In 2012, then-Secretary of Defense Leon Panetta predicted that the United States faced the threat of a \u201cCyber Pearl Harbor,\u201d a devastating digital attack on critical national infrastructure. That single pronouncement would help to shape the nation\u2019s cyber strategy in the short term, and the ramifications of that warning continue to be reflected in Cyber Command\u2019s evolving mission today.<\/p>\n\n\n\n
When Panetta warned of a cyber Pearl Harbor, Cyber Command was still just getting on its feet. In an interview with Fifth Domain, the former secretary said he was aiming, in part, to let the nascent cyber agency\u2019s leaders know that the Department of Defense was in their corner.<\/p>\n\n\n\n
The cyberwarriors needed to hear \u201cthat we were supporting financially the efforts there to stay on the cutting edge, and that we were developing the plans that needed to be developed to ensure the United States would remain one of the strongest players in the cyber arena,\u201d Panetta said.<\/p>\n\n\n\n
The long game, Panetta said, was to shake up ordinary citizens, to awaken them to the seriousness of the situation at a time when the nation\u2019s cyber defenses were still in their formative stages.<\/p>\n\n\n\n
Gen. Keith Alexander, then the head of Cyber Command, warned in 2012 that American readiness for a major cyberattack was \u201caround a three [out of 10].\u201d Panetta knew he needed to sound the alert about that situation.<\/p>\n\n\n\n
\u201cThe American people needed to know that the potential for a paralyzing attack was there,\u201d Panetta said. \u201cWe had known that cyberattacks could be used to interrupt business, to gain intellectual property. We knew about hacking. But the fact that a sophisticated virus could be used to virtually paralyze our country, to take down our electric grid, take down our financial systems \u2026 that potential was there and real.\u201d<\/p>\n\n\n\n
The arrow found its mark. \u201cIt was a clarion call, evoking the specter of a horrific national disaster as a way to galvanize public support,\u201d said Edward Wittenstein, executive director of the Johnson Center for the Study of American Diplomacy at Yale. \u201cIt also communicated that urgency to members of Congress, whose support was needed for solidifying and resourcing Cyber Command.\u201d<\/p>\n\n\n\n
Given the hyperbole of the remark \u2014 something he describes as a form of \u201cshock therapy\u201d \u2014 Cyber Command\u2019s response may appear muted.<\/p>\n\n\n\n
In 2014, Panetta\u2019s successor, Defense Secretary Chuck Hagel, established a deliberately low-key tone in describing the cyber mission. Speaking at Fort Meade, Maryland, which is home to both Cyber Command and the National Security Agency, he said the United States would \u201cmaintain an approach of restraint to any cyber operations outside of U.S. government networks. The United States does not seek to militarize cyberspace.”<\/p>\n\n\n\n
He added that the United States wanted to leverage the internet as a \u201ccatalyst for freedom and prosperity\u201d instead.<\/p>\n\n\n\n
In hindsight, analysts today say the keyword \u201crestraint\u201d doesn\u2019t suggest that the Defense Department wasn\u2019t taking cyber seriously. Rather, Hagel may have been seeking a muted approach with Cyber Command\u2019s mission as a way to cool down, rather than heat up, potential use of cyber as a combatant arena.<\/p>\n\n\n\n
\u201cThere was a sentiment at the time that we should try to make cyberspace a peaceful place. We would reserve the right to use force there \u2014 but only as a last resort,\u201d Herbert Lin, senior research scholar at the Center for International Security and Cooperation and Hank J. Holland fellow at the Hoover Institution, told Fifth Domain.<\/p>\n\n\n\n
\u201cHagel was saying that we will exercise a policy of restraint, that we will not be very aggressive, that we will try to do everything diplomatically before resorting to force in cyberspace,\u201d Lin said.<\/p>\n\n\n\n
With cyberwarfare still a relatively new domain, some felt that any overly aggressive steps by the United States could lead to rapid escalation. Cyber Command at that time embodied \u201ca wariness about wading into cyberwarfare,\u201d said James Di Pane, a research assistant at the Heritage Center for National Defense. \u201cWe don\u2019t want to be the ones moving the goalpost and creating global norms where it is okay for countries to do that kind of thing.\u201d<\/p>\n\n\n\n
Today, Panetta explains what that \u201crestraint\u201d means in a military sense: to be prepared, but also to be circumspect. \u201cThe idea of restraint was that we have to be serious about the potential for this weapon, but that we can\u2019t panic. Rather, we have to be restrained in terms of our emotions.\u201d<\/p>\n\n\n\n
Today\u2019s cyber policy appears to be driving Cyber Command in a more proactive direction.<\/p>\n\n\n\n
The national cyber strategy, rolled out in September 2018, makes the case that the best defense is a good offense. Rather than merely fend off attacks, the United States would let our enemies know that the U.S. is not afraid to use cyber as a weapon. The United States will \u201censure adversaries understand the consequences of their malicious cyber behavior,\u201d according to the plan.<\/p>\n\n\n\n
The nation has since witnessed offensive cyber operations in action. In 2017 a Defense official confirmed the United States had been dropping \u201ccyber bombs\u201d on ISIS in a program dubbed Joint Task Force-Ares, led by Adm. Michael Rogers, then the head of Cyber Command.<\/p>\n\n\n\n
That program aimed \u201cto coordinate cyberspace operations against ISIS,\u201d Rogers said in written testimony to Congress. \u201cJTF-Ares\u2019 mission is to provide unity of command and effort for [Cyber Command] and coalition forces working to counter ISIS in cyberspace. The JTF model has helped USCYBERCOM to direct operations in support of USCENTCOM operations, and marks an evolution in the command-and-control structure in response to urgent operational needs.\u201d<\/p>\n\n\n\n
The JTF \u201cbrought cyber out of the shadows and successfully demonstrated the value and capabilities of cyberspace operations to the Joint Force when integrated as part of [a] broader coordinated military effort,\u201d then Lt. Gen. Paul Nakasone, commander of Army Cyber Command and JTF-Ares, wrote in congressional testimony.<\/p>\n\n\n\n
This kind of operation marks a new direction for Cyber Command and was reflected in an August 2017 move by the Defense Department, recommended by then-Secretary Jim Mattis, to elevate the agency to a standalone combatant command. Until then, it had been a sub-unified command under U.S. Strategic Command.<\/p>\n\n\n\n
\u201cThey now have the full operating capacity to conduct cyberwarfare. They have the people and the tools they need,\u201d Di Pane said.<\/p>\n\n\n\n
Experts say the new status, and the new approach, reflect the realities of the changed cyber landscape. There may not be an imminent Pearl Harbor: Most experts agree a single cataclysmic attack on national infrastructure seems unlikely, given the present posture of likely threat actors. But even smaller-scale attacks pose a hazard. The repeated cyber incursions unfolding daily could have a devastating cumulative effect on American infrastructure.<\/p>\n\n\n\n
\u201cIn the last five years the policy of restraint hasn\u2019t worked. People continue to break into our networks,\u201d Lin said. \u201cAnd Cyber Command doesn\u2019t want to just sit around and wait. No military guy wants to play defense all the time. They want to go on the offensive, and the new strategy calls for a much more aggressive posture.\u201d<\/p>\n\n\n\n
To effectively execute on that new strategy, Cyber Command may have to overcome new institutional or organizational hurdles.<\/p>\n\n\n\n
\u201cThey want to be like Special Operations Command, but right now Cyber Command is not postured to have that same level of success,\u201d said Jacquelyn Schneider, an assistant professor at the Naval War College. She noted she wasn\u2019t speaking for the Defense Department.<\/p>\n\n\n\n
\u201cThey need to set up processes to acquire technology and to execute on contracts. This is about the acquisition of software, and that\u2019s something DoD struggles with,\u201d she said. \u201cThere is no good model, so they will need to create all these institutional processes, while they are already dealing with major threats.\u201d<\/p>\n\n\n\n
Despite the hurdles, Panetta lauds the new alignment as appropriate to the current threat.<\/p>\n\n\n\n
\u201cYou\u2019ve got to fight fire with fire. The Russians would be thinking twice about doing what they are doing in our election process if they knew they were going to be paying a price for it,\u201d he said. \u201cThey have to know that it is not a free pass.\u201d<\/p>\n\n\n\n