U.S. weighs countering cyberattacks with nukes

Draft of Pentagon policy report targets crippling attacks.

David E. Sanger and William J. Broad WASHINGTON — A newly drafted U.S. nuclear strategy that has been sent to President Donald Trump for approval would permit the use of nuclear weapons to respond to a wide range of devastating but non-nuclear attacks on U.S. infrastructure, including what current and former government officials described as the most crippling kind of cyberattacks.

For decades, U.S. presidents have threatened “first use” of nuclear weapons against enemies in only very narrow and limited circumstances, such as in response to the use of biological weapons against the United States. But the new document is the first to expand that to include attempts to destroy wide-reaching infrastructure, like a country’s power grid or communications, that would be most vulnerable to cyberweapons.

The draft document, called the Nuclear Posture Review, was written at the Pentagon and is being reviewed by the White House. Its final release is expected in the coming weeks and represents a new look at the United States’ nuclear strategy. The draft was first published last week by HuffPost.

It called the strategic picture facing the United States quite bleak, citing not only Russian and Chinese nuclear advances but advances made by North Korea and, potentially, Iran.

“We must look reality in the eye and see the world as it is, not as we wish it to be,” the draft document said. The Trump administration’s new initiative, it continued, “realigns our nuclear policy with a realistic assessment of the threats we face today and the uncertainties regarding the future security environment.”

The Pentagon declined to comment on the draft assessment because Trump had not yet approved it. The White House also declined to comment.

But three current and former senior government officials said large cyberattacks against the United States and its interests would be included in the kinds of foreign aggression that could justify a nuclear response — although they stressed there would be other, more conventional options for retaliation. The officials spoke on the condition of anonymity because they were not authorized to discuss the proposed policy.

Gary Samore, who was a top nuclear adviser to President Barack Obama, said much of the draft strategy “repeats the essential elements of Obama declaratory policy word for word” — including its declaration that the United States would “only consider the use of nuclear weapons in extreme circumstances to defend the vital interests of the United States or its allies and partners.”

But the biggest difference lies in new wording about what constitutes “extreme circumstances.”

In the Trump administration’s draft, those “circumstances could include significant non-nuclear strategic attacks.” It said that could include “attacks on the U.S., allied, or partner civilian population or infrastructure, and attacks on U.S. or allied nuclear forces, their command and control, or warning and attack assessment capabilities.”

The draft does not explicitly say that a crippling cyberattack against the United States would be among the extreme circumstances. But experts called a cyberattack one of the most efficient ways to paralyze systems like the power grid, cellphone networks and the backbone of the internet without using nuclear weapons.

“In 2001, we struggled with how to establish deterrence for terrorism because terrorists don’t have populations or territory to hold at risk. Cyber poses a similar quandary,” said Kori Schake, a senior National Security Council and State Department official during President George W. Bush’s administration, who is now the deputy director general of the International Institute for Strategic Studies in London.

“So if cyber can cause physical malfunction of major infrastructure resulting in deaths,” Schake said, the Pentagon has now found a way “to establish a deterrent dynamic.”

The draft review also cites “particular concern” about “expanding threats in space and cyberspace” to the command-and-control systems of the U.S. nuclear arsenal that the review identifies as a “legacy of the Cold War.” It was the latest warning in a growing chorus that the nuclear response networks could themselves be disabled or fed false data in a cyberattack.

So far, all of the United States’ leading adversaries — including Russia, China, North Korea and Iran — have stopped well short of the kind of cyberattacks that could prompt a larger, and more violent, response.

The Russians have placed malware called “Black Energy” in U.S. utility systems but never tried to cause a major blackout. They have sent cable-cutting submarines along the path of undersea fiber-optic lines that connect the continents but not cut them. North Korea has attacked companies like Sony, and used cyberweapons to cause chaos in the British health care system, but never directly taken on the United States.

Still, the document recognizes that U.S., Russian and Chinese strategies have all been updated in recent years to reflect the reality that any conflict would begin with a lightning strike on space and communications systems. During the Obama administration, for example, a secret program, code-named “Nitro Zeus,” called for a blinding cyberattack on Iran in the event negotiations over its nuclear program failed and Washington found itself going to war with Tehran.

There are other differences with the Obama administration policy.

The draft strategy embraces the U.S. production of a new generation of small, low-yield nuclear weapons — some of which were under development during the Obama administration. Some experts warn that such smaller weapons can blur the distinction between nuclear and non-nuclear weapons and, as a result, be more tempting to use.

And it states outright that Russia is testing its first autonomous nuclear torpedo, one that U.S. officials believe would be guided largely by artificial intelligence to strike the United States even if communications with Moscow were terminated. It was Washington’s first public acknowledgment of such an undersea weapon, a prototype of which was first envisioned in the 1960s by Andrei Sakharov, the physicist who later ranked among the Soviet Union’s most famous dissidents.

The torpedo’s development was detected by the Obama administration and has been widely discussed in defense circles but never publicly referred to by the Pentagon as a significant future threat.

Trump has rarely publicly criticized President Vladimir Putin of Russia for its aggressions around the world. But the Pentagon document describes Moscow’s actions as so destabilizing that the United States may be forced to reverse Obama’s commitment to reduce the role and size of the U.S. nuclear arsenal.

Russia is adopting “military strategies and capabilities that rely on nuclear escalation for their success,” Defense Secretary Jim Mattis wrote in an introduction to the report. “These developments, coupled with Russia’s invasion of Crimea and nuclear threats against our allies, mark Moscow’s unabashed return to Great Power competition.”