Carpet Bombing in Cyberspace?

Col Charlie Williamson, an AF judge advocate, wrote an interesting article titled Carpet Bombing in Cyberspace published in the on-line version of the Armed Forces Journal. In it, Col Williamson calls for a military botnet to act, when necessary, as an offensive weapon against computer networks that may be attacking ours. We’re not just talking about your garden-variety hackers here, characterized by the caricature of the pale-faced geek hiding out in his mom’s basement trying to find the backdoor into the Pentagon’s super secret supercomputer just to say “Kilroy was here.” We’re talking about either state-sponsored or terrorist-sponsored cyberthreats, who are extremely sophisticated in their means and methods. It is this type of cyberattack for which Col Williamson proposes his botnet cyberbomber. Personally, I think he’s on to something.

Col Williamson uses a history lesson to show that our current methods of protecting our computer networks have become outdated. He likens our computer networks firewalls, passwords, and gateways to a medieval castle’s walls, moats and drawbridges. Like a castle fortress, a computer’s protections can help keep out intruders, and may serve as a minor deterrent, but those protections, according to Col Williamson, do not “strike the enemy while he is still on the move.”

Col Williamson believes we need to have the offensive capability to do so, as a part of a scheme of defense in depth. That idea is simple; you defend in close by taking the fight to the enemy offensively. For defending our most sensitive computer networks, Col Williamson proposes a botnet. A botnet is a “collection of widely distributed computers controlled from one or more points.” He suggests we use all those old and outdated computers the DoD is constantly replacing. Good idea? I think the concept is good, but as with everything else, the “devil is in the details.” There would have to be a great deal of engineering done by a lot of very smart people. There would have to be a lot of discussion on when, and how, to deploy this potential weapon. Most critically, there would have to be the willingness to accept what would most likely be a high political cost of using a weapon like this.

In some ways, that is the most interesting question: are there some computer systems (and what are they) that are so important that we have to risk the political implications of using an offensive botnet cyberspace weapon to protect them, even at the expense of losing political capitol? I’m certain there are some “red line” computer systems out there that should not be crossed. But if we do field, then use, this type of weapon the political backlash would be huge; particularly if some of the computer systems used by the “adversaries” are located in a putative-allies’ country. Could you imagine the uproar. . . . What would the U.N. say? What would France say?