This year, acknowledging the growing threat of digital attacks on American infrastructure and networks, the Defense Department announced its first strategy for cyber warfare. Introducing the new document in July, Deputy Defense Secretary William J. Lynn III stated that under this plan, “the Defense Department is treating cyberspace as an operational domain, like land, air, sea, and space.” Kurt Bertone, vice president at Fidelis Security Systems, explains, “Designating cyberspace an operational domain allows them to do things preemptively, such as organizing, training, and investing [for cyber war], just as they would for an air war.”
The new strategy harkens back to the 1999 National Space Policy, which similarly declared outer space “a medium like land, sea, and air.” What is missing, at least from the unclassified version of the document, is a clear statement that the United States has the right to retaliate against attacks with offensive capabilities.
This is hardly a theoretical matter. Last year the Stuxnet virus, designed by unknown parties to sabotage the Iranian nuclear program’s centrifuges, demonstrated that cyber attacks can destroy physical objects. How would the United States respond if a cyber attack took down, for example, civilian air traffic control? Would the Pentagon launch a concrete military response, such as attacking a country that harbors cyber villains? Despite such lingering questions, merely having a strategy is a big step forward for a nation that six or seven years ago was still in the process of getting email for its FBI agents.
