Appendix

Cyber warfare (CyW). Any act intended to compel an opponent to fulfill our national will, executed against the software controlling processes within an opponent‘s system. CyW includes the following modes of cyber attack: cyber infiltration, cyber manipulation, cyber assault, and cyber raid. Cyber infiltration (CyL). Penetration of the defenses of a software-controlled system such that the system can be manipulated, assaulted, or raided. Cyber manipulation (CyM). Following infiltration, the control...

Blog Conclusion

To defend against all forms of cyber attack, the United States must have the ability to deter attacks. In most cases the first line of deterrence will be a strong defense to deny potential cyber attackers access to our systems. However, because of the inherently open nature of our systems, it will be impossible to stop all intrusions. As long as there is any risk for computer attack, we remain vulnerable. The second part of a strong deterrent policy will be the threat of retaliation or punishment....

Appropriate US Response

Finally, the spectrum of cyber conflict as depicted in figure 5 speaks to the type of appropriate response from the US government in case of a cyber attack. In most cases, the appropriate response will be prosecution of the perpetrator either within the United States or by extradition to the US or through appropriate courts in other countries. However, there will be times that the identity of the perpetrator reveals intent by a foreign government to do harm to US national security interests. It...

Law Enforcement Response

The only case as shown in the Spectrum of Cyber Conflict diagram in which the DOD would initially respond to a cyber attack would be in the case of a serious attack coming from outside the United States. However, even in these circumstances, DOD officials must work closely with Law Enforcement in case the trace is eventually looped back to the United States. In addition, in most cases if the attack is determined to be located within an allied or friendly foreign country, a US law Enforcement agency...

Location of the Perpetrator (Outside or Within US)

As shown in figures 3 and 4, if the initial computer intrusion is identified as coming from outside the United States, the DOD does not violate any US laws by tracing the computer attack back to its source. However, if at any point during the trace back, the intrusion uses a computer system located within the US, DOD officials are not authorized by US law under the Privacy Act to obtain information from that system. At this point, appropriate law enforcement agencies would have to acquire court...

Intention of Cyber-Actors

The intention of actors or perpetrators of cyber attack within the spectrum of cyber conflict can be broken down into two broad categories as relates to national security. These categories are outlined by Lionel D. Alford, Jr., in Appendix A of this paper and are defined as intentional cyber actors (I-actors) and unintentional cyber actors (Uactors). Intentional actors are individuals intentionally prosecuting attack through cyber-means to affect national security. U-actors are individuals who...

Type of Attack

Cyber Crime The first level of conflict is identified as Cyber crime and ranges from illegal exploration, hacking or other computer intrusions perpetrated by an individual or group with criminal or self-motivated interests and intent. Hacktivism The second level of cyber conflict is a relatively new phenomenon identified as "hacktivism" and is politically motivated. Hacktivism is computerized activism and operates in the tradition of non-violent direct action and civil disobedience. It uses the...

Spectrum of Cyber Conflict

The purpose of developing a spectrum of cyber conflict is to show the range of cyber attacks from unintentional actors such as hackers and criminals with only self-serving interests to intentional actors with intent to affect national security. This spectrum will synthesize the type of attack, intentional or unintentional actors, location of attack, and will identify what agency will have the authority to identify and track down the perpetrator. It will also identify what type of appropriate response...

Legal Limitations

Law enforcement agencies face many challenges in responding to information attacks in cyber space, particularly attacks that cross national and regional borders and exploit technologies of concealment. It can be difficult to locate a hacker who has looped through multiple systems, used anonymous services, or entered through a wireless connection from a mobile unit. Another challenge is collection and preservation of evidence. Evidence may be encrypted or dispersed across several countries. Tracking...

Technical Limitations

The vast array of public and private networks connecting computers and users all over the globe is known as cyberspace. Indeed, it is often characterized as a "virtual world" that transcends space. People log onto computers and on-line services without regard to their own geographic location or the location of the system they enter. Computers are addressed through domain names such as "abc.xyz.com," which give no indication of physical location. Similarly, individuals correspond using domain-based...

Determination of Perpetrator

If the Department of Defense wants to have the ability to retaliate against a computer attack whether it is a cyber crime or a cyber warfare attack, they must be able to determine who has committed the attack and their intentions. This chapter will explore the technical and legal difficulties with determining who the perpetrator is and address the necessity for DOD to establish a strong operational relationship with both civil and military law enforcement organizations in order to be able to react...

Cyber Warfare

The highest level of threat on the spectrum of cyber conflict is cyber warfare. Defining exactly what is meant by cyber or information warfare can be difficult and encompasses many aspects of traditional attacks against information systems and also warfare waged by using computer systems to attack computer network or software systems. For the purpose of this paper, cyber warfare will be defined as the "use of computer intrusion techniques and other capabilities against an adversary‘s information-based...

Computer Terrorism

The next threat identified on the spectrum of cyber attack is cyber terrorism. Barry Collin, a senior research fellow at the Institute for Security and Intelligence in California, established the term "cyber terrorism“ to refer to the convergence of cyber space and terrorism. 20 Mark Pollitt, special agent for the FBI, offers a working definition: "Cyber terrorism is the premeditated, politically motivated attack against information, computer systems, computer programs, and data which result in...

Computer Espionage

The next level of threat to the DOD and US national security is cyber espionage. This threat is likely to be the most difficult to distinguish because it may appear to be hacker activity and will intentionally avoid causing damage or harm in order to avoid detection. Although there is little information in the public domain about the use of computer hacking in foreign intelligence operations, there is no doubt that this activity is prevalent among most state intelligence agencies around the world....

Hacktivism

A new phenomenon in the spectrum of cyber conflict has emerged and can be described as electronic disobedience or hacktivism. Computerized activism operates in the tradition of non-violent direct action and civil disobedience and borrows the tactics of trespass and blockade from earlier social movements and applies them to the Internet. A typical civil disobedience tactic is a ”sit-in‘ in which groups of people physically blockade, with their bodies, the entranceways of an opponent's office or...

Cyber Crime (Illegal Exploration and Hacking)

The first type of computer attack combines several different types of unintentional actors into one category defined as cyber crime or "hacker". Although this category of hacker includes many kinds of cyber criminals, from a DOD perspective, the motivation of a hacker without intent to damage the national security of the United States is the importance difference. Therefore, it is necessary to differentiate between cyber crime and other levels of computer attack because it will affect the type...

Types of Computer Attacks

This study will divide the types of computer attacks into two distinct categories based on the intent of the perpetrator of the computer intrusion. This differentiation can be defined as intentional cyber warfare attack (IA) with intentional actors (I-actors) or Unintentional cyber warfare attack (UA) with U-actors (unintentional cyber actors).1 An intentional cyber warfare attack (IA) is any attack through cyber-means to intentionally affect national security (cyber warfare) or to further operations...

Introduction

The United States must be able to deter computer attacks against our critical information infrastructure. A strong deterrence policy involves both a strong defense and the threat of retaliation or punishment. Despite a strong defense to deny cyber attackers access to our systems, we remain vulnerable because it is nearly impossible to stop all intrusions. Therefore, we must be able to punish or retaliate against individuals, sub-state groups or states that are responsible for cyber attacks. This...

Blog Abstract

Our reliance on computers and information-based technologies within DOD has greatly increased our potential for vulnerability if our information systems are attacked. DOD systems now receive numerous intrusion attempts daily and this trend appears to be increasing. It is paramount that DOD develops appropriate defensive courses of action to systematically and appropriately counter the threat of future cyber attacks. The main problem is distinguishing the type of intrusion or attack and developing...