Why do the harbor lights remain on in cyberspace? Because, rather than focusing on security, information technology manufacturers and software developers have been driven for decades by market forces that impel them to seek greater speed and efficiency -- at the most competitive prices. In short, the virtual harbor lights stay on because the perceived economic cost of improved security -- that is, of enforcing a blackout, in metaphorical terms -- is seen as too high. And, just like FDR, American political leaders have shied away from forcing their hand.
Where the metaphor breaks down -- no metaphor can address every aspect of a problem -- is in its invisibility. Mass ship sinkings in the early months of 1942 were tangible events that horrified the nation. Today, the ongoing compromise of sensitive military information systems, the theft of intellectual property, and the recruitment of men, women, and children into zombie armies, all these pass largely beneath our levels of awareness. Cyberwarfare is a lot like Carl Sandburg's fog, coming in on "little cat feet."
To be sure, senior civil and military leaders know the gravity of the situation. A deeply alarming study of our cyber vulnerabilities by the National Academies was just declassified; it makes quite clear the grave nature of the threat. At the same time, word of a new presidential decision directive (PD-20) about responding aggressively to the cyber threat has leaked out. Reporting about the still-classified directive suggests that it follows the line of Secretary Panetta's comments in recent weeks about taking pre-emptive action against cyber threats.
All this implies clear awareness of the problem, but the pro-active recommendation to seek out and "attack the attackers" is problematic, given how well-hidden so many of them remain. Eleven years after the Code Red and Nimda computer viruses were unleashed -- shortly after 9/11 -- the identity of the perpetrators remains unknown. And this is true of many, perhaps most, cyber attacks. Digital warriors and terrorists today hide in the virtual ocean of cyberspace as well as U-boat skippers did during their "happy time" along the Atlantic seaboard 70 years ago. And efforts to track them in advance of their attacks, to hearken yet again to the harbor lights metaphor, will be as fruitless as the U.S. Navy's original strategy in 1942 of sending out hunter-killer squadrons to search the ocean for the U-boats.
Back then, the right answer from the start was to black out coastal cities at night. Then, when ships sailed, they were evasively routed and escorted by anti-submarine vessels. Losses still occurred, but soon fell to acceptable levels. This is the lesson of the "harbor lights" metaphor. In cyberspace, the analogous approach would consist of far greater use of strong encryption and "evasive routing" of data via the Cloud, making it much harder for the virtual U-boat wolf packs that stalk them to find their targets.
Forget Pearl Harbor. Remember the harbor lights.
SUBJECTS:
