A secret review of American policies governing the use of cyberweapons has concluded that President Barack Obama has the broad power to order pre-emptive strikes on any country preparing to launch a major digital attack against the U.S.
The review is part of an ongoing effort by the Administration to develop new ground rules for U.S. engagement in cyberspace. Over the next few weeks the administration will work on approving rules for how the military can defend or retaliate against cyberattacks launched by unfriendly nation states, says a report in The New York Times.
The rules will also spell out how far U.S. intelligence agencies can go in looking for and mitigating imminent threats against U.S. assets in cyberspace, The Times reported, quoting unnamed sources. It would spell out situations where the military, with presidential approval, would be allowed to go out and preemptively inject destructive code on an adversary's networks, the report noted.
The order would also provide for exceptions where the military would be permitted to carry out preemptive cyberattacks of a tactical nature where executive approval would not be necessary
The highly classified rules have been under development for nearly two years and are apparently a response to growing concerns about crippling attacks against U.S. critical infrastructure targets by enemy states.
The new policies would continue to bar the military from defending domestic civilian targets against most cyberattacks, since that would be a task carried by the U.S. Department of Homeland Security. However, in the event of a major cyberattack the rules would allow the Pentagon to become involved. The threshold for what constitutes a major event will be deliberately kept shrouded to confound adversaries.
News of the administration's plans to develop new rules of engagement in cyberspace follows the recent disclosure that the Pentagon is planning on adding as many as 4,000 more troops and civilians to its Cyber Command. The goal of the planned staffing increase is to create three separate types of cyberforces each tasked with specific roles and responsibilities. The cyberforce structure will include Cyber National Mission Forces, Cyber Combat Mission Forces and Cyber Protection Forces, a military official said.
Together, the moves constitute a broad ranging effort by the government to come up with a strategic policy for dealing with online threats. The U.S. is already regarded as having a fairly aggressive posture in cyberspace. The Stuxnet attacks in 2010 that temporarily took out nearly one-fifth of the 5,000 centrifuges that Iran had operating at the Natanz nuclear facility for example is believed to be one example of a pre-emptive strike that has already taken place.
Though the U.S. government has never officially conceded to its role in the attack many with the government have anonymously admitted to its involvement in creating and deploying Stuxnet.
Sign up for CIO Asia eNewsletters.