6th European Conference - Academic Conferences

Christopher Perr
This command is the new U.S. Cyber Command and was announced in June of 2009. Before that the
Air Force was hoping to form their own combatant command, but instead settled for a numbered
command. The Navy and Army have their own units as well. With all these new units confusion
regarding responsibility is inevitable.
The mission of U.S. Cyber Command is:
“...to coordinate computer-network defense and direct U.S. cyber attack operations (US
military prepares for ‘cyber command, 2010).”
Unfortunately, this new command with a somewhat clear mission did not seem to solve all of the ills
that cyberspace has created. In January of 2010 the Pentagon attempted to respond to a simulated
cyber attack.
“The results were dispiriting. The enemy has all the advantages: stealth, anonymity, and
unpredictability. No one could pinpoint the country from which the attack came, so there
was no effective way to deter further damage by threatening retaliation. What’s more, the
military commanders noted that they even lacked the military authority to respondespecially
because it was never clear if the attack was an act of vandalism, an attempt at
commercial theft, or a state-sponsored effort to cripple the United States, perhaps as a
prelude to conventional war (Markoff, 2010).”
As U.S. Cyber Command has not officially stood up yet it can only be hoped that the response to a
cyber attack would improve after a governing body has been established. Unfortunately, this still
leaves a third problem in our cyber strategy. What about the civilian side?
In March of this year a graduate student in Liaoning, China named Wang Jianwei authored a paper
titled “Cascade-Based Attack Vulnerability on the U.S. Power Grid.” The paper actually had nothing to
do with attacking the U.S. power grid, but instead was a technical exercise with the goal of increasing
security for networked power grids. The paper still created cries of outrage and questions as to who
was in charge of our grids well-being. The interesting part to take note of is that Jianwei chose the
U.S. power grid because it had the most information available on the inner workings of the network
(Markoff, 2010).
At the same time, according to Nielsen Online, in August of 2009 almost 75% of the United States
was listed as ‘users of the internet’ (Miniwatts Marketing Group, 2009). You can imagine that ‘internet
user’ includes lots of activities like banking, social networking, commerce, and business. Without even
mentioning necessities like the power grid or other services, the e-commerce sector alone was worth
more than $100 billion in 2007. You can see why the civilian sector would have a vested interest into
the handling of cybersecurity. The concern is that the DoD will dominate the area of cybersecurity and
the civilian side will be forced to submit to harsh and sometimes arbitrary regulation.
The answer to the concerns raised about the DoD’s dominance of cyber security and operations? The
Department of Homeland Security will eventually be receiving a Director for Cybersecurity, and
currently has in place an Office of Cybersecurity and Communications. Their specific responsibility is
listed below.
“The Office of Cybersecurity and Communications (CS&C) is responsible for enhancing
the security, resiliency, and reliability of the nation’s cyber and communications
infrastructure. CS&C actively engages the public and private sectors as well as
international partners to prepare for, prevent, and respond to catastrophic incidents that
could degrade or overwhelm these strategic assets (Department of Homeland Security,
2010).”
As of right now it could be said that none of that is taking place. Recently, when Google first feared
that their operation in China had been hacked, they turned to the NSA, not the Department of
Homeland Security, to help sort out the problem (Markoff, 2010). Where is the communication and
organization for who deals with what? This is without even mentioning that the FBI and the Secret
Service both have units that work in cyber security. The FBI is now also responsible for investigating
cyber crime on U.S. companies even though the attack may have occurred well outside our borders
(FBI probes cyber attack on Citigroup, 2010).With the convoluted policies and rapid changes it is easy
to see where one might be confused. There is no clear guide as to who responds, or how.
Unfortunately, that does not bode well for the defense of the United States. The best that can be said
210