From the latest issue of the Harvard National Security Journal, a batch of very interesting pieces:
Vol. 3, Issue 1
Can It Really Work? Problems with Extending EINSTEIN 3 to Critical Infrastructure
By Steven M. Bellovin, Scott O. Bradner, Whitfield Diffie, Susan Landau, and Jennifer Rexford
In an effort to protect its computer systems from malevolent actors, the U.S. government has developed a series of intrusion-detection and intrusion- prevention systems aimed at monitoring and screening traffic between the internet and government systems. With EINSTEIN 3, the government now may seek to do the same for private critical infrastructure networks. This article considers the practical considerations associated with EINSTEIN 3 that indicate the program is not likely to be effective. Considering differences in scale, the inability to dictate hardware and software choices to private parties, and the different regulatory framework for government action in the private sector, this Article discusses why the government may be unable to effectively implement EINSTEIN 3 across the private networks serving critical infrastructure. Looking at what EINSTEIN aims to protect, what it is capable of protecting, and how privacy considerations affect possible solutions, this Article provides suggestions as to how to amend the EINSTEIN program to better protect critical infrastructure.
Loving the Cyber Bomb? The Dangers of Threat Inflation in Cybersecurity Policy
By Jerry Brito & Tate Watkins
There has been no shortage of attention devoted to cybersecurity, with a wide range of experts warning of potential doomsday scenarios should the government not act to better secure the Internet. But this is not the first time we have been warned of impending dangers; indeed, there are many parallels between present portrayals of cyberthreats and the portrayal of Iraq prior to 2003, or the perceived bomber gap in the late 1950s. This Article asks for a better justification for the increased resources devoted to cyber threats. It examines the claims made by those calling for increased attention to cybersecurity, and notes the interests of a military-industrial complex in playing up fears of a “cyber Katrina.” Cybersecurity is undoubtedly an important policy issue. But with a dearth of information regarding the true nature of the threat, it is quite difficult to determine whether certain government policies are warranted—or if this merely represents the latest iteration of threat inflation benefitting private and parochial political interests.
Modern warfare requires close integration of military and intelligence forces. The Secretary of Defense possesses authorities under Title 10 and Title 50 and is best suited to lead US government operations against external unconventional and cyber threats. Titles 10 and 50 create mutually supporting, not mutually exclusive, authorities. Operations conducted under military command and control pursuant to a Secretary of Defense-issued execute order are military operations and not intelligence activities. Attempts by congressional overseers to redefine military preparatory operations as intelligence activities are legally and historically unsupportable. Congress should revise its antiquated oversight structure to reflect our integrated and interconnected world.
Advantaging Aggressors: Justice & Deterrence in International Law
By Paul H. Robinson & Adil Ahmad Haque
Current international law imposes limitations on the use of force to defend against unlawful aggression that improperly advantage unlawful aggressors and disadvantage their victims. The Article gives examples of such rules, governing a variety of situations, showing how clearly unjust they can be. No domestic criminal law system would tolerate their use. There are good practical reasons why international law should care that its rules are perceived as unjust. Given the lack of an effective international law enforcement mechanism, compliance depends to a large degree upon the moral authority with which international law speaks. Compliance is less likely when its rules are perceived as obviously unjust. This common sense perspective is supported by social science research showing the importance of law’s moral credibility in gaining assistance and compliance, in reducing resistance and subversion, and in helping to shape shared norms. The current practice of victim states ignoring legal limitations, with studied indifference to such “violations” by the international community, only legitimizes and habituates law-breaking, further undermining international law’s moral credibility. One important opportunity for reforming international law is currently being squandered. The Assembly of State Parties to the International Criminal Court has recently approved a resolution defining the international crime of aggression. However, rather than confront international law’s existing problems, the drafters compounded them by imposing individual criminal liability on leaders of victim states who authorize defensive force in violation of flawed current law. Fortunately, the resolution will not go into effect until 2017 at the earliest. There is still time to change course.