DOD's challenge: Balancing bits and bombs

There were few surprises last month when Deputy Defense Secretary William Lynn formally unveiled the Defense Department’s strategy for operating in cyberspace. As had already been reported, it is a defensive strategy built on proportional response and the equivalence of electronic and kinetic attacks.

On the one hand, there were complaints that the strategy is not aggressive enough in ensuring consequences for those who would launch cyberattacks against the United States and, on the other hand, that it risks militarizing the Internet by reserving the right to respond with conventional weapons to electronic attacks.

But Lynn’s comments included three points that should reassure both camps.

Related coverage:

DOD's 5-point cyber plan sees Internet as an 'operational zone'

Cyber Command still struggling to define cyber war

For those who want a more aggressive posture, there is the doctrine of equivalency. In the event of an attack, the United States will not distinguish between bits and bombs. If a cyberattack results in real damage or loss of life, we reserve the right to respond with traditional kinetic weapons as appropriate. At the present time, however, DOD has emphasized a defensive strategy of deterring attacks by denying the attacker benefits rather than threatening retaliation.

This is wise because, at the moment, attribution that would allow the military to respond aggressively to a cyberattack is a problem. It might be tempting to launch a cruise missile when a piece of malware disrupts a critical network, but who do we address it to? It might look like the packets came from China, North Korea or Venezuela, but it is unlikely an attacker would advertise his or her identity. And someone might want to frame an innocent third party.

Attribution still requires considerable forensic investigation and probably the use of traditional human intelligence to identify a cyber attacker with any degree of confidence. Because of this, “we cannot rely on the threat of retaliation alone,” Lynn said.

For those who worry that the Internet will be militarized by the doctrine of equivalency, Lynn explicitly said any response to a cyberattack would be made “under the laws of armed conflict.”

These are the laws that have, with varying degrees of success, helped to civilize modern warfare. Civilized warfare is an oxymoron, but the laws are intended to protect civilian populations and ensure that any military response is proportional to the action that prompts it. This means that we should not be throwing hand grenades at hackers, launching missiles against spammers or taking down an enemy’s civilian power grid. These laws have been broken in the past when convenient, and winners seldom are called to account, but Lynn’s statement that the United States intends to abide by them in cyberspace is a good sign.

And finally for both camps, its creators do not pretend that this strategy is a finished product. The cyberspace domain is too new and is changing too quickly to be fully understood. And its weapons, both offensive and defensive, are not mature. This strategy will evolve with time and experience. Lynn called it “one part of the effort to learn and change over time.”

It would be a mistake to be too aggressive in an arena we do not fully understand with tools and weapons with which we have little real-world experience. At the same time, it would be foolish to ignore the threats or allow potential aggressors to believe we are an easy target. The DOD strategy is a realistic first step toward addressing these concerns in a new domain.

inside gcn

  • power grid (elxeneize/

    Electric grid protection through low-cost sensors, machine learning

Reader Comments


Wow, Earth, that is a crazy assessment of the world through your "Uber left Wing reading glasses". You are probably one of those folks running around saying the "tea party" are terrorists trying to bring down this country by forcing serious discussion of the national debt, while the real terrorists don't exist in your mind. I take serious offense when you state that "US has rarely followed the laws of civilized warfare". War is a messy business, it often doesn't get solved in a neat and orderly fashion and invariably there are accidents and civilian casualties, but to say this is the rule rather the exception shows your total ignorance. The US goes around the world and hands out humanitarian aid and food on a scale unmatched by any other nation and takes extraordinary measures to limit collateral damaged if hostilies need to be brought to a foreign nation. Your argument linking the Giffords shooting and Norway incident to the right is extrememly flawed as well, if anything the maniacs responsible for these actions were fueled by left wing rheatoric not right.

Tue, Aug 2, 2011 earth

As a person that once owned a patch board for an IBM accumulator few articles have filled me with more dread for the future of humanity than this article. “the use of traditional human intelligence” lead to the dark ages with church installed kings and internecine wars for centuries. The US has rarely followed the laws of “civilized warfare” or any other euphemism for doing unto others what they would never accept being done to themselves. How many in the upper ranks or civilian oversight were punished for Abu Gahrib, camp x-ray, the destruction of Palestinian human rights or supplying white phosphorus bombs to use on civilian population areas in Gaza? It isn’t that the Judeo-Christians have stopped burning people at the stake it’s that they have better munitions. The mindset has not improved and it can be argued, given the evidence of the attacks on Iraq and Afghanistan these last decades, and the promotion of “Christian values” that lead to the promotion of people like Rush Limbaugh and the shooting of Rep. Gifords and the children in Norway that it has gotten totally out of control. That our DOD claims the right to bomb anybody, anywhere with drones, violating the sovereignty of other nations and killing people without trial, and now claims the right to do the same for what should be dealt with via international criminal prosecution demonstrates an arrogance not unlike that of the common criminal though at the national scale. Pity the nation that does not arrest such senselessness. Mathew 18:18

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group