For the last decade, the US military has been hinting that it would like to be able to be more aggressive in cyberspace.
Naturally, since this is the US, and the US military, offensive operations are cast as ‘defense’; that is in keeping with the long-standing tradition that history’s deadliest military force exists to keep the peace by destroying potential threats to its supremacy. People who are capable of thinking well, and accurately, immediately recognize this as ‘offense’ not ‘defense’ but it’s hard to correct the language of what is, basically, a war-fighting machine with a government attached to it, that collects the taxes that feed it.
We have already seen that in “cyber” the NSA and CIA have spent a tremendous amount of effort on offensive operations; they have built overlapping ground-work for compromising systems and software on a vast scale and have dramatically weakened the security of computer systems as part of an ongoing project to make it possible to gain illicit access to whatever they want, when they want it. Note that that’s what the US complains bitterly that China, North Korea, Iran, and Russia are trying to do – there’s nothing as fun as ‘helping’ to ‘solve’ a problem you helped make immeasurably worse. It’s difficult to get anything like an accurate figure but I’d say, conservatively, that the US government’s expenditures on computer security are about offense=80%, defense=20%. There is some innovation going on, on the defensive side, but it’s mostly happening in the commercial sector, for commercial reasons. The government buys its defensive technologies “off the shelf” and its offensive tools are expensive, secret, bespoke stuff.
Expensive, secret, bespoke stuff that they cannot seem to keep from leaking regularly. The current crop of malware uses leaked implementations of top secret US government-funded attack tools; when the US is complaining about North Korean malware, they are complaining that the North Koreans are using US-developed malware. It would be ridiculous except that the huddled masses appear to accept the US government’s position relatively uncritically.
The spooks have been having so much fun, the grunts want to get in on the party. No doubt they will develop another parallel stack of tools and techniques, which will – in due course – leak and be used against everyone.
[CNN] The US military is taking a more aggressive stance against foreign government hackers who are targeting the US and is being granted more authority to launch preventative cyberstrikes, according to a summary of the Department of Defense’s new Cyber Strategy.
The Pentagon is referring to the new stance as “defend forward,” and the strategy will allow the US military “to disrupt or halt malicious cyber activity at its source, including activity that falls below the level of armed conflict.”
“Defend forward” is another one of those Orwellian terms that Washington likes to come up with: it means “attack.”
The notion of “launching a
preventable preventative cyberstrike” makes no sense at all, but perhaps that’s because I’m making the mistake of trying to understand it. It parses as “optional combat” or “attacks we say we had to do in order to defend ourselves, but we didn’t actually have to defend ourselves.” Let’s be honest – it’s pre-emptive strike. Pre-emptive strikes are an ancient military concept: it’s when you hit the other guy and say “he was about to hit me!” And there’s always a problem with that: if you know that I am about to attack you, that means it’s still time for Diplomacy. “Hey, Marcus? Why are you walking toward me with that baseball bat? The sniper I have positioned 300 yards away is worried that you are thinking of hitting me with it, and I think we should discuss the situation before you get within say, 30 feet of me, as that will avoid your potential involuntary dissolution.”
The new military strategy, signed by Defense Secretary James Mattis, also emphasizes an intention to “build a more lethal force” of first-strike hackers.
The “defend forward” initiative wasn’t included in the 2015 strategy and further enables the United States to carry out offensive hacking operations to defend against cyberattacks on critical US infrastructure, such as election systems and the energy grid.
We all saw that coming, didn’t we? Since the US doesn’t know how to defend anything, it’s going to adopt a policy of pre-empting any threat that looks like it may emerge. Basically, that has been the US military strategy all along: destroy any possible threat and blame them – after all, it’s their fault because they were threatening! And if you attempt to defend yourself, well, that’s threatening too!
In effect, it gives the US military more authority to act on its own — even against computer networks based in friendly countries.
Generally I am not a fan of quoting The Founding Fathers (all in caps!) as though they were a source of political wisdom, but: The Founding Fathers specifically tried to prevent the nation’s military from being able to decide when to act on its own. The Founding Fathers knew that soldiers tend to be nationalistic thugs who see violence as their preferred solution – they are not the ones to be carrying out foreign policy on their own initiative. That was why The Founding Fathers put war-making authority in the craven and feeble hands of Congress… Oh, nevermind.
Until recently, if the US National Security Agency observed Russian hackers building a computer network in a Western European country, the president’s National Security Council would need to weigh in before any action is taken.
Now, the NSA won’t have to give its seal of approval, according to Jason Healey, a senior research scholar at Columbia University and former George W. Bush White House cyber official.
We’re in some real pretty shit now. You saw how that just happened, without any oversight on the part of Congress or the people? Our military has decided that it is acceptable to attack whoever they want, whenever they can convince themselves that it’s justified. And they’re really good at convincing themselves that it’s justified. When people said it was dangerous to have Mattis in a policy-making role because the military likes to make policy that says “attack stuff” – this was exactly what they were worried about. This has happened. They are not asking for more authority, they took it.