Michael Chertoff, former US Secretary of Homeland Security, recently emphasized that establishing rules of engagement regarding cyberwar should be a top priority. Dealing with the issue of active defenses is an important component of this initiative.

“Preemption” is a loaded word. The right of a nation to act in self-defense against imminent threats is protected by Article 51 of the UN Charter, but cyberspace adds a different dimension to the issue. If the government discovered potentially malicious code on a computer, code that could disable a US power grid, or shut down military command and control centers, preemptive action to destroy the virus would necessitate a delicate hand.

The code could be on another country’s computers, on a civilian’s computer, or within the government network. Eliminating the code could have unintended effects on target computer or computer system, and accessing it might violate the owner’s civil liberties. In order to respond in "real time" to cyber threats, should the United States develop more automated response systems? If this was the case, cyber threats could be countered without a single human involved. Efficient, but scary.

Sanctioning unchecked cyber preemption is a problem. From a government standpoint it means revealing defense capabilities, as well as the priorities about what assets are important to us. At worst, it means taking a first, possibly aggressive action, that could have inadvertent negative effects on targeted systems, or even provoke an enemy to retaliate. On the other hand, if no preemptive action is taken, one could end up with an "embarrassed executive problem." Somewhere in the aftermath of a cyber attack, an official will have to sit in front of Congress and say the equivalent of "Yes, we knew the oil rig had safety issues, but we didn't fix them." And that, as we all know, is frustrating.

Yes it's true, yet strangely you don't see that headline splashed across CNN.  The reason is that this wasn't a conventional attack on Iran, it was a cyber attack.  As David Sanger reported in the New York Times,

The Iranian government agency that runs the country’s nuclear facilities, including those the West suspects are part of a weapons program, has reported that its engineers are trying to protect their facilities from a sophisticated computer worm that has infected industrial plants across Iran.

In short, a computer worm has infiltrated the systems that run Iran's nuclear facilities, causing an unspecified amount of damage.  As the story reports, experts (and I am certainly not one) believe the level of sophistication of the attack could only be achieved by a state.  Without further information about the extent of the damage or nature of the worm, which given the nature of attack is unlikely to be made public, it's impossible to say for sure who released the worm or why, but early speculation points at two prime suspects - Israel and the United States.

Attacking the technological base of the Iranian nuclear program is not a solution to the problem, but it will most likely slow the program.  While that may seem minor, if you believe Jeffrey Goldberg's recent article in The Atlantic then perhaps a bit of time may be tremendously important.

Even more important, however, will be the repercussions from this attack.  If Iran believes that the U.S. or Israel was behind the attack, it may seek to retaliate, in cyberspace or with a conventional attack.  Furthermore, if other nations, particularly China and Russia, come to believe that America was behind this attack, it could mark the start of a new era of cyberwar.  Until now countries have tested defenses and capabilities, much like boxers circling the ring and throwing exploratory jabs.  Launching a prominent attack on Iran's nuclear systems could come to be viewed as the first real punch thrown in this match, and could signal to other powers that the fight is on. 

Once that barrier is crossed, and cyberwar crosses from potential to actual, there is no going back.