Tuesday, May 31, 2011

Pentagon's New(ish) Policy About Hack Attacks

First, the bad news: The United States is vulnerable to an attack on our information technology.

Now, the good news: It's possible to defend against a 'cyberattack.' And the American military has been working on ways of dealing with threats to our info tech.

Welcome to the 21st Century

That good news/bad news thing is from my point of view, of course.

I live in this country. I like being able to run a furnace during winter, get air conditioning now and then in the summer, and use the telephone year-round. All of which depend on a power grid and telecommunications system that rely on software and computers.

I think that the Pentagon isn't anywhere near as big a threat to me as, say, Al Qaeda. Which isn't the same as assuming brass hats can do no wrong. (June 18, 2009) The American military isn't perfect. I don't expect that of any human institution. What's remarkable about the people who defend this country is that they routinely and objectively review what's been done - then learn from their mistakes - and successes. (June 30, 2008)

Military Minds, Hackers, and Obligatory Hand-Wringing

News that an attack on America's information technology will be treated as an act of war, like any other attack, will almost certainly hit old-school news media this June.

The Wall Street Journal has already published an article about the report.1 That paper has been around since the late 19th century, so in a sense it's 'old school,' but their editors seem to have noticed that class struggles and Yankee imperialism are a trifle dated as relevant topics go. So is "relevance," for that matter - and that's another topic.

In a perfect world, the Pentagon would have noticed America's reliance on information technology - and how an attack could target that technology - years ago. For that matter, in a perfect world we wouldn't need armed forces: and nobody would have decided to fly airliners into New York City's World Trade Center.

I'd like to be wrong about this, but my guess is that we'll read some of the usual complaints:
  • Paranoid generals
  • Threats to our privacy
  • American
    • Arrogance
    • Insensitivity
    • Whatever
And, of course, how any attack on American information technology is our fault. That's probably when Stuxnet will be displayed as an example of American indifference. Or something else that's pretty much icky.

Maybe that sort of knee-jerk response has gone out of fashion. Things change, including biases among the powers that be. Sometimes change comes when the powers that be themselves get swapped out. And that's yet another topic. (May 26, 2011, March 18, 2011)

Dealing With Uncertainty

A concern that's already been raised is, I think, more reasonable: how to tell where an attack on an American information system came from.

Anything involving the Internet will be easy enough to track, in a way. A few years ago, a series of such attacks came from China. Or, rather, servers in China. March 20, 2010, February 22, 2010, October 10, 2008) The Chinese government's official line is that it wasn't them.

They could be right. I don't necessarily think so - but it is possible that whoever planned the various attacks lived in and operated out of, say, Liechtenstein. Or Kenya. Or Paraguay. Or anywhere else in the world with modestly-adequate Internet connections. Trojan horse viruses are nothing new: and a government-run server could be hijacked by one. (Apathetic Lemming of the North (October 3, 2010))

One thing I'm not particularly worried about is a Dr. Strangelove scenario where one (1) lunatic general - American, of course - decides to make it look like China launched yet one more hack attack on America. It could happen, of course: but I'm pretty sure that this country, at least, has learned to be a little more careful than we were back in the "remember the Maine" days.

Perfect, no. But we do, I think, learn.

Why I Believe What I Believe

As I said earlier, I like living in America.

I was born here, so there's a sort of 'this is my home' feeling involved. I've also known folks who weren't born here, and decided to pull up roots and become Americans. I know that this country isn't perfect: but it's one of the nations folks are trying to break into.

I've discussed some of the reasons I think the way I do in another blog: including posts listed in the last quintet of links under "Related posts."

Related posts:
In the news:

1 Excerpt from today's news:
"The Pentagon's first formal cyber strategy, unclassified portions of which are expected to become public next month, represents an early attempt to grapple with a changing world in which a hacker could pose as significant a threat to U.S. nuclear reactors, subways or pipelines as a hostile country's military.

"In part, the Pentagon intends its plan as a warning to potential adversaries of the consequences of attacking the U.S. in this way. 'If you shut down our power grid, maybe we will put a missile down one of your smokestacks,' said a military official.

"Recent attacks on the Pentagon's own systems - as well as the sabotaging of Iran's nuclear program via the Stuxnet computer worm-have given new urgency to U.S. efforts to develop a more formalized approach to cyber attacks. ... This weekend Lockheed Martin, a major military contractor, acknowledged that it had been the victim of an infiltration, while playing down its impact.

"The report will also spark a debate over a range of sensitive issues the Pentagon left unaddressed, including whether the U.S. can ever be certain about an attack's origin, and how to define when computer sabotage is serious enough to constitute an act of war....

"...One idea gaining momentum at the Pentagon is the notion of 'equivalence.' If a cyber attack produces the death, damage, destruction or high-level disruption that a traditional military attack would cause, then it would be a candidate for a 'use of force' consideration, which could merit retaliation.

"The Pentagon's document runs about 30 pages in its classified version and 12 pages in the unclassified one. It concludes that the Laws of Armed Conflict - derived from various treaties and customs that, over the years, have come to guide the conduct of war and proportionality of response - apply in cyberspace as in traditional warfare.... The document goes on to describe the Defense Department's dependence on information technology and why it must forge partnerships with other nations and private industry to protect infrastructure.

"The strategy will also state the importance of synchronizing U.S. cyber-war doctrine with that of its allies, and will set out principles for new security policies. The North Atlantic Treaty Organization took an initial step last year when it decided that, in the event of a cyber attack on an ally, it would convene a group to 'consult together' on the attacks, but they wouldn't be required to help each other respond....

"...Pentagon officials believe the most-sophisticated computer attacks require the resources of a government. For instance, the weapons used in a major technological assault, such as taking down a power grid, would likely have been developed with state support, Pentagon officials say.

"The move to formalize the Pentagon's thinking was borne of the military's realization the U.S. has been slow to build up defenses against these kinds of attacks, even as civilian and military infrastructure has grown more dependent on the Internet. The military established a new command last year, headed by the director of the National Security Agency, to consolidate military network security and attack efforts.

"The Pentagon itself was rattled by the 2008 attack.... At the time, Pentagon officials said they believed the attack originated in Russia, although didn't say whether they believed the attacks were connected to the government. Russia has denied involvement.

"The Rules of Armed Conflict that guide traditional wars are derived from a series of international treaties, such as the Geneva Conventions, as well as practices that the U.S. and other nations consider customary international law. But cyber warfare isn't covered by existing treaties. So military officials say they want to seek a consensus among allies about how to proceed.

" 'Act of war' is a political phrase, not a legal term, said Charles Dunlap, a retired Air Force Major General and professor at Duke University law school....
(The Wall Street Journal)

4 comments:

Online Home Inspector said...

It's almost impossible to prove though those individuals outside government are responsible for any cyber attack or individuals assigned to cyber attack us by a government and there's the rub. We now can respond to a cyber attack with bombs using the excuse that any particular government was reallly responsibl¬e. Obama has become one the most hawkish presidents, a hawk among hawks.

Brian Gill said...

Online Home Inspector,

First point - the difficulty of establishing with absolute certainty who launched a cyber attack - is true, in my opinion.

However, I think this country's leadership - and others - are adjusting to the reality that information technology is vulnerable.

Although it's true that a hack attack could be used as an "excuse" for a response with conventional weapons.

I am of the opinion that President Obama is a severe disappointment to quite a number of people who expected him to inaugurate a sort of secular utopia where doctrinally pure liberal ideas would be applied. Perhaps I'm being unfair.

As for being "one of the most hawkish presidents," in light of the term "excuse," I assume that is a criticism of the Obama administration. It may be justified, but I am not convinced of this.

Social Networking Savings said...

Cyber attacks constitute an act of war, and deserve a military response when they can be traced back to nation-states like China. The intent behind these attacks is no different than the intent behind the 9/11 attack on the Pentagon. Those responsible in both instances are looking to disrupt our ability to function and respond to a crisis, and in practical terms this would carry more severe consequences than a regular military attack. Therefore, our military response should be proportional.

Brian Gill said...

Social Networking Savings,

Although intent is difficult to prove, objectively: I'm strongly inclined to agree with you.

It's difficult to imagine a reason for damaging a country's power grid, for example, if the intent was not to cause massive disruption and probable loss of life. I can imagine a situation where a group of technically gifted people might imagine that they were 'saving the planet' by pulling the plug on North America's electrical system - but the, I've got a very active imagination.

Bottom line, I'm somewhat relieved to see that America's leadership has started working out details of how to deal with information technology - before a major crisis happens.

Unique, innovative candles


Visit us online:
Spiral Light CandleFind a Retailer
Spiral Light Candle Store

Blogroll

Note! Although I believe that these websites and blogs are useful resources for understanding the War on Terror, I do not necessarily agree with their opinions. 1 1 Given a recent misunderstanding of the phrase "useful resources," a clarification: I do not limit my reading to resources which support my views, or even to those which appear to be accurate. Reading opinions contrary to what I believed has been very useful at times: sometimes verifying my previous assumptions, sometimes encouraging me to change them.

Even resources which, in my opinion, are simply inaccurate are sometimes useful: these can give valuable insights into why some people or groups believe what they do.

In short, It is my opinion that some of the resources in this blogroll are neither accurate, nor unbiased. I do, however, believe that they are useful in understanding the War on Terror, the many versions of Islam, terrorism, and related topics.