Panel calls for national dialog on gov't cyberattacks

The U.S. government lacks a comprehensive policy about cyberattacks, a group says

The U.S. needs to engage in a national dialog about its government's use of cyberattacks against other nations, and the government lacks a comprehensive policy about how and when it will engage in cyberwarfare, a new study says.

The U.S. government also lacks a person or office to coordinate cyberattacks, and agencies making attacks should regularly brief the U.S. Congress about their efforts, said the report, from a panel of military, diplomatic, legal and IT security experts assembled by the National Research Council, a nonprofit organization that provides policy advice to the U.S. government.

The U.S. government's current policy and legal framework on the use of cyberattacks is "ill-informed, undeveloped and highly uncertain," the report said. The U.S. government has no comprehensive policy on how to respond to cyberattacks or how it will use cyberattacks, said the report, released Wednesday.

The U.S. military is developing cyberwarfare capabilities and may have already used them, and U.S. intelligence agencies also have the ability to penetrate computer networks, said Kenneth Dam, a former law professor who has in the past held senior positions in the U.S. Departments of Treasury and State. But those capabilities have been developed largely without public discussion about when cyberattacks are appropriate, he said.

The secrecy surrounding U.S. cyberattack capabilities has impeded debate about the legal and ethical issues associated with cyberattacks and the consequences of such attacks, Dam said.

In many cases, a cyberattack will have a much larger effect than a destroyed computer or network, added William Owens, a retired Navy admiral and former CEO of Nortel Networks. An attack on some computers could cause the electric grid to shut down or a pipeline to stop working, causing widespread problems in the targeted country, he said.

"When you attack a computer, it's not just attacking a computer, it's obviously attacking everything that computer serves," Owens said.

Representatives of the U.S. Air Force and the U.S. Director of National Intelligence, two organizations involved in cyberattacks and defense, didn't immediately respond to a request for comment on the report.

The U.S. government doesn't seem to have a policy about when it will use cyberattacks and what response it will take when another country attacks its computer networks, Owens said. That's why public debate is needed, he added.

Cheap tools for attacking computer networks are easily available, and it's likely that the U.S. government will continue to face serious cyberattacks well into the future, Owens added. "Enduring unilateral dominance of cyberspace is neither realistic or achievable by the United States," he said.

The report distinguishes between cyberattacks and cyberexploitation. It defines cyberattacks as efforts intended to damage or cripple computers and networks, while cyberexploitation is a stealthy effort intended to compromise information held on computers. The report largely focuses on cyberattacks.

In recent years, many media reports have pointed to cyberattacks coming from China or Russia. Earlier this month, China denied reports that it has installed malware on the U.S. electrical grid designed to shut it down.

The National Research Council report doesn't point fingers at specific countries, but it calls for the U.S. government to have a stated policy about how it will respond to attacks. However, it's often difficult to identify where attacks are coming from or whether a foreign government was involved, Dam said.

Recent attacks attributed to China and Russia appear to come from college students wearing "slippers and pajamas," not from foreign militaries, said John Jiang, CTO at Xana, a cybersecurity vendor based in Reston, Virginia. It would be difficult for the U.S. to counterattack in those cases, said Jiang, who was in the audience for the announcement of the report.

Dam agreed, but said it's easy for nations to hire private "patriotic hackers" to carry out cyberattacks.

The offensive cybercapabilities of the U.S. government also came up during a hearing before the U.S. Senate Homeland Security and Governmental Affairs Committee Tuesday. Senator Roland Burris, an Illinois Democrat, asked a panel of cybersecurity experts whether the U.S. had the ability to respond to cyberattacks with its own attacks.

"It most likely seems like we are on the defensive in all of this," Burris said. "Are we in this country doing anything on the offense?"

The U.S. government has significant offensive capabilities, but is also a major target, said James Lewis, director of the Technology and Public Policy Program at the Center for Strategic and International Studies, a Washington, D.C., think tank.

"We have offensive capabilities that are among the best in the world," Lewis said. "The problem is what I would call asymmetric vulnerability. We're a target-rich environment. So even though we're as good as our opponents, they have more stuff to shoot at."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securitycyber attacks

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Grant Gross

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?