The Pentagon is expected to issue its cyber warfare strategy in the next few weeks, providing more detail about possible U.S. responses to attacks on key computer systems.
Two weeks ago, the White House released its International Strategy for Cyberspace, which, among other things, declares that the United States will use “all necessary means” to defend its vital cyber assets. The strategy says the United States “will respond to hostile acts in cyberspace as [it] would to any other threat,” including specifically reserving the right to respond with military action.
Pentagon Spokesman Colonel David Lapan repeated that view on Tuesday. “A response to a cyber incident or attack on the U.S. would not necessarily be a cyber response. So, all appropriate options would be on the table if we were attacked via cyber," he said.
The White House strategy was not a surprise, culminating a long effort to officially identify computer networks as a vital national interest, which, if attacked electronically, could result in a retaliatory strike.
Now the Pentagon is working on a follow-up document to lay out its role in implementing the White House strategy. Colonel Lapan declined to provide details Tuesday, but said the document will likely not provide specific consequences for specific types of attacks. “If we are attacked, we reserve the right to do any number of things in response, just like we do now with kinetic attacks. Military option is always a resort. There are other things we could do," he said. "But it won’t necessarily lay out, ‘if this happens, then this will happen.' ”
Lapan says a more general statement asserting the right to retaliate by a variety of means is likely a better deterrent to any potential attackers.
Former senior U.S. defense official Daniel Gallington, now at the Potomac Institute, says Pentagon strategy documents are usually more about capabilities than specific actions. “The Pentagon doesn’t decide when we go to war. And the Pentagon doesn’t decide these policy questions. The Pentagon is the doer. They are the ones who take action when they are directed by competent political authority and the command structure. The Pentagon is in the training and equipping business. And what they do is, they have to anticipate the kind of capabilities that they’re going to need to have in the future for future conflicts," he said.
Documents like the Pentagon cyber strategy serve to provide direction to the military services, combat commands and defense agencies so they can develop specific plans, and seek the funding and authorization to develop specific capabilities.
Gallington says he hopes the document includes a variety of capabilities designed to prepare the U.S. military to respond to serious and minor cyber attacks, and everything in-between, using both military and electronic means. That would provide a full range of options for a president faced with a decision about how to respond to a cyber attack.
