US Cyber Command to Take Offensive

In testimony before the Senate Armed Services Committee this past week, Gen. Keith Alexander, director of the National Security Agency, said 13 cyber warfare “teams” would be ready by 2015.

According to a prepared statement, the teams would be “analogous to battalions in the Army and Marine Corps—or squadrons in the Navy and Air Force.” Furthermore, “they will soon be capable of operating on their own, with a range of operational and intelligence skill sets, as well as a mix of military and civilian personnel.”

“Let me be clear, this defend-the-nation team is not a defensive team; this is an offensive team that the Department of Defense would use to defend the nation if it were attacked in cyberspace,” he said during the testimony.

Citing “destructive” cyber attacks on the Saudi Aramco oil company last summer, during which 30,000 company computers were damaged, Alexander said experts believe the threat of attack will grow, and “there’s a lot that we need to do to prepare for this.”

There have already been reports of alleged U.S. offensive capability in the cyber domain. It is widely believed the U.S. and Israel were behind the so-called Stuxnet worm that damaged key components of Iran’s nuclear facilities in 2010.

The U.S. also was accused of hacking into the Elysée Palace computers in May of last year just before François Hollande succeeded Nicolas Sarkozy as president of France. The U.S. denied the charges.

In 2011, the White House issued document titled the “International Strategy for Cyberspace,” which said, “when warranted, the United States will respond to hostile acts in cyberspace as we would to any other threat to our country.”

Matthew Aid, an intelligence historian, had some questions about the revelation about offensive capabilities.

“I did not understand why so many teams need to be created to give [U.S. Cyber Command – CYBERCOM] an attack capability, and why this capability did not exist before now,” he wrote in an e-mail. “Who developed and employed Stuxnet then, if CYBERCOM is still building this capability?

“What the General also did not say is that this would be, according to the lawyers, an act of war requiring presidential approval and congressional notification,” Aid said. “What form of cyber attack on one or more critical U.S. systems from abroad would cross this imaginary retaliatory threshold? This is all Brave New World territory. Nothing like this has ever happened, so there are no precedents or standard operating procedures in place to guide us.”

Christopher Burgess, principal analyst at Prevendra LLC, and co-author ofSecrets Stolen, Fortunes Lost, Preventing Economic Espionage and Intellectual Property Theft in the 21st Century, also had questions.

“What is key, will be how they engage, be it covert or overt, and how the U.S. will signal, diplomatically, where the red lines are for countries who also have an offensive cyber capability,” he wrote in an e-mail. “Then we see if the U.S. has a backbone of steel or the equivalent of a Gummi-worm?”