Schneier on Security

Skeptical • January 9, 2015 4:02 PM

Okay – I have to say that I find some of the skepticism in the comment threads mildly hilarious after the last year and a half. From “the NSA has compromised everything (almost)” to “the NSA doesn’t know basic fundamentals of networks” is quite a trip, but some of the commenters made it without breaking a sweat. Nicely done!

More seriously:

What this all means is that it’s in the US’s best interest to claim omniscient powers of attribution. …
It can be an effective bluff, but only if you get away with it. …
The only way out of this, with respect to the Sony hack and any other incident of cyber-aggression in which we’re expected to support retaliatory action, is for the government to be much more forthcoming about its evidence.

No… Bruce, I like a lot of the issues you’re raising in general about norms governing how we categorize and respond to cyber attacks, but I really disagree with you as to whether it is in the perceived, or actual, interest of the US to bluff.

The following proposition (among others with similar implications) is likely to be considered true with a probability of more-likely-than-not by the USG:

If North Korea is truly not responsible, then it is probable that China knows it.

From this we can easily infer:

If the US is wrong in its attribution, it is telling China something important about the limits of its capabilities.

Because attribution is a necessary component of deterrence, this would enormously reduce US deterrence in relation to cyber attacks by China.

Is there any value that would justify a bluff which risks US deterrence capability against China?

No. If the US were uncertain, it could wait to develop additional intelligence in the hope of becoming certain, without endangering its deterrence capability. Responding swiftly does not require having the President announce both attribution and promise retaliation within weeks of becoming involved.

So the proposition that the US is bluffing is extremely unlikely to be true.

That leaves the possibility that US is not bluffing, but is mistaken. Certitude and certainty, after all, are not the same thing.

The problem of attribution is obviously a central issue in law enforcement and intelligence. The USG has many years of experience with this problem, as do the private experts and organizations who have assisted the USG in the past. They know, as well as anyone in the world, how hard and complex attribution can be. They’ll be cautious in describing what conclusions the evidence supports.

There are additional points of possible error down the line – other analysts, influential policymakers – but they all seem unlikely in this case.

Finally, does the USG ever need to actually show the evidence that it found persuasive? Absolutely not. If the attribution is correct, then China probably knows it. Russia may not be certain, but would probably be more surprised if the USG revealed sources and methods just to placate the public (and wouldn’t believe what the USG says anyway) – it will probably conclude that the US is on the mark in its attribution.

And other actors? If they want to take the risk, the USG isn’t going to dissuade them – or anyone else – by revealing sources and methods that are immediately rendered useless by the disclosure.

Skeptical • January 10, 2015 2:30 AM

@Nick P: What deterrence capability? The U.S. government has said in numerous reports and statements that Chinese spies stole … Chinese are hammering us nonstop, the NSA/FBI’s SIGINT-enabling policies only make it easier, and we should talk about response to the existing situation rather than deterrence of… what?

There are two types of deterrence.

(1) Deterrence by denial: you dissuade an adversary from taking an action because you have persuaded him that the action will fail, or that the direct costs of doing so are not worth the benefit;

(2) Deterrence by punishment: you dissuade an adversary from taking an action because you will retaliate in such a way as to render his action inadvisable.

We don’t seek to deter espionage by retaliating against the nation conducting it, There are rough rules of the road when it comes to how nations treat the spies of other countries. For example, the US spies on Russia; Russia spies on the US. If a foreign intelligence officer is caught spying, he’ll be locked up for a few hours, asked some questions, but will generally be treated humanely and then declared PNG and given 24 hours to vacate the country. We don’t go to war over espionage, and we don’t seek to deter espionage by other nations by punishment – though we certainly seek to deter espionage against us by our own citizens by punishment.

When it comes to nuclear attacks, deterrence by punishment is the primary US strategy. Use nuclear weapons against us, and we’ll obliterate you. Period.

What about smaller military incidents? Usually tit-for-tat.

What about cyber attacks? Current US policy is: retaliation will depend on the magnitude of the attack, which will be assessed just like any other attack, and the means of response are not limited to the cyber domain. In other words, if you attack a chemical plant, cause the failure of safety systems and the release of toxic gases that cause casualties, the US will consider it no differently than if you had bombed the chemical plant. At a minimum the response will be calibrated to deter by punishment additional such attacks. If the cyber attack is more akin to a small military incident, then a tit-for-tat response may be called for. And if there’s some cyber-equivalent to a nuclear attack (I doubt there is), then an extremely punitive response will be called for, probably in domains outside of cyber.

Deterring cyber attacks, just like deterring nuclear or conventional attacks, requires the ability to attribute responsibility. This is why, for example, when concerns rose about the proliferation of nuclear material from North Korea, the US made it very well known that it had the capability to determine precisely where the nuclear material that composed a bomb was derived from, and that it would use this fact to attribute responsibility.

Besides, Chinese don’t have an interest in outright destroying us.

True, just as we do not have an interest in destroying them. However neither nation wants to rely on the good will of the other for its security, so deterrence is an important capability, the loss of which would be viewed as quite serious. To reiterate, deterrence by punishment is not practiced with respect to espionage (except with respect to citizens who betray their own countries, and between certain nations at higher levels of hostility).

They believe U.S. will collapse economically under the weight of its own poor financial, military, and diplomatic decision-making. (As do I.) They instead make their currency independent from us, ensure they’ll survive economically if we’re not there, and continue allowing U.S. companies to use their cheap labor to gain leverage + money + I.P. stealing opportunities.

Well, okay, but I wouldn’t bet much on that view. The US economy is distinguished from the rest of the developed world at the moment by steady growth and stability, a trend expected to continue throughout 2015. China may turn out fine, but has enormous corruption issues, much more serious risks in its financial system, and far more social strains and tensions than the US. I don’t think either nation is in danger of collapse, but the US is perhaps one of the nations farthest from such a possibility.