PACIFIC RIM SECURITY CONFERENCE CYBERATTACK A NEW STRATEGIC

PACIFIC RIM SECURITY CONFERENCE CYBERATTACK: A NEW STRATEGIC WEAPON David Elliott February 24, 2010

Some Definitions Cyberattack Offensive cyber action to disable or cause to malfunction computer systems or networks or to alter or destroy the information or programs resident in or transiting those systems. Critical National Infrastructure Cyber-dependent networks that affect the efficient functioning of society, including its economy and civil governance. Examples are: the electric power grid, gas and oil transmission, telecommunications, the internet, the financial system, transportation management, and many government services, including air traffic control. This infrastructure is essentially civilian, but the military is also a user.

Why States Are Attracted To This Form Of Attack • Can have strategic effect with few direct casualties and little physical damage. – Strategic meaning actions to alter a state’s behavior, reduce its ability to prosecute a war, or undermine domestic support. • Growing number of targets • Inexpensive compared to all other forms of modern warfare and is potentially accessible to otherwise weaker states (asymmetric warfare. ) • A new form of coercion and retaliation without use of armed force (sub jus ad bellum) and arguably not subject to the restriction of UN Charter Article 2.

What Are The Barriers To Its Adoption And Use? Strong Barriers • Technically difficult to prep targets and test in situ, and its effects are hard to predict reliably. • Collateral and cascading damage inside and outside the target state. Weak Barriers • Deterrence (high background and difficult forensic and attribution problems. ) • Cyber defense • Legal norms (barring new agreements. )

President Obama’s Perspective It’s the great irony of our Information Age: the very technologies that empower us to create and to build also empower those who would disrupt and destroy. International norms are critical to establishing a secure digital infrastructure. Only by working with international partners can the United States address the challenges of network defense and response to cyber attacks.

Future Prospects • An increasing number of states will, without acknowledgment, pursue the development of cyberattack capability. • States with highly evolved networks will make a major effort to secure those networks, but with uncertain outcomes. • There may be some progress toward establishing norms against use affecting civil targets, perhaps beginning with a no first-use commitment (or convention. )