On the Use of Offensive Cyber Capabilities - Belfer Center for ...

there are offensive and defensive CNA and offensive and defensive CND. In itsexamination of “offensive cyber”, the National Research Council of the NationalAcademies (hereafter, NRC) recognized this distinction and offered anillustrative example: “[U]nder this rubric, a computer network attack might beused for a defensive purpose, such as the neutralization of a cyberthreat to aDOD computer or network.” 21 If the NRC’s example accurately represents DoD’sintent in JP 3-13, then this hypothetical overlaps the definition of CND, because itwould be an action taken through the use of computer networks to protect DoDnetworks.NRC does not offer an example in which a computer network defensemight be used for offensive purposes. Either such a case would look very muchlike the CNA for defensive purposes example or it would be an illogical one.Though we acknowledge that there is a category of cyber operation that isessentially a counterattack (a defensive measure), it is only defined in part byintent. Attempting to define it otherwise produces an illogical framework.Yet most importantly for this paper, the DoD framework does not providerelevant distinctions that address policy considerations. Specifically, is theresomething in the nature of CND that enables more permissive conditions for itsuse relative to the nature of CNA? If that were the case, then a convenientloophole would seem to exist that would permit commanders to label all CNA asactually offensive CND. These definitions, therefore, do not distinguish betweenthe different operations in cyberspace in a manner that establishes the nature oftheir key differences. This prevents policy makers from having fruitfuldiscussions or establishing effective policies.21 See section 3.1 of (National Research Council, 2009)15