There are only a few courses of action available when it comes to addressing cyber threats. The first is the maintenance of the status quo: victim hood. Note that organizations that deal with cyber threats all have “response” in their name and you will realize that INFOSEC today is almost entirely reactive.
The second course of action has the government building the capability to bring law and order to cyberspace. This is unlikely if for no other reason than the stateless nature of the Internet precludes exercising dominion by any single nation. Consider that the Department of Justice’s cyber crime budget for 2005 was projected to be roughly $300 million dollars and a similar program within Homeland Security’s was much less.6 Contrast cyber defense spending to the tens of billions of dollars malicious actors are estimated to be making and you will understand the priority cyber threat has on Capitol Hill.7
The final option – outsourcing – has private-sector enterprises performing the tasks necessary to defend national interests online. Unlike the government the private sector has ample resources and a strong motivation to succeed: reducing threats means less risk which translates into higher profits.
I’m loving this. Read the whole thing. Non-state actors are eating our lunch in the infowar and the regularly constituted authorities of my beloved Westphalian nation-state have neither the mandate, the resources, nor the political will to capture or destroy enemies in cyberspace. Those of us who still think America and Americans and American minds and American intellectual, virtual, and physical property are still worth protecting are rapidly realizing the limits of .gov.
I’m old. Meatspace analogies make sense to me. The Bad Guys in cyberspace are numerous but most of them don’t work well together. Cyberspace is Major Dundee meets The Road Warrior. Rustlers, horse thieves, and raiders under every rock, plus invading armies. Irregulars, a cyber Magnificent Seven, can do more than cavalry that never comes.