How might the US respond to cyber attacks?

In the wake of the news last week of the Office of Personnel Management hack that exposed millions of individuals’ personal information, it remains unclear what the response by the U.S. government will be. Some pundits and Republican presidential candidates have called for a hard strike against China, and President Obama, speaking at the G7 Summit in Germany—and on the same day that the Army’s website was forced offline by the Syrian Electronic Army—promised “much more aggressive" reactions to cyber attacks, but the U.S. response so far has been muted.

China’s status as the United States’ biggest trading partner and creditor could complicate matters; it was politically easier early this year to hit North Korea with sanctions after it was blamed for the Sony hack. Another reason for the delay could be in identifying exactly who was behind the attack—the White House has not publicly pinned it on the Chinese government, who security experts and anonymous government officials suspect.

But the lack of a response to date doesn’t necessarily mean one won’t be forthcoming. The cyber realm has become an operational domain in the military sense, just as air, land and sea are, and U.S. officials on several occasions have touted a whole-of-government approach combining deterrence, defense and response to cyber threats and incidences.

What would a response look like? Christopher Painter, coordinator for Cyber Issues at the State Department, offered his take on how the U.S. could respond to a hypothetical attack during a Senate subcommittee hearing last month.

Subcommittee chairman Cory Gardner (R-Colo.) framed a hypothetical scenario:  “Let’s say your office receives notification that our nation’s sensitive cyber networks have been penetrated and you determine that the attack originated from the great political science founded nation of Ruritania,” Gardner posited. “We also know that this nation has been hostile to U.S. interests in the past and its leadership has prioritized advancing its cyber capabilities to counter U.S. interests. Basically, walk us through … how do you work with other U.S. government agencies, and then what would be your diplomatic response put in place?”

Painter started with information sharing, both among U.S. agencies and with partner nations, which he said would be key to identifying where an attack came from, what it affected and what might be next. “[W]e are a key part, of the interagency process to respond to cyber attacks and cyber intrusions. We work with our interagency to support both the whole of government responses – what the law enforcement and technical community would do – and also what the White House and other parts of our government would do, and including our Department of Defense,” Painter said. “I’d say that one thing I’ve seen that is a marked difference over the last five or six years is the number – the amount of coordination among federal agencies is far better than it’s ever been before.”

State is part of the Cyber Response Group, which is led by the White House but includes “all the key agencies,” including the Pentagon and the intelligence agencies. Established in December, the group works to share threat information, assign attribution and discusses response coordination across the government. State also is part of the National Cyber Incident Response Plan, which is run by the Homeland Security Department.   

And the department has cooperative relationships with several partner nations and counterparts in other governments, which allows for quick communication and coordination across the globe, he said. Cyber threats can much more easily traverse geographic borders than threats in the physical domain, so rapid response and coordination with others is vital.

Painter offered a few real-world examples of how the government responded to cyber incidents. During a 2012-2013 denial of service attack that targeted financial institutions, the United States reached out to its 20 global partners, to not only raise the level of concern, but build a collective action against shared threats, given that the botnet attack compromised computers all over the world.  “[W]e got a lot of assistance from governments because they understood it wasn’t just a technical issue, it was more of a policy issue and it was elevated in their governments,” Painter said.      

Painter also revisited the Sony attack in December by North Korea. “[P]art of what we did,” Painter explained, “is when it was clear what the attribution was and the president was going to make this attribution, I reached out to counterparts in a number of countries around the world and a number of those countries condemned [North Korea’s] action. And that also shows that that kind of activity is unacceptable – it’s a norm that’s unacceptable.”    

In cyber incidents, however, attribution can be the most difficult component, in part because cyberspace allows for a great deal of anonymity and attacks can be routed through servers all over the globe to mask its origins. 

In the case of the OMB hack, Foreign Policy said what it calls the “attribution problem” is best summed up by confusion regarding U.S. officials quoted by major American news outlets. “[The Washington­] Post said that U.S. officials believed the attack was state-sponsored; the [New York] Times said it was unclear whether the breach had been orchestrated at the behest of Chinese authorities.”       

The United States has taken action against China before, indicting five Chinese military officials in May 2014 for cyber espionage. The indictment was also significant as it demonstrated that the U.S. does not always respond to cyber incidents in cyberspace. “[S]omething I would like to emphasize is, although it’s a cyberattack, we don’t think about the response purely through [a] cyber lens; it would be all the tools of foreign policy and military options,” Eric Rosenbach, principal cyber advisor to the Defense Secretary, said at a congressional hearing this year. 

Rosenbach described DOD’s defensive and offensive role. First, “[w]e need to develop the capabilities to deny a potential attack from achieving its desired effect … Second, the U.S. must increase the cost of executing a cyberattack, and this is where DOD must be able to provide the president with options to respond to cyberattacks on the U.S., if required through cyber and other means… And finally, we have to ensure that we are resilient, so if there is an attack that we can bounce back.”

These goals are in addition to DOD’s three missions for cyberspace: “defending DOD networks, defending U.S. networks overall against significant attacks and providing full-spectrum cyber support for military operations.”   

While it is still unclear exactly what the U.S. will do in response to the OPM hack, which took place in 2014 and was just discovered in April, some are calling for a robust and aggressive response. “We should be deeply concerned as a nation about this – millions of cleared individuals have had an enormous amount of personal information taken, their online identities made far more vulnerable, and secure accounts more easily compromised,” retired Army Lt. Col. John Quigg wrote in Breaking Defense, which identified Quigg as one of the first U.S. cyber warriors.  

“We are seeing a nation-state moving with aplomb across our commercial and governmental networks gathering HUMINT (Human Intelligence) data with little resistance and — to date — no consequences. We have a governmental response that is hamstrung by turf and policy and befuddled by the speed of change in this newest of global commons (military speak for places we fight: Land, Sea, Air, Space, CyberSpace),” Quigg wrote. “A muscular governmental response is called for immediately.” 

The U.S. has proven that it is not afraid to pull the trigger in the cyber domain when it comes to offensive operations. The most famous example was the attack on Iran’s nuclear infrastructure with the Stuxnet virus that damaged about one fifth of Iran’s centrifuges. More recently and less publicized, it was reported that the U.S. purportedly attempted to replicate the Iran attack on North Korea’s nuclear infrastructure five years ago but was unsuccessful. And, of course, China regularly claims that its own networks are under attack from the United States and elsewhere.