Until very recently, America’s battles have all been waged somewhere in physical space—on land, in the air, on water, or in outer space. Many of these domains come along with inherent features that make life harder or easier in battle. History tells us, for example, that defenders generally have an easier time on mountains or hills with a view. Underwater, sound waves travel easily, so countries with the quietest submarines are more effective. And, in space, gravity sets boundaries on where you can go and when. To overcome these obstacles takes human ingenuity, but also a healthy respect for these environmental limits.
Americans are quickly learning now about a fifth domain: cyberspace. In some ways, this battlefield is the same as the others. It’s an arena where countries are competing with one another for political or economic advantage. But it’s also different in some fundamental ways. And how the world decides to use this space will go a long way toward determining how disruptive—or destructive—war in this domain will become. Michael Hayden, the former CIA director under President George W. Bush, believes the United States has a lead role to play in setting up man-made institutions to shape state behavior.
Hayden told an audience at George Washington University on Tuesday that unlike air, sea, or land, cyberspace “is almost defenseless. There are no natural barriers up here in this domain.”
There are a few ways to solve this problem. One is to make some cyberactivities prohibitively costly. The United States could, for instance, link cyberespionage attempts such as the kind China has allegedly committed with other issues in the U.S.-China relationship. As a start, lawmakers such as Sen. Dianne Feinstein, D-Calif., have complained directly to Chinese officials. But because Beijing doesn’t officially acknowledge its hacking activities, the United States might need to become more aggressive. Threatening to restrict the number of visas Washington gives out to Chinese nationals could be one way to deter further hacking, Hayden said.
A more significant step would be for Americans to decide how they want to be protected in cyberspace. It’s a more complicated problem than today’s debates over information-sharing and privacy currently capture.
Think about all the public services you use, directly or indirectly. There are rules governing each. When the cops come knocking, they need a warrant to search your house—but firefighters don’t generally need to ask to save your home. In other words, there isn’t just one best way to protect public safety online.
“Do you want it to be the way the military defends you?” asked Hayden. “The way law enforcement defends you? The way firemen defend you? The way the Centers for Disease Control defends you? Those are all models, they are all legitimate, they all work—in specific domains.”
For now at least, a broad consensus seems to be developing in favor of a more aggressive setup. A Washington Post poll last year found 50 percent of Americans in favor of heavy federal involvement in investigating cyberthreats, even if it came at the expense of personal privacy. Only 38 percent thought otherwise. Meanwhile, the Pentagon has plans to dramatically increase the size of its cyberstaff, though it’s not clear where all the manpower will come from. And as many businesses across the country are now becoming aware of gaps in their cyberdefenses, Washington has been equally invested in going on offense. More and more, it looks as if the militarized model is taking over.
Yet even that approach contains pitfalls. Suppose the Defense Department gains access to a foreign network. Because it isn’t a large step from snooping around to wreaking havoc inside the system, taking that step becomes exceedingly tempting. And that’s true for any state. Setting up a world where checks against that temptation are easily violated raises the baseline risk of an accidental cyberwar.
Thankfully, said Hayden, the vast majority of cyberproblems the United States has dealt with so far have been attempts at cyberespionage—not cyberattack. And there’s a big difference between the two.
Colloquially, said Hayden, “we use cyberattack for anything unpleasant that happens to us on the Web. In my business, a cyberattack is someone using a weapon comprised of ones and zeros to effect damage. We don't call cyberespionage a cyberattack.”
This article appears in the Feb. 21, 2013, edition of National Journal Daily.
Get the latest news and analysis delivered to your inbox. Sign up for National Journal's morning alert, Wake-Up Call, and afternoon newsletter, The Edge. Subscribe here.
Leave A Comment