On the Use of Offensive Cyber Capabilities - Belfer Center for ...

More documents

Recommendations

Info

Deterrence and Defense“To the issue of where we're going in the future and deterrence-type strategies associated withcyber and then how they're incorporated into larger deterrence strategies, today we have anetwork that is essentially constructed around point defenses. In other words, you go buy afirewall and some sort of virus protection, you put it on your computer. That's a point defense. Ittends to be the most inefficient defense there is, because you're static; in any attack on you, you'rejust always there. [As an Attacker] you just keep [attacking] as often as you want, and there'sreally no penalty for doing it.” 30 -General James CartwrightOne final area worth clarifying is the difference between deterrence anddefense. Substantial ambiguity and confusion exists in the current literature onthe relationship between deterrence and defense. 31 It is essential that thisdistinction is clear in order to have a productive policy discussion. In this work,we follow the definition of deterrence found in JP 1-2 of “the prevention of actionby the existence of a credible threat of unacceptable counteraction.” This we term activedeterrence.Defense protects systems, directly increasing the cost to conduct a successfulattack. Deterrence increases the cost should an attack succeed either throughthreatened retaliatory action or entanglement (passive deterrence). Given thevaluable information stored in cyberspace and the high cost of defending thisinformation, we agree with the analysis of retired General Cartwright 32 thatorganizations which only defend and do not deter against cyber attacks arecertain to be the victims of cyber attacks as long as they use information systems.All deterrence is inherently achieved through creating a system whereadversaries believe that a successful attack will imposes additional costs on themthat exceed the benefits of an attack. This is generally achieved through30 (Lynn & Cartwright, 2011)31 For example, see (Gourley, 2008)32 (Nakashima, 2011)25
threatening external action or entanglement, respectfully described as active andpassive deterrence. Active deterrence is often achieved through threatened legalor law enforcement activity, but for actors beyond the reach of law, activedeterrence is achieved through threatened military or other state action. As apart of this work we will be exploring what sorts of external cyber action couldand should be employed to achieve an active deterrent effect while following,where applicable, the principles of the law of armed conflict such as militarynecessity, proportionality, and distinction. Active deterrence strategies are mostcredible when officially declared in policy along with a clear demonstration ofcapability, but any declared policy will have a norm setting effect in theinternational community. As such we explore what sorts of cyber deterrencepolicies, and use of offensive cyber action, that the U.S. should be willing toaccept as a new norm for behavior in cyberspace.ConclusionThe above ontology provides policy makers a system that recognizes thedefining characteristics of the Internet and provides a consistent means forcategorizing the relevant activities within it. It moves away from an intent-basedtypology and instead focuses primarily on the effects and ownership of theaffected system. This provides greater clarity to policy makers who analyzecybersecurity policy in order to support national security objectives.Sections IV-VII will examine the cyber policy implications of the keycategories defined by this ontology and the effect that various considerationshave on policy development regarding the areas we have outlined. Additionallywe will provide plausible scenarios to illustrate the above types of external cyberoperations and recommendations for legitimate, legal and effective externalcyber actions.26
Page 1 and 2: On the Use of OffensiveCyber Capabi
Page 3 and 4: Table of ContentsAcknowledgements .
Page 5 and 6: Executive SummaryThe defining chara
Page 7 and 8: FrameworkAssessing the implications
Page 9 and 10: I. IntroductionThough conflict inev
Page 11 and 12: Unfortunately, we believe that ther
Page 13 and 14: To the maximum extent possible we u
Page 15 and 16: these cyberspace operations “comp
Page 17 and 18: Principles Driving the Ontological
Page 19 and 20: Cyber activity can have both logica
Page 21 and 22: cyberspace and complicates sound na
Page 23 and 24: cyber action, but we do find them t
Page 25: Cyber Pre-emption: External cyber o
Page 29 and 30: Figure 5: Framework for Cyber Polic
Page 31 and 32: effects of external cyber operation
Page 33 and 34: International LawInternational cons
Page 35 and 36: There is also an interaction betwee
Page 37 and 38: TemporalCommanders desire the abili
Page 39 and 40: InternationalMultilateral action is
Page 41 and 42: Potential changes to the “laws of
Page 43 and 44: Scanning:IV. Cyber Actions with Min
Page 45 and 46: The 4 th Amendment protects against
Page 47 and 48: operational intelligence collection
Page 49 and 50: security vulnerabilities are identi
Page 51 and 52: 1) Establish an interagency underst
Page 53 and 54: individual’s agency must be justi
Page 55 and 56: Finally section (f) exempts only la
Page 57 and 58: argue it is not intended to limits
Page 59 and 60: intrusion methods are required to e
Page 61 and 62: SystemicDespite the first order eff
Page 63 and 64: is possible. The capabilities used
Page 65 and 66: d. Section (f) should be expanded t
Page 67 and 68: indicates a will to keep the inform
Page 69 and 70: protections for privacy. However, t
Page 71 and 72: information on U.S. persons collect
Page 73 and 74: Example ScenarioThe following scena
Page 75 and 76: the awkward position: if it is unkn
Page 77 and 78:
less severe than attack are largely
Page 79 and 80:
treaties. This second set of duties
Page 81 and 82:
persons. Beyond the limitations pla
Page 83 and 84:
instead of force, when cyber attack
Page 85 and 86:
collection effort to generate all t
Page 87 and 88:
and incentivize technology companie
Page 89 and 90:
operational capabilities for employ
Page 91 and 92:
2) To ensure the operational capabi
Page 93 and 94:
and are entirely permissible ethica
Page 95 and 96:
equires an external component. The
Page 97 and 98:
any one branch’s overreach. (We h
Page 99 and 100:
particularly from limiting espionag
Page 101 and 102:
more destructive/disruptive. Though
Page 103 and 104:
to reach an interagency understandi
Page 105 and 106:
counterattacks to serve as a deterr
Page 107 and 108:
however, may require a significant
Page 109 and 110:
There is a possibility of a backlas
Page 111 and 112:
2) The foreign external cyber opera
Page 113 and 114:
For the purpose of this work, a pre
Page 115 and 116:
Although the ethical considerations
Page 117 and 118:
ight to “life, liberty and securi
Page 119 and 120:
would be hard to overstate. 131 Thi
Page 121 and 122:
ConsequentialDomesticAs mentioned i
Page 123 and 124:
extent to which the executive branc
Page 125 and 126:
public as new U.S. military technol
Page 127 and 128:
IC believes that the HVT is using 3
Page 129 and 130:
Policy Recommendations1) Use of cyb
Page 131 and 132:
identified by our ontology, spannin
Page 133 and 134:
Appendix 1: Summary of Recommendati
Page 135 and 136:
c. Amended (a)(2) (a), (b), and (c)
Page 137 and 138:
gained) and necessity (only the min
Page 139 and 140:
2) If overt, cyber force should be
Page 141 and 142:
Cyber Intrusion: Unauthorized acces
Page 143 and 144:
BibliographyAllison, G. T., & Black
Page 145 and 146:
Etzioni, A. (2011). Cybersecurity i
Page 147 and 148:
Jacobellis v. Ohio, 11 (United Stat
Page 149 and 150:
Nye, Jr., J. S. (2004). Soft Power.
Page 151 and 152:
United Nations. (1948, December 10)
Page 153:
152
show all

On the Use of Offensive Cyber Capabilities - Belfer Center for ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?