Danzig: Focus On Cyber ‘Existential’ Threats Undermines U.S. Preparedness

August 8, 2014 · 

Danzig: Focus on Cyber ‘Existential’ Threats Undermines U.S. Preparedness

Washington’s recurring tendency to label cyber attacks an “existential” threat to the United States exaggerates the danger and fails to focus attention on managing significant cyber risks to critical infrastructure and U.S. national security, according to Richard Danzig, a key administration adviser and author of a recent cyber security study.

The State Department’s International Security Advisory Board used the term last month in its cyber-stability report: “Threats are particularly concerning to countries with a high degree of dependency on cyber infrastructure, including the United States, where the risks are massive and possibly existential.” Leaders from Capitol Hill, the Pentagon and other agencies have also used it in recent years.

“I don’t think that’s the right focus of debate,” Danzig told Inside Cyber security in an interview when asked whether cyber threats are existential and whether such a label matters. “It gets into a lot of semantic questions – what do we mean about existential and the like?”

Cyber attacks are unlikely to imperil the existence of the United States, he argued. “Would the U.S. still exist after a cyber attack, even if it were masterfully conducted and massively executed? I think the answer is yes, the U.S. would still exist,” he said. “How grave would such a thing be? Not only hard to tell now but whatever our answer was today, it would be a different answer years from now.”

The assertions by Danzig, who serves on the President’s Intelligence Advisory Board and was Navy secretary in the Clinton administration, come as Obama administration officials and lawmakers are grappling with an appropriate U.S. response to an evolving cyber threat.

White House Cyber security Coordinator Michael Daniel acknowledged in a March speech that cyber attacks do not threaten the country’s existence, at least for now. “We’re not quite in a world where attacks on our critical infrastructure can wipe us out imminently, but we are headed in that direction,” he said.

Other officials, by contrast, have explicitly invoked the “E” word. Sen. John McCain (R-AZ) said in 2012 that a large-scale cyber attack on the United States is inevitable and represents an existential threat.

“Despite all of the advantages of computers and the Internet, if we fail to act, the cyber threat can be an existential threat – meaning it can challenge our country’s very existence or significantly alter our nation’s potential,” then-FBI official Steven Chabinsky, now an official with CrowdStrike, said in March 2010.

In 2011, Adm. Michael Mullen, then chairman of the Joint Chiefs of Staff, described “cyber” as the biggest existential threat facing the United States, the other being Russia’s nuclear weapons.

But Gen. Martin Dempsey, Mullen’s successor, said that the United States faces “no obvious existential threat, now or in the foreseeable future” – a point he reiterated last month at a conference in Hawaii. Other cyber security analysts, including Jim Lewis of the Center for Strategic and International Studies and Jason Healey of the Atlantic Council, have also said that cyber attacks do not pose an existential threat to the country.

For Danzig, the prime concern is that other countries with high-end cyber weapons might seek to deter the United States from conducting national security policy. His recently released paper, “Living With Cyber Insecurity: Reducing the National Security Risks of America’s Cyber Dependencies,” says the White House should vow to prevent cyber risks from undermining the U.S. government’s decisions and actions on fundamental national security policy by adopting a new standard for vital cyber security.

“The point I try and make is that the kinds of people who might execute an attack like that are not likely to be vandals simply intent on damaging the U.S.,” he said. “They are likely to have a particular end in mind and that end is likely to be to keep us from doing certain things in the national security realm, like deploying troops to a place or defending an ally or protecting an interest of ours. And they could do that either by deterring us because the damage would seem so unacceptable to us, or by disabling our capabilities. And my point is that’s really the standard: can you prevent some other power from being in a position where they could deter or disable us?”

Adopting such a standard does not involve such an “ambiguous or inflammatory phrase as the word ‘existential,'” Danzig said. “I’m trying to move the debate along and to focus it better.” He said he thinks his report is not a panacea but rather a step forward. – Christopher J. Castelli ( ccastelli@iwpnews.com