PACIFIC RIM SECURITY CONFERENCE

CYBERATTACK: A NEW STRATEGIC WEAPON

David Elliott

February 24, 2010

Some Definitions

CyberattackOffensive cyber action to disable or cause to malfunction

computer systems or networks or to alter or destroy the information or programs resident in or transiting those systems.

Critical National InfrastructureCyber-dependent networks that affect the efficient

functioning of society, including its economy and civil governance. Examples are: the electric power grid, gas and oil transmission, telecommunications, the internet, the financial system, transportation management, and many government services, including air traffic control.

This infrastructure is essentially civilian, but the military is also a user.

Why States Are Attracted To This Form Of Attack

• Can have strategic effect with few direct casualties and little physical damage. – Strategic meaning actions to alter a state’s behavior, reduce its

ability to prosecute a war, or undermine domestic support.

• Growing number of targets

• Inexpensive compared to all other forms of modern warfare and is potentially accessible to otherwise weaker states (asymmetric warfare.)

• A new form of coercion and retaliation without use of armed force (sub jus ad bellum) and arguably not subject to the restriction of UN Charter Article 2.

What Are The Barriers To Its Adoption And Use?

Strong Barriers• Technically difficult to prep targets and test in situ, and its

effects are hard to predict reliably.

• Collateral and cascading damage inside and outside the target state.

Weak Barriers• Deterrence (high background and difficult forensic and

attribution problems.)

• Cyber defense

• Legal norms (barring new agreements.)

President Obama’s Perspective

It’s the great irony of our Information Age: the very

technologies that empower us to create and to build also

empower those who would disrupt and destroy.

International norms are critical to establishing a secure

digital infrastructure. Only by working with international

partners can the United States address the challenges of

network defense and response to cyber attacks.

Future Prospects

• An increasing number of states will, without acknowledgment, pursue the development of cyberattack capability.

• States with highly evolved networks will make a major effort to secure those networks, but with uncertain outcomes.

• There may be some progress toward establishing norms against use affecting civil targets, perhaps beginning with a no first-use commitment (or convention.)