The Private Sector Role in Offensive Cyber Operations: Benefits, Issues and Challenges

Abstract

This paper explores the role that companies play in supporting offensive cyber operations. It finds that contractors play critical roles in two key functions: intelligence/reconnaissance and planning/mission support. The reliance of the U.S. military on cyber contractors brings both benefits and risks. Benefits include access to rapidly evolving technologies and the ability to obtain access to in-demand skills sets quickly and easily. Challenges fall into two categories: domestic policy and international relations. In the former case, the main issues are over-reliance on non-government personnel and challenges in oversight of cyber contractors, which could result in undesirable financial and strategic outcomes. Within the international arena, cyber contractors may affect the balance of power of states. The most likely outcome is that the use of contractors will exacerbate existing power discrepancies between developed and developing countries. However, it is possible that wealthy but less developed states could rely on private sector capability to quickly develop their cyber attack capabilities. Another issue that may affect international relations is uncertainty about the legal status of cyber contractors as combatants. A final concern surrounds the observation that companies may find themselves on both sides of a cyber operation. To accrue the benefits and address the challenges posed by contractor support to offensive cyber operations, several actions should be taken. There needs to be a public debate about the proper role of cyber contractors in military operations. Companies should have a voice in this debate due to their increasingly important role in cyberspace. In addition, the US government and international community must provide guidance to cyber contractors on the role that they should play in offensive cyber operations. Export controls are helpful but they are blunt tools that often bring heavy costs and do not always accomplish their desired outcomes. More precise direction is needed, most likely beginning with norms of behavior.