Leaving Deterrence Behind: War-Fighting and National Cybersecurity

How should the United States organize itself to deal with the threat of cyberaggression? The initial effort of the Obama Administration, released in May 2009, focuses attention on the organizational and bureaucratic decisionmaking infrastructure necessary for cybersecurity and provides some general guidelines about goals and means. It does not address the more fundamental question of strategic approach. This article suggests the time has come to resolve the core issue of what organizing principle should drive national cybersecurity policy. Specifically, we argue that an offense-defense strategic framework must be adopted to think about and organize against cyber threats in the 21st century. This means that the United States must set aside deterrence–-the dominant strategic anchor of the past fifty-plus years-–and adopt a full war-fighting posture. What has worked in the nuclear realm, and remains relevant for homeland security against WMD terrorism, will not work in cyberspace.