The Trump administration’s National Cyber Strategy rests on a pair of convenient fictions.

I used to think we didn’t have enough strategic documents guiding U.S. cyber policy. Now I think we have at least one too many. In September, the Trump administration published a National Cyber Strategy—proudly declaring that it was the first fully articulated cyber strategy in 15 years. This week, the annual intelligence threat hearing laid bare the fantasy world of that four-month-old document and the cold hard reality of, well, reality.

The National Cyber Strategy paints an aspirational view of how the U.S. is doing in cyberspace and what we should do in the future. To be fair, aspirational isn’t all bad. Strategy documents need to inspire, not depress. And the strategy’s four pillars seem as unobjectionable as motherhood and apple pie: defending the homeland and America’s way of life; promoting American prosperity; preserving peace through strength; and advancing American interests. Who could argue with that? The best strategies articulate a future world, lay out a pathway to get there, generate new ideas, and align the disparate elements of government on a common path to succeed. Given how hard it is to keep the government lights on these days, getting on the same page about anything is a big deal.

Read the rest at The Atlantic.

This piece originally appeared at Brookings.

In December, Secretary of State Pompeo said Russia had 60 days to come back into compliance with the Intermediate-range Nuclear Forces (INF) Treaty. Otherwise, the United States would suspend its treaty obligations.

The clock runs out on February 2. Unfortunately, U.S. and Russian officials, already anticipating the treaty’s demise, have turned to finger-pointing…and Washington is losing the blame game.

CHARGES OF TREATY VIOLATIONS

In 2014, the United States charged Russia with violating the INF Treaty by testing a ground-launched cruise missile to intermediate range (500-5,500 kilometers). In 2017, Washington said Russia had begun to deploy the offending missile, later identified by the Russian designator 9M729.

U.S. officials for several years provided little public information to substantiate their charge. However, one could still believe that Russia had violated the treaty—or at least that the U.S. government believed that Russia had violated the treaty. When the Obama administration declared Russia in violation in 2014, it handed its Republican critics a large chunk of red meat, and they only too happily mocked President Obama as naïve in his desire to reduce nuclear arms. Had there been any ambiguity in the U.S. evidence, the Obama administration surely would not have exposed itself to that.

Moscow nonetheless has denied violating the treaty and charges Washington with three violations. Two charges don’t bear scrutiny, and Russian officials themselves seem to recite them merely for form’s sake, but the charge regarding the Mk-41 launcher for missile interceptors at the Aegis Ashore facility in Romania has some basis. Mk-41 launchers on U.S. warships can hold a variety of missiles, including cruise missiles.

The U.S. military does not have cruise missiles secreted in Romania, but the Russian concern is understandable. Were the positions reversed, Washington might well raise the point.

U.S. and Russian officials met in Geneva on January 15 to discuss the INF Treaty and compliance issues. The Russians reportedly offered some kind of exhibition of the 9M729 missile, but U.S. officials said it did not satisfy their concerns. It does not appear the American side tried to improve the terms of the Russian offer but instead sought total surrender by the Russian side, which was not going to happen.

Afterwards, American officials told the press that the Russian ideas did not break new ground. Russian officials called the U.S. approach “uncompromising.”

WHO KILLED THE TREATY?

The blame game is now on. Perhaps due to the partial government shutdown in Washington, Moscow is winning.

Russian officials have actively made their case since President Trump in October said the United States would leave the treaty. On January 23, the Russians held a briefing outside of Moscow for journalists and foreign military attachés to rehash their charges of U.S. treaty violations and explain their claim that the 9M729 was treaty-compliant. The briefing compared the dimensions of the 9M729 to the 9M728, a somewhat shorter missile with a range of less than 500 kilometers (thus treaty-compliant), and claimed the former had the same engine and fuel capacity but a larger warhead and thus a shorter range. The briefing revealed some previously undisclosed details about the 9M729, which may or may not be true.

Russian military officers then exhibited the 9M729 and 9M728 missiles. Well, no. They exhibited canisters labeled 9M729 and 9M728. Whether the canisters actually contained missiles is anyone’s guess.

The problem for Washington, however, is that the Russian narrative includes far more detail and specifics than the U.S. presentation. American officials handicapped themselves for years by refusing to reveal the basis for their charge about the 9M729, citing the need to protect sources and methods. Losing the public relations battle could have diplomatic consequences as Washington seeks to rally allies to its case.

It was only in December that Director of National Intelligence Dan Coats explained that the Russian military had tested the 9M729 from a fixed launcher to a range greater than 500 kilometers (that would be okay, if the missile were a sea-launched cruise missile). The Russians then tested the 9M729 from a mobile ground launcher to a range of less than 500 kilometers, apparently hoping the U.S. intelligence community would not make the connection between the two.

Coats’s briefing helped, but Washington continues to play catch up in the blame game. Since it is the United States that has said it will cease observing the treaty’s terms, it needs to do better to fix responsibility for the treaty’s end on Moscow.

SAVE THE TREATY?

In this regard, rejecting the Russian January 15 offer of an exhibition was a mistake. U.S. officials instead should have pocketed the proposal and defined terms for a meaningful exhibition and technical briefing. That would have meant looking not at canisters but at the missile and inside the missile to see things such as the engine and fuel tank. Procedures would have been needed to ensure a real 9M729 was exhibited. This would have taken negotiation, but smart technical experts might have worked out something.

In order to get the Russians to go that far, Washington would have had to be prepared to address Russian concerns about the Mk-41 launcher—perhaps an exhibition and technical briefing? The U.S. side was not ready for that.

That’s unfortunate. Taking up the Russian offer and then pressing to make the exhibit meaningful, combined with a readiness to exhibit the Mk-41, would have positioned Washington to show that it was making every effort to find a solution and that Russia, not the United States, bears responsibility for the end of the INF Treaty. And who knows? It would have created a small chance of finding a way to resolve the sides’ compliance concerns and save the treaty.

War is changing, and the U.S. military can now use cyber weapons as digital combat power.

When and how that’s done is the subject of a new book, Bytes, Bombs and Spies: The Strategic Dimensions of Offensive Cyber Capabilities, edited by Herb Lin and Amy Zegart at the Center for International Security and Cooperation and the Hoover Institution.

US military doctrine defines offensive cyber operations as operations intended to project power by the application of force in and through cyberspace. This is defined as actions that disrupt or destroy intended targets.

At a time when US cyber policy is taking a new direction, Bytes, Bombs and Spies is one of the first books to examine strategic dimensions of using offensive cyber operations. With chapters by leading scholars, topics include US cyber policy, deterrence and escalation dynamics, among other issues. Many of the experts conclude that research, scholarship, and more open discussion needs to take place on the topics and concerns involved.

Lin and Zegart are senior research scholar and senior fellow, respectively, at Stanford’s Center for International Security and Cooperation. Max Smeets, a CISAC cybersecurity postdoctoral fellow, is also a contributor to the book.

Offensive cyber rising

Examples in recent years of offensive cyber usage include the Stuxnet computer virus that destroyed centrifuges in Iran and slowed that country’s attempt to build a nuclear weapon; cyber weapons employed against ISIS and its network-based command and control systems; and reported cyber incursions against North Korea’s ballistic missiles system that caused launch failures.

“If recent history is any guide, the interest in using offensive cyber operations is likely to grow,” wrote Lin and Zegart.

One key issue is how to best respond to cyberattacks from abroad, such as the 2015 theft of millions of records from the Office of Personnel Management, the 2016 U.S. election hacking, and the 2017 WannaCry ransomware attack that affected computers worldwide, to name but a few. Those incidents have “provided strong signals to policymakers that offensive cyber operations are powerful instruments of statecraft for adversaries as well as for the United States,” Zegart and Lin wrote.

In September 2018, the White House reportedly issued a directive taking a more aggressive posture toward cyber deterrence. This measure allows the military to engage, without a lengthy approval process, in actions that fall below the “use of force” or a level that would cause death, destruction or significant economic effects. Also, US Cyber Command was elevated to an independent unified command, giving it more independence in conducting offensive cyber operations.

These new policy directions make it all the more imperative that offensive cyber weapons be researched, analyzed and better understood, wrote Lin and Zegart.

Conceptual thinking lags

The 438-page Bytes, Bombs and Spies includes 16 chapters by different authors. Topics include the role and nature of military intelligence, surveillance, and reconnaissance in cyberspace; how should the United States respond if an adversary employs cyberattacks to damage the U.S. homeland or weaken its military capabilities; a strategic assessment of the U.S. Cyber Command vision; and operational considerations for strategic offensive cyber planning; among others.

“Conceptual thinking,” Lin and Zegart noted, lags behind the technical development of cyber weapons. Some issues examined include:

• How might offensive cyber operations be used in coercion or conflict?

• What strategic considerations should guide their development and use?

 • What intelligence capabilities are required for cyber weapons to be effective?

• How do escalation dynamics and deterrence work in cyberspace?

• What role does the private sector play?

Scholars at universities and think tanks need to conduct research on such topics, Zegart said. “Independent perspectives contribute to the overall body of useful knowledge on which policymakers can draw.”

In the chapter Lin wrote on “hacking a nation’s missile development program,” he noted that cyber sabotage relies on electronic access to various points in the life cycle of a missile, from its construction to ultimate use.

“For some points, access is really hard to obtain; in other points, it is easier.  Access can be technical (what might be obtained by hacking into a network) or human (what might be obtained by bribing or blackmailing a technician into inserting a USB thumb drive),” he said. 

One key, Lin said, is the availability of intelligence on the missile and the required infrastructure needed to fabricate, assemble, and launch the missile. 

“Precisely targeted offensive cyber operations generally require a great deal of detailed technical information, and such information is usually hard to obtain, especially if the missile program is operated by a closed authoritarian government that does not make available much information on anything,” he said.

Origins in cyber workshop

The idea for Bytes, Bombs and Spies originated from a 2016 research workshop led by Lin and Zegart through the Stanford Cyber Policy Program. That event brought together researchers from academia and think tanks as well as current and former policymakers in the Department of Defense (DoD) and U.S. Cyber Command.

“We organized the workshop for two reasons,” wrote Lin and Zegart. “First, it was already evident then—and is even more so now—that offensive cyber operations were becoming increasingly prominent in U.S. policy and international security more broadly. Second, despite the rising importance of offensive cyber operations, academics and analysts were paying much greater attention to cyber defense than to cyber offense.”

Herb Lin is the Hank J. Holland Fellow in Cyber Policy and Security at the Hoover Institution and senior research scholar for cyber policy and security at the Center for International Security and Cooperation, a center of the Freeman Spogli Institute for International Studies.

Amy Zegart is the Davies Family Senior Fellow at the Hoover Institution, where she directs the Robert and Marion Oster National Security Affairs Fellows program. She is founder and co-director of the Stanford Cyber Policy Program, and senior fellow at the Center for International Security and Cooperation, a center of the Freeman Spogli Institute for International Studies.

Media Contacts

Clifton B. Parker, Hoover Institution: 650-498-5205, cbparker@stanford.edu

Today, January 14, marks the 25^th anniversary of the Trilateral Statement.  Signed in Moscow by President Bill Clinton, Russian President Boris Yeltsin and Ukrainian President Leonid Kravchuk, the statement set out the terms under which Ukraine agreed to eliminate the large arsenal of former Soviet strategic nuclear weapons that remained on its territory following the collapse of the Soviet Union.

Among other things, the Trilateral Statement specified the security assurances that the United States, Russia and Britain would provide to Ukraine eleven months later in the Budapest Memorandum on Security Assurances.  Unfortunately, Russia grossly violated those assurances in 2014 when it used military force against Ukraine.

Soon after regaining independence, Ukraine’s leadership indicated its intention to be a non-nuclear weapons state.  Indeed, the July 16, 1990 declaration of state sovereignty adopted by the Rada (parliament) adopted that goal.  Kyiv had questions, however, about the terms of the elimination of the strategic weapons.

First, eliminating the intercontinental ballistic missiles (ICBMs), bombers, ICBM silos and nuclear infrastructure would cost money.  Ukraine’s economic future in the early 1990s was uncertain (the economy ended up declining for most of the decade).  Who would pay for the expensive elimination process?

Second, the strategic nuclear warheads had economic value as they contained highly enriched uranium.  That could be blended down into low enriched uranium to fabricate fuel rods to power nuclear reactors.  If Ukraine shipped warheads to Russia for dismantlement, how would it be compensated for the value of the highly enriched uranium they contained?

Third, nuclear weapons were seen to confer security benefits.  What security guarantees or assurances would Kyiv receive as it gave up the nuclear arms on its territory?

These questions were reasonable, and Kyiv deserved good answers.  In 1992 and the first half of 1993, Ukrainian and Russian officials met in bilateral channels to discuss them, along with other issues such as a schedule for moving warheads to Russia.  In parallel, U.S. officials discussed similar issues with their Ukrainian and Russian counterparts.

However, in September 1993, a Ukrainian-Russian agreement dealing with the nuclear issues fell apart.  Washington decided to become more directly involved out of fear that a resolution might otherwise not prove possible, giving birth to the “trilateral process.”  Discussions over the course of the autumn led U.S. negotiators in mid-December to believe that the pieces of a solution were ready.

In a negotiation in Washington in early January 1994, U.S. Ambassador-at-large Strobe Talbott, Ukrainian Deputy Prime Minister Valeriy Shmarov and Deputy Foreign Minister Borys Tarasyuk, and Russian Deputy Foreign Minister Georgiy Mamedov and their teams finalized answers to Kyiv’s three questions, and wrote them into what became the Trilateral Statement and an accompanying annex.

The United States agreed to provide Nunn-Lugar Cooperative Threat Reduction funds to finance the elimination of the strategic delivery systems and infrastructure in Ukraine.  Specifically, $175 million would be made available as a start.

The three sides agreed that Russia would compensate Ukraine for the value of the highly enriched uranium in the nuclear warheads transferred to Russia for elimination by providing Ukraine fuel rods containing an equivalent amount of low enriched uranium for its nuclear reactors.  In the first ten months, Ukraine would transfer at least 200 warheads, and Russia would provide fuel rods containing 100 tons of low enriched uranium.

The sides laid out in the Trilateral Statement the specific language of the security assurances that Ukraine would receive once it had acceded to the Non-Proliferation Treaty as a non-nuclear weapons state.  Although Kyiv had sought security guarantees, Washington was not prepared to extend what would have been a military commitment similar to what NATO allies have; the assurances were the best that was on offer.

Two issues—the date for transfer of the last nuclear warheads out of Ukraine and compensation for the highly enriched uranium that had been in tactical nuclear warheads removed from Ukraine to Russia by May 1992—nearly derailed the Trilateral Statement.  The sides, however, agreed to address those in private letters.

Presidents Clinton, Yeltsin and Kravchuk met briefly in Moscow on January 14, 1994 and signed the Trilateral Statement.  That set in motion the transfer of nuclear warheads to Russia, accompanied by parallel shipments of fuel rods to Ukraine.  The deactivation and dismantlement of missiles, bombers and missile silos in Ukraine began in earnest with Cooperative Threat Reduction funding.

In December 1994, Ukraine acceded to the Non-Proliferation Treaty and received security assurances from the United States, Russia and Britain in the Budapest Memorandum.  France and China subsequently provided Kyiv similar assurances.

Ukraine fully met its commitments under the Trilateral Statement.  The last nuclear warheads were transferred out of Ukraine in May 1996.

The other signatories met their commitments—with one glaring exception.  In 2014, Russia used military force to illegally seize Crimea, in violation of its Budapest Memorandum commitments “to respect the independence and sovereignty and the existing borders of Ukraine,” and “to refrain from the threat or use of force” against Ukraine.  Russian security and military forces then instigated a conflict in the Donbas region in eastern Ukraine, a conflict that has claimed more than 10,000 lives and continues to simmer.

At the time, the Trilateral Statement was seen as a major achievement in Washington, as it eliminated hundreds of ICBMs and bombers and nearly 2,000 strategic nuclear warheads that had been designed and built to strike the United States.  Not surprisingly, in light of Russia’s aggression, many in Ukraine now question the value of the Trilateral Statement and Budapest Memorandum.  They argue that, had Ukraine held on to at least some nuclear weapons, Russia would never have dared move on Crimea and Donbas.

That argument is understandable and perhaps correct (although alternative histories are not always easy to envisage).  However, had Ukraine tried to keep nuclear weapons, it would have faced political and economic costs, including:

·      Kyiv would have had limited relations, at best, with the United States and European countries (witness the virtual pariah status that a nuclear North Korea suffers).  In particular, there would have been no strategic relationship with the United States.

·      NATO would not have concluded a distinctive partnership relationship with Ukraine, and the European Union would not have signed a partnership and cooperation agreement, to say nothing of an association agreement.

·      Kyiv would have received little in the way of reform, technical or financial assistance from the United States and European Union.

·      Western executive directors would have blocked low interest credits to Ukraine from the IMF, World Bank and European Bank of Reconstruction and Development.

To be sure, one can debate the value of these benefits.  But those who now assert that Ukraine should have kept nuclear arms should recognize that keeping them would have come at a steep price.  Moreover, in any confrontation or crisis with Russia, Ukraine would have found itself alone.

This article originally appeared at Brookings.

On December 21, the United Nations General Assembly voted down a Russian-proposed resolution calling for support for the INF Treaty. That Moscow gambit failed, in large part because Russia is violating the treaty by deploying prohibited missiles.

This bit of diplomatic show came one week after Russian officials said they would like to discuss INF Treaty compliance concerns. That could be—not is, but could be—significant. Washington should test whether those suggestions represent just more Kremlin posturing or a serious effort to save the treaty.

THE INF TREATY

Ronald Reagan and Mikhail Gorbachev signed the INF Treaty in 1987. It resulted in the elimination of some 2,700 U.S. and Soviet missiles. The treaty continues to ban the United States and Russia from having ground-launched missiles of intermediate range (500-5,500 kilometers) as well as from having launchers for such missiles.

In 2014, the U.S. government publicly charged that Russia had violated the treaty by developing and testing a ground-launched intermediate-range cruise missile. In early 2017, U.S. officials said the Russian military had begun deploying it.

From 2013 to late 2017, Russian officials claimed that they did not know what missile Washington had in mind. After a U.S. official revealed that the Russian designator for the offending missile was 9M729, Russian officials conceded that the 9M729 ground-launched cruise missile existed but asserted that its range did not exceed 500 kilometers.

On December 4, NATO foreign ministers stated that the development and deployment of the 9M729 constituted a material breach of the INF Treaty. Secretary of State Pompeo the same day said that, if Russia did not return to compliance within 60 days, the United States would suspend its obligations under the treaty, meaning that it would face no treaty bar to testing and deploying its own intermediate-range missile. U.S. suspension of its obligations would relieve Russia of the requirement to observe its obligations.

The treaty seemed fixed on a path for demise.

SIGNS OF POSSIBLE LIFE?

Then, on December 14, Reuters reported that a Russian foreign ministry official had said Moscow envisaged the possibility of mutual inspections to resolve the sides’ compliance concerns. The next day, the Associated Press and TASS said Defense Minister Shoygu had sent Secretary of Defense Mattis a message proposing “open and specific” talks on compliance issues.

As with the failed U.N. resolution, these statements could just represent posturing. Indeed, given the lack of serious engagement for nearly five years, it likely is part of Moscow’s effort to ensure that blame for the INF Treaty’s end falls on Washington.

There is, however, a small chance that the Russians seek a settlement. U.S. officials should explore this, if for no other reason than that a failure to do so would increase the prospects that Washington bears the responsibility for the agreement’s collapse in the eyes of publics and allies.

The big question: Are the Russians willing to exhibit the 9M729 and provide a technical briefing to American experts on why the missile’s range does not exceed 500 kilometers? That invariably would entail questions about the capacity of the missile’s fuel tanks and power of its engine. U.S. experts might also ask why, if the 9M729 can fly no further than 500 kilometers, Russia built the missile when it already deploys the modern 9M728, a ground-launched cruise missile whose range is also less than 500 kilometers.

Working out the details for this kind of exhibit and briefing would require some patience and delicacy. It would require agreeing to procedures not specified in the INF Treaty. It would also require steps to ensure that U.S. experts had the opportunity to view a 9M729, not something else. But the State Department, Defense Department, and intelligence community have bright people who could figure out how to make this work.

Of course, if the 9M729’s range exceeds 500 kilometers, the treaty requires its elimination. Senior American officials, however, have allowed for the possibility that Russia might satisfy U.S. concerns by modifying the missile so that it could not fly to intermediate ranges.

WOULD HAVE TO BE MUTUAL

Russian readiness to conduct the exhibit poses one test. A second test is for the American side. While denying that they have violated the INF Treaty, Russian officials charge that the United States has committed three violations. Two of the charges lack any real foundation, and Russians themselves seem to be setting them aside.

They continue, however, to press a third charge. The Russians assert that the Mk-41 launcher used by the Aegis Ashore missile defense facility in Romania can hold and launch offensive cruise missiles of intermediate range in addition to the Mk-41’s stated purpose of containing and launching SM-3 missile interceptors.

U.S. officials respond that the Mk-41 launcher used in Romania (and soon to be deployed at an Aegis Ashore site in Poland) has not been tested with a ground-launched missile. They argue that it thus is not a prohibited intermediate-range missile launcher.

Technically, U.S. officials may be correct. Moreover, nothing suggests that the Aegis Ashore facility hosts anything but SM-3 missile interceptors.

However, the Mk-41 launcher is standard on U.S. Navy warships. On board warships, the Mk-41 holds a variety of weapons in addition to SM-3 interceptors, including the BGM-109C Tomahawk land-attack cruise missile. The Tomahawk has a range of about 1,500 kilometers. Other than that it is launched from the sea rather than land, it shares many similarities with the BGM-109G ground-launched cruise missiles eliminated under the INF Treaty.

Were the Russians instead of the Americans using something like the Mk-41 launcher on land, the U.S. side might well have questions about its compliance with the treaty.

Speaking in mid December, a Russian foreign ministry official ruled out a unilateral demonstration of the 9M729 but seemed to leave open the possibility for mutual measures. If Russian officials were prepared to allow an exhibit and provide a technical briefing on the 9M729, U.S. officials should be prepared to demonstrate the Mk-41 launcher in Romania to Russian experts and explain why it cannot hold cruise missiles. If it can do so, there should be ways to address Moscow’s concerns, either by modifying the shore-based Mk-41 or allowing periodic visits by Russian experts to show that the launchers contain SM-3 missile interceptors only.

Again, working out the details for such a demonstration would take some time, but the sides have experts with the expertise to do so.

AN OPPORTUNITY?

Some may object that this kind of proposal equates Russia’s material breach of the INF Treaty with a question of technical compliance on the American side. Perhaps, but U.S. officials—and European officials, since the treaty affects their security—should ask whether offering to address Russian questions about the Aegis Ashore’s Mk-41 launcher is worth the chance to resolve the 9M729 issue and preserve the INF Treaty.

At worst, if Russia is merely posturing, U.S. officials will be able to cite their effort and finger Moscow’s lack of seriousness. At best, they could preserve a treaty that has made a substantial contribution to U.S., European, and global security.

Washington should take up Moscow’s offer for dialogue. It can do so while allowing the 60-day clock to run, though it might consider allowing more time if technical talks get underway and make progress.

The INF Treaty may still have a glimmer of hope, but someone still needs to act to save it.

Closing the gap between technology leaders and policy makers will require a radically different approach from the defense establishment.

A silent divide is weakening America’s national security, and it has nothing to do with President Donald Trump or party polarization. It’s the growing gulf between the tech community in Silicon Valley and the policy-making community in Washington.

Beyond all the acrimonious headlines, Democrats and Republicans share a growing alarm over the return of great-power conflict. China and Russia are challenging American interests, alliances, and values—through territorial aggression; strong-arm tactics and unfair practices in global trade; cyber theft and information warfare; and massive military buildups in new weapons systems such as Russia’s “Satan 2” nuclear long-range missile, China’s autonomous weapons, and satellite-killing capabilities to destroy our communications and imagery systems in space. Since Trump took office, huge bipartisan majorities in Congress have passed tough sanctions against Russia, sweeping reforms to scrutinize and block Chinese investments in sensitive American technology industries, and record defense-budget increases. You know something’s big when senators like the liberal Ron Wyden and the

In Washington, alarm bells are ringing. Here in Silicon Valley, not so much. “Ask people to finish the sentence, ‘China is a ____ of the United States,’” said the former National Economic Council chairman Keith Hennessey. “Policy makers from both parties are likely to answer with ‘competitor,’ ‘strategic rival,’ or even ‘adversary,’ while Silicon Valley leaders will probably tell you China is a ‘supplier,’ ‘investor,’ and especially ‘potential market.’”

Read the rest at The Atlantic.