Cyberwar

Should We Fire the First Shot in a Cyberwar?

Military bureaucracies around the world are likely to see offensive capabilities as increasingly attractive in any cyberwar, suggests the head of the computer research arm of the National Academy of Sciences.

"Offensive cybertechnology and operations are inherently stronger than defensive operations—that is, offense beats defense in cyberspace, in most cases, and given enough time," says Herbert Lin, chief scientist at the Computer Science and Telecommunications Board at the National Research Council. Lin spoke last week at an MIT workshop on the fast-emerging cyber dimension to international relations.

Cyberattacks could damage or disable military networks or civilian infrastructure like power grids, or they could involve the theft of military and corporate secrets. Experts warn that such attacks could occur at light speed and be difficult to trace, especially if data is routed through computers in many different countries.

"Since you don't know how to do good defense, you can't prevent offensive dominance. And you can't do good deterrence because effective retaliation is hard, so if you want to take advantage of cyberspace, you will do offensive operations for nondefensive purposes," Lin says. "I'd really like to be wrong about that, but I fear that's where we are going."

Lin contributed to a 2009 National Academiesreport which argued that the situation calls for talks with other nations to establish the rules of the road, open debate in Congress on U.S. strategy, and the development of better tools to detect and measure threats. A later reportdescribed the tricky landscape of deterrence.

Last month, General Keith Alexander, head of the National Security Agency and the U.S. Cyber Command, said the U.S. military needs better capabilities to not only defend against cyberattacks, but also to potentially launch them. Speaking at the U.S. Strategic Command's Cyber and Space Symposium in Omaha, Nebraska, he told an audience of 1,500 military and defense contracting officials that the U.S. military should have the power to attack other countries in cyberspace. "We can't just defend," Alexander said.