Hackers Track Online Acts of War

In the Citizen Lab at the University of Toronto, a new breed of hackers is conducting digital espionage.

They are among a growing number of investigators monitoring how traffic is routed through various countries, where Web sites are blocked and why it's happening. Now they are turning their scrutiny to a new weapon of warfare: cyber attacks.

Tracking wars isn't what many of the researchers set out to do. Many began intending to help people in countries that censor online content. But as the Internet has evolved, so has their mission.

Ronald J. Deibert, the director of the Citizen Lab, calls the organization a "global civil society counterintelligence agency."

Researchers say Internet assaults are playing a larger role in military strategy and political struggles. Even before Russia invaded Georgia last month, Citizen Lab's researchers noticed sporadic attacks aimed at several Georgian Web sites. Such attacks are especially threatening to countries increasingly linking critical activities such as banking and transportation to the Internet. Once fighting began, massive raids on Georgia's Internet infrastructure were deployed using techniques similar to those used by Russian criminal organizations. Then, attacks seemed to come from individuals who found online instructions, and they shut down much of Georgia's communication system.

"These attacks in effect had the same effect that a military attack would have," said Rafal Rohozinski, who co-founded the Information Warfare Monitor, which tracks cyber attacks with Citizen Lab, in 2003.

The cyber attacks marked the first time such an assault coincided with physical fighting.

Georgian Internet providers also limited access to Russian media outlets, cutting off the only remaining updates about the war. On Aug. 12 -- the height of the fighting -- "there was panic in Tbilisi brought about by a vacuum of information," Mr. Rohozinski said.