Private Companies Will Be The Core Of A New “Offset” Strategy Against Cyber Attacks

Cyber warfare is not a future threat. It is a real, here and now danger to the security of the West. Some nations such as Russia have already employed cyber attacks as part of their integrated offensive operations. Others, China for example, are withholding their fire, preferring to employ their cyber troops for a combination of military, economic and intelligence preparation of the battlefield. We are still in the early stages of what could be a new revolution in military affairs, perhaps like the period just before the start of the First World War, when the military applications of the internal combustion engine to combat on land and in the air was mostly speculative. But make no mistake, as Jarno Limnell, Director of Cyber Security for McAfee pointed out in a recent article for Breaking Defense, we are in a new era:

“One trend in security is clear: the rapidly increasing use of cyberspace to pursue political goals and seek geostrategic advantage. Nation-states are pouring massive amounts of money into developing technological capabilities and hiring skilled people. There are already about 35 countries with both the capabilities and doctrines to conduct offensive cyber operations. The world is moving toward a greater strategic use of cyber weapons. The reality is that if you want to be a credible player in world politics, in economics, and on the battlefield, you must possess strong cyber capabilities.”

During the Cold War, the United States and its allies came up with two strategies to “offset” the Soviet Union’s advantage in conventional military power. The first was the threat of nuclear escalation based on a massive and sophisticated arsenal of strategic, theater and tactical nuclear weapons. When the Soviet Union achieved nuclear parity with the West, our offset strategy shifted to the exploitation of advances in electronic and information technology that allowed the deployment of stealthy aircraft, precision-guided weapons and systems for electronic warfare.

Now a third offset strategy is needed, one to counter the strategic use of cyber weapons by both state and non-state actors. Unlike the previous two offset strategies, really unlike any prior revolution in military affairs, this one will not be the product of government investments in advanced technologies such as nuclear power or stealth coatings. Nor will the military be the sole or even principal wielders of this new strategic capability. Private companies will be the core of a new offset strategy against cyber threats. There are a number of reasons for this. First, the rate of change in cyber security technology and methods is concentrated in the private sector. Second, most of the critical infrastructure that requires protection from cyber attacks is in private hands too. Third, military institutions, actually governments in general, are just too slow at understanding the rapidly changing state-of-the-art technologies and acquiring cyber capabilities. Finally, many of the people who make the best cyber warriors are the least suitable for membership in a hierarchical, rules and tradition-driven organization – even if they could pass the physical.

Private companies, many in the United States, but others in Israel, the United Kingdom, Sweden and Finland, are at the forefront of developing the technologies, organizations, trained personnel and strategies for engaging on this new battlefield. Some are major defense companies such as Lockheed Martin, BAE Systems and General Dynamics. Others are smaller, more specialized defense-oriented operations like ManTech and Kingfisher Systems. Then there are companies that are primarily commercial like McAfee that not only provide cyber security software and services for individuals and other companies but also help protect government networks. In this field, these companies have proven to be agile and innovative. They have a vast array of tools, methods and strategies for dealing not only with external attacks but the more insidious and probably more dangerous insider threat. Because no single technique, program or data base will provide a complete solution to the cyber threat, there is a need for an array of solutions that can provide a layered defense capability. If the entrepreneurial and creative energies of Western cyber firms are unleashed, I believe they will be able to outpace and out maneuver our adversaries.

The key to a successful offset strategy will be to rely on the private sector for most of the innovation in cyber warfare while carefully thinking through what specific roles and missions can be delegated and which are inherently governmental or even military in nature. It is possible that much of the defensive mission, particularly with respect to the homeland, can rest with the private sector. What about strategic cyber offensive actions?

As Mr. Limnell points out in his article, there are also policy, strategy and legal issues regarding cyber warfare to be addressed with U.S. allies. If Russia moves against Ukraine, NATO may find itself under cyber attack from shadowy groups. Can the Alliance defend itself against such attacks and how will it respond? It would be wise to know the answers before the next war starts.