White House promotes whole-of-nation cyber deterrence strategy

Following criticism from lawmakers regarding the lack of a cyber deterrence strategy, the Obama administration recently presented its view on the matter to relevant congressional committees, recommending an across-the-board approach to defending against threats.

According to the document, made available by FedScoop, the administration is emphasizing a whole-of-government and whole-of-nation approach toward deterring cyber threats. The strategy calls for raising the costs and reducing the benefits of conducting malicious cyber activity against computer networks, communications systems, data and infrastructure.

The document outlines various methods adversaries use to access friendly networks and critical infrastructure, including:

• Remote cyber operations that exploit technical vulnerabilities to gain access to target machines, networks and information through cyberspace.
• Supply-chain operations that seek to exploit access to products and services provided to the intended victim and can occur during any point in the product lifecycle. 
• Close-access operations, which may attempt to intercept unprotected wireless communications and other emanations near a targeted system such as hidden emissions from compromised hardware or hosts.
• Insiders that either knowingly or unwittingly provide knowledge about networks, solicit information from other people, corrupt systems or data, or influence decisions by the target organization.

The administration wants to combat cyber activity through deterrence, either by denial or through cost imposition. Deterrence by denial seeks to persuade adversaries that the U.S. can thwart attacks with strong defenses and resilient systems that can quickly recover from attacks or disruptions.  Deterrence through cost imposition is designed to threaten adversaries by inflicting penalties and costs, which could include “pursuing law enforcement measures, sanctioning malicious cyber actors, conducting offensive and defensive cyber operations, projecting power through air, land, sea, and space, and, after exhausting all available options, to use military force,” according to the strategy.

The strategy, however, draws a key distinction between the idea of Cold War-style deterrence and deterrence in cyberspace, a topic that has drawn debate among cyber and security experts. “[C]yber deterrence in the Information Age is substantially different from Cold War era concepts intended to deter the use of weapons of mass destruction,” the document states. “The Cold War was characterized by a small number of nation states who possessed nuclear weapons and were allied with either the United States or the Soviet Union in a bipolar international system. Today, the United States possesses dominant military capabilities, but is asymmetrically dependent on cyberspace and faces highly capable state and non-state adversaries that have the capability, expertise, and intent to conduct significant cyber attacks against us.”

One of the activities specifically outlined to support deterrence is bringing a both a whole-of-government and a whole-of-nation approach to cyber incident response. The administration previously has maintained that it has a range of tools for responding to cyber incidents, including economic sanctions, indictments and in-kind, proportional responses—noting that responses to cyber incidents do not necessarily have to take place in cyberspace.

The strategy identified the various capabilities and skill sets federal agencies can bring to bear:

State Department – coordinate with foreign governments regarding policy responses.

Justice Department – investigative, prosecutorial and law enforcement capabilities’

Homeland Security Department – expertise and knowledge of critical infrastructure can be utilized in incident response and mitigation as well as coordination with the private sector to protect and respond to attacks.

Secret Service – leverage expertise in fraud investigations.

Economic agencies including the Commerce and Treasury departments and the  Office of Trade Representative – leverage understanding of economics and market forces to develop and enforce economic sanctions, trade laws and other actions

One recent example of a non-cyber response that has appeared to have an effect is the indictments filed in May 2014 against members of the Chines People’s Liberation Army. “The Chinese military scaled back its cybertheft of U.S. commercial secrets in the wake of Justice Department indictments of five officers, and the surprising drawdown shows that the law enforcement action had a more significant impact than is commonly assumed,” the Washington Post reported at the end of November. “In the following months, the Chinese military quietly began dismantling its economic espionage apparatus, officials said. PLA leaders, with [Chinese President] Xi’s approval, reviewed the military’s cyber-activities,” the Post reported. “They cracked down on moonlighters within the PLA who were hacking on the side to sell information to companies, and they attempted to halt collection of data that was not central to the national security mission.”

The release of the strategy comes at an especially sensitive time. The Wall Street Journal recently reported that Iranian hackers had infiltrated the systems of a small dam in New York. In addition, the Associated Press released a lengthy, year-long report regarding significant vulnerabilities in the U.S. power grid, which if compromised by hackers could cause significant damage.

While some organizations in government such as the Defense Advanced Research Projects Agency have undertaken efforts to improve resiliency, redundancy and forecasting of such threats and events – all critical components of the White House deterrence strategy – concerns for the vitality of the power grid persist.