To most spectators, the United States appears to be in the midst of a successful cyber defense campaign against Russia. As General Paul Nakasone, head of the U.S. Cyber Command, recently testified before Congress, the U.S. military is deploying military members to the region to sit “side by side with our partners.” Cyber Command has also “designed options for national decision makers” and “performs operations as directed.” Yet at a crucial time in the Ukrainian cyber defense, the Biden administration is reportedly considering a proposal to remove the Ministry of Defense authorities to conduct offensive cyber operations and reintroduce a centralized approval process from the White House. This would be a mistake.
All departments and agencies within the federal government operate under different authorities, delegated from the president through executive policies and from Congress through law. These define what an organization may and may not do and when it should ask for permission. In a conflict or military campaign, the president (and sometimes Congress) delegates authorities to the Department of Defense to conduct operations.