At a glance.
- The Cyberspace Solarium reports.
Layered deterrence and a whole-of-nation approach to resiliency.
The US Cyberspace Solarium released its report today, which includes as foreseen seventy-five recommendations grouped under six heads:
- "Reform the U.S. Government's Structure and Organization for Cyberspace."
- "Strengthen Norms and Non-Military Tools."
- "Promote National Resilience."
- "Reshape the Cyber Ecosystem."
- "Operationalize Cybersecurity Collaboration with the Private Sector."
- "Preserve and Employ the Military Instrument of National Power."
The recommendations are framed against the background of national vulnerability to a sudden, disabling cyber campaign, and the report does have the feel of some of the retrospective self-examination the US Government undertook after the 9/11 attacks of 2001.
This 9/11, of course, is prospective, and it projects itself imaginatively into the report by an introductory piece of fiction, "A Warning from Tomorrow," in which legislative staffers working from a Rosslyn, Virginia, high-rise survey the cyber-induced devastation across the Potomac with a sense of despair, futility, and anomie. The river itself is discolored red with the release of ”the wrong chemicals” from upstream treatment plants. The city’s low-lying areas are still sodden from floods that happened when reservoirs drained after their “sensors” were hacked, and the Reflecting Pool is still a venomous purple. Drone wreckage litters the Mall. In outlying open spaces can be seen the tents and shacks of the Hoovervillesque refugee camps that sprang up after a trainload of toxic chemicals was induced to crash up the line in Baltimore. And so on.
The story speaks of Capitol Hill, and of course Rosslyn is across the Potomac from the actual Capitol Hill, but clearly the writers are dealing with the geography of the spirit, and not prosaic real estate.
That's a relatively remote dystopia, but cyberspace as the Solarium sees it is already an incipient dystopia, and the United States needs to wake up. We quote: “While America looks forward to the potential of cyberspace and associated technologies to improve the quality of human life, threats continue to grow at an accelerating pace. America is facing adversary nationstates, extremists, and criminals that are leveraging emerging technologies to an unprecedented degree. Authoritarian states seek to control every aspect of life in their societies and export this style of government, in which surveillance trumps liberty, to the rest of the world. There is no public square, only black boxes proliferating propaganda and organizing economic activity to benefit the few at the expense of the many. Rogue states, extremists, and criminals thrive on the dark web, taking advantage of insecure network connections and a market for malware to prey on victims.” And that's indeed a grab-bag of the grim.
There’s no mystery as to the identity of the principal nation-state adversaries this time around, either. They’re the familiar four: Russia, China, Iran, and North Korea. The non-state actors the report cites are also familiar: criminal gangs, hacktivist organizations, lone wolves.
Like the report of the original Cold War Solarium (which considered nuclear strategy) the Cyberspace Solarium used three teams to come up with competing approaches to the challenge it was set. Also like the original, the new Solarium’s recommendations concentrate heavily on deterrence and resilience. The commissioners offer some "big ideas to get the conversation started." These include the conviction that deterrence in cyberspace is possible, that such deterrence relies on a resilient economy and will require "government reform," that the private sector must up its own security game, and that election security must be given high priority.
Deterrence would involve defending forward, and would be “layered,” the report says, designed to shape behavior, deny benefits, and impose costs. Thus prospective attackers who worked the calculus of cyber conflict would be dissuaded first by international “entanglement” and international norms. The low probability of deriving any benefit from an attack would further persuade them that offensive action would be largely futile, and, finally, in the third level, the sure prospect of retaliation, punishment, the imposition of costs, would convince them that it wasn’t in their interest to attack. It's a long and heavy report (WIRED calls it an "anvil") with much to consider in its 174 pages.
The logic of deterrence, the report says, hasn’t substantially changed in more than half a century. Their notes about the value of entanglement and international norms are well-taken, but a look back a bit more than a century might give the commissioners pause. Norman Angell's Europe's Optical Illusion (subsequently renamed The Great Illusion) argued in 1909 that modern economies were so intertwined that any rational states would recognize that war among great powers had become self-defeating, and thus that Great Power war had become effectively impossible, an illusion. Of course five years after publication the European Powers showed that they weren't rational actors. Perhaps that's one reason the Cyberspace Solarium proposes layered deterrence: each layer shouts louder than the one before.
Looking back at the story with which the report begins, one can’t help noting that maybe if the fictional staffers had a more appropriate life-goal than a window office from which they could enjoy their Capitol Hill positions, maybe things wouldn’t have become the hellscape the authors imagine. One can hope the real professionals inside the Beltway are better than that, right?