In January, US President George W. Bush signed two presidential directives that called for establishing a comprehensive cyber-security plan, and his budget for next year requested US$6 billion to develop a system to protect national cyber security.
President-elect Barack Obama is likely to follow suit. In his campaign, Obama called for tough new standards for cyber security and physical resilience of critical infrastructure, and promised to appoint a national cyber adviser who will report directly to him and be responsible for developing policy and coordinating federal agency efforts.
That job will not be easy, because much of the relevant infrastructure is not under direct government control. Just recently, US Deputy Director of National Intelligence Donald Kerr warned that “major losses of information and value for our government programs typically aren’t from spies ... In fact, one of the great concerns I have is that so much of the new capabilities that we’re all going to depend on aren’t any longer developed in government labs under government contract.”
Kerr described what he called “supply chain attacks” in which hackers not only steal proprietary information, but go further and insert erroneous data and programs in communications hardware and software — Trojan horses that can be used to bring down systems. All governments will find themselves exposed to a new type of threat that will be difficult to counter.
Governments can hope to deter cyber attacks just as they deter nuclear or other armed attacks. But deterrence requires a credible threat of response against an attacker. And that becomes much more difficult in a world where governments find it hard to tell where cyber attacks come from, whether from a hostile state or a group of criminals masking as a foreign government.
While an international legal code that defines cyber attacks more clearly, together with cooperation on preventive measures, can help, such arms-control solutions are not likely to be sufficient. Nor will defensive measures like constructing electronic firewalls and creating redundancies in sensitive systems.
Given the enormous uncertainties involved, the new cyber dimensions of security must be high on every government’s agenda.
Joseph Nye is a professor at Harvard University and an author.
Copyright: Project Syndicate
RSS