1. Homeland Security v. Homeland Defense: The Big Gap
World Federation of Scientists
40th Session
International Seminars on Planetary Emergencies
August 21, 2008
Jody R. Westby, Esq.

2. ADVERSARIES IN CYBERSPACE
ACTORS RESPONDERS
Nation States with Info War Capabilities Pvt, Military & Intel, , Homeland Security (HS)
Terrorists Pvt, HS, Military & Intel,
Law Enforcement
Rogue Actors (Organized Crime, Pvt, Law Enf, HS, Intel
Economic Espionage, Intelligence)
Insiders Pvt, Law Enf, HS
Script Kiddies Pvt, Law Enf, HS
© Jody R. Westby

3. NEED FOR RESPONSE COORDINATION
At Time of Attack Not Possible to Know Who Attacker Is – Attribution is one of biggest problems
Response Baton May Have to Pass From Private Sector to Law Enforcement to Military
Requires Swift Coordination, Certainty on Legal Authority for Actions
Requires Information Sharing & Public-Private Sector Coordination
85% of U.S. Critical Infrastructure Owned by Private Sector
95% of DoD’s Global Telecom Needs Satisfied by Private Networks
© Jody R. Westby

4. STATE OF CYBER WARFARE
U.S. Government Engaged in Cyber Warfare Probably More Than Any Other Nation
In 1982, CIA Exploited Software Transferred to Soviet Union That Operated Pumps, Turbines, & Valves of Pipeline. Caused Software to Malfunction and Reset Pump Speeds and Valve Settings. Result was Largest Non-Nuclear Explosion and Fire Ever Seen From Space. 3 Kilotons TNT Equivalent – Hiroshima Was Kilotons TNT
Operation Desert Storm in 1991: Strategic Air Command Targeted Command, Control, Communications Systems, Electrical Grids, & Key Infrastructure
Estonia: Month of Attacks, Shut Down Govt Systems, Banks, Newspapers, Called in NATO, EU, Cyber Experts, Blocked Traffic
Georgia: Attacks Since June, Govt Web Sites, DDoS, Russian Business Network & Russian Govt, Blocked .ru traffic
120 Countries With Cyber Warfare Capabilities; Terrorists With High Level of Skills, Rogue Actors (Bot Herders); US has Joint Functional Component Command Network Warfare (JFCCNW)
© Jody R. Westby

5. GEO-CYBER CONSIDERATIONS
Cyber Warfare Impacts Geo-Cyber Stability
Geo-Cyber –
Relationship Between Internet & the Geography, Demography,
Economy & Politics of a Nation & its Foreign Policy
Geo-Cyber Security –
Ability to Protect Infrastructure, Systems & Information of a Nation From
Intrusion, Attack, Espionage, Sabotage, & Other Forms of Negative or
Criminal Activity That Could Undermine Its National & Economic Security
© Jody R. Westby

6. Is More Than One Network Required? How Is This Negotiated?
OPEN QUESTIONS
Who on the Public & Private Sector Sides Can Approve Military Use of
Network?
Is More Than One Network Required? How Is This Negotiated?
What Assistance or Permissions Are Needed From Other Countries?
Can Governments Take Over Private Sector Network?
What About Risk to Network & Private Sector Fiduciary Duty to Shareholders?
When Can Governments Intervene On Behalf Of Private Sector in
Event of Cyber Attacks?
What is Private Sector Role? What Can the Government Ask the
Private Sector to Do?
Who Is Responsible For Damage to Networks Damaged in an Attack?
© Jody R. Westby

7. LEGAL ISSUES: COMPLEX & LEAST PROGRESS
Legal Frameworks (Cybercrime, Criminal Procedure)
Information Sharing & Freedom of Information Act (Sunshine Laws)
Antitrust
Posse Comitatus (Military Cannot Engage in Law Enforcement)
Executive Orders, Presidential Memoranda & Directives
Jurisdictional Issues (extradition, dual criminality)
International Cooperation (search/seizure, investigation, ISPs, 24/7)
Council of Europe Convention on Cybercrime
UN Charter
NATO Treaty
INT’L
© Jody R. Westby

8. LEGAL FRAMEWORKS ARE ANTIQUATED: UN CHARTER
Art. 2(4): Members refrain from threat or use of force against territorial integrity and political independence
Art. 41: Security Council may decide what measures not involving the use of armed force are to be employed
Art 42: If Security Council considers actions pursuant to Art 41 inadequate, it may take action by air, sea, or land forces
Art 51: Nothing impairs inherent right to self-defense if armed attack occurs
Art 99: Secretary-General may bring to the attention of the Security Council any matter which in his opinion may threaten the maintenance of peace and security
© Jody R. Westby

9. LEGAL FRAMEWORKS ARE ANTIQUATED: NATO TREATY
Art. 3: Parties separately & jointly maintain and develop individual and collective capacity to resist armed attack
Art. 4: Parties will consult when territorial integrity, political independence, or security of any of the Parties is threatened
Art 5: Parties agree armed attack against one or more of them shall be considered attack against all
Art 6(1): Armed attack means
On territory of any of Parties in Europe or North America
On territories or on islands of any of Parties
On the forces, vessels, or aircraft of any of the Parties
Art 12: After 10 years in force, Parties shall, if any of them requests, consult together for the purposes of reviewing the Treaty, having regard for the factors then affecting peace and security
© Jody R. Westby

10. Military neither owns the weapons nor knows how to use them
SUMMARY
Cyber warfare is increasingly engaged to exploit vulnerabilities and dependencies on ICTs
Military neither owns the weapons nor knows how to use them
Huge gaps in passing the response baton
Gaps in response coordination, legal frameworks, policies
Legal & technical issues present greatest barrier to effective response
Collaboration between public and private sectors is critical
Multinational cooperation and assistance mechanisms need to be defined
© Jody R. Westby

11. THANK YOU!
Jody R. Westby