Is Cyber Deterrence Possible

In recent years, the importance of operating in and protecting the cyber domain has gained much attention. As long as our nation relies on computer networks as a foundation for military and economic power, our national and economic security are at risk through the cyber domain. Cyber attacks on US industry and government systems severely impact our economy and ability to execute modern network-centric warfare. Our reliance on networked systems and the high costs associated with cyber attacks have led many leaders in the US government and Department of Defense to focus resources toward developing a strategy for deterring adversaries from attacking our networks in the first place. This effort has led to much debate about the question, is cyber deterrence possible? Deterrence in the cyber domain is drastically different and far more complicated than in other military domains (air, land, sea, and space). Cyber weapons and offensive cyber techniques are relatively inexpensive and easily obtained or developed. The number of adversary groups capable of attacking US networks is large, and our ability to deter each group will vary based on its motives and levels of risk tolerance. An effective cyber deterrence strategy must be multilayered and use all instruments of US national power. This paper discusses the difficulties of deterring unwanted cyber activities, provides some realistic expectations for a deterrence strategy, and offers proposals to help mitigate the problems.

Cyberspace, where information--and hence serious value--is stored and manipulated, is a tempting target. An attacker could be a person, group, or state and may disrupt or corrupt the systems from which cyberspace is built. When states are involved, it is tempting to compare fights to warfare, but there are important differences. The author addresses these differences and ways the United States protect itself in the face of attack.

The national security of the United States depends on a secure, reliable and resilient cyberspace. The inclusion of digital systems into every aspect of US national security has been underway since World War II and has increased with the proliferation of Internet-enabled devices. There is an increasing need to develop a robust deterrence framework within which the United States and its allies can dissuade would-be adversaries from engaging in various cyber activities. Yet despite a desire to deter adversaries, the problems associated with dissuasion remain complex, multifaceted, poorly understood and imprecisely specified. Challenges, including credibility, attribution, escalation and conflict management, remain ever-present and challenge the United States in its efforts to foster security in cyberspace. These challenges need to be addressed in a deliberate and multidisciplinary approach that combines political and technical realities to provide a robust set of policy options to decision makers. The Cyber Deterrence Problem brings together a multidisciplinary team of scholars with expertise in computer science, deterrence theory, cognitive psychology, intelligence studies and conflict management to analyze and develop a robust assessment of the necessary requirements and attributes for achieving deterrence in cyberspace. Beyond simply addressing the base challenges associated with deterrence, many of the chapters also propose strategies and tactics to enhance deterrence in cyberspace and emphasize conceptualizing how the United States deters adversaries.

In a world of increasing dependence on information technology, the prevention of cyberattacks on a nation's important computer and communications systems and networks is a problem that looms large. Given the demonstrated limitations of passive cybersecurity defense measures, it is natural to consider the possibility that deterrence might play a useful role in preventing cyberattacks against the United States and its vital interests. At the request of the Office of the Director of National Intelligence, the National Research Council undertook a two-phase project aimed to foster a broad, multidisciplinary examination of strategies for deterring cyberattacks on the United States and of the possible utility of these strategies for the U.S. government. The first phase produced a letter report providing basic information needed to understand the nature of the problem and to articulate important questions that can drive research regarding ways of more effectively preventing, discouraging, and inhibiting hostile activity against important U.S. information systems and networks. The second phase of the project entailed selecting appropriate experts to write papers on questions raised in the letter report. A number of experts, identified by the committee, were commissioned to write these papers under contract with the National Academy of Sciences. Commissioned papers were discussed at a public workshop held June 10-11, 2010, in Washington, D.C., and authors revised their papers after the workshop. Although the authors were selected and the papers reviewed and discussed by the committee, the individually authored papers do not reflect consensus views of the committee, and the reader should view these papers as offering points of departure that can stimulate further work on the topics discussed. The papers presented in this volume are published essentially as received from the authors, with some proofreading corrections made as limited time allowed.

This book creates a framework for understanding and using cyberpower in support of national security. Cyberspace and cyberpower are now critical elements of international security. United States needs a national policy which employs cyberpower to support its national security interests.

According to the FBI, about 4000 ransomware attacks happen every day. In the United States alone, victims lost $209 million to ransomware in the first quarter of 2016. Even worse is the threat to critical infrastructure, as seen by the malware infections at electrical distribution companies in Ukraine that caused outages to 225,000 customers in late 2015. Further, recent reports on the Russian hacks into the Democratic National Committee and subsequent release of emails in a coercive campaign to apparently influence the U.S. Presidential Election have brought national attention to the inadequacy of cyber deterrence. The U.S. government seems incapable of creating an adequate strategy to alter the behavior of the wide variety of malicious actors seeking to inflict harm or damage through cyberspace. This book offers a systematic analysis of the various existing strategic cyber deterrence options and introduces the alternative strategy of active cyber defense. It examines the array of malicious actors operating in the domain, their methods of attack, and their motivations. It also provides answers on what is being done, and what could be done, by the government and industry to convince malicious actors that their attacks will not succeed and that risk of repercussions exists. Traditional deterrence strategies of retaliation, denial and entanglement appear to lack the necessary conditions of capability, credibly, and communications due to these malicious actors’ advantages in cyberspace. In response, the book offers the option of adopting a strategy of active cyber defense that combines internal systemic resilience to halt cyber attack progress with external disruption capacities to thwart malicious actors’ objectives. It shows how active cyber defense is technically capable and legally viable as an alternative strategy for the deterrence of cyber attacks.

"Published in the United Kingdom in 2013 by C. Hurst & Co. (Publishers) Ltd"--Title page verso.

In a very short time, individuals and companies have harnessed cyberspace to create new industries, a vibrant social space, and a new economic sphere that are intertwined with our everyday lives. At the same time, individuals, subnational groups, and governments are using cyberspace to advance interests through malicious activity. Terrorists recruit, train, and target through the Internet, hackers steal data, and intelligence services conduct espionage. Still, the vast majority of cyberspace is civilian space used by individuals, businesses, and governments for legitimate purposes. Cyberspace and National Security brings together scholars, policy analysts, and information technology executives to examine current and future threats to cyberspace. They discuss various approaches to advance and defend national interests, contrast the US approach with European, Russian, and Chinese approaches, and offer new ways and means to defend interests in cyberspace and develop offensive capabilities to compete there. Policymakers and strategists will find this book to be an invaluable resource in their efforts to ensure national security and answer concerns about future cyberwarfare.