The Pentagon has concluded that computer sabotage coming from another country can constitute an act of war, a finding that for the first time opens the door for the U.S. to respond using traditional military force. [...] In part, the Pentagon intends its plan as a warning to potential adversaries of the consequences of attacking the U.S. in this way. “If you shut down our power grid, maybe we will put a missile down one of your smokestacks,” said a military official. – Cyber Combat: Act of War Pentagon Sets Stage for U.S. to Respond to Computer Sabotage With Military Force
In the modern 21st century, this shouldn’t surprised anyone. It gets down to definitions and retaliation.
One idea gaining momentum at the Pentagon is the notion of “equivalence.” If a cyber attack produces the death, damage, destruction or high-level disruption that a traditional military attack would cause, then it would be a candidate for a “use of force” consideration, which could merit retaliation.
Somewhere in the Beltway Richard Clarke is shaking his head. The man who tried to warn the Bush administration, but was demoted below cabinet rank instead, has been writing books about it for a very long time.
Back in 2008, the Russians successfully launched a cyberattack against US Central Command, sending shock waves through the Chairman of the Joint Chiefs Adm. Mullen, who was alarmed enough to brief Bush and SecDef Gates. “This one was significant, this one got our attention,” said one anonymous official.
Cyberwarfare, just imagine how Congress will deal with it. How many of you believe members of Congress are even qualified to make judgments about cybersecurity or attacks of this nature? If the authorization for the Iraq war taught us anything it’s that getting briefed isn’t the same as really knowing the material over which you have jurisdiction.
The thing I think people should be most concerned about is the question of how we determine if we’ve been attacked, and how bad the resulting damage was. Investigating computer break-ins is often something the victims don’t want to do, or they don’t want to publicize the results. Privacy concerns make complete disclosure more difficult, as well. There’s sometimes a fine line between keeping enough network data logged to be able to determine how a problem happened, and making far too many copies of sensitive information and putting it in far too many hands.
This isn’t even a question of whether I trust the government to do the right thing – I’m not sure it can without opening up several other cans of worms.
Didn’t we cyber-attack the Iran nuclear reactor and cause it to become completely destroyed? I could have sworn I heard that on a PBS show recently. Does that mean it was an act of war against Iran? I guess it was. But maybe it’s not clear that it was the US or some other interested country.