The Wall Street Journal
February 21, 2009

The Central Asian Republic of Kyrgyzstan experienced a cyber attack last month that took down its two largest Web sites. But that's small beer compared to what happened to the Pentagon and several other U.S. agencies in 2007, when cyber attackers successfully hacked into their computer systems, including Defense Secretary Robert Gates's email.

Welcome to the brave new world of cyber war, an area where the U.S. lacks the dominance it enjoys in traditional military arenas. President Obama's recent appointment of Melissa Hathaway to head a 60-day cyber security review is a sign that he is serious about stepping up the battle in cyber space.

Like other forms of terrorism, cyber war offers an attacker asymmetrical advantages and can be used by individuals as well as governments to debilitate and confuse civilian and military targets. The more governments and economies rely on the Internet, the more vulnerable they become. Michael McConnell, the recently departed National Intelligence Director, called cyber security "the soft underbelly of this country."

The Bush Administration made some progress, such as last year's executive order creating the Comprehensive National Cyber Security Initiative. This highly classified $6 billion program aims to secure the dot-gov and dot-mil domains by instituting basic security measures for federal agencies. These include installing improved monitor programs -- known as "Einstein" -- to detect intrusions on federal computers, for example, and sharing attack information across federal departments.

The U.S. government deflects low-level cyber attacks every day. Many are seeking sensitive information, such as weapon designs or classified communications. Security experts say most hackers who target Washington appear to operate from China, although the nature of the Internet makes it impossible to know for certain. In 2007, the government reported nearly 13,000 information security attacks, more than twice the number in 2006. Brigadier General John Davis, deputy commander of the cyber security unit at U.S. Strategic Command, told us his mission deals with millions of cyber "events" every day, although not all of these turn out to be attacks.

Cyber attacks can also be coupled with conventional warfare, which is what happened in Georgia in August. Even before Russian tanks rolled over the border, hackers -- probably Russian -- probed Georgian government Web sites and took several down. Russian hackers are also believed to have attacked Estonia in 2007, freezing government and private information systems, including banks, for days, apparently in retaliation for Estonia's decision to remove a historic Russian statue.

The U.S. hasn't experienced such a coordinated and sustained attack, but no one is sure what would happen if it did. A known vulnerability is America's power grid, which could be disrupted for months by a sophisticated cyber attack, experts say. In telecommunications, banking and transportation, it's harder to predict how great the damage would be; the current season of the TV program "24" is showcasing some of the more unpleasant possibilities. It makes sense that one of Ms. Hathaway's first tasks is overseeing an assessment of the country's vulnerabilities.

The task is complicated by the lack of a legal framework that defines cyber war and security standards. It isn't clear whether the government can dictate security standards for private industry or if federal agencies can probe private networks to determine their safety. If you thought the debates over warrantless wiretapping were heated, get ready for fireworks over cyber security.

Responsibility for U.S. cyber security is shared across many federal agencies. The Departments of Defense and Homeland Security, the FBI, the CIA, armed services and others all have cyber security projects. A successful counterterrorism strategy has to be decentralized to some degree, but better coordination is needed. A good defense also requires a shift in mentality for anyone with access to sensitive computer systems -- even an ordinary flash drive can become a weapon if handled carelessly.

The experiences of Estonia and Georgia show that cooperating with allies to share information -- and possibly coordinate counterattacks -- is an important element of any response. Cyber warriors typically take control of computers in a third country, from which they launch their attacks. Negotiating agreements on cyber security with allies will also help make the U.S. more secure.

Mr. Obama released a statement on homeland security last month saying he would "declare the cyber infrastructure a strategic asset." That's a start. As the attacks on Kyrgyzstan remind, an aggressive response to the cyber threat can't come soon enough.