Experts Respond to Defense Department Cyber Strategy

The U.S. Department of Defense recently unveiled declassified portions of its long-awaited strategy for handling cyberattacks, declaring publicly for the first time that it would treat cyberspace -- just as land, sea, and air -- as an "operational domain."

While the department's five-pronged approach to combating cyber threats signaled an important first step in the development of a national cyberwarfare strategy, it also raised many unanswered questions, including policy issues such as how the U.S. could use the Internet to respond to a cyber threat.

Three experts from the Indiana University Center for Applied Cybersecurity Research (CACR) offered brief insight into the plan. Each is available for further comment.

FRED H. CATE, CACR director and Distinguished Professor, IU Maurer School of Law: This is an important first step; it is the first time this has ever been done by the Department of Defense. But it's still a very traditional and not particularly innovative approach. There are critical legal questions that aren't asked or answered. For example: When does a cyber attack constitute an act of war and when is a kinetic response justified? What are the limits of DoD involvement in the proposed partnerships with industry and civilian government agencies? How are civil liberties to be protected? We should care, and the Defense Department should care, about the answers, but at least in the unclassified section of the report, it doesn't ask the questions, most likely because it doesn't want the department's hands tied.

DAVID P. FIDLER, CACR Fellow, James P. Calamaras Professor of Law: The five pillars of the new DoD strategy consolidate existing thinking and practice rather than break new policy ground. The central tension in this strategy is the contrast between the announced scaling up of U.S. military activities in cyberspace with repeated reassurances that these increased and intensified activities do not portend the militarization of cyberspace. The openness and interconnectedness of the Internet suggest that containing rapidly expanding military interest, initiatives, and influence in cyberspace will be a very difficult policy challenge -- especially if cybersecurity failures continue in civilian contexts. Stronger moves by the U.S. military in cyberspace will prompt similar moves by other countries, producing a collective militarization creep in cyberspace that might threaten, ultimately, the Internet freedom agenda the Obama administration is championing.

SCOTT SHACKELFORD, CACR Fellow, professor of business law and ethics, IU Kelley School of Business: The strategy states that sophisticated cyber capabilities reside with nations, allowing the U.S. to respond with military force if threatened. But it fails to note how the U.S. will be able to attribute attacks quickly and accurately, or how the U.S. will respond to state-sponsored cyberattacks launched by non-state actors. What will the burden of proof be? The strategy is interesting, but did little to change the overall dynamic or address fundamental legal and technical questions of securing cyberspace.

The Center for Applied Cybersecurity Research has been designated a National Center of Academic Excellence in both Information Assurance Education and Research. CACR is part of the Pervasive Technology Institute at Indiana University.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3