We Are Already in the Third World War

What happened in October

First, my sympathies to everyone who was hurt by the events of these past days.
And to everyone still working at the coalface: thank you, and well done.
The back-end engineers in particular must be exhausted. Even I, sitting somewhere between the front end and the back, certainly am.

On 21 October, a pair of critical vulnerabilities known as “PHP2Shell”¹ were made public.
PHP is the programming language behind roughly 70 per cent of the world’s websites. Hidden in its very foundations, for years, was a hole that let an outsider take over a server without ever logging in.
It was found by security researchers working with AI.

Nothing conveys how serious this was better than one piece of advice. A unit of the US National Security Agency told websites that could not patch immediately to take themselves offline for the time being.
Switch your website off, in other words.

Real damage has been reported.
Personal data has leaked.
In the worst cases, I have heard of sites whose owners gave up on reopening altogether, because recovery was impossible or close to it.

Fortunately, no harm has been reported on my own sites, or among the people whose sites I look after.
On 20 October, as details began to leak ahead of the official announcement, I sensed that something was coming.
I brought plans forward, and some appointments had to be cancelled at the last minute.
I would like to take this opportunity to apologise sincerely to those affected.

Already inside a world war

I am sorry to begin with something so ominous, but I believe we are already in the middle of the Third World War.

This is not as far-fetched as it sounds.
From around 2014, the late Pope Francis spoke again and again of a “piecemeal third world war”².
The term “hybrid warfare”³, meaning military force combined with cyber attacks, disinformation and economic pressure, has also become commonplace.
No declaration of war. No trenches. And yet the fighting is plainly happening.

The rate at which cyber attacks have grown in recent years is extraordinary.
Since Russia’s invasion of Ukraine in 2022 in particular, the increase has been visible to the naked eye.
Japan’s National Institute of Information and Communications Technology (NICT) runs an observation network called NICTER⁴. The attack-related traffic it records rose from about 1.83 million packets per IP address a year in 2022 to about 2.5 million in 2025, the highest since records began. In 2016 the figure was about 470,000, so it has grown roughly fivefold in a decade.
That said, the same period saw generative AI reach the general public, with the launch of ChatGPT and others. That too has surely played its part.
Things move through tangled, overlapping causes, and it is rare to arrive at just one.

This past decade has also been one in which, case after case, state intelligence agencies have been exposed as players in cyber attacks.
To put it crudely: Russia destroys and disrupts, China lies low and steals, North Korea goes after money. Each has its own “style”.

Japan has not been spared.
Here are some of the main cases, focusing on those where governments have formally named the culprits (attribution)⁵ or brought charges.

Russia (GRU, SVR)

• Attacks on Ukraine’s power grid (2015, 2016): attributed to the GRU’s⁶ “Sandworm” group (Unit 74455), these caused winter blackouts. They were the first known cases of a cyber attack shutting down a power grid.
• NotPetya (2017): data-wiping malware aimed at Ukraine spread worldwide, causing damage estimated at around US$10 billion. The US and UK named the GRU as responsible.
• The PyeongChang and Tokyo Olympics: the British government announced that GRU cyber units tried to sabotage the PyeongChang Games while making it look like the work of North Korean or Chinese hackers. Reconnaissance against the Tokyo organising committee was also reported.
• The SolarWinds affair (2020): attributed to the SVR, a large-scale espionage operation that burrowed deep into US government agencies.
• The attack on Viasat satellite communications (24 February 2022): on the day of the invasion, a satellite network also used by the Ukrainian military was knocked out.
• Japan: in September 2022 the pro-Russian hacktivist group Killnet launched DDoS attacks⁷ on Japanese government websites, including the e-Gov portal.

China (Ministry of State Security, People’s Liberation Army)

• APT10 (2018): the first time the Japanese government publicly named China. A group linked to the Ministry of State Security⁸ was accused of stealing data through IT service providers around the world, including Japanese firms.
• MirrorFace (announced January 2025): Japan’s National Police Agency attributed attacks on the Foreign Ministry, defence officials, think tanks and politicians to a China-linked group. It was a rare instance of Japanese police pointing towards state involvement.
• The intrusion at JAXA: Japan’s space agency was also reportedly breached by a China-linked group.
• Volt Typhoon and Salt Typhoon (2023–24): groups reported to have lain hidden inside American infrastructure and telecoms networks. There are fears they were preparing for sabotage in a future conflict.

North Korea (Reconnaissance General Bureau)

• The attack on Sony Pictures (2014): said to be retaliation for a film satirising Kim Jong Un.
• Bangladesh Bank (2016): some US$81 million was stolen.
• WannaCry (2017): ransomware that spread across the world.
• DMM Bitcoin (2024): crypto assets worth about ¥48.2 billion were stolen from a Japanese exchange. Japan’s National Police Agency and the FBI attributed the theft to North Korea’s “TraderTraitor”⁹.

Laid out like this, the “styles” come into focus.
Russia breaks, China hides, North Korea earns.

The attack comes down to street level

What frightens me is that this state-level attacking capability is, thanks to AI, coming down to the level of the individual hacker.

PHP2Shell was almost a symbol of that.
The defenders found the hole with tightly controlled, cutting-edge AI.
But AI nearly as capable is now circulating among attackers too, free for anyone to download.
Earlier this month, a hacker who appears to have been an amateur using AI tools reportedly stole customer data from a South Korean bank.
What once only a state intelligence agency could do is coming within reach of individuals.

The point I want to stress is this: the target is not “someone in particular”.
Most attackers do not choose their victims.
They sweep the web mechanically for vulnerable sites, and when they find a house with the door unlocked, they walk in. That is all.

It is common to find a hacked site displaying a political slogan that has nothing to do with it, or stuffed with pages in some unfamiliar foreign language.
The intruders have not looked at what the site is about. The door was open, so they went in.

In short, “we’re too small to matter” does not hold.
Small or not, an unlocked door lets people in.
If anything, it is the small, poorly kept house that is easiest to enter.

The people who quietly do what needs doing

Some time ago, dealing with a certain incident, I turned to my hosting company for help.
I contacted them in the middle of the night, and they responded promptly all the same.
More than that, they provided, free of charge, a safeguard that in ordinary times could probably have been sold as a product in its own right.
Developing it must have cost them a great deal, but they skipped all that and simply gave it away.
I was deeply impressed by a company that just gets on with doing what ought to be done.
I am sure that this time, too, there are people all over the place quietly doing the same.

On the other hand, I often feel there is a startling lack of any sense of crisis.
At times it seems the whole of society has gone slack.

The bill for that should not land on the small shops and businesses that are honestly trying to make a living.

Deterrence by locking the door

In the world of security policy, there are two ways of thinking about deterrence.
One is “deterrence by punishment”: you make it clear that any attack will be met with painful retaliation, and so you dissuade it.
The other is “deterrence by denial”¹⁰: you make the attacker believe they cannot achieve their aim, that it simply is not worth it.

What individuals and small businesses can do is the latter.
You may not be able to strike back, but you can lock the door.
You can make an attacker think, “Too much bother here. Let’s try next door.”

What needs doing is, in truth, not very dramatic.

• Keep your systems and software up to date
• Lock down your logins (long passwords you never reuse, two-factor authentication¹¹)
• Keep backups, just in case

It is unglamorous, but this alone takes you off the list of “houses with the door unlocked”.

To business owners, I would ask this: please look once more, and closely, at whether your own defences and those of the people you work with are adequate.
Your website and your online services are assets. I think we need to start seeing them that way.

What I would rather be doing

Having gone on at length about such grim things, I know this will sound contradictory, but the truth is I would rather not be doing any of this.

I want to show you beautiful places, in words and photographs.
I want to tell you that there are wonderful people here in Niigata.
I want to write whatever I like on my website.
And now and then, to give it a rather show-offy new design.

That is all I want to be doing.

What I really want to do is edit, write, and make things.
Put simply, I want to publish freely.

But that needs solid ground beneath it.
Just as you have to lay the foundations before you build a house.
So I count protecting that ground as work every bit as important as the work I would rather be doing.
Honestly, I go back and forth between the two, but I have no intention of letting go of either.

Keeping the skirmish a skirmish

We must not let this escalate into a real war.

I hate war with all my heart.
I wish there were no soldiers left in the world.
But that is not how things are.

My grandfather served in the Imperial Japanese Navy. He was an officer, and in the end he was training to ram American warships in a suicide boat¹² when the war ended, and he survived by the narrowest of margins.
My great-uncle was in the infantry regiment based in Shibata, in Niigata. He fought his way through battlefields such as Guadalcanal¹³ and was killed in action.

I do not want anything like that to happen again. It must never happen again.

When many of the generation who knew war were still alive, I think they understood in their bones that “if we don’t prepare for this now, there will be war”.
The misery of it was also common knowledge. And so, I think, deterrence held at the moments when war might have broken out.
Today, that understanding has been hollowed out almost entirely.
Even so, I believe we are still at a stage where we can learn from history.

Simply declaring “No to war!” will not, I am afraid, prevent it.
A declaration needs something to back it up: steady, patient preparation that convinces an attacker it is not worth trying.

I am in no position to lecture anyone on national defence.
But I can lock the door at my own post.
Each small house, locking its own door.
That, I believe, is the smallest unit of deterrence: the kind that tells an attacker this place is not worth the trouble.

So that the skirmish ends as a skirmish.

Sources

• NICTER Observation Report 2025 (NICT, in Japanese)
• NICTER Observation Report 2022 (NICT, in Japanese)
• NICTER Observation Report 2016 (NICT, in Japanese)

1. Nickname for two critical flaws found in PHP itself. Fixed versions were released on 21 October 2026.
2. A phrase Pope Francis used repeatedly from 2014, for conflicts around the world joining up.
3. Combining military force with cyber attacks, disinformation and economic pressure. Widely discussed after Russia’s annexation of Crimea in 2014.
4. NICT’s observation network, which counts traffic sent to unused IP addresses. Its figures are not a count of attacks as such.
5. Identifying who carried out a cyber attack and saying so publicly. It underpins diplomatic protests and sanctions.
6. Russia’s military intelligence directorate, known for destructive cyber operations.
7. Flooding a site or server with traffic until it collapses.
8. China’s intelligence agency, handling counter-intelligence and foreign espionage, and known to use contract hackers.
9. A hacking group said to work under North Korea’s Reconnaissance General Bureau, focused on stealing crypto assets.
10. Discouraging an attack by blocking it, so that the attacker cannot achieve their aim.
11. Confirming identity by a second means, such as a code sent to your phone, as well as a password.
12. A small explosive-laden boat meant to ram enemy ships. The Navy’s Shin’yō was one type.
13. An island in the Solomons fought over by Japan and the US in 1942–43. Supplies failed and many Japanese soldiers starved.