# Collateral Damage from Offensive Cyber Operations-- A Systematic Literature Review
## 4 Results
### Targeting in Cyber Operations--Collateral Damage Considerations  
Another significant cluster of research concerns the targeting of cyber operations against desired targets only. Papers within this cluster consider how a cyberweapon can be targeted, or a cyber operation conducted against a specific and delimited target, in such a way as to minimize collateral effects. Most of this research starts by formally defining a basis for the evaluation of intended and unintended consequences. [PERSON] and [PERSON] [48]; [PERSON] and [PERSON] [49]; [PERSON], [PERSON], and [PERSON] [17]; and [PERSON] and [PERSON] [50] all present such definitions. Notably, these definitions are significantly different. There are three main points of agreement:  
* No commonly accepted definitions exist for concepts like \"cyberwar\", \"information war\", or \"collateral damage\";
* Collateral damage is undesirable and illegal and must be taken into account; and
* Cyber effects are difficult to measure.  
Stuxnet, a \"game-changing\" cyberweapon [51], famously included several failsafes to protect against unintended harm. This is one of the foundational observations inspiring the argument that OCOs can and should be developed discriminately, i.e., that it is both required by the laws of armed conflict and technically possible to do so. [PERSON] [52] describes the failure of such mechanisms, leading to indiscriminate and virus-like spread, as a loss of integrity. Most authors take a legalistic approach to targeting, noting the existence of laws, and implicitly assume that they are there to be followed. [PERSON] and [PERSON] [48]; [PERSON], [PERSON], and [PERSON] [53]; and [PERSON] [54] all note that a more prosaic reason exists for precise targeting and stealthy operation: to increase cyberweapons' efficiency and to avoid escalation and retaliation.  
One of the most well-used targeting frameworks is the Joint Targeting Cycle [7], as shown in Figure 5. The idea of applying this to the cyber domain has been independently proposed by [PERSON] and [PERSON] [49], [PERSON] [55], [PERSON] [56], and [PERSON] and [PERSON] [57]. Their motivation is that the use of such a framework would create specified and mandatory steps to calculate and predict collateral damage before operations are conducted and ensure that the collateral outcomes are assessed after them.  
Finally, a reverse approach to targeting is the identification of attack modalities that have an increased risk of collateral damage. [PERSON] [58] presents a list of five such modalities, shown in Table 6.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Attack Modality** & **Collateral Damage Risk** \\ \hline Replicating attack vectors & Complicated and expensive clean-up \\ Drive-by attacks & Scattershot approach, many unintended targets \\ Supply chain attacks & Scattershot approach, many unintended targets \\ Third-party DDoS (bots) & Use of third party causes unpredictable results \\ Flooding attacks (DDoS) & Spillover to adjacent systems/networks \\ \hline \hline \end{tabular} The following subsections once again begin with tables (Tables 7-9) listing key papers in the described categories.  
\end{table}
Table 6: High-risk cyberattack modalities, adapted from [PERSON] [58].  
Figure 5: The Joint Targeting Cycle, adapted from [7].