Homeland Security v. Homeland Defense: The Big Gap World Federation of Scientists 40th Session International Seminars on Planetary Emergencies August 21, 2008 Jody R. Westby, Esq.

ADVERSARIES IN CYBERSPACE ACTORS RESPONDERS Nation States with Info War Capabilities Pvt, Military & Intel, , Homeland Security (HS) Terrorists Pvt, HS, Military & Intel, Law Enforcement Rogue Actors (Organized Crime, Pvt, Law Enf, HS, Intel Economic Espionage, Intelligence) Insiders Pvt, Law Enf, HS Script Kiddies Pvt, Law Enf, HS © Jody R. Westby

NEED FOR RESPONSE COORDINATION At Time of Attack Not Possible to Know Who Attacker Is – Attribution is one of biggest problems Response Baton May Have to Pass From Private Sector to Law Enforcement to Military Requires Swift Coordination, Certainty on Legal Authority for Actions Requires Information Sharing & Public-Private Sector Coordination 85% of U.S. Critical Infrastructure Owned by Private Sector 95% of DoD’s Global Telecom Needs Satisfied by Private Networks © Jody R. Westby

STATE OF CYBER WARFARE U.S. Government Engaged in Cyber Warfare Probably More Than Any Other Nation In 1982, CIA Exploited Software Transferred to Soviet Union That Operated Pumps, Turbines, & Valves of Pipeline. Caused Software to Malfunction and Reset Pump Speeds and Valve Settings. Result was Largest Non-Nuclear Explosion and Fire Ever Seen From Space. 3 Kilotons TNT Equivalent – Hiroshima Was 14-20 Kilotons TNT Operation Desert Storm in 1991: Strategic Air Command Targeted Command, Control, Communications Systems, Electrical Grids, & Key Infrastructure Estonia: Month of Attacks, Shut Down Govt Systems, Banks, Newspapers, Called in NATO, EU, Cyber Experts, Blocked Traffic Georgia: Attacks Since June, Govt Web Sites, DDoS, Russian Business Network & Russian Govt, Blocked .ru traffic 120 Countries With Cyber Warfare Capabilities; Terrorists With High Level of Skills, Rogue Actors (Bot Herders); US has Joint Functional Component Command Network Warfare (JFCCNW) © Jody R. Westby

GEO-CYBER CONSIDERATIONS Cyber Warfare Impacts Geo-Cyber Stability Geo-Cyber – Relationship Between Internet & the Geography, Demography, Economy & Politics of a Nation & its Foreign Policy Geo-Cyber Security – Ability to Protect Infrastructure, Systems & Information of a Nation From Intrusion, Attack, Espionage, Sabotage, & Other Forms of Negative or Criminal Activity That Could Undermine Its National & Economic Security © Jody R. Westby

Is More Than One Network Required? How Is This Negotiated? OPEN QUESTIONS Who on the Public & Private Sector Sides Can Approve Military Use of Network? Is More Than One Network Required? How Is This Negotiated? What Assistance or Permissions Are Needed From Other Countries? Can Governments Take Over Private Sector Network? What About Risk to Network & Private Sector Fiduciary Duty to Shareholders? When Can Governments Intervene On Behalf Of Private Sector in Event of Cyber Attacks? What is Private Sector Role? What Can the Government Ask the Private Sector to Do? Who Is Responsible For Damage to Networks Damaged in an Attack? © Jody R. Westby

LEGAL ISSUES: COMPLEX & LEAST PROGRESS Legal Frameworks (Cybercrime, Criminal Procedure) Information Sharing & Freedom of Information Act (Sunshine Laws) Antitrust Posse Comitatus (Military Cannot Engage in Law Enforcement) Executive Orders, Presidential Memoranda & Directives Jurisdictional Issues (extradition, dual criminality) International Cooperation (search/seizure, investigation, ISPs, 24/7) Council of Europe Convention on Cybercrime UN Charter NATO Treaty INT’L © Jody R. Westby

LEGAL FRAMEWORKS ARE ANTIQUATED: UN CHARTER Art. 2(4): Members refrain from threat or use of force against territorial integrity and political independence Art. 41: Security Council may decide what measures not involving the use of armed force are to be employed Art 42: If Security Council considers actions pursuant to Art 41 inadequate, it may take action by air, sea, or land forces Art 51: Nothing impairs inherent right to self-defense if armed attack occurs Art 99: Secretary-General may bring to the attention of the Security Council any matter which in his opinion may threaten the maintenance of peace and security © Jody R. Westby

LEGAL FRAMEWORKS ARE ANTIQUATED: NATO TREATY Art. 3: Parties separately & jointly maintain and develop individual and collective capacity to resist armed attack Art. 4: Parties will consult when territorial integrity, political independence, or security of any of the Parties is threatened Art 5: Parties agree armed attack against one or more of them shall be considered attack against all Art 6(1): Armed attack means On territory of any of Parties in Europe or North America On territories or on islands of any of Parties On the forces, vessels, or aircraft of any of the Parties Art 12: After 10 years in force, Parties shall, if any of them requests, consult together for the purposes of reviewing the Treaty, having regard for the factors then affecting peace and security © Jody R. Westby

Military neither owns the weapons nor knows how to use them SUMMARY Cyber warfare is increasingly engaged to exploit vulnerabilities and dependencies on ICTs Military neither owns the weapons nor knows how to use them Huge gaps in passing the response baton Gaps in response coordination, legal frameworks, policies Legal & technical issues present greatest barrier to effective response Collaboration between public and private sectors is critical Multinational cooperation and assistance mechanisms need to be defined © Jody R. Westby

THANK YOU! Jody R. Westby 202.255.2700 westby@globalcyberrisk.com