U.S. Cyber Strategy Deterrence and Strategic Response

A great deal of thought has been applied to focus government and industrial resources on the important problem of preventing cyber attacks against high profile infrastructure and economic targets. The cyber attack prevention problem is actually one of risk management and mitigation - it aims to reduce the number, severity, and impact of attacks rather than dreaming of preventing all cyber attacks. As prevention efforts continue, cyber attacks are ongoing and unlikely to completely stop. The pragmatic problem shifts toward appropriate responses. contend that not enough attention has been brought to study how the nation should respond to cyber attacks. Clearly such a policy rests heavily on knowing the source of an attack, the nature of the attacked infrastructure, as well as the destructive effect of the attack. Policy makers must also consider how the international community would view such a policy in light of existing international criminal law and the laws of armed conflict. Attack attribution is problematic, but can be helped with international cooperation. Thus, the key recommendation is that international norms for cyber crime and war fighting in the cyber domain be established through broadening of existing laws and conventions.