The US needs to engage in a national dialogue about its government's use of cyberattacks against other nations, and the government lacks a comprehensive policy about how and when it will engage in cyberwarfare, a new study said.
The US government also lacks a person or office to coordinate cyberattacks, and agencies making attacks should regularly brief the US Congress about their efforts, said the report, from a panel of military, diplomatic, legal and IT security experts assembled by the National Research Council, a nonprofit organisation that provides policy advice to the US government.
The US government's current policy and legal framework on the use of cyberattacks is "ill-informed, undeveloped and highly uncertain," the report said. The US government has no comprehensive policy on how to respond to cyberattacks or how it will use cyberattacks, said the report, released Wednesday.
The US military is developing cyberwarfare capabilities and may have already used them, and US intelligence agencies also have the ability to penetrate computer networks, said Kenneth Dam, a former law professor who has in the past held senior positions in the US Departments of Treasury and State. But those capabilities have been developed largely without public discussion about when cyberattacks are appropriate, he said.
The secrecy surrounding US cyberattack capabilities has impeded debate about the legal and ethical issues associated with cyberattacks and the consequences of such attacks, Dam said.
In many cases, a cyberattack will have a much larger effect than a destroyed computer or network, added William Owens, a retired Navy admiral and former CEO of Nortel Networks. An attack on some computers could cause the electric grid to shut down or a pipeline to stop working, causing widespread problems in the targeted country, he said.
"When you attack a computer, it's not just attacking a computer, it's obviously attacking everything that computer serves," Owens said.
Representatives of the US Air Force and the US Director of National Intelligence, two organisations involved in cyberattacks and defense, didn't immediately respond to a request for comment on the report.
The US government doesn't seem to have a policy about when it will use cyberattacks and what response it will take when another country attacks its computer networks, Owens said. That's why public debate is needed, he added.
Cheap tools for attacking computer networks are easily available, and it's likely that the US government will continue to face serious cyberattacks well into the future, Owens added. "Enduring unilateral dominance of cyberspace is neither realistic or achievable by the United States," he said.
The report distinguishes between cyberattacks and cyberexploitation. It defines cyberattacks as efforts intended to damage or cripple computers and networks, while cyberexploitation is a stealthy effort intended to compromise information held on computers. The report largely focuses on cyberattacks.
In recent years, many media reports have pointed to cyberattacks coming from China or Russia. Earlier this month, China denied reports that it has installed malware on the US electrical grid designed to shut it down.
The National Research Council report doesn't point fingers at specific countries, but it calls for the US government to have a stated policy about how it will respond to attacks. However, it's often difficult to identify where attacks are coming from or whether a foreign government was involved, Dam said.
Recent attacks attributed to China and Russia appear to come from college students wearing "slippers and pajamas," not from foreign militaries, said John Jiang, CTO at Xana, a cybersecurity vendor based in Reston, Virginia. It would be difficult for the US to counterattack in those cases, said Jiang, who was in the audience for the announcement of the report.
Dam agreed, but said it's easy for nations to hire private "patriotic hackers" to carry out cyberattacks.
The offensive cybercapabilities of the US government also came up during a hearing before the US Senate Homeland Security and Governmental Affairs Committee Tuesday. Senator Roland Burris, an Illinois Democrat, asked a panel of cybersecurity experts whether the US had the ability to respond to cyberattacks with its own attacks.
"It most likely seems like we are on the defensive in all of this," Burris said. "Are we in this country doing anything on the offense?"
The US government has significant offensive capabilities, but is also a major target, said James Lewis, director of the Technology and Public Policy Program at the Centre for Strategic and International Studies, a Washington, D.C., think tank.
"We have offensive capabilities that are among the best in the world," Lewis said. "The problem is what I would call asymmetric vulnerability. We're a target-rich environment. So even though we're as good as our opponents, they have more stuff to shoot at."