The U.S. needs to engage in a national dialog about its government's use of cyberattacks against other nations, and the government lacks a comprehensive policy about how and when it will engage in cyberwarfare, a new study says.
The U.S. government also lacks a person or office to coordinate cyberattacks, and agencies making attacks should regularly brief the U.S. Congress about their efforts, said the report, from a panel of military, diplomatic, legal and IT security experts assembled by the National Research Council, a nonprofit organization that provides policy advice to the U.S. government.
The U.S. government's current policy and legal framework on the use of cyberattacks is "ill-informed, undeveloped and highly uncertain," the report said. The U.S. government has no comprehensive policy on how to respond to cyberattacks or how it will use cyberattacks, said the report, released Wednesday.
The U.S. military is developing cyberwarfare capabilities and may have already used them, and U.S. intelligence agencies also have the ability to penetrate computer networks, said Kenneth Dam, a former law professor who has in the past held senior positions in the U.S. Departments of Treasury and State. But those capabilities have been developed largely without public discussion about when cyberattacks are appropriate, he said.
The secrecy surrounding U.S. cyberattack capabilities has impeded debate about the legal and ethical issues associated with cyberattacks and the consequences of such attacks, Dam said.
In many cases, a cyberattack will have a much larger effect than a destroyed computer or network, added William Owens, a retired Navy admiral and former CEO of Nortel Networks. An attack on some computers could cause the electric grid to shut down or a pipeline to stop working, causing widespread problems in the targeted country, he said.
"When you attack a computer, it's not just attacking a computer, it's obviously attacking everything that computer serves," Owens said.
Representatives of the U.S. Air Force and the U.S. Director of National Intelligence, two organizations involved in cyberattacks and defense, didn't immediately respond to a request for comment on the report.
The U.S. government doesn't seem to have a policy about when it will use cyberattacks and what response it will take when another country attacks its computer networks, Owens said. That's why public debate is needed, he added.
Cheap tools for attacking computer networks are easily available, and it's likely that the U.S. government will continue to face serious cyberattacks well into the future, Owens added. "Enduring unilateral dominance of cyberspace is neither realistic or achievable by the United States," he said.
The report distinguishes between cyberattacks and cyberexploitation. It defines cyberattacks as efforts intended to damage or cripple computers and networks, while cyberexploitation is a stealthy effort intended to compromise information held on computers. The report largely focuses on cyberattacks.
In recent years, many media reports have pointed to cyberattacks coming from China or Russia. Earlier this month, China denied reports that it has installed malware on the U.S. electrical grid designed to shut it down.
The National Research Council report doesn't point fingers at specific countries, but it calls for the U.S. government to have a stated policy about how it will respond to attacks. However, it's often difficult to identify where attacks are coming from or whether a foreign government was involved, Dam said.
Recent attacks attributed to China and Russia appear to come from college students wearing "slippers and pajamas," not from foreign militaries, said John Jiang, CTO at Xana, a cybersecurity vendor based in Reston, Virginia. It would be difficult for the U.S. to counterattack in those cases, said Jiang, who was in the audience for the announcement of the report.
Dam agreed, but said it's easy for nations to hire private "patriotic hackers" to carry out cyberattacks.
The offensive cybercapabilities of the U.S. government also came up during a hearing before the U.S. Senate Homeland Security and Governmental Affairs Committee Tuesday. Senator Roland Burris, an Illinois Democrat, asked a panel of cybersecurity experts whether the U.S. had the ability to respond to cyberattacks with its own attacks.
"It most likely seems like we are on the defensive in all of this," Burris said. "Are we in this country doing anything on the offense?"
The U.S. government has significant offensive capabilities, but is also a major target, said James Lewis, director of the Technology and Public Policy Program at the Center for Strategic and International Studies, a Washington, D.C., think tank.
"We have offensive capabilities that are among the best in the world," Lewis said. "The problem is what I would call asymmetric vulnerability. We're a target-rich environment. So even though we're as good as our opponents, they have more stuff to shoot at."
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.