President can order preemptive cyberattacks if needed
Secret review shows executive office has broad power to act in cyber emergency
Computerworld - A secret review of American policies governing the use of cyberweapons has concluded that President Barack Obama has the broad power to order pre-emptive strikes on any country preparing to launch a major digital attack against the U.S.
The review is part of an ongoing effort by the Administration to develop new ground rules for U.S. engagement in cyberspace. Over the next few weeks the administration will work on approving rules for how the military can defend or retaliate against cyberattacks launched by unfriendly nation states, according to a report in The New York Times.
The rules will also spell out how far U.S. intelligence agencies can go in looking for and mitigating imminent threats against U.S. assets in cyberspace, The Times reported, quoting unnamed sources. It would spell out situations where the military, with presidential approval, would be allowed to go out and preemptively inject destructive code on an adversary's networks, the report noted.
The order would also provide for exceptions where the military would be permitted to carry out preemptive cyberattacks of a tactical nature where executive approval would not be necessary
The highly classified rules have been under development for nearly two years and are apparently a response to growing concerns about crippling attacks against U.S. critical infrastructure targets by enemy states.
The new policies would continue to bar the military from defending domestic civilian targets against most cyberattacks, since that would be a task carried by the U.S. Department of Homeland Security. However, in the event of a major cyberattack the rules would allow the Pentagon to become involved. The threshold for what constitutes a major event will be deliberately kept shrouded to confound adversaries.
News of the administration's plans to develop new rules of engagement in cyberspace follows the recent disclosure that the Pentagon is planning on adding as many as 4,000 more troops and civilians to its Cyber Command. The goal of the planned staffing increase is to create three separate types of cyberforces each tasked with specific roles and responsibilities. The cyberforce structure will include Cyber National Mission Forces, Cyber Combat Mission Forces and Cyber Protection Forces, a military official said.
Together, the moves constitute a broad ranging effort by the government to come up with a strategic policy for dealing with online threats. The U.S. is already regarded as having a fairly aggressive posture in cyberspace. The Stuxnet attacks in 2010 that temporarily took out nearly one-fifth of the 5,000 centrifuges that Iran had operating at the Natanz nuclear facility for example is believed to be one example of a pre-emptive strike that has already taken place.
Though the U.S. government has never officially conceded to its role in the attack many with the government have anonymously admitted to its involvement in creating and deploying Stuxnet.
While many see the moves as vital to protecting American interests in cyberspace, others worry that the efforts at building an offensive capability are misdirected.
"Indeed, the Obama Administration has been so intent on responding to the cyber threat with martial aggression that it hasn't paused to consider the true nature of the threat," wrote Thomas Rid, a Reader in War Studies at King's College in London and a non-resident fellow at the School for Advanced International Studies at Johns Hopkins University.
"And that has lead to two crucial mistakes: first, failing to realize (or choosing to ignore) that offensive capabilities in cyber security don't translate easily into defensive capabilities. And second, failing to realize (or choosing to ignore) that it is far more urgent for the United States to concentrate on developing the latter, rather than the former," Rid wrote.
It is a position shared by others. "It does seem as though the U.S. is ramping up its offensive capabilities a hell of a lot more than preparing for defensive resiliency," Daniel Drezner, a professor of international politics at Tufts University, wrote in a blog post on Monday. "In an arena populated by non-state actors and quasi-non-state actors, defense would seem to me to be a far more important concern."
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org.
- Syrian Electronic Army shanghais Microsoft's Twitter account, blog
- Is French outrage against U.S. spying misplaced?
- Lawmakers seek answers on Obamacare Data Hub security
- China-based hacking group behind hundreds of attacks on U.S. companies
- How to Prepare for a Potential Syrian Counterattack on the U.S. Power Grid
- New York Times site outage caused by attack on domain registrar, company says
- Cyber drills like Quantum Dawn 2 vital to security in financial sector
- Quantum Dawn 2 will test Wall Street's cyber readiness
- Pentagon accuses China of cyberattacks on U.S military, business targets
- Spamhaus attacks expose huge open DNS server dangers
Read more about Cyberwarfare in Computerworld's Cyberwarfare Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Cyberwarfare White Papers | Webcasts