“Only the dead have seen the end of war.”
George Santayana
- John Wheeler
By John Wheeler
[email protected]
Writing Cyber defense into Title 10: Meeting the Challenge Head-on
The public debate is increasingly acknowledging that the military must have a distinct and essential role in cyberspace. This realization emphasizes that warfighting is distinct from other professional skill sets involved in cyberspace, namely law enforcement and intelligence. Key ideas from the history and practice of the military art will help to shape a U.S. cyber defense and warfighting capability. This capability will be necessary in order to protect the global freedom of commerce, trade, and communications.
In order to better craft a cyber defense and warfighting capability, Congress will need to expand its guidance on warfighting – contained in Title 10 of the U.S. Code – to include cyberspace. Currently, the code covers land, sea, air and space but notably omits cyberspace.
Evolving Perspectives on the Cyber Challenge
In a recent interview, Deputy Secretary of Defense William Lynn spoke of the importance of collaborating with other nations for the common defense, creating a vigorous defense capability, and seizing the initiative to locate attackers.
The Vice Chairman of the Joint Staff, General James Cartwright, has made the same point:
History teaches us that a purely defensive posture poses significant risks: the ‘Maginot Line’ model of terminal defense will ultimately fail without a more aggressive offshore strategy, one that more effectively layers and integrates our cyber capabilities. If we apply the principles of warfare to the cyber domain, as we do to sea, air, and land, we realize the defense of the nation is better served by capabilities enabling us to take the fight to our adversaries, when necessary to deter actions detrimental to our interests. [1]
Further, the new Joint Staff statement, “Command and Control for Joint Air Operations,” states in bold letters: “Communications security, and specifically bandwidth protection (from both friendly interference and adversary action) is imperative.” This bandwidth protection applies to both manned and unmanned systems. As reported by Secrecy News, the document states that, in general, unmanned aircraft should be treated “similarly to manned systems with regard to the established doctrinal warfighting principles.”
The Need for Title 10 Inclusion
Latent in Mr. Lynn’s remarks is the policy question that is now ripe for discussion: When shall Congress incorporate cyberspace into Title 10 of the U.S. Code?
New advice and consent appointees in DOD could be forgiven for being mystified that they find the guidance for land, sea, air, and space in Title 10, but nothing on cyberspace. Many long explanations and excuses can be woven, but it is a gaping policy and statutory gap.
Notional Language for Title 10 Inclusion of Cyberspace
Title 10 of the U.S. Code is where Congress gives guidance to the Executive Branch for the efforts to organize, train, and equip forces for defense in land, sea, air, and space domains; Title 10 is where Congressional guidance for the cyberspace domain would be included.
What follows is notional language for the inclusion of cyberspace in Title 10. It is a “thought experiment” to illustrate Congressional guidance to appointed officials and the military for the tasks of organizing, training and equipping forces in the Cyber domain. The language for the space domain in Title 10 is used as a template and applied to cyberspace. Indeed, space and cyberspace share common properties of (a) being unbounded and (b) enveloping the other domains. The first section would read:
§ 2XXX. Policy regarding assured access to cyberspace: Freedom of Cyberspace and national security cyber payloads
(a) Policy.— It is the policy of the United States for the President to undertake actions appropriate to ensure, to the maximum extent practicable, that the United States has the capabilities necessary to successfully insert United States national security and supportive cyber payloads into cyberspace whenever such payloads are needed in cyberspace for the purpose of defending the freedom of action in and access to cyberspace by the United States and carrying out attacks in cyberspace pursuant to the defense of the United States and its interests.
(b) Included Actions.— The appropriate actions referred to in subsection (a) shall include, at a minimum, providing resources and policy guidance to sustain—
(1) the capability of delivering into cyberspace any cyber payload designated by the Secretary of Defense or the Director of Central Intelligence as a national security cyber payload; and
(2) a robust cyberspace infrastructure and industrial base from which to base the defense of the United States in cyberspace and to mount attacks in cyberspace as needed, pursuant to the provisions of law for cyberattack.
(c) Coordination.— The Secretary of Defense shall, to the maximum extent practicable, pursue the attainment of the capabilities described in subsection (a) in coordination with the Director of Homeland Security and the Director of National Intelligence.
We are just barely wading out into the new “cyber sea,” yet we have guidance from the past in shaping appropriate responses to the other domains of defense.
For a full draft of Title 10 Cyber Language with the Title 10 Space antecedents used for the Cyber language, click here.
***
*** Posted on March 11th, 2010
References
[1] William A. Owens, Kenneth W. Dam, and Herbert S. Lin, editors,” Technology, Policy, Law, and Ethics Regarding U.S. Acquisition and Use of Cyberattack Capabilities”, 2009, Committee on Offensive Information
Warfare, National Research Council, page 3-1.
———-