There is something about the cyber domain that makes people lose perspective. The latest cyberspace incident is a perfect example.<\/p>\n\n\n\n
According to the news, a foreign actor, most likely Russia, infected a much-used software program with malware that allowed it to access the accounts of those U.S. agencies that used the program. The goal seems to have been to collect (i.e., spy) on these organizations.<\/p>\n\n\n\n
This cyberspace incident is a classic case of espionage through a system breach executed via a software supply-chain compromise by Russian actors. Many U.S. agencies were penetrated, without their knowledge, and the access to these systems reportedly was maintained for many months and may be ongoing today. If the Russians have this sort of cyber espionage tradecraft, you can be sure the Chinese have, or soon will have, it too.<\/p>\n\n\n\n
However, the event was not, as widely characterized, a \u201ccyberspace attack.\u201d To call it such is to minimize the consequences of a real cyberspace attack, an event where actual functional denial occurs in cyberspace or one of the physical domains. It was not, if the news accounts are correct, an \u201carmed attack\u201d or even likely an example of \u201carmed conflict.\u201d No \u201carms\u201d were used, unless Russia left behind code that would allow disruption or destruction of infected computers upon subsequent command. If the malware left behind can be used to allow malicious code to be delivered sometime in the future that destroys or degrades these U.S. computers, then this attack-preparation malware left behind might permit a future-armed attack. Ransomware events are examples of actual cyberspace attack, since they deny functionality.<\/p>\n\n\n\n
In cyberspace, some code used to maintain access to a target for intelligence collection can also be used later to deliver weapons. So far, this case appears to be one of collection only, albeit a significant one. Affected agencies will now spend millions of dollars clearing their systems of this infected code, eliminating adversary access.<\/p>\n\n\n\n
Historically, no act of espionage has ever been treated as an \u201cact of war\u201d by any president, the one and only person who decides whether any event is \u201can act of war.\u201d Others can have opinions, but no one else but the commander-in-chief makes this call. No legal definition exists for when a cyberattack would constitute an act of war. There is no policy, doctrine or fixed criteria to guide the president in making such a determination, however, and only the U.S. Congress can declare war on another state.<\/p>\n\n\n\n
By contrast, the 2014 North Korean attack on Sony Pictures was indeed a cyberspace attack, since its denial effects included destruction of Sony computers and proprietary information, and the extortion though the threat of more destruction and physical violence to theatergoers. Although it may have been justified, President Barack Obama declined to call it an act of war; he even declined to call it an attack, but instead called it merely a cyber nuisance. Such decisions are always political in nature, made in consideration of many factors, only one of which is the actual effect in cyberspace.<\/p>\n\n\n\n
There is no statute of limitations on declaring something an act of war, so it is conceivable that the current or future president could declare the Russian espionage an act of war, but it would be historically unprecedented.<\/p>\n\n\n\n
No American was killed, and no U.S. computer, as far as press reports explain, has been damaged, destroyed or made inoperable. In other words, there was no functional denial of systems, only exploitation and espionage. Calling these acts an \u201cattack,\u201d \u201cact of armed conflict,\u201d or \u201can act of war\u201d is inconsistent with the doctrines and understanding of war and serves only to confuse and mislead.<\/p>\n\n\n\n
This clarification is not meant to downplay the significance of the espionage. It is noteworthy in scope, tradecraft, cleverness and scale. The Russians likely now have insight into many U.S. programs, policies, attitudes, plans, command and control, and technology, which may give it enormous advantage in negotiations, defense planning, policy formation, foreign affairs and intelligence.<\/p>\n\n\n\n
Policymakers and politicians who are calling for punishment seem to envision inflicting some level of retribution to dissuade Russia from conducting subsequent acts of espionage via cyberspace. That will not be easy. Espionage via cyberspace is something the U.S. intelligence community conducts too. Russia knows the U.S. conducts such cyberspace operations, and assumes the country will continue such espionage.<\/p>\n\n\n\n
The current or future president may wish to respond via cyberspace or by leveraging other elements of national power, but such steps are not likely to dissuade Russia from conducting cyberspace espionage altogether. At best, Russia will become more circumspect (but therefore more advanced) in its techniques and procedures.<\/p>\n\n\n\n
All U.S. agencies should be assisting each other with protection (i.e., security and defense) of government cyberspace. Indeed, having strong security and internal defensive measures is by far the best deterrent to malicious cyberspace activity.<\/p>\n\n\n\n
Russia and China are near-peer cyberspace powers today. Russia is particularly stealthy; China overwhelms adversaries with superior numbers of forces and operations. Russia conducts espionage and influence operations via cyberspace. China conducts espionage, influence operations, and steals U.S. and allied intellectual property through cyberspace. Neither state cares that we know what they do.<\/p>\n\n\n\n
No domain of operations is as disastrous to the United States\u2019 strength, prosperity and commitment to the rule of law as cyberspace, which has allowed authoritarian states to recover from their political backwardness and challenge the U.S. and Western notions of sovereignty, rule of Western law, and accepted notions of international behavior. Cyberspace allowed the unipolar world to collapse into a multipoplar world, where authoritarianism now enjoys some semblance of global respect and comparable power. The locus of political competition has shifted to cyberspace \u2014 and cyberspace is delivering for the malicious, authoritarian states of the world.<\/p>\n\n\n\n
James Van de Velde is an adjunct faculty member at George Mason, Johns Hopkins and the National Intelligence University. The views expressed in this article are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. government.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
A expert explains how a recent giant hack is a classic case of espionage that differs from a true cyberspace attack.<\/p>\n","protected":false},"author":7,"featured_media":25931,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":24,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"10":{"categories":["opinion","daily-news-roundup","newsletters","commentary"],"primary_category":"commentary"}}},"categories":[106,29,32,24],"tags":[],"coauthors":[7616],"class_list":["post-26704","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-newsletters","category-opinion"],"acf":{"subheadline":"","legacy_arc_id":"33JH75CGFVGJBGG4NPRLG6ZBCA","arc_canonical_url":"\/opinion\/2021\/02\/01\/cyber-espionage-is-not-cyberattack\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n