As US officials loudly argue over how to best go about hacking foreign governments, other countries are taking note, and an international hacking arms race seems to be picking up pace.
Of the many unexpected topics that came into play in this year’s cartoonish US presidential election, one that received considerable attention was Russian hacking and offensive cyber operations. Vice President Joe Biden even went as far as suggesting in October that America would hack back, “sending a message” to Russia “at the time of our choosing.” Meanwhile, Congress and intelligence officials have been publicly debating a more definite split between the National Security Agency and US Cyber Command, apparently with the aim of creating a better legal basis for offensive cyber operations.
All of this chatter, however, has had its consequences. “State actors are experimenting with offensive cyber capabilities,” notes a new five-year cyber-security plan for the UK that was released in the wake of Biden’s comments.
“Five years ago, countries were loathe to openly talk about offensive cyber capabilities, with many only referencing defensive capabilities in what could be gleaned from official doctrine,” writes Alex Grigsby of the Council on Foreign Relations. “Now, the UK is open about the need to invest in its National Offensive Cyber Program to ensure that UK capabilities ‘can be deployed at a time and place’ of its choosing.” The language used here is noticeably similar to Biden’s.
The UK report defines “offensive cyber capabilities” as those that “involve deliberate intrusions into opponents’ systems or networks, with the intention of causing damage, disruption or destruction.”
“Offensive cyber forms part of the full spectrum of capabilities we will develop to deter adversaries,” it continues, “and to deny them opportunities to attack us, in both cyberspace and the physical sphere. Through our National Offensive Cyber Programme (NOCP), we have a dedicated capability to act in cyberspace and we will commit the resources to develop and improve this capability.”
Though Biden’s comments seemed to have fairly direct implications, it is unclear what, if anything, US military and intelligence agencies will actually do to strike back in response to alleged Russian election meddling, especially following Donald Trump’s win. “Although the White House has asked for retaliation options, U.S. intelligence agencies haven’t been ordered to launch a robust response to the leaks, a U.S. official said on condition of anonymity to discuss internal deliberations,” the L.A. Times reported a few days before the election.
Even if the US launches no major “offensive” cyber operation against Russia, it is clear that America has the capabilities to take such actions, as demonstrated by the theft and auction of NSA “cyber weapons” in August. For a country like the US, though, that tries to rely so heavily on an image of representing morally exceptional democratic values, public relations concerns may prevent the kind of full scale response some are arguing for.
“One thing the White House should be wary of,” noted a Bloomberg editorial on the eve of the election, “is employing its own arsenal of cyberweapons. Such implements are inherently unpredictable. They risk revealing capabilities that might later come in handy. And the U.S. has far more to lose from an escalating cyber conflict than does Russia. Better to use the tools — legal, diplomatic and political — that have proved effective in the past.”
The Bloomberg piece notes that such diplomatic efforts have been successful in reaching an understanding with China that has reduced hacking. But the US, it notes “has no such understanding with Russia. Getting there will require a similar combination of threats and compromises, carrots and sticks. Russia is a much-diminished power, and its intrusions signify only weakness. But the U.S. still needs its cooperation on many issues, from space to Syria. It should make clear that interfering with an American election will have a price. But the price shouldn’t be needlessly steep.”
The editorial board that wrote that, like most in the media, probably expected Hillary Clinton to easily win the election. They may view things differently now. Nonetheless, it remains to be seen whether, given a chance for the heated rhetoric of the US election to subside, talk of international cyber warfare will similarly dissipate, or if the digital arms race will instead continue to escalate.