Cybersecurity: how preemptive cyberwar is entering the nation's arsenal

In addition to authorizing the use of cyberweapons, the White House is preparing an executive order to beef up cybersecurity for critical infrastructure, such as the electric grid, refineries, and telecommunications.

|
Virginia Mayo/AP/File
Defense Secretary Leon Panetta, seen here speaking at NATO headquarters in Brussels on Oct. 10, 2012, warns of the potential of a cyber-9/11 and the need to boost US cybersecurity.

A formal, three-year legal and policy review of US cyberweapons that concluded last fall has effectively cleared their use alongside other weapons systems in the US arsenal, a stamp of approval that propels the fledgling US Cyber Command toward a fully operational role within the nation's military structure, cyberwar experts say.

Cyberweapons have been available to the US military since at least the first Gulf War against Iraq, but when, how, and under what conditions they could or should be deployed has been subject to vigorous debate among military and civilian policymakers.

Now it appears cyberweapons and cyberwarfare have nudged up alongside other legally approved military theaters and techniques, including space warfare and electronic war as well as the use of drones, sabotage, and special operations. In particular, cyberweapons were approved in the review for "preemptive" attacks if authorized by the president and if an imminent attack on the US warranted it, the New York Times reports.

While most details of the legal authorizations aren't known, the Times quoted anonymous sources as saying that the new policies "govern how the intelligence agencies can carry out searches of faraway computer networks for signs of potential attacks on the United States and, if the president approves, attack adversaries by injecting them with destructive code – even if there is no declared war."

"The fact that DOD has moved to the point where it felt required to [conduct the policy review] is a step toward normalization and operationalization of cyberweapons," says Dan Kuehl, a professor of intelligence studies at Mercyhurst University and formerly at National Defense University. "If you've got a new bomb or a tank or a weapons system, there's a requirement to do a legal review of its usage – under the Law of Armed Conflict. With DOD having done that for cyber, it's a significant step toward normalization of cyber as a weapon we can actually use militarily."

Word that legal hurdles have been largely surmounted for cyberweapons comes amid a backdrop of daily reports of cyberespionage attacks on US businesses, government agencies, and the Pentagon – not to mention numerous recent statements of concern by the nation's military officials.

In a speech last fall, Secretary of Defense Leon Panetta warned of the potential for a "cyber 9/11" and urged tougher laws that would help protect US critical infrastructure like the power grid and water systems. Other current and former senior administration and Pentagon officials have echoed that concern – and say that the legal review is long past due.

"This legal review of cyberweapons has been far too slow, too lawyer-and-State Department-ridden," says Stewart Baker, a former assistant secretary at the Department of Homeland Security and now a partner at Steptoe & Johnson, a Washington law firm. "What we've needed is a faster process that allows us to actually come up with a strategy for actually winning a cyberconflict. But this is clearly a step in the right direction. It's clear that cyberweapons are going to be used. If so, then we need to be better at using them than our adversaries."

Defending the nation from cyberattack was a priority reflected in the formal establishment of US Cyber Command in 2009. But whether cyberweapons truly fit into and complied with international legal norms and structures such as the International Law of Armed Conflict, which sets humanitarian norms during war – has been a question mark.

Debate over US cyberweapons policy for DOD was in full swing in early 2009. As in the past, when critical military policy questions were at stake, the Pentagon threw the problem over to the Defense Science Board and the Defense Policy Board to analyze and develop a cyberwar-fighting policy structure, cyberexperts told the Monitor.

"If we have the capability of using something that will disrupt, degrade, or deny an enemy at less than lethal force, we have an ethical conundrum," says Sam Liles, a professor of cyberforensics at Purdue University. "Should we use this – if cyber gives us that capability? Perhaps we're morally and ethically required to use it. On the other hand, if that weapon can be turned around and used against us, perhaps we shouldn't use it. That's what the policy discussion has been about."

Such a policy debate was made more urgent by the furor surrounding Stuxnet, the world's first publicly known cyberweapon, which was utilized by the US to sabotage Iran's nuclear fuel-refining facilities. It also accelerated debate about the wisdom of releasing such weapons, especially since they can be reverse-engineered and used against the US.

By last fall, the process had reached a series of conclusions after a lengthy internal debate. The result: DOD had a first cut, an organized structure that includes rules for engagement and a decisionmaking process for using cyberweapons, says James Lewis, a cybersecurity expert at the Center for Strategic and International Studies in Washington.

The new cyberarms policy reflects a push by powerful military figures as well, including Gen. Keith Alexander, director of the National Security Agency and commander of the US Cyber Command, which is a sub-unified command under the US Strategic Command. But with this step, it's likely that the US Cyber Command will be propelled to equal footing alongside other commands, Dr. Lewis says.

Two key other architects of the cyberpolicy that has just emerged publicly were William Lynn III, a former deputy secretary of Defense, and the former vice chairman of the Joint Chiefs of Staff, Gen. James E. Cartwright, former head of the US Strategic Command. Both were central in helping set up US Cyber Command, Dr. Lewis says. General Cartright, who retired from service in August 2011, was well positioned to assist in the cyber review, joining the Defense Policy Board Advisory Committee two months later.

Cartright has warned of the US need for better cyber preparedness. The Chinese, he told the US-China Economic and Security Review Commission in March 2007, are making “plans to use this type of capability in a military context.” He added, “I don’t think the [United States] has gotten its head around this issue yet, but I think we should start to consider that the regret factors associated with a cyberattack could, in fact, be in the magnitude of a weapon of mass destruction.”

"We're seeing plenty of signs that cyber deterrence hasn't worked," Dr. Lewis says. "If that doesn't work, well, then you have to preempt. This is where we see a potential attack, some planning going on, and we would be able to go in an stop it. Suppose we could turn off the attack computer the moment they pressed the key sequence. We could say: Well, we saw he was going to hit me and hit him first."

Another backdrop for the US authorization of the use of cyberweapons is the prospect that President Obama, in the absence of congressional action, will issue an executive order to require federal agencies to tighten regulations to bolster cyberdefenses at US critical infrastructure like the electric grid, refineries, and telecommunications.

What appears to be emerging, then, is an overlapping set of mandates to protect the US against attack. On a strategic level, the US has now authorized the use of cyberweapons. On a middle level, Internet service providers could also detect and mitigate an attack to some degree. Finally, the Department of Homeland Security is working to implement policies, presumably with sharper teeth under a coming executive order, to bolster defenses at the individual company level.

"What's happening is that all these mandates are really overlapping and to some degree connected," Dr. Kuehl says. "There's now a growing awareness that cyberspace is absolutely crucial to US national security – not just militarily, but societally. All these forces are gelling to protect the nation's critical infrastructure."

You've read  of  free articles. Subscribe to continue.
Real news can be honest, hopeful, credible, constructive.
What is the Monitor difference? Tackling the tough headlines – with humanity. Listening to sources – with respect. Seeing the story that others are missing by reporting what so often gets overlooked: the values that connect us. That’s Monitor reporting – news that changes how you see the world.

Dear Reader,

About a year ago, I happened upon this statement about the Monitor in the Harvard Business Review – under the charming heading of “do things that don’t interest you”:

“Many things that end up” being meaningful, writes social scientist Joseph Grenny, “have come from conference workshops, articles, or online videos that began as a chore and ended with an insight. My work in Kenya, for example, was heavily influenced by a Christian Science Monitor article I had forced myself to read 10 years earlier. Sometimes, we call things ‘boring’ simply because they lie outside the box we are currently in.”

If you were to come up with a punchline to a joke about the Monitor, that would probably be it. We’re seen as being global, fair, insightful, and perhaps a bit too earnest. We’re the bran muffin of journalism.

But you know what? We change lives. And I’m going to argue that we change lives precisely because we force open that too-small box that most human beings think they live in.

The Monitor is a peculiar little publication that’s hard for the world to figure out. We’re run by a church, but we’re not only for church members and we’re not about converting people. We’re known as being fair even as the world becomes as polarized as at any time since the newspaper’s founding in 1908.

We have a mission beyond circulation, we want to bridge divides. We’re about kicking down the door of thought everywhere and saying, “You are bigger and more capable than you realize. And we can prove it.”

If you’re looking for bran muffin journalism, you can subscribe to the Monitor for $15. You’ll get the Monitor Weekly magazine, the Monitor Daily email, and unlimited access to CSMonitor.com.

QR Code to Cybersecurity: how preemptive cyberwar is entering the nation's arsenal
Read this article in
https://www.csmonitor.com/USA/Military/2013/0204/Cybersecurity-how-preemptive-cyberwar-is-entering-the-nation-s-arsenal
QR Code to Subscription page
Start your subscription today
https://www.csmonitor.com/subscribe