Foreign Policy Blogs

CyberAssault* Attribution? Who Cares!

That’s the not-terribly-unreasonable response of former NSA Director Michael Haydon.

It’s a problem to try and figure out where Internet attacks come from. In the real world, that doesn’t really matter as much. If Canada was feeling pissy and let a bunch of bombers from some unknown third country sail through their airspace to take out Buffalo, USSTRATCOM is unlikely wring their hands and say “we’ll never know who it is, so I guess we can’t respond.”

The Intertubes are not the real world, but countries have some responsibility for securing the infrastructure that passes through physical cables, routers, and satellites they control, and not letting it be used for evil.

This can be a slippery slope, though; stopping attacks are one thing, but enforcing someone else’s rules on, say, dishonoring the Father of the Nation would be bad – and blocking content transiting your borders not being consumed or produced there would be worse.

Futility looms large here. Monitoring and controlling such traffic may be impossible anyway. A system could be compromised based on a few bytes of information, and even a denial of service attack might be obvious in the vast rivers of data flowing through a nation’s pipes.

Of course, CyberCommand on a hair trigger would could be a delightful way to screw your enemies. Not capable of doing the destruction that the US info-warriors can? No problem! Just make sure to route an attack on critical American infrastructure through the network of your nemesis, get some popcorn, and sit back and enjoy the show.

* Why should I put the title in StudlyCaps? According to the AP Stylebook everything involving Cyber is BadAss and needs to be capped appropriately.