WASHINGTON \u2014 The U.S. needs to coordinate with the international community in identifying and punishing those behind cyberattacks to deter future hacks, according to a co-chair of the Cyber Solarium Commission.<\/p>\n\n\n\n
In testimony before the House Armed Services Subcommittee on Intelligence and Emerging Threats and Capabilities, Sen. Angus King, I-Maine, called for a two-pronged approach to deter cyber-based espionage operations, attempts to disrupt U.S. banks, and widespread online influence campaigns. His recommendation included increased international cooperation to call out and punish such activities, and for the U.S. to create a stronger declaratory policy.<\/p>\n\n\n\n
The Cyber Solarium Commission, a bipartisan organization created in 2019 to develop a multipronged U.S. cyber strategy, delivered a report in March advocating for multiple cyber deterrence efforts.<\/p>\n\n\n\n
King said the U.S. hasn\u2019t done a good job imposing costs against adversaries who conduct these cyber operations.<\/p>\n\n\n\n
\u201cWe\u2019ve become a cheap date in cyber,\u201d he said, echoing similar comments made by Gen. Paul Nakasone, commander of U.S. Cyber Command, during his 2018 confirmation hearing for the post.<\/p>\n\n\n\n
\u201cWe can be attacked \u2026 and there\u2019s no real consequences, there\u2019s no real results, there\u2019s no cost paid by our adversary,\u201d King said. \u201cWe\u2019ve got to make adversaries go through a cost calculation saying, \u2018Well, if we do this, they might do something else to us and it may not be cyber, it may be sanctions, it may be other kinds of a response,\u2019 but we have to establish that there will be a response. Otherwise, because cyber is a relatively cheap form of aggression, it will continue to happen.\u201d<\/p>\n\n\n\n
King said international definitions of what constitutes cyberwar are still in their infancy, and the United States must be an active participant in setting standards, guardrails and the norms for activity in cyberspace, so when the country does respond to a cyber incident, it\u2019s not doing so alone.<\/p>\n\n\n\n
In recent months, large coalitions have called out and exacted punitive measures against cyber actors. In February, a coalition of more than 10 nations issued statements condemning Russian behavior<\/a> against the country of Georgia. And this week, the European Union issued the first set of cyber sanctions<\/a> against Russian and North Korean entities for a range of cyber activities dating back three years.<\/p>\n\n\n\n However, it is unclear how effective these measures have been, as actors continue to conduct cyberattacks.<\/p>\n\n\n\n For its part, the United States has not ruled out physical military retaliation for cyber action, but it\u2019s unlikely it will risk a violent conflict over cybertheft or the defacement of websites. The military has come under fire recently for statements that appear to undermine the existence of international norms and laws in cyberspace.<\/p>\n\n\n\n \u201cWe\u2019re not fighting an enemy that people can see,\u201d said Chief of Naval Operations Adm. Michael Gilday, as quoted in a tweet from U.S. Cyber Command. \u201cAnd we\u2019re not fighting a war where international norms exist. But make no mistake, we are in conflict day-in and day-out in the cyber realm and you all are on the front lines.\u201d<\/p>\n\n\n\n That position irked some in the international cyber arena as undermining international rules.<\/p>\n\n\n\n \u201cFrustrating the \u2018no international norms\u2019 myth sticks around. If there are no international norms then there\u2019s showing any restraint ourselves is a sucker bet. No one else is restrained, so why should we be? It\u2019s a crap argument,\u201d Jason Healey, a senior research scholar at Columbia University, tweeted <\/a>in response. \u201cSaying there are \u2018no international norms\u2019 for cyber conflict is ignorant, wrong, and dangerous. Often someone is just parroting what they\u2019ve heard. Others specifically say it [because] they want fewest restraints on US cyber actions.\u201d<\/p>\n\n\n\n \u201cConflicting messages, like the one below amplified by @US_Cybercom yesterday, undermine progress in developing and enforcing such limits,\u201d tweeted<\/a> Kristen Eichensehr, an assistant professor of law at UCLA Law School.<\/p>\n\n\n\n \u201cU.S. CyberCom: the Russians and Chinese are conducting massive cyber attacks against the U.S. This is an outrage, they must stop! Also U.S. CyberCom: there are no rules in cyberspace. Errm, if so, Russia and China do not violate any rules. So why should they stop,\u201d tweeted<\/a> Przemys\u0142aw Roguski, a lecturer in international law at Jagiellonian University in Poland.<\/p>\n\n\n\n The second prong of King\u2019s deterrent approach involves a greater declaratory policy, because \u201cif you don\u2019t tell your adversary that you\u2019ll respond, then it\u2019s not a deterrent,\u201d he said. \u201cI think we need to have a much clearer statement of our doctrine, of our strategy so that adversaries know that they will, in fact, pay a price.\u201d<\/p>\n\n\n\n U.S. defense officials have begun speaking more bombastically about their intentions and are attempting to signal to adversaries that malign activity is not acceptable.<\/p>\n\n\n\n Cyber Command and the National Security Agency \u201care going to know our adversaries better than they know themselves, we\u2019re going to broaden our partnership and we\u2019re going to act when we see adversaries attempting to interfere in our elections,\u201d a July 24 tweet <\/a>from Cyber Command read. This mirrors statements made by Nakasone on July 20 at an Association of the U.S. Army event, during which he said the security of the 2020 elections is his top priority.<\/p>\n\n\n\n