Although most of the conflict-related cyber attacks taking place today appear to originate with nonstate actors, governments have been blamed for launching some of them. China especially is fingered, but the Kremlin was accused of being behind the Estonian assault. Whereas the Chinese and Russian protest attacks were most likely the work of patriotic hackers operating on their own, it is possible these governments supported their efforts, or at least turned a blind eye. Regardless, most major governments are developing a cyber warfare capability, though details remain closely guarded secrets. If there is a silver lining, it is that cyber warfare may produce fewer casualties than conventional conflict as well as damages that are more quickly repaired. Instead of bombing a telecommunications hub and killing those in the vicinity, the objective of disrupting enemy communications on the battlefield might also be achieved through a cyber attack. Although a cyber attack, say against a power generator or military communications hub, could lead to casualties, in the near term, at least, physical weapons are far more lethal.
Addressing the cyber attacks against U.S. targets has been a challenge. Clearly, we need to defend our networks and computers, but this is not a problem the government alone can solve any more than it can defend our homes and offices from burglars. Rather, it requires knowledge and diligence on the part of each of us, along with considerable support from industry, such as more secure software. Industry efforts such as Microsoft's Trustworthy Computing Initiative help, but much remains to be done.
Government can help in four areas: defending its own networks; establishing and enforcing the law in cyberspace; promoting security through regulation and incentives; and funding research and education in security. Of these, the U.S. government has most effectively met the latter objective, perhaps because it is the easiest to accomplish. It has also been successful creating cyberspace law, though enforcement has been problematic owing to the difficulty of tracing and investigating cyber attacks, especially when they cross international borders. Yet effective law enforcement is critical for deterrence.
As for defending its own networks, many government agencies continue to flunk security assessments or succumb to cyber attacks, so there is ample room for improvement. Although the government has helped promote security in the private sector, it has generally avoided regulation, which in the end may become necessary, at least for software that controls crucial infrastructural and life-critical systems.
The White House's Comprehensive National Cybersecurity Initiative, a multiagency, multiyear plan established in January by the U.S. Department of Homeland Security, may address some of these needs. The plan calls for the government to set up a National Cyber Security Center to coordinate and integrate information for protecting U.S. networks and promoting collaboration among federal cyber groups. The jury is still out, however, on whether the initiative will be up to the task of strengthening the nation's cyber security posture.