Webber, speaking at the Air Force Association’s Global Warfare symposium in Los Angeles Nov. 19, said near-term priorities include normalizing “Net ops” and standing up command-and-control functions while moving into the new operations center. Occupying more than 50,000 square feet, the custom-built facility is being constructed at the former Kelly Air Force Base site across the runway from Lackland AFB, Texas. “We have limited ability to monitor various ‘pipes’ and we have the ability to push ‘patches,’ but it is not a warfighting organization,” Webber says, adding this will change when the new operations center is up and running. The facility is due to be fully completed by the end of 2010.

Speaking at the same event, the head of U.S. Strategic Command, USAF Gen. Kevin Chilton, says the real catalyst for the birth of the 24th was a massive cyber attack in late 2008. “One year ago this month we had a wake-up call in cyberspace. We had a severe intrusion into the Defense Dept. networks. It’s why I didn’t come to this conference a year ago. It changed the way people are thinking about cyberspace. This time it’s everybody’s problem — every soldier, sailor, airman and Marine. Every one of us is on the Net, and depending on it to conduct operations. It’s the commander’s business to make sure the network is supported to help the warfighter’s needs. That’s the biggest change in the mind-set — to make it the commander’s business.”

As part of this mind-set adjustment, Webber says cyberspace “is a place, not a mission. It’s about where operations are conducted, like the land, air, sea and space. Our job is to integrate the mission, not the domain. It’s about assuring the mission, not the network.” Remarking on a recent cyber attack on Peterson AFB, Colo., Webber says, “What did we do? We disconnected. But we must learn to fight through an attack because we need mission assurance.”

To ensure this, Webber says change must occur. “Our defense has been very much like the Maginot Line. But building the wall higher and higher is not going to be effective. We need to defend in depth. So we will work with backbone providers and go to the medical- or personnel-information worlds and say, ‘What hardware is essential?’”

The process will be used to develop a list of protected targets and defended assets.

The mission of Cyber Command is to protect the U.S. military’s networks and to be ready to launch offensive cyber attacks on a potential enemy. Those offensive cyber attacks have the potential to reach out from cyberspace into the physical dimension, causing giant electrical generators to shred themselves, trains to derail, high-tension power-transmission lines to burn, gas pipelines to explode, aircraft to crash, weapons to malfunction, funds to disappear and enemy units to walk into ambushes. Welcome to warfare in the twenty-first century.

We have become accustomed to the pilots of Predator and Reaper drones driving a few miles to their homes in Virginia and dinner with their kids after having “flown” aircraft all day on the other side of the globe, firing deadly Hellfire missiles into houses of terrorists in Pakistan. That looks like war as PlayStation: death by joystick, no risk of being shot down, no chance of capture. Now, with cyber war, we have another means of launching attacks on the other side of the world, this time with only a keyboard. In Vietnam and Iraq, U.S. pilots were shot down while attempting to bomb enemy air-defense missiles. Now, a cyber warrior might simply shut off an air-defense network or cause missiles to explode on their launch rails, not by using a laser-guided missile, but by activating a logic bomb. Cyber war could well mean fewer casualties, less physical destruction. Surely then, it is a good idea.

PERHAPS NOT. Much like sixty years ago when we first began to deal with strategic nuclear weapons, we have neither outlined a clear strategy nor had an open debate about how best to deal with this new capability and this new threat. As former–Secretary of Defense Robert McNamara discovered, without a real strategy for the use of strategic nuclear weapons, we risked annihilation of both ourselves and our enemies. The Strategic Air Command (SAC) had a simple plan: the United States would perceive when the Soviet Union was getting ready to attack us and then SAC would go first, launching all of its weapons against all of its possible targets in the Soviet Union, China and the Warsaw Pact nations of Eastern Europe. Horrified by that idea, McNamara commissioned work that developed a strategy of deterrence, including withholding attacks on cities, controlling escalation, minimizing crisis instability and initiating nuclear-arms control. Much of the development of that strategy was done in public, in speeches by then-President John F. Kennedy and McNamara, and in books by academics such as Herman Kahn, founder of the Hudson Institute, and MIT professor William Kaufmann. This is exactly the kind of discussion we need to have today. For it is not an overstatement to say that the body of work on atomic strategy initiated in the Kennedy administration probably prevented a nuclear war in which hundreds of millions may have died.

We sit at a similar historical moment. War fighting is forever changed. Though it will never produce the kind of death toll of nuclear weapons, we can see echoes of these same risks and challenges in today’s newest cyber-war battlefield. We’ve developed a plethora of gee-whiz technological capabilities in the past few years, but cyber war is a wholly new form of combat, the implications of which we do not yet fully understand. Its inherent nature rewards countries that act swiftly and encourages escalation.

AS IN the 1960s, the speed of war is rapidly accelerating. Then, long-range missiles could launch from the prairie of Wyoming and hit Moscow in only thirty-five minutes. Strikes in cyber war move at a rate approaching the speed of light. And this speed favors a strategy of preemption, which means the chances that people can become trigger-happy are high. This, in turn, makes cyber war all the more likely. If a cyber-war commander does not attack quickly, his network may be destroyed first. If a commander does not preempt an enemy, he may find that the target nation has suddenly raised new defenses or even disconnected from the worldwide Internet. There seems to be a premium in cyber war to making the first move.

And much as in the nuclear era, there is a real risk of escalation with cyber war. Nuclear war was generally believed to be something that might quickly grow out of conventional combat, perhaps initiated with tanks firing at each other in a divided Berlin. The speed of new technologies created enormous risks for crisis instability and miscalculation. Today, the risks of miscalculation are even higher, enhancing the chances that what begins as a battle of computer programs ends in a shooting war. Cyber war, with its low risks to the cyber warriors, may be seen by a decision maker as a way of sending a signal, making a point without actually shooting. An attacker would likely think of a cyber offensive that knocked out an electric-power grid and even destroyed some of the grid’s key components (keeping the system down for weeks), as a somewhat antiseptic move; a way to keep tensions as low as possible. But for the millions of people thrown into the dark and perhaps the cold, unable to get food, without access to cash and dealing with social disorder, it would be in many ways the same as if bombs had been dropped on their cities. Thus, the nation attacked might well respond with “kinetic activity.”

Responding, however, assumes that you know who attacked you. And, one of the major differences between cyber war and conventional war—one that makes the battlefield more perilous—is what cyber warriors call “the attribution problem.” Put more simply, it is a matter of whodunit. In cyberspace, attackers can hide their identity, cover their tracks. Worse, they may be able to mislead, placing blame on others by spoofing the source.

In 2007, the Russian government denied that it had engaged in primitive cyber war against Estonia that took out such things as the financial-services sector, and in 2009 claimed it was not responsible for largely identical activity against Georgia; though Russia did concede that some of its citizens, outraged over the conflict in Abkhazia, might have launched the denial-of-service attacks.

In July of this year, cyber attacks were launched against commercial and government websites in the United States and South Korea. The targets included the White House and Washington Post homepages. South Korean intelligence officials blamed the North. The attacks, however, seemed to originate inside South Korea.

For years, masses of data have been stolen from sensitive U.S. government and defense-contractor computers in attacks that investigators have code-named “Moonlight Maze” and “Titan Rain.” Which nation—or nonstate actor—has repeatedly performed the brazen cyber espionage has never been clearly established. What is clear is that cyber warfare poses new risks that we have yet to fully grasp.

THE UNITED States thinks that its cyber warriors are the best at offense, with the capability of shutting down enemy air defenses, electric-power grids, rail systems and telephony. The United States has probably already penetrated many such networks and laced them with trap doors (ways to get back in easily) and logic bombs (software that would wipe out everything on a network).

Such offensive prowess does nothing to defend our own networks from similar attacks, however, and the current U.S. defense systems protect only parts of the federal government, and not civilian or private-sector infrastructure. No nation is as dependent on cyber systems and networks for the operation of its infrastructure, economy and military as the United States. Yet, few national governments have less control over what goes on in its cyberspace than Washington. And these major lapses in our defense present a threat we ignore at extremely high cost.

The possibility of an electric-power grid being hit by a cyber attack is less far-fetched than one might think. A CIA official has admitted that at least one blackout outside the United States was already caused by a cyber attack. An Energy Department laboratory determined that a cyber attack from the Internet could weave its way into the digital control system of a generator and cause the device to self-destruct. Officials have privately confirmed media accounts that logic bombs have already been placed in America’s power-grid control systems, presumably by foreign cyber warriors.

And this problem goes deeper still. The “critical infrastructure” of the transportation, finance, energy and communications sectors are owned and operated by nongovernmental entities, corporations that have proven highly resistant to regulation. The Federal Energy Regulatory Commission (FERC) issued new cybersecurity guidelines to U.S. power companies in January 2008, requiring greater separation of the operations systems from the public Internet. But it took two years for these rules to go into effect (they start in January 2010), and many critics do not believe that the FERC has the ability to audit compliance. The leaders of those corporations, when asked about cybersecurity, almost uniformly believe that they should fund as much corporate cybersecurity as is necessary to maintain profitability and no more. They will defend themselves against cyber crime. Defending them against a cyber war, they all concur, is the job of the government.

Unfortunately, the government has no cyber-defense strategy. While the cyber warriors of Fort Meade may take comfort in America’s reputation as having the most potent arsenal of cyber weapons, they may be members of the national cyber-war team with the lowest overall capability. Indeed, America’s ability to defend its vital systems from cyber attack ranks among the world’s worst. Some countries, like China, have implemented plans allowing them to shut the limited number of portals that connect their cyberspace to the outside world. Other nations, like North Korea, have such limited cyberspace and cyber dependence that there is almost nothing to defend. America’s connectivity to the rest of the world is unlimited and controlled by no plan or agency. If, as a result of a cyber-war attack, our power grids failed, trains stopped and the financial sector froze, the government’s response today would make former–FEMA Director Michael Brown’s performance after Katrina truly look like one “hell of a job.”

While we do have Cyber Command, it has a defensive mission largely limited to protecting the Defense Department. Cyber Command says someone else needs to defend civilian entities, specifically, the Department of Homeland Security (DHS). Unfortunately, DHS has neither a plan nor the capability to defend private-sector infrastructure from a cyber attack. Thus, electric power, gas pipelines, rail and air transport, banking, food-distribution networks and other key systems are defenseless against nation-state cyber attacks.

This asymmetry, in which we are developing offensive capability but doing little to prevent a devastating cyber attack, began in the Bush administration. In the last year of his eight-year presidency, George W. Bush signed a national-security decision called PDD-54. That directive, still classified, ordered steps be taken to improve the security of the Department of Defense and other federal-government computer networks. Critics say it did almost nothing to address the weaknesses of the national infrastructure. President Obama launched a sixty-day review of cyber policy in March, but it resulted in no new major initiatives. He did announce the creation of a cybersecurity position within the staff of the National Security Council (NSC). But it has yet to be filled permanently. The new staffer will report not only to bosses in the NSC staff, but also to Director of the National Economic Council Lawrence Summers—who has vehemently criticized government cybersecurity efforts in the past as imposing costly burdens on U.S. companies, whose leaders supposedly know best what level and type of cybersecurity they need.

When pressed about America’s lack of cyber defenses, several officials privately suggested that there was no nation today that would want to hurt us like that. If that philosophy were applied more broadly to the defense budget, the nation could save hundreds of billions annually—and be left entirely defenseless.

THE FACT that legislators and policy makers do not understand the strategy issues surrounding cyber war may stem from the lack of public discussion, absence of academic contribution, minimal media coverage and insistence on unnecessary government secrecy. A multidepartment effort this year to develop a cyber-war-deterrence strategy produced a paper that is still labeled “secret.” The last time someone thought a secret could deter an opponent was when 1960s movie character Dr. Strangelove yelled at the Soviet ambassador that a deterrent weapon only works “if you tell us you have it.” America was not sufficiently deterred in that movie scenario (an air-force general launched an attack which resulted in escalation into global destruction).

In the absence of a public cyber-war strategy, we do not know today whether an air-force general could launch an effective cyber war. We have not had the basic discussion of whether the United States is better-off with the advent of cyber-war capabilities, or whether it is we who will be deterred in the future by the threat of cyber attack on our vulnerable infrastructure.

Although President Obama may not yet know it, his freedom to maneuver in the world is likely already restricted by those vulnerabilities. Perhaps in a crisis, someone will tell him. Or maybe he will learn it by looking out the window at a darkened city after he has ordered a bombing raid on Iran, or sent a carrier battle group to protect Taiwan, or done something to irritate the Dear Leader of Pyongyang.

Maybe then he will ask policy questions such as: How does deterrence work in cyber war when our capabilities are secret and our weapons undemonstrated? Should we, because of our own vulnerabilities to cyber attack, initiate cyber-arms-limitation talks, instead of our current policy of opposing them? Can arms control work in cyberspace when verification is so difficult? Strategic defense was not possible in nuclear strategy, despite Ronald Reagan’s best efforts, but does that also apply to cyber war? Can public discussion, international norms and established lines of communication result in some sort of risk-reduction process to address the issues of crisis instability that seem to be inherent in cyber war? Are the generals and admirals at Cyber Command more thoughtful than SAC’s leaders were at the advent of the era of strategic nuclear war? We would like to think so, but in the absence of public-policy development, the American people cannot know the answer to that or to the many other questions that the possibility of cyber war raises. It is time for that public discussion.

Richard Clarke was special adviser to the president for cybersecurity in the George W. Bush administration. He is now chairman of Good Harbor Consulting. His book Cyber War, coauthored with Robert Knake, will be published by HarperCollins in the spring.

In the most likely scenarios cyber-attacks will be used in coordination with other forms of assaults, including physical combat, either to distract opponents or merely cause more damage, the experts say. However, the report also indicates how difficult it remains simply to understand when many forms of cyber-attack are occurring, let alone who they should be attributed to.

The report does not conclude that the Air Force should invest significantly in any specific mechanisms to prepare or react to cyber-war at present, but it does recommend substantial attention to be given to planning for potential scenarios, and call for continued commitment to federal initiatives aimed at helping private grid providers to improve their IT security standing.

“The lessons from traditional warfare cannot be adapted to apply to attacks on computer networks, cyber-space must be addressed in its own terms.” Martin C. Libicki, the report’s lead author and senior management scientist at Rand said in a summary.

“Operational cyberwar has the potential to contribute to warfare. how much is unknown and, to a large extent, unknowable,” the report contends. “Because a devastating cyber-attack may facilitate or amplify physical operations and because an operational cyber-war capability is relatively inexpensive, it is worth developing.”

The Rand paper echoes the sentiment that too much attention is presently being given to easily-detected denial-of-service type assaults, versus those tied to computing infrastructure infiltration and quiet interference or manipulation of important systems — the kind of cyber-attacks that can be used to inflict damage for longer periods of time while being less likely to be detected.

Because military networks use the same IT systems as their civilian networks, they have similar vulnerabilities, but in some senses, it may be wise for the military to keep its hands out of attacks aimed at private organizations to ensure that those companies continue to feel compelled to invest in their own defenses, Libicki’s group’s research contends.

Overall, the report reaffirms the concept that while the entire theater of electronic warfare remains extremely nascent and unproven, it clearly represents one of the most important areas of development for future U.S. national defense and military strategies.

“Cyber-defense remains the Air Force’s most important activity within cyberspace,” concludes the Rand paper. “Although most of what it takes to defend a military network can be learned from what it takes to defend a civilian network, the former differ from the latter in important ways. Thus, the Air Force must think hard as it crafts its cyber-defense goals, architectures, policies, strategies, and operations.”

Follow eWeek Security Watch on Twitter at: eWeekSecWatch.

Matt Hines has been following the IT industry for over a decade as a reporter and blogger, and has been specifically focused on the security space since 2003, including a previous stint writing for eWeek and contributing to the Security Watch blog. Hines is currently employed as marketing communications manager at Core Security Technologies, a Boston-based maker of security testing software. The views expressed herein do not necessarily represent the views of Core Security, and neither the company, nor its products and services will be actively discussed in the blog. Please send news, research or tips to SecurityWatchBlog@gmail.com.

But Libicki argues that cyberwar presents unique challenges that hinder cyberdeterrence, such as the difficulty of knowing who attackers are, what damages they caused, and if they can repeat the attack.

“Hitting the wrong person back not only weakens the logic of deterrence…but makes a new enemy,” Libicki wrote. “Instead of facing one potential cyberwar, the defender may now face two.”

While deterrence may not be a viable strategy, the U.S. military still must protect its networks and systems, which it uses to function, Libicki told SCMagazineUS.com on Thursday.

“The military has no choice but to assess the threats against it and protect its networks as well as it can,” he said. “They do have to be continually prepared.”

In the report, he suggested focusing on diplomatic, economic and prosecutorial efforts.

Cybersecurity has received considerable attention by the military this year.

In June, Defense Secretary Robert Gates ordered the establishment of the U.S. Cyber Command to protect military networks and organize digital security efforts underway at the Pentagon.

The command is not yet operational but is expected to be soon, Department of Defense (DoD) spokesman Lt. Col. Eric Butterbaugh told SCMagazineUS.com in an email on Thursday.

The Navy last week announced it will merge its information technology, intelligence and communications operations into one organization to improve cybersecurity efforts. The reorganization is planned to be completed by the end of the year.

In addition, during August the 24th Air Force Command, intended to defend the Air Force from cyber intrusions, was activated.