Preparing for Warfare in Cyberspace

Interesting stance to state publicly.

It is relatively easy to convincingly demonstrate the capabilities of traditional weapons without causing any collateral damage (well, except for Castle Bravo). The problem, I think, is how does one convincingly demonstrate cyberwarfare capabilities without causing some amount of real harm. For example: we now know that China has the "great cannon" it can use relatively effectively for DDOS attacks, but only because GitHub suffered...and this is just the beginning of the inevitable arms race.

> He urged the next generation of software pioneers and entrepreneurs to take a break from developing killer apps and consider a tour of service fending off Chinese, Russian and North Korean hackers, even as he acknowledged that the documents leaked by Edward J. Snowden, the former intelligence contractor, “showed there was a difference in view between what we were doing and what people perceived us as doing.”

So our 'defense secretary' thinks that being capable of writing ruby on rails apps means that someone knows what a NOP sled is. Fantastic!

Screw all of these idiots in suits. I'm not afraid of North Korean hackers. I've not been afraid of Russian hackers throughout the past decade and I'm not afraid of Chinese hackers now. And even if I was, I can assure you, there's nothing at all that the US government could do to alleviate that.

That's policy is completely backwards if what they really want is security. But they don't want that. What they want is hackers that can hack foreign states as well as develop malware to infect or spy on everyone. Nothing to do with security.

Also, screw NYT for promoting this crap. They've been promoting the cyber-threat sharing legislation as well.

Amid sequestration in discretionary defense spending, cyber capabilities have been spared the harsh bulk of cuts and the published strategy amounts to what looks very close to all-in by the USG.

The DoD has begun to build career paths for professional cyber soldiers, is extending and reinvesting in training programs, is and will invest further in internet and cyberwarfare simulation, will redouble efforts to acquire technical capabilities including offense from the private sector, have started partnering with Venture Capitalists in Silicon Valley to encourage startup with defensive and offensive technologies and to discourage startups with consumer encryption solutions, is creating collective cyber defense partnerships with allied nations, is expanding information sharing programs both overseas and with US corporations, and will be further refining the technological capabilities to respond to nations suspected of cyber attacks.

So many things to say about this. Here's two:

One. The US thought that Bush was a fool when he claimed that the US needed to prepare for cyberwarfare. Because people scoffed at cyberwarfare (it's not war, they said, making vague references to the absence of explosions) so the Bush Administration switched to trying to pry support from the public by waving around the goto boogieman - now it was cyberterrorists - Americans are afraid of terrorists right? This didn't pass muster either. The image of hacker at that time was still of neckbearded manchildren renting their parents basements and people didn't feel like computers could hurt them.

The Bush Administration pursued cyber capabilities anyway, now switching to the tactic of keeping the discussion out of the spotlight. This proved to be largely successful, as it tends to be. Without widespread coverage only a few fringe outlets and advocacy groups followed the legislation.

This, from my short time on Earth, describes my experience of US politics. The US is an international superpower and just as often as not its legislation is about what it needs to do internationally to remain top dog (case in point - TPP). But Americans, by part their own volition, part the determination of a Washington that thinks it knows better about this complicated subject (and may very well) and in part because of sheer magnitude and complexity; the public are not invited to vote on Foreign Policy except in the coarsest of ways. You want out of the Middle East? No president will do that unless the complicated set of international stategic circumstances happen to align with American ideals.

This brings me to the second point. That time is now. The US is trying to 'rebalance' away from the Middle East. Not for high minded reasons mind you - and it will invariably maintain a presence. But now is an era where the US is undergoing fundamental transformation. It is shifting from its peacekeeping role in Europe and as a garunteur of energy security by interventionism and neocolonialism in the Middle East. It is moving to invest in the Asia-Pacific and to contain China from becoming a hegemonic power there (this is US grand strategy, both two decades ago by the Wolfowitz Doctrine and this decade by its reassurtion in the Bush Doctrine). New challenges face her: space and hypersonic delivery vehicles for nuclear warheads, air denial around the world by the proliferation of anti-air capabilities (sold by Russia, China), very effective propaganda campaigns on US citizens by foreign states fake blogs and newspapers, decrepit alliances and infrastructure, and having the softest underbelly in new sophisticated levels of cyberwarfare.

America's cyberstrategy can only be understood in context of its broad strategy to both contain its competition beneath a level where physical warfare can break out and to prevent balances of powers and alliance systems that could similarly challenge her.

The problem for us is that an all-in in cyber is a canary. It means that diplomacy and other forms of coercion, influence and sabotage haven't been enough to address the issue - and it foretells of conflict, at least for the meantime in the information domain.

If you look at what was done at Natanz then think of what that group could have done against your local power grid, or water supply, or grocery store supply chain, it is scary.

As an American, our current wars are all fought in distant lands- out of sight and mostly out of mind. The next generation of warfare will strike home.

Oh, no...

My question to sec enthusiasts and pros: isn't the whole point of security to disclose as little as possible? Security through obscurity?

I realize that most of this information is public knowledge and there are all kinds of double agents, but this really seems like a lot of information!

It just seems to me as though we have everything wrong. China raises children to be hackers and hires criminals to do their bidding, or subs it out to whoever while you can't even get a government job if you have a DUI?