The Pentagon has proposed that military cyber-specialists be given permission to take action outside its computer networks to defend critical U.S. computer systems — a move that officials say would set a significant precedent.
The proposal is part of a pending revision of the military’s standing rules of engagement. The secretary of defense has not decided whether to approve the proposal, but officials said adopting the new rules would be within his authority.
“Without a doubt it would be a very big and significant step forward,” said a senior defense official, speaking on the condition of anonymity to discuss a sensitive topic. “It would account for changes in technology that will give more flexibility in defending the nation from cyberattack.”
Currently, the military is permitted to take defensive actions or to block malicious software — such as code that can sabotage another computer — only inside or at the boundaries of its own networks. But advances in technology and mounting concern about the potential for a cyberattack to damage power stations, water-treatment plants and other critical systems have prompted senior officials to seek a more robust role for the department’s Cyber Command.
The proposed rules would open the door for U.S. defense officials to act outside the confines of military-related computer networks to try to combat cyberattacks on private computers, including those in foreign countries.
In establishing the new regulations, officials have sought to overcome concerns that action in another country’s networks could violate international law, upset allies or result in unintended consequences, such as the disruption of civilian networks.
The Pentagon, in consultation with the White House and other agencies, has developed strict conditions governing when military cyber-specialists could take action outside U.S. networks. Some officials said these conditions are so stringent that the new capability to go outside military boundaries might never be used.
Pentagon and other officials say such military action is meant to be taken only in extreme emergencies and with great care.
The proposed revision to Cyber Command’s standing rules is significantly narrower than what the military originally sought, officials said. But, one senior Pentagon official said, “we want to have something approved that starts the dialogue that allows us to start seeking more.”
Generally, the new rules would allow the two-year-old Cyber Command to take defensive action in a foreign country or in the United States if reliable intelligence indicates that a threat is imminent and could have certain consequences, such as deaths, severe injury or damage to national security, said several current and former officials.
“We’re not talking about shooting back, not talking about tit-for-tat,” said the Pentagon official, who like many interviewed for this article spoke on the condition of anonymity and would not discuss operational details. “We’re talking about stopping the bleeding, lest something really bad happens to the country.”
The standing rules of engagement, or SROE, were last revised in 2005. They are intended to give military commanders guidance on what they can do when they find their troops or systems under attack and they need to act quickly without having to consult the president or defense secretary.
While the rules for air, sea and land operations are fairly straightforward, the rules for cyberspace have posed great challenges for policymakers. For one thing, cyberattacks can take place in milliseconds. The assailant may be unknown. The attack route may be hard to trace, crossing multiple countries.
“The legal and policy entanglement in cyber is far, far more difficult than it is in some of the other domains” of warfare, William J. Lynn III, a former deputy defense secretary, said at a global security conference this year.
The SROE discussion is part of a larger interagency policy debate over the role of government in fighting attacks on the nation’s privately owned critical computer systems.
Ideally, current and former officials say, the Pentagon would like Cyber Command to be able to undertake a range of activities, from blocking or redirecting viruses to disabling a computer server in another country to prevent destructive malware from being launched.
But something as aggressive as shutting down a server in another country is probably going to require presidential permission, Gen. Keith Alexander, the head of Cyber Command, has said.
Indeed, “going after something outside the network in defense of the nation, which may still be characterized as offensive, is definitely the hardest policy part,” a senior U.S. official said.