Four principles to guide the US response to cyberattacks

Opening the Overton window on responding to cyberattacks

My latest op-ed tries to open the Overton window on responding to cyberattacks:

Cyber weapons have allowed Russia to reinvent deterrence on the cheap. Recent reports reveal a prolonged, systematic, and not particularly subtle Russian campaign to infiltrate the U.S. power grid.

It raises the prospect that Russian strongman Vladimir Putin has the ability to cut off power to large parts of the United States, as he has done already in Ukraine. He has "prepare[d] the battlefield, without pulling the trigger," said one former U.S. official.

All of which raises the question: how to deter him? After all, where Putin goes, Iranian mullahs and Kim Jong Un will not be far behind. If any of these actors knock out even a small segment of our power grid, we will need to retaliate, and not with restraint. It's time to start thinking the unthinkable.

Four principles should guide American decision makers in developing tough responses to other nations' cyber provocation …

Read the rest at Fifth Domain.

Comments

[Longtobefree]

Not to worry; AOC will rebuild the entire grid to accommodate her elimination of coal, gas, and nuclear, and put in safeguards.

[Gozer the Gozarian]

Using a cyberattack to create a fire sale is fiction. You'd never do that if you were a nation state. Terrorist, sure, but not a nation state.

The real weapon isolation of cyberattacks is financial. The Third World War is going on right now, and it's an economic-information war, not one fought with traditional military weapons.

There are countless online scams that funnel money out of the US from consumers. And there are trade and intellectual property data that are regularly stolen by nation states to gain access to technologies they've been barred from or want to benefit from.

The war today isn't about territories, it's about information and the value of information. Value through the theft of invention, and value in weaponizing it to create FUD (fear, uncertainty, and disinformation).

Hercules defeated 1,000 soldiers by throwing a stone amongst them, causing them to fight amongst themselves. That rock is information. The soldiers are the general population.

[apedad]

War is still and will always be about who controls territory (e.g. Ukraine, Syria/Iraq, Dem. Rep Congo, etc.).

Yes we have another cold war where data (e.g. Chinese stole millions of personal clearance records), financial and electrical systems can be attacked but you simply cannot dismiss territorial war.

[regexp]

Principal 1: Never listen to anything Stewart Baker says on InfoSec

[Krayt]

Short of full war, you bottle up his fleet in its ports, and be prepared to shoot down anything that comes after you, including hitting anti-ship inland sites.

Let this be known ahead of time. And that full seizure of the billions his whole kleptocracy is safely keeping in the US (to keep away from domestic challengers) is forfeit.

[M.L.]

"If any of these actors knock out even a small segment of our power grid, we will need to retaliate, and not with restraint."

WOW. Why not focus on SECURING facilities, rather than leaving them open to attack? More astounding failure of leadership.

The focus on retaliation "and not with restraint" after the fact, rather than prevention and security before the fact, is very chilling and ominous indeed. What are we being set up for here? A "small segment of our power grid" goes out . . . and then . . . what?

Here's what just happened recently: shocking lies and deception from our media freaks and their war mongering national security "sources"

Russian Hackers Invaded the U.S. Electricity Grid to Deny Vermonters Heat During the Winter (WashPost)
On December 30, 2016, the Washington Post reported that "Russian hackers penetrated the U.S. electricity grid through a utility in Vermont," causing predictable outrage and panic, along with threats from U.S. political leaders. But then they kept diluting the story with editor's notes ? to admit that the malware was found on a laptop not connected to the U.S. electric grid at all ? until finally acknowledging, days later, that the whole story was false, since the malware had nothing to do with Russia or with the U.S. electric grid . . .

[Brett Bellmore]

Because securing facilities costs money?

[M.L.]

Oh, right. So let's save a few bucks, let our country be attacked, and then start killing people!

What great moral leaders we have!

Wait until you see what James Comey did today.

He literally just wrote the book on moral leadership, of course, but he took a break from hocking that and tweeting bible verses, in order to publish a nice little Washington Post op-ed ranting about . . . blackface, and pushing The Narrative on Confederate monuments calling for them to be destroyed. What a guy.

[Toranth]

It's more like, securing computer networks is extremely difficult, to the point that widely networked systems with public interfaces like the power grid are effectively impossible to secure.

The best you can do is "Good enough for typical attackers" which does not include nation-state enemies like Russia and China.

[NToJ]

"It's more like, securing computer networks is extremely difficult..."

The same is true of preventing a Russian nuclear attack.

[Toranth]

A Russian nuclear attack might kill fewer people than having the US power grid shut down for a few days. Certainly fewer than a multi-week outage.

Even so, preemptive mining of Russian harbors is probably not the way I would choose to go.

[anorlunda]

I wish you had chosen a better example Stewart.

The reports that I read say that there are as many as 20000 attempts per day to "attack the power grid". Even if some succeed in gaining access, there's an enormous amount of domain knowledge needed to cause major disruptions. The power grid's ordinary role is to withstand multiple simultaneous failures without collapse. During the 1998 ice storm, more than 600,000 poles and towers in the NE and Canada were knocked down simultaneously, yet the blackout did not extend past the boundaries of the storm.

Ted Koppel made a fool of himself with a book on this topic. His conclusion was to join the survivalists and to hole up in a bunker with a lifetime of food and machine gun ammo.

The Russians had some limited success in Ukraine, but that country was in poor shape and fighting a war.

Extraordinary claims need extraordinary evidence. There is no such evidence that a grid cyberattack could do as you claim. There is a similar lack of evidence that the Russians could cause all of our nuclear warheads to detonate in-place at our storage facilities.