UNIVERSITY OF READING U.S. Strategic Cyber Deterrence Options Doctor of Philosophy in Politics Department of Politics & International Relations Scott Jasper March 2018 1 Contents Abstract......................................................................................................................... 3 List of Abbreviations..................................................................................................... 4 Introduction................................................................................................................... 7 Section One: Thinking about Deterrence Chapter I: Literature Review........................................................................................59 Chapter II: Global Cybered Conflict...........................................................................120 Chapter III: Theoretical Foundations..........................................................................158 Section Two: Contemporary Deterrence Strategies Chapter IV: Deterrence by Retaliation.........................................................................198 Chapter V: Deterrence by Denial................................................................................. 234 Chapter VI: Deterrence by Entanglement.....................................................................269 Section Three: A New Strategic Option Chapter VII: Active Cyber Defense..............................................................................307 Conclusion.....................................................................................................................343 Appendix.......................................................................................................................381 Bibliography..................................................................................................................406 2 Abstract The U.S. government appears incapable of creating an adequate strategy to alter the behavior of the wide variety of malicious actors seeking to inflict harm or damage through cyberspace. This thesis provides a systematic analysis of contemporary deterrence strategies and offers the U.S. the strategic option of active cyber defense designed for continuous cybered conflict. It examines the methods and motivations of the wide array of malicious actors operating in the cyber domain. The thesis explores how the theories of strategy and deterrence underpin the creation of strategic deterrence options and what role deterrence plays with respect to strategies, as a subset, a backup, an element of one or another strategic choice. It looks at what the government and industry are doing to convince malicious actors that their attacks will fail and that risk of consequences exists. The thesis finds that contemporary deterrence strategies of retaliation, denial and entanglement lack the conditions of capability, credibility, and communications that are necessary to change the behavior of malicious actors in cyberspace. This research offers a midrange theory of active cyber defense as a way to compensate for these failings through internal systemic resilience and tailored disruption capacities that both frustrate and punish the wide range of malicious actors regardless of origin or intentions. The thesis shows how active cyber defense is technically capable and legally viable as an alternative strategy in the U.S. to strengthen the deterrence of cyber attacks. 3 Abbreviations A2/AD Anti-access/Area denial ACD Active Cyber Defense AIS Automated Indicator Sharing APT Advanced Persistent Threat BPHS Bulletproof Hosting Services CBM Confidence-Building Measure CFAA Computer Fraud and Abuse Act CIS Center for Internet Security CISP Cybersecurity Strategy and Implementation Plan CMF Cyber Mission Force CSC Critical Security Controls DCO Defensive Cyberspace Operations DDoS Distributed Denial of Service DHS Department of Homeland Security DIUx Defense Innovation Unit Experimental DNC Democratic National Committee DNS Domain Name System DOD Department of Defense EEZ Exclusive Economic Zone EU European Union FBI Federal Bureau of Investigation FS Financial Services FTP File Transfer Protocol GDP Gross Domestic Product GLACY Global Action on Cybercrime GOP Guardians of Peace G-20 Group of Twenty GPS Global Positioning System 4 GSCI Global Socio-Cyber Infrastructure HM Her Majesty’s HTTP(S) Hypertext Transfer Protocol (Secure) IACD Integrated Adaptive Cyber Defense ICANN Internet Corporation for Assigned Names and Numbers ICMP Internet Control Message Protocol ICS-CERT Industrial Control System – Computer Emergency Response Team ICT Information and Communication Technology IDM Internal Defensive Measures IP Intellectual Property IP Internet Protocol ISAC Information Sharing and Analysis Center ISIS Islamic State of Iraq and Syria NSA National Security Agency NATO North Atlantic Treaty Organization NCCIC National Cybersecurity and Communications Integration Center NIST National Institute of Standards and Technology NTP Network Time Protocol OPM Office of Personnel Management OSCE Organization for Security and Co-operation in Europe PII Personally Identifiable Information PIN Personal Identification Number POS Point-of-Sale PPD Presidential Policy Directive PLA People’s Liberation Army RA Response Actions RAM Remote Access Memory RAT Remote Access Trojan SIEM Security Information and Event Management SSL Secure Sockets Layer 5 STIX Structured Threat Information eXpression SQL Structured Query Language TAXII Trusted Automated eXchange of Indicator Information TTP Tactics, Techniques and Procedures UK United Kingdom UN United Nations UNCLOS UN Convention on Law of the Sea URL uniform resource locator XML Extensible Markup Language 6 Introduction Headlines in May 2017 were dominated by the massive WannaCry ransomware attack that hit 74 countries across Europe and Asia, affecting more than a dozen hospitals in England’s National Health System.1 Even worse than this criminal activity is the threat to critical infrastructure as seen by the malware infections at electrical distribution companies in Ukraine that caused outages to 225,000 customers in late 2015. 2 Furthermore, recent reports on alleged Russian hacks into the U.S. Democratic National Committee and the staff of French candidate Emmanuel Macron, coupled with subsequent release of emails or content in coercive campaigns to apparently influence Presidential Elections have brought national attention to the inadequacy of cyber deterrence. 3 All sectors of the economy rely on the networks, systems, and services that form cyberspace.4 Information and Communication Technologies [ICTs] form the technical backbone of these networks and are equally essential to the defense sector, especially during the conduct of military operations. Yet protecting cyberspace is challenging because it is currently borderless, subject to dynamic change, and open to all comers. The cybered society is probed and penetrated by nation states, hacker groups, criminal organizations, and terrorist groups or lone wolves. These entities called malicious or threat actors can be partially or wholly responsible for 1 Robert McMillian, Jenny Gross, and Denise Roland, “Major Cyberattack Sweeps Globe, Hitting FedEx, U.K. Hospitals, Spanish Companies,” The Wall Street Journal, May 12, 2017. 2 Electrical Information Sharing and Analysis Center, “Analysis of the Cyber Attack on the Ukrainian Power Grid,” March 18, 2016: 1-25. 3 Adam Nossiter, David E. Sanger and Nicole Perlroth, “Hackers Came, But the French Were Prepared,” New York Times, May 10, 2017. 4 The basis of this introduction first appeared in Strategic Studies Quarterly Vol. 9, No. 1 (Spring 2015). The thesis is drawn from recent publication of my book titled Strategic Cyber Deterrence: The Active Cyber Defense Option (New York, Rowman & Littlefield: July 2017). 7 a cyber incident that dramatically reduces an organization’s security.5 Many of these malicious actors seek state secrets, trade secrets, technology, and ideas, or they develop the ability to strike critical infrastructure and harm advanced economies.6 Hacker groups and criminal gangs often work in concert with state actors, under some form of control, direction, incitement or other more nebulous arrangement. That intertwined relationship allows foreign governments to hide their malicious activity and claim innocence if confronted.7 In addition, malicious actors use common tools, techniques and talent, available for purchase at very low prices on illicit web sites on the worldwide underground market.8 This convergence of actor relationships, motivations, tactics, and capabilities complicates attribution of an attack9 and makes using a single option to change the behavior of an individual actor, such as the nation state, impossible and impractical to counter cyber attacks. Malicious actor attacks, via cyberspace, target “an enterprise’s use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/ infrastructure; or destroying the integrity of the data or stealing controlled information.”10 Recent incidents show cyber attacks are employed and refined in a systematic, coordinated manner in an effort to achieve actor objectives. Criminal exploitation, military or 5 Ivy Wigmore, “Threat Actor Definition,” Security Threats and Countermeasures Glossary, January 2016. 6 Robert Anderson, Jr. “Cybersecurity, Terrorism, and Beyond: Addressing Evolving Threats to the Homeland,” testimony before the Committee