By SeanLawsonWhat started last week as a series of reports on domestic spying by the NSA took a turn towards cyber security on Friday when Glenn Greenwald and Ewen MacAskill of The Guardian published the top secret Presidential Policy Directive 20 (PPD–20), which deals with U.S. policy and planning for cyber conflict. Like the other documents that The Guardian released, this one largely confirmed what those who pay close attention to these issues already knew: the United States is working to build up its offensive cyber warfare capabilities. But the document provides other insights as well, and perhaps even a small measure of consolation for cyber war critics.
First, we know from reporting by the New York Times this time last year that the United States has already engaged in offensive cyber attacks with the use of Stuxnet against Iranian nuclear facilities. Over the last year, other reports have pointed to various indicators of the United States’s preparations for offensive cyber warfare. By calling attention to that portion of PPD–20 that directs DoD and the intelligence community to draw up a list of possible targets for “Offensive Cyber Effects Operations (OCEO)” (p. 3), Greenwald and MacAskill have provided one more important bit of information about how U.S. plans for possible offensive cyber warfare are proceeding.
Second, PPD–20 provides an interesting tidbit related to cyber intelligence. Following the hack of HBGary Federal in 2011, various observers took note of the growing number of companies providing technologies and services for cyber intelligence to the U.S. government. One such technology was “persona management” software that can be used to facilitate online information gathering and perception management operations. Though the evidence for the existence of such tools and techniques seemed solid, some still questioned their reality. But PPD–20 makes reference to “the use of online personas” as a tool for “human intelligence operations undertaken via the Internet” (p. 5). This provides another, powerful piece of evidence for the reality of persona management.
Third, the document might provide some measure of consolation for cyber war critics. Though news of the President’s order to draw up a list of targets and circumstances for which cyber capabilities might be appropriate is a disappointing development for those of us who wish the Internet were not becoming a battlefield, it is not surprising that policy makers and planners are carrying out this kind of exercise. It is routine and makes sense. If you are going to have a weapon/capability, you should think in advance about when, where, against whom, and with what effects that capability/weapon can be used. So yes, it’s disappointing to see one more step towards the militarization of the Internet and the possibility of cyber war. On the other