## 3 State-Level Cyber Conflict  
As already noted, Stuxnet was reportedly developed and deployed by the United States and Israel [5,6]. The apparent objective was to do more than just destroy some centrifuges. It was to slow down Iran's nuclear program. In that regard, Stuxnet achieved a national security goal that might otherwise have been met with a kinetic attack such as bombing the Natanz facility. But it did so without killing or injuring anyone, destroying anything other than centrifuges, or risking the lives of military personnel delivering bombs. By causing less harm to its target and incurring less risk for its perpetrators, it may have provided a morally better approach than its kinetic alternative, although its collateral effect of infecting about a hundred thousand computers worldwide would also need to be considered. In any case, I am not arguing that the operation was ethical, only that it may have been a more ethical means of destroying centrifuges than bombs would have been [15]. Only a handful of cyber-attacks have been publicly attributed to nation-states. In 1982, the United States is said to have planted a Trojan horse in Canadian software that was used by the Soviets to control their Trans-Siberian gas pipeline. The effect was a massive explosion on a remote area of the pipeline [16]. Then in 2003, just before Operation Iraqi Freedom, the US penetrated the Iraqi Defense Ministry e-mail system, injecting messages telling Iraqi officials that the US did not wish to harm them and asking them to not resist the coming invasion ([17], pp. 9-10). Israel is said to have used cyber-weapons to blind Syria's air defenses at the time of its airstlike against a Syrian nuclear weapons facility in 2007. Nothing was damaged or destroyed, but the cyber-attack had the effect of hiding the Israeli aircraft from Syrians who were monitoring their airspace ([17], pp. 1-8). Like Stuxnet, the cyber-attack offered a morally better choice than, say, a kinetic attack that physically damaged Syrian's air defenses. When at war, nations often launch destructive military strikes, including strikes against the critical infrastructures of their adversary. During the opening moments of Operation Desert Storm in 1991, a US fighter plane directed a precision-guided bomb straight down the air-conditioning shaft of the Iraqi telephone system in downtown Bagdad, taking out the entire underground coaxial cable system and the primary means of communicating between the Iraqi high command in Baghdad and subordinates in the field [18]. What Stuxnet and the above instances of nation-state cyber-attacks illustrate is the possibility of meeting national security objectives with bits rather than bombs. In so doing, operations may be less expensive, less deadly, less destructive, and less risky to their perpetrators. Instead of dropping a bomb into a Baghdad communication facility, the US might have been able to temporarily disable Iraqi military communications with a well-crafted cyber-weapon. Stuxnet showed just how sophisticated and precise such cyber-weapons can be. It was dramatically different from the weapons used in the other instances, offering new possibilities for achieving military objectives. To the extent that cyber-weapons offer a less costly but morally preferred means of achieving national objectives over kinetic strikes, nation-states may find them an attractive alternative. Cyber weapons might be used to disrupt activity at other facilities believed to be involved in the production of weapons of mass destruction. During military operations, they might be deployed to temporarily disable power, communications, transportation, or other services, allowing the rapid restoration of such services once hostilities end, and thereby avoiding the costs and problems associated with post-conflict reconstruction. Stuxnet showed what is possible against an ICS, while providing a blueprint for attacks against nuclear enrichment facilities.