Cyber ShockWave exposed missing links in U.S. security

In mid-February the Bipartisan Policy Center hosted Cyber ShockWave, a simulation of how our nation might respond to a catastrophic cyber event. The simulation was conducted through the lens of a notional National Security Council (NSC) meeting convened to advise the president on how the federal government should respond to the crisis and what the president should communicate to the American people to reassure them.

Related story:

Cyberattack simulation highlights vulnerabilities

The presentation of Cyber ShockWave was well timed. Right now, the U.S. government is involved in a significant debate: How important is cybersecurity among the many security matters competing for attention?

My view is that cybersecurity issues transcend the protection of personal data or networks from hackers or even organized crime. Rather, cyber warfare is a major national security issue — protecting the security and freedom of our networks is as critical as protecting freedom of the seas and space. As Congress debates competing legislative proposals to marshal our government’s resources in this critical conflict, Cyber ShockWave provided important benchmarks to guide these deliberations.

It was my privilege to play the role of the national security adviser during the Cyber ShockWave NSC meeting. From that vantage point, here is my perspective of what we learned.

• First, the United States does not have well-defined responsibilities for maintaining common situational awareness of emerging critical operational developments in cyberspace.
• In a cyber crisis, our nation lacks an effective decision-making framework below the Cabinet level for coordinating the government's response and recovery from a devastating cyber event.
• There is not in place a user-friendly process to allow government cyber defenders to effectively collaborate with the private sector to take advantage of their expertise and knowledge during the response to a cyberattack.
• Current policy, legal and organizational constraints drive us to only a binary response: the traditional domestic-focused law enforcement approach on one hand and, at the other extreme, the compulsion to respond internationally to neutralize the attack.

Two key real-world elements arose, however, to complicate NSC’s consideration of response actions. First, it is difficult to establish evidence that proves beyond a reasonable doubt that a particular entity staged an attack — the issue of attribution. Not only is it difficult to identify and prove whether the attacker is sanctioned by a foreign government, it is also hard to distinguish between active direction by foreign officials and mere tolerance or lax enforcement. Consequently, accountability for cyberattacks is extremely difficult to determine.

Furthermore, even if there were an ability to demonstrate a specific entity's or a foreign government's complicity in an attack, what are the options for response? The United States has long declared that a physical attack on us is an act of war that will be met with retaliation. How should that same principle be contemplated in the context of attacks in cyberspace? Should our cyber policies hold a hosting state responsible for attacks launched by its agents, sanctioned or not? Is our response to a cyberattack limited to the cyber world, or are physical responses on the table? Cyber ShockWave demonstrated that these decisions need to be debated and translated into a national declaratory policy to govern future U.S. cyber response actions.

In spite of these complications, the notional NSC meeting concluded with surprising unanimity that we needed to authorize very aggressive, vigorous response actions, and from the outset, Congress needed to be involved and on board. Additionally, we recognized that timely public buy-in was critical.

In the aftermath of Cyber ShockWave, it is clear that there are concrete, practical steps that government and the private sector need to address. These include:

• Developing clear policies with regard to what the government can and cannot do in these kinds of emergencies.
• Arriving at a broad national understanding of what constitutes a reasonable expectation of privacy on the Internet during such crises.
• Creating more robust and regularized public/private cybersecurity partnerships for the purpose of timely information exchange to enable improved mutual situational awareness.
• Building on the national declaratory policy I mentioned earlier to formulate a strategy for deterrence and response to state-sponsored cyberattacks that parallels the national security strategies we developed for dealing with nuclear threats during the Cold War.
• Complementing a deterrence and response strategy with a broadly accepted international regime of what constitutes acceptable and unacceptable behavior in cyberspace. This regime should parallel the traditional international laws that govern transiting land, maritime and air domains.

Finally, we must recognize that everyone is a combatant in the world of cyber warfare. Civilians are on the front lines because our personal communications and network systems are the conduits for Internet warfare. This means that the responsibility for cybersecurity must be a joint effort involving not only our government’s national security and homeland security elements and private enterprise but also individuals who must do their part to practice safe computing. To be responsible Internet citizens, we must each commit to employing well-documented security techniques, such as creating and renewing passwords for protecting our individual computing resources. The Web site (www.uscert.gov) of the Homeland Security Department's U.S. Computer Emergency Readiness Team provides very useful information to this end.

Additionally, in this regard, I would note the well-known sports adage: “While offense wins games, defense wins championships.” Each of us must resolve to make our individual contributions to the defense of cyberspace.