Cyberwarfare in the United States

As a major developed economy, the United States is highly dependent on the Internet and therefore greatly exposed to cyber attacks. At the same time, the United States has substantial capabilities in both defense and power projection thanks to its advanced technology and large military budget. Cyber warfare continues to be a growing threat as more physical systems and infrastructure are linked to the internet. Malicious hacking from domestic or foreign enemies remains a constant threat to the United States. In response to these growing threats, the United States has developed significant cyber capabilities.

The United States Department of Defense recognizes the use of computers and the Internet to conduct warfare in cyberspace as a threat to national security, but also as a platform for attack.

The United States Cyber Command centralizes command of cyberspace operations, organizes existing cyber resources and synchronizes defense of U.S. military networks. It is an armed forces sub-unified command subordinate to United States Strategic Command.

The Department of Defense Cyber Strategy

In April 2015, the U.S. Department of Defense (DoD) published its latest Cyber Strategy^[1] building upon the previous DoD Strategy for Operating in Cyberspace published in July 2011.^[2] The DoD Cyber strategy focuses on building capabilities to protect, secure, and defend its own DoD networks, systems and information; defend the nation against cyber attacks; and support contingency plans. This includes being prepared to operate and continue to carry out missions in environments impacted by cyber attacks.

The DoD outlines three cyber missions:

1. Defend DoD networks, systems, and information.
2. Defend the United States and its interests against cyberattacks of significant consequence.
3. Provide integrated cyber capabilities to support military operations and contingency plans.

In addition the Cyber Strategy emphasizes the need to build bridges to the private sector, so that the best talent and technology the United States has to offer is at disposal to the DoD.^[1]

The Five Pillars

The five pillars is the base of the Department of Defense's strategy for cyberwarfare. The first pillar is to recognize that the new domain for warfare is cyberspace and that it is similar to the other elements in the battlespace. The key objectives of this pillar is to build up technical capabilities and accelerate research and development to provide the United States with a technological advantage. The second pillar is proactive defenses as opposed to passive defense. Two examples of passive defense are computer hygiene and firewalls. The balance of the attacks require active defense using sensors to provide a rapid response to detect and stop a cyber attack on a computer network. This would provide military tactics to backtrace, hunt down and attack an enemy intruder. The third pillar is critical infrastructure protection (CIP) to ensure the protection of critical infrastructure by developing warning systems to anticipate threats. The fourth pillar is the use of collective defense which would provide the ability of early detection, and to incorporate it into the cyberwarfare defense structure. The goal of this pillar being to explore all options in the face of a conflict, and to minimize loss of life and destruction of property. The fifth pillar is build and maintain international alliances and partnerships to deter shared threats, and to remain adaptive and flexible to build new alliances as required. This is focused on "priority regions, to include the Middle East, Asia-Pacific, and Europe".^[1]

Cyberattack as an act of war

In 2011, The White House published an "International Strategy for Cyberspace" that reserved the right to use military force in response to a cyberattack:^[3][4]

In 2013, the Defense Science Board, an independent advisory committee to the U.S. Secretary of Defense, went further, stating that "The cyber threat is serious, with potential consequences similar in some ways to the nuclear threat of the Cold War," and recommending, in response to the "most extreme case" (described as a "catastrophic full spectrum cyber attack"), that "Nuclear weapons would remain the ultimate response and anchor the deterrence ladder."^[5]

Attacks on other nations

Iran

In June 2010, Iran was the victim of a cyber attack when its nuclear facility in Natanz was infiltrated by the cyber-worm ‘Stuxnet’, said to be the most advanced piece of malware ever discovered and significantly increases the profile of cyberwarfare.^[6][7] It destroyed perhaps over 1000 nuclear centrifuges and, according to a Business Insider article, "[set] Tehran's atomic program back by at least two years."^[8]

Despite a lack of official confirmation, Gary Samore, White House Coordinator for Arms Control and Weapons of Mass Destruction, made a public statement, in which he said, "we're glad they [the Iranians] are having trouble with their centrifuge machine and that we—the US and its allies—are doing everything we can to make sure that we complicate matters for them", offering "winking acknowledgement" of US involvement in Stuxnet.^[9]

China

In 2013, Edward Snowden, a former systems administrator for the Central Intelligence Agency (CIA) and a counterintelligence trainer at the Defense Intelligence Agency (DIA), revealed that the United States government had hacked into Chinese mobile phone companies to collect text messages and had spied on Tsinghua University, one of China's biggest research institutions, as well as home to one of China's six major backbone networks, the China Education and Research Network (CERNET), from where internet data from millions of Chinese citizens could be mined. He said U.S. spy agencies has been watching China and Hong Kong for years.^[10]

According to classified documents provided by Edward Snowden, the National Security Agency (NSA) has also infiltrated the servers in the headquarters of Huawei, China's largest telecommunications company and the largest telecommunications equipment maker in the world. The plan is to exploit Huawei's technology so that when the company sold equipment to other countries—including both allies and nations that avoid buying American products—the NSA could roam through their computer and telephone networks to conduct surveillance and, if ordered by the president, offensive cyberoperations.^[11]

Other

• In 1982, a computer control system stolen from a Canadian company by Soviet spies caused a Soviet gas pipeline to explode. It has been alleged that code for the control system had been modified by the CIA to include a logic bomb which changed the pump speeds to cause the explosion,^{[12][12][12][13]} but this is disputed.^[14][15]
• An 1 April 1991 article in InfoWorld Magazine "Meta-Virus Set to Unleash Plague on Windows 3.0 Users" by John Gantz^[16] was purported to be an extremely early example of cyber warfare between 2 countries. In fact the "AF/91 virus" was an April Fools Joke that was misunderstood and widely re-reported as fact by credulous media.^[17]

Cyber threat information sharing

The Pentagon has had an information sharing arrangement, the Defense Industrial Base Cybersecurity and Information Assurance (DIBCIA) program, in place with some private defense contractors since 2007^[18] to which access was widened in 2012.^[19]

A number of other information sharing initiatives such as the Cyber Intelligence Sharing and Protection Act (CISPA) and Cybersecurity Information Sharing Act (CISA) have been proposed, but failed for various reasons including over fears that they have too few limits, and could be used to spy on the general public.

United States Cyber Command

The United States Cyber Command (USCYBERCOM) is a United States armed forces sub-unified command subordinate to United States Strategic Command. USCYBERCOM plans, coordinates, integrates, synchronizes and conducts activities to: defend Department of Defense information networks and; prepare to conduct "full spectrum military cyberspace operations" to ensure US/Allied freedom of action in cyberspace and deny the same to adversaries.^[20]

Army

The Army Cyber Command (ARCYBER) is an Army component command for the U.S. Cyber Command.^[21] ARCYBER has the following components:

• Army Network Enterprise Technology Command / 9th Army Signal Command
• Portions of 1st Information Operations Command (Land)
• United States Army Intelligence and Security Command will be under the operational control of ARCYBER for cyber-related actions.^[22][23][24]

Marine Corps

United States Marine Corps Forces Cyberspace Command is a functional formation of the United States Marine Corps to protect infrastructure from cyberwarfare.^[25]

Air Force

The Twenty-Fourth Air Force (24 AF) will be the United States Air Force component of United States Cyber Command (USCYBER).^[26] It has the following components:

• 67th Network Warfare Wing
• 688th Information Operations Wing
• 689th Combat Communications Wing

Navy

The Navy Cyber Forces (CYBERFOR) is the type commander for the U.S. Navy's global cyber workforce. The headquarters is located at Joint Expeditionary Base Little Creek-Fort Story. CYBERFOR provides forces and equipment in cryptology/signals intelligence, cyber, electronic warfare, information operations, intelligence, networks, and space. In September 2013, the United States Naval Academy will offer undergraduate students the opportunity to major in Cyber Operations.^[27]

Fleet Cyber Command is an operating force of the United States Navy responsible for the Navy's cyber warfare programs.^[28] Tenth Fleet is a force provider for Fleet Cyber Command.^[29] The fleet components are:

• Naval Network Warfare Command
• Navy Cyber Defense Operations Command
• Naval Information Operation Commands
• Combined Task Forces

Timeline

Cyberwar defense team

• Systems in the US military and private research institutions were penetrated from March 1998 for almost two years in an incident called Moonlight Maze. The United States Department of Defense traced the trail back to a mainframe computer in the former Soviet Union but the sponsor of the attacks is unknown and Russia denies any involvement.
• Titan Rain was the U.S. government's designation given to a series of coordinated attacks on American computer systems since 2003. The attacks were labeled as Chinese in origin, although their precise nature (i.e., state-sponsored espionage, corporate espionage, or random hacker attacks) and their real identities (i.e., masked by proxy, zombie computer, spyware/virus infected) remain unknown.
• In 2007, the United States government suffered "an espionage Pearl Harbor" in which an unknown foreign power...broke into all of the high tech agencies, all of the military agencies, and downloaded terabytes of information.^[30]
• In 2008, a hacking incident occurred on a U.S. Military facility in the Middle East. United States Deputy Secretary of Defense William J. Lynn III had the Pentagon release a document, which reflected a "malicious code" on a USB flash drive spread undetected on both classified and unclassified Pentagon systems, establishing a digital beachhead, from which data could be transferred to servers under foreign control. "It was a network administrator's worst fear: a rogue program operating silently, poised to deliver operational plans into the hands of an unknown adversary. This ... was the most significant breach of U.S. military computers ever and it served as an important wake-up call", Lynn wrote in an article for Foreign Affairs.^[31]
• On 9 February 2009, the White House announced that it will conduct a review of the nation's cyber security to ensure that the Federal government of the United States cyber security initiatives are appropriately integrated, resourced and coordinated with the United States Congress and the private sector.^[32]
• On 1 April 2009, U.S. lawmakers pushed for the appointment of a White House cyber security "czar" to dramatically escalate U.S. defenses against cyber attacks, crafting proposals that would empower the government to set and enforce security standards for private industry for the first time.^[33][34]

• On 7 April 2009, The Pentagon announced they spent more than $100 million in the last six months responding to and repairing damage from cyber attacks and other computer network problems.^[35]
• In December 2009 through January 2010, a cyber attack, dubbed Operation Aurora, was launched from China against Google and over 20 other companies.^[36] Google said the attacks originated from China and that it would "review the feasibility" of its business operations in China following the incident. According to Google, at least 20 other companies in various sectors had been targeted by the attacks. McAfee spokespersons claimed that "this is the highest profile attack of its kind that we have seen in recent memory."^[37]
• In February 2010, the United States Joint Forces Command released a study which included a summary of the threats posed by the internet: "The open and free flow of information favored by the West will allow adversaries an unprecedented ability to gather intelligence."^[38]
• On 19 June 2010, United States Senator Joe Lieberman (I-CT) introduced a bill called "Protecting Cyberspace as a National Asset Act of 2010",^[39] which he co-wrote with Senator Susan Collins (R-ME) and Senator Thomas Carper (D-DE). If signed into law, this controversial bill, which the American media dubbed the "Kill switch bill", would grant the President emergency powers over parts of the Internet. However, all three co-authors of the bill issued a statement that instead, the bill "[narrowed] existing broad Presidential authority to take over telecommunications networks".^[40]
• In August 2010, the U.S. for the first time is publicly warning about the Chinese military's use of civilian computer experts in clandestine cyber attacks aimed at American companies and government agencies. The Pentagon also pointed to an alleged China-based computer spying network dubbed GhostNet that was revealed in a research report last year.^[41] The Pentagon stated that the People's Liberation Army was using "information warfare units" to develop viruses to attack enemy computer systems and networks, and those units include civilian computer professionals. Commander Bob Mehal would monitor the PLA's buildup of its cyberwarfare capabilities and "will continue to develop capabilities to counter any potential threat."^[42] In response to these and other clandestine cyber attacks by China, Amitai Etzioni of the Institute for Communitarian Policy Studies has suggested that China and the United States should agree to a policy of mutually assured restraint with respect to cyberspace. This would involve allowing both states to take the measures they deem necessary for their self-defense while simultaneously agreeing to refrain from taking offensive steps; it would also entail vetting these commitments.^[43]
• In 2010, American General Keith B. Alexander endorsed talks with Russia over a proposal to limit military attacks in cyberspace, representing a significant shift in U.S. policy.^[44]
• In 2011 as part of The Anonymous attack on HBGary Federal information about private companies such as Endgame systems who design offensive software for the Department of Defense were revealed. It was shown that Endgame systems job applicants had previously "managed team of 15 persons, responsible for coordinating offensive computer network operations for the United States Department of Defense and other federal agencies."^[45]
• In October 2012, the Pentagon was to host contractors who "want to propose revolutionary technologies for understanding, planning and managing cyberwarfare. It is part of an ambitious program that the Defense Advanced Research Projects Agency, or DARPA, calls Plan X, and the public description talks about 'understanding the cyber battlespace', quantifying 'battle damage' and working in DARPA's 'cyberwar laboratory.'"^[46]
• Starting in September 2012, denial of service attacks, were carried out against the New York Stock Exchange and a number of banks including J.P. Morgan Chase.^[47] Credit for these attacks was claimed by a hacktivist group called the Qassam Cyber Fighters^[48] who have labeled the attacks Operation Ababil. The attacks had been executed in several phases and were restarted in March 2013.^[49]
• In 2013, the first Tallinn Manual on the International Law Applicable to Cyber Warfare^[50] was published. This publication was the result of an independent study to examine and review laws governing cyber warfare sponsored by the NATO Cooperative Cyber Defence Centre of Excellence in 2009.
• In February 2013, the White House Presidential Executive Order (E.o.) 13636 "Improving Critical Infrastructure Cybersecurity^[51]" was published. This executive order highlighted the policies needed to improve and coordinate cybersecurity, identification of critical infrastructure, reduction of cyber risk, information sharing with the private sector, and ensure civil and privacy liberties protections are incorporated.
• In January 2014, the White House Presidential Policy Directive 28 (PPD-28) on "Signals Intelligence Activities^[52]" was published. This presidential policy directive highlighted the principles, limitations of use, process of collection, safeguarding of personal information, and transparency related to the collection and review of cyber intelligence signal activities.
• In August 2014, "gigabytes" of sensitive data were reported stolen from JPMorgan Chase, and the company's internal investigation was reported to have found that the data was sent to a "major Russian city." The FBI was said to be investigating whether the breach was in retaliation for sanctions the United States had imposed on Russia in relation to the 2014 Russian military intervention in Ukraine.^[53][54]
• On 29 May 2014, iSIGHT Partners uncovered a "long-term" and "unprecedented" cyber espionage that was "the most elaborate cyber espionage campaign using social engineering that has been uncovered to date from any nation". Labelled "Operation Newscaster", it targeted senior U.S. military and diplomatic personnel, congresspeople, journalists, lobbyists, think tankers and defense contractors, including a four-star admiral.^[55]
• In December 2014, Cylance Inc. published an investigation on so-called "Operation Cleaver" which targeted over 50 world's unnamed leading enterprises, including in United States. Federal Bureau of Investigation tacitly acknowledged the operation and "warned businesses to stay vigilant and to report any suspicious activity spotted on the companies' computer systems".^[56][57]
• In December 2014, in response to a hack on the US based company Sony believed to be perpetrated by North Korea (see Sony Pictures hack) the US government created new economic sanctions on North Korea and listed the country as a state sponsor of terrorism. After the hack there was an internet blackout over most of North Korea allegedly caused by the US, but there is no definitive evidence to support that claim.^[58][59]
• In April 2015, The Department of Defense Cyber Strategy^[1] was updated and published. Original DoD Strategy for Operating In Cyberspace^[2] was published in July 2011.
• In 2015 the United States Office of Personnel Management (OPM) was victim to what has been described by federal officials as among the largest breaches of government data in the history of the United States,^[60] in which an estimated 21.5 million records were stolen. Information targeted in the breach included personally identifiable information such as Social Security numbers,^[61] as well as names, dates and places of birth, and addresses,^[62] and likely involved theft of detailed background security-clearance-related background information.
• In June 2015, the US Department of Defense (DoD) included a chapter dedicated to cyber warfare in the DoD Law of War Manual.^[63] See Cyber Warfare section on p. 994.^[63]
• In 2016 Cyber Command mounted computer-network attacks on ISIL.^[64]

See also

References

Further reading

• Hunt, Edward (2012). "US Government Computer Penetration Programs and the Implications for Cyberwar". IEEE Annals of the History of Computing. 34: 3. doi:10.1109/mahc.2011.82. 
• Obama Order Sped Up Wave of Cyberattacks Against Iran with diagram, 1 June 2012

United States Air Force cyber units
Air Forces	24 AF
Wings	Combat Communications 689th Information Operations 688th Network Warfare 67th
Groups	Combat Communications 3d 5th 201st 226th 254th 281st Cyberspace Engineering Installation 38th 251st 253d Information Operations 318th Network Operations 26th 50th Network Support 690th Network Warfare 67th
Squadrons	Combat Communications 1st (USAFE) 23d 31st 32d 33d 34th 35th 42d 51st 52d 53d 54th 55th 147th 221st 232d 236th 239th 242d 263d 264th 265th 267th 269th 271st 280th (AFSOC) 282d 283d 291st 292d 293d 644th (PACAF) Combat Communications Support 3d 5th Command and Control 119th 153d 222d Communications 21st 721st Cyberspace Readiness 38th Engineering 38th Engineering Installation 85th 130th 202d 205th 210th 211th 212th 213th 214th 215th 217th 219th 220th 241st 243d 270th 272d Information Operations 39th 90th 92d Intelligence Support 690th Network Operations 26th 83d 561st Network Support 690th Network Warfare 33d 68th 91st 315th 352d 426th Operations Support 38th Space Communications 30th 45th 50th 460th
Flights	Communications 310th 710th
Centers	614 OC 624 OC