U.S. needs to be cautious in asserting its intention to defend its cyber turf
Connecting state and local government leaders
If we don’t know who is attacking us and why, we run the risk of escalating minor incidents with inappropriate responses.
Halfway through the Obama administration’s comprehensive review of the nation’s strategy for cybersecurity, the process is being second-guessed by experts and commentators of all stripes. Phrases such as “digital 9-11” are being used freely, and there are calls for the government to issue the cyber equivalent of the Monroe Doctrine, giving would-be trespassers notice of our intention of defending our cyber turf.
This sounds good. Who wouldn’t be in favor of self-defense? But we need to be careful about making such assertions when we really do not know what is going on.
For several years, there has been a drumbeat of reports of violations of government and corporate IT systems, apparently seeking classified and proprietary information. Sometimes they appear to be coordinated, and some have been tracked to apparent sources in other countries, most notably China. Our military has announced it is developing cyberwarfare capabilities, in part because it assumes other nations are developing them as well. It is an easy to step to assume that these intrusions are part of such an effort by hostile nations.
But the fact is, we do not know where these “attacks” are coming from or who is behind them. It could be hackers, it could be organized criminals, it could be terrorists, and it could be foreign governments. Or it could be some other category we have not yet considered.
These distinctions matter, because our response to any incident should depend on the nature of the incident. The last administration’s failure to distinguish between a terrorism incident and an act of war led to tragic results from our response to the 2001 terrorist attacks. In cyberspace, we need to be able to distinguish ill-advised curiosity from hostility, and nation-states from individuals or nongovernmental organizations.
Amit Yoran, former director of the Homeland Security Department’s National Cyber Security Division and now chief executive officer of NetWitness Corp., summed up this challenge in his testimony last week before the House Homeland Security Committee.
“There is a clear and distinct conflict of interest between intelligence objectives and those of system operators,” Yoran said. Simply put, information assurance is about quickly spotting, stopping and recovering from an incident. Intelligence is about monitoring and learning about the incident. “For instance, intelligence and law enforcement entities often prioritize attack attribution, while almost no emphasis is placed on attribution by those defending systems.”
Because of different aims, intelligence and defense are in some senses mutually exclusive. “Rather than sharing information with operators and better informing them as to how they can defend and monitor themselves, an intelligence community centric mindset around cyber would limit information exchange and instead focus on enabling the intelligence community to perform an expanded and aggregated monitoring program.”
So we cannot rely on intelligence capabilities to provide tactical cyberdefense, but these capabilities are necessary for strategic policy. Unfortunately, we do not yet have the cyber intelligence capacity to inform a comprehensive cyberstrategy. Until we do, we should be careful about establishing doctrines we cannot adequately enforce.
It makes a real difference to our response whether the guy behind the offending computer is wearing a Chinese uniform in Beijing, eating cheesey poofs in his mother’s basement in Dallas, or is a Russian criminal working in Bangkok. One we might want to put in jail, another we might slap on the wrist, and another we might want to take offline with “extreme prejudice.”
Foreign governments might not like it if we attack their cyber turf in retaliation for a misperceived attack, and that could put our own turf at greater risk. So before we put anyone on notice, let’s make sure we know who we are talking to and what that notice should be.