Analysis: USAF's cyber offense capability

Procurement documents from the U.S. Air Force give a rare glimpse into the Pentagon's plans for developing an offensive cyberwar capacity that can infiltrate, steal data from and if necessary take down enemy information technology networks.

The Broad Area Announcement, posted Monday by the Air Force Research Laboratory's Information Directorate in Rome, N.Y., outlines a two-year, $11 million effort to develop "access to any remotely located open or closed computer information systems," lurk on them "completely undetected," "stealthily exfiltrate information" from them and ultimately "be able to affect computer information systems through Deceive, Deny, Disrupt, Degrade, Destroy (D5) effects."

"Of interest," continues the announcement, "are any and all techniques to enable user and/or root level access to both fixed (and) mobile computing platforms ¿¿ (and) methodologies to enable access to any and all operating systems, patch levels, applications and hardware."

The announcement "reflects the fact that the Department of Defense views information operations as critical to success in modern warfare," Air Force spokeswoman Larine Barr told United Press International, and is designed to "ensure that Air Force Cyber Command stands up on the leading edge of technology and expertise."

The announcement is the latest stage in the Air Force's effort to develop a cyberwar capability and establish itself as the service that delivers U.S. military power in cyberspace. Last year the Air Force announced it was setting up a Cyber Command, alongside its Space and Air Commands, and was developing military doctrine for the prosecution of cyberwar operations.

The United States is not alone in thinking along these lines, and NATO announced Wednesday that seven European nations had signed up to participate in a cyberdefense Center of Excellence in Tallinn, Estonia, which suffered a cyberattack last year that many officials believe was orchestrated by Russia.

The center will conduct research and training on cyberwarfare and include a staff of 30 persons, half of them specialists from the sponsoring countries of Estonia, Germany, Italy, Latvia, Lithuania, Slovakia and Spain, according to a statement from NATO.

The developments highlight the murky legal territory on which the cyberwars of the future will be fought: terrain on which attackers can cloak their identity and use as weapons the home computers of unsuspecting Web surfers that have been recruited to so-called botnets -- networks of PCs that unbeknownst to their owners have been compromised by hackers.

The cyberattack on Estonia last year, for instance, was carried out by botnets, and Russian officials have denied any involvement.

In a recent article for the Armed Forces Journal, Col. Charles Williamson, a staff judge advocate for the USAF Intelligence, Surveillance and Reconnaissance Agency, argued that computer users whose equipment was recruited to botnets because they failed to patch their systems could not properly be considered innocent bystanders.

"If the United States is defending itself against an attack that originates from a computer which was co-opted by an attacker, then there are real questions about whether the owner of that computer is truly innocent. At the least, the owner may be culpably negligent, and that does not, in fairness or law, prevent America from defending itself if the harm (from an attack) is sufficiently grave," wrote Williamson in the article, which officials were keen to stress does not represent U.S. policy.

More importantly, because of the difficulties in identifying attackers and immediately quantifying damage from a cyberattack, it can be hard to determine when such attacks constitute an act of war -- as opposed to crime or even vandalism.

"The speed and anonymity of cyberattacks makes it very hard to distinguish what actions would be those of terrorists, criminals, nation states or just some lone prankster," said Gen. William Lord, who heads up the new Cyber Command.

The legal minefield that U.S. cyberwarriors must negotiate was spelled out in an analysis prepared by the Defense Department general counsel.

"It would be useful to create a process for determining when the response to a computer intrusion should shift from the customary law enforcement and counterintelligence modes to a national defense mode," reads the analysis.

"No one's come out and defined that yet," Cyber Command spokeswoman Karen Petitt told UPI, adding that the Air Force saw its role as developing capabilities for cyberwar, but that the decision about when and how to use those capabilities would be one for the national leadership.