News

McAfee: U.S. Needs Clear Cyber War Doctrine

• By William Jackson
• 12/02/2009

A recent study from McAfee on cyber crime and cyber warfare concluded that, like it or not, the world's information infrastructures are becoming theaters of war, as nations develop offensive and defensive capabilities to wage cyber warfare.

"Cyber weapons exist, and we should expect that adversaries might use them," said James Lewis, director of the Technology and Public Policy program at the Center for Strategic and International studies. Lewis is one of 2,000 national and cybersecurity experts who were interviewed for the study.

The threat of cyber war is not comforting, but more disturbing is the fact that we do not know how to use the weapons we are developing. Our ability to defend ourselves and to take the struggle to our enemies is hindered by the difficulty in understanding the sources and motives behind what might be considered hostile action against our networks and systems. Unlike attacks by conventional and nuclear military weapons, cyber attacks tend to be asymmetrical, remote and hidden. It is difficult to tell who is behind an attack and what its objective is.

It is easy to blame North Korea or China for intrusions that seem to be launched from computers in those countries, but the location of a computer or network launching an attack says little about who is behind it.

"There is no way to prove by looking at where the attacks are coming from whether there is a person behind it there, or if the computer is being used unwittingly," said David Endler, senior director of security research at TippingPoint.

Even if security experts get over that hurdle and identify the assailants, they still do not have a coherent policy for response, said Greg Garcia, former assistant secretary for cybersecurity at the Homeland Security Department.

"We didn't have a doctrine for what actually constitutes warfare in cyber space" when he was in government, he said. "We need to have rules for cyber engagement, because it's not going to stop."

Beginning a public dialogue to establish those rules was one of the aims of the McAfee study, said Dmitri Alperovitch, director of research at McAfee. "It's time to take the conversation out of the classified world."

One of the study's goals was to define cyber warfare. To respond to an incident, you must be able to distinguish vandalism from terrorism, and criminal activity from acts of war. The study came up with four criteria:

• Source of the attack: Can the attack be attributed to a nation-state?
• Motivation: Is it being carried out for financial gain, as espionage, for political advantage or for strategic advantage?
• Sophistication: Are the tools being use beyond the level typically used indiscriminately by hackers and criminals?
• Duration: Is the attack being sustained over a period of time with real destructive capability?

Using these criteria helped determine that recent well-publicized incidents, such as attacks against the infrastructures of Estonia and Georgia and foreign intrusion into U.S. defense systems, did not rise to the level of warfare. Nations believed to have cyber warfare capabilities appear to be hesitant to use them.

"We do have a bit of a Cold War situation today," Alperovitch said. Uncertainty of the results of the attack itself and of the response to it make countries hesitant to launch a first strike. "Because the world is so interconnected, there is danger you are going to hurt yourself in an attack."

The doctrine of mutually assured destruction managed to keep fingers off the nuclear button during the height of the Cold War, but it was an extremely high-risk gamble that we should not be willing to repeat today with our critical infrastructure. Motives count in determining a response to an incident. The country needs to become much better at determining as quickly as possible the type, source and objective of apparently malicious cyber activity, and have responsible plans in place for how we react.

One of the most significant statements about cyber warfare in the McAfee report came from Eneken Tikk, legal adviser at Estonia's Cooperative Cyber Defence Centre of Excellence.

"Current international law is not adequate for addressing cyber war," he said. "Analogies to environmental law, law of the sea and kinetic war all break down at some point. Answering the question of when to use force in response to a cyber attack needs its own framework."