Wednesday, May 13, 2009

Traditional War Strategy In The Cyber Age

As U.S. military and government officials consider the best approach to fighting cyber threats, they are considering the relevance of historic approaches to national security dangers such as nuclear weapons and terrorism. Herbert Lin, chief scientist at the National Research Council's computer science and telecommunications board, said a range of topics are currently being weighed such as "strategy, escalation, and deterrence, as well as issues related to doctrine and employment policy for cyber weapons." Doctrine and employment policy refer to how the military plans to operate during a conflict and strategy refers to thinking beyond immediate engagement to develop a roadmap for how to win, he said. Deterrence involves persuading a bad guy to not attack and escalation refers to how to keep a war from getting out of hand, he said.

"The very concepts of what constitutes offense versus defense and what is contained within either is a new and nascent debate in cyber," wrote Rod Beckstrom of the Homeland Security Department's National Cybersecurity Center, in an email. Historic concepts that have emerged include preemptive war strategy or when an attempt is made to combat a perceived inevitable threat before the threat becomes a reality and, the "no first use pledge," or when a state with nuclear weapons promises not to use the weapons first. Another approach, known as mutually assured destruction, "reflects the idea that one's population could best be protected by leaving it vulnerable so long as the other side faced comparable vulnerabilities," NuclearFiles.org states. The U.S. has waged past wars against threats that are not easily defined and geographically diverse such as terrorism and drugs.

"[B]ut questions on the potential for, and the ramifications of, the United States' use of cyber attack as a component of its military and intelligence arsenal have not been the subject of much public debate. Although the policy and organizational issues raised by the use of cyber attack are significant, the report says, neither government nor society at large is organized or prepared to handle issues related to cyber attack, let alone to make broadly informed decisions,'" according to an NRC summary. "The U.S. could use cyber attack either defensively, in response to a cyber attack from another nation, or offensively to support military missions or covert actions... Deterring such attacks against the U.S. with the threat of an in-kind response has limited applicability, however; cyber attacks can be conducted anonymously or falsely attributed to another party relatively easily, making it difficult to reliably identify the originator of the attack." -- Winter Casey