Information warfare strategy takes shape

Information warfare strategy takes shape

The Tutsi "cruelly kill mankind . . . they kill by dissecting Hutus . . . by extracting various organs from the bodies of Hutus . . . for example, by taking the heart, the liver, the stomach . . . the [Tutsi] eat men."
-Radio-Television Libre des Mille Collines, Rwanda

It was this sort of vitriol in 1994 that helped ignite the bloody and genocidal Rwandan civil war, which killed perhaps 800,000 men, women, and children, and plunged Central Africa into a chaos from which it still has not recovered.

Many observers and former government officials argue that the Rwandan crisis could have been prevented, or at least lessened, if the U.S. government had acted early and with a minimum of force, even by simply jamming the incendiary radio broadcasts. Jamming "might have saved a few hundred thousand people from getting their heads bashed in, but ... [the White House] decided not to give it any consideration," said James L. Woods, then-deputy assistant secretary of Defense for African affairs and now a partner with Cohen and Woods International, an Arlington, Va., firm that lobbies on behalf of African governments.

President Clinton later flew to Rwanda, in 1998, and apologized for the international community's failure to take action that might have prevented the 1994 slaughter. And it is with the lesson of Rwanda firmly in mind that Administration officials are now completing a Presidential Decision Directive on International Public Information, intended to coordinate the U.S. government's numerous public relations offices so that, if necessary, Washington can move quickly to counter future barrages of hate propaganda anywhere in the world. The directive will create a new post at the State Department-the coordinator for international public information. The job will be to harmonize the messages transmitted via top-level press secretaries, the U.S. Information Agency, ambassadors, and even the combat units of the Defense Department.

The new process is already being used in the Balkans. U.S. agencies there are working to persuade Serbian Kosovars to accept the NATO peace plan, mostly by broadcasting interviews of U.S. policy-makers directly into the satellite-television dishes in many Kosovo homes-thus eluding Serbian television-jamming devices. "Anecdotally, a lot of people are viewing it, and apparently it is having a lot of impact," said a U.S. government official who asked not to be named.

Just as the United States military and governmental leaders gradually learned to harness sea, air, and nuclear power to advance the nation's interests, White House officials, through this directive and other steps, are now trying to knit the power of information-and information technology-into all aspects of national security strategy.

When signed, the directive will not only complement a May 1998 directive asking the FBI to create a national cyberspace defense, it will also dovetail with the Pentagon's growing focus on "information superiority"-its goal of dominating all aspects of information collection and dissemination during wartime. Pentagon planners say that if they were to lump together all the money they plan to spend on collecting, creating, and disseminating information, it would amount to an astonishing $43 billion a year in the next few years. And already, Pentagon officials are upgrading anti-hacker defenses and electronic-eavesdropping satellites, as well as developing exotic weaponry that, among other things, would be able to burn out enemy computers with powerful electromagnetic pulses.

But the Information Revolution is doing much more than reshaping national defense strategy. It is also affecting the lives of citizens, both personally and professionally, in a great many ways. So whatever grand infowar schemes the governmental hatchers might hatch, they will constantly bump up against the competing interests of personal privacy, corporate profits, and ultimately, the nature of modern democracy.

Information Operations

Information has always been vital in the conduct of a war. Without it, no one could inform decision-makers, guide weapons, resupply armies, or arrange soldiers into coherent fighting units. But reformers argue that the new information technologies can do much more-that they can be used alongside the panoply of nuclear deterrents, high-tech "smart" weapons, and low-tech weapons to deflate vastly larger armies and to win wars away from the battlefield. Armed with this array, the U.S. lost fewer than 400 lives-most of them to accidents-as it smashed the huge Iraqi army during the Persian Gulf War. On the other hand, uncontrolled information can be immensely destructive to U.S. aims. In 1993, Somali warlords sent the U.S. Army packing, after TV pictures of a few U.S. casualties were broadcast to an audience of U.S. voters already skeptical about the mission in Somalia.

The bare outlines of a newly emerging Information Age vision are laid out in Pentagon manuals, notably in Joint Pub. 3-13; Joint Doctrine For Information Operations. This strategy statement, which is driving the debate in the entire Administration, says that the nation can achieve its security goals if the U.S. government's many agencies work in cooperation to undermine, redirect, distort, or stop an enemy's use of information-while simultaneously protecting information used by U.S. leaders, soldiers, businesses, and citizens.

But that broad vision creates an acute dilemma for government officials, especially soldiers, whose job it is to defend a Constitution under which the government and military are granted only narrow authority, and only by the consent of the governed. Information warfare, unless tightly controlled, may leap well beyond these narrow limits, now that national security information is increasingly commingled with public information, a citizen's private information, a business' proprietary data, and the global Internet marketplace. Thus nearly every citizen cheers the Navy's defense of the U.S. coastlines, but few would welcome a government offer to defend the data on their personal computers.

The information-operations strategy raises obvious political problems. If it were taken to its logical extreme, Pentagon and FBI officials would stand guard on the nation's communications networks, and customs officials would block exports of the compact computers that are so valuable to foreign soldiers, while government flacks would spin tales designed to protect the citizenry from the blandishments of enemies, both domestic and foreign. This Big Brother future is not desirable, or likely, or even possible, acknowledge government officials, even as they work behind closed doors to square the circles of their emerging vision.

So far, officials have squared only a few small circles. For example, White House officials have replaced the Pentagon's original phrase, "information warfare," with the nicer-sounding "information operations," thus fuzzing the distinction-and easing future coordination-between defense agencies and domestic law enforcement agencies. But top officials are still grappling with the tougher policy questions-some pressing, some barely recognized, and others almost beyond the scope of the federal government.

U.S. Hacker War

Consider the relatively modest questions raised here at home by the United States' undoubted ability to wage offensive information warfare by hacking into foreign computers to pilfer secrets, move funds, corrupt data, and destroy software.

When such activities are planned for a narrow, routine, peacetime spy operation, they are dubbed "special intelligence operations" and must be approved by top officials, sometimes even by the President. But what if a more massive U.S. hacker attack was designed to wreck the computers that control an enemy's banking system, electrical-power grid, or telephone network? Launching such a warlike operation would require a different approval process-maybe a presidential finding, or perhaps even a congressional assent that the nation is at war.

And how should the President and his advisers weigh the merits of offensive hacker attacks? One obvious question is whether the United States should forswear such computer attacks in the hope that international law might, over time, curb foreign computer assaults on the United States. This option is advocated by China and Russia, both of whom sought arms control agreements to curb the superior U.S. nuclear armory during the Cold War. In January, China and Russia persuaded the U.N. General Assembly to study the hacker-war issue after the United States rejected an initial proposal to outlaw offensive computer attacks.

This hacker-arms-control option seems absurd on its face because it is so difficult to monitor which countries are complying and which aren't. Nevertheless, it is being considered because the Pentagon is worried about foreign computer attacks on our networks, and because the military wants some clear direction before formulating information-warfare plans. The Defense Department is expected, in the near future, to give the U.S. Space Command responsibility for defending military information networks and for launching military hacker attacks on foreign networks. Space Command can't develop plans for such attacks until the White House signs off on a national policy-just as the U.S. Air Force's Strategic Air Command could not craft Cold War nuclear plans until the White House developed a nuclear strategy.

Which raises another question vexing White House decision-makers: How much consideration should Space Command give to the possibility of "collateral damage"-damage, for example, to U.S. economic interests? After all, Space Command may wish to implant software flaws in enemy computers before war. But politicians who represent districts with lots of high-tech employment might wish to bar such electronic "preparation-of-the-battlefield" measures until the formal exchange of gunfire, especially if such peacetime tactics make foreign customers suspicious that U.S.-built computers are infested with Pentagon-approved security bugs or viruses.

In view of these potential controversies, the White House may put a civilian agency in charge of U.S. hacker attacks, just as the Energy Department now controls the production and storage of nuclear weapons. "It is very important to ensure firm civilian control of strategic information operations, and one way of doing that would be to treat them much like we treat nuclear weapons," said Col. Charles Dunlap, the staff judge advocate at Shaw Air Force Base, in South Carolina.

National Cyberdefense

Apart from debates about when to use information warfare against an enemy, questions also arise about who should defend the United States against computer attacks-the Pentagon, or domestic law enforcement. The White House's May 1998 directive instructed the FBI-not the military-to organize a defense of the nation's electronic central nervous system.

The directive seeks to defend America's critical computer networks, including the ones used by the banking system, power grid, telephone lines, and other vital services. Government officials say these systems could easily be crashed by well-organized hackers in what would be an "electronic Pearl Harbor."

Only "this Pearl Harbor's going to be different," John J. Hamre, the deputy secretary of Defense, told the Senate Armed Services Committee on March 9. "It is not going to be against Navy ships sitting in a Navy shipyard; it's going to be against commercial infrastructure, and we don't control that." The threat is deemed so great that back in July 1996, then-Deputy Attorney General Jamie Gorelick even called on Congress to fund a program, in the style of the atomic bomb's Manhattan Project, that would defend the nation's critical computer networks.

Despite repeated claims of organized hacker attacks, however, the government has not published any evidence that any terrorists or foreign states are trying to cripple the nation's information networks. This may be because there is no evidence. Or it may be that the Pentagon fears that publishing the evidence would help the attackers. The most that has been said in public is that countries such as France, China, and Israel are hacking into U.S. computers to steal technology and trade secrets, and that organized attempts are being made to map U.S. government computer networks. Still, the vast majority of known hacker attacks amount to petty vandalism or minor criminality, and are largely insignificant for national security.

But according to the new information-operations vision, business and government, law enforcement, and national security are all bound together by their shared information systems. Identical information technology is used by businesses and governments, and more than 95 percent of Pentagon communications-plus 100 percent of critical banking, energy, transportation, and electrical-grid data-travel via civilian communications lines.

To bolster the computer defenses of government agencies, and of industry, the May 1998 White House directive advocates new spending, including money for long-term research into hacker defense. The White House says it will spend a total of $10 billion to fend off new warfare threats-including biological, chemical, and information-over the next few years, although Republicans say the real figure is closer to $5 billion.

The directive also gives the FBI a few small carrots with which to prod companies into upgrading their computer defenses. The carrots include free FBI technical advice and the sharing of secret intelligence about hacker activities. The stick is the unstated but real threat that companies will be sued by customers or shareholders whose interests are hurt when a hacker cripples a company's computers.

Overall, however, despite the high-decibel alarms from Hamre and others at the Pentagon, the White House's efforts have been surprisingly modest. The White House has not given the FBI any new authority-as far as is publicly known-to defend or control company networks, and has done little to win national or international support for new rules that would let the FBI pursue hackers through the various national neighborhoods on the global Internet. Without such powers of pursuit, neither identification nor retribution is likely, thus deterrence is very weak.

The government is, however, studying proposals to amend antitrust law and the Freedom of Information Act to allow more sharing of information among companies and the government without threat from an antitrust lawsuit or a nosy reporter, said Michael A. Vatis, director of the FBI's National Infrastructure Protection Center.

So far, most companies have ignored the whole issue, much to the distress of national security officials. "What this represents to [most executives] is some future issue, certainly not well-understood, and with no air of crisis," said Michael J. O'Neil, who served as general counsel at the CIA until 1997. This passivity is risky, because a damaging hacker attack may cause Congress to override industry objections and pass a set of expensive and intrusive network-defense laws, said O'Neil, who is now a partner at Preston Gates Ellis & Rouvelas Meeds.

Meanwhile, civil libertarians see information warfare, both offensive and defensive, as an excuse for law enforcement and intelligence officials to win bigger budgets and wider legal authority over information, domestically and internationally. For "the FBI to assume ... authority for domestic networking is a half-step toward a form of domestic military control," especially when the threat is poorly demonstrated, said Marc Rotenberg of the Washington-based Electronic Privacy Information Center. It would be wiser, say libertarians and many industry observers, to let the unfettered marketplace-currently led by American technology-decide how to defend against hacker attacks, with some advice from government agencies. Those companies that perform well at making information secure over the Internet and other networks will survive. Those that perform poorly, won't.

The Marketplace

Underlying the discussions over how much, or whether, to protect our information streams, is the question of whether technology is inherently good, or simply neutral. Does the spread of information technology benefit everyone, making others more like us, making them more eager for peaceful commerce in goods and ideas? Or does it simply give them tools to build new weapons for aggression? That issue has been around for many years; in the climate of 20th-century boosterism before World War I, optimists argued that the growing international trade in finished goods would suppress nationalist tensions, foster understanding, and give rise to a world where war was no longer logical. That didn't quite pan out.

The Clinton administration clearly believes that the spread of technology is essentially good, that technology will transmit American ideas of democracy and freedom around the world. Today's sales of high-powered computers to bad actors-including Russian nuclear-weapons laboratories, the Chinese military, unknown terrorist groups, and criminal syndicates-are only a tiny fraction of U.S. high-tech sales, the argument goes. High-tech sales, in the aggregate, do America too much good to be interrupted. They spur economic growth, create millions of new U.S. jobs, boost government revenue to help fund extra military spending, increase diplomatic clout, help the White House's poll numbers, and make hostile countries dependent on a web of peaceful trading links, say trade proponents and administration officials.

Vice President Al Gore is the chief proponent of this view. "We can build on our progress and use these powerful new forces of technology to advance our oldest and most cherished values: to extend knowledge and prosperity to the most isolated inner cities at home, and the most rural villages around the world ... to deepen the meaning of democracy and freedom in this Internet age," Gore said last October.

This logic prompted the early Clinton Administration to drop Cold War-era export curbs on computers, data-scrambling gear, and satellites. But these days, that policy is returning to bite the White House, now beset by Republican and press charges that it has recklessly given military advantages to enemies of American interests. Critics point most alarmingly to China, which in recent years has bought numerous fast computers and high-capacity communications networks, an aircraft factory, rocket expertise. Growing protests over the Administration's China policy forced the cancellation of a $450 million contract for a pair of cell-phone satellites that could serve military as well as civilian purposes.

U.S. high-tech companies bitterly oppose trade curbs and argue that the benefits of exports outweigh the risks. And because Silicon Valley and its many imitators are a major sector of this economy now, this argument gets a very respectful hearing, from lawmakers and from the Administration in Washington. Joel L. Johnson, at the Aerospace Industries Association, for example, says that the U.S. government gave up numerous good jobs when it nixed the satellite sale, and delayed China's satellite program for only a short time-until it can buy replacement satellites from Europe. Johnson says that even from a security perspective, it is better that we, and not the Europeans, sell to China. "If we sell the Chinese a satellite, we have the [satellite's] wiring diagrams, and there may be some stuff in there that the Chinese don't know about" that would allow the United State to turn it off in a crisis, he said. But "the French won't give us an 'off' switch."

More broadly, many officials argue that exports of American technology, and the cultural values carried by it, boost the United States' so-called "soft power"-the nation's ability to achieve desired long-range goals of freedom and democracy by persuasion rather than coercion. Champions of this view include retired Navy Adm. William A. Owens, former vice chairman of the Joint Chiefs of Staff; and Joseph S. Nye, former assistant secretary of Defense for international affairs and now the Dean of the John F. Kennedy School of Government at Harvard University.

International PR

Owens, Nye, and others hold that America's soft power-gradually infusing into other cultures the U.S. values of human rights, freedom of thought, and freedom of commerce-undermined the Soviet Union, helped create the 1989 protests in China, and has otherwise promoted democracy, trade, and peace around the world. This view is, in essence, the ultimate American information-warfare policy. The message transmitted throughout the Cold War by American exports-be they television programs-such as Baywatch or The International Herald Tribune, or Arnold Schwarzenegger movies-made a clear and ultimately victorious point-"Socialism stinks, capitalism is cool."

Armed with this notion of soft power, and seeing information as the chief weapon of choice, the White House is drafting its new directive to try to improve the various ways the government uses information and coordinate these uses into a strategy to use abroad.

Ever since World War II, the U.S. government has augmented the work of American commercial news organizations in reaching out to foreign audiences with its own agencies, including the U.S. Information Agency, Radio Free Europe, and Radio Liberty. At modest cost, these agencies helped undermine communism in Europe, and they are now operating against the Chinese and Serbian governments. These three older Cold War-era agencies now also use TV and the Internet to get their message to places where commercial media won't go and to get past hostile government censors. Recently, they have begun to tighten coordination with the departments of Commerce, Health and Human Services, and Defense. The USIA, for example, has Web pages explaining U.S. bombing raids in Kosovo.

The new presidential directive is intended to further such efforts, and "stems out of the lesson learned from Rwanda and Bosnia, where hate propaganda was used to incite and organize genocide," said a government official. The directive calls on all government agencies to increase their training and inter-agency coordination, and urges them to cooperate with foreign governments and nongovernmental organizations to help spread an authorized message or to counter a false one. These foreign organizations include corporations, environmental and health advocates, democracy proponents, and even populations willing to cooperate with the U.S. government. Already, the U.S. Agency for International Development is paying $800,000 per year to Search for Common Ground, a Washington-based aid organization that operates a pro-peace radio station in Rwanda's neighboring country, Burundi.

The new directive is intended "to bring all the pieces together," a government official said, thus giving policy-makers an extra tool beyond the usual list of economic sanctions, diplomatic pressure, or military threats. In the case of Rwanda, this tool would have offered the President a more acceptable alternative than military intervention, he added.

Significantly, the draft directive also calls for development of a still-amorphous "National Information Strategy." This item may merely generate reams of bureaucratic blather, or it may provide a formative stepping stone toward a security strategy for the Information Age, just as the notion of "containment" set the strategy for the Cold War, and "mutual assured destruction" set the strategy for the nuclear age, say government officials. "What George Kennan did for us in 1948, when he wrote the `containment' article, is what we are searching for," said one former government official who is pushing for such a comprehensive strategy.

The first step toward a national information strategy could even be completed this year, said John Arquilla, a professor at the Naval Postgraduate School, in Monterey, Calif. Already working with top-level officials on information policy, Arquilla said this grand plan should closely combine the computer side of Information Operations with the public-information side; create incentives for all agencies to freely share information; create a policy of "guarded openness" that balances financial profits and other benefits from high-tech trade against damage to national security; establish a top-level organization to manage the information strategy; and set policies that guide any computer attacks launched by the United States.

Although the Defense Department will be encouraging the White House to take a comprehensive view of these issues, political caution and bureaucratic rivalry may stymie creation of this grand strategy, Arquilla warned. In its place, White House officials may simply take the easy route and write separate policies for each aspect of the problem. That route would create a dysfunctional set of feuding fiefdoms, said Arquilla.

One encouraging sign for those who want a comprehensive information-warfare strategy is that the White House already has a czar for information operations-Richard A. Clarke, the President's national coordinator for security, infrastructure protection, and counterterrorism. Clarke, an influential civil servant at the National Security Council, was instrumental in writing the 1998 directive and has shaped the pending public information directive. But it is not clear whether President Clinton has enough interest in the issue to help when Clarke, the Pentagon's Hamre, and other interested officials try to bring the Cabinet together to chart a strategy for the Information Age. Indeed, "a lot of these issues are just too hard," said one congressional staff member skeptical of the White House's willingness to clash with high-tech export industries and anti-government libertarians. Clarke declined to be interviewed for this article.

If no grand strategy is crafted by the White House, a partial strategy will slowly emerge as agencies muddle through piecemeal, driven by the latest crisis. Such a substitute strategy would be put together largely by senior and middle-ranking officials, occasionally in the open but often behind closed doors, usually by appointees, and sometimes by the courts.

Of course, this bottom-up approach may not provide an answer soon enough to be useful, may not allow for sufficient public debate, and may not be understood by the various participating agencies because of the tight secrecy surrounding the topic. "It is easier to get somebody [cleared] to read into nuclear targets than the small information-warfare things," said the Air Force's Dunlap.

That would leave the United States with a crippled strategic approach on the day it finds itself surprised by the first war of the Information Age. Still, that's the way the United States entered World War II-and everyone knows how that turned out.

NEXT STORY: Iowa is a hazardous place