Determining Hostile Intent in Cyberspace

Laser-guided bombs line flight deck of aircraft carrier USS John F. Kennedy in preparation for air strikes against Iraq during Operation Desert Storm (PH2 Lipski) Determining Hostile Intent in Cyberspace By Ramberto A. Torruella, Jr. kay, bogies have jinked back were inbound to the John F. Kennedy through the clutter, the Libyans relied on at me again for the fifth time. Carrier Strike Group. Two F-14 Tomcats guidance from shore-based radar stations O They’re on my nose now. Inside of VF-32 were assigned to intercept. for a ground-controlled intercept. The of 20 miles.” The Tomcats flew low, lost in the radar MiGs kept their noses pointed toward This was the report made by clutter kicked up by the sea’s surface, the Americans, hoping their radar would Commander Steven Collins, USN, Radar maneuvering several times to stay out burn through the clutter and give them Intercept Officer (RIO) of Gypsy 207, of the Libyan fighters’ engagement a chance to shoot first. It was clear the prior to arming his F-14’s radar-guided envelope. The Americans maintained Libyans wanted a fight. It was clear they missiles. Two Libyan MiG-23 Floggers a constant fire control lock on their had hostile intent. opponents. The MiGs matched each “13 miles. Fox 1! Fox 1!” the RIO American maneuver unerringly, ignoring shouted as the missiles left the rails of the the radar lock warnings growling in their Tomcat, initiating an engagement that Commander Ramberto A. Torruella, Jr., USN, is the Joint Staff J8 Models and Analysis cockpits. Because the radar on the MiG would end with two MiGs destroyed and Information Technology Support Branch Chief. fighters could not detect the Americans two Libyan pilots lost at sea (paraphrased 114 Features / Determining Hostile Intent in Cyberspace JFQ 75, 4th Quarter 2014 from “Splash Two MiGs,” an account of necessary to communicate complex Army experimented with a technology the 1989 Gulf of Sidra Incident).1 calculations. Commanders from Alex- that turned that land-based abstraction According to the Joint Chiefs of Staff, ander the Great to Napoleon used both (hold the high ground) into the start of hostile intent is defined as the threat of of these abstractions to send dispatches a useful warfighting domain; it started imminent use of force against the United in clear text and code—to communicate using balloons for aerial reconnaissance States, U.S. forces, or other designated with subordinates, coordinate actions of the battlefield.6 Soon, other countries persons or property.2 It is the indica- in real space, and hide their intentions experimented with using balloons for tion, the belief, a commander has that an from opponents. Eventually, special observation, bombing the enemy, or adversary is about to attack. That belief signal corps evolved to encrypt, trans- increasing the range of communications. provides the groundwork for “anticipa- mit, receive, and handle messages, first Most experiments met with modest tory self-defense,” an American legal at the rate of the written word and the success; the technology simply was not concept that allows a commander to at- horse, then at the rate of signal flags, robust enough to deliver consistent tack before being attacked.3 telegraphs, and flashing lights. Code battlefield results. From the point of view of the breakers ancient and modern fought a But once the airplane was invented, American pilots, the Libyan pilots showed silent war to understand enemy signals everything changed. Aerial reconnais- hostile intent by flying a vector toward and gain access to enemy information. sance became consistent and soon was the American Carrier Strike Group, But it was not until the late 20th vital to events on the ground. Artillery constantly maneuvering to threaten the century, when improvements in com- spotting was added to the airman’s list of American interceptors, and ignoring the munication and computing technology vital tasks as well as reconnaissance deep obvious warning signal of American fire raised the volume and velocity of data inside of enemy lines. Change occurred control radar locked onto their aircraft. flow from dozens of words per minute again when the first airman aimed a pistol Libyan actions gave the Americans the to 1.5 trillion words per minute, that the at an enemy observer in another aircraft. belief that an attack was imminent. The information domain gained enough sig- An arms race quickly ensued—planes Americans launched their own missile nificance to be treated as a warfare area in increased in number, specialized in strike as a result: a clear case of anticipa- its own right.4 An adversary with access to purpose, and carried specially developed tory self-defense, a preemptive attack that a commander’s data flow now possessed weapons meant to shoot down other spoils the anticipated attack of an enemy. a far richer set of information regard- aircraft. They flew faster and higher Interestingly, from the Libyan point of ing intentions and operations. More and fought for dominance of the air. view, the Americans also clearly showed importantly, if an adversary could deny Commanders now prioritized effects in hostile intent by constantly illuminating the commander necessary information the air over direct effects on the ground, the Libyan fighters with their fire control or, better yet, change information needed and air warfare, a new warfighting do- radar, the last step the Libyans would to make a decision, disastrous effects main, was born. detect prior to an American missile attack. could occur in real space. For instance, Determining hostile intent is often what if the Libyans were able to fool the Hostile Intent in an not this clear, but in this instance, within American radars and combat systems into Abstract Domain the physical realm of fighter jets, radars, believing their MiGs were farther away or Cyber warfighters learn from the evolu- and missiles, the evidence strongly sug- on a different vector? Would confusion tion of other domains, especially with gests that both parties demonstrated have ensued? Would the world be lament- regard to the legal authorities associ- hostile intent. ing (or celebrating) a different outcome? ated with the use of force and armed This is rarely the case in cyberspace. This is not the first time, and probably combat, the Law of Armed Conflict. not the last, that a change in technol- Just as aviators learned to apply the Law Information as a Weapon, ogy caused an abstraction to evolve into of Armed Conflict in their new domain, Cyberspace as an Abstraction a warfighting domain. Consider the so will commanders who operate in the The cyberspace realm is an abstraction, concept of the high ground. In the 6th cyber domain. with components located in a physi- century BCE, the military philosopher Cyberspace has its own unique chal- cal space but operations occurring in Sun Tzu plainly articulated the benefit lenges. Attributing a cyber attack is a nonphysical space, where the terrain of operations from the higher ground; difficult at best because commanders are is data and information is used as a a commander has greater visibility over rarely ever sure of the source of an attack weapon. This is not new. The ancient enemy movements and is better situated or intrusion, and establishing the forensic Phoenicians pioneered information as to defend against attack.5 It was even evidence needed to be certain is a time- an abstraction when they laid the foun- axiomatic in ancient times that military consuming and often imprecise science. dation for our alphabet, an abstraction possession of higher ground would Intentions are even harder to discern. necessary for transmitting concepts via greatly increase the chance of combat For example, does malware beaconing the written word. Medieval Arabs devel- success. During the late 18th century, to an Internet protocol address in China oped our number system, an abstraction however, the French Revolutionary indicate an attempt to steal data? Is it a JFQ 75, 4th Quarter 2014 Torruella 115 F-14D Tomcat conducts mission over Persian Gulf region (U.S. Air Force/Rob Tabor) precursor for establishing a botnet? Is Classifying Use of Force point of view instead of an effects-based the malware even Chinese? Is placing in Cyberspace point of view of limiting coercion.9 This malware even considered a use of force? Article 2, Paragraph 4, of the United means that the framers intentionally Unfortunately, there is little to no inter- Nations (UN) Charter specifically states sought to limit how coercion could be national consensus on what constitutes a that “All Members shall refrain in their performed in international politics, not use of force in cyberspace.7 international relations from the threat limit the effects of coercion on a target This article discusses the legal au- or use of force against the territorial nation. For instance, armed attacks and thorities to use force in cyberspace. It integrity or political independence kinetic strikes are not authorized, nor discusses what constitutes the use of force of any state, or in any other manner are blockades, bombardments, or any in cyberspace and how a commander can inconsistent with the Purposes of the other classic use of military power, except determine if an opponent intends to use United Nations.” Force, in this case, in self-defense or as authorized by the force against the United States or its assets does not mean coercion, but the use UN Security Council for the peace and and interests. The article builds on a ru- of armed force as a tool of coercion or security of the international community. bric developed by Michael Schmitt to help persuasion. Matthew Waxman notes However, diplomatic isolation and eco- identify hostile intentions in cyberspace that the framers of the UN Charter did nomic coercion are perfectly authorized and, using a spectrum of cyber activity not set out to end coercive behaviors in by the charter.

Load more