Andy Kessler is hardly the person I would have thought of when stories of hacking surfaced today in the Wall Street Journal. He is strongly advocating that when attacked, we hack back - retaliate. He pointed out that Cyber Command has done next to nothing to create defenses against these attacks and we should use them to take steps to deter these kinds of attacks.
Yes, I see his point, but we have been dealing with the problem for 30 years so I have heard all the arguments on both sides for at least that long. Cybrwar is not fun; it will not be more rewarding to attack someone who attacks us because the satisfaction of defense is only good for as long at the second strike that takes place. When you start this war, you better be ready. I imagine this is why Cyber command does not attack {and talk about) any of the things the Journal is pointing to.
I was always a big proponent of attacking our enemies when they attack us. I still am.
But these kinds of attacks are kind of like sailing ships through the Straits of Taiwan. They are public displays of a response to actions that are clearly intended to keep the US away from Taiwan. The Chinese have escalated the potential cost of doing this kind of deterrent by reinforcing their little islands and making diplomatic moves like working with embassies around the world to recognize Taiwan as part of China. Both sides are taking public steps that aggravate the situation, thinking their own actions will reduce tension and win over the world public opinion. Not likely.
First, the theft of information by China is largely from its own intelligence services. China denies it does such things, even though they also know they are lying to us. They are covert activities with plausible deniability. A response is usually going to be the same - covert and with deniability for anyone who responds. We have no idea of what may have already been done, or which country did it, and we will likely not know for years. Israel kept a secret of its attack on a nuclear reactor until last year. It was 6 September 2007, when the Israelis bombed the nuclear facility at Al-Kubar in eastern Syria. Everyone knew somebody attacked it, and there was speculation that Israel might have done it, but there was no proof. It didn't even make the evening news when they announced that they did it. Iran must have been keeping an eye on that situation but may not have known for sure. It was a good deterrent and the reason they put their facilities underground.
Second, the business community is often the target - insurance companies, banking institutions, government agencies are the targets. Are we suggesting each one retaliates? There isn't a cry from these institutions to do that because they know that they can't start a war they would lose with a government. Nobody wants to be on that target list and retaliation does that. I have had a few large banks think they could do something, but none of them ever did. A couple of commercial companies wanted to do the same thing, but also never did. They actually had the technical expertise. Only the governments can do it on behalf of them so the business community is isolated from the retaliation.
Third, a government that attacks better be ready for the response. I wonder if China thinks it can defend itself against retaliation? They are grossly overestimating their skills if they do. They have pockets just like every country does, but pockets will not help a country survive for long if this really gets turned up. Only arrogance would allow them to think that they can't be embarrassed.
Militaries are the ones who start this kind of thinking. I have rarely met a military cyber group that thinks it could not damage an adversary and avoid retaliation. They are safe in their assumptions until the second strike.
Diplomacy is probably the only answer, as much as we hate it. We don't trust China and they don't do well at keeping their agreements. This is what brings us to the Journal approach. If we are going to be striking back, we better be ready. Decide for yourself if you think we are.
No comments:
Post a Comment