Balancing Our Civil Liberties with Our National Security Interests in Cyberspace (1999)

America enjoys a juridical separation between our law enforcement and our national security establishments that has historically protected our civil liberties while giving us the ability to effectively respond to what we perceive to be national security threats to the United States.1 This separation is a balancing among our constitutional safeguards, our civil liberties, and our national security interests. However, this juridical separation no longer serves us well in the face of a cyber-attack.2 In truth, this separation is wholly dependent upon an identification of who the alleged criminal is.3 In the context of a cyber-attack, current technology does not allow us to determine who the criminal hacker is before we investigate the problem or determine how we will investigate the threat.4 And therein lies the problem we cannot reliably know in each instance who the intruder is that has broken into our national defense computer systems until some point in time after an investigation has begun. Not knowing the identity of the attacker prevents us from knowing who should begin an investigation and from knowing how much of our national assets we should bring to bear on that particular threat. In fact, at the moment, technology is such that we may never be able to determine the identity of any particular computer hacker. Accordingly, our current default response to all computer intrusions is a law enforcement response.5 Given that background, I want to narrow the focus of my presentation a little more. How do we balance our civil liberties with our legitimate national security interest in protecting the United States from a cyber-attack against our national defense and commercial information infrastructures? As I just outlined, our default response any time there is an intrusion into a computer system is a law enforcement response.6 It has not mattered up to this point whether the hacker's target was a government information system or a local Wal-Mart computer. If the target is Wal-Mart or a mom-and-pop grocery store that is not critical to our national security, then a law enforcement response is not only appropriate, but perhaps, despite the technological challenges, an effective response. Similarly, if there is a thrill-seeker who does not intend to do any damage to our national security but who simply seeks the challenge of breaking into a government system, then the law enforcement approach may be an appropriate response-but it still cannot prevent the damage that could be done while we are figuring out that the intruder is not a hostile threat. Consequently, when sensitive command-and-control systems-- such as our early warning system, the computer systems that we rely upon for the safety and the security of our nuclear stockpile, or even the New York Stock Exchange-are jeopardized, then a default law enforcement response is too slow and too late.7 Such a legal construct will not allow us to aggressively defend the United States with all the assets that are available to us. The problem is that technology simply does not allow us to determine ahead of time who the intruder is so that we can determine exactly how our legal system will allow us to respond to that threat.8 Technology is such that it is a very dangerous proposition for us to assume up-front that an attack is merely a thrill-seeker or a criminal enterprise, because the threat could be a terrorist or an enemy state. The destruction, the downloading, the spoofing, the spamming, the manipulation of computer systems and data, the thefts-all the damage that could be done to us-is only one key-stroke away once someone penetrates a computer system. In February 1998, when two California teenagers and their Israeli mentor broke into sensitive Department of Defense (DoD) telecommunication systems, the DoD contacted the Federal Bureau of Investigation, and a law enforcement investigation ensued.9 It was, I assure you, a very intense investigation, and the FBI, the Department of Justice, and the interagency did a superb job within their limitations, but the teenage thrill-seekers still eluded the best law enforcement could offer for nearly a month. …