On the Use of Offensive Cyber Capabilities - Belfer Center for ...

Internal cyber actions are defined similarly as actions with effects only onsystems owned or operated by the actor. Scanning ports of an adversary’s systemin order to find vulnerabilities is an example of an external cyber action.Scanning ports on one’s own system in order to identify flaws in the network isan example of an internal cyber action. This apparently simple and basicdistinction is actually the source of much confusion in some policy debates. Whatwe have defined as external cyber operations is often referred to as an “offensivecyber attack,” which is a poor description of the action from a DoD policyperspective, obscuring it with military definitions of attack and offense. From asecurity policy perspective, internal actions (those that only affect one’s ownsystems) do not pose relevant concerns in discussion of national security orinternational relations. External actions, however, do require analysis andjustification, and are the focus of this project.Many external cyber actions, particularly those attempting to acquireinformation, are executed through achieving unauthorized access to a computersystem, or an intrusion. For many cyber actions an attempted or successfulintrusion is the first observable event. Attempted intrusions are oftenerroneously reported as “cyber attacks.” This greatly exaggerates the threat andleads to astronomical threat reports. For example Senator Susan Collins wrote:“Every month, an estimated 1.8 billion cyberattacks target the computer systemsof Congress and executive branch agencies, according to the Senate’s sergeant atarms.” 27 Senator Collins is actually referring to the suspected number ofattempted intrusions (via scanning or other methods) and not actual cyberattacks. This type of alarmist hyperbole erodes the nuance that exists in27 (Collins, 2011)19