WASHINGTON — The U.S. Cyber Command will face growing pains as it seeks to define both its mission and limitations in the near future, panelists and a command official said Friday.
“There’s so little established law that we can weigh in with our opinions and they might actually matter,” said Col. Gary Brown, staff judge advocate for the command.
Much of the uncertainty revolves around defining the area of responsibility for the command, whose senior leaders are working to map a sort of geography of the cyber realm in which they operate, Brown said.
The analysis came during a conference for the Military Reporters and Editors Association held in Washington, D.C., in partnership with the Medill National Security Journalism Initiative and the American University National Institute of Military Justice.
Former CIA Director James Woolsey stressed that Cyber Command would need to expand its mandate — against the military’s will, he said — into protecting U.S. infrastructure.
Woolsey laid out several scenarios in which anyone from hostile states to bored teenagers could cripple the nation.
Woolsey, an evangelist for green energy and a venture capitalist, said America needs to decentralize and diversify its electrical grid while bringing it under the military’s cyber umbrella.
“If one is serious about protecting the country in these cyber times, these highly vulnerable grid times, I would suggest one simply has no alternative but to get the military involved in this aspect of protecting the country,” Woolsey said.
In questioning on Capitol Hill in September, the head of Cyber Command and the National Security Agency, Gen. Keith Alexander, said his focus and mandate were limited to protecting military interests in cyberspace and preventing attacks.
In a New Yorker profile of the command this month, Seymour Hersh cast doubt on the ability of other states or individual hackers to plunge the country into darkness.
“The cartoonish view that a hacker pressing a button could cause the lights to go out across the country is simply wrong,” Hersh wrote.
So the command is left to determine where it is working and how it should respond in case of an attack, which could require a response much quicker than any nuclear salvo, Brown said.
“Minutes, in the plural, is optimistic. Even minute singular is optimistic,” he said.
In legal terms, Brown’s team is working to define what exactly constitutes a “use of force” in cyberspace, he said. This would determine the rules of engagement.
Beyond that, they are working to refine the nature of cyber sovereignty, the geography and area in which the command can operate.
“Our military networks are connected to the civilian network,” he said. “It’s difficult to say where one starts and the other ends and it is difficult to pull those threads apart sometimes.”