For those of us who have lived inside the national security conversation for more than a decade now, such early warnings of dire consequences might sound tediously familiar, just another example of the (George W.) Bush who cried wolf. After all, in the wake of the actual 9/11 attacks, governmental overreach became commonplace, based on fear-filled scenarios of future doom. Continual hysteria over a domestic terror threat and (largely nonexistent) al-Qaeda "sleeper cells" bent on chaos led to the curtailing of the civil liberties of large segments of the American Muslim population and, more generally, far greater surveillance of Americans. That experience should indeed make us suspicious of doomsday predictions and distrustful of claims that extraordinary measures are necessary to protect "national security."
For the moment, though, let's pretend that we haven't been through a decade in which national security needs were used and sometimes overblown to trump constitutional protections. Instead, let's take the recent cyber claims at face value and assume that Richard Clarke, who prior to 9/11 warned continuously of an impending attack by al-Qaeda, is correct again.
And while we're not dismissing these apocalyptic warnings, let's give a little before-the-fact thought not just to the protection of the nation's resources, information systems, and infrastructure, but to what's likely to happen to rights, liberties, and the rule of law once we're swept away by cyber fears. If you imagined that good old fashioned rights and liberties were made obsolete by the Bush administration's Global War on Terror, any thought experiment you perform on what a response to cyber war might entail is far worse.
Remember former White House Council Alberto Gonzales telling us that, when it came to the interrogation of suspected terrorists, the protections of the U.S. Constitution were "quaint and obsolete"? Remember the argument, articulated by many, that torture, Guantanamo, and warrantless wiretapping were all necessary to prevent another 9/11, whatever they did to our liberties and laws?
Now, fast forward to the new cyber era, which, we are already being told, is at least akin to the threat of 9/11 (and possibly far worse). And keep in mind that, if the fears rise high enough, many of the sorts of moves against rights and constitutional restraints that came into play only after 9/11 might not need an actual cyber disaster. Just the fear of one might do the trick.
Not surprisingly, the language of cyber defense, as articulated by Panetta and others, borrows from the recent lexicon of counterterrorism. In Panetta's words, "Just as [the Pentagon] developed the world's finest counterterrorism force over the past decade, we need to build and maintain the finest cyber operators."
The Cyber Threat to American Rights and Liberties
Cyber is "a new terrain for warfare," Panetta tells us, a "battlefield of the future." So perhaps it's time to ask two questions: In a world of cyber fear, what has the war on terror taught us about protecting ourselves from the excesses of government? What do policymakers, citizens, and civil libertarians need to think about when it comes to rights that would potentially be threatened in the wake of, or even in anticipation of, a cyber attack?
Here, then, are several potential threats to constitutional liberties, democratic decision-making processes, and the rule of law to watch out for in this new cyber war era:
The Threat to Privacy: In the war on terror, the government -- thanks to the Patriot Act and the warrantless surveillance program, among other efforts -- expanded its ability to collect information on individuals suspected of terrorism. It became a net that could snag all sorts of Americans in all sorts of ways. In cyber space, of course, the potential for collecting, sharing, and archiving data on individuals, often without a warrant, increases exponentially, especially when potential attacks may target information itself.
A recent FBI investigation illustrates the point. The Coreflood Botnet utilized viruses to steal personal and financial information from millions of Internet users, including hospitals, banks, universities, and police stations. The focus of the Coreflood threat -- which also means its interface with the government -- was private information. The FBI got warrants to seize the command-and-control servers that acted as an intermediary for the stolen information. At that point, the government was potentially in possession of vast amounts of private information on individual American citizens. The FBI then offered assurances that it would not access or make use of any of the personal information held on those servers.
But in an age that has become increasingly tolerant of -- or perhaps resigned to -- the government's pursuit of information in violation of privacy rights, the prospects for future cyber-security policy are worrisome. After all, much of the information that might be at risk in so many potential cyber attacks -- let's say on banks -- would fall into the private sphere. Yet the government, citing national security, could persuade companies to turn over that that data, store it, and use it in various ways, all the while claiming that its acts are "preventive" in nature and so not open to debate or challenge. And as in so many post-9/11 cases, the courts might back such claims up.
Once the information has been shared within the government, who's to say how long it will be held and how it will be used in the future? Or what agency guidelines exist, if any, to ensure that it won't be warehoused for future uses of quite a different sort? As former Department of Homeland Security head Michael Chertoff put it, "You need to have a certain amount of accountability so government doesn't run roughshod [over people's right to privacy] and that's been a hard thing to architect."
Enemy Creep: If you think it's been difficult to reliably distinguish enemies from the rest of us in the war on terror (as in the 600 Guantanamo detainees that the Bush administration finally declared "no longer enemy combatants" and sent home), try figuring it out in cyber space. Sorting out just who launched an attack and in whose name can be excruciatingly difficult. Even if, for example, you locate the server that introduced the virus, how do you determine on whose behalf such an attack was launched? Was it a state or non-state actor? Was it a proxy or an original attack?
The crisis of how to determine the enemy in virtual space opens up a host of disturbing possibilities, not just for mistakes, but for convenient blaming. After all, George W. Bush's top officials went to war in Iraq labeling Saddam Hussein an ally of al-Qaeda, even when they knew it wasn't true. Who is to say that a president won't use the very difficulty of naming an online enemy as an excuse to blame a more convenient target?
War or Crime?: And what if that enemy is domestic rather than international? Will its followers be deemed "enemy combatants" or "lawbreakers"? If this doesn't already sound chillingly familiar to you, it should. It was an early theme of the war on terror where, beginning with its very name, "war" won out over crime.
(Note: You can view every article as one long page if you sign up as an Advocate Member, or higher).
