Fedscoop takes note of an announcement:
Shawn Turskey [Executive Director for U.S. Cyber Command] told a small audience of predominantly security software vendors and government officials the command unit is looking for tools that can be definitively traced back to the United States military, diverging from the ultra-stealth exploits often used at bureaus like the National Security Agency.
“In the intelligence community you never want to be caught, you want be low and slow, you never really want to be attributed. There’s a different paradigm from where you are at in the intelligence community,” said Turskey, who leads the Department of Defense’s capability and tool development project within Cyber Command. “But there’s another space over here, where maybe you definitely want to be louder, where attribution is important to you and you actually want the adversary to know.”
The development of “loud” offensive cyber tools, able to possibly deter future intrusions, represent a “different paradigm shift” from what the agency has used to in the past, Turskey said.
Dr. Herb Lin asks some questions, via Lawfare, with this amongst them:
4. Is enabling a national attribution marker required by the laws of war? Fighter planes and cruise missiles carry a U.S. insignia; soldiers wear U.S. uniforms. But bullets do not. Is a cyber weapon more like a platform or soldier, or more like a bullet?
These cyberwarriors1 of which they speak are soldiers, but the end result, while non-kinetic, non-explosive, is more like a bullet. Which means that branding the final attack instrument is a tactical question, not a legal question, at least in my pragmatic view. I suppose someone can make a law requiring attacks to be branded – but who will pay attention? Laws’ efficacy, particularly in war, lies to some extent in its probability of effective enforcement, and also in your fear that if you use some illegal tactic, so will your enemy. So far, I’d say the probability of enforcing such a law is low, and the fear of attack from an anonymous source, vs a known source, isn’t all that significant.
1“Cyberwarriors” made me tired even before I read it.
