That decision is among several reached in recent months as the administration moves, in the next few weeks, to approve the nation's first rules for how the military can defend, or retaliate, against a major cyberattack.
New policies will also govern how the intelligence agencies can carry out searches of faraway computer networks for signs of potential attacks on the U.S. and, if the president approves, attack adversaries by injecting them with destructive code - even if there is no declared war.
The rules will be highly classified, just as those governing drone strikes have been closely held. John O. Brennan, Obama's chief counterterrorism adviser and his nominee to run the Central Intelligence Agency, played a central role in developing the administration's policies regarding both drones and cyberwarfare, the two newest and most politically sensitive weapons in the U.S. arsenal.
Cyberweaponry is the newest and perhaps most complex arms race under way. The Pentagon has created a new Cyber Command, and computer network warfare is one of the few parts of the military budget that is expected to grow. Officials said that the new cyberpolicies had been guided by a decade of evolution in counterterrorism policy, particularly on the division of authority between the military and the intelligence agencies in deploying cyberweapons.Officials spoke on condition of anonymity because they were not authorized to talk on the record.
Under current rules, the military can openly carry out counterterrorism missions in nations where the U.S. operates under the rules of war, like Afghanistan. But the intelligence agencies have the authority to carry out clandestine drone strikes and commando raids in places like Pakistan and Yemen, which are not declared war zones. The results have provoked wide protests.
Obama is known to have approved the use of cyberweapons only once, early in his presidency, when he ordered an escalating series of cyberattacks against Iran's nuclear enrichment facilities. The operation was code-named Olympic Games, and while it began inside the Pentagon under President George W. Bush, it was quickly taken over by the National Security Agency, the largest of the intelligence agencies, under the president's authority to conduct covert action.
As the process of defining the rules of engagement began more than a year ago, one senior administration official emphasized that the U.S. had restrained its use of cyberweapons.
"There are levels of cyberwarfare that are far more aggressive than anything that has been used or recommended to be done," the official said.
The attacks on Iran illustrated that a nation's infrastructure can be destroyed without bombing it or sending in saboteurs.
While many potential targets are military, a country's power grids, financial systems and communications networks can also be crippled. Even more complex, nonstate actors, like terrorists or criminal groups, can mount attacks, and it is often difficult to tell who is responsible. Some critics have said the cyberthreat is being exaggerated by contractors and consultants who see billions in potential earnings.
One senior U.S. official said that officials quickly determined that the cyberweapons were so powerful that - like nuclear weapons - they should be unleashed only on the direct orders of the commander in chief.
A possible exception would be in cases of narrowly targeted tactical strikes by the military, like turning off an air defense system during a conventional strikeagainst an adversary.
"There are very, very few instances in cyberoperations in which the decision will be made at a level below the president," the official said. That means the administration has ruled out the use of "automatic" retaliation if a cyberattack on America's infrastructure is detected, even if the virus is traveling at network speeds.
While the rules have been in development for more than two years, they are coming out at a time of greatly increased cyberattacks on U.S. companies and critical infrastructure.
The Department of Homeland Security recently announced that a U.S. power station, which it did not name, was crippled for weeks by cyberattacks. The New York Times reported last week that it had been struck, for more than four months, by a cyberattack emanating from China. The Wall Street Journal and The Washington Post have reported similar attacks on their systems.
"While this is all described in neutral terms - what are we going to do about cyberattacks - the underlying question is, 'What are we going to do about China?"' said Richard Falkenrath, a senior fellow at the Council on Foreign Relations. "There's a lot of signaling going on between the two countries on this subject."
International law allows any nation to defend itself from threats, and the U.S. has applied that concept to conduct pre-emptive attacks.
Pre-emption always has been a disputed legal concept, most recently after former President George W. Bush made it a central justification for the invasion of Iraq in 2003, based on faulty intelligence about that country's weapons of mass destruction. Pre-emption in the context of cyberwar raises a potentially bigger quandary, because a country hit by a pre-emptive cyberstrike could easily claim that it was innocent, undermining the justification for the attack.
"It would be very hard to provide evidence to the world that you hit some deadly dangerous computer code," one senior official said.
The implications of pre-emption in cyberwar were specifically analyzed at length in writing the new rules. One major issue involved in the administration's review, according to one official involved, was defining "what constitutes reasonable and proportionate force" in halting or retaliating against a cyberattack.
During the attacks on Iran's facilities, which the U.S. never acknowledged, Obama insisted that cyberweapons be targeted narrowly, so that they did not affect hospitals or power supplies. Obama frequently voiced concerns that America's use of cyberweapons could be used by others as justification for attacks on the U.S.
The U.S. effort was exposed when the cyberweapon leaked out of the Iranian enrichment center that was attacked, and the code, known as "Stuxnet," replicated millions of times on the Internet.
Under the new guidelines, the Pentagon would not be involved in defending against ordinary cyberattacks on U.S. companies or individuals, even though it has the largest array of cybertools. Domestically, that responsibility falls to the Department of Homeland Security, and investigations of cyberattacks or theft are carried out by the FBI.
But the military, barred from actions within the U.S. without a presidential order, would become involved in cases of a major cyberattack within the U.S.
To maintain ambiguity in an adversary's mind, officials have kept secret what that threshold would be; so far, Defense Secretary Leon E. Panetta has only described the "red line" in the vaguest of terms - as a "cyber 9/11."
The Obama administration has urged stronger firewalls and other systems to provide a first line of defense, and then "resiliency" in the face of cyberattacks. It failed to get Congress to pass cybersecurity legislation that would have allowed the government to mandate standards.
No comments:
Post a Comment