Could a cyberattack against the United States start a physical war that is fought by the U.S. military?
President Biden just answered that question for the world: Yes.
Biden was addressing the staff at the Office of the Director of National Intelligence (ODNI) when he made the following statement:
"I think it's more likely we're going to end up… if we end up in a war, a real shooting war, with a major power, it's going to be as a consequence of a cyber breach of great consequence."
That seems like a pretty definitive answer to a question many have been asking for years.
However, sometimes one answer leads to additional questions.
Is there a precedent for such a statement from a U.S. leader? And what could be the purposes behind a direct statement like this?
Can a cyberwar start a physical war?
SecureWorld News reached out to CNN Military Analyst Colonel Cedric Leighton for perspective. Leighton held cryptology and cyber leadership roles during his years in the U.S. Air Force, and he recently delivered the keynote at our SecureWorld Gov-Ed conference. Col Leighton said:
"President Biden's comment that a cyber attack 'of great consequence' could result in a shooting war is the latest acknowledgement by a high-level U.S. leader that the country is keeping its options open when it comes to such an event."
SWN: So U.S. leaders have made statements like this before?
Col. Leighton: "During the Obama Administration, the then-Vice Chairman of the Joint Chiefs, General James Cartwright, made a similar comment. General Cartwright had wanted the U.S. to develop a menu of options so that cyberattacks of a very high magnitude—ones that would result in high numbers of civilian and military casualties—would potentially result in a kinetic response from the U.S. side.
What's different this time is that the President himself is making it crystal clear that he not only recognizes the danger posed by cyberattacks but that he's willing to use all the military powers at his disposal to answer such an attack."
SWN: Was this a message for our cyber enemies?
Col. Leighton: "Such a statement puts both our adversaries and our allies on notice that we take cyberattacks seriously. It's also a signal to the U.S. military that it needs to be ready to provide the president with multiple options whenever a serious cyber attack is detected."
SWN: What else should we take away from a statement like this?
Col. Leighton: "The timing of the president's statement is also noteworthy. The current Vice-Chairman, General Hyten, revealed in a little-noticed statement the other day that in a series of war games with a near-peer competitor, the U.S. lost control of its networks.
The result was disastrous for the U.S. side.
Luckily, this was 'just' an exercise, but the terrible performance of U.S. forces in this exercise has resulted in the elimination of the information dominance-based doctrine we've used over the past few decades. That old doctrine won't work in what I'll call the 'New Cyber Age.'
The U.S. military is, thankfully, recognizing this and is on a path to, hopefully, develop doctrine, strategies, and tactics that better reflect the type of environment we'll be fighting in."
SWN: Does this mean there are more policy shifts ahead?
Col. Leighton: "Clearly, there will be big changes in the U.S. security posture over the next decade or so. These changes will affect both the military and civilian sectors, and they can't come soon enough if we're going to preserve our way of life and our system of governance."
For a long time now, cybersecurity leaders have said that cyber risk is business risk.
Now we know it is also national security risk—one that could lead to a U.S. military response.