February 3, 2013
Broad Powers Seen for Obama in Cyberstrikes
By DAVID E. SANGER and THOM SHANKER
NY Times
http://www.nytimes.com/2013/02/04/us/broad-powers-seen-for-obama-in-cyberstrikes.html
WASHINGTON — A secret legal review on the use of America’s growing
arsenal of cyberweapons has concluded that President Obama has the broad
power to order a pre-emptive strike if the United States detects
credible evidence of a major digital attack looming from abroad,
according to officials involved in the review.
That decision is among several reached in recent months as the
administration moves, in the next few weeks, to approve the nation’s
first rules for how the military can defend, or retaliate, against a
major cyberattack. New policies will also govern how the intelligence
agencies can carry out searches of faraway computer networks for signs
of potential attacks on the United States and, if the president
approves, attack adversaries by injecting them with destructive code —
even if there is no declared war.
The rules will be highly classified, just as those governing drone
strikes have been closely held. John O. Brennan, Mr. Obama’s chief
counterterrorism adviser and his nominee to run the Central Intelligence
Agency, played a central role in developing the administration’s
policies regarding both drones and cyberwarfare, the two newest and most
politically sensitive weapons in the American arsenal.
Cyberweaponry is the newest and perhaps most complex arms race under
way. The Pentagon has created a new Cyber Command, and computer network
warfare is one of the few parts of the military budget that is expected
to grow. Officials said that the new cyberpolicies had been guided by a
decade of evolution in counterterrorism policy, particularly on the
division of authority between the military and the intelligence agencies
in deploying cyberweapons. Officials spoke on condition of anonymity
because they were not authorized to talk on the record.
Under current rules, the military can openly carry out counterterrorism
missions in nations where the United States operates under the rules of
war, like Afghanistan. But the intelligence agencies have the authority
to carry out clandestine drone strikes and commando raids in places like
Pakistan and Yemen, which are not declared war zones. The results have
provoked wide protests.
Mr. Obama is known to have approved the use of cyberweapons only once,
early in his presidency, when he ordered an escalating series of
cyberattacks against Iran’s nuclear enrichment facilities. The operation
was code-named Olympic Games, and while it began inside the Pentagon
under President George W. Bush, it was quickly taken over by the
National Security Agency, the largest of the intelligence agencies,
under the president’s authority to conduct covert action.
As the process of defining the rules of engagement began more than a
year ago, one senior administration official emphasized that the United
States had restrained its use of cyberweapons. “There are levels of
cyberwarfare that are far more aggressive than anything that has been
used or recommended to be done,” the official said.
The attacks on Iran illustrated that a nation’s infrastructure can be
destroyed without bombing it or sending in saboteurs.
While many potential targets are military, a country’s power grids,
financial systems and communications networks can also be crippled. Even
more complex, nonstate actors, like terrorists or criminal groups, can
mount attacks, and it is often difficult to tell who is responsible.
Some critics have said the cyberthreat is being exaggerated by
contractors and consultants who see billions in potential earnings.
One senior American official said that officials quickly determined that
the cyberweapons were so powerful that — like nuclear weapons — they
should be unleashed only on the direct orders of the commander in chief.
A possible exception would be in cases of narrowly targeted tactical
strikes by the military, like turning off an air defense system during a
conventional strike against an adversary.
“There are very, very few instances in cyberoperations in which the
decision will be made at a level below the president,” the official
said. That means the administration has ruled out the use of “automatic”
retaliation if a cyberattack on America’s infrastructure is detected,
even if the virus is traveling at network speeds.
While the rules have been in development for more than two years, they
are coming out at a time of greatly increased cyberattacks on American
companies and critical infrastructure. The Department of Homeland
Security recently announced that an American power station, which it did
not name, was crippled for weeks by cyberattacks. The New York Times
reported last week that it had been struck, for more than four months,
by a cyberattack emanating from China. The Wall Street Journal and The
Washington Post have reported similar attacks on their systems.
“While this is all described in neutral terms — what are we going to do
about cyberattacks — the underlying question is, ‘What are we going to
do about China?’ ” said Richard Falkenrath, a senior fellow at the
Council on Foreign Relations. “There’s a lot of signaling going on
between the two countries on this subject.”
International law allows any nation to defend itself from threats, and
the United States has applied that concept to conduct pre-emptive attacks.
Pre-emption always has been a disputed legal concept. Most recently
former Mr. Bush made it a central justification for the invasion of Iraq
in 2003, based on faulty intelligence about that country’s weapons of
mass destruction. Pre-emption in the context of cyberwar raises a
potentially bigger quandary, because a country hit by a pre-emptive
cyberstrike could easily claim that it was innocent, undermining the
justification for the attack. “It would be very hard to provide evidence
to the world that you hit some deadly dangerous computer code,” one
senior official said.
The implications of pre-emption in cyberwar were specifically analyzed
at length in writing the new rules. One major issue involved in the
administration’s review, according to one official involved, was
defining “what constitutes reasonable and proportionate force” in
halting or retaliating against a cyberattack.
During the attacks on Iran’s facilities, which the United States never
acknowledged, Mr. Obama insisted that cyberweapons be targeted narrowly,
so that they did not affect hospitals or power supplies. Mr. Obama
frequently voiced concerns that America’s use of cyberweapons could be
used by others as justification for attacks on the United States. The
American effort was exposed when the cyberweapon leaked out of the
Iranian enrichment center that was attacked, and the “Stuxnet” code
replicated millions of times on the Internet.
Under the new guidelines, the Pentagon would not be involved in
defending against ordinary cyberattacks on American companies or
individuals, even though it has the largest array of cybertools.
Domestically, that responsibility falls to the Department of Homeland
Security, and investigations of cyberattacks or theft are carried out by
the F.B.I.
But the military, barred from actions within the United States without a
presidential order, would become involved in cases of a major
cyberattack within the United States. To maintain ambiguity in an
adversary’s mind, officials have kept secret what that threshold would
be; so far, Defense Secretary Leon E. Panetta has only described the
“red line” in the vaguest of terms — as a “cyber 9/11.”
The Obama administration has urged stronger firewalls and other systems
to provide a first line of defense, and then “resiliency” in the face of
cyberattacks. It failed to get Congress to pass cybersecurity
legislation that would have allowed the government to mandate standards.
_______________________________________________
Medianews mailing list
[email protected]
http://etskywarn.net/mailman/listinfo/medianews_etskywarn.net
