Cyberconflict and Cybersecurity Initiative
Cyberconflict and Cybersecurity Initiative
Cyberconflict the use of computer power for intelligence gathering
or to attack the computer, communication, transportation, and energy
networks of states or non-governmental groups--is now a major arena of
political, economic, and military contest. Fending off cyberattacks has
become a costly preoccupation of governments, corporations, and
non-profit organizations. Cyberattacks could ultimately lead to massive
financial loss, economic disruptions, or even war.
Despite this potential for harm, little agreement exists on how to
respond. One problem is the lack of understanding, especially among
policymakers, about how interconnected and vulnerable our increasingly
sophisticated computer networks are. Beyond this lies a whole host of
thorny analytical questions: What is our ability to track the source of
attacks? How susceptible are we to "false flag" attacks where the
attackers deliberately seek to "frame" another actor as carrying out an
attack? What responsibility should governments bear for attacks carried
out by their nationals on foreign governments or entities? How should
the responsibility for defending against cyberattacks be apportioned
between government and the private sector, between national governments
and the international community? Can deterrence work in cyberspace?
The Council on Foreign Relations (CFR) is actively engaged in helping
U.S policy makers, business leaders, and the general public better
address these and other questions at the nexus of cybersecurity and
foreign policy. CFR has hosted some of the most important practioners
and thinkers to speak at general meetings and roundtable seminars.
In January 2011, CFR will host a one-day workshop focusing on some of
the trade and economic issues involved in cybersecurity including
supply chain security and corporate espionage. Future meetings and
research will focus on the relationship between cyberwar and the
existing laws of war and conflict; how the United States should engage
other states and international actors in pursuit of its interests in
cyberspace; how the promotion of the free flow of information interacts
with the pursuit of cybersecurity; and the private sectors role in
defense, deterrence, and resilience.
Five CFR Research Fellows work on cyber issues, and they publish in
numerous outlets and comment frequently in the media. And CFR's
membership and corporate programs have a unique ability to draw
expertise from government, industry, and academia to address an issue
that will require greater public-private cooperation, both domestically
and internationally.
Appendix
- Cyber warfare (CyW). Any act intended to compel an opponent to fulfill our national will, executed against the software controlling processes within an opponent‘s system. CyW includes the following modes of cyber attack: cyber infiltration, cyber manipulation, cyber assault, and cyber raid.
- Cyber infiltration (CyL). Penetration of the defenses of a software-controlled system such that the system can be manipulated, assaulted, or raided.
- Cyber manipulation (CyM). Following infiltration, the control of a system via its software, which leaves the system intact, then uses the capabilities of the system to do damage. For example, using an electric utility‘s software to turn off power.
- Cyber assault (CyA). Following infiltration, the destruction of software and data in the system, or attack on a system that damages the system capabilities. Includes viruses and overload of systems through email (email overflow).
- Cyber raid (CyR). Following infiltration, the manipulation or acquisition of data within the system, which leaves the system intact, results in transfer, destruction, or alteration of data. For example, stealing email or taking password lists from a mail server.
- Cyber attack. See CyL, CyM, CyA, or CyR.
- Cyber crime (CyC). Cyber attacks without the intent to affect national security or to further operations against national security.
- Intentional cyber warfare attack (IA). Any attack through cyber-means to intentionally affect national security (cyber warfare) or to further operations against national security. Includes cyber attacks by unintentional actors prompted by intentional actors. (Also see, "unintentional cyber warfare attack.")
- Intentional cyber actors (I-actors). Individuals intentionally prosecuting cyber warfare (cyber operators, cyber troops, cyber warriors, cyber forces).
- Unintentional cyber actors (U-actors). Individuals who unintentionally attack but affect national security and are largely unaware of the international ramifications of their actions. Unintentional actors may be influenced by I-actors but are unaware they are being manipulated to participate in cyber operations. U-actors include anyone who commits CyL, CyM, CyA, and CyR without intent to affect national security or to further operations against national security. This group also includes individuals involved in CyC, journalists, and industrial spies. The threat of journalists and industrial spies against systems including unintentional attacks caused by their CyL efforts should be considered high.
- Unintentional cyber warfare attack (UA). Any attack through cyber-means, without the intent to affect national security (cyber crime)
Blog Conclusion
To defend against all forms of cyber attack, the United States must have the ability to deter attacks. In most cases the first line of deterrence will be a strong defense to deny potential cyber attackers access to our systems. However, because of the inherently open nature of our systems, it will be impossible to stop all intrusions. As long as there is any risk for computer attack, we remain vulnerable. The second part of a strong deterrent policy will be the threat of retaliation or punishment. This ability to retaliate will be instrumental in establishing law and order in cyber space and will give us the ability to hold individuals, sub-state groups and states responsible for cyber attacks. Without this ability to retaliate, potential cyber attackers will continue to threaten US interests with impunity.
There are several technical and legal difficulties with identifying the perpetrator of a cyber attack. Because these attacks against our national information infrastructure and DOD networks are mainly perpetrated via computer intrusions from the Internet, it is very easy for the attacker to hide his identity through the World Wide Web. In addition, an attacker may also be able to hide his intentions by appearing to be a juvenile hacker but is actually collecting foreign intelligence or preparing for cyber warfare operations on behalf of a foreign government. Because of the difficulty in determining the type of attack without identifying the perpetrator, it is paramount to trace back the attack to the attacker.
Inherent in US law is the right to privacy, even on the Internet. The DOD is limited by US laws from obtaining information from computer systems located in the United States without proper legal authority, which can only be obtained via appropriate law enforcement agencies and US courts. Because of these legal restrictions, DOD must work closely with it‘s own investigative agencies and Department of Justice to be able to identify perpetrators and deter future attacks through the threat of punishment or military retaliation.
The spectrum of cyber conflict depicts the range of possible cyber attacks and identifies whether law enforcement or the military could pursue the attacker based on location of the attacker. It also shows the range of possible punishment or retaliation by DOD or the US government based on the perpetrator and his intentions to harm national security. The spectrum progresses from hackers with no intent to affect national security and advances to intentional actors like political activists who use hacktivism to affect changes in national policy. It then increases in threat to cyber espionage and cyber terrorism, which harms national security. Finally, it culminates with full out cyber warfare that furthers military operations (warfare) against a nation. The purpose of this spectrum is not only to depict the different types of computer attack but also to highlight the similarities between computer intrusions and reveal the need to identify not only the perpetrator but understand his intentions. This may not always be possible but in order to strengthen our deterrence of cyber attack, we must improve our ability to trace and identify attackers and retaliate through either criminal prosecution or other means of government sponsored retaliation when necessary.
Appropriate US Response
Finally, the spectrum of cyber conflict as depicted in figure 5 speaks to the type of appropriate response from the US government in case of a cyber attack. In most cases, the appropriate response will be prosecution of the perpetrator either within the United States or by extradition to the US or through appropriate courts in other countries. However, there will be times that the identity of the perpetrator reveals intent by a foreign government to do harm to US national security interests. It may then be appropriate for the US government to apply diplomatic or economic pressure towards the offending country or in certain circumstances retaliate in kind with a cyber attack or through military strikes.
The spectrum of cyber conflict as depicted above attempts to bridge the gap between computer attacks perpetrated with criminal intent and attacks with national security intentions. Both types of attacks are on the same spectrum of conflict and often are difficult to distinguish. Because of this continuum of conflict from crime to warfare, the US and its Department of Defense must be prepared to work within the full constraints of US law and still be able to respond and retaliate against would-be attackers. Without this capability, we will not be able to prevent and deter future attack.
Law Enforcement Response
The only case as shown in the Spectrum of Cyber Conflict diagram in which the DOD would initially respond to a cyber attack would be in the case of a serious attack coming from outside the United States. However, even in these circumstances, DOD officials must work closely with Law Enforcement in case the trace is eventually looped back to the United States. In addition, in most cases if the attack is determined to be located within an allied or friendly foreign country, a US law Enforcement agency such as the FBI or DOD investigative agencies will work with the law enforcement officials from that country to further locate and prosecute the attacker.
So as depicted in figure 5, US law enforcement officials in concert with DOD will be intricately involved in most cyber attacks against the national information infrastructure and DOD systems. This type of relationship between DOD and law enforcement must fundamentally change the understanding and nature of national security defense. It must also shape the way DOD prepares to defend and deter against information warfare attacks.
So as depicted in figure 5, US law enforcement officials in concert with DOD will be intricately involved in most cyber attacks against the national information infrastructure and DOD systems. This type of relationship between DOD and law enforcement must fundamentally change the understanding and nature of national security defense. It must also shape the way DOD prepares to defend and deter against information warfare attacks.
Location of the Perpetrator (Outside or Within US)
As shown in figures 3 and 4, if the initial computer intrusion is identified as coming from outside the United States, the DOD does not violate any US laws by tracing the computer attack back to its source. However, if at any point during the trace back, the intrusion uses a computer system located within the US, DOD officials are not authorized by US law under the Privacy Act to obtain information from that system. At this point, appropriate law enforcement agencies would have to acquire court orders to obtain further information leading to the identification of the perpetrator.
Langganan:
Postingan (Atom)