How might the US respond to cyber attacks?

It would start with information sharing and would not necessarily be limited to actions in cyberspace.

Cyber norms are  and while the U.S. has publicly outlined its commitment to cyber defenses, breaches such as the OPM hack and could push the offensive behavior in the cyber domain.

In the wake of the news last week of the Office of Personnel Management hack that exposed millions of individuals’ personal information, it remains unclear what the response by the U.S. government will be. Some pundits and Republican presidential candidates have called for a hard strike against China, and President Obama, speaking at the G7 Summit in Germany—and on the same day that the Army’s website was forced offline by the Syrian Electronic Army—promised “much more aggressive" reactions to cyber attacks, but the U.S. response so far has been muted.

China’s status as the United States’ biggest trading partner and creditor could complicate matters; it was politically easier early this year to hit North Korea with sanctions after it was blamed for the Sony hack. Another reason for the delay could be in identifying exactly who was behind the attack—the White House has not publicly pinned it on the Chinese government, who security experts and anonymous government officials suspect.

But the lack of a response to date doesn’t necessarily mean one won’t be forthcoming. The cyber realm has become an operational domain in the military sense, just as air, land and sea are, and U.S. officials on several occasions have touted a whole-of-government approach combining deterrencedefense and response to cyber threats and incidences.

What would a response look like? Christopher Painter, coordinator for Cyber Issues at the State Department, offered his take on how the U.S. could respond to a hypothetical attack during a Senate subcommittee hearing last month.

Subcommittee chairman Cory Gardner (R-Colo.) framed a hypothetical scenario:  “Let’s say your office receives notification that our nation’s sensitive cyber networks have been penetrated and you determine that the attack originated from the great political science founded nation of Ruritania,” Gardner posited. “We also know that this nation has been hostile to U.S. interests in the past and its leadership has prioritized advancing its cyber capabilities to counter U.S. interests. Basically, walk us through … how do you work with other U.S. government agencies, and then what would be your diplomatic response put in place?”

Painter started with information sharing, both among U.S. agencies and with partner nations, which he said would be key to identifying where an attack came from, what it affected and what might be next. “[W]e are a key part, of the interagency process to respond to cyber attacks and cyber intrusions. We work with our interagency to support both the whole of government responses – what the law enforcement and technical community would do – and also what the White House and other parts of our government would do, and including our Department of Defense,” Painter said. “I’d say that one thing I’ve seen that is a marked difference over the last five or six years is the number – the amount of coordination among federal agencies is far better than it’s ever been before.”

State is part of the Cyber Response Group, which is led by the White House but includes “all the key agencies,” including the Pentagon and the intelligence agencies. Established in December, the group works to share threat information, assign attribution and discusses response coordination across the government. State also is part of the National Cyber Incident Response Plan, which is run by the Homeland Security Department.   

And the department has cooperative relationships with several partner nations and counterparts in other governments, which allows for quick communication and coordination across the globe, he said. Cyber threats can much more easily traverse geographic borders than threats in the physical domain, so rapid response and coordination with others is vital.

Painter offered a few real-world examples of how the government responded to cyber incidents. During a 2012-2013 denial of service attack that targeted financial institutions, the United States reached out to its 20 global partners, to not only raise the level of concern, but build a collective action against shared threats, given that the botnet attack compromised computers all over the world.  “[W]e got a lot of assistance from governments because they understood it wasn’t just a technical issue, it was more of a policy issue and it was elevated in their governments,” Painter said.      

Painter also revisited the Sony attack in December by North Korea. “[P]art of what we did,” Painter explained, “is when it was clear what the attribution was and the president was going to make this attribution, I reached out to counterparts in a number of countries around the world and a number of those countries condemned [North Korea’s] action. And that also shows that that kind of activity is unacceptable – it’s a norm that’s unacceptable.”    

In cyber incidents, however, attribution can be the most difficult component, in part because cyberspace allows for a great deal of anonymity and attacks can be routed through servers all over the globe to mask its origins. 

In the case of the OMB hack, Foreign Policy said what it calls the “attribution problem” is best summed up by confusion regarding U.S. officials quoted by major American news outlets. “[The Washington­] Post said that U.S. officials believed the attack was state-sponsored; the [New York] Times said it was unclear whether the breach had been orchestrated at the behest of Chinese authorities.”       

The United States has taken action against China before, indicting five Chinese military officials in May 2014 for cyber espionage. The indictment was also significant as it demonstrated that the U.S. does not always respond to cyber incidents in cyberspace. “[S]omething I would like to emphasize is, although it’s a cyberattack, we don’t think about the response purely through [a] cyber lens; it would be all the tools of foreign policy and military options,” Eric Rosenbach, principal cyber advisor to the Defense Secretary, said at a congressional hearing this year. 

Rosenbach described DOD’s defensive and offensive role. First, “[w]e need to develop the capabilities to deny a potential attack from achieving its desired effect … Second, the U.S. must increase the cost of executing a cyberattack, and this is where DOD must be able to provide the president with options to respond to cyberattacks on the U.S., if required through cyber and other means… And finally, we have to ensure that we are resilient, so if there is an attack that we can bounce back.”

These goals are in addition to DOD’s three missions for cyberspace: “defending DOD networks, defending U.S. networks overall against significant attacks and providing full-spectrum cyber support for military operations.”   

While it is still unclear exactly what the U.S. will do in response to the OPM hack, which took place in 2014 and was just discovered in April, some are calling for a robust and aggressive response. “We should be deeply concerned as a nation about this – millions of cleared individuals have had an enormous amount of personal information taken, their online identities made far more vulnerable, and secure accounts more easily compromised,” retired Army Lt. Col. John Quigg wrote in Breaking Defense, which identified Quigg as one of the first U.S. cyber warriors.  

“We are seeing a nation-state moving with aplomb across our commercial and governmental networks gathering HUMINT (Human Intelligence) data with little resistance and — to date — no consequences. We have a governmental response that is hamstrung by turf and policy and befuddled by the speed of change in this newest of global commons (military speak for places we fight: Land, Sea, Air, Space, CyberSpace),” Quigg wrote. “A muscular governmental response is called for immediately.” 

The U.S. has proven that it is not afraid to pull the trigger in the cyber domain when it comes to offensive operations. The most famous example was the attack on Iran’s nuclear infrastructure with the Stuxnet virus that damaged about one fifth of Iran’s centrifuges. More recently and less publicized, it was reported that the U.S. purportedly attempted to replicate the Iran attack on North Korea’s nuclear infrastructure five years ago but was unsuccessful. And, of course, China regularly claims that its own networks are under attack from the United States and elsewhere.

still developing
X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.