The nation needs a clear cyber war doctrine

Experts in McAfee study say methods for identifying and responding to cyber attacks is lacking

A recent study from McAfee on cyber crime and cyber warfare concluded that, like it or not, the world’s information infrastructures are becoming theaters of war, as nations develop offensive and defensive capabilities to wage cyber warfare.

“Cyber weapons exist, and we should expect that adversaries might use them,” said James Lewis, director of the Technology and Public Policy program at the Center for Strategic and International studies. Lewis is one of 2,000 national and cybersecurity experts who were interviewed for the study.

The threat of cyber war is not comforting, but more disturbing is the fact that we do not know how to use the weapons we are developing. Our ability to defend ourselves and to take the struggle to our enemies is hindered by the difficulty in understanding the sources and motives behind what might be considered hostile action against our networks and systems. Unlike attacks by conventional and nuclear military weapons, cyber attacks tend to be asymmetrical, remote and hidden. It is difficult to tell who is behind an attack and what its objective is.

It is easy to blame North Korea or China for intrusions that seem to be launched from computers in those countries, but the location of a computer or network launching an attack says little about who is behind it.

“There is no way to prove by looking at where the attacks are coming from whether there is a person behind it there, or if the computer is being used unwittingly,” said David Endler, senior director of security research at TippingPoint.

Even if security experts get over that hurdle and identify the assailants, they still do not have a coherent policy for response, said Greg Garcia, former assistant secretary for cybersecurity at the Homeland Security Department.

“We didn’t have a doctrine for what actually constitutes warfare in cyber space,” when he was in government, he said. “We need to have rules for cyber engagement, because it’s not going to stop.”

Beginning a public dialogue to establish those rules was one of the aims of the McAfee study, said Dmitri Alperovitch, director of research at McAfee. “It’s time to take the conversation out of the classified world.”

One of the study’s goals was to define cyber warfare. To respond to an incident you must be able to distinguish vandalism from terrorism, and criminal activity from acts of war. The study came up with four criteria:

  • Source of the attack: Can the attack be attributed to a nation state?
  • Motivation: Is it being carried out for financial gain, as espionage, for political advantage or for strategic advantage?
  • Sophistication: Are the tools being use beyond the level typically used indiscriminately by hackers and criminals?
  • Duration: Is the attack being sustained over a period of time with real destructive capability?

Using these criteria helped determine that recent well-publicized incidents, such as attacks against the infrastructures of Estonia and Georgia and foreign intrusion into U.S. defense systems, did not rise to the level of warfare. Nations believed to have cyber warfare capabilities appear to be hesitant to use them.

“We do have a bit of a Cold War situation today,” Alperovitch said. Uncertainty of the results of the attack itself and of the response to it make countries hesitant to launch a first strike. “Because the world is so interconnected, there is danger you are going to hurt yourself in an attack.”

The doctrine of mutually assured destruction managed to keep fingers off the nuclear button during the height of the Cold War, but it was an extremely high-risk gamble that we should not be willing to repeat today with our critical infrastructure. Motives count in determining a response to an incident. The country needs to become much better at determining as quickly as possible the type, source and objective of apparently malicious cyber activity, and have responsible plans in place for how we react.

One of the most significant statements about cyber warfare in the McAfee report came from Eneken Tikk, legal adviser at Estonia’s Cooperative Cyber Defence Centre of Excellence. “Current international law is not adequate for addressing cyber war,” he said. “Analogies to environmental law, law of the sea and kinetic war all break down at some point. Answering the question of when to use force in response to a cyber attack needs its own framework.”

Reader Comments

Mon, Dec 14, 2009 Brad

Based upon these criteria, if "9/11" had been a cyber attack, then it would not have been considered "an act of war", because it was not "attributable to a nation state" (Source of the attack: Can the attack be attributed to a nation state?). We need to realize that "warfare" can be, and is, practiced by entities other than "nation states", especially cyber warfare.

Tue, Dec 8, 2009 Cy

This article is right on the money.

Tue, Dec 1, 2009 Pete

There was a paper on this topic presented at a conference last year. It defines what it means to WIN a cyberwar and then goes on to suggest methods that can be applied by any country to win such a war. The white paper is located at: http://www.cybersoft.com/cs_whitepapers/paper_details.php?content=cs019

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above