Cyberwarfare and the United States

Cyberattacks involving the United States and its military

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)

This article is written like a personal reflection, personal essay, or argumentative essay that states a Misplaced Pages editor's personal feelings or presents an original argument about a topic. Please help improve it by rewriting it in an encyclopedic style. (January 2021) (Learn how and when to remove this message)

This article possibly contains original research. Please improve it by verifying the claims made and adding inline citations. Statements consisting only of original research should be removed. (January 2021) (Learn how and when to remove this message)

(Learn how and when to remove this message)

Cyberwarfare is the use of computer technology to disrupt the activities of a state or organization, especially the deliberate attacking of information systems for strategic or military purposes. As a major developed economy, the United States is highly dependent on the Internet and therefore greatly exposed to cyber attacks. At the same time, the United States has substantial capabilities in both defense and offensive power projection thanks to comparatively advanced technology and a large military budget. Cyberwarfare presents a growing threat to physical systems and infrastructures that are linked to the internet. Malicious hacking from domestic or foreign enemies remains a constant threat to the United States. In response to these growing threats, the United States has developed significant cyber capabilities.

The United States Department of Defense recognizes the use of computers and the Internet to conduct warfare in cyberspace as a threat to national security, but also as a platform for attack.

The United States Cyber Command centralizes command of cyberspace operations, organizes existing cyber resources and synchronizes defense of U.S. military networks. It is an armed forces Unified Combatant Command. A 2021 report by the International Institute for Strategic Studies placed the United States as the world's foremost cyber superpower, taking into account its cyber offense, defense, and intelligence capabilities.

Background

This section is an excerpt from Cyberwarfare.

War (outline)
Part of a series on

History Prehistoric Ancient Post-classical castles Early modern military revolution pike and shot napoleonic warfare Late modern industrial warfare fourth-gen warfare
Military Organization Command and control Defense ministry Army Navy Air force Marines Coast guard Space force Reserves Ranks Specialties: Staff Engineers Intel Recon Medical Police Diving Pilot Land units: Infantry Armor Cavalry Artillery Special forces Signal corps Naval units: Warships Submarines Aircraft carriers Landing craft Auxiliary ships Air units: Fighters Bombers Command Close air support Electronic-warfare Reconnaissance Combat systems: Fire-control system Fire-control radar Director (military) Combat information center Sonar Radar Historical: Ship gun fire-control Gun data computer Torpedo data computer Development: Basic training Military manoeuvrers Combat training
Battlespace Aerospace Aerial Airborne Space Land Cold-region Desert Fortification Jungle Mountain Urban Subterranean Tunnel Sea Amphibious Blue Brown Green Surface Underwater Seabed Cyber Information
Weapons Air defence Armor Artillery Barrage Biological Camouflage Cavalry Horses Air cavalry Chemical Combined arms Conventional Cyber Denial Disinformation Drone / Robot Electromagnetic Infantry Loitering Missile Music Nuclear Psychological Radiological Submarine Unconventional
Tactics List of military tactics Aerial Airlift Air assault Airbridge Airdrop Anti-aircraft Anti-sub Anti-tank Battle Cavalry Charge Counterattack Counterinsurgency Convoy Defeat in detail Foxhole Drone Envelopment Formation Guerrilla Naval Rapid dominance Encirclement Investment Siege Swarm Screen Tactical objective Target saturation Trench Withdrawal
Operational Military operation Special Operations research Blitzkrieg Expeditionary Deep operation Maneuver Operational manoeuvre group Raid Covert Stay-behind
Strategy List of military strategies and concepts Military campaign Anti-access Attrition Commerce raiding Counter-offensive Culminating Defence in depth Fabian Empty fort Mosaic Deception Defensive Depth Goal Nuclear Naval Offensive Scorched earth
Grand strategy Asymmetric Blockade Broken-backed Class Cold war Colonial Conquest Containment Divide and conquer Economic Endemic Fleet in being Irregular Liberation Limited Network-centric New generation Perpetual Political Princely Proxy Religious Resource Strategic Succession Technology Theater Total war World war
Administrative Branch Policy Staff Training Service Sociology
Organization Area of responsibility Chain of command Command and control Doctrine Order of battle Principles of war Economy of force Medicine Engineers Intelligence Ranks Technology and equipment
Personnel Recruitment Conscription Mobilization Training Specialism Soldier Morale Volunteer Women Children Transgender Harassment Conscientious objector Counter-recruitment
Logistics History War economy Arms industry Materiel Supply-chain management Military–industrial complex Base MOB FOB Outpost
Science Power projection Loss-of-strength gradient Lanchester's laws Force multiplication
Law Occupation Armistice Ceasefire Court-martial Desertion Geneva Conventions Geneva Protocol Islamic rules Justice Lawful / Unlawful combatant Perfidy Jewish laws on war Rules of engagement Martial law War crime
Theory Air supremacy Appeasement Command of the sea Deterrence theory Full-spectrum dominance Overmatch Unrestricted Warfare Just war theory Principles of war Philosophy of war Security dilemma Tripwire force Wargaming Simulation Exercises
Non-warfare Arms control Counter-insurgency deterrence Disaster response Grey-zone Gunboat diplomacy Humanitarian aid Law enforcement Low-intensity conflict Military engineering Peacekeeping Peacebuilding Peace through strength Show of force
Culture Awards and decorations Battle cry Warrior War film Military science fiction War novel Anti-war movement Foot drill War song Uniform Wargame
Related Women in war War resister War studies Horses in warfare Wartime sexual violence Fifth column Mercenary Privateer Private military company
Lists Battles Military occupations Military terms Operations Sieges War crimes Wars Weapons Writers
v t e

Cyberwarfare is the use of cyber attacks against an enemy state, causing comparable harm to actual warfare and/or disrupting vital computer systems. Some intended outcomes could be espionage, sabotage, propaganda, manipulation or economic warfare.

There is significant debate among experts regarding the definition of cyberwarfare, and even if such a thing exists. One view is that the term is a misnomer since no cyber attacks to date could be described as a war. An alternative view is that it is a suitable label for cyber attacks which cause physical damage to people and objects in the real world.

Many countries, including the United States, United Kingdom, Russia, China, Israel, Iran, and North Korea, have active cyber capabilities for offensive and defensive operations. As states explore the use of cyber operations and combine capabilities, the likelihood of physical confrontation and violence playing out as a result of, or part of, a cyber operation is increased. However, meeting the scale and protracted nature of war is unlikely, thus ambiguity remains.

The first instance of kinetic military action used in response to a cyber-attack resulting in the loss of human life was observed on 5 May 2019, when the Israel Defense Forces targeted and destroyed a building associated with an ongoing cyber-attack.

The Department of Defense Cyber Strategy

In September 2023, Department of Defense (DoD) published its latest Cyber Strategy, building upon the previous DoD Strategy for Operating in Cyberspace published in April 2015 and July 2011. The DoD Cyber strategy focuses on building capabilities to protect, secure, and defend its own DoD networks, systems and information; defend the nation against cyber attacks; and support contingency plans. This includes being prepared to operate and continue to carry out missions in environments impacted by cyber attacks.

The DoD outlines three cyber missions:

Defend DoD networks, systems, and information.
Defend the United States and its interests against cyber attacks of significant consequence.
Provide integrated cyber capabilities to support military operations and contingency plans.

In addition, the Cyber Strategy emphasizes the need to build bridges to the private sector, so that the best talent and technology the United States has to offer is at disposal to the DoD.

The Five Pillars

1. Build and maintain ready forces and capabilities to conduct cyberspace operations;
2. Defend the DoD information network, secure DoD data, and mitigate risks to DoD missions;
3. Be prepared to defend the U.S. homeland and U.S. vital interests from disruptive or destructive cyber attacks of significant consequence;
4. Build and maintain viable cyber options and plan to use those options to control conflict escalation and to shape the conflict environment at all stages;
5. Build and maintain robust international alliances and partnerships to deter shared threats and increase international security and stability.

—US Department of Defense Cyber Strategy, US DoD, April 2015.

The five pillars is the base of the Department of Defense's strategy for cyber warfare. The first pillar is to recognize that the new domain for warfare is cyberspace and that it is similar to the other elements in the battlespace. The key objectives of this pillar are to build up technical capabilities and accelerate research and development to provide the United States with a technological advantage. The second pillar is proactive defenses as opposed to passive defense. Two examples of passive defense are computer hygiene and firewalls. The balance of the attacks requires active defense using sensors to provide a rapid response to detect and stop a cyber attack on a computer network. This would provide military tactics to backtrace, hunt down and attack an enemy intruder. The third pillar is critical infrastructure protection (CIP) to ensure the protection of critical infrastructure by developing warning systems to anticipate threats. The fourth pillar is the use of collective defense which would provide the ability of early detection, and incorporate it into the cyber warfare defense structure. The goal of this pillar is to explore all options in the face of a conflict, and to minimize loss of life and destruction of property. The fifth pillar is building and maintaining international alliances and partnerships to deter shared threats, and to remain adaptive and flexible to build new alliances as required. This is focused on "priority regions, to include the Middle East, Asia-Pacific, and Europe".

Trump Administration's National Cyber Strategy

Shortly after his election, U.S. President Donald Trump pledged to deliver an extensive plan to improve U.S. cybersecurity within 90 days of his inauguration. Three weeks after the designated 90-day mark, he signed an executive order that claimed to strengthen government networks. By the new executive order, federal-agency leaders are to be held responsible for breaches on their networks and federal agencies are to follow the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity in consolidating risk management practices. In addition, the federal departments were to examine cyber defense abilities of agencies within 90 days, focusing on "risk mitigation and acceptance choices" and evaluating needs for funding and sharing technology across departments. Experts in cybersecurity later claimed that the order was "not likely" to have a major impact.

In September, President Trump signed the National Cyber Strategy- "the first fully articulated cyber strategy for the United States since 2003." John Bolton, the National Security Advisor, claimed in September 2018 that the Trump administration's new "National Cyber Strategy" has replaced restrictions on the use of offensive cyber operations with a legal regime that enables the Defense Department and other relevant agencies to operate with a greater authority to penetrate foreign networks to deter hacks on U.S. systems. Describing the new strategy as an endeavor to "create powerful deterrence structures that persuade the adversary not to strike in the first place," Bolton added that decision-making for launching attacks will be moved down the chain of command from requiring the president's approval.

The Defense Department, in its strategy document released in September 2018, further announced that it would "defend forward" U.S. networks by disrupting "malicious cyber activity at its source" and endeavor to "ensure there are consequences for irresponsible cyber behavior" by "preserving peace through strength."

The National Cyber Strategy has also garnered criticisms that evaluating acts of cyberwarfare against the United States still remains ambiguous, as the current U.S. law does not specifically define what constitutes an illegal cyber act that transcends a justifiable computer activity. The legal status of most information security research in the United States is governed by 1986 Computer Fraud and Abuse Act, which was derided to be "poorly drafted and arbitrarily enforced" by enabling prosecution of useful information security research methods such as Nmap or Shodan. As even the needed services fall into prohibition, top-level information security experts find it challenging to improve the infrastructure of cyberdefense.

Cyberattack as an act of war

In 2011, The White House published an "International Strategy for Cyberspace" that reserved the right to use military force in response to a cyberattack:

When warranted, the United States will respond to hostile acts in cyberspace as we would to any other threat to our country. We reserve the right to use all necessary means – diplomatic, informational, military, and economic – as appropriate and consistent with applicable international law, in order to defend our Nation, our allies, our partners, and our interests. In so doing, we will exhaust all options before military force whenever we can; will carefully weigh the costs and risks of action against the costs of inaction; and will act in a way that reflects our values and strengthens our legitimacy, seeking broad international support whenever possible.

—International Strategy for Cyberspace, The White House, 2011

In 2013, the Defense Science Board, an independent advisory committee to the U.S. Secretary of Defense, went further, stating that "The cyber threat is serious, with potential consequences similar in some ways to the nuclear threat of the Cold War," and recommending, in response to the "most extreme case" (described as a "catastrophic full spectrum cyber attack"), that "Nuclear weapons would remain the ultimate response and anchor the deterrence ladder."

Attacks on other nations

Iran

See also: Operation Olympic Games and Stuxnet

In June 2010, Iran was the victim of a cyber attack when its nuclear facility in Natanz was infiltrated by the cyber-worm 'Stuxnet', said to be the most advanced piece of malware ever discovered and significantly increased the profile of cyberwarfare. It destroyed perhaps over 1,000 nuclear centrifuges and, according to a Business Insider article, " Tehran's atomic program back by at least two years."

Despite a lack of official confirmation, Gary Samore, White House Coordinator for Arms Control and Weapons of Mass Destruction, made a public statement, in which he said, "we're glad they are having trouble with their centrifuge machine and that we—the US and its allies—are doing everything we can to make sure that we complicate matters for them", offering "winking acknowledgement" of US involvement in Stuxnet.

China

Russia

In June 2019, Russia said that its electrical grid could be under cyber-attack by the United States. The New York Times reported that American hackers from the United States Cyber Command planted malware potentially capable of disrupting the Russian electrical grid.

Others

According to Thomas C. Reed's account in his 2004 autobiographical book At the Abyss: An Insider's History of the Cold War, in 1982, a computer control system stolen from a Canadian company by Soviet spies caused a Soviet gas pipeline to explode. He alleged that code for the control system had been modified by the CIA to include a logic bomb which changed the pump speeds to cause the explosion, but this is disputed.
A 1 April 1991 article in InfoWorld Magazine "Meta-Virus Set to Unleash Plague on Windows 3.0 Users" by John Gantz was purported to be an extremely early example of cyber warfare between 2 countries. In fact the "AF/91 virus" was an April Fools Joke that was misunderstood and widely re-reported as fact by credulous media.

Cyber threat information sharing

The Pentagon has had an information sharing arrangement, the Defense Industrial Base Cybersecurity and Information Assurance (DIBCIA) program, in place with some private defense contractors since 2007 to which access was widened in 2012. A number of other information sharing initiatives such as the Cyber Intelligence Sharing and Protection Act (CISPA) and Cybersecurity Information Sharing Act (CISA) have been proposed, but failed for various reasons including fears that they could be used to spy on the general public.

United States Cyber Command

Main article: List of cyber warfare forces

The United States Cyber Command (USCYBERCOM) is a United States Armed Forces Unified Combatant Command. USCYBERCOM plans, coordinates, integrates, synchronizes and conducts activities to: defend Department of Defense information networks and; prepare to conduct "full spectrum military cyberspace operations" to ensure US/Allied freedom of action in cyberspace and deny the same to adversaries.

Army

The Army Cyber Command (ARCYBER) is an Army component command for the U.S. Cyber Command. ARCYBER has the following components:

Army Network Enterprise Technology Command / 9th Army Signal Command
Portions of 1st Information Operations Command (Land)
United States Army Intelligence and Security Command will be under the operational control of ARCYBER for cyber-related actions.

New cyber authorities have been granted under National Security Presidential Memorandum (NSPM) 13; persistent cyber engagements at Cyber command are the new norm for cyber operations.

Marine Corps

United States Marine Corps Forces Cyberspace Command is a functional formation of the United States Marine Corps to protect infrastructure from cyberwarfare.

Air Force

The Sixteenth Air Force (16 AF) is the United States Air Force component of United States Cyber Command (USCYBERCOM). It has the following components:

The F-15 and C-130 systems are being hardened from cyber attack as of 2019.

Navy

The Navy Cyber Forces (CYBERFOR) is the type of some commanders for the U.S. Navy's global cyber workforce. The headquarters is located at Joint Expeditionary Base Little Creek-Fort Story. CYBERFOR provides forces and equipment in cryptology/signals intelligence, cyber, electronic warfare, information operations, intelligence, networks, and space. In September 2013, the United States Naval Academy will offer undergraduate students the opportunity, to major in Cyber Operations for the United States.

Fleet Cyber Command is an operating force of the United States Navy responsible for the Navy's cyber warfare programs. Tenth Fleet is a force provider for Fleet Cyber Command. The fleet components are:

Timeline

Systems in the US military and private research institutions were penetrated from March 1998 for almost two years in an incident called Moonlight Maze. The United States Department of Defense traced the trail back to a mainframe computer in the former Soviet Union but the sponsor of the attacks is unknown and Russia denies any involvement.
Titan Rain was the U.S. government's designation given to a series of coordinated attacks on American computer systems since 2003. The attacks were labeled as Chinese in origin, although their precise nature (i.e., state-sponsored espionage, corporate espionage, or random hacker attacks) and their real identities (i.e., masked by proxy, zombie computer, spyware/virus infected) remain unknown.
In 2007, the United States government suffered "an espionage Pearl Harbor" in which an unknown foreign power ... broke into all of the high tech agencies, all of the military agencies, and downloaded terabytes of information.
In 2008, a hacking incident occurred on a U.S. Military facility in the Middle East. United States Deputy Secretary of Defense William J. Lynn III had the Pentagon release a document, which reflected a "malicious code" on a USB flash drive spread undetected on both classified and unclassified Pentagon systems, establishing a digital beachhead, from which data could be transferred to servers under foreign control. "It was a network administrator's worst fear: a rogue program operating silently, poised to deliver operational plans into the hands of an unknown adversary. This ... was the most significant breach of U.S. military computers ever and it served as an important wake-up call", Lynn wrote in an article for Foreign Affairs.
Operation Buckshot Yankee, conducted by the United States in response to the 2008 breach which was allegedly conducted by Russia. This operation lasted three years, starting in October 2008 when the breach was first detected. The operation included attempts to recognize and mitigate the malicious code (Agent.btz), which had spread to military computers around the world. The team conducting the operation requested permission to use more offensive means of combating the code, but it was denied by senior officials. Operation Buckshot Yankee was a catalyst for the formation of Cyber Command.
On 9 February 2009, the White House announced that it will conduct a review of the nation's cyber security to ensure that the Federal government of the United States cyber security initiatives are appropriately integrated, resourced and coordinated with the United States Congress and the private sector.
On 1 April 2009, U.S. lawmakers pushed for the appointment of a White House cyber security "czar" to dramatically escalate U.S. defenses against cyber attacks, crafting proposals that would empower the government to set and enforce security standards for private industry for the first time.
On 7 April 2009, The Pentagon announced they spent more than $100 million in the last six months responding to and repairing damage from cyber attacks and other computer network problems.
From December 2009 to January 2010, a cyber attack, dubbed Operation Aurora, was launched from China against Google and over 20 other companies. Google said the attacks originated from China and that it would "review the feasibility" of its business operations in China following the incident. According to Google, at least 20 other companies in various sectors had been targeted by the attacks. McAfee spokespersons claimed that "this is the highest profile attack of its kind that we have seen in recent memory."
In February 2010, the United States Joint Forces Command released a study which included a summary of the threats posed by the internet: "The open and free flow of information favored by the West will allow adversaries an unprecedented ability to gather intelligence."
On 19 June 2010, United States Senator Joe Lieberman (I-CT) introduced a bill called "Protecting Cyberspace as a National Asset Act of 2010", which he co-wrote with Senator Susan Collins (R-ME) and Senator Thomas Carper (D-DE). If signed into law, this controversial bill, which the American media dubbed the "Kill switch bill", would grant the President emergency powers over parts of the Internet. However, all three co-authors of the bill issued a statement that instead, the bill " existing broad Presidential authority to take over telecommunications networks".
In August 2010, the U.S. for the first time publicly warned about the Chinese military's use of civilian computer experts in clandestine cyber attacks aimed at American companies and government agencies. The Pentagon also pointed to an alleged China-based computer spying network dubbed GhostNet that was revealed in a research report last year. The Pentagon stated that the People's Liberation Army was using "information warfare units" to develop viruses to attack enemy computer systems and networks, and those units include civilian computer professionals. Commander Bob Mehal would monitor the PLA's buildup of its cyberwarfare capabilities and "will continue to develop capabilities to counter any potential threat."
In 2010, American General Keith B. Alexander endorsed talks with Russia over a proposal to limit military attacks in cyberspace, representing a significant shift in U.S. policy.
In 2011 as part of The Anonymous attack on HBGary Federal information about private companies such as Endgame systems who design offensive software for the Department of Defense were revealed. It was shown that Endgame systems job applicants had previously "managed team of 15 persons, responsible for coordinating offensive computer network operations for the United States Department of Defense and other federal agencies."
In October 2012, the Pentagon was to host contractors who "want to propose revolutionary technologies for understanding, planning and managing cyberwarfare. It is part of an ambitious program that the Defense Advanced Research Projects Agency, or DARPA, calls Plan X, and the public description talks about 'understanding the cyber battlespace', quantifying 'battle damage' and working in DARPA's 'cyberwar laboratory.'"
Starting in September 2012, denial of service attacks, were carried out against the New York Stock Exchange and a number of banks including J.P. Morgan Chase. Credit for these attacks was claimed by a hacktivist group called the Qassam Cyber Fighters who have labeled the attacks Operation Ababil. The attacks had been executed in several phases and were restarted in March 2013.
In 2013, the first Tallinn Manual on the International Law Applicable to Cyber Warfare was published. This publication was the result of an independent study to examine and review laws governing cyber warfare sponsored by the NATO Cooperative Cyber Defence Centre of Excellence in 2009.
In February 2013, the White House Presidential Executive Order (E.o.) 13636 "Improving Critical Infrastructure Cybersecurity" was published. This executive order highlighted the policies needed to improve and coordinate cybersecurity, identification of critical infrastructure, reduction of cyber risk, information sharing with the private sector, and ensure civil and privacy liberties protections are incorporated.
In January 2014, the White House Presidential Policy Directive 28 (PPD-28) on "Signals Intelligence Activities" was published. This presidential policy directive highlighted the principles, limitations of use, process of collection, safeguarding of personal information, and transparency related to the collection and review of cyber intelligence signal activities.
In August 2014, "gigabytes" of sensitive data were reported stolen from JPMorgan Chase (see 2014 JPMorgan Chase data breach), and the company's internal investigation was reported to have found that the data was sent to a "major Russian city." The FBI was said to be investigating whether the breach was in retaliation for sanctions the United States had imposed on Russia in relation to the 2014 Russian military intervention in Ukraine.
On 29 May 2014, iSIGHT Partners, a global provider of cyber threat intelligence, uncovered a "long-term" and "unprecedented" cyber espionage that was "the most elaborate cyber espionage campaign using social engineering that has been uncovered to date from any nation". Labelled "Operation Newscaster", it targeted senior U.S. military and diplomatic personnel, congresspeople, journalists, lobbyists, think tankers and defense contractors, including a four-star admiral.
In December 2014, Cylance Inc. published an investigation on so-called "Operation Cleaver" which targeted over 50 world's unnamed leading enterprises, including in United States. Federal Bureau of Investigation tacitly acknowledged the operation and "warned businesses to stay vigilant and to report any suspicious activity spotted on the companies' computer systems".
In December 2014, in response to a hack on the US based company Sony (see Sony Pictures hack) believed to be perpetrated by North Korea, the US government created new economic sanctions on North Korea and listed the country as a state sponsor of terrorism. After the hack, there was an internet blackout over most of North Korea allegedly caused by the US, but there was no definitive evidence to support that claim.
In January 2015, terrorist group ISIS hacked United States Central Command and took over their Twitter and YouTube accounts. They distributed sensitive information obtained during the attack on various social media platforms.
In April 2015, The Department of Defense Cyber Strategy was updated and published. Original DoD Strategy for Operating in Cyberspace was published in July 2011.
In 2015 the United States Office of Personnel Management (OPM) was victim to what has been described by federal officials as among the largest breaches of government data in the history of the United States, in which an estimated 21.5 million records were stolen. Information targeted in the breach included personally identifiable information such as Social Security numbers, as well as names, dates and places of birth, and addresses, and likely involved theft of detailed background security-clearance-related background information.
In June 2015, the US Department of Defense (DoD) included a chapter dedicated to cyber warfare in the DoD Law of War Manual. See Cyber Warfare section on p. 994.
In 2016 Cyber Command mounted computer-network attacks on ISIS under Operation Glowing Symphony with the intent to disrupt internal communication, manipulate data, and undermine confidence in the group's security. A particular emphasis was placed on locking key figures out of their accounts, deleting files of propaganda, and making it all look like general IT trouble instead of an intentional attack. This operation prompted an internal debate in the American government about whether or not to alert their allies that they would be attacking servers located within other countries.
In March 2018, the Office of Foreign Assets Control sanctioned two Russian intelligence agencies, the Federal Security Service (FSB) and the Main Intelligence Directorate (GRU) for committing "destructive cyber-attacks." The attacks include the NotPetya attack, an assault that was allegedly conducted by the Russian military in February according to statements of the White House and British government, and which the United States Treasury described as "the most destructive and costly cyber-attack in history."
In March 2018, the United States Justice Department charged nine Iranians with stealing scientific secrets on behalf of Iran's Revolutionary Guard Corps. The defendants "stole more than 31 terabytes of academic data and intellectual property from universities, and email accounts of employees at private sector companies, government agencies, and non-governmental organizations."
In September 2018, the United States Justice Department published a criminal complaint against Park Jin Hyok, a professional hacker alleged to be working for North Korea's military intelligence bureau, for his commitment of three cyber-attacks: attack against Sony Pictures in 2014, the theft of $81m from the central bank of Bangladesh in 2016, and WannaCry 2.0 ransomware attack against hundreds of thousands of computers.
September 2018, The White House has "authorized offensive cyber operations" against foreign threats as a result of loosened restrictions on the use of digital weapons in line with the president's directive; the National Security Presidential Memorandum 13 (NSPM 13). This allows the military to carry out such attacks with a shortened approval process.
In October 2018, the United States Cyber Command launched the still-classified Operation Synthetic Theology. A team of experts were deployed to Macedonia, Ukraine, and Montenegro to identify Russian agents interfering in the election. The team was also gathering intelligence on Russia's cyber capabilities and attacking the Internet Research Agency, a "Kremin-backed troll farm in St. Petersburg".
Beginning at least by March 2019, persistent cyber operations were applied by the United States against Russia's power grid, seemingly per National Security Presidential Memorandum 13 (September 2018).
June 2019, White House National Security Adviser John Bolton announced that U.S. offensive cyber operations would be expanded to include "economic cyber intrusions". These comments appear to reference China's alleged theft of information and data from U.S. corporations.
In June 2019, President Trump ordered a cyber attack against Iranian weapons systems in retaliation to the shooting down of a US drone being in the Strait of Hormuz and two mine attacks on oil tankers. The attacks disabled Iranian computer systems controlling its rocket and missile launchers. Iran's Islamic Revolutionary Guard Corps (IRGC) was specifically targeted.

References

Grenoble, Ryan (16 August 2018). "Trump Reverses Obama-Era Rules on Cyberattacks". HuffPost. Retrieved 1 October 2018.
"How the US military is beating hackers at their own game". Business Insider. Retrieved 1 October 2018.
Pomerleau, Mark (28 June 2021). "Who can match the US as a cyber superpower? No one". c4isrnet.com. Retrieved 30 June 2021.
Singer, P. W.; Friedman, Allan (March 2014). Cybersecurity and cyberwar : what everyone needs to know. Oxford. ISBN 9780199918096. OCLC 802324804.{{cite book}}: CS1 maint: location missing publisher (link)
"Cyberwar – does it exist?". NATO. 13 June 2019. Retrieved 10 May 2019.
Smith, Troy E. (2013). "Cyber Warfare: A Misrepresentation of the True Cyber Threat". American Intelligence Journal. 31 (1): 82–85. ISSN 0883-072X. JSTOR 26202046.
Lucas, George (2017). Ethics and Cyber Warfare: The Quest for Responsible Security in the Age of Digital Warfare. Oxford. p. 6. ISBN 9780190276522.{{cite book}}: CS1 maint: location missing publisher (link)
"Advanced Persistent Threat Groups". FireEye. Retrieved 10 May 2019.
"APT trends report Q1 2019". securelist.com. 30 April 2019. Retrieved 10 May 2019.
"GCHQ". www.gchq.gov.uk. Retrieved 10 May 2019.
"Who are the cyberwar superpowers?". World Economic Forum. 4 May 2016. Retrieved 24 June 2021.
Cyber warfare : a multidisciplinary analysis. Green, James A., 1981–. London. 7 November 2016. ISBN 9780415787079. OCLC 980939904.{{cite book}}: CS1 maint: location missing publisher (link) CS1 maint: others (link)
Newman, Lily Hay (6 May 2019). "What Israel's Strike on Hamas Hackers Means For Cyberwar". Wired. ISSN 1059-1028. Retrieved 10 May 2019.
Liptak, Andrew (5 May 2019). "Israel launched an airstrike in response to a Hamas cyberattack". The Verge. Retrieved 10 May 2019.
^ Department of Defense Strategy for Operating in Cyberspace (PDF). US DoD. 2011.
^ US Department of Defense Cyber Strategy (PDF). US Department of Defense. 2015. pp. 2–8.
Williams, Martyn. "Trump's cybersecurity mystery: 90 days in, where's the plan?". Network World. Archived from the original on 19 April 2017. Retrieved 2 October 2018.
"Nonexistent Trump cybersecurity policy worries experts - The Parallax". The Parallax. 23 March 2018. Retrieved 2 October 2018.
"Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure | The White House". whitehouse.gov. Retrieved 2 October 2018 – via National Archives.
"Trump's cybersecurity order not likely to have a major impact, experts say - The Parallax". The Parallax. 12 May 2017. Retrieved 2 October 2018.
"President Trump Unveils America's First Cybersecurity Strategy in 15 Years | The White House". whitehouse.gov. 20 September 2018. Retrieved 2 October 2018 – via National Archives.
Groll, Elias. "Trump Has a New Weapon to Cause 'the Cyber' Mayhem". Foreign Policy. Retrieved 1 October 2018.
"President Donald J. Trump Is Strengthening America's Cybersecurity". whitehouse.gov. Retrieved 1 October 2018 – via National Archives.
Wheeler, Tarah. "In Cyberwar, There are No Rules". Foreign Policy. Retrieved 1 October 2018.
"International Strategy for Cyberspace" (PDF). whitehouse.gov. 2011. Retrieved 4 September 2014 – via National Archives.
Alexander, David (15 November 2011). "U.S. reserves right to meet cyber attack with force". Reuters. Retrieved 4 September 2014.
Miller, Steven E. "Cyber Threats, Nuclear Analogies? Divergent Trajectories in Adapting to New Dual-Use Technologies - Understanding Cyber Conflict: 14 Analogies". Carnegie Endowment for International Peace. Retrieved 13 December 2019.
Singer, Peter W.; Friedman, Allan (2014). Cybersecurity: What Everyone Needs to Know. Oxford University Press. ISBN 978-0-19-991809-6. Retrieved 13 December 2019.
AFP: Stuxnet worm brings cyber warfare out of virtual world. Google.com (1 October 2010). Retrieved 8 November 2011.
Ralph Langner: Cracking Stuxnet, a 21st-century cyber weapon | Video on Archived 1 February 2014 at the Wayback Machine. Ted.com. Retrieved 8 November 2011.
"US General: Iran's Cyber War Machine 'A Force To Be Reckoned With'". Business Insider. Retrieved 15 September 2016.
Gary Samore speaking at the 10 December 2010 Washington Forum of the Foundation for Defense of Democracies in Washington DC, reported by C-Span and contained in the PBS program Need to Know ("Cracking the code: Defending against the superweapons of the 21st century cyberwar", 4 minutes into piece)
Rapoza, Kenneth (22 June 2013). "U.S. Hacked China Universities, Mobile Phones, Snowden Tells China Press". Forbes.
SANGER, DAVID; PERLROTH, NICOLE (22 March 2014). "N.S.A. Breached Chinese Servers Seen as Security Threat". The New York Times.
"US and Russia clash over power grid 'hack attacks". BBC News. 18 June 2019.
"How Not To Prevent a Cyberwar With Russia". Wired. 18 June 2019.
Reed, Thomas C. (2004). At the Abyss: An Insider's History of the Cold War. ISBN 978-0-8914-1821-4.
Markoff, John (26 October 2009). "Cyberwar: Old Trick Threatens the Newest Weapons". The New York Times. Retrieved 30 July 2015.
"Cyberwar: War in the fifth domain". The Economist. 1 July 2010. Retrieved 4 July 2010.
Medetsky, Anatoly (18 March 2004). "KGB Veteran Denies CIA Caused '82 Blast". The Moscow Times. Archived from the original on 31 January 2016. Retrieved 30 July 2015.
Hesseldahl, Arik; Kharif, Olga (10 October 2014). "Cyber Crime and Information Warfare: A 30-Year History". Bloomberg Business. p. 2. Retrieved 30 July 2015.
Gantz, John (1 April 1991). "Tech Street". InfoWorld. p. 39.
Smith, George (10 March 2003). "Iraqi Cyberwar: an Ageless Joke". SecurityFocus. Retrieved 13 November 2015.
"Increased trust boosts Pentagon-industry info sharing", Sean Lyngaas, 22 April 2014, FCW.com
Reed, John. "Pentagon expanding public-private cyber information sharing program." Foreign Policy Magazine, 27 September 2012.
U.S. Department of Defense, Cyber Command Fact Sheet, 21 May 2010 "U.S. Strategic Command - Fact Sheets". Archived from the original on 5 September 2010. Retrieved 16 September 2010.
US Department of Defense (24 May 2010). "DoD Release No. 420-10 Establishment of Army Forces Cyber Command". defense.gov. Archived from the original on 29 May 2011. Retrieved 24 May 2010.
"20091203 IO Newsletter v10 no 03".
Patrick Jackson (15 March 2010). "Meet USCybercom: Why the US is fielding a cyber army". BBC News. Retrieved 10 July 2010.
"News Release: Army Forces Cyber Command Headquarters Standup Plan Announced". Defense.gov. Archived from the original on 29 May 2011. Retrieved 10 July 2010.
Sydney J. Freedberg Jr. (17 September 2018) Trump Eases Cyber Ops, But Safeguards Remain: Joint Staff
Mark Pomerleau (8 May 2019) New authorities mean lots of new missions at Cyber Command
"Fort Mead News: USMC Cyber Command". Ftmeade.army.mil. 28 January 2010. Archived from the original on 13 April 2010. Retrieved 10 July 2010.
"Sixteenth Air Force (Air Forces Cyber)". Archived from the original on 19 July 2020. Retrieved 4 August 2020.
Colin Clark (20 June 2019) Raytheon Wins Air Force F-15, C-130 Cyber Contracts
Mike Hoffman (8 June 2013). "Naval Academy Launches Cyber Operations Major". DefenseTech.org.
DOD News Release 827-09
Navy Stands Up Fleet Cyber Command, Reestablishes U.S. 10th Fleet, NNS100129-24
"Cyber War: Sabotaging the System". CBS News. 6 November 2009.
The Washington Post: Pentagon computers attacked with flash drive
Nakashima, Ellen (8 December 2011). "Cyber-intruder sparks response, debate". The Washington Post.
"White House Eyes Cyber Security Plan". CBS News. 9 February 2009.
Warrick, Joby; Pincus, Walter (1 April 2009). "Senate Legislation Would Federalize Cybersecurity". Washingtonpost.com.
Greenwald, Glenn; Gallagher, Ryan (12 March 2014). "How the NSA Plans to Infect 'Millions' of Computers with Malware". The Intercept.
"Pentagon Bill To Fix Cyber Attacks: $100M". CBS News. 7 April 2009.
"A new approach to China". Blogspot. 12 January 2010. Retrieved 17 January 2010.
"Google Attack Is Tip Of Iceberg", McAfee Security Insights, 13 January 2010
"The Joint Operating Environment", Report released, 18 Feb 2010, pp. 34–36
"Home - Homeland Security & Governmental Affairs Committee". hsgac.senate.gov.
Senators Say Cybersecurity Bill Has No 'Kill Switch', informationweek.com, 24 June 2010. Retrieved on 25 June 2010.
"ANNUAL REPORT TO CONGRESS Military and Security Developments Involving the People's Republic of China 2010" (PDF).
Baldor, Lolita C. (19 August 2010). "Pentagon takes aim at China cyber threat". The Boston Globe.
"WSJ: U.S. Backs Talks on Cyber Warfare". Online.wsj.com. 4 June 2010.
Haroon Meer (11 March 2011). "Lessons from Anonymous on cyberwar". Al Jazeera English.
Shane, Scott (26 September 2012). "U.S. Officials Opening Up on Cyberwarfare". The New York Times.
"Chase, NYSE Websites Targeted in Cyber Attacks". Fox Business. Archived from the original on 19 October 2012. Retrieved 15 March 2013.
"Phase 2 Operation Ababil". 7 December 2012. Retrieved 15 March 2013.
"Bank Attackers Restart Operation Ababil DDoS Disruptions". 6 March 2013. Retrieved 15 March 2013.
NATO Cooperative Cyber Defence Centre of Excellence (2013). Tallinn Manual. Cambridge University Press. ISBN 978-1-107-02443-4.
"Executive Order -- Improving Critical Infrastructure Cybersecurity". whitehouse.gov. 12 February 2013. Retrieved 25 October 2015 – via National Archives.
"Presidential Policy Directive -- Signals Intelligence Activities". whitehouse.gov. 17 January 2014. Retrieved 25 October 2015 – via National Archives.
Michael Riley; Jordan Robertson (27 August 2014). "FBI Examining Whether Russia Is Tied to JPMorgan Hacking". Bloomberg. Retrieved 5 September 2014.
Jordan Robertson; Michael Riley (3 September 2014). "Computers for Hire Send JPMorgan Data to Russia". Bloomberg. Retrieved 5 September 2014.
Finkle, Jim (29 May 2014). Tiffany Wu (ed.). "Iranian hackers use fake Facebook accounts to spy on U.S., others". Reuters. Retrieved 30 March 2015.
Riley, Michael A; Robertson, Jordan (2 December 2014). "Iran-Backed Hackers Target Airports, Carriers: Report". Bloomberg News. Retrieved 30 March 2015.
Finkle, Jim (2 December 2014). Richard Valdmanis, Christian Plumb and W Simon (ed.). "Iran hackers targeted airlines, energy firms: report". Reuters. Retrieved 30 March 2015.
"U.S. Sanctions North Korea Over Sony Hack". Time. Retrieved 9 April 2017.
Evans, Stephen (23 December 2014). "Why did North Korea's internet go down?". BBC News. Retrieved 9 April 2017.
Atwan, Abdel Bari. Islamic State: The Digital Caliphate. University of California Press.
Barrett, Devlin (5 June 2015). "U.S. Suspects Hackers in China Breached About four (4) Million People's Records, Officials Say". The Wall Street Journal. Retrieved 5 June 2015.
Risen, Tom (5 June 2015). "China Suspected in Theft of Federal Employee Records". U.S. News & World Report. Retrieved 5 June 2015.
Sanders, Sam (4 June 2015). "Massive Data Breach Puts 4 Million Federal Employees' Records at Risk". NPR. Retrieved 5 June 2015.
^ Department of Defense Law of War (PDF). US Department of Defense. 2015. p. 994. Archived from the original (PDF) on 15 October 2015. Retrieved 25 October 2015.
"ISIS Targeted by Cyberattacks in a New U.S. Line of Combat". NYT. 24 April 2016.
"How The U.S. Hacked ISIS". NPR.org. Retrieved 5 November 2019.
Nakashima, Ellen (9 May 2017). "U.S. military cyber operation to attack ISIS last year sparked heated debate over alerting allies". The Washington Post. ISSN 0190-8286. Retrieved 5 November 2019.
"America sanctions Russians for election-meddling and cyber-attacks". The Economist. Retrieved 1 October 2018.
"Nine Iranians Charged With Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps". 23 March 2018. Retrieved 1 October 2018.
"America's government is putting foreign cyber-spies in the dock". The Economist. Retrieved 1 October 2018.
Nakashima, Ellen (20 September 2018). "White House authorizes 'offensive cyber operations' to deter foreign adversaries". The Washington Post. Retrieved 5 November 2019.
Ratnam, Gopal; Donnelly, John M.; Ratnam, Gopal; Donnelly, John M. (16 July 2019). "House demands to see Trump's cyberwarfare directive". Retrieved 5 November 2019.
Barnes, Julian E. (7 May 2019). "U.S. Cyber Command Bolsters Allied Defenses to Impose Cost on Moscow". The New York Times. ISSN 0362-4331. Retrieved 5 November 2019.
Sanger, David E.; Perlroth, Nicole (15 June 2019). "U.S. Escalates Online Attacks on Russia's Power Grid". The New York Times. ISSN 0362-4331. Retrieved 5 November 2019.
"US buries digital land mines to menace Russia's power grid | Energy Central". www.energycentral.com. Retrieved 5 November 2019.
Strobel, Warren P. (11 June 2019). "Bolton Says U.S. Is Expanding Offensive Cyber Operations". The Wall Street Journal. Retrieved 5 November 2019.
"U.S. Offensive Cyber Operations against Economic Cyber Intrusions: An International Law Analysis - Part I". Just Security. 11 July 2019. Retrieved 5 November 2019.
"US 'launched cyberattacks on Iran weapons' after drone downing". www.aljazeera.com. Retrieved 8 November 2019.