Upload
lynhi
View
215
Download
1
Embed Size (px)
Citation preview
THE UNITED STATES NAVAL WAR COLLEGE
National Security Affairs Department
Theater Security Decision Making Course
THE 'AZANIA' POLICY COORDINATING COMMITTEE SIMULATION: THE SCENARIO
Excerpts from:
"Detect, Disrupt, Deter: A Whole of Government Approach to National Security Cyber Threats"
by John P. Carlin
Reprinted with permission from Harvard National Security Journal, Issue 7, 2016, pp. 392-436. Copyright © 2016 Harvard University Law School.
TSDM
Policy 10-1
A variety of educational institutions—from the Foreign Service Institute which educates our nation’s
diplomats to Harvard University—use simulations to reinforce lessons learned in the classroom. The
tradition of using fictional countries in these exercises is to allow for a focus on the process and the
dynamics of real-time interaction, rather than testing knowledge about specific places and governments.
“Azania” is a fictional country, but the simulation laid out here is based on a number of real-world
incidents and has been based on conversations with actual participants in such interagency meetings.
THE SETTING:
Azania is one of the largest countries in the AOR of the combatant command. It is considered to be a
rising regional power with a growing level of development, and is considered to be ranked among the
world’s middle powers.
It is an authoritarian country, ruled by the Azanian National Front (ANF). The ANF does allow for token
opposition parties to exist and to have a few seats in the legislature, and allows for a limited set of
political and civil rights, while claiming its mandate is to pursue economic growth and development. The
ANF took power in a coup 40 years ago, displacing the previous governing body, the Azanian
Constitutionalists. The ANF faces opposition both from the Azanian Movement for Democracy, which
claims to be a peaceful opposition group pressing for more democracy, and from an insurgency in the
southern parts of the country, the Azanian Liberation Front (ALF).
Azania is not a major trading partner of the United States and there are few U.S. companies invested in
the country, even though it is a lucrative market. The Azanian government, however, does pursue close
security cooperation with the United States. The United States has a major airbase in Azania which is
critical for the U.S. to be able to project power and supply forces engaged in operations elsewhere in the
AOR. Azania also has port agreements allowing U.S. ships to dock and be resupplied.
The airbase is an important facility and one that cannot be easily replaced, although, if several of the
surrounding countries agree, it might be possible to mitigate the loss of the Azanian facilities. The port
facilities are useful because the nearest comparable facilities that would be open and accessible to the
U.S. Navy are some 300 miles away.
The Azanian National Intelligence Service (NIS) is a close partner helping the U.S. to gain intelligence on
and infiltrate violent extremist organizations in the AOR which pose a threat both to Azanian and
American interests. The NIS has been able to carry out operations neutralizing key figures in VEOs that
would not have been permissible under U.S. law for American agencies to undertake. Azania is also in
talks to host U.S. listening facilities on its territory.
Because of its geographic location, Azania is an important transit point for the narcotics trade with the
United States being one of the important final destinations. In the past, Azania tended to overlook the
trade as long as traffickers did not sell their products on their territory, and traffickers were able to bribe
Azanian officials, border guards and police to ignore their operations. Under U.S. pressure, Azania has
begun to take stronger measures to interdict the drug trade across its territory.
Azania is an important regional center for finance. Its banks handle funds from around the world and its
stock market is an important secondary listing location for many companies, in particular for firms that
may not meet U.S. or British requirements for the New York and London exchanges. In recent years, the
U.S. Department of the Treasury has been able to work with Azania to ensure that financial sanctions
that prevent terrorist groups from moving money as well as the sanctions imposed on North Korea
would be followed in Azania. Azania also has cracked down on money-laundering by the drug cartels.
Azania has a large and well-educated workforce, particularly in STEM fields, but the economy has not
grown to keep pace with the size of that labor force. Some Azanians have drifted, therefore, into various
hacking collectives as a way to stay employed. The government in the past has turned a blind eye to
these activities and in some cases the Azanian security services have even turned to them for assistance.
The largest of these hacking collectives, the “Snow Leopard Brotherhood,” was responsible for a major
hack that stole hundreds of millions of dollars from seven U.S. banks in addition to obtaining credit card
information on hundreds of thousands of U.S. citizens. The Snow Leopard Brotherhood was also alleged
to be behind an attempted hack of U.S. government personnel databases in order to sell that
information on the “dark web”, as well as the intercept (and leak) of sensitive e-mails sent by the U.S.
ambassador to Freedonia, a neighboring country, in which very frank and unflattering comments about
the host government were made and which complicated U.S. diplomacy in the area, and led to the
ambassador’s departure. Two years ago, after strong pressure from the U.S. ambassador, the Azanian
government pledged to crack down on the hackers.
There is a large Azanian diaspora in the United States, made up both of supporters of the former regime,
the Constitutionalists, who fled when the ANF took power, and people who have left the southern
regions of the country because of the fighting. The Azanian-American community tends to be very
opposed to the current ANF government. The Azanian-American community has tended to cluster
together in a number of states, including key battleground states like Pennsylvania and Ohio, where
they are seen as a swing vote. There is an Azanian caucus in Congress with 25 members. Several wealthy
business figures have endowed Azanian study programs at think tanks in Washington. The current
National Security Advisor, prior to entering the administration, held an endowed chair at a DC think tank
that was funded by an Azanian-American philanthropist.
THE IMMEDIATE SCENARIO
Five days ago, a pro-democracy demonstration in the principal city of the south led by the Movement
for Democracy clashed with police; ALF insurgents then used the opportunity to launch strikes on
security forces. In retaliation, the Azanian military launched a full-scale set of reprisals to retake control
of the city, but used artillery and airpower in civilian areas. Footage of the devastation and of the
thousands of civilian casualties has appeared on social media and has been rebroadcast by the news
networks. The President was asked at the end of a speech at the Carnegie Council on Ethics and
International Affairs in New York what he thought the U.S. reaction would be. In off-the-cuff remarks,
not cleared by the interagency process, the President condemned the violence, seemed to indicate that
the government bore responsibility for the carnage, and then called for an “impartial” investigation. He
stopped short of suggested any U.S. sanctions would be applied.
Two days later, there was a cyber intrusion into the systems of the lobbying and governmental affairs
firm which has Jack Mayor, the President’s former chief of staff, as its principal. Six months ago, Mayor
took the account for the Azanian Movement for Democracy, to help bolster its reach in Washington.
That hack uncovered e-mails that were leaked to the Washington Post and published the next day. They
detail conversations where Mayor discusses how he will use his close personal relationship with the
President to push change; advises the Azanian Movement for Democracy to tap down any links with
anti-government forces; speculates about likely defectors from within the government and considers
the line-up of a potential new government.
Members of Congress are now questioning whether the U.S. government is engaged in regime change in
Azania or has a “pay to play” foreign policy. The Azanian government takes this as proof that there is an
organized effort to overthrow it and has announced that it will carefully reconsider the relationship with
the United States. Meanwhile, the first report from an FBI investigation says that there are “indications”
that the hack bears the signature moves of the Snow Leopard Brotherhood.
The PCC has been assembled to assess the situation and the impact of different options. In particular,
the most pressing task which must be resolved by the end of the meeting is to lay out how the President
plans to respond to these latest developments and what statement, if any, will be issued by the White
House.
KEY BACKGROUND DETAILS
U.S. policy must be crafted in broad conformity to the outlines presented in the National Security
Strategy (and not openly contradictory of its provisions). [See document #1] Whatever solutions you
propose must also be in accordance with the provisions of the so-called “Leahy amendment” which
governs U.S. security assistance when there are questions raised of human rights abuses. [See document
#2]. Details on cyber approaches are contained in the excerpts from the John Carlin article. [See
document #3] The U.S.-Singapore security cooperation agreement is presented [document #4] as a
template for what a similar hypothetical agreement with Azania might look like.
The President is in the 3rd year of his first term and plans to run for re-election.
A key plank in his initial election campaign was “Standing True to American Values” and he was
critical of his opponent’s willingness to make “deals with dictators.”
Leading members of the Azanian-American community were donors to the President’s campaign
but have expressed dissatisfaction with the President’s policies; there is talk of throwing support
to a potential challenger in the primaries next year.
Six months ago, the President and the Secretary of Commerce pledged to double U.S.
investment in Azania when the Azanian president visited the United States and to encourage
U.S. firms to explore opportunities in Azania. In two weeks, CEOs of a number of major U.S.
companies plan to attend the Azanian Economic Forum.
The Undersecretary of State for Democracy and Human Affairs is an American of Azanian origin
(second generation) and retains a personal interest in what transpires in that country.
The U.S. is engaged in sustained military action in a country that borders Azania and is using the
facilities in Azania to support that engagement. The President has just announced that there will
be a surge in the U.S. military effort in that country.
The Azanian president was invited to take part in a summit meeting with Russia and China to
discuss forming a closer association with those countries. He has not yet accepted.
The Secretary of Defense is traveling overseas. In a press availability he was quoted as saying,
“The United States will not rush to judgment.”
An Azanian-American delegation is visiting the White House today and it was announced that
they would be meeting the Chief of Staff. Three members of Congress from the President’s
party, one of them the deputy whip in the House, are accompanying them.
The current Chief of Staff was the deputy to his predecessor, who stepped down last year. His
predecessor was the President’s college roommate and was his colleague in different political
endeavors for 30 years. The current Chief of Staff is still struggling to be seen as speaking with
the President’s voice and still relies on support from his predecessor. In this White House, the
Chief of Staff has forged a strong working relationship with the National Security Advisor and
the Vice President to manage policy.
We have the following reports from the U.S. embassy in Azania:
o The Azanian president spoke to the nation last night. He made it clear that Azania is
fighting against terrorists and stated that other countries who question Azania’s actions
are supporting the terrorists and cannot be viewed as genuine partners of Azania
o The Foreign Minister, someone educated in the United States and with good experience
of the U.S. domestic political system, told the U.S. ambassador privately that he
understands that the United States had to make some comment on the event and now
must respond to the latest incident. If reaction is minimal, he feels he can persuade the
president to overlook it, but anything deemed to be too drastic will impede
cooperation. He did not elaborate.
o The Chief of the Azanian General Staff told the defense attache that he hopes there is
no interruption because Azania benefits from the U.S. presence and the income
generated from U.S. rental payments goes directly into the defense budget of the
country. He also suggests that hackers working for the ALF are responsible as they hope
to develop a wedge between the U.S. and Azanian governments.
o A representative of the Movement for Democracy has contacted the embassy to stress
that the Movement is not anti-American and does not seek to impede U.S.-Azanian
relations. The MoD would want to continue cooperation with the United States
o A Facebook message posted by the ALF states that the ALF remains committed to
ending any U.S. presence in Azania
o A Gab account that is suspected of being the mouthpiece of the Snow Leopard
Brotherhood denies responsibility for the hack and suggests that the ALF is responsible.
o The chief of staff to the Azanian president was at a private dinner at the swank
“Restaurant Syldavia” in the capital. A British diplomat was present. He has passed along
the following: the chief of staff was loudly complaining that Azania has taken action
against drug cartels and computer hackers who were creating no problems for Azania as
favors to the United States—and wonders if this is Washington’s gratitude, why should
Azania continue?
IMPORTANT DATES
The Chinese and Russian summit where the Azanian president has been invited convenes in one
month’s time.
The Pentagon is planning to rely on the Azanian bases for ongoing operations and for a major
operation that will take place in two months’ time.
WHAT THE PCC’S TASK IS:
By the end of this meeting, the PCC must pass along to the Deputies’ Committee the following
recommendations:
1. Will a statement on the hack be made by the United States? Should any further action be
contemplated?
2. Will the United States government elaborate on the President’s earlier remarks that the U.S. is
calling for an investigation into the attacks from five days ago?
3. Will the President make the statement, or will it be another U.S. official?
4. Will the statement express concern, or raise the possibility of further action, and, if so, what?
PCCs work on consensus. An option can be forwarded even if not enthusiastically endorsed by all
participants. Silence equals consent. On the other hand, if the PCC cannot agree because there are
disputes that need to be settled between departments and agencies, the PCC will send up the
disagreements to be adjudicated by the deputies’ committee.
KEY DOCUMENTS
1) Relevant extract from the 2015 National Security Strategy (for purposes of this simulation,
assume that this document is still operative):
Defending democracy and human rights is related to every enduring national interest. It aligns us with
the aspirations of ordinary people throughout the world. We know from our own history people must
lead their own struggles for freedom if those struggles are to succeed. But America is also uniquely
situated—and routinely expected—to support peaceful democratic change. We will continue mobilizing
international support to strengthen and expand global norms of human rights. We will support women,
youth, civil society, journalists, and entrepreneurs as drivers of change. We will continue to insist that
governments uphold their human rights obligations, speak out against repression wherever it occurs,
and work to prevent, and, if necessary, respond to mass atrocities.
Our closest allies in these efforts will be, as they always have, other democratic states. But, even where
our strategic interests require us to engage governments that do not share all our values, we will
continue to speak out clearly for human rights and human dignity in our public and private diplomacy.
Any support we might provide will be balanced with an awareness of the costs of repressive policies for
our own security interests and the democratic values by which we live. Because our human rights
advocacy will be most effective when we work in concert with a wide range of partners, we are building
coalitions with civil society, religious leaders, businesses, other governments, and international
organizations. We will also work to ensure people enjoy the same rights—and security—online as they
are entitled to enjoy offline by opposing efforts to restrict information and punish speech.
2) Full text of the so-called “Leahy Amendment.” This is the binding Congressional legislation
that requires that U.S. assistance can only be provided to foreign security forces whose
personnel have not committed gross human rights abuses. When the vetting process
uncovers credible evidence that an individual or unit has committed a gross violation of
human rights, U.S. assistance is withheld.
The Leahy amendment was first introduced by Senator Patrick Leahy (D-VT) in 1997 and
attached to the Foreign Operations Appropriations Act. It was subsequently renewed each
year until made permanently part of the U.S. Code in 2008.
No assistance shall be furnished under this chapter or the Arms Export Control Act [22 U.S.C. 2751 et
seq.] to any unit of the security forces of a foreign country if the Secretary of State has credible
information that such unit has committed a gross violation of human rights.
(b) Exception
The prohibition in subsection (a) shall not apply if the Secretary determines and reports to the
Committee on Foreign Relations of the Senate, the Committee on Foreign Affairs of the House of
Representatives, and the Committees on Appropriations that the government of such country is taking
effective steps to bring the responsible members of the security forces unit to justice.
(c) Duty to inform
In the event that funds are withheld from any unit pursuant to this section, the Secretary of State shall
promptly inform the foreign government of the basis for such action and shall, to the maximum extent
practicable, assist the foreign government in taking effective measures to bring the responsible
members of the security forces to justice.
(d) Credible information
The Secretary shall establish, and periodically update, procedures to—
(1) ensure that for each country the Department of State has a current list of all security force
units receiving United States training, equipment, or other types of assistance;
(2) facilitate receipt by the Department of State and United States embassies of information
from individuals and organizations outside the United States Government about gross
violations of human rights by security force units;
(3) routinely request and obtain such information from the Department of Defense, the Central
Intelligence Agency, and other United States Government sources;
(4) ensure that such information is evaluated and preserved;
(5) ensure that when an individual is designated to receive United States training, equipment,
or other types of assistance the individual’s unit is vetted as well as the individual;
(6) seek to identify the unit involved when credible information of a gross violation exists but
the identity of the unit is lacking; and
(7) make publicly available, to the maximum extent practicable, the identity of those units for
which no assistance shall be furnished pursuant to subsection (a).
3) Excerpt from John P. Carlin, “Detect, Disrupt, Deter: A Whole of Government Approach to
National Security Cyber Threats,” Harvard National Security Journal 7 (2016), 392-436.
The United States faces an inflection point when it comes to the Internet's effect on daily life. What has
enriched our economy and quality of life for the past several decades may start to hurt us more than
help us, unless we confront its cybersecurity challenges. Waves of network intrusions-increasing in
number, sophistication, and severity-have hit American companies and the U.S. government. In 2012,
former CIA Director and Defense Secretary Leon Panetta described the nation's cybersecurity
weaknesses as presenting a "pre-9/11 moment." And in July 2014, the 9/11 Commission itself warned:
"We are at September 10th levels in terms of cyber preparedness.” Following that ominous prediction,
in a span of less than two years, the United States was besieged by intrusions originating from around
the globe. There was no single target, and no common perpetrator. Our adversaries stated or
demonstrated that they hacked on behalf of China, North Korea, Syria, Iran, and many others. They stole
sensitive information from government databases, damaged and destroyed private companies'
computer systems, and-in a new twist-even targeted individuals' personally identifiable information to
benefit terrorist organizations. The list of victims is broad and varied-the private sector, the government,
and individual citizens. The past two years have publicly demonstrated the extent of the threat.
… Empowered by advances in technology like cheap storage, increased bandwidth, miniaturized
processors, and cloud architecture, we've extended Internet connectivity throughout our lives. But this
expansion carries a risk not fully accounted for. Increased connectivity makes our critical infrastructure-
water, electricity, communications, banking-and our most private information more vulnerable. We
invested an enormous amount over the past few decades to digitize our lives. But we made these
investments while systematically underestimating risks to our digital security. If we don't secure our
Internet connectivity, what has been an important driver of prosperity and strength for the past twenty
years could have disastrous effects in the next twenty.
To meet this challenge, the U.S. government has changed its approach to disrupting national security
cyber threats. One element of its new strategy involves implementing and institutionalizing a "whole-of-
government" approach. No one agency can beat the threat. Instead, success requires drawing upon
each agency's unique expertise, resources, and legal authorities, and using whichever tool or
combination of tools will be most effective in disrupting a particular threat. At times, that may mean
economic sanctions from the Treasury Department, proceedings initiated by the Office of the U.S. Trade
Representative, and cyber defense operations from the Defense Department. At other times, it might
mean information sharing coordinated by the Department of Homeland Security, diplomatic pressure
from the State Department, intelligence operations from the U.S. Intelligence Community (IC), and
prosecution and other legal action from the Justice Department. And in many instances, it will mean a
coordinated application of several capabilities from the U.S. government's menu of options.
The United States' approach to combating Chinese theft of sensitive U.S.-company business information
and trade secrets-activity that former National Security Agency Director Keith Alexander described as
the "greatest transfer of wealth in history" illustrates the power of this coordinated approach. In May
2014, after an unprecedented investigation spanning several years, a federal grand jury indicted five
uniformed members of the Chinese military on charges of hacking and conducting economic espionage
against large U.S. nuclear-power, metal, and solar-energy companies. The 48-page indictment describes
numerous, specific instances where officers of the People's Liberation Army (PLA) hacked into the
computer systems of American companies to steal trade secrets and sensitive, internal communications
that could be used for economic gain by Chinese companies. The recipient companies could use the
stolen information against the victims in competition, negotiation, and litigation.
This landmark case was the first prosecution of official state actors for hacking. But the indictment was
not pursued in isolation; nor was it seen as an end in and of itself. Rather, the investigation and
prosecution of the PLA members were pieces of a larger deterrence strategy. In spring 2015, the
President issued an executive order authorizing sanctions against companies engaging in malicious cyber
activity. At the same time, the government was advocating diplomatically for basic international norms
in cyberspace.
It appears that these coordinated efforts are starting to establish new norms in cyberspace. In
September 2015, President Obama and Chinese President Xi Jinping affirmed that neither country's
government will conduct or knowingly support cyber-enabled theft of intellectual property, including
trade secrets or other confidential business information, with the intent of providing competitive
advantages to companies or commercial sectors. Although we don't know the extent to which China will
honor this commitment, the fact that the commitment was made is itself significant, as is the fact that at
the November 2015 G20 Summit in Turkey, leaders representing the twenty largest economies in the
world agreed to norms related to acceptable behavior in cyberspace. …
A whole-of-government approach is critical to success in disrupting national security cyber threats. But
given the complexity of the threats we face, no strategy, regardless of the number of agencies involved
or the breadth of tools available, would be complete without coordination with the private sector. In an
increasingly flattened and connected world, the threat can easily move and change-but one constant is
that private entities remain on the front lines of this fight. Thus, a second element of the United States'
new approach involves deeper partnerships with the private sector.
This Article explains how national security investigators and lawyers in the Department of Justice (DOJ)
play a crucial role in this new approach. As practiced at DOJ, national security law goes beyond the use
of one set of tools or body of law. It is cross-disciplinary-encompassing a practical, problem-solving
approach that uses all available tools, and draws upon all available partners, in a strategic, intelligence-
driven, and threat-based way to keep America safe. As former Acting Assistant Attorney General (AAG)
for National Security Todd Hinnen has noted, "[n]ational security investigations seek to harness and
coordinate the authorities and capabilities of all members of the national security community, state and
local law enforcement, and foreign law enforcement and intelligence partners," and "may result in a
wide variety of national security activity, including . . . arrest and prosecution of perpetrators, imposition
of economic sanctions, diplomatic overtures to foreign governments, and actions undertaken by U.S.
intelligence services or armed forces overseas."
Key to almost any of these responses is attribution. Attribution is the ability to confidently say who did
it: which country, government agency, group, or even individual is responsible for a cyber intrusion or
attack. To respond to cyber activity, you must know who is responsible, and what makes them tick.
Defense, deterrence, and disruption all require an understanding of the adversary. Government
lawyers, agents, analysts, computer scientists, and other national security investigators are particularly
good at developing the building blocks of attribution-they have expertise honed in criminal
investigations and carry a host of legal authorities that allow them to investigate and gather
information.
Although attribution is a simple idea, doing so on the Internet is very complex. The Internet's
architecture allows hackers to route their activities through a global network of computers, almost all of
which are owned and operated by a variety of private actors. In addition, knowing which specific
computer or network caused the malicious activity doesn't necessarily tell you which person or
organization ordered, carried out, or supported the hack. But attribution is still possible. DOJ, including
the Federal Bureau of Investigation (FBI) and other law enforcement agencies, and with support from
the IC, has unique expertise and legal authorities it can use to attribute cyber activities to their source.
We can then take steps based on that attribution including but not limited to prosecuting those
responsible-to help us fight cyber threats. Each of these steps may seem small, but incrementally they
can help us turn the tide.
4) For purposes of comparison, sections of relevant agreements between the United States and
Singapore related to the U.S. use of port and other facilities are enclosed here. Assume that
the United States has reached similar agreements with Azania.
a) From the Defense Cooperation Agreement Between the United States of America and
Singapore, signed at Washington July 12, 2005
Article 2: EXPANDED DEFENSE AND SECURITY COOPERATION
1. The United States and Singapore desire to expand the scope of defense and security cooperation
reflected in their 1990 Memorandum of Understanding (MOU) Regarding United States Use of Facilities
in Singapore and other relevant agreements. The United States recognizes the important role played by
Singapore as a Major Security Cooperation Partner and its place in the global network of strategic
partnerships for the promotion of peace and stability and the war against global terrorism.
2. The Parties agree to work toward enhanced cooperation in the following areas:
a. Increased defense cooperation through the provision of facilities in Singapore for United
States military vessels, aircraft, personnel, equipment and materiel; supporting deployments of the
Parties' respective forces; conducting bilateral and multilateral exercises in the region and in the United
States and exchanging military training; fostering inter-operability of the Parties' respective aimed
forces; conducting defense policy dialogues to exchange strategic perspectives; conducting exchanges
between defense intelligence and security agencies; and joint efforts to broaden and deepen defense
technology and defense related research, development, testing, and scientific assessments;
b. Cooperation in Search and Rescue (SAR) and disaster management operations;
c. Exchanges and cooperative collection and analyses of information on threats of common
concern, including law enforcement cooperation;
d. Countering global terrorism and enhancing combined defenses against terrorism, including
promoting greater regional cooperation and coordination, building counterterrorism capacity, and
managing responses to terrorist attacks;
e. Cooperation against the proliferation of weapons-related items and dangerous technologies,
including through adherence to export, re-export, transit/transshipment, and brokering control systems
and to multilateral nonproliferation and export control regimes; and strengthened enforcement of such
controls; and
f. Such other areas of defense and security cooperation as the Parties may agree upon in the
future.
3. Increased cooperation in these areas will be subject to conditions separately agreed upon by the
Parties. The specific details of cooperation in these areas may be set out in Annexes to this Agreement
or other agreements entered into between the Parties pursuant to this Agreement.