TransTracker 's List: IntlComm News Brief - 8/31/2010

• The Pentagon is contemplating an aggressive approach to defending its computer systems that includes preemptive actions such as knocking out parts of an adversary's computer network overseas - but it is still wrestling with how to pursue the strategy legally.
• But officials are reluctant to use the tools until questions of international law and technical feasibility are resolved, and that has proved to be a major challenge for policymakers. Government lawyers and some officials question whether the Pentagon could take such action without violating international law or other countries' sovereignty.

• Some officials and experts say they doubt the technology exists to use such capabilities effectively, and they question the need for such measures when, they say, traditional defensive steps such as updating firewalls, protecting computer ports and changing passwords are not always taken. 

   

   Still, the deployment of such hardware and software would be the next logical step in a cyber strategy outlined last week by Deputy Secretary of Defense William J. Lynn III. The strategy turns on the "active defense" of military computer systems, what he called a "fundamental shift in the U.S. approach to network defense."
• The military's dismantling in 2008 of a Saudi Web site that U.S. officials suspected of facilitating suicide bombers in Iraq also inadvertently disrupted more than 300 servers in Saudi Arabia, Germany and Texas, for example, and the Obama administration put a moratorium on such network warfare actions until clear rules could be established.
• Still, taking action against an attacker's computer in another country may well violate a country's sovereignty, experts said. And government lawyers have questioned whether the Pentagon has the legal authority to take certain actions - such as shutting down a network in a country with which the United States is not at war. The CIA has argued that doing so constitutes a "covert" action that only it has the authority to carry out, and only with a presidential order.
• Policymakers also are grappling with questions of international law. "We are having a big debate about what constitutes the use of force or an armed attack in cyberspace," said Herbert S. Lin, a cyber expert with the National Research Council of the National Academy of Sciences. "We need to know where those lines are so that we don't cross them ourselves when we conduct offensive actions in cyberspace against other nations."

  • Yet another example of someone who should know better manufacturing ambiguity where it does not exist.  What constitutes "use of force" and "armed attack" is the same as it was before, is still based on the same treaties and norms of international behavior as before.  See Michael Schmitt's work on developing metrics for determining when cyber attacks constitute "used of force" or "armed attack" under international law.
• The industry official said his concern is "the militarization" of the international dialogue. "Any time Pentagon leaders start using the terms 'active defense,' " he said, "then my concern is that foreign countries use that as a basis for their doctrine, starting a cycle of tit for tat."

  • Exactly.  We have based our narrative thus far on the argument that it is "them"--foreign actors of various sorts, from governments to terrorists--who are developing cyber attack capabilities and threatening "us."  In actuality, we are finding out that this is all just a cover for our own creation of new weapons systems and, with them, a new "domain" of war.  In turn, we stand the real risk of creating a self-fulfilling prophecy.  If "they" were not developing cyber attack capabilities for use against "us" before, "they" certainly will now.

5 more annotations...

• The worm, dubbed agent.btz, caused the military’s network administrators major headaches. It took the Pentagon nearly 14 months of stop and go effort to clean out the worm — a process the military called “Operation Buckshot Yankee.” The endeavor was so tortuous that it helped lead to a major reorganization of the armed forces’ information defenses, including the creation of the military’s new Cyber Command.
• n 2007, the security firm Symantec rated SillyFDC as “Risk Level 1: Very Low.”
• The havoc caused by agent.btz has little to do with the worm’s complexity or maliciousness — and everything to do with the military’s inability to cope with even a minor threat.

• But what spy service would launch such a lame attack?

   

  “It isn’t the most capable threat, I agree with that,” Lynn replies. “But that kind of makes the point. If you had something of the kind of capability you described and we suffered a compromise as the result of it, it clearly means that we need to have a new strategic approach and that’s what started a couple years ago. I’ve tried to lay out where we’re going going forward.”

  • So let's get this straight.  DoD found itself vulnerable to a "Level 1: Low Risk" threat, the kind of threat that could have been taken care of by one of Symantec's antivirus applications, because it was completely ignorant of its own systems.  And instead of bringing its defense up to date, the response has been to create the U.S. Cyber Command with a mission that includes offensive cyber attack against adversaries, as well as calls from prominent individuals in the defense community to "re-engineer the Internet" to eliminate anonymity online.  Inappropriate, dangerous overkill anyone?

2 more annotations...