Cyberspace: A battlefield where the old rules don't apply
Connecting state and local government leaders
Concepts such as deterrence, overwhelming force, even diplomacy don't work against anonymous, asymmetric attacks, experts say.
Asymmetric attacks and the difficulty of identifying attackers makes cyberspace a challenging place in which to defend yourself, and countries such as the United States and alliances such NATO cannot depend on overwhelming force to deter online enemies, military and diplomatic officials said.
“We need to improve our defensive posture,” said the Defense Department’s James Miller, principal deputy undersecretary for policy, during a panel discussion by government and non-governmental agency representatives Nov. 7 at the Center for Strategic and International Studies in Washington.
In addition to hardened, resilient systems, international norms of behavior and collaboration will be needed to police and defend cyberspace.
Related coverage:
China puts itself in the cyber crosshairs — what now?
Cyber war: How close are we to the real thing?
“Awareness of the cyber threat has grown substantially and progress has been made,” said former Deputy Defense Secretary William Lynn. But the country has a limited window of opportunity to defend itself against an increasingly sophisticated array of threats, he said. “Much remains to be done, and in my view we are not moving fast enough.”
A consensus is developing that increasingly dangerous electronic threats to critical information infrastructure and physical infrastructure have made cyber warfare the equivalent of traditional military action. Both the United States and NATO have formally recognized this equivalence in their strategies. But although cyberspace is being recognized as an operational domain in warfare, along with land, sea, air and space, many traditional concepts of warfare and diplomacy do not apply in this new domain.
“Classic deterrence policy fails in the absence of attribution,” said Michele Markoff, senior policy adviser in the State Department’s Office of the Coordinator for Cyber Issues.
Traditional Cold War doctrine relied on the concept of Mutual Assured Destruction to keep superpowers from pulling the nuclear trigger. But retaliation is difficult in cyberspace because it can take too long to effectively identify the source of an attack and it is so much easier to launch an attack than to defend against one.
“We cannot rely on the threat of retaliation alone to deter attacks,” Lynn said. “Deterrence must be based on denying the benefits of the attack.” This means improving defenses, so that launching an effective attack becomes more difficult and expensive, and improving resiliency, so that effects of an attack can be mitigated.
Attribution, the ability to determine who is attacking you, is difficult but not impossible in cyberspace.
“We are working hard to improve our ability to attribute,” said Steven Schleien, DOD’s principal director for cyber policy. But DOD policy assumes that it will not be able to block all attacks. “We are assuming we will have to operate in a degraded environment.”
International cooperation is widely seen as essential in cyber defense, particularly in establishing norms of behavior that can be enforced with diplomatic, political and economic action, as well as by military. But traditional arms control efforts that have been used to limit the spread and use of nuclear and conventional weapons of mass destruction are not likely to work with cyber threats, both military and diplomatic experts agreed.
“It is hard to imagine,” an effective cyber arms control agreement or verification scheme, Markoff said.
“Arms control is not feasible,” said Schleien, who called himself an advocate of arms control.
Although Markoff said there is no single deterrence strategy for cyberspace, she said a set of overlapping strategies could be effective. These include better defense and resiliency, improved intelligence for attribution of attacks, and credible non-military responses such as law enforcement, diplomacy and economic sanctions.
These are most likely to be effective with traditional nation-state adversaries that are accustomed to working within the diplomatic community, Markoff said. It will be more difficult to engage rogue states and terrorist organizations who might see asymmetric, relatively cheap cyberattacks as a powerful weapon.