As the world becomes increasingly interconnected and networked, the potential for cyber attacks against a nation’s critical infrastructure and key resources continues to increase. Countries fear that sustained cyber attacks will significantly incapacitate or damage critical infrastructure and key resources. How to properly guard against these attacks has become a topic of debate for nations all across the world. Many cyber experts feel that the traditional means of defense setup and administered by governments is not sufficient to defend against sustained cyber attacks during a time of war.

There are three (3) types of militia that exist today:- the forum, the cell, and the hierarchy.

The forum cyber militia is an ad-hoc group that forms around an online meeting place or forum. The forum unites people that are “willing and able to use cyber attacks in order to achieve a political goal.”  It also serves as a command and control platform where members can post propaganda along with attack instructions and tools.

A cell cyber militia is a group of hackers who perform cyber attacks on their own. They commit cyber attacks on a regular basis over a period of time. Cell type militias are limited in size and consist of members who know and trust each other. Members coordinate their actions and do not give or receive orders.

Lastly, a hierarchical cyber militia is one that adopts a traditional hierarchical structure with a clear chain of command. (Ottis, 2011) It is similar to a military unit with a unit commander who exercises power over sub-units. Each sub-unit can have a specific task and its membership can be identified or anonymous.

The three types of cyber militias defined each have their own attributes with specific strengths and weaknesses. When deciding to establish a militia, they all need to be weighed accordingly. During the construction of a cyber militia, what will be required of the cyber militia must be considered.

This will most likely dictate the type of cyber militia that is assembled.

Each type has its own advantages and disadvantages that make it appropriate for specific circumstances. The need for strict command and control, mobilization, sustainment, size, and anonymity are all factors that should be contemplated as a part of this. For example, will the cyber militia need to take strict orders from command for coordination of operations? Or will a loose network of individuals be sufficient? The talent pool for potential members and the types of cyber missions they will carry out must also be considered. The cyber militia will have to be tailored to the skill level of its members. If highly skilled hackers are available, sophisticated attacks may be carried out. If not, a cyber militia that facilitates the use of relatively easy cyber attacks should be used. Each cyber militia relates to the aforementioned factors in different ways, making it more suitable for certain applications.

A forum type cyber militia will provide a force that can rapidly mobilize and expand in size.

New members can quickly take up the cause and join existing members in the attacks. It also lends itself to a relatively unskilled membership with more experienced members posting instructions and tools to perform cyber attacks. However, since a forum cyber militia is a loose network of individuals, it lacks command and control with members deciding on their own actions.

Once the flurry of activity by the militia has ceased, activity in the forum decreases so it will not serve as a sustained force. A cell cyber militia differs from the forum type in that it will consist of a relatively small group of highly skilled hackers that know and trust each other. As a result, gaining membership is a difficult and lengthy process. (Ottis, 2011) Similar to the forum type, a cell militia does not provide regimented command and control, but there is coordination. Due to their skill level and coordination, cell militias are able to quickly mobilize and carry out sophisticated cyber attacks.

A cell can also be a sustained force with periods of activity and dormancy. Since they are only a small group, cells are not able to carry out the volume of attacks that a forum militia could. In addition, the continued actions of a small group of individuals may also make them more susceptible to identification. Discovering the identity of even a few members of the group may disrupt its effectiveness.

The hierarchical cyber militia provides a third option for forces where a clear chain of command is required. Unlike the previous two types, it can provide strong and efficient command and control, making it suitable for government-sponsored groups. (Ottis, 2011) Tasks and responsibilities can be assigned as attacks are carried out. However, hierarchy militias require more time to assemble than the others because the command and assignments must be established. (Ottis, 2011) During periods of inactivity, a hierarchical militia can also be sustained and improved through recruitment and training. Although like the hacker cell, it is not easy to add new members because they must go through a vetting process before admission.

Much of the success of the hierarchy militia is also dependent on capable leaders being assigned to the few available command positions. (Ottis, 2011) The success of the other militias does not hinge on a few select individuals as it does here. When assembling a cyber militia for the United States, the most practical option is a militia fashioned after Ottis’ hierarchy model. The hierarchy model provides for a clear chain of command and control that mimics a military organization and the militia should be operated as such. The strict sense of command and control is required by the United States because as a government sponsored cyber militia, the U.S. would be responsible for its actions. Models such as the forum where members can act unilaterally should not be used. The militia should have a skilled, vetted, and identified membership that is ready to respond and take part in cyber missions when needed. Following Ottis’ model, the militia should be comprised of sub-units that fulfill specific roles and perform specialized tasks. Some of these sub-units could be modeled after highly skilled cell militias and could perform very sensitive cyber missions. However, these cells would take direct orders from superiors and not coordinate activities amongst themselves. With this type of militia, the U.S. would also have opportunities to develop their forces through training and recruiting. Being that it is state sponsored, there would be government resources that could be used to develop and grow the militia through training and recruiting. Furthermore, this would make the militia sustainable over time, especially during periods of peace. The cyber militia model suggested for the United States would also be applicable to law enforcement as they combat cybercrime. Instead of using it militarily to protect our nation, it could be applied on a more local level to law enforcement departments to protect civilians and civilian assets. Since the model follows a hierarchy with command and control coming from points of leadership, it is similar to what currently exists for law enforcement. However, in this case, members would be enforcing cyber laws. The same reasoning that supports the use of this model for a U.S. cyber militia also applies for law enforcement. Members who are a part of the militia should be skilled, vetted, and identified. Strict orders from superiors are required to ensure members act within the bounds of the law and not unilaterally. Different roles and assignments can also given to different members and units. Leveraging this hierarchical model for law enforcement would present an effective and efficient way to be combat cybercrime with a militia.

The fundamental concern when it comes to constructing a cyber militia in the United States is the actions of its members. (Lango, 2011) There are fears that members of the militia may act on their own accord and not under the direction of the United States. This calls into question the effectiveness of the command and control of a cyber militia. Although there would be a vetting process, in the heat of battle members may unilaterally feel that their actions are in the best interest of the country. These unauthorized actions will ultimately be attributed to the U.S. Not only can this cause unpredictable and undesired consequences such as escalating the conflict, it may be politically and legally difficult to assign responsibility to those accountable. (Lango, 2011) Without a truly effective command and control structure, the viability of a cyber militia in the U.S. is called into question. The use of a cyber militia by the United States is being suggested to augment existing national defenses and help with the growing problem of cyber defense. One country, Estonia, has already taken the step to bolster its defenses with a cyber militia. However, for a country like the United States, it is not an easy step to take. There are many issues to be considered such as the shape of the militia itself. Rain Ottis has suggested three models for cyber militias. They are the forum, cell, and hierarchy models. Each one has its own advantages and disadvantages, but the hierarchy model would best fit a cyber militia instituted in the United States. It could also be adapted and used along with law enforcement to combat cybercrime. In spite of the additional defense, a cyber militia would provide the United States, many are still skeptical about its use. There is fear that command and control would be ineffective and members of the militia will act without the approval of the U.S. Unsanctioned cyber strikes have the potential to escalate ongoing conflicts with other countries. Furthermore, there would be political and legal issues with assigning responsibility for these actions. Consequently, the U.S. is unlikely to assemble a cyber militia anytime soon. Nonetheless, the need to strengthen cyber defenses will continue to be a topic of debate. Therefore, the U.S. needs to continue to explore all possible means of reinforcing its cyber defenses, including the controversial use of cyber militias.

References

Gjelten, T. (2011, January 4). Volunteer Cyber Army Emerges In Estonia. Retrieved August 1,

2011 from NPR: http://www.npr.org/2011/01/04/132634099/in-estonia-volunteer-cyberarmy-

defends-nation

Lango, H.-I. (2011, June 14). Should the United States Create a Cyber Militia? Retrieved August

1, 2011 from Hegemonic Obsessions: http://hegemonicobsessions.com/?p=516

Ottis, R. (2011). Theoretical Offensive Cyber Militia Models. Retrieved August 1, 2011 from

Cooperative Cyber Defence Centre of Excellence:

http://www.ccdcoe.org/articles/2011/Ottis_TheoreticalOffensiveCyberMilitiaModels.pdf