So, what to do about all this?
The basic task is to dissuade potential foes from thinking that they would gain escalation-dominance by launching, or having the ability to launch, a cyberattack on America’s infrastructure.
A popular notion of how to do this is to threaten “retaliation in kind”—or, taking a phrase from the nuclear-deterrence playbook, “mutual assured destruction.” This threat has its place in cyberwar but also its limits, because the United States is far more dependent on computer networks, in every aspect of its national security and its daily economic life, than China, Iran, or any other prospective foe or rival. Retaliation in kind might not serve as a sufficient deterrent because it would inflict much less damage on them than their first strike would inflict on us.
A better, but much harder, way is to defend the critical infrastructure in the first place. There are limits to this, too. First, we’re in too deep; we can’t untether our economy from the Internet any more than we can detour all road traffic off the interstate. Second, there is no such thing as a perfect defense; if well-funded, well-trained predators want to get in, they will get in. Still, there are ways to wall off or split up the most critical segments of infrastructure—and to monitor further efforts to break in. If they haven’t already, the private companies responsible for this infrastructure should start to take these steps immediately.
That is the point behind President Obama’s recent executive order on cybersecurity. In recent years, Congress has rejected bills requiring Internet service providers to follow government standards on security for various reasons, many of them legitimate. The executive order at least allows government agencies to share information with ISPs, some of it classified, on how to meet these standards themselves. It’s a good first step.
But there’s another way to stave off the danger of cyberwar, and that’s diplomacy.
In his extremely important 2010 book Cyber War, Richard Clarke likened the current era to the decade after the first atomic bombs, when American, then Soviet, scientists built these weapons of enormous destructiveness—but before politicians or strategists devised ways of thinking about them rationally: how to control them, deter their use, or limit their damage if a war couldn’t be deterred.
It’s time to move on to the next era, when this sort of thinking did occur, not just in secretive research tanks but also in open discussions and international negotiations. Clarke, who was chief of counterterrorism and cybersecurity for Presidents Clinton and Bush, spells out ways that concepts from nuclear arms control—inspections and verification, no first use, and ideas from other accords, including the Geneva Conventions—might be applied to cyberweapons.
In any case, it’s sheer silliness, at this point, to keep cyber issues off the table for fear of upsetting the sensitivities of Chinese officials (who deny that they have offensive cyberwarfare programs) and thus possibly triggering a diplomatic crisis. A crisis already looms from all sides of the globe; the United States, after all, has an offensive cyberwarfare program, too. Best to deal with it head-on, and soon.