Cyber commander: U.S. not drawing 'red lines' in cyberspace

The U.S. is avoiding drawing "red lines" in cyberspace to maintain strategic ambiguity about its intentions and retain freedom of maneuver in its responses to online aggression, the deputy head of U.S. Cyber Command said Wednesday.

The U.S. is avoiding drawing “red lines” in cyberspace to maintain strategic ambiguity about its intentions and retain freedom of maneuver in its responses to online aggression, the deputy head of U.S. Cyber Command said Wednesday.

“Ambiguity, not locking yourself in, is the way that our government prefers to do this,” Air Force Lt. Gen. Kevin McLaughlin told the 2016 Intelligence and National Security Summit.

He said he “agreed” with former National Intelligence Officer for Cyber Sean Kanuck, who laid out the reasoning in more detail during the panel discussion on cyber deterrence.

“Currently most countries don’t want to be incredibly specific about the red line for two reasons,” explained Kanuck, now a consultant. “They don’t want to invite people to do anything they want to below that red line thinking they can do it with impunity; and secondly you don’t want to back yourself into a strategic corner where you have to respond if they do something above that red line or else lose credibility.”

McLaughlin said attribution — it can be hard to know for sure who is behind a cyberattack — was an issue even outside of cyberspace, but that didn’t cripple U.S. response.

As an example, he cited the shooting down of Malaysia Airline’s flight 17 en route from Holland over Ukraine — an action that has been attributed to pro-Russian militia using Kremlin-supplied anti-aircraft weapons.

“It’s hard to prove exactly who was behind it,” he said of such an attack. “When you bring it to the public there’s lots of debate and dialogue.”

Even with improving attribution, cyberattacks are tricky territory when it comes to response, he acknowledged.

“You get into discussions where it’s [about] was that cyber action something you want to deter — or was the cyber action something we think of as a legitimate tool of nation-state [actors], but the end result is something that crossed the line.”

Although he didn’t give examples, one instance is Chinese hackers’ looting of intellectual property from U.S. advanced technology companies. U.S. officials recognize that network intrusion and the theft of sensitive data is a legitimate objective for a national intelligence service. But they say it’s wrong to give that data to Chinese companies so they can underbid, or out-engineer, their U.S. competitors.

Cyber is, after all, only a domain — like the air and the sea. It’s what the adversary does there — and why — that should dictate the U.S. response, McLaughlin said.

“I think those red lines in cyber will firm up to some degree, but I think we’ll see a lot of it generate down to: ‘What actually was that country trying to do?’ It’s often not that the action itself in cyber[space] which was the thing that crossed the red line, it’s often what was the objective … behind it, the end result, that actually crossed the red line.”

But with so much ambiguity, the cyber domain becomes a dangerous space into which conflicts can overflow, and from which conflicts can quickly escalate, precisely because the rules of engagement are unclear or poorly understood, Kanuck said.

“There’s an interest in ambiguity from a strategic sense, but that also leads to strategic uncertainty,” he said.

The event was co-organized by AFCEA International, and the Intelligence and National Security Alliance.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure