OFFENSIVE CYBER OPERATIONSWorth a Try: The U.S. Will Authorize Some Companies for Cyber Counterattacks
The United States has had enough in cyberspace. The White House has now created a program under which American companies can conduct offensive cyber operations against ransomware gangs and other ‘cyber-enabled transnational criminal organizations.’
The United States has had enough in cyberspace. The White House has now created a program under which American companies can conduct offensive cyber operations against ransomware gangs and other ‘cyber-enabled transnational criminal organizations.’
Australia should look closely at the experiment.
No one can know whether this idea will work. After all, adversaries’ cyber operations have only become more frequent and the consequences more severe in the eight years since the White House unleashed US Cyber Command. Its persistent offensive engagement was supposed to lead to diminished attacks and cyber stability, but here we are again.
Despite that, widening the task is worth trying. Allowing a small number of vetted companies to disrupt adversaries, under government control, is a worthwhile experiment. These operations are not meant to be ‘hacking back’ but longer term surveillance and disruption to frustrate their operations.
I would have hated this idea 10 or 15 years ago, when I argued the US should forgo its pre-eminent offence to prioritize defense above all else. I thought it would all rebound against us, leading to more attacks than we could stomach. But, rather than prioritize defense, the government instead decided to ‘balance’ it with offence. And now here we are.
Policymakers have to make decisions for the world of today and tomorrow, not the one that might have been prevented.
Critics have a range of reasonable objections to the White House plan. Some suggest these operations might be escalatory, fueling an arms race. Those arguments can be dismissed. The more worrying concerns are about implementation.
The risk of escalation or an arms race should be the least concern with outsourcing non-state offensive operations. Critics should not blame the victims for fighting back.
These criminal groups operate with near impunity, often given sanctuary by Russia, Iran and China, and are unafraid of prosecution, even as they target the most vulnerable among us, attacking schools and hospitals during a pandemic. It cannot be a policy priority to worry whether Russian cronies get upset because their criminal enterprises got disrupted.
Implementation presents a larger set of issues. The devil is truly in the details, as my colleague Erica Lonergan has highlighted.
