Few cyberattacks are cause for major retaliation: Experts

Attacks on government and private networks happen all the time and require subdued responses, some experts say

Cyberattacks on U.S. networks by other nations may not always demand the same level of retaliation, and only attacks that cause major damage or loss of life should prompt similar responses, a group of national security experts said Wednesday.

Cyberattacks on private companies and even on the U.S. Department of Defense's network are commonplace and part of a long history of international espionage that the U.S. and other countries have engaged in for years, said some panelists speaking at a cyberwar discussion at the Center for Strategic and International Studies (CSIS) in Washington, D.C.

Presented with a scenario similar to a computer compromise at RSA Security, in which the attackers also targeted defense contractor Lockheed Martin, defense consultant Franklin Miller said people getting upset with the attack seem to assume that the U.S. doesn't engage in some of the same practices.

"This is going to happen," said Miller, former senior director for defense policy and arms control at the U.S. National Security Council. "This is what intelligence organizations do."

CSIS fellow Adriane Lapointe presented Miller and other panelists with a series of reality-based scenarios and asked them what the appropriate U.S. government response should be. The CSIS panel came just days after the U.S. Department of Defense said it was prepared to use force to respond to some cyberattacks.

In some cases, attacks that appear to be sponsored by another nation -- including attacks that Google blamed on China in early 2010 -- may prompt the U.S. to file formal complaints, the panelists said. In other cases, the U.S. may want to signal another country that it considered an attack unfair, although it may be more difficult for other countries to read cybersignals than to interpret military aircraft flying near their borders, said James Lewis, director of the CSIS Technology and Public Policy Program.

The cybersignals of displeasure can be clear, said Robert Giesler, former director of information operations and strategic studies in the DOD's Office of the Secretary of Defense. "There are ways you can noisily go about penetrating networks," he said.

In some cases, the signal may not be cyber in nature, Miller added. "You don't have to [signal] in the same medium," he said. "If you want to inflict pain ... you need to find the point of pain. It may not be in the cyberworld. It may be elsewhere."

Countries may need to negotiate rules of engagement for cyber-espionage, panelists said.

Part of the problem with retaliating against other nations for a cyberattack is that it's still difficult to pinpoint where an attack came from, Giesler said. In some cases, compromised companies may attribute an attack to another nation when it's really a case of industrial espionage, he said. In other cases, attacks may come from so-called "patriotic" hackers who are acting on their own initiative, he said.

Even in attacks on DOD networks, "attribution still remains foggy," Giesler said.

Asked about attacks on DOD networks by another country, the panelists said the U.S. should respond, but in most cases, in a limited way. Only if major damage was done should the U.S. consider responding with force, said Judith Miller, former general counsel at the DOD.

"You're not going to start a war over something like this," added Robert Deitz, former senior councilor to the director of the U.S. Central Intelligence Agency.

The response would change in the case of an attack causing major damage or killing U.S. residents, the panelists said. An attack that takes down a large portion of the U.S. electric grid or the banking system would likely require significant retaliation, Franklin Miller said.

Recent news reports have suggested that China and Russia have probed the U.S. electric grid for weaknesses. Panelists suggested that attacking the grid was a step up from probing it.

"This is the kind of message that needs to be put out by the United States government publicly, that inference with the grid constitutes an extremely serious act ... which would be subject to very serious retaliation," Franklin Miller said. "If you lose the ability to generate or distribute power to an entire region of this country, we are going to be in very serious trouble as a country."

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is grant_gross@idg.com.

Join the PC World newsletter!

Error: Please check your email address.

Tags Adriane Lapointersa securitysecuritydata breachFranklin MillerJames Lewislockheed martinRobert GieslerCenter for Strategic and International StudiesRobert DeitzGoogle

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Grant Gross

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?