It has become abundantly clear that the next great frontier of threats for nation states across the globe exists in the cyber realm. From government and military to the private sector, various nations, industries, groups and agencies have been the targets (and in some cases the ones who carry out) cyber attacks. This growing shift in focus is also coupled with the ever-prevailing concept of exponential increase in technological development and the subsequent dependency on such technologies therein. Surprisingly, the United States is one of the more vulnerable countries when it comes to cyber security (which will be briefly expanded upon later), thus it is especially interesting to note that the United States has unveiled a new strategy to deter future cyber threats by carrying out cyber attacks themselves on foreign nations, actors, groups, etc.
Historically speaking, cyber attacks have really only been around since the 80’s. It is worth noting that while thirty years is a relatively long time in the rapid growth of computer technology, it’s conversely a relatively small amount of time for major policy shifts in government and military to occur. Nonetheless, one of the earliest known acts of cyber warfare occurred in 1983, involving the Soviets, CIA and a Canadian software company. In this case, the CIA was tipped off that the Soviet Union was going to attempt to steal software from a Canadian company to regulate the pumps, valves, etc. of a large Serbian pipeline. Aware of this plan, the CIA tampered with the Canadian software and programmed it to go on the fritz once implemented into the pipeline hardware. The result was an explosion of the pipeline so massive that Norad monitors thought there might have been a nuclear detonation (even though there was not). While this particular example is an exciting one with regards to the massive explosion, cyber attacks since then have been and continue to be relatively benign. Some experts tend to point out that due to the nature of cyber warfare, catastrophic events are unlikely to occur, however certain arguments can be raised to the latter.
While it is true that most cyber attacks have been relatively benign (i.e. DDoS attacks and espionage), some countries have weaknesses in infrastructure that can easily be exploited and cause substantial damage. The United States is one such country. Richard Clarke points out in his book Cyber War, how the United States depends heavily on the cyber realm for many of its sensitive operations within government and military as well as the operation and regulation of its infrastructure, and the aforementioned constitutes vulnerability. The United States military outsources much of its work to private contracting and consulting companies and because of their private nature, the government and military have very little oversight over these companies, and as such, there is sensitive information fragmented and spread out among many different parties. Even if a handful of those are capable of adequately defending themselves against cyber attacks, others may not be and are thus vulnerable to losing such sensitive information. Similarly, infrastructure, such as power grids and forms of transportation (and even satellites) are subject to tampering and sabotage which can result in considerably significant damages depending on how widespread the attack may be.
There have been annual cyber war-games both between the United States and its allies and among the intelligence community, the military and other relevant parties within the United States itself. In these cyber war games, there are scenarios that the participants are faced with in which cyber warfare inevitably breaks out or is used in an effort to deter a belligerent actor from using conventional force. In one particular scenario, participants were divided into the United States and China and pitted against each other. The details of the dispute are not as important as some of the tactics that were used. Examples of such tactics were hacking a Chinese Naval Intelligence satellite and manipulating its boosters, sending it out of its orbit and to its destruction; hacking into the Chinese rail system to override train controls and send them speeding off tracks (although in this scenario, the China team implemented a fail-safe in which their trains were switched to radio control so the attack became null); and hacking the US power grid causing cascading blackouts across certain parts of the country.
In consideration of the latter, it becomes clearer why countries across the globe are strengthening and buffering their cyber defenses. But again, what is interesting is how the United States is incorporating the older, yet still functioning, strategy of deterrence into its new strategy. As most know, deterrence is the strategy used with nuclear missiles; basically the understanding that every other country is deterred from inciting conventional military conflict against a nuclear-armed country because of the possible consequences against the aggressor (i.e. a nuclear strike). Similarly, nuclear-armed countries are deterred from using nuclear weapons against each other due to the concept of Mutually Assured Destruction (MAD). So far this has worked for nuclear weapons, but can deterrence be incorporated into something so intangible as cyber warfare, where thousands of attacks or intrusions happen every day from a plethora of different people around the world?