Bytes, Bombs, and Spies: The Strategic Dimensions of Offensive Cyber Operations

440 Pages·2019·15.26 MB·English

by  Herbert Lin

BYTES
L
Offensive cyber operations have become increasingly important elements
I
N
of U.S. national security policy. From the deployment of Stuxnet to

|
disrupt Iranian centrifuges to the possible use of cyber methods against Z
E
North Korean ballistic missile launches, the prominence of offensive
G
cyber capabilities as instruments of national power continues to grow. Yet A
R
conceptual thinking lags behind the technical development of these new T
weapons. How might offensive cyber operations be used in coercion or
conflict? What strategic considerations should guide their development and
use? What intelligence capabilities are required for cyber weapons to be
B
BOMBS
effective? How do escalation dynamics and deterrence work in cyberspace?
Y
What role does the private sector play?
T
In this volume, edited by Herbert Lin and Amy Zegart—co-directors of the
E
Stanford Cyber Policy Program—leading scholars and practitioners explore S
these and other vital questions about the strategic uses of offensive cyber ,

operations. The contributions to this groundbreaking volume address the key B
technical, political, psychological, and legal dimensions of the fast-changing O
strategic landscape. M
B
S D SPIES
HERBERT LIN is senior research scholar for cyber policy and security at the
,
Center for International Security and Cooperation and Hank J. Holland
A
Fellow in Cyber Policy and Security at the Hoover Institution, both N N
D
at Stanford University. He is chief scientist emeritus for the Computer

Science and Telecommunications Board at the National Academies. He S
served on President Barack Obama’s Commission on Enhancing National P A
Cybersecurity. I
E
S
AMY ZEGART is the Davies Family Senior Fellow at the Hoover Institution,
senior fellow at the Center for International Security and Cooperation,
and professor of political science, by courtesy, at Stanford University. Her
The Strategic Dimensions
previous books include Political Risk: How Businesses and Organizations
Can Anticipate Global Insecurity, with Condoleezza Rice; and Spying Blind:
The CIA, the FBI, and the Origins of 9/11. of Offensive Cyber Operations
BROOKINGS INSTITUTION PRESS
Washington, D.C.
www.brookings.edu/press
Edited by Herbert Lin and Amy Zegart
Cover design by Cameron Zotter
Lin-Zegart_Bytes, Bombs, and Spies_Cover.indd 1 11/28/18 10:42 AM
Bytes, Bombs, and Spies
00-3547-2-fm.indd 1 11/08/18 9:30 pm
00-3547-2-fm.indd 2 11/08/18 9:30 pm
Bytes,
Bombs,
and
Spies
The Strategic Dimensions of
Offensive Cyber Operations
Edited by
Herbert Lin and Amy Zegart
BROOKINGS INSTITUTION PRESS
Washington, D.C.
00-3547-2-fm.indd 3 11/08/18 9:30 pm
Copyright © 2018
THE BROOKINGS INSTITUTION
1775 Mas sa chu setts Ave nue, N.W., Washington, D.C. 20036
www . brookings . edu
All rights reserved. No part of this publication may be reproduced or
transmitted in any form or by any means without permission in writ-
ing from the Brookings Institution Press.
The Brookings Institution is a private nonprofit organ ization devoted
to research, education, and publication on impor tant issues of domes-
tic and foreign policy. Its principal purpose is to bring the highest
quality in de pen dent research and analy sis to bear on current and
emerging policy prob lems. Interpretations or conclusions in Brook-
ings publications should be understood to be solely those of the
authors.
Library of Congress Cataloging- in- Publication data are available.
ISBN 978-0-8157- 3547-2 (cloth. : alk. paper)
ISBN 978-0-8157- 3548-9 (ebook)
9 8 7 6 5 4 3 2 1
Typeset in Adobe Caslon Pro
Composition by Westchester Publishing Ser vices
00-3547-2-fm.indd 4 11/08/18 9:30 pm
To the men and w omen of U.S. Cyber Command
00-3547-2-fm.indd 5 11/08/18 9:30 pm
00-3547-2-fm.indd 6 11/08/18 9:30 pm
Contents
List of Figures and Tables
ix
Acknowl edgments
xi
1 Introduction
1
herbert lin and amy zegart
2 Illuminating a New Domain: The Role and Nature of
19
Military Intelligence, Surveillance, and Reconnaissance
in Cyberspace
chris inglis
3 How Effects, Saliencies, and Norms Should Influence
45
U.S. Cyberwar Doctrine
henry farrell and charles l. glaser
4 A Strategic Assessment of the U.S. Cyber Command Vision
81
max w. e. smeets and herbert lin
5 A Cyber SIOP? Operational Considerations for Strategic
105
Offensive Cyber Planning
austin long
6 Second Acts in Cyberspace
133
martin c. libicki
00-3547-2-fm.indd 7 11/08/18 9:30 pm
viii Contents
7 Hacking a Nation’s Missile Development Program
151
herbert lin
8 The Cartwright Conjecture: The Deterrent Value and
173
Escalatory Risk of Fearsome Cyber Capabilities
jason healey
9 The Cyber Commitment Prob lem and the Destabilization
195
of Nuclear Deterrence
erik gartzke and jon r. lindsay
10 Cyber Terrorism: Its Effects on Psychological Well- Being,
235
Public Confidence, and Po liti cal Attitudes
michael l. gross, daphna canetti, and dana r. vashdi
11 Limiting the Undesired Impact of Cyber Weapons:
265
Technical Requirements and Policy Implications
steven m. bellovin, susan landau, and herbert lin
12 Rules of Engagement for Cyberspace Operations: A View
289
from the United States
c. robert kehler, herbert lin, and michael sulmeyer
13 U.S. Offensive Cyber Operations in a China- U.S. Military
319
Confrontation
adam segal
14 Disintermediation, Counterinsurgency, and Cyber Defense
343
david aucsmith
15 Private Sector Cyber Weapons: An Adequate Response to
357
the Sovereignty Gap?
lucas kello
16 Cyberwar Inc.: Examining the Role of Companies in
379
Offensive Cyber Operations
irv lachow and taylor grossman
Index
401
Contributors
417
00-3547-2-fm.indd 8 11/08/18 9:30 pm
Figures and T ables
Figure 4-1
Main Observation Under lying U.S. Cyber 89
Command’s 2018 Vision
Figure 4-2
Potential Trade- Offs in Objectives for U.S. 90
Cyber Command
Figure 4-3
Win/Win Scenarios for U.S. Cyber Command 92
Figure 4-4
Escalation (Win/Lose and Lose/Lose) 94
Scenarios for U.S. Cyber Command
Figure 11-1
An Attack on a Target “I,” Passing through 277
“J” and “K”
Figure 11-2
An Attack on a Target “I,” Passing through 278
“J” and “K,” but Where “A” and “B” Rely on
“I” for Their Own Functions
Table 4-1
U.S. Cyber Command in Numbers 84
Table 4-2
Comparison of Vision I and Vision II of U.S. 86
Cyber Command
Table 9-1
Cyber Operations and Crisis Stability 222
ix
00-3547-2-fm.indd 9 11/08/18 9:30 pm