Cyber Arms Control: Trust, but Don’t Verify?

Cyber Arms Control: Trust, but Don’t Verify?

In the twenty-first century, attacks against computer systems and networks emerged as powerful tools of warfare.

During the 2008 invasion of the Republic of Georgia, Georgian computer systems suffered attacks in parallel to Russia’s conventional offensive. In 2010, the Stuxnet computer worm damaged the Iranian nuclear facilities at Bushehr and Natanz. Recognizing the threat posed by state sponsored cyber attacks, the Pentagon recently accused the Chinese military of attacking U.S. systems.

Interest in a cyber arms control regime has developed as cases of state sponsored cyber war increase. Yet due to the anonymity of cyberspace, treaties seeking to limit cyber weapons will lack the crucial verification component.

Two major challenges prevent the replication of traditional arms control agreements in cyberspace:

  • Verification: Arms control treaties require verification mechanisms and reliance on a “trust, but verify” model. Yet current technologies cannot verify compliance with any ban on cyber weapons or cyber war tactics
  • Attribution: Cyber weapons are not solely under the control of state actors, and tracking the source of a cyber attack presents unique challenges with no equivalent in traditional arms control. Even if the origination of an attack is tracked to within a state’s borders, unequivocally distinguishing between a state sponsored cyber attack and one led by a private citizen remains impossible

While a verifiable arms control treaty remains out of reach given the limitations of current technologies, strategies for mitigating a cyber arms race could include:

  • Forging agreements to foster transnational cooperation in cyber forensics to identify the perpetrator of attacks,  thereby developing trust and conceivably creating a deterrent
  • Establishing peacetime norms of behavior in cyberspace that reflect the structure for acceptable cyber activities, similar to the arms control norms currently affecting state actions in the domain of space

A verifiable cyber arms control treaty remains a nonstarter. Yet the international community should act to form cooperative agreements and shape new international norms that promote restraint in cyberspace. 

Contributors

* Arc Aspicio |

Arc Aspicio enhances the future of our nation by creating bold ideas and bringing them to life. A consulting and solutions company, Arc Aspicio solves problems by applying our integrated capabilities in strategy, design, data, human capital, behavioral science, and technology. The company passionately pursues our vision to be the hub of creativity where people take action to change the world. To do this, employees collaborate with clients and partners to create solutions using a human-centered approach. Innovation is not possible without action. The company focuses on strategy first, then takes a hands-on approach implementing ideas to achieve results. Join Arc Aspicio and our Strategy Innovation Lab (SILab) by creating and sharing ideas to inspire people to change the world. Follow us on Twitter @ArcAspicio @SILabDC and, #welovedogs!

Reinventing Strategy

Reinventing Strategy

Since the GPRA Modernization Act in 2010, agencies across the Federal Government have raced to establish new Strategic Plans in response to incoming Presidential Administrations and agency leaders. Developing a new Strategic Plan is incredibly exciting for an agency. Leaders can redefine priorities, frontline managers can improve mission performance, and employees can better engage with the mission. Strategy, however, is so much more than just a Strategic Plan.

Running IT Like a Business: How Technology Business Management is Shaping the Future of Federal Agencies

Running IT Like a Business: How Technology Business Management is Shaping the Future of Federal Agencies

As the Government continually looks for ways to increase efficiency and encourage innovation, Information Technology (IT) is emerging as a solution to these needs. Recent Federal guidance mandates all agencies to adopt a new framework for better understanding IT costs. Technology Business Management (TBM) is a framework that incorporates IT departments into the overall business network, shifting away from treating IT as an independent unit. This provides a clear way to evaluate and manage IT, running IT as a business and communicating the value of new IT investments.

Behavioral Science – Using Behavioral Science to Effect Action

Behavioral Science – Using Behavioral Science to Effect Action

How do organizations encourage behavior change in their customers? Increasingly, they focus on customer experience, and as a consequence employ behavioral science methodologies. At the heart of behavioral science is the consideration of how an organization can make small investments that generate incremental savings/returns while considering both customers and organizational benefits. One example is Transportation Security Administration’s (TSA) Pre✓® and U.C. Customs and Border Protection’s Global Entry programs.

Launching into #Action Through Strategy

Launching into #Action Through Strategy

As a new employee, your first company-wide meeting can make you nervous. This was how I felt.

Arc Aspicio’s recent Strategy Launch Day was so well planned and it involved participants so that I learned that I had nothing to worry about! The company treats each employee equally and equips even the newest joiners with the information and skills they need to have a meaningful experience

What Being a Consultant Means to Me

What Being a Consultant Means to Me

As a Consulting Associate at Arc Aspicio, I provide expertise and insight to help clients solve difficult problems. To be successful, a consultant does not need only to be a subject matter expert on their client’s industry and needs - though this often ends up happening over time.

Captivate Your Audience Through Design+Data

Captivate Your Audience Through Design+Data

So often, senior leaders must communicate their strategic and simple vision in a world of growing complexity. They must make decisions – and frequently explain them – based on an enterprise view of their data. It’s getting easier to do this these days through data visualizations and infographics that speak to specific employee and stakeholder audiences. Design+Data is what we call it at Arc Aspicio.

Chief Data Officers: Six Steps to Manage Data as an Enterprise Asset

Chief Data Officers: Six Steps to Manage Data as an Enterprise Asset

With an exponential increase in the types and quantities of data, organizations need defined strategies and techniques to manage data as an enterprise asset. To create enterprise-wide use of data, a Chief Data Officer (CDO) needs a clear data agenda for leadership and the whole organization to address current and future needs. CDOs should follow this six-part data plan to achieve short term capability gains and plot a path to greater enterprise data maturity.

Securing Cyberspace: Agile Strategy to Counter Changing Threats

Securing Cyberspace: Agile Strategy to Counter Changing Threats

Cybersecurity, managing and protecting computer systems from attacks, is evolving just as quickly as the techniques hackers use to cause damage. Historically, the public and private sectors believed that stronger technology and more advanced computer systems alone were enough to prevent attacks. As new trends emerge and the technologies used to both conduct and prevent hackings improve, cybersecurity strategies must remain agile, trying new tactics to counter changing threats.

Hacking Back – Do the Benefits Outweigh the Risks?

Hacking Back – Do the Benefits Outweigh the Risks?

With the increased frequency and sophistication of cyber-attacks worldwide, companies and executives are becoming frustrated with a traditional focus on defensive tactics. As a result, some private sector actors are taking a more active role in cybersecurity by “hacking back” – hacking against the very groups that are attacking their systems in retaliation or to retrieve stolen data. As hacking back rises in popularity, it is important to consider a number of political and legal issues and the risks to counter-terrorism efforts.