemical, and even nuclear weapons, could be used stealthily, however would be difficult to use anonymously. That is, it might be possible to introduce such weapons in to a venue undetected, however attribution after use is likely to be reliable, and by the nature of the measurement systems we have at our disposal. Physical measuring systems, those that measure distances, locations, and trajectories, and analytical tools, those that analyze chemical compounds and isotopes, and are well developed and difficult to circumvent. Forensic tools and techniques used in cyber-attacks undertaken on the battlefield called the 'internet', on the other hand, are less developed and easier to manipulate. Internet protocols are by design largely geo-location neutral, and Boolean forensics techniques can be obfuscated to a greater extent than those based on physical measurements. Therefore cyber-attackers may at least believe there is a significant possibility they may not be reliably identified. The LOAC, in particular Geneva Convention IV, defines civilians and specifies protections afforded to them 'on the battlefield'. The concept of civilian, or non-combatant, however, is not well defined in cyber warfare. Further, the battlefield itself is ill-defined, and by the nature of computer networking as deployed on the WWW, is certainly not localized. This combination of characteristics; anonymity on an exponentially growing network, lack of restraints, widespread vulnerabilities, military grade tools disseminated widely, and ease and simplicity of attack, raises the specter of a perfect storm; widespread damage to organizations, enterprises, individuals, and critical infrastructure, on which we are becoming increasingly dependent for maintenance of civilian life and health.