To defeat adversaries in cyberspace, America must go on offense

John Yoo and Ivana Stradner

Source Link

Following our humiliating Afghanistan retreat, America’s rivals will amplify their assaults on our credibility and defenses. China could attack Taiwan; Russia might further encroach against Ukraine; Iran or North Korea may seek more extortion over their nuclear programs. It’s also possible that adversaries will launch their first jabs where America is most vulnerable: cyberspace.

While President Joe Biden has warned the Kremlin that Washington will “respond with cyber” if Moscow’s cyberattacks affect critical infrastructure, he also wants to cooperate with the Russians. This contradictory approach fails to notice that Beijing and Moscow have exploited the international order by coopting key institutions in their low-intensity cyberwar against the United States.

To make good on his promise to curb cyberattacks, Biden should adopt a strategy of deterrence rather than of international cooperation. Today, the most effective path forward for the United States is retaliation. If Biden takes such a step, it would be a striking, and welcome, departure from the soft policies he has adopted.

Cybercrime costs the United States billions of dollars, generates funds for criminals and derails critical infrastructure. To protect the nation, the administration must strengthen, and even use, its offensive cyber capabilities. Biden shouldn’t shy away from deploying offensive and preemptive cyberattacks. Those actions don’t violate international law, and America’s adversaries have coopted the international institutions that could hypothetically resolve such conflicts anyway.

While some in the defense community want to improve network security instead, defensive capabilities are expensive and imperfect. Offense, by contrast, comes cheaply and easily.

These basic facts mean that the most effective means of security lie in deterrence based on the threat of reciprocal attack. During the Cold War, when nuclear weapons were inexpensive, American and Soviet strategies of mutually assured destruction produced international stability. Similarly, America can deter future cyberattacks by demonstrating its capability and resolve to respond now.

The Biden administration can’t rely on multilateral gabfests to control cyber conflict. International law remains vague on cyberwarfare. Yes, diplomats and scholars have tried to adapt conventional laws of war to cyber conflict in a document known as the Tallinn Manual. But while these rules may dominate the discussion in academe, they don’t bind states — certainly not Russia and China.

And while Washington has signed the Budapest Convention on Cybercrime, an international agreement governing hacking and other cybercrimes, Russia, China, North Korea and Iran have refused to do so. NATO, for its part, seems content to simply declare that international law should apply in cyberspace without taking public measures to respond to foreign hacking.

Meanwhile, Russia and China are developing their own international legal schemes to regulate cyberspace. In recent years, Moscow and Beijing signed bilateral agreements on information-security cooperation, attempted to take over the United Nation’s International Telecommunications Union and extended a cooperation treaty with the goal of destroying the global free flow of online information.

With Chinese support, the Kremlin has also manipulated the United Nations so that Russia, a sponsor of cybercrimes, is leading efforts to draft a new international cyber treaty. Any cyber treaty developed by Moscow and Beijing would allow their hacker proxies to continue operating while granting political cover to authoritarians who repress online free speech. It’s as if Congress invited the Mafia to draft laws against racketeering and extortion. Inexplicably, the Biden administration and the US Office of the Coordinator for Cyber Issues still support some UN control over cyber rules.

As rogues and rivals challenge the US-led order, Washington shouldn’t be fooled into thinking that Russian and Chinese support for international institutions signals genuine cooperation. Both countries will continue to pursue their national interests through international law and institutions in the short term, even as they seek to destroy the broader system that supports those rules in the long term.

America can prevail in this struggle but only from a position of strength — not naïveté. American cyber capabilities are still the most powerful in the world. To maintain its advantage, the United States must develop and use its offensive cyberweapons. Most nations will understand that Washington is defending itself by launching preemptive cyberattacks.

If Moscow and Beijing dislike a dose of their own medicine, they can always complain to the UN mandarins or, better yet, cease their cyber hostilities. While they plead their case, they can also answer for their cybercrimes.