Information Operations, Cyberwarfare, and Cybersecurity: Capabilities and Related Policy Issues
Released: 2009-03-17T00:00:00

Introduction

Background

Control of information has always been part of military operations, and the U.S. Strategic Command views information operations as a core military competency, with new emphasis on (1) use of electromagnetic energy, (2) cyber operations, and (3) use of psychological operations to manipulate an adversary's perceptions. Department of Defense (DOD) officials now consider cyberspace to be a domain for warfare, similar to air, space, land, and sea. A recent memo issued by the Secretary of Defense defines cyberspace as: "a global domain within the information environment consisting of the interdependent network of information technology infrastructures, including the internet, telecommunications networks, computer systems, and embedded processors and controllers."

This definition is consistent with the one presented in the 2008 National Military Strategy for Cyberspace Operations (NMS-CO), which is the overall guidance for all the services. A September 29, 2008, memo signed by the Deputy Secretary of Defense defines cyberspace operations as: "The employment of cyber capabilities where the primary purpose is to achieve military objectives or effects in or through cyberspace. Such operations include computer network operations and activities to operate and defend the Global Information Grid."

Cyberspace operations are a component of Information Operations (IO), which also includes Electronic Warfare (EW). Each service has organizations with IO and EW responsibilities: (1) the Naval Network Warfare Command (NETWARCOM) is the Navy's central operational authority for space, information technology requirements, network and information operations in support of naval forces afloat and ashore; (2) the Army Reserve Information Operations Command has responsibility for conducting information operations, the U.S. Army IO Proponent is responsible for developing requirements for IO doctrine and training, and the Army Intelligence and Electronic Warfare Directorate provides testing services for Electronic Warfare; and finally, (3) the Air Force has created what was to have been a major Cyber Command, but will now be a Numbered Air Force (NAF), the 24 th Air Force to the Air Force Space Command, with responsibility for its portion of cyberwarfare, electronic warfare, and protection of U.S. critical infrastructure networks that support telecommunications systems, utilities, and transportation.

The DOD views information itself as both a weapon and a target in warfare. In particular, Psychological Operations (PSYOP) provides DOD with the ability to rapidly disseminate persuasive information to directly influence the decision making of diverse audiences, and is seen as a means for deterring aggression, and important for undermining the leadership and popular support for terrorist organizations.

However, a 2006 report by the RAND Corporation describes how IO can also affect audiences outside of the intended target, stating,

... in contingencies involving an opponent, information operations planning and execution should include noncombatant considerations that may have nothing to do with affecting the enemy's activities or defending friendly force capabilities. In today's conflict environment the impact of information operations is seldom limited to two opposing sides. Second and higher-order effects will most likely influence all parties in opposition, impact various and varied noncombatant groups, and be interpreted in different ways by members of the media and audiences worldwide.

Thus, new technologies for military IO also create new national security policy issues, including (1) consideration of psychological operations used to affect friendly nations or domestic audiences; and (2) possible accusations against the U.S. of war crimes if offensive military computer operations or electronic warfare tools severely disrupt critical civilian computer systems, or the systems of non-combatant nations.

Because of the new communications technologies and the growth of the Internet, EW and IO have taken on new importance. Insurgents use cell phones, garage door openers, and other remotely controlled electronic devices to detonate roadside bombs, and afterwards transmit video images of successful attacks against U.S. troops for broadcast on the local news or the Internet to influence public opinion about the future outcome of the war. In some cases, populations may have these video broadcasts or local TV news stories in their native language as their only source of information. DOD is seeking methods to counter these actions where violence may be seen as secondary to the use and manipulation of information.

This report describes current adversary threats in the information environment and DOD capabilities for conducting military information operations, gives the current state of federal cybersecurity efforts, and provides an overview of related policy issues.

Information Operations by Adversaries

The electromagnetic spectrum is the arena in which information operations take place. Aspects of the electromagnetic spectrum can be used by adversaries to conduct kinetic attacts, disrupt access, influence targets, and steal data. A review of the types of activity currently being conducted by adversaries illustrates the overlap between the various pillars of information operations. The following are examples of current threats to the United States.

Electronic Warfare

The US military's dominance of the electromagnetic spectrum is being challenged. Terrorist groups use wireless electronics to detonate roadside bombs (Improvised Explosive Devices). They also use the Internet to transmit financial transactions, and use free Global Positioning System (GPS) signals and commercial satellite video and images to direct their ground attacks against U.S. and coalition troops. In addition, peer competitors are focusing on electronic warfare as a crucial element of their military operations by attempting to deny US forces' access to the spectrum, which enables such equipment as radars, communication links, computer networks, and sensors to work.

Psychological Operations

In what some have termed the "Battle of Ideas," electronic media plays an important role in influencing populations. Reportedly, only a small portion of the Iraqi populace watch and listen to the current government run television and radio news broadcasts, with the majority preferring instead to support the foreign satellite news stations such as Al-Jazeera and Al-Arabiya. Observers say that most Arabs believe that U.S. sponsored news broadcasts are managed too closely by the coalition powers and do not objectively present the news. When the Iraqi Governing Council (IGC) prohibited Al-Jazeera and Al-Arabiya from covering all IGC events during a short period in early 2004, this action reportedly gave many Iraqi people the impression that the Coalition Provisional Authority (CPA) was manipulating their information.

Some observers have also stated that terrorist groups, through use of the Internet, are now challenging the monopoly over mass communications that both state-owned and commercial media have long exercised. A strategy of the terrorists is to propagate their messages quickly and repeat them until they have saturated cyberspace. Internet messages by terrorist groups have become increasingly sophisticated through use of a cadre of Internet specialists who operate computer servers worldwide. Other observers have also stated that al-Qaeda has relied on a Global Islamic Media Unit to assist with its public outreach efforts.

Computer Network Operations

As Vice Chairman of the Joint Chiefs of Staff James Cartwright told Congress in March 2007 "America is under widespread attack in cyberspace." The low cost of entry (for example, a laptop connected to the Internet), and the ability to operate anonymously, are factors that makes information operations in cyberspace attractive to adversaries who know they cannot challenge the United States in a symmetrical war. Cyber-based threats against U.S. information infrastructures are now a growing area of concern for national security. The US CERT recently revealed that attacks on US government systems increased by 40% in 2008. Assaults on these systems have been sustained for nearly a decade.

In 1999, a series of attacks with the US codename "Moonlight Maze"were aimed at DOD's unclassified Non-Classified Internet Protocol Router Network (NIPRnet), the network which is used to exchange information internally. These attacks may have compromised massive amounts of sensitive military data, and appeared to originate from a mainframe in Russia. In 2003, a series of cyberattacks designed to copy sensitive data files was launched against DOD systems, and the computers belonging to DOD contractors. The cyberespionage attack apparently went undetected for many months. This series of cyberattacks was labeled "Titan Rain," and was suspected by DOD investigators to have originated in China. The attacks were directed against the U.S. Defense Information Systems Agency (DISA), the U.S. Redstone Arsenal, the Army Space and Strategic Defense Installation, and several computer systems critical to military logistics. Although no classified systems reportedly were breached, many files were copied containing information that is sensitive and subject to U.S. export-control laws.

In 2006, an extended cyberattack against the U.S. Naval War College in Newport, Rhode Island, prompted officials to disconnect the entire campus from the Internet. A similar attack against the Pentagon in 2007 led officials to temporarily disconnect part of the unclassified network from the Internet. DOD officials acknowledge that the Global Information Grid, which is the main network for the U.S. military, experiences more than three million daily scans by unknown potential intruders.

Lt. General Charles Croom (JTF-Global Net Operations) has stated that cyber attackers "are not denying, disrupting, or destroying [American military] operations – yet. But that doesn't mean they don't have the capability." Potential adversaries, such as China, Russia, Cuba, Iran, Iraq, Libya, North Korea, and several non-state terrorist groups are reportedly developing capabilities to attack or degrade U.S. civilian and military networks. "Titan Rain" is an example of successful attacks against non-classified military systems which DOD officials claim were directed by other governments. Maj. Gen. William Lord (Air Force) stated publicly in 2007 that "China has downloaded 10 to 20 terabytes of data from the NIPRNet already."

According to the Defense Department's annual report to Congress on China's military prowess, the Chinese military is enhancing its information operations capabilities. The report finds that China is placing specific emphasis on the ability to perform information operations designed to weaken an enemy force's command and control systems.

Cyberwarfare: Estonia, Georgia and Kyrgystan

On April 27, 2007, officials in Estonia moved a Soviet-era war memorial commemorating an unknown Russian who died fighting the Nazis. The move stirred emotions, inciting rioting by ethnic Russians, and the blockading of the Estonian Embassy in Moscow. The event also marked the beginning of a series of large and sustained Distributed Denial-Of-Service (DDOS) attacks launched against several Estonian national websites, including government ministries and the prime minister's Reform Party. DDOS attacks occur when remote computers, often vast networks of "zombies" infected with malicious code, are instructed to target particular websites with requests, overwhelming the sites with traffic so that they become unavailable. Estonia's infrastructure relies heavily on information technology, and the country is described as being the most "wired" in Europe. Because availability of basic services to Estonian citizens was disrupted, the attacks were considered crippling.

Initially, the Russian government was blamed by Estonian officials for the cyberattacks, but it is unclear whether the attacks are sanctioned or initiated by the Russian government. NATO sent computer security experts to Estonia to help protect government systems against continued attacks, and to help recover from the attacks.

However, some analysts later concluded that the cyber attacks targeting Estonia were not a concerted attack, but instead were the product spontaneous anger from a loose federation of separate attackers. Technical data showed that sources of the attack were worldwide rather than concentrated in a few locations. The computer code that caused the DDOS attack was posted and shared in many Russian language chat rooms, where the moving of the statue was a very emotional topic for discussion. These analysts state that although various Estonian government agencies were taken offline, there was no apparent attempt to target national critical infrastructure other than internet resources, and no extortion demands were made. Their analysis concluded that there was no Russian government connection to the attacks against Estonia.

Ocurring simultaneously with a kinetic attack by Russian forces on Georgia's separatist regions, the country's major internet service providers were targeted with coordinated, sustained cyber attacks, knocking the some of the government's websites offline while defacing others. Investigations later determined that the attacks began with online Russian hacking forums, who distributed lists of Georgian internet sites as targets. Unlike the DDOS attacks on Estonia, the Georgian sites were taken down by exploiting a vulnerability in widely used software to manage Web databases. Rather than involving botnets comprised of thousands, attacks of this nature can be conducted with a single computer. In its effort to mitigate the attacks, the Georgian government blocked all internet traffic originating from Russian users. However, blogs quickly appeared with detailed instructions on how to bypass the block by re-routing the traffic through internet addresses in other countries.

Although there is no evidence linking the Russian government directly, there is much to suggest that the attacks were at least tolerated and perhaps even encouraged by Russian officials.

In anothern example of the growing popularity of cyber attacks as an intimidation tactic, Kyrgystan's two main internet service providers—which take up approximately 80% of the country's bandwith—were systematically targeted with denial of service attacks, effectively taking the country offline. Again, there is no evidence of direct involvement with the Russian Government; these attacks instead appeared to have originated with a Russian "cyber militia." Possible motives for the network assault include Russia's displeasure with a U.S. air base located in Kyrgystan, and with the Kyrzyg government's opposition party, which relies on the internet as its media outlet.

A persistent problem after a computer network attack is accurate and timely identification of the attacker. This uncertainty may affect decisions about how and against whom, or even whether, to retaliate.

Law and Proportionality for Information Operations

These incidents indicate a trend towards cyberattacks as a form of political manipulation. If cyberspace is a new battlefield on which war may be waged, then the international community will be challenged to come together to determine its conduct. The attack on Estonia, a member of NATO, raised questions of whether the actions taken could be defined as an "armed attack" under Article 5 of the Washington Treaty. Internationally, Article 51 of the Charter of the United Nations is the guidance for response. For now, NATO and other states consider network protection to be a national responsibility. However, questions of sovereignty, attribution, and response thresholds remain.

It has been presumed that the rules of engagement for information operations will follow the law of Armed Conflict, meaning a response taken after receiving an electronic or cyber attack will be scaled in proportion to the attack received, and distinctions will be maintained between combatants and civilians. However, protection against attack through cyberspace is a new task for the military, and the offensive tools and other capabilities used by DOD to stage retaliatory strikes against enemy systems are highly classified. Experience has shown that a reactive defense is not very effective against increasingly powerful and rapid malicious cyber attacks, or against other malicious activity using the electromagnetic spectrum. A more effective defense against these attacks is to incorporate predictive, active, and pre-emptive measures that allow DOD defenders to prevent, deflect, or minimize the efforts of the attacker.

Accurate attribution is important when considering whether to retaliate using military force or police action. Some DOD officials have indicated that the majority of cyber attacks against DOD and U.S. civilian agency systems are suspected to originate in China, and these attacks are consistently more numerous and sophisticated than cyberattacks from other malicious actors. The motives appear to be primarily cyberespionage against civilian agencies, DOD contractors, and DOD systems. The espionage involves unauthorized access to files containing sensitive industrial technology, and unauthorized research into DOD operations. Some attacks included attempts to implant malicious code into computer systems for future use by intruders.

Cyberattack, Cybercrime, and Cyberterrorism

In order to determine the legality of a response to malicious cyber behavior, the categories of activity, actors, and jurisdictions must be clearly defined. Labeling a "cyberattack" as "cybercrime" or "cyberterrorism" is problematic because of the difficulty determining with certainty the identity, intent, or the political motivations of an attacker. "Cybercrime" can be very broad in scope, and may sometimes involve more factors than just a computer hack. "Cyberterrorism" is often equated with the use of malicious code. However, a "cyberterrorism" event may also sometimes depend on the presence of other factors beyond just a "cyberattack."

Cyberterrorism

Various definitions exist for the term "cyberterrorism," just as various definitions exist for the term "terrorism." Analysis of cyberspace misconduct is complicated by the presence of violence in the definitions of terrorism. Security expert Dorothy Denning defines cyberterrorism as "... politically motivated hacking operations intended to cause grave harm such as loss of life or severe economic damage." The Federal Emergency Management Agency (FEMA) defines cyberterrorism as "unlawful attacks and threats of attack against computers, networks, and the information stored therein when done to intimidate or coerce a government or its people in furtherance of political or social objectives."

Others indicate that a physical attack that destroys computerized nodes for critical infrastructures, such as the Internet, telecommunications, or the electric power grid, without ever touching a keyboard, can also contribute to, or be labeled as cyberterrorism. Thus, it is possible that if a computer facility were deliberately attacked for political purposes, all three methods described above (physical attack, EA, and cyberattack) might contribute to, or be labeled as "cyberterrorism."

CRS is unaware of any reported acts of cyberterrorism, to date.

Cybercrime

Cybercrime is crime that is enabled by, or that targets computers. Some argue there is no agreed-upon definition for "cybercrime" because "cyberspace" is just a new specific instrument used to help commit crimes that are not new at all. Cybercrime can involve theft of intellectual property, a violation of patent, trade secret, or copyright laws. However, cybercrime also includes attacks against computers to deliberately disrupt processing, or may include espionage to make unauthorized copies of classified data. If a terrorist group were to launch a cyberattack to cause harm, such an act also fits within the definition of a cybercrime. The primary difference between a cyberattack to commit a crime or to commit terror is found in the intent of the attacker, and it is possible for actions under both labels to overlap.

One of the most prevalent forms of cybercrime is identity theft. Botnets and other examples of malicious code can operate to assist cybercriminals with identity theft, a crime generally motivated by financial gain. Current FBI estimates are that identity theft costs American businesses and consumers $50 billion a year. Individual users are often lured into clicking on tempting links that are found in email or when visiting websites. Clicking on titles such as "Buy Rolex watches cheap," or "Check out my new Photos," can take advantage of web browser vulnerabilities to place malicious software onto a users system which allows a cybercriminal to gather personal information from the user's computer.

Malicious code can scan a victim's computer for sensitive information, such as name, address, place and date of birth, social security number, mother's maiden name, and telephone number. Full identities obtained this way are bought and sold in online markets. False identity documents can then be created from this information using home equipment such as a digital camera, color printer, and laminating device, to make official-looking driver's licences, birth certificates, reference letters, and bank statements.

Identity theft involving thousands of victims is also enabled by inadequate computer security practices within organizations. MasterCard International reported that in 2005 more than 40 million credit card numbers belonging to U.S. consumers were accessed by computer hackers. Some of these account numbers were reportedly being sold on a Russian website, and some consumers have reported fraudulent charges on their statements. Officials at the UFJ bank in Japan reportedly stated that some of that bank's customers may also have become victims of fraud related to theft of the MasterCard information. In June 2006, officials from the U.S. Department of Energy acknowledged that names and personal information belonging to more than 1,500 employees of the National Nuclear Security Administration (NNSA) had been stolen in a network intrusion that apparently took place starting in 2004. The NNSA did not discover the security breach until one year after it had occurred.

Some sources report that stolen credit card numbers and bank account information are traded online in a highly structured arrangement, involving buyers, sellers, intermediaries, and service industries. Services include offering to conveniently change the billing address of a theft victim, through manipulation of stolen PINs or passwords. Observers estimated that in 2005 such services for each stolen MasterCard number cost between $42 and $72. Other news articles report that, in 2007, a stolen credit card number sells online for only $1, and a complete identity, including a U.S. bank account number, credit-card number, date of birth, and a government-issued ID number now sells for just $14 to $18.

As of January 2007, 35 states have enacted data security laws requiring businesses that have experienced an intrusion involving possible identity theft to notify persons affected, and to improve security for protection of restricted data. However, existing federal and state laws that impose obligations on information owners, may require harmonization to provide protections that are more uniform.

Identity theft continues to plague government systems. The U.S. government's online recruiting website, monster.com, suffered an intrusion in August 2007 that affected the confidential information of nearly 1.3 million users. The company admitted to waiting several days before notifying the public of the breach. The website was attacked again in February 2009, resulting in the theft of personal data for millions of users worldwide. In February 2009, the Federal Aviation Administration issued a letter exposing a data breach that affected more that 45,000 employees. There have been many criticisms of the FAA's handling of the situation, particularly for its failure to publish pertinent information on its website. Some argue that FISMA's requirements have agencies focused on meeting deadlines rather than expending resources on added security measures.

Also in February 2009, the Air Force shut down all internet access at Maxwell Air Force Base, Alabama. The measure was in response to an intrusion that may have affected the security of all Air Force systems, but also to stress the importance of information assurance to individual components. Air Force Chief of Staff General Shwartz stated that the disconnect was ordered because personnel " hadn't demonstrated — in our view at the headquarters — their capacity to manage their network in a way that didn't make everyone else vulnerable. This is the kind of effort that 's required up and down the line. "

On March 10, 2009, the Army publicly announced a breach of a database containing personal information about nearly 1,600 soldiers. The intrusions may have compromised the data on those participating in the Army's Operation Tribute to Freedom program, which allows soldiers to share their stories with the public. (For details on cybercrime and federal computer fraud, see CRS Report 97-1025, Cybercrime: An Overview of the Federal Computer Fraud and Abuse Statute and Related Federal Criminal Laws , by [author name scrubbed].

Cyberespionage

Cyberespionage involves the unauthorized probing to test a target computer's configuration or evaluate its system defenses, or the unauthorized viewing, copying, and exfiltration of data files. Deliberate network intrusions, whether for industrial espionage or espionage involving military information, qualify as cyberespionage. If there is disagreement about this, it is likely because technology has outpaced policy for labeling actions in cyberspace. In fact, industrial cyberespionage may now be considered a necessary part of global economic competition, and secretly monitoring the computerized functions and capabilities of potential adversary countries may also be considered essential for national defense.

U.S. counterintelligence officials reportedly have stated that about 140 different foreign intelligence organizations regularly attempt to hack into the computer systems of U.S. government agencies and U.S. companies. Cyberespionage, which enables the extraction of massive amounts of information electronically, has now transformed the nature of counterintelligence, by enabling a reduced reliance on conventional spying operations. The Internet, including satellite links and wireless local networks, now offers new, low cost and low risk opportunities for espionage. In 2001, a Special Committee of Inquiry established by the European Parliament accused the United States of using its Echelon electronic spy network to engage in industrial espionage against European businesses. Echelon was reportedly set up in 1971 as an electronic monitoring system during the Cold War. European Union member Britain operates the system, which includes listening posts in Canada, Australia, and New Zealand. Echelon is described as a global spy system reportedly capable of intercepting wireless phone calls, e-mail, and fax messages made from almost any location around the world.

Former director of the U.S. Central Intelligence Agency, James Woolsey, has reportedly justified the possibility of industrial espionage by the United States on the basis of the use of bribery by European companies. Officials of the European parliament reportedly expressed outrage about the justification, while not denying that bribery is sometimes used to make sales.

Some government officials warn that criminals now sell or rent malicious code tools for cyberespionage, and the risk for damage to U.S. national security due to cyberespionage conducted by other countries is great. One industry official, arguing for stronger government agency computer security practices, stated that, "If gangs of foreigners broke into the State or Commerce Departments and carried off dozens of file cabinets, there would be a crisis. When the same thing happens in cyberspace, we shrug it off as another of those annoying computer glitches we must live with."

Security experts warn that all U.S. federal agencies should now be aware that in cyberspace some malicious actors consider that no boundaries exist between military and civilian targets. According to an August 2005 computer security report by IBM, more than 237 million overall security attacks were reported globally during the first half of that year. Government agencies were targeted the most, reporting more than 54 million attacks, while manufacturing ranked second with 36 million attacks, financial services ranked third with approximately 34 million, and healthcare received more than 17 million attacks. The most frequent targets for these attacks, all occurring in the first half of 2005, were government agencies and industries in the United States (12 million), followed by New Zealand (1.2 million), and China (1 million). These figures likely represent an underestimation, given that most security analysts agree that the number of incidents reported are only a small fraction of the total number of attacks that actually occur.

Terrorism Linked to Cybercrime

The proportion of cybercrime that can be directly or indirectly attributed to terrorists is difficult to determine. However, linkages do exist between terrorist groups and criminals that allow terror networks to expand internationally through leveraging the computer resources, money laundering activities, or transit routes operated by criminals. For example, the 2005 U.K. subway and bus bombings, and the attempted car bombings in 2007, also in the U.K., provide evidence that groups of terrorists are already secretly active within countries with large communication networks and computerized infrastructures, plus a large, highly skilled IT workforce. London police officials reportedly believe that terrorists obtained high-quality explosives used for the 2005 U.K. bombings through criminal groups based in Eastern Europe.

A recent trial in the U.K. revealed a significant link between Islamic terrorist groups and cybercrime. In June 2007, three British residents, Tariq al-Daour, Waseem Mughal, and Younes Tsouli, pled guilty, and were sentenced for using the Internet to incite murder. The men had used stolen credit card information at online web stores to purchase items to assist fellow jihadists in the field—items such as night vision goggles, tents, global positioning satellite devices, and hundreds of prepaid cell phones, and more than 250 airline tickets, through using 110 different stolen credit cards. Another 72 stolen credit cards were used to register over 180 Internet web domains at 95 different web hosting companies. The group also laundered money charged to more than 130 stolen credit cards through online gambling websites. In all, the trio made fraudulent charges totaling more than $3.5 million from a database containing 37,000 stolen credit card numbers, including account holders' names and addresses, dates of birth, credit balances, and credit limits.

Cybercriminals have made alliances with drug traffickers in Afghanistan, the Middle East, and elsewhere where illegal drug funds or other profitable activities such as credit card theft, are used to support terrorist groups. Drug traffickers are reportedly among the most widespread users of encryption for Internet messaging, and are able to hire high-level computer specialists to help evade law enforcement, coordinate shipments of drugs, and launder money. Regions with major narcotics markets, such as Western Europe and North America, also possess optimal technology infrastructure and open commercial nodes that increasingly serve the transnational trafficking needs of both criminal and terrorist groups. Officials of the U.S. Drug Enforcement Agency (DEA), reported in 2003 that 14 of the 36 groups found on the U.S. State Department's list of foreign terrorist organizations were also involved in drug trafficking. A 2002 report by the Federal Research Division at the Library of Congress, revealed a "growing involvement of Islamic terrorist and extremists groups in drug trafficking," and limited evidence of cooperation between different terrorist groups involving both drug trafficking and trafficking in arms. Consequently, DEA officials reportedly argued that the war on drugs and the war against terrorism are and should be linked.

State Department officials, at a Senate hearing in March 2002, also indicated that some terrorist groups may be using drug trafficking as a way to gain financing while simultaneously weakening their enemies in the West through exploiting their desire for addictive drugs. The poppy crop in Afghanistan reportedly supplies resin to produce over 90% of the world's heroin, supporting a drug trade estimated at $3.1 billion. Reports indicate that money from drug trafficking in Afghanistan is used to help fund terrorist and insurgent groups that operate in that country. Subsequently, U.S. intelligence reports in 2007 have stated that "al Qaeda in Afghanistan" has been revitalized and restored to its pre-September 11, 2001 operation levels, and may now be in a better position to strike Western countries.

Drug traffickers have the financial clout to hire computer specialists with skills for using technologies which make Internet messages hard or impossible to decipher, and which allow terrorist organizations to transcend borders and operate internationally with less chance of detection. Many highly trained technical specialists that make themselves available for hire originally come from the countries of the former Soviet Union and the Indian subcontinent. Some of these technical specialists reportedly will not work for criminal or terrorist organizations willingly, but may be misled or unaware of their employers' political objectives. Still, others will agree to provide assistance because other well-paid legitimate employment is scarce in their region.

Terrorist Groups Linked to Hackers

Links between computer hackers and terrorists, or terrorist-sponsoring nations may be difficult to confirm. Membership in the most highly skilled computer hacker groups is sometimes very exclusive and limited to individuals who develop, demonstrate, and share only with each other, their most closely guarded set of sophisticated hacker tools. These exclusive hacker groups do not seek attention because maintaining secrecy allows them to operate more effectively. Some hacker groups may also have political interests that are supra-national, or based on religion, or other socio-political ideologies, while other hacker groups may be motivated by profit, or linked to organized crime, and may be willing to sell their computer services, regardless of the political interests involved.

Information about computer vulnerabilities is now for sale online in a hackers' "black market." For example, a list of 5,000 addresses of computers that have already been infected with spyware and which are waiting to be remotely controlled as part of an automated "bot network" reportedly can be obtained for about $150 to $500. Prices for information about computer vulnerabilities for which no software patch yet exists reportedly range from $1,000 to $5,000. Purchasers of this information are often organized crime groups, various foreign governments, and companies that deal in spam.

Terrorist Capabilities for Cyberattack

Some experts estimate that advanced or structured cyberattacks against multiple systems and networks, including target surveillance and testing of sophisticated new hacker tools, might require from two to four years of preparation, while a complex coordinated cyberattack, causing mass disruption against integrated, heterogeneous systems may require 6 to 10 years of preparation. This characteristic, where hackers devote much time to detailed and extensive planning before launching a cyberattack, has also been described as a "hallmark" of previous physical terrorist attacks and bombings launched by Al Qaeda.

It is difficult to determine the level of interest, or the capabilities of international terrorist groups to launch an effective cyberattack. A 1999 report by The Center for the Study of Terrorism and Irregular Warfare at the Naval Postgraduate School concluded that it is likely that any severe cyberattacks experienced in the near future by industrialized nations will be used by terrorist groups simply to supplement the more traditional physical terrorist attacks.

Some observers have stated that Al Qaeda does not see cyberattack as important for achieving its goals, preferring attacks which inflict human casualties. Other observers believe that the groups most likely to consider and employ cyberattack and cyberterrorism are the terrorist groups operating in post-industrial societies (such as Europe and the United States), rather than international terrorist groups that operate in developing regions where there is limited access to high technology.

However, other sources report that Al Qaeda has taken steps to improve organizational secrecy through more active and sophisticated use of technology, and evidence suggests that Al Qaeda terrorists used the Internet extensively to plan their operations for September 11, 2001. In past years, Al Qaeda groups reportedly used new Internet-based telephone services to communicate with other terrorist cells overseas. Khalid Shaikh Mohammed, one of the masterminds of the attack against the World Trade Center, reportedly used special Internet chat software to communicate with at least two airline hijackers. Ramzi Yousef, who was sentenced to life imprisonment for the previous bombing of the World Trade Center, had trained as an electrical engineer, and had planned to use sophisticated electronics to detonate bombs on 12 U.S. airliners departing from Asia for the United States. He also used sophisticated encryption to protect his data and to prevent law enforcement from reading his plans should he be captured.

Tighter physical security measures now widely in place throughout the United States may encourage terrorist groups in the future to explore cyberattack as way to lower the risk of detection for their operations. However, other security observers believe that terrorist organizations might be reluctant to launch a cyberattack because it would result in less immediate drama and have a lower psychological impact than a more conventional bombing attack. These observers believe that unless a cyberattack can be made to result in actual physical damage or bloodshed, it will never be considered as serious as a nuclear, biological, or chemical terrorist attack. Some experts fear that an attack on critical infrastructures such as the nation's electric grid or Supervisory Control and Data Acquisition (SCADA) utilities delivery systems, either through kinetic or cyber means, may be more likely. (For an explanation of vulnerabilities and security measures, see CRS Report RL30153, Critical Infrastructures: Background, Policy, and Implementation , by [author name scrubbed].)

International Convention on Cybercrime

Cybercrime is also a major international challenge, even though attitudes about what comprises a criminal act of computer wrongdoing still vary from country to country. However, the Convention on Cybercrime was adopted in 2001 by the Council of Europe, a consultative assembly of 43 countries, based in Strasbourg. The Convention, effective July 2004, is the primary international treaty dealing with breaches of law "over the internet or other information networks." The Convention requires participating countries to update and harmonize their criminal laws against hacking, infringements on copyrights, computer facilitated fraud, child pornography, and other illicit cyber activities.

Although the United States has signed and ratified the Convention, it did not sign a separate protocol that contained provisions to criminalize xenophobia and racism on the Internet, which would raise Constitutional issues in the United States. The separate protocol could be interpreted as requiring nations to imprison anyone guilty of "insulting publicly, through a computer system" certain groups of people based on characteristics such as race or ethnic origin, a requirement that could make it a crime to e-mail jokes about ethnic groups or question whether the Holocaust occurred. Reportedly, the Department of Justice has said that it would be unconstitutional for the United States to sign that additional protocol because of the First Amendment's guarantee of freedom of expression. The Electronic Privacy Information Center, in a June 2004 letter to the Foreign Relations Committee, objected to U.S. ratification of the Convention, because it would "create invasive investigative techniques while failing to provide meaningful privacy and civil liberties safeguards."

On August 3, 2006, the U.S. Senate passed a resolution of ratification for the Convention. The United States will comply with the Convention based on existing U.S. federal law; and no new implementing legislation is expected to be required. Legal analysts say that U.S. negotiators succeeded in scrapping most objectionable provisions, thereby ensuring that the Convention tracks closely with existing U.S. laws.

The Need to Improve Cybersecurity

Department of Defense (DOD) officials have stated that, while the threat of cyber attack is "less likely" to appear than conventional physical attack, it could actually prove more damaging because it could involve disruptive technology that might generate unpredictable consequences that give an adversary unexpected advantages. The Homeland Security Presidential Directive 7 required that the Department of Homeland Security (DHS) coordinate efforts to protect the cybersecurity for the nation's critical infrastructure. This resulted in two reports in 2005, titled "Interim National Infrastructure Protection Plan," and "The National Plan for Research and Development in Support of Critical Infrastructure Protection," where DHS provided a framework for identifying and prioritizing, and protecting each infrastructure sector.

However, some observers question why, in light of the many such reports describing an urgent need to reduce cybersecurity vulnerabilities, there is not an apparent perceived sense of national urgency to close the gap between cybersecurity and the threat of cyberattack. For example, despite Federal Information Security Management Act of 2002 (FISMA), some experts argue that security remains a low priority, or is treated almost as an afterthought at some domestic federal agencies. In 2007, the Government Accountability Office issued a report, titled "Critical Infrastructure Protection: Multiple Efforts to Secure Control Systems Are Under Way, but Challenges Remain," which states that cybersecurity risks have actually increased for infrastructure control systems because of the persistence of interconnections with the Internet, and continued open availability of detailed information on the technology and configuration of the control systems. The report states that no overall strategy yet exists to coordinate activities to improve computer security across federal agencies and the private sector, which owns the critical infrastructure. Some observers argue that, as businesses gradually strengthen their security policies for headquarters and administrative systems, the remote systems that control critical infrastructure and manufacturing may soon be seen as easier targets of opportunity for cybercrime.

Cybercrime is obviously one of the risks of doing business in the age of the internet, but observers argue that many decision-makers may currently view it as a low-probability threat. Some researchers suggest that the numerous past reports describing the need to improve cybersecurity have not been compelling enough to make the case for dramatic and urgent action by decision-makers. Others suggest that even though relevant information is available, future possibilities are still discounted, which reduces the apparent need for present-day action. In addition, the costs of current inaction are not borne by the current decision-makers. These researchers argue that IT vendors must be willing to regard security as a product attribute that is coequal with performance and cost; IT researchers must be willing to value cybersecurity research as much as they value research for high performance or cost-effective computing; and, finally, IT purchasers must be willing to incur present-day costs in order to obtain future benefits.

New U.S.A.F. Cyber Command

The Air Force is not laying claim to the cyber domain, but their new mission statement issued in August 2008 indicates they are building a force to operate in that domain. Former Secretary of the Air Force Michael W. Wynne recently stated that the new mission of the U.S. Air Force is to "fly and fight in air, space, and cyberspace." For the Air Force, this means that military action in cyberspace now includes defending against malicious activity on the Internet, and anywhere across the entire electromagnetic spectrum (including the energy spectrum bands for radio, microwaves, infrared, X-ray, and all other options for directed energy), where national security is threatened. Secretary Wynne stated that cyberwarfare flows naturally from the Air Force's traditional missions, such as downloading data from platforms in space, and that U.S. capabilities should be expanded to also enable the shut down of enemy electronic networks..

Air Force officials, led by the Air Force Chief of Staff Gen. Michael Mosley, met at the Pentagon in a "cyberwarfare-themed summit" during November 2006, to make plans for a new Air Force Cyber Command. General Elder stated that the planning session would include an assessment of cyberwarfare requirements to defend the nation.

Homeland security reportedly would also be a large part of the Cyber Command's new responsibility, including protection of telecommunications systems, utilities, and transportation. Several issues to be considered may include (1) what kind of educational skills, technical skills, and training are needed for staff at the Cyber Command and (2), what kind of career path can be offered to those in the Air Force who want to participate in defending the new cyber domain.

A provisional team led by AFCYBER Commander Maj. Gen. William T. Lord was starting to look at these issues. Then, Air Force Chief of Staff, Gen. Norton Schwartz, announced October 8, 2008, that there would no longer be a new major command developed for cyberspace operations. Instead the Air Force would continue with standing up a component-Numbered Air Force, which will focus on cyberspace warfighting operations. The 24 th Air Force will be led by a 2-star general, and will operate in support of NORTHCOM and STRATCOM missions, which could include anything from hurricane relief to homeland defense. All other administrative, policy and organize-train-equip oversight now falls under Air Force Space Command. The AFCYBER (P) team will stay formed so they can assist in developing a roadmap to outline the actions needed to transition the work done this past year over to the space command. The provisional team will also assist with other tasks as needed until the new organizational construct is formalized. The new organization will operate on an equal footing with other Numbered Air Force headquarters.

Eventually, there may be a new major command for cyberspace that will stand alongside the Air Force Space Command and the Air Combat Command. Some speculate that there may be a stand-alone combatant command for cyberspace. Precise future command relationships are still being decided in the ongoing planning effort, and more details will be forthcoming.

Joint Command Structure for Cyberwarfare

Currently, the U.S. Strategic Command (USSTRATCOM), which is a unified combatant command for U.S. strategic forces, controls military information operations, space command, strategic warning and intelligence assessments, global strategic operations planning under the Unified Command Plan, and also has overall responsibility for Computer Network Operations (CNO). USSTRATCOM gives most of the daily defense and operational activity to the National Security Agency.

Beneath USSTRATCOM are several Joint Functional Component Commands (JFCCs): (1) space and global strike integration; (2) intelligence, surveillance and reconnaissance; (3) network warfare; (4) integrated missile defense; and (5) combating weapons of mass destruction.

The JFCC-Network Warfare (JFCC-NW), and the JFCC-Space & Global Strike (JFCC-SGS) have responsibility for overall DOD cyber security, while the Joint Task Force-Global Network Operations (JTF-GNO) and the Joint information Operations Warfare Center (JIOWC) both have direct responsibility for defense against cyber attack. The JTF-GNO defends the DOD Global Information Grid, while the JIOWC assists combatant commands with an integrated approach to information operations. These include operations security, psychological operations, military deception, and electronic warfare. The JIOWC also coordinates network operations and network warfare with the JTF-GNO and with JFCC-NW.

Cyberwarrior Education

The President's Comprehensive National Cyber-security Initiative has identified cyber education and training as one of its critical areas of focus. As more U.S. military systems become computerized and linked to networks, some argue there is a growing need for qualified Electronic Warfare operators. In a recent speech, Deputy Secretary of Defense Gordan England said that "in the U.S., the number of scientists and engineers is declining at a time when numbers in many other countries are increasing. This decline in science and technology poses the greatest long-term threat to our country ... including our cyber networks."

Each year, DOD conducts a Cyber Defense Exercise, where teams of students from the nation's military academies advance their cyber skills in practice competition where they deliberately hack into test networks, and also protect these test networks against intrusions by other teams. The Officer Professional Military Education Policy (OPMEP) offers guidance on information operations (IO) and areas related to both IO and command and control (C2), and efforts are underway towards integrating cyber warfare into Joint Professional Military Education curriculum. An impediment to the program is the heavily classified nature of cyberspace doctrine and the international students who comprise some of the student body at the schools.

However, DOD has stated a need to attract, train, and retain skilled information technology professionals beyond those enrolled in the military academies. In an attempt to solve this problem, the Air Force Research Laboratory (AFRL) Cyber Operations Branch offers a 10-week summer program each year for university students, consisting of intensive studies in cyber security. The Advanced Course in Engineering (ACE) Cyber Security Boot Camp has been held at Rome, NY, for the past four years, and involves between 40 and 60 student applicants from Air Force and Army pre-commissioning programs, some National Science Foundation Cyber Corps Fellows, and some civilian college students. For 2006, the theme was "Cybercraft," described as a non-kinetic weapon platform that seeks dominance in cyberspace, corresponding to the new mission of the Air Force to "fly and fight in air, space, and cyberspace," according to program director Dr. Kamal Jabbour. Students study legal and policy issues, cryptography, computer network defense and attack, steganography, and analysis of malicious code. ACE students also spend an average of three days per week in internships at the Air Force Research Laboratory, or with local industry partners, and participate in officer development activities. The faculty for ACE is drawn from Syracuse University, West Point, and Norwich University.

DHS and the National Science Foundation (NSF) have recognized the ACE program as an official internship program for Federal Cyber Service Scholarship for Service (SFS) program. The SFS program seeks to increase the number of skilled students entering the fields of information assurance and cyber security by funding universities to award two-year scholarships in cyber security. Graduates are then required to work for a federal agency for two years. Recent ACE graduates are now working at the Air Force Office of Special Investigations, the AFRL, and the NSA.

Also, as a result of ACE summer program success with college students, in September 2006, Syracuse University developed a special cyber security course to be offered in 12 high schools in New Your State. Currently, Syracuse University offers 29 introductory cyber security courses in 148 high schools throughout New York, New Jersey, Maine, Massachusetts, and Michigan. High school students who successfully complete the cyber security courses can receive Syracuse college credits in computer science and engineering.

DOD and the U.S. Critical Infrastructure

DOD officials have noted that because 80% of U.S. commerce goes through the Internet, DOD systems must develop a capability to adequately protect it. Currently, to assist commercially owned telecommunications networks, communications satellite systems, and other civilian critical infrastructure systems, DOD contracts with Carnegie Mellon's Software Engineering Institute to operate the Computer Emergency Response Team (CERT-CC), while DHS, in partnership with private industry, operates a parallel organization called US-CERT. Both organizations monitor trends in malicious code and cyber crime, send out alerts about threats to computer systems, and provide guidance for recovery after an attack.

The Defense Information Systems Agency oversees the military's Global Information Grid (GiG), and provides support for net-centric operations through the JTF-GNO. The GiG is an interconnected set of capabilities that includes any DoD system, equipment, software, or service that transmits, stores, or processes DoD information. The Joint Staff J-6 is working on an initiative called "GiG 2.0," which may take advantage of cloud computing applications and social networking tools. Few details are known about the program at this point, but briefings suggest that the goal is to reconcile the inconsistent security postures and interoperability problems among the multiple service infrastructures by creating a joint DOD enterprise.

Federal Efforts to Protect Computers

The federal government has taken steps to improve its own computer security and to encourage the private sector to also adopt stronger computer security policies and practices to reduce infrastructure vulnerabilities. In 2002, the Federal Information Security Management Act (FISMA) was enacted, giving the Office of Management and Budget (OMB) responsibility for coordinating information security standards and guidelines developed by federal agencies. In 2003, the National Strategy to Secure Cyberspace was published by the Bush Administration to encourage the private sector to improve computer security for the U.S. critical infrastructure through having federal agencies set an example for best security practices.

The OMB has mandated that all U.S. Government enable their networks to handle traffic from IPv6, a next generation set of internet protocols. IPv6 was developed in response to the imminent exhaustion of IP addresses; the new system will allow more flexibility in address assignment, and simplifies the translating mechanism used to route traffic to particular sites. Network security is also a built-in feature of IPv6 architecture, and government systems running it are anticipated to be more secure. Federal agencies now support the IPv6 protocol and its interoperability, but are not necessarily using it on a day-to-day basis. Full operational transition to IPv6 remains a future goal.

The National Cyber Security Division (NCSD), within the National Protection and Programs Directorate of the Department of Homeland Security (DHS) oversees a Cyber Security Tracking, Analysis and Response Center (CSTARC), tasked with conducting analysis of cyberspace threats and vulnerabilities, issuing alerts and warnings for cyberthreats, improving information sharing, responding to major cybersecurity incidents, and aiding in national-level recovery efforts. In addition, a new Cyber Warning and Information Network (CWIN) has begun operation in 50 locations, and serves as an early warning system for cyberattacks. The CWIN is engineered to be reliable and survivable, has no dependency on the Internet or the public switched network (PSN), and reportedly will not be affected if either the Internet or PSN suffer disruptions.

In January 2004, the NCSD also created the National Cyber Alert System (NCAS), a coordinated national cybersecurity system that distributes information to subscribers to help identify, analyze, and prioritize emerging vulnerabilities and cyberthreats. NCAS is managed by the United States Computer Emergency Readiness Team (US-CERT), a partnership between NCSD and the private sector, and subscribers can sign up to receive notices from this new service by visiting the US-CERT website.

To observers, the most pervasive question regarding cyberattack and response is, "Who's in charge?" In an attempt to clarify roles and responsibilities and to develop an all-encompassing strategy, then president George W. Bush launched a $30 billion dollar Comprehensive National Cybersecurity Initiative (CNCI) in 2008 to prioritize and coordinate cyber defense across government. The initiative was prompted by the Director of National Intelligence's urging, and was led by ODNI's Joint Interagency Cyber Task Force. The Obama administration is continuing this effort by conducting a 60-day cybersecurity review, led by Melissa Hathaway, who was the coordinator of the ODNI task force. (For more on the CNCI, see CRS Report R40427, Comprehensive National Cybersecurity Initiative: Legal Authorities and Policy Considerations , by John Rollins and [author name scrubbed].)

DHS is lead agency for the Federal Government's cybersecurity; it coordinates government and private-sector efforts through its National Cyber Security Center (NCSC). However, there are high-ranking officials who assert that NSA should run the government's cybersecurity efforts as it does for the military. The resident technological talent within NSA and the benefits of having both defensive and offensive capabilities co-located make the idea attractive to some. Critics point towards allegations of NSA's civil liberties violations with internet monitoring programs, and say that having this one agency in charge of all things cyber will erode the public trust. Also, the private sector may be less inclined to work cooperatively with the NSA—which they maintain would present a big problem, as 80% of the United States infrastructure is privately owned. There have also been criticisms that DHS's cyber programs are inadequately funded, and that the leadership lacks the authority necessary to push forward its initiatives. To illustrate this point, Rob Beckstrom, the director of the NCSC resigned on March 6, 2009 over concerns that the NSA was "dominating" cybersecurity efforts. At a hearing on March 10, 2009, several experts testifying before the House Subcommittee on Emerging Threats, Cybersecurity and Science and Technology echoed this sentiment. (For a thorough discussion of reforming the national security structure to meet today's challenges, see CRS Report RL34455, Organizing the U.S. Government for National Security: Overview of the Interagency Reform Debates , by [author name scrubbed], [author name scrubbed], and [author name scrubbed].)

Policy Issues

Several areas for possible congressional consideration are:

help to determine appropriate responses by DOD to a cyberattack; examine the incentives for achieving the goals of the National Strategy to Secure Cyberspace and the CNCI, or for developing a new national strategy; search for ways to improve the security of commercial software products; explore ways to increase security education and awareness for businesses and home PC users; and find ways for private industry and government to coordinate to protect against cyberattack. reconsider classification levels to allow for increased information sharing oversight for DOD execution of cyberdefense appropriations

Congress may also wish to consider ways to harmonize existing federal and state laws that require notice to persons when their personal information has been affected by a computer security breach, and that impose obligations on businesses and owners of that restricted information.

DOD and Cyberattack Response

If a terrorist group were to use a cybercrime botnet to subvert computers in a third party country, such as China, to launch a cyberattack against the United States, the U.S. response to the cyberattack would presumably need to be carefully considered, in order to avoid retaliating against the wrong entity. Would the resulting effects of cyberweapons used by the United States be difficult to limit or control? Would a cyberattack response that could be attributed to the United States possibly encourage other extremists, or rogue nations, to start launching their own cyberattacks against the United States? Would an attempt by the U.S. to increase surveillance of another entity via use of cyberespionage computer code be labeled as an unprovoked attack, even if directed against the computers belonging to a terrorist group? If a terrorist group should subsequently copy, or reverse-engineer a destructive U.S. military cyberattack program, could it be used against other countries that are U.S. allies, or even turned back to attack civilian computer systems in the United States? If the effects become widespread and severe, could the U.S. use of cyberweapons exceed the customary rules of military conflict, or violate international laws?

Commercial electronics and communications equipment are now used extensively to support complex U.S. weapons systems, and are possibly vulnerable to cyberattack. This situation is known to our potential adversaries. To what degree are military forces and national security threatened by computer security vulnerabilities that exist in commercial software systems, and how can the computer industry be encouraged to create new commercial off-the-shelf (COTS) products that are less vulnerable to cyberattack?

Incentives for the National Strategy to Secure Cyberspace

Does the National Strategy to Secure Cyberspace present clear incentives for achieving security objectives? Suggestions to increase incentives may include requiring that all software procured for federal agencies be certified under the "Common Criteria" testing program, which is now the requirement for the procurement of military software. However, industry observers point out that the software certification process is lengthy and may interfere with innovation and competitiveness in the global software market.

Should the National Strategy to Secure Cyberspace rely on voluntary action on the part of private firms, home users, universities, and government agencies to keep their networks secure, or is there a need for possible regulation to ensure best security practices? Has public response to improve computer security been slow partly because there are no regulations currently imposed? Would regulation to improve computer security interfere with innovation and possibly harm U.S. competitiveness in technology markets? Two of the former cybersecurity advisers to the president have differing views: Howard Schmidt has stated that market forces, rather than the government, should determine how product technology should evolve for better cybersecurity; however, Richard Clarke has stated that the IT industry has done little on its own to improve security of its own systems and products.

Improving Security of Commercial Software

Some security experts emphasize that if systems administrators received the necessary training for keeping their computer configurations secure, then computer security would greatly improve for the U.S. critical infrastructure. However, should software product vendors be required to create higher quality software products that are more secure and that need fewer patches? Could software vendors possibly increase the level of security for their products by rethinking the design, or by adding more test procedures during product development?

Education and Awareness of Cyberthreats

Ultimately, many observers argue that reducing the threat to national security from cybercrime depends on a strong commitment by government and the private sector to follow best management practices that help improve computer security. Numerous government reports already exist that describe the threat of cybercrime and make recommendations for management practices to improve cybersecurity.

A 2004 survey done by the National Cyber Security Alliance and AOL showed that most home PC users do not have adequate protection against hackers, do not have updated antivirus software protection, and are confused about the protections they are supposed to use and how to use them. How can computer security training be made available to all computer users that will keep them aware of constantly changing computer security threats, and that will encourage them to follow proper security procedures?

Coordination Between Private Sector and Government

What can be done to improve sharing of information between federal government, local governments, and the private sector to improve computer security? Effective cybersecurity requires sharing of relevant information about threats, vulnerabilities, and exploits. How can the private sector obtain information from the government on specific threats which the government now considers classified, but which may help the private sector protect against cyberattack? How can the government obtain specific information from private industry about the number of successful computer intrusions, when companies resist reporting because they want to avoid publicity and guard their trade secrets? Should cybercrime information voluntarily shared with the federal government about successful intrusions be shielded from disclosure through Freedom of Information Act requests?

How can the United States better coordinate security policies and international law to gain the cooperation of other nations to better protect against a cyberattack? Pursuit of hackers may involve a trace back through networks requiring the cooperation of many Internet Service Providers located in several different nations. Pursuit is made increasingly complex if one or more of the nations involved has a legal policy or political ideology that conflicts with that of the United States.

Thirty-eight countries, including the United States, participate in the Council of Europe's Convention on Cybercrime, which seeks to combat cybercrime by harmonizing national laws, improving investigative abilities, and boosting international cooperation. However, how effective will the Convention without participation of other countries where cybercriminals now operate freely? (For more on the Convention, see CRS Report RS21208, Cybercrime: The Council of Europe Convention , by [author name scrubbed] (pdf).)

Legislative Activity in the 110th Congress

H.R. 1525 —The Internet Spyware (I-SPY) Prevention Act of 2007, proposed penalties for unauthorized access to computers, or the use of computers to commit crimes. The bill passed the House on May 22, 2007. On May 23, 2007, this bill was received in the Senate and referred to the Committee on the Judiciary.

H.R. 1684 —The Department of Homeland Security Authorization Act for Fiscal Year 2008 established within the Department of Homeland Security an Office of Cybersecurity and Communications, headed by the Assistant Secretary for Cybersecurity and Communications, with responsibility for overseeing preparation, response, and reconstitution for cybersecurity and to protect communications from terrorist attacks, major disasters, and other emergencies, including large-scale disruptions.

The bill directed the Assistant Secretary to do the following:

Establish and maintain a capability within the Department for ongoing activities to identify threats to critical information infrastructure to aid in detection of vulnerabilities and warning of potential acts of terrorism and other attacks. Conduct risk assessments on critical information infrastructure with respect to acts of terrorism. Develop a plan for the continuation of critical information operations in the event of a cyber attack. Define what qualifies as a cyber incident of national significance for purposes of the National Response Plan. Develop a national cybersecurity awareness, training, and education program that promotes cybersecurity awareness within the Federal Government and throughout the Nation. Consult and coordinate with the Under Secretary for Science and Technology on cybersecurity research and development to strengthen critical information infrastructure against acts of terrorism.

This bill passed the House on May 9, 2007. On May 11, 2007, this bill was referred to the Senate Committee on Homeland Security and Governmental Affairs.

H.R. 3237 —The Smart Grid Facilitation Act of 2007 proposed to modernize the Nation's electricity transmission and distribution system to incorporate digital information and controls technology. "Smart grid" technology functions would include the ability to detect, prevent, respond to, or recover from cyber-security threats and terrorism. The new Grid Modernization Commission would be directed to undertake, and update on a biannual basis, an assessment of the progress toward modernizing the electric system including cybersecurity protection for extended grid systems. On August 24, 2007, the bill was referred to House subcommittee on Energy and Environment.

H.R. 3221 —The New Direction for Energy Independence, National Security, and Consumer Protection Act proposed establishment of the Grid Modernization Commission to facilitate the adoption of Smart Grid standards, technologies, and practices across the Nation's electricity grid. This bill became P.L. 110-289 on July 30, 2008.

H.R. 1585 , the National Defense Authorization Act for Fiscal Year 2008, required the Secretary of Defense to conduct a quadrennial roles and missions review for the Department of Defense, which will also include cyber operations. This bill became P.L. 110-181 on January 28, 2008.

H.Rept. 110-146 , on H.R. 1585 , by the Committee on Armed Services. This report stated that within 180 days after enactment of the National Defense Authorization Act for 2008, the Secretary of Defense must submit a report to congressional defense committees, with the following requirements:

1. Review legal authorities to ensure effective cyberspace operations.

2. Review DOD's policies for information sharing and risk management for cyberspace operations.

3. Provide an overview of DOD's cyberspace organization, strategy, and programs.

4. Assess operational challenges, including the impact of the military's reliance on commercial communications infrastructure.

5. Recommend ways to improve DOD's ability to coordinate cyberspace operations with law enforcement, intelligence communities, the commercial sector, and with international allies. The recommendations shall include consideration of the establishment of a single joint organization for cyberspace operations.

6. Provide an overview of training and educational requirements.

7. Provide an overview of funding for cyberspace operations.

The DOD Roles and Missions Review report, issued in January 2009, placed cyberspace high on the list of focus areas, and asserted that this domain will be one in which major combat operations may take place.

Potential Future Issues for Congress

Could provocative actions, for example, intelligence gathering by the U.S. military that involves using intrusive cyber or electronic warfare tools to monitor enemy system activity, or copy important data files, be challenged by other nations as a violation of the law of Armed Conflict? Exploratory intrusions by U.S. military computers to gather intelligence may provoke other strong or unexpected responses from some countries or extremist groups that are targeted for monitoring by DOD.

Several questions also may arise when considering a retaliatory cyber or electronic warfare counterstrike: (1) if the attacker is a civilian, should the attack be considered a law enforcement problem rather than a military matter?; (2) if a U.S. military cyberattack against a foreign government also disables civilian infrastructure, can it be legally justified?; or (3) how can the military be certain that a targeted foreign computer system has not been innocently set up to appear as an attacker by another third party attacker?

Some observers have stated that success in future conflicts will depend less on the will of governments, and more on the perceptions of populations, and that perception control will be achieved and opinions shaped by the warring group that best exploits the global media. As a result of the increasingly sophisticated use of networks by terrorist groups and the potentially strong influence of messages carried by the global media, does DOD now view the Internet and the mainstream media as a possible threat to the success of U.S. military missions? How strongly will U.S. military PSYOP be used to manipulate public opinion, or reduce opposition to unpopular decisions in the future?

Another emerging issue may be whether DOD is legislatively authorized to engage in PSYOP that may also affect domestic audiences. DOD Joint Publication 3-13, released February 2006, provides current doctrine for U.S. military Information Operations, and explains the importance of achieving information superiority. However, the DOD Information Operations Roadmap, published October 2003, states that PSYOP messages intended for foreign audiences increasingly are consumed by the U.S. domestic audience, usually because they can be re-broadcast through the global media. The Roadmap document states that, " ... the distinction between foreign and domestic audiences becomes more a question of USG (U.S. Government) intent rather than information dissemination practices (by DOD)." This may be interpreted to mean that DOD has no control over who consumes PSYOP messages once they are re-transmitted by commercial media.

Appendix A. Definitions

Information

Information is a resource created from two things: phenomena (data) that are observed, plus the instructions (systems) required to analyze and interpret the data to give it meaning. The value of information is enhanced by technology, such as networks and computer databases, which enables the military to (1) create a higher level of shared awareness, (2) better synchronize command, control, and intelligence, and (3) translate information superiority into combat power.

DOD Information Operations

The current DOD term for military information warfare is "Information Operations" (IO). DOD information operations are actions taken during time of crisis or conflict to affect adversary information, while defending one's own information systems, to achieve or promote specific objectives. The focus of IO is on disrupting or influencing an adversary's decision-making processes.

An IO attack may take many forms, for example: (1) to slow adversary computers, the software may be disrupted by transmitting a virus or other malicious code; (2) to disable sophisticated adversary weapons, the computer circuitry may be overheated with directed high energy pulses; and (3) to misdirect enemy sensors, powerful signals may be broadcast to create false images. Other methods for IO attack may include psychological operations such as initiating TV and radio broadcasts to influence the opinions and actions of a target audience, or seizing control of network communications to disrupt an adversary's unity of command.

Computer Network Defense (CND) is the term used to describe activities that are designed to protect U.S. forces against IO attack from adversaries. Part of CND is information assurance (IA), which requires close attention to procedures for what is traditionally called computer and information security.

DOD places new emphasis on the importance of dominating the entire electromagnetic spectrum with methods for computer network attack and electronic warfare. DOD also emphasizes that because networks are increasingly the operational center of gravity for warfighting, the U.S. military must be prepared to "fight the net." Because the recently declassified source document containing this phrase has some lines blacked out, it is not clear if "... net" means the Internet. If so, then this phrase may be a recognition by DOD that Psychological Operations, including public affairs work and public diplomacy, must be employed in new ways to counter the skillful use of the Internet, social networking tools, and the global news media by U.S. adversaries.

Appendix B. DOD Information Operations Core Capabilities

In Joint Publication 3-13, DOD identifies five core capabilities, or "pillars," for conduct of information operations: (1) Psychological Operations, (2) Military Deception, (3) Operations Security, (4) Computer Network Operations, and (5) Electronic Warfare. These capabilities are interdependent, and increasingly are integrated to achieve desired effects.

Psychological Operations (PSYOP)

DOD defines PSYOP as planned operations to convey selected information to targeted foreign audiences to influence their emotions, motives, objective reasoning, and ultimately the behavior of foreign governments, organizations, groups, and individuals. For example, during the Operation Iraqi Freedom (OIF), broadcast messages were sent from Air Force EC-130E aircraft, and from Navy ships operating in the Persian Gulf, along with a barrage of e-mail, faxes, and cell phone calls to numerous Iraqi leaders encouraging them to abandon support for Saddam Hussein.

The civilian Al Jazeera news network, based in Qatar, beams its messages to well over 35 million viewers in the Middle East, and is considered by many to be a "market competitor" for U.S. PSYOP. Terrorist groups can also use the Internet to quickly place their own messages before an international audience. Some observers have stated that the U.S. will continue to lose ground in the global media wars until it develops a coordinated strategic communications strategy to counter competitive civilian news media, such as Al Jazeera.

Partly in response to this observation, DOD now emphasizes that PSYOP must be improved and focused against potential adversary decision making, sometimes well in advance of times of conflict. Products created for PSYOP must be based on in-depth knowledge of the audience's decision-making processes. Using this knowledge, the PSYOPS products then must be produced rapidly, and disseminated directly to targeted audiences throughout the area of operations.

Following the Smith-Mundt Act, DOD policy prohibits the use of PSYOP for targeting American audiences. However, while military PSYOP products are intended for foreign targeted audiences, DOD also acknowledges that the global media may pick up some of these targeted messages, and replay them back to the U.S. domestic audience. Therefore, a sharp distinction between foreign and domestic audiences cannot be maintained.

Military Deception (MILDEC)

Deception guides an enemy into making mistakes by presenting false information, images, or statements. MILDEC is defined as actions executed to deliberately mislead adversary military decision makers with regard to friendly military capabilities, thereby causing the adversary to take (or fail to take) specific actions that will contribute to the success of the friendly military operation.

As an example of deception during Operation Iraqi Freedom (OIF), the U.S. Navy deployed the Tactical Air Launched Decoy system to divert Iraqi air defenses away from real combat aircraft.

Operational Security (OPSEC)

OPSEC is defined as a process of identifying information that is critical to friendly operations and which could enable adversaries to attack operational vulnerabilities. For example, during OIF, U.S. forces were warned to remove certain information from DOD public websites, so that Iraqi forces could not exploit sensitive but unclassified information.

Computer Network Operations (CNO)

CNO includes the capability to: (1) attack and disrupt enemy computer networks; (2) defend our own military information systems; and (3) exploit enemy computer networks through intelligence collection, usually done through use of computer code and computer applications. The Joint Information Operations Warfare Command (JIOWC) and the Joint Functional Component Command for Network Warfare (JFCCNW) are responsible for the evolving mission of Computer Network Attack. The exact capabilities of the JIOWC and JFCCNW are highly classified, and DOD officials have reportedly never admitted to launching a cyber attack against an enemy, however many computer security officials believe the organization can destroy networks and penetrate enemy computers to steal or manipulate data, and take down enemy command-and-control systems. They also believe that the organization consists of personnel from the CIA, National Security Agency, FBI, the four military branches, and civilians and military representatives from allied nations. The Joint Task Force for Global Network Operations (JTF-GNO), currently residing within the Defense Information Security Agency (DISA), is an operational arm of the services. A recent decision to move the JTF-GNO under the auspices of the National Security Agency will put defensive and operational capabilities within the same organization.

Computer Network Defense (CND)

CND is defined as defensive measures to protect information, computers, and networks from disruption or destruction. CND includes actions taken to monitor, detect, and respond to unauthorized computer activity. Responses to IO attack against U.S. forces may include use of passive information assurance tools, such as firewalls or data encryption, or may include more intrusive actions, such as monitoring adversary computers to determine their capabilities before they can attempt an IO attack against U.S. forces.

Some DOD officials believes that CND may lack sufficient policy and legal analysis for guiding appropriate responses to intrusions or attacks on DOD networks. Therefore, DOD has recommended that a legal review be conducted to determine what level of intrusion or data manipulation constitutes an attack. The distinction is necessary in order to clarify whether an action should be called an attack or an intelligence collection operation, and which aggressive actions can be appropriately taken in self-defense. This legal review should also determine if appropriate authorities permit U.S. forces to retaliate through manipulation of unwitting third party computer hosts. And finally, DOD has recommended structuring a legal regime that applies separately to domestic and to foreign sources of computer attack against DOD or the U.S. critical. infrastructure.

Computer Network Exploitation (CNE)

CNE is an area of IO that is not yet clearly defined within DOD. Before a crisis develops, DOD seeks to prepare the IO battlespace through intelligence, surveillance, and reconnaissance, and through extensive planning activities. This involves intelligence collection, that in the case of IO, is usually performed through network tools that penetrate adversary systems to gain information about system vulnerabilities, or to make unauthorized copies of important files. Tools used for CNE are similar to those used for computer attack, but configured for intelligence collection rather than system disruption. Although CNE is an activity designed for data exfiltration, it is unknown whether the methods used to penetrate networks could also be used for an attack by an adversary.

Computer Network Attack (CNA)

CNA is defined as effects intended to disrupt or destroy information resident in computers and computer networks. As a distinguishing feature, CNA normally relies on a data stream used as a weapon to execute an attack. For example, sending a digital signal stream through a network to instruct a controller to shut off the power flow is CNA, while sending a high voltage surge through the electrical power cable to short out the power supply is considered Electronic Warfare (However, a digital stream of computer code or a pulse of electromagnetic power can both be used to also create false images in adversary computers).

During Operation Iraqi Freedom, U.S. and coalition forces reportedly did not execute any computer network attacks against Iraqi systems. Even though comprehensive IO plans were prepared in advance, DOD officials stated that top-level approval for several CNA missions was not granted until it was too late to carry them out to achieve war objectives. U.S. officials may have rejected launching a planned cyber attack against Iraqi financial computers because Iraq's banking network is connected to a financial communications network also located in Europe. Consequently, according to Pentagon sources, an information operations attack directed at Iraq might also have brought down banks and ATM machines located in parts of Europe as well. Such global network interconnections, plus close network links between Iraqi military computer systems and the civilian infrastructure, reportedly frustrated attempts by U.S. forces to design a cyber attack that would be limited to military targets only in Iraq.

In a meeting held in January 2003, at the Massachusetts Institute of Technology, White House officials sought input from experts outside government on guidelines for use of cyber-warfare. Officials have stated they are proceeding cautiously, since a cyberattack could have serious cascading effects, perhaps causing major disruption to networked civilian systems. In February 2003, the Bush Administration announced national-level guidance for determining when and how the United States would launch computer network attacks against foreign adversary computer systems. The classified guidance, known as National Security Presidential Directive 16, is intended to clarify circumstances under which a disabling computer attack would be justified, and who has authority to launch such an attack.

Electronic Warfare (EW)

EW is defined by DOD as any military action involving the direction or control of electromagnetic spectrum energy to deceive or attack the enemy. High power electromagnetic energy can be used as a tool to overload or disrupt the electrical circuitry of almost any equipment that uses transistors, micro-circuits, or metal wiring. Directed energy weapons amplify, or disrupt, the power of an electromagnetic field by projecting enough energy to overheat and permanently damage circuitry, or jam, overpower, and misdirect the processing in computerized systems. The Electronic Warfare Division of the Army Asymmetric Warfare Office has responsibility for creating electronic warfare policy, and for supporting development of new electromagnetic spectrum concepts that can be translated into equipment and weapons.

Domination of the Electromagnetic Spectrum

DOD now emphasizes maximum control of the entire electromagnetic spectrum, including the capability to disrupt all current and future communication systems, sensors, and weapons systems. This may include (1) navigation warfare, including methods for offensive space operations where global positioning satellites may be disrupted; or, (2) methods to control adversary radio systems; and, (3) methods to place false images onto radar systems, block directed energy weapons, and misdirect unmanned aerial vehicles (UAVs) or robots operated by adversaries.

For example, military IO testing examined the capability to secretly enter an enemy computer network and monitor what their radar systems could detect. Further experiments tested the capability to take over enemy computers and manipulate their radar to show false images.

Electromagnetic Non-Kinetic Weapons

Non-kinetic weapons emit directed electromagnetic energy that, in short pulses, may permanently disable enemy computer circuitry. For example, an electromagnetic non-kinetic weapon mounted in an aircraft, or on the ground, might disable an approaching enemy missile by directing a High Power Microwave (HPM) beam that burns out the circuitry, or that sends a false telemetry signal to misdirect the targeting computer. Also, at reduced power, electromagnetic non-kinetic weapons can also be used as a non-lethal method for crowd control.

The Active Denial System (ADS), developed by the Air Force, is a vehicle-mounted nonlethal, counter-personnel directed energy weapon. Currently, most non-lethal weapons for crowd control, such as bean-bag rounds, utilize kinetic energy. However, the ADS projects a focused beam of millimeter energy waves to induce an intolerable burning sensation on an adversary's skin, repelling the individual without causing injury. Proponents say the ADS is safe and effective at ranges between 50 and 1,600 feet. The nonlethal capabilities of the ADS are designed to protect the innocent, minimize fatalities, and limit collateral damage. Approximately $40 million has been spent on this technology over the past ten years.

Military officials requested that ADS devices be deployed to Iraq to assist Marines in guarding posts, countering insurgent snipers and protecting convoys. In July 2005, it was reported that the Active Denial System would be deployed to Iraq before the end of the year. Under an initiative called Project Sheriff, troops would receive a total of 15 vehicles. Concerns of political fallout have delayed these plans; as of early 2007, initial deployment was slated no sooner than 2010.

The ADS system would be the first operationally deployed directed-energy weapon for counter-personnel missions.