Rules of Engagement for Cyberspace Operations

Abstract

As offensive and defensive cyberspace operations are incorporated into U.S. military planning, senior leaders and commanders must address the rules of engagement (ROEs) for U.S. forces with regard to such operations. Cyber weapons do provide U.S. forces with operational choices that were previously unavailable, but traditional principles that inform rules of engagement in the physical world can and do inform rules of engagement that govern cyberspace operations as well. To a very large extent, the U.S. military seeks to integrate cyber weapons into its operational toolkit within a common framework of principles that apply to all weapons. Nevertheless, several characteristics of operations in cyberspace and the use of cyber capabilities complicate the formulation of cyber-specific ROEs, including among other things the borderless geography and range of effects possible on the Internet, ambiguity of adversary intent arising from the difficulty of distinguishing between intelligence-gathering for reconnaissance and preparation for attack, and difficulties of attribution in cyberspace. Issues related to command and control and escalation of force also play important roles in shaping ROEs. The paper concludes by noting that the U.S. military has had many decades of operational experience to inform how it formulates ROEs for kinetic weapons, and a paucity of similar experience with cyber operations will hamper the formulation of ROEs for cyber weapons unless special efforts are made to impart such experience to the appropriate leaders and commanders.