Optimizing Cyberdeterrence

A Comprehensive Strategy for Preventing Foreign Cyberattacks

Robert Mandel

• Publisher: Georgetown University Press
• Year: 2017
• Print ISBN: 9781626164130
• eBook ISBN: 9781626164147
• Topic: Politics & International Relations
• Subtopic: National Security
• Index: Politics & International Relations

Cyberattacks are one of the greatest fears for governments and the private sector. The attacks come without warning and can be extremely costly and embarrassing.

Robert Mandel offers a unique and comprehensive strategic vision for how governments, in partnership with the private sector, can deter cyberattacks from both nonstate and state actors. Cyberdeterrence must be different from conventional military or nuclear deterrence, which are mainly based on dissuading an attack by forcing the aggressor to face unacceptable costs. In the cyber realm, where attributing a specific attack to a specific actor is extremely difficult, conventional deterrence principles are not enough. Mandel argues that cyberdeterrence must alter a potential attacker’s decision calculus by not only raising costs for the attacker but also by limiting the prospects for gain. Cyberdeterrence must also involve indirect unorthodox restraints, such as exposure to negative blowback and deceptive diversionary measures, and cross-domain measures rather than just retaliation in kind.

The book includes twelve twenty-first-century cyberattack case studies to draw insights into cyberdeterrence and determine the conditions under which it works most effectively. Mandel concludes by making recommendations for implementing cyberdeterrence and integrating it into broader national security policy. Cyber policy practitioners and scholars will gain valuable and current knowledge from this excellent study.

CHAPTER 1

Foreign Cyberthreat Dangers

In the United States at least, there is no security threat today that government policymakers, private businesses, and the public fear more than major cyberattacks. For example, since 2013 the American director of national intelligence has named cyberthreat as “the number one strategic threat to the United States, placing it ahead of terrorism for the first time since the attacks of September 11, 2001.”¹ The relative invisibility, tracking difficulty, inexpensive initiation, technical obtuseness, fluid content, speedy impact, and broad scope of cyberthreat make it seem unintelligible, unpredictable, unmanageable, and ultimately catastrophic. On a global level, potential victims find themselves both frustrated and baffled about how to cope with cyberthreat more successfully. In light of this threat, this chapter analyzes the rising perceived importance of foreign cyberthreat, its changing nature, the legacy of ineffective target responses, and the ramifications of resulting global sea changes.

Rising Perceived Importance of Foreign Cyberthreat

Since the 1990s cyberattacks on global computer networks have risen in number (as well as in sophistication), reaching 1.7 billion in 2013, up from 1.6 billion in 2012.² For the United States, over time “the frequency and sophistication of intrusions into U.S. military networks have increased exponentially.”³ In 2011 the Government Accountability Office estimated that “the number of unauthorized access or installations of malicious software on U.S. government computers has increased by 650 percent since 2006.”⁴ From October 2011 through February 2012, the Department of Homeland Security reported over 50,000 cyberattacks on private and government networks, with 86 on critical infrastructure networks.⁵ In 2014 a report to Congress revealed that “hackers have penetrated, taken control of, caused damage to and/or stolen sensitive personal and official information from computer systems at the Departments of Homeland Security, Justice, Defense, State, Labor, Energy, and Commerce; NASA [National Aeronautics and Space Administration]; the Environmental Protection Agency; the Office of Personnel Management; the Federal Reserve; the Commodity Futures Trading Commission; the Food and Drug Administration; the US Copyright Office; and the National Weather Service.”⁶ Aside from governments, cyberattacks also have targeted private businesses. For example, in 2010 “proprietary corporate data, e-mails, credit-card transaction data and login credentials at companies in the health and technology industries,” involving over 75,000 computers at more than 2,500 businesses in 196 countries, were hacked.⁷ Today nobody seems immune—regardless of the protection system—to cyber penetration.

The monetary scope of the damage wrought in cyberattacks has also grown. Regarding government targets, in 2009 the Pentagon reported that costs of repairing cyberattack damage—in terms of “manpower, computer technology, and contractors hired to clean up after both external probes and internal mistakes”—was more than $100 million a year.⁸ Outside of government targets, in 2008 cybercriminal groups reportedly stole more than $1 trillion in global data and intellectual property.⁹ Critical infrastructure operators across the globe report that their networks and control systems are “under repeated cyberattack, often from high-level adversaries like foreign nationstates,” and that in 2010 their downtime costs from such breaches exceeded $6 million per day.¹⁰ In May 2013 the Commission on the Theft of American Intellectual Property reported that hackers cost the United States $300 billion a year.¹¹ The cost of cyberattacks on private business is dramatically rising as well. Including abnormal turnover of customers, reputation loss, diminished goodwill, and paying for credit reports and aid to affected customers, the average cost of a computer breach in 2015 was $3.79 million for large private companies globally, up 23 percent from 2013; and it ran $6.5 million for American companies, up 11 percent from 2013.¹² Although such estimates are inherently imprecise, they do provide a glimmer of the massive, global financial impact of cyberintrusions.

Even more than most global threats, cyberspace dangers can certainly be socially constructed to a great extent. Given that cyberspace is man made, objectively determining to what extent cyberthreat is actually rising or actually poses greater dangers than other security threats would be extremely difficult. However, to call cyberthreat completely artificial and illusory goes too far, for tangible cyberattacks have generated concrete damage to data, information systems, and (indirectly) physical structures. Moreover, regardless of the level of existing threat, there is little doubt that government officials, corporate executives, and the public are now more scared of cyberattacks than ever before in the digital age.

Changing Nature of Foreign Cyberthreat

Possessing a unique set of characteristics, the virtual domain of cyberspace is now as important a source of threat as the physical domains of land, sea, air, and space.¹³ However, considerable confusion surrounds the rapidly changing cyberthreat. Continuing transformations in cyberattackers, their goals and motivations, their targets, and their attack styles have complicated understanding ongoing trends. Figure 1.1 summarizes the changing nature of foreign cyberthreat.

Cyberattackers

Not surprising, the most dangerous cyberattackers come from “groups with the resources and commitment to relentlessly target a company or government agency until they succeed in breaking in and then take value out.”¹⁴ Thus, today “the main threats no longer come from teenage hackers or petty criminals, although such actors are still around; instead, sophisticated criminals and state-sponsored spies pose the most danger for businesses and governments.”¹⁵ The Government Accountability Office lists the primary cyberattack sources as intelligence services, criminal groups, hackers and hacktivists, disgruntled insiders, and terrorists.¹⁶

Cyber disruption has wide appeal, requiring no more than “a powerful computer, a keen mind, and an underlying grudge.”¹⁷ The initiators range from “script kiddies” to “elite hackers” and from rich states and poor states. Cyberattacks’ attraction to both the powerful and the weak lies in their “low relative cost, high potential impact and general lack of transparency. Powerful actors such as the United States can combine cyber power with existing military capabilities, economic assets and soft power networks. Less powerful actors—states, organizations, individuals or any combination thereof—can gain asymmetrically in cyberspace by inflicting extensive damage on vulnerable targets.”¹⁸ Major powers seeking to protect the status quo often may find themselves thwarted by cyberinitiatives from smaller, weaker players.

Unlike many other forms of aggression, most states with relevant capabilities have not been reluctant to engage in foreign cyberintrusion, leading to intensified international cross penetration. Following security dilemma logic, other states can see a given state’s offensive cyberdefense strategy as violating their sovereignty. For example, former US deputy secretary of defense William Lynn suggests that over a hundred foreign intelligence organizations have been illegitimately trying to break into American defense networks.¹⁹ Today’s tightly networked information systems can serve equally as weapons...

Table of contents

• Cover
• Half title
• Title
• Copyright
• Contents
• List of Illustrations
• Acknowledgments
• Introduction
• 1 Foreign Cyberthreat Dangers
• 2 Cyberdeterrence Paradoxes
• 3 Obstacles to Forward Progress
• 4 Cyberattack Case Studies
• 5 Case Study Patterns
• 6 Improving Cyberdeterrence Planning
• 7 Improving Cyberdeterrence Execution
• 8 When Cyberdeterrence Works Best
• Conclusion
• Bibliography
• Index
• About the Author