Is Cyber Deterrence Possible? - U.S. Department of Defense

1 Air UniversitySteven L. Kwast, Lieutenant General, Commander and PresidentAir Force Research InstituteDale L. Hayden, PhD, DirectorAIR UNIVERSITYAir Force Research InstitutePerspectives on Cyber PowerIs Cyber Deterrence Possible? Timothy M. McKenzieColonel, USAFCPP 4 Air university Press Air Force Research Institute Maxwell Air Force Base, AlabamaProject Editor Jeanne K. ShamburgerLibrary of Congress Cataloging-in-Publication DataNames: McKenzie, Timothy M., 1969 author. | Air university ( ). Air Force Research Institute, issuing : Is Cyber Deterrence possible ? / Timothy M. McKenzie Other titles: Air Force Research Institute perspectives on Cyber power ; CPP-4. 2329-5821 Description: First edition. | Maxwell Air Force Base, Alabama : Air university Press, Air Force Research Institute, [2017] | Series: Perspectives on Cyber power, ISSN 2329-5821 ; CPP-4 | Includes bibliographical : LCCN 2016052326| ISBN 9781585662739 | ISBN 1585662739 Subjects: LCSH: Cyberterrorism United States Prevention.

2 | Deterrence (Strategy) | Cyber intelligence (Computer security) International cooperation. | Cyberspace Military aspects United States. | Security, International. | Information warfare United States : LCC M35 2017 | DDC dc23 | SUDOC D :4LC record available at by Air university in January 2017 DisclaimerOpinions, conclusions, and recommendations expressed or implied within are solely those of the author and do not necessarily represent the views of the Air Force Research Institute, Air university , the United States Air Force, the Department of Defense , or any other US govern-ment agency. Cleared for public release: distribution Editor Carolyn BurnsCover Art, Book Design, and Illustrations Daniel ArmstrongComposition and Prepress Production Nedra O.

3 LooneyPrint Preparation and Distribution Diane Clark AIR FORCE RESEARCH INSTITUTE AIR university PRESSD irector and Publisher Dale L. Hayden, PhDEditor in Chief Oreste M. JohnsonManaging Editor Dr. Ernest Allan RockwellDesign and Production Manager Cheryl King Air university Press 600 Chennault Circle, Building 1405 Maxwell AFB, AL 36112-6010 Air Force Research Institute Perspectives on Cyber Power We live in a world where global efforts to provide access to Cyber resources and the battles for control of cyberspace are intensifying. In this series, leading international experts explore key topics on Cyber disputes and collaboration. Written by practitioners and renowned scholars who are leaders in their fields, the publica-tions provide original and accessible overviews of subjects about Cyber power, conflict, and cooperation.

4 As a venue for dialogue and study about Cyber power and its relationship to national security, military operations, economic policy, and other strategic issues, this series aims to provide essen-tial reading for senior military leaders, professional military education students, and interagency, academic, and private-sector partners. These intellectually rigorous studies draw on a range of contemporary examples and contextualize their sub-jects within the broader Defense and diplomacy and other Air Force Research Institute studies are available via the AU Press website at Please submit comments to university PressA DIVISION OF THE AIR FORCE RESEARCH INSTITUTEiiiContents List of Illustrations v About the Author vii Abstract ix Introduction 1 What Is a Cyber Attack?

5 3 Analysis of Current US Cyber Policy 5 Challenges for Cyber Deterrence 7 Final Analysis 11 Abbreviations 15 Bibliography 17vIllustrationsFigure Spectrum of Cyber operations 5Ta b l e Deterrence attributes 3viiAbout the AuthorCol Timothy M. McKenzie is assigned to the Space and Missile Systems Center, Los Angeles AFB, California. He began his career in 1993 after receiv-ing a commission through the Reserve Officer Training Corps and graduating from Northern Arizona university with a bachelor of science degree in elec-trical engineering. He has served in a number of assignments in the Air Force s and Department of Defense s space acquisition sectors, including the Space and Missile System Systems Center, National Reconnaissance Office, and Secretary of the Air Force staff.

6 In addition to space acquisition , Colonel McKenzie has conducted command and control of the Global Positioning System satellite constellation and worldwide computer security red-team recent years, the importance of operating in and protecting the Cyber domain has gained much attention. As long as our nation relies on computer networks as a foundation for military and economic power, our national and economic security are at risk through the Cyber domain. Cyber attacks on US industry and government systems severely impact our economy and ability to execute modern network-centric warfare. Our reliance on networked systems and the high costs associated with Cyber attacks have led many leaders in the US government and Department of Defense to focus resources toward developing a strategy for deterring adver-saries from attacking our networks in the first place.

7 This effort has led to much debate about the question, is Cyber Deterrence possible ? Deterrence in the Cyber domain is drastically different and far more complicated than in other military domains (air, land, sea, and space). Cyber weapons and offensive Cyber techniques are relatively inexpensive and easily obtained or developed. The number of adversary groups capable of attacking US networks is large, and our ability to deter each group will vary based on its motives and levels of risk tolerance. An effective Cyber Deterrence strategy must be multilayered and use all instruments of US national power. This paper discusses the dif-ficulties of deterring unwanted Cyber activities, provides some realistic expectations for a Deterrence strategy, and offers proposals to help mitigate the United States reliance on networked systems and the high costs asso-ciated with Cyber attacks have led many leaders in the US government and the Department of Defense (DOD) to prioritize protecting our critical networked infrastructure.

8 Part of that focus is trying to develop a strategy for deterring adversaries from attacking our networks in the first place. This effort has led to much debate around the question of whether Cyber Deterrence is possible . Answering this question is difficult since the number of adversary groups capable of attacking US networks is large and our ability to deter each group will vary based on its motives and levels of risk tolerance. The United States should not expect a Cyber Deterrence strategy to achieve the kind of results seen with our nuclear Deterrence strategy during the Cold War. However, a limited US Cyber Deterrence strategy is possible . To be effective, this strategy must be multilayered and use all instruments of US national power. The strategy employed against one adversary group ( , criminal actors) will be different than that against another group ( , state or state-sponsored actors).

9 This paper explores (1) the difficulties of deterring unwanted Cyber activities by each group of Cyber threats, (2) realistic expectations for a Deterrence strategy, and (3) proposals to help mitigate the problems. BackgroundIn recent years, the importance of operating in and protecting the Cyber domain has gained much attention. The US president, members of Congress, and senior DOD/military officials are keenly aware of the criticality of Cyber to US national security. The 2010 National Security Strategy says the following regarding cybersecurity:Cybersecurity threats represent one of the most serious national security, public safety, and economic challenges we face as a nation. The very technologies that empower us to lead and create also empower those who would disrupt and destroy.

10 Our daily lives and public safety depend on power and electric grids, but potential adversaries could use Cyber vulnerabilities to disrupt them on a massive scale.. Our digital infrastructure .. is a strategic national asset, and protecting it .. is a national security long as our nation relies on computer networks as a foundation for mili-tary and economic power, our national and economic security can be placed at risk through the Cyber domain. Cyber attacks on US industry and government The author wrote this paper in 2014 while a student at the Air War College Cyber Horizons program, Maxwell AFB, have significant impacts to our economy. As many as 500,000 US jobs are lost each year from costs associated with Cyber espionage, and hacking costs the overall US economy as much as $100 billion each A compre-hensive Cyber Deterrence strategy is one option available to the United States for preventing or minimizing further impacts to critical US national security digital Deterrence Theory To answer the question of whether Cyber Deterrence is possible , one must understand the theories or concepts behind successful deterrent strategies and how they apply to Cyber .