President can order preemptive cyberattacks if needed
Secret review shows executive office has broad power to act in cyber emergency
Computerworld - A secret review of American policies governing the use of cyberweapons has concluded that President Barack Obama has the broad power to order pre-emptive strikes on any country preparing to launch a major digital attack against the U.S.
The review is part of an ongoing effort by the Administration to develop new ground rules for U.S. engagement in cyberspace. Over the next few weeks the administration will work on approving rules for how the military can defend or retaliate against cyberattacks launched by unfriendly nation states, according to a report in The New York Times.
The rules will also spell out how far U.S. intelligence agencies can go in looking for and mitigating imminent threats against U.S. assets in cyberspace, The Times reported, quoting unnamed sources. It would spell out situations where the military, with presidential approval, would be allowed to go out and preemptively inject destructive code on an adversary's networks, the report noted.
The order would also provide for exceptions where the military would be permitted to carry out preemptive cyberattacks of a tactical nature where executive approval would not be necessary
The highly classified rules have been under development for nearly two years and are apparently a response to growing concerns about crippling attacks against U.S. critical infrastructure targets by enemy states.
The new policies would continue to bar the military from defending domestic civilian targets against most cyberattacks, since that would be a task carried by the U.S. Department of Homeland Security. However, in the event of a major cyberattack the rules would allow the Pentagon to become involved. The threshold for what constitutes a major event will be deliberately kept shrouded to confound adversaries.
News of the administration's plans to develop new rules of engagement in cyberspace follows the recent disclosure that the Pentagon is planning on adding as many as 4,000 more troops and civilians to its Cyber Command. The goal of the planned staffing increase is to create three separate types of cyberforces each tasked with specific roles and responsibilities. The cyberforce structure will include Cyber National Mission Forces, Cyber Combat Mission Forces and Cyber Protection Forces, a military official said.
Together, the moves constitute a broad ranging effort by the government to come up with a strategic policy for dealing with online threats. The U.S. is already regarded as having a fairly aggressive posture in cyberspace. The Stuxnet attacks in 2010 that temporarily took out nearly one-fifth of the 5,000 centrifuges that Iran had operating at the Natanz nuclear facility for example is believed to be one example of a pre-emptive strike that has already taken place.
Though the U.S. government has never officially conceded to its role in the attack many with the government have anonymously admitted to its involvement in creating and deploying Stuxnet.
While many see the moves as vital to protecting American interests in cyberspace, others worry that the efforts at building an offensive capability are misdirected.
"Indeed, the Obama Administration has been so intent on responding to the cyber threat with martial aggression that it hasn't paused to consider the true nature of the threat," wrote Thomas Rid, a Reader in War Studies at King's College in London and a non-resident fellow at the School for Advanced International Studies at Johns Hopkins University.
"And that has lead to two crucial mistakes: first, failing to realize (or choosing to ignore) that offensive capabilities in cyber security don't translate easily into defensive capabilities. And second, failing to realize (or choosing to ignore) that it is far more urgent for the United States to concentrate on developing the latter, rather than the former," Rid wrote.
It is a position shared by others. "It does seem as though the U.S. is ramping up its offensive capabilities a hell of a lot more than preparing for defensive resiliency," Daniel Drezner, a professor of international politics at Tufts University, wrote in a blog post on Monday. "In an arena populated by non-state actors and quasi-non-state actors, defense would seem to me to be a far more important concern."
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org.
- Cyberattacks could paralyze U.S., former defense chief warns
- Syrian Electronic Army shanghais Microsoft's Twitter account, blog
- Is French outrage against U.S. spying misplaced?
- Lawmakers seek answers on Obamacare Data Hub security
- China-based hacking group behind hundreds of attacks on U.S. companies
- How to Prepare for a Potential Syrian Counterattack on the U.S. Power Grid
- New York Times site outage caused by attack on domain registrar, company says
- Cyber drills like Quantum Dawn 2 vital to security in financial sector
- Quantum Dawn 2 will test Wall Street's cyber readiness
- Pentagon accuses China of cyberattacks on U.S military, business targets
Read more about Cyberwarfare in Computerworld's Cyberwarfare Topic Center.
- Top 12 Laptop Bags for Mobile Pros
- Think Deleted Text Messages Are Gone Forever? Think Again
- 7 New Faces of the C-suite
- 5 Ways CIOs Can Rationalize Application Portfolios
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Integrating security with HP TippingPoint This white paper discusses the components and configuration requirements to implement an Intrusion Prevention System (IPS) for CloudSystem Enterprise.
- Five Cloud Security Concerns You Must Address Security for the cloud era should be information centric, built in, adaptive, and proactive. How can you respond to the new threat landscape...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts