WASHINGTON — The government’s efforts to deter computer attacks against the United States are not working, and it is time to consider boosting the military’s cyber-offensive capability, the head of U.S. Cyber Command told Congress on Thursday.
“We’re at a tipping point,” Adm. Michael Rogers, who also directs the National Security Agency, or NSA, said at a Senate Armed Services Committee hearing. “We need to think about: How do we increase our capacity on the offensive side to get to that point of deterrence?”
Adm. Rogers noted that the command, which launched in 2010, has focused mostly on defense. But he said, “In the end, a purely defensive, reactive strategy will be both late to need and incredibly resource-intense.”
His testimony picks up where his predecessor, retired Gen. Keith Alexander, left off. Mr. Alexander, who retired last year and started a cybersecurity firm, had long advocated a more robust offensive capability. But concerns over the years from the White House, the State Department and even some within the Pentagon that cyberweapons use could trigger unintended consequences and might harm diplomatic relations have slowed their deployment.
Adm. Rogers said President Barack Obama has not yet decided to delegate authority to him to deploy offensive tools. He indicated that policymakers still were not convinced that it was time. “We’ve got to increase our decision-makers’ comfort and level of knowledge with what capabilities we have, and what we can do,” he said.
Asked by Sen. John McCain, R-Ariz., the panel chairman, whether he agreed that the “level of deterrence is not deterring,” Adm. Rogers said: “That is true.” He was emphatic that the threat is growing. Attackers not only want to disrupt, but also establish “a persistent presence on our networks,” he said.
Adm. Rodgers said that at present, he sees “a strong, direct linkage” between “individual” hackers in Iran, Russia and China and “the nation state directing” an attack or intrusion. But he added, “One of the things we’ll be looking for” is foreign governments trying to confuse analysts by using “partners” outside government, so that the activity is not as easy to attribute directly to the state.
Adm. Rogers’ views on a cyber-offensive were endorsed by several committee members, most notably Mr. McCain, who used the platform to criticize the Obama administration’s handling of recent cyber-incidents.
The November cyberattack by North Korea on Sony Pictures Entertainment “has exposed serious flaws in this administration’s cyber-strategy,” Mr. McCain said at the hearing’s start. “The failure to develop a meaningful cyber-deterrence strategy has increased the resolve of our adversaries and will continue to do so, at a growing risk to our national security.”
Administration officials, however, say the financial sanctions imposed against North Korean officials following the attack and the indictments last year against five Chinese military officials who were accused of stealing corporate secrets from U.S. companies show greater resolve to hold adversaries accountable for their actions.
Adm. Rogers himself has said it was necessary to publicly name North Korea as the country behind the Sony attack to deter other nations from taking similar actions. Naming North Korea as the state responsible for a cyberattack was virtually unprecedented for the United States.
But Mr. McCain and other lawmakers want to see more forceful action.
“I just think it’s critical to develop an offensive cyber-capability,” said Sen. Angus King, I-Maine. Moreover, he said, that capability needs to be publicized. Remember “Dr. Strangelove,” he said, referring to the classic movie satirizing Cold War fears of a nuclear conflict. “If you build the doomsday machine, you’ve got to tell people you have it. Otherwise, the purpose is thwarted.”
