The document, signed by Barack Obama in October 2012, is called "Presidential Policy Directive 20" (PPD-20) and starts by explicitly stating that the directive "supersedes National Security Presidential Directive (NSPD)-38", which was a document authorizing U.S. government power to conduct surveillance through monitoring.The top secret document describes two main subjects, these are Defensive Cyber Effects Operations (DCEO) and Offensive Cyber Effects Operations (OCEO). Each of these are described as operations and related programs or activities conducted by or on behalf of the U.S. Government to protect against threats against national interests or to produce cyber effects outside of U.S. Government networks respectively.
One of the notable capabilities that are provided as a part of this top-secret document is that "OCEO can offer unique and unconventional capabilities to advance U.S. national objectives around the world with little or no warning to the adversary or target and with potential effects ranging from subtle to severely damaging."
In a nutshell, this means that authority is provided to the United States to launch a potentially numbing attack on threats that it describes could present significant consequences to America. Significant consequences are defined in the document as causing "loss of life, significant responsive actions against the United States, significant damage to property, serious adverse US foreign policy consequences, or serious economic impact on the United States."
The document also says that the governemtn will "identify potential targets of national importance where OCEO can offer a favorable balance of effectiveness and risk as compared with other instruments of national power".
This makes it very clear that America will not be a bystander to cyber attacks on domestic networks, and that the government has broad power to retaliate with generalized rules of engagement. There are a lot of generalized points made within this document. The lack of specifics could be due to a shortage of technical understanding by those who were charged to author the document. As a consequence, this warrants a lot of power to people who may not understand what network attacks may be capable of.
Not knowing who has the power to launch a cyber attack definitely makes me a bit worried, how about you? Leave a comment below and start a conversation!
