{"id":22170,"date":"2015-08-25T06:00:11","date_gmt":"2015-08-24T20:00:11","guid":{"rendered":"http:\/\/www.aspistrategist.ru\/?p=22170"},"modified":"2015-08-24T13:35:04","modified_gmt":"2015-08-24T03:35:04","slug":"when-states-strike-back-national-responses-to-cyber-incidents","status":"publish","type":"post","link":"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/","title":{"rendered":"When states strike back\u2014national responses to cyber incidents"},"content":{"rendered":"

\"Keyboard<\/a><\/p>\n

As states become less inhibited about utilising cyber as a component of state power, policymakers will be increasingly challenged to develop proportionate responses to disruptive or destructive attacks. Already, there\u2019s been significant pressure to \u2018do something\u2019 in light of the allegedly state-sponsored attacks on Sony Pictures Entertainment<\/a>, the Sands Casino<\/a> in Las Vegas and Saudi Aramco<\/a>. But finding a timely, proportionate, legal and discriminatory response is complicated by the difficulty in assessing the damage to national interests and the frequent use of proxies. Perpetrators have plausible deniability, frustrating efforts to assign responsibility. Past experience suggests that most policy responses have been ad hoc.<\/p>\n

In determining the appropriate response to a state-sponsored cyber incident, policymakers will need to consider three variables: the intelligence community\u2019s confidence in its attribution of responsibility, the impact of the incident and the levers of national power at a state\u2019s disposal. While these variables will help guide responses to a disruptive or destructive cyberattack, policymakers will also need to take two steps before an incident occurs. First, they will need to work with the private sector to determine the effect of an incident on their operations. Second, governments need to develop a menu of pre-planned response options and assess the potential impact of any response on political, economic, intelligence and military interests.<\/p>\n

Even as the number of highly disruptive and destructive cyberattacks grows, governments remain unprepared to respond adequately. In other national security areas, policy responses to state-sponsored activity are well established. For example, a country can expel diplomats in response to a spying scandal, issue a demarche if a country considers its sovereignty to have been violated, and use force in response to an armed attack. Clear and established policy responses such as these don\u2019t yet exist for cyberattacks for two reasons. First, assessing the damage caused by a cyber incident is difficult. It can take weeks, if not months, for computer forensics experts to accurately and conclusively ascertain the extent of the damage done to an organisation\u2019s computer networks. For example, it took roughly two weeks<\/a> for Saudi authorities to understand the extent of the damage of the Shamoon incident, which erased data on 30,000 of Saudi Aramco\u2019s computers. Although this may be quick by computer forensics standards, a military can conduct a damage assessment from a non-cyber incident in as little as a few hours.<\/p>\n

Second, attributing cyber incidents to their sponsor remains a significant challenge. Masking the true origins of a cyber incident is easy\u2014states often use proxies or compromised computers in other jurisdictions to hide their tracks. For example, a group calling itself the Cyber Caliphate claimed responsibility<\/a> for taking French television station TV5 Monde off the air with a cyberattack in April 2015, and used the television station\u2019s social media accounts to post content in support of the self-proclaimed Islamic State. Two months later French media reported<\/a> that Russian state-sponsored actors, not pro\u2013Islamic State groups, were likely behind the incident. Even when attribution is possible, it isn\u2019t guaranteed that domestic or foreign audiences will believe the claim unless officials reveal potentially classified methods used to determine the identity of the perpetrator, damaging intelligence assets in the process. Under pressure, responses are likely to be made quickly with incomplete evidence and to attract a high degree of public skepticism. This creates clear risks for policymakers. Quick damage assessments could lead to an overestimation of the impact of an incident, causing a state to respond disproportionately. Misattributing an incident could cause a response to be directed at the wrong target, creating a diplomatic crisis.<\/p>\n

Policymakers should consider three variables before developing a response. First, they should understand the level of confidence that their intelligence agencies have in attributing the incident. Although there have been great strides in the ability of intelligence agencies to attribute malicious activity, digital forensics aren\u2019t perfect. The degree of attributional certainty will have a direct impact on the action taken. For example, if the level of attribution is low, policymakers will be limited in their choice of response even if the severity of the attack is high. They may choose a less valuable retaliatory target to limit the odds of escalation and international criticism. There may also be instances where there\u2019s such little evidence for the source of the attack that the victim may choose not to respond.<\/p>\n

Second, policymakers should assess the cyber incident\u2019s effects on physical infrastructure, society, the economy and national interests. Questions include: What was the physical damage caused by the affected systems, and was there any impact to critical infrastructure? What type of essential services are affected? Has the incident caused a significant loss of confidence in the economy? What was the incident\u2019s impact on national security and the country\u2019s reputation?<\/p>\n

Third, policymakers should consider the range of diplomatic, economic and military responses at their disposal, from a quiet diplomatic rebuke to a military strike. Responses need not be limited to cyberspace\u2014nothing bars a state from using other channels, though each carries its own risks.<\/p>\n

Cyber responses can be taken in addition to diplomatic, economic and military activity. However, they would most often be delivered covertly and could be difficult to develop quickly unless a government had prepared capability against a specific target, likely involving prior cyber espionage, an unparalleled understanding of a target\u2019s vulnerabilities and a custom exploit kit at its disposal. As an example, Stuxnet reportedly took years to develop<\/a> and deploy. An overt cyber response can be unappealing as states may lose the ability to launch similar responses against other targets. Although states may outsource their responses to a proxy, doing so could limit their control over the response and lead to escalatory activity. Therefore, policymakers are likely to concentrate on other levers of power, alongside whatever they may do covertly.<\/p>\n

Given the pressure governments will feel to respond to significant cyberattacks, policymakers need to develop a response framework before a disruptive or destructive cyber incident occurs. Although each response will be case specific, a framework will enable policymakers to quickly consider their options. I suggest such a framework for response in a publication<\/a> released today with the Council for Foreign Relations.<\/p>\n","protected":false},"excerpt":{"rendered":"

As states become less inhibited about utilising cyber as a component of state power, policymakers will be increasingly challenged to develop proportionate responses to disruptive or destructive attacks. Already, there\u2019s been significant pressure to \u2018do …<\/p>\n","protected":false},"author":49,"featured_media":22173,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[391,95,713,107],"class_list":["post-22170","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-cyber","tag-cyber-security","tag-cyberattack","tag-policymaking"],"acf":[],"yoast_head":"\nWhen states strike back\u2014national responses to cyber incidents | The Strategist<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"When states strike back\u2014national responses to cyber incidents | The Strategist\" \/>\n<meta property=\"og:description\" content=\"As states become less inhibited about utilising cyber as a component of state power, policymakers will be increasingly challenged to develop proportionate responses to disruptive or destructive attacks. Already, there\u2019s been significant pressure to \u2018do ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/\" \/>\n<meta property=\"og:site_name\" content=\"The Strategist\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/ASPI.org\" \/>\n<meta property=\"article:published_time\" content=\"2015-08-24T20:00:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2015-08-24T03:35:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/08\/3049692026_c26357ab94_z.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"327\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Tobias Feakin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:site\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tobias Feakin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\",\"url\":\"https:\/\/www.aspistrategist.ru\/\",\"name\":\"The Strategist\",\"description\":\"ASPI's analysis and commentary site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.aspistrategist.ru\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-AU\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/#primaryimage\",\"url\":\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/08\/3049692026_c26357ab94_z.jpg\",\"contentUrl\":\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/08\/3049692026_c26357ab94_z.jpg\",\"width\":640,\"height\":327,\"caption\":\"Keyboard & Mouse\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/\",\"url\":\"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/\",\"name\":\"When states strike back\u2014national responses to cyber incidents | The Strategist\",\"isPartOf\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/#primaryimage\"},\"datePublished\":\"2015-08-24T20:00:11+00:00\",\"dateModified\":\"2015-08-24T03:35:04+00:00\",\"author\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/84f461839f3f37e79509040ae4eeedcd\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/#breadcrumb\"},\"inLanguage\":\"en-AU\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.aspistrategist.ru\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"When states strike back\u2014national responses to cyber incidents\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/84f461839f3f37e79509040ae4eeedcd\",\"name\":\"Tobias Feakin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/a8346dd3562a4d00483b16ff7e8b8df6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/a8346dd3562a4d00483b16ff7e8b8df6?s=96&d=mm&r=g\",\"caption\":\"Tobias Feakin\"},\"url\":\"https:\/\/www.aspistrategist.ru\/author\/tobias-feakin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"When states strike back\u2014national responses to cyber incidents | The Strategist","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/","og_locale":"en_US","og_type":"article","og_title":"When states strike back\u2014national responses to cyber incidents | The Strategist","og_description":"As states become less inhibited about utilising cyber as a component of state power, policymakers will be increasingly challenged to develop proportionate responses to disruptive or destructive attacks. Already, there\u2019s been significant pressure to \u2018do ...","og_url":"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/","og_site_name":"The Strategist","article_publisher":"https:\/\/www.facebook.com\/ASPI.org","article_published_time":"2015-08-24T20:00:11+00:00","article_modified_time":"2015-08-24T03:35:04+00:00","og_image":[{"width":640,"height":327,"url":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/08\/3049692026_c26357ab94_z.jpg","type":"image\/jpeg"}],"author":"Tobias Feakin","twitter_card":"summary_large_image","twitter_creator":"@ASPI_org","twitter_site":"@ASPI_org","twitter_misc":{"Written by":"Tobias Feakin","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/www.aspistrategist.ru\/#website","url":"https:\/\/www.aspistrategist.ru\/","name":"The Strategist","description":"ASPI's analysis and commentary site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.aspistrategist.ru\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-AU"},{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/#primaryimage","url":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/08\/3049692026_c26357ab94_z.jpg","contentUrl":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/08\/3049692026_c26357ab94_z.jpg","width":640,"height":327,"caption":"Keyboard & Mouse"},{"@type":"WebPage","@id":"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/","url":"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/","name":"When states strike back\u2014national responses to cyber incidents | The Strategist","isPartOf":{"@id":"https:\/\/www.aspistrategist.ru\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/#primaryimage"},"datePublished":"2015-08-24T20:00:11+00:00","dateModified":"2015-08-24T03:35:04+00:00","author":{"@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/84f461839f3f37e79509040ae4eeedcd"},"breadcrumb":{"@id":"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/#breadcrumb"},"inLanguage":"en-AU","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.aspistrategist.ru\/when-states-strike-back-national-responses-to-cyber-incidents\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.aspistrategist.ru\/"},{"@type":"ListItem","position":2,"name":"When states strike back\u2014national responses to cyber incidents"}]},{"@type":"Person","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/84f461839f3f37e79509040ae4eeedcd","name":"Tobias Feakin","image":{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a8346dd3562a4d00483b16ff7e8b8df6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a8346dd3562a4d00483b16ff7e8b8df6?s=96&d=mm&r=g","caption":"Tobias Feakin"},"url":"https:\/\/www.aspistrategist.ru\/author\/tobias-feakin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/22170"}],"collection":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/users\/49"}],"replies":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/comments?post=22170"}],"version-history":[{"count":3,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/22170\/revisions"}],"predecessor-version":[{"id":22174,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/22170\/revisions\/22174"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media\/22173"}],"wp:attachment":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media?parent=22170"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/categories?post=22170"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/tags?post=22170"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}