During the last week of January 2010 I was at the Army War College for a Cyberwarfare Symposium where all the US Combatant Commanders, Service representatives, Joint Staff and Cyber and/or IO leaders were present. The publications we were required to read prior to our participation were voluminous, but when we were finished we all had a very good understanding of how a cyberwar will play out from a variety of perspectives. I came out of this symposium a shaken man; to my core. In many ways this was good and in many ways I was shaken in a bad way. I was surrounded by very intelligent, insightful, learned and experienced professionals. These would be the kind of people I would want on my team if I were to ever pick and choose. The participants spoke with a surprising amount of candor, revealing capabilities and limitations I had not even considered, and I’ve been working in this field for 15 years and around the military for over 30. When I finally sat down and considered all the ramifications from written notes, briefing slides and from conversations, it felt like all the tumblers in a lock were finally opening, opening up and revealing its contents to me.
There seem to be a few schools of thought about offensive cyberwarfare:
1. Official US ‘units’ will perform cyberwarfare
2. Cyber mercenary or even militia ‘units’ will perform cyberwarfare.
3. Patriotic hackers who support US objectives will wage cyberwarfare on behalf of the US
My thoughts are very clear on this issue: Future cyberwarfare will contain all three elements.
In the first case, the lines are fairly clear under United States Code, Title 10 and Title 32, active duty fighters and the national guard will wage a war of sorts via the internet. During the symposium we had the usual talks about crossing international borders, using civilian networks, and unintended consequences. In the past 15 years as an insider I have not met even one person in this field who would even remotely consider planning or executing an operation in cyberspace outside the law and this group was certainly no exception. Their frustration with the speed of the legal system, their pain was obvious in other issues, but their professionalism enabled them to overcome this angst. Title 18, law enforcement and Title 50, governing intelligence operations, are necessary ‘evils’ but cause the defenders of our networks heartache and worry and make our attackers sit on their hands for inordinate periods of time. As a planner for one of the US Combatant Commanders stated, “it is easier for me to launch a tomahawk missile downrange and kill someone than it is for me to release one single electron into someone’s computer”.
Cyber mercenary or even militia units were briefly discussed, but they would be highly illegal, even if they were somehow part of a National Guard unit. I submit, however, that if tensions were to increase, groups of already close-knit computer professionals would form themselves into units of sorts and seek to attack and defend. I am also certain some would have some sort of a healthy relationship where they could operate outside the law but their actions would not be official in any capacity. More than likely this is the type of organization we may be seeing inside China, Russia or even Iran, but without better attribution we may never know for sure.
Patriotic hackers operate completely outside the law but it is extremely unlikely anyone will ever be apprehended or prosecuted for performing these acts outside the law. It is widely acknowledged that the vast majority of the hacking emerging from Russia during the 2008 Russia-Georgia conventional and cyberwars came from patriotic hackers. Toolkits were made available to those supporting the Russians, so that anyone capable of turning on a computer could act as a proxy for the Russian side, complete with targeting instructions and cyber weapons. Timelines were issued and the conventional attack was accompanied by an attack intended to create an information vacuum on many official computers, cutting off information to Georgian citizens. Georgia reacted in many ways, some wrong, some right and showed a surprisingly amount of resiliency and innovation. At one point they were disconnected from the internet, but then nobody got information. At one point they blocked all sites with the .ru domain association, but many of their information sources were effectively stifled. The Georgians moved many of their services to servers in the United States, even then the attacks continued, obviously illegal.
Many of these attacks showed elements of pre-planning, code had been written months prior to the conflict. Attribution was difficult and remains one of the most difficult aspects of cyberwar today; not only which computer was being used to launch botnet attacks against the target, but who controlled the zombie computers and, more importantly, determining which person or organization was responsible. Many of the attacks used previously unknown vulnerabilities, known as zero day exploits, showing a surprisingly complex form of sophistication, leading many to believe there must have been at least tacit Russian government approval.
The really good news is that those responsible for conducting a cyber war on behalf of the United States are not waiting for congressional approval for a US Cyber Command; they are already planning and rehearsing through a wide variety of situations.