[Commentary] The Department of Defense's Strategy for Operating in Cyberspace is predicated upon five strategic initiatives. All five planks are logical and laudable in principle. But none of them are new or novel. To the contrary, many of these elements have been discussed as desiderata for years. That the strategic conversation and planning environment should still be so stunted is disappointing if not also disturbing. The omission of cyber weapons from the strategy, in terms of a treatment of their development and use, is the unacknowledged gorilla in the room.
One powerful dimension of the nation's deterrent may be the ability to quickly reconstitute damaged systems, regardless of the perpetrator. For now, though, strategic ambiguity remains: the United States will respond to grave attack (cyberspace being a "domain" akin to the others), but the instruments it would invoke are unspecified. Ambiguity may in fact be advantageous, permitting consideration of a range of response options and tools -- as long as there are markers in the sand concerning perpetrators, intentions and circumstances. Moving forward, other important open questions include the place and parameters, if any, of information operations in the form of "digital disinformation" that could be invoked to influence outcomes and behavior. While bits and bytes may never completely replace bullets and bombs, cyber tools can serve either as a force multiplier or as a separate channel of attack. Until policy and doctrine here catch up with technology and people, our cyber posture will remain more reactive and ad hoc, and therefore potentially less effective, than it should or could be. Some have even argued that it is too late for redress, and that we should instead start anew by building "a more hardened enterprise structure for some activities." Regardless of one's view on that matter, it highlights the overlap between critical services and national defense. As the strategy makes clear, Defense will help protect privately held critical infrastructure that supports military functions.
[Cilluffo is director of The George Washington University Homeland Security Policy Institute; Cardash is associate director of HSPI]