Does the US Need Cyberspace Strategy Modeled on NSC-68?

Analytical Writing, Memo

Does the US Need Cyberspace Strategy Modeled on NSC-68?

The 1950 report by the National Security Council interpreted George F Kennan’s “warning about Soviet ideological expansionism as a warrant for a build-up and projection of American military strength, force-backed intervention in countries at risk of adopting communist government, and a framework for understanding and negotiating with the USSR.¹ NSC-68 provided a compelling raison d’être for an arms race, reversal of political rhetoric about our war-time ally, proxy conflicts in Korea, Vietnam and transformed societies in two superpowers for the last half of the twentieth century.²

After nearly two decades since the collapse of the Soviet Union, a rejuvenated Russian Federation appears to be providing direct³ and indirect⁴ aegis for hostile interference in the domestic political processes of the United States and other NATO signatories.⁵ While attribution for attacks is extremely difficult, technical analysis of incidents suggest that the Kremlin may be using its elite military intelligence units, and supporting proxy actors to compromise technical infrastructure, steal secret communications and records, disseminate damaging highly suggestive true and untrue information in order to create distrust in the political processes of democratic states including our own. The wider American public is being introduced, through prolific reporting on investigations of domestic and international incidents of interference, to Russian subterfuge techniques collectively known as “активные мероприятия”⁶.⁷

As the domains of American strength is shifting industrial and commercial world to the information and services world, so has the national security threat landscape. The US still responds to threats to the homeland, its allies, and interests abroad with traditional tactical and strategic force, but most of those threats are from small, non-state actors. Increasingly the US is experiencing sustained and serious attacks in cyberspace from mysterious actors, but attacks with levels of sophistication that suggest state-level support. Commensurate with the rise in attacks, US federal agencies, commercial firms, research and educational institutions have increased the intensity of their efforts to harden their defenses, improve their incident response capability and strategize about how to protect American power in this new theater. The addition of the Russian Federation (RF or Russia) to set of established cyber-enemies, predominantly the People’s Republic of China (PRC or China) and the Democratic People’s Republic of Korea (DPRK or North Korea), invites the question about whether the US needs a more robust and coordinated strategy comparable to NSC-68.⁸

Legacy of NSC-68

The dramatic rise in military strength, readiness and force projections NSC-68 can claim as its legacy are instructive when viewed historically. The plan initiated a nuclear arms race which, despite significant retraction, still holds the potential for US annihilation.⁹Kristensen, Hans M. and Robert S. Norris. “Russian nuclear forces, 2017.” Bulletin of the Atomic Scientists 73.2 (2017): 115-126. 21 September 2017 It also resulted in enormous environmental damage from the production of fissile material and ongoing proliferation issues. The Korean peninsula has been stuck in Cold War geopolitics for half a century. The expansion of NATO in the 1960s and again in the 1990s are sources of Soviet and now Russian frustration and distrust of the West.¹⁰

NSC-68 proposed a very active military posture against communism in the world, but it remains debatable whether the decline in communism and the fall of the Soviet Union can really be credited to what emerged from its recommendations. Andrew Marshall would come to find that the US made mistakes in its assessment of the level and sources of Soviet defense growth as well as it’s aims. In a piece for Foreign Policy Jeffrey Lewis writes, “Each side, the BMD study implied, was really racing with itself.” ¹¹ Stephen Kotkin’s book Armageddon Averted challenges the opinion that the United States won the Cold War by actively resisting Soviet power, but instead, that their failure to modernize their economy in step with global trends, as well as to liberalize politically created an unsustainable future for the socialist juggernaut.¹² NSC-68 makes a dispensable overture to the possibility that the USSR might “collapse from within,” and even makes modest effort to address the impact that a hawkish American government might have on society.¹³ Even cyberspace has Cold War origins. Arpanet and the TCP/IP stack was designed to create a communications network that could remain functional in the event of a nuclear attack.¹⁴ The decentralization that makes the system robust, low reliance on authentication, and non-proprietary foundations make cyberattacks easy to perform, hard to defend against, and hard to trace. While the damage from and imagined threats from cyberattacks are unquestionably benign when compared to the risk from a conventional or nuclear attack by a state, our increasing reliance on computer networks for state power must be considered and balanced as part of a comprehensive strategic posture.

US on Cyber Defense

It remains difficult to synthesize what the US strategy on cybersecurity is or how long any particular articulation will remain relevant. There is a secret-level Department of Defense (DOD) strategy document from 2006 available online that articulates one posture.¹⁵ In 2011 President Barack Obama issued International Strategy for Cyberspace¹⁶, and in late 2012 another National Strategy for Information Sharing and Safeguarding.¹⁷ A document much more like NSC-68 in its detail is the Cybersecurity Strategy and Implementation Plan (CSIP)¹⁸, from 2015 created by the Office of Management and Budget (OMB) with participation by the National Security Council, Department of Homeland Security and DOD among others. CSIP, unlike NSC-68, is focused domestically. Again, in late 2016 the Commission on Enhancing National Cybersecurity, assembled by President Obama largely from the private and higher education sectors, produced a 100-page Report on Securing and Growing the Digital Economy¹⁹. Four of the six “imperatives” from its list of recommendations are security-focused. There seem to be no end to the number of agencies involved in producing endless assessments and plans replete with broadly-framed guidelines, imperatives, directives and such. It is beyond the purview capability of this memo to exhaustively survey this publishing industry, suffice it to say it appears representative that the number and scope of productions suggest an industry-sized effort, which in turn suggests risks associated with coordination when a singular, authoritative strategy document cannot be cited as the source of common mandate.

If it is difficult to say what the US domestic or international strategy is with the clarity and force of something like NSC-68, perhaps budget data will be informative. A supplementary document focused on IT spending in President Trump’s 2018 budget proposes “nearly $95.7 billion” in spending, with 44.4% going to DOD and another 14.5% going to the Department of Homeland Security (DHS). That is 51.5% of all federal IT spending is going to the national security establishment. The supplement also claims that “for the first time, this Budget, includes discrete cyber program investments that align budget resources with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.”²⁰ The inclusion here suggests that perhaps NIST is leading the domestic effort with its draft document produced in May 2017. Of course, the DOD produced its own document in 2015.²¹ China, Russia, Iran and North Korea are all named in the document. The tone of the language regarding Russia is mild and the number of mentions is small compared to China. One would expect that to change in any near-term future documents by defense or security agencies in the US, if the tone of outrage in popular media is indicative of a real change in mood by the US. Of the four strategic goals outlined by the DOD the most aggressive posturing might be found in Strategic Goal IV; which is to provide “viable cyber options…to control conflict escalation and shape conflict environment.”²² The remainder of their public-facing message focuses on defense of its own capabilities and networks, homeland defense and partnerships with allies. Spending on IT isn’t as representative of capability growth as one might expect. IT hardware isn’t traditionally terribly expensive, but the research and development that creates technical advantages is and depends quite significantly on private sector discovery. An increase in spending coupled with the explosion in publication of IT/cybersecurity standards suggests an uptick in effort.

Conclusion

John Lewis Gaddis writes of NSC-68 that, “the whole point of the document had been to shake the bureaucracy, Congress and the public into supporting more vigorous action.”²³ The goals of that action included, “projection into the Soviet world in such a way as to bring about an internal change in the Soviet system.”²⁴ The success of these two measures is again instructively different. There is no doubt that the US was shaken into vigorous action, but what evidence is there that NSC-68, in its self-expressed aims and design was instrumental in the subversion of the Soviet system? The collapse of the Soviet Union seems to have been met by the broader US population, not with a sense of victory, but with a sense of relief that we need not worry so much about MAD or some mysterious Communist monster.

There has been no Hiroshima in cyberspace yet, nor has there been a Hungarian Revolution or Berlin Wall to galvanize the public. Perhaps the closest such antagonism is happening now with the possibility that we could discover our President was aided in his campaign to the office by the support of a state is arguably credited with taking “active measures” to weaken our democracy. Nor are Americans ready to empower the government with greater cyber strength after revelations that it grossly misused that power.²⁵ The US seems to be able to respond to quickly to individual cyber vulnerabilities, but information technology is still a very dynamic field for innovation, and as such it is extremely difficult to adjudicate who is winning any kind of security competition or for how long. Because this field is so innovative, the global diffusion of technical capability so rapid, the weaponizable tools so affordable and the technical literacy of most citizens dangerously inadequate it may be impossible or too early yet for any state power to form a meaningful and lasting cyber strategy.

1
Kennan, George F. The ‘Long Telegram’. Incoming Telegram. United States, Congress. Washington: United States Government Printing Office, 1946.
2
National Security Council. “National Security Council Report, NSC 68, ‘United States Objectives and Programs for National Security‘.” 14 april 1950. Wilson Center.
3
“…Cozy Bear—were believed to be directed by the Russian government.” Osnos, Evan, Remnick David and Joshua Yaffa. “Trump, Putin, and the New Cold War.” The New Yorker 6 March 2017.
4
Schactman, Noah. KREMLIN KIDS: WE LAUNCHED THE ESTONIAN CYBER WAR. 9 March 2009. Accessed 21 September 2017.
5
Stelzenmüller, Dr. Constanze. “Testimony: The impact of Russian interference on Germany’s 2017 elections.” 28 June 2017. Brookings. Accessed 21 September 2017
6
active measures
7
Osnos, Evan, Remnick David and Joshua Yaffa. “Trump, Putin, and the New Cold War.” The New Yorker 6 March 2017.
8
Department of Defense. The National Military Strategy for Cyberspace Operations. [Secret Memo]. United States Government. Washington DC: US Government Publishing Office, 2006.⁸

Legacy of NSC-68
The dramatic rise in military strength, readiness and force projections NSC-68 can claim as its legacy are instructive when viewed historically. The plan initiated a nuclear arms race which, despite significant retraction, still holds the potential for US annihilation.⁹Kristensen, Hans M. and Robert S. Norris. “Russian nuclear forces, 2017.” Bulletin of the Atomic Scientists 73.2 (2017): 115-126. 21 September 2017
9
10
Osnos, Evan, Remnick David and Joshua Yaffa. “Trump, Putin, and the New Cold War.” The New Yorker 6 March 2017.
11
Lewis, Jeffrey. “Yoda Has Left the Building.” Foreign Policy. 24 October 2014. Accessed Sept. 21, 2017.
12
Kotkin, Stephen. Armageddon Averted: The Soviet Collapse, 1970-2000. Oxford: Oxford University Press, 2001.
13
National Security Council. “National Security Council Report, NSC 68, ‘United States Objectives and Programs for National Security‘.” 14 april 1950. Wilson Center.
14
Featherly, Kevin. ARPANET. 28 November 2016. Accessed 21 September 2017.
15
Department of Defense. The National Military Strategy for Cyberspace Operations. [Secret Memo]. United States Government. Washington DC: US Government Publishing Office, 2006.
16
Obama, President Barack. International Strategy for Cyberspace. Government. United States Government. Washington, DC: US Government Publishing Office, 2011
17
Obama, President Barack. National Strategy for Information Sharing and Safeguarding. Government. United States Government. Washington, DC: US Government Publishing Office, 2012.
18
Office of Management and Budget. Cybersecurity Strategy and Implementation Plan for the Federal and Civilian Government. United States Government. Washington, DC: US Government Publishing Office, 2015
19
Commission on Enhancing National Cybersecurity. Report on Growing and Securing the Digital Economy. Commissioned. Washington, DC: US Government Publishing Office, 2016
20
Office of Management and Budget. Analytical Perspectives, Budget of the US Government, 2018. Budget. Executive Office of the President. Washington, DC: US Government Publishing Office, n.d.
21
United States Department of Defense. “THE DEPARTMENT OF DEFENSE CYBER STRATEGY.” April 2015. US Department of Defense. 20 September 2014.
22
United States Department of Defense. “THE DEPARTMENT OF DEFENSE CYBER STRATEGY.” April 2015. US Department of Defense. 20 September 2014.
23
Gaddis, John Lewis. Strategies of Containment. Oxford: Oxford University Press, 2005.
24
National Security Council. “National Security Council Report, NSC 68, ‘United States Objectives and Programs for National Security‘.” 14 april 1950. Wilson Center.
25
“The spy agency began allowing the analysis of phone call and e-mail logs in November 2010 to examine Americans’ networks of associations for foreign intelligence purposes after N.S.A. officials lifted restrictions on the practice, according to documents provided by Edward J. Snowden, the former N.S.A. contractor.”Risen, James and Laura Poitras. “N.S.A. Examines Social Networks Of U.S. Citizens.” The New York Times 29 September 2013, New York ed.

By Rick Spencer
September 21, 2017
Topics: Cyberdomain Defense, National Security, Nuclear Weapons