Cyber attacks that might have constituted an "act of war" went unpunished by the U.S. over the last decade, leading to a more dangerous cyber environment, according to a top Navy admiral.
"We've had an awful lot of examples of what, 10 years ago, we assumed would be construed as an act of war," Vice Adm. Jan Tighe said Thursday. "And, in a lot of cases, there has not been a response, either a military response or a diplomatic response."
Tighe, the deputy chief of naval operations for information warfare, suggested that policy makers in recent years failed to develop international standards due to a belief that cyber technology was too nascent. But the danger of hacking threats grew quickly, leaving U.S. officials uncertain of how to respond.
For example, Russian-linked hackers shut down an electrical grid in Ukraine, leaving hundreds of thousands of people without power for several hours.
"The international community did not even really come out strongly and say, ‘this is unacceptable, you cannot go after critical infrastructure,'" she said at the Center for Strategic and International Studies. "Where is the hue and cry in that? And so, what that says is, that must be okay. That must be perfectly acceptable. When you're not at war, you can attack someone's critical infrastructure."
Military analysts and some lawmakers worry that the United States is unprepared to respond if hackers similarly target the American power grid. "There is not a single cyber resource type within [the Department of Homeland Security] or FEMA that allows a state to request cyber response assistance from the federal government or even state to state using existing emergency management processes," Col. Gent Welsh, a commander in the Washington Air National Guard who oversees an elite cybersecurity unit, told a Senate panel in April.
Tighe acknowledged that the lack of clear rules also brings a degree of freedom for her team, just as it does for foreign adversaries. "I don't have to invoke rules of engagement in my current job, at the Pentagon," she said. "Well, maybe just with my co-workers."