President can order preemptive cyberattacks if needed
Secret review shows executive office has broad power to act in cyber emergency
Computerworld - A secret review of American policies governing the use of cyberweapons has concluded that President Barack Obama has the broad power to order pre-emptive strikes on any country preparing to launch a major digital attack against the U.S.
The review is part of an ongoing effort by the Administration to develop new ground rules for U.S. engagement in cyberspace. Over the next few weeks the administration will work on approving rules for how the military can defend or retaliate against cyberattacks launched by unfriendly nation states, according to a report in The New York Times.
The rules will also spell out how far U.S. intelligence agencies can go in looking for and mitigating imminent threats against U.S. assets in cyberspace, The Times reported, quoting unnamed sources. It would spell out situations where the military, with presidential approval, would be allowed to go out and preemptively inject destructive code on an adversary's networks, the report noted.
The order would also provide for exceptions where the military would be permitted to carry out preemptive cyberattacks of a tactical nature where executive approval would not be necessary
The highly classified rules have been under development for nearly two years and are apparently a response to growing concerns about crippling attacks against U.S. critical infrastructure targets by enemy states.
The new policies would continue to bar the military from defending domestic civilian targets against most cyberattacks, since that would be a task carried by the U.S. Department of Homeland Security. However, in the event of a major cyberattack the rules would allow the Pentagon to become involved. The threshold for what constitutes a major event will be deliberately kept shrouded to confound adversaries.
News of the administration's plans to develop new rules of engagement in cyberspace follows the recent disclosure that the Pentagon is planning on adding as many as 4,000 more troops and civilians to its Cyber Command. The goal of the planned staffing increase is to create three separate types of cyberforces each tasked with specific roles and responsibilities. The cyberforce structure will include Cyber National Mission Forces, Cyber Combat Mission Forces and Cyber Protection Forces, a military official said.
Together, the moves constitute a broad ranging effort by the government to come up with a strategic policy for dealing with online threats. The U.S. is already regarded as having a fairly aggressive posture in cyberspace. The Stuxnet attacks in 2010 that temporarily took out nearly one-fifth of the 5,000 centrifuges that Iran had operating at the Natanz nuclear facility for example is believed to be one example of a pre-emptive strike that has already taken place.
Though the U.S. government has never officially conceded to its role in the attack many with the government have anonymously admitted to its involvement in creating and deploying Stuxnet.
While many see the moves as vital to protecting American interests in cyberspace, others worry that the efforts at building an offensive capability are misdirected.
"Indeed, the Obama Administration has been so intent on responding to the cyber threat with martial aggression that it hasn't paused to consider the true nature of the threat," wrote Thomas Rid, a Reader in War Studies at King's College in London and a non-resident fellow at the School for Advanced International Studies at Johns Hopkins University.
"And that has lead to two crucial mistakes: first, failing to realize (or choosing to ignore) that offensive capabilities in cyber security don't translate easily into defensive capabilities. And second, failing to realize (or choosing to ignore) that it is far more urgent for the United States to concentrate on developing the latter, rather than the former," Rid wrote.
It is a position shared by others. "It does seem as though the U.S. is ramping up its offensive capabilities a hell of a lot more than preparing for defensive resiliency," Daniel Drezner, a professor of international politics at Tufts University, wrote in a blog post on Monday. "In an arena populated by non-state actors and quasi-non-state actors, defense would seem to me to be a far more important concern."
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
- New docs show DHS was more worried about critical infrastructure flaw in '07 than it let on
- Needed: Breach detection correction
- Evan Schuman: Resurrection of Full Disclosure mailing list is great news, if you're not a cyberthief
- Cyberattacks could paralyze U.S., former defense chief warns
- Syrian Electronic Army shanghais Microsoft's Twitter account, blog
- Is French outrage against U.S. spying misplaced?
- Lawmakers seek answers on Obamacare Data Hub security
- China-based hacking group behind hundreds of attacks on U.S. companies
- How to Prepare for a Potential Syrian Counterattack on the U.S. Power Grid
- New York Times site outage caused by attack on domain registrar, company says
Read more about Cyberwarfare in Computerworld's Cyberwarfare Topic Center.
- The Evolution of Corporate Cyberthreats Cybercriminals are creating and deploying new threats every day that are more destructive than ever before. While you may have more people devoted...
- Platfora Big Data Analytics for Network Security Platfora amplifies the effectiveness of network security analysis, providing Big Data Analytics capability to augment existing security infrastructure for known threats, and advanced...
- Cloud Computing Drives IT and Business Agility Hybrid Cloud Accelerates Time to Value What is the main focus for IT in your organization - cost or agility? Many IT discussions today focus on cost controls rather...
- Infographic:10 Reasons to Choose vCloud Air Looking to create an agile, productive, and efficient IT environment? Read this simple infographic to learn about the benefits that VMware vCloud® Air™...
- Cloud BI in Action: Recorded Webinar of Customer, Kony, Inc. See how Kony, Inc., a leading enterprise mobility company, is using TIBCO Jaspersoft for Amazon Web Services and Redshift to achieve embedded analytics...
- Cloud BI Overview: Jaspersoft for AWS Check out this overview of Jaspersoft for AWS, to easily and affordably build business intelligence solutions as well as embed visualizations and analytics... All Cyberwarfare White Papers | Webcasts