On the Use of Offensive Cyber Capabilities - Belfer Center for ...

Cyber Action Overall Severity of Implication RecommendationsScanningIntrusionDataCollectionCyber AttackCounterattackCyber Force Establish interagency understanding thatscanning is good intelligence practice. Do not describe scanning as “attacks.” Conduct with good operational security. Establish process to share identifiedvulnerabilities when appropriate. Conduct only to improve cyberspace securityor support higher U.S. strategic objectives. Establish disclosure procedures for sharingidentified vulnerabilities, when appropriate. Amend the CFAA. Employ signaling in intrusions when able. Ensure protection of privacy. Promote reasonable norms for privacyprotection standards. Continually fund research of new TTPs. Recognize that Cyber Attacks are a useful,short-of-force, tool for political coercion. Conduct Cyber Attacks only in a manner thatis internationally understood to notconstitute an “armed attack.” Develop matrix to categorize counterattackcapabilities based on uniqueness. Create metrics to categorize scenarios basedon imperative to act. Engage in interagency dialogue to createcounterattack norms. Refine method for executing counterattacks. Create escalation and de-escalation matrix. Do not engage in cyber force unless thefollowing conditions are met:o Conforming to LOACo Minor or no spillover effects (if overt)o Coordinated with allied partners andlegitimized through multi-national bodyo In concert with traditional military forceand as targeted as possibleo Limit use of catastrophic cyber force tosituations of declared general warfare.Table 1: Summary of Analysis and Recommendations7