Iran, China, and Cyber Posses

The asymmetric tit-for-tat with Iran continues. A virus may have been used to attack oil terminal controls on Kharg, a strategically important island in the North Arabian Gulf. Whether this was actually a cyber attack, who conducted it, and for what purpose are currently unknown. Regardless, we can expect to see more of these sorts of non-kinetic strikes on maritime infrastructure globally.  The barriers to entry for cyber-attack are fairly low. Malicious code and TTPs are available in the open source and it doesn't take a computer science degree from a prestigious university to employ them effectively. CSBA's article on the democratization of violence elaborates.

This concept should be nothing new to ID readers as we’ve discussed open source (as defined by John Robb) naval warfare here on several occasions. Mr. Krepinevich accurately articulates the issues facing the United States via the proliferation of high technology warfare, including PGMs, cyber, bio, etc. But he provides little in the way of recommendations to counter this trend except a continued stay ahead of the Jones’ approach: “… the Pentagon will need to prove better than its rivals at exploiting advances in artificial intelligence to enhance the performance of its unmanned systems. The U.S. military will also need to make its robot crafts stealthier, reduce their vulnerability to more sophisticated rivals than the Taliban, and make their data links more robust in order to fend off efforts to disable them.”

A more proactive recommendation would be to permit, or even encourage non-government entities to take an more active, even offensive, role in defending their interests. The expectation for companies and individuals' to maintain domestic readiness and business continuity in the face of natural disasters has already been established. Many Americans and companies learned a hard, but predictable lesson following Katrina and other hurricanes last decade: the federal government, as large and powerful as it may be, is not agile enough to come to the rescue of every American in need. Similarly, commercial shipping companies were slow to realize that the First World’s expensive navies would not always be in the right place, at the right time, with the right ROE in the vast Indian Ocean to protect them from pirates, so they took matters into their own hands with embarked armed security guards.

Lately, American companies have come under attack from a variety of state and non-state actors. These cyber attackers, some sponsored by states with malign intent, others just self-organizing sophomoric thugs, place an increasing toll on the cost of doing business and the global economy. It should come as no surprise to most Americans that the computer experts with the maddest cyber-skillz likely don’t work for Uncle Sam’s Cyber Command and other government agencies and that the commercial sector will always be more nimble and responsive than the federal government. So then why shouldn’t Google, Cisco, etc. take an active role in offensively attacking the actors - both state and non-state - who disrupt their operations? When future attacks against a US commercial network occur, the private sector should go after the perpetrators with a vengeance -- counter-attacking with cyber, legal, and any other conceivable means until the threat is disrupted or deterred. Some might consider this anarchy, unecessary escalation, or a failure to accept rule of law. But in the face of an increasingly broad and dynamic range of threats to civil order, do we really have a choice?  As to possible future cyber-vigilante targets, here are one analyst's thought provoking ideas...

The opinions and views expressed in this post are those of the author alone and are presented in his personal capacity. They do not necessarily represent the views of the U.S. Department of Defense or any of its agencies.