Free Cyber Warfare by Bobby Akart Page B

internationally, on how cyber warfare and cyber criminal activity will be dealt with between countries. Some suggest that such norms will evolve over time. The question has to be asked—cyber attacks can happen so quickly, will the standards come too late?
     

Chapter Eight
The Problem of Attribution

    Attribution—or lack thereof—is another major obstacle that prevents nations from defining when a bad actor can start a war via cyber attack. If a government cannot determine who carried out the attack, it’s difficult to know who to blame and whether the attack warrants a response. Without definitive evidence leading to identification of the intruder, a state can’t formulate an appropriate response without knowing who was involved. This challenge is on clear display with the Sony attack. At various times, investigators have attributed the attacks to North Korea, China, and even Sony employees. The FBI, after initially saying there was no connection between North Korea and the attack, has since concluded that indeed North Korea did carry out the attack—a conclusion that led to U.S. sanctions against the secluded country. For a time, it was alleged a disgruntled employee was behind the cyber intrusion—or perhaps both working in concert.
    Just like any criminal investigation, if law enforcement could somehow figure out the assailant, then a lot of issues go away. If you know who’s conducting the cyber activity, you also get an insight into their intent. If it’s the Russian government, you know they have the ability to take things a step further. If it’s some hacker in his mom’s basement, you know there’s no intent or ability to raise the level of force that’s going to be used. Ultimately, the issue of attribution is not a legal problem; it’s a technical problem.
    Determining whether a non-state entity is acting under the direction of the state further complicates the attribution problem. If it turns out that the Sony attack can’t be tied directly to the North Korea government, but rather to a group of non-state-affiliated individuals—North Korea’s response would be these individuals were just patriots . What level of command-and-control or even sponsorship is required before a state is held accountable for the cyber activity?
    The problem of attribution won’t soon be solved. Most of the cyber attacks undertaken will require patient waiting and watching to establish a pattern. One policy analyst summarized the approach as follows: “We watch what states do over time and it sort of settles. State takes an action, no one objects, or everyone objects. We have a lot of people who want answers right now, but we’re in for a period of uncertainty.”
    Attribution, the process of detecting an adversaries fingerprints on a cyber attack, will always be a challenge. Establishing any degree of confidence in determining guilt may always stand in the way of a military response. Will the United States government require a beyond all reasonable doubt standard as it might in a criminal prosecution? Time will tell.
     

Chapter Nine
U. S. Department of Defense Preparations
    United States Cyber Command (USCYBERCOM) is an armed forces sub-unified command subordinate to United States Strategic Command. The command is located at Fort Meade, Maryland, and centralizes command of cyberspace operations, organizes existing cyber resources and synchronizes defense of U.S. military networks. USCYBERCOM synchronizes and conducts activities to direct the operations and defense of specified Department of Defense information networks, The agency also conducts full-spectrum military cyberspace operations in order to enable actions in all domains, ensure US/Allied freedom of action in cyberspace and deny the same to our adversaries. USCYBERCOM is charged with pulling together existing cyberspace resources, creating synergy and synchronizing war-fighting effects to defend the information security environment.
    The Department of