Should a national cybersecurity strategy include offensive botnets?

Right now all industries, including the military, have very serious security problems. Recently the Department of Defense was infected with a USB virus, the Air Force traffic control system was breached, and attackers broke into the Joint Strike Fighter project network and stole terabytes of sensitive data. Information security is such a new and rapidly changing industry that there are no established, well-tested standards for creating secure infrastructures (as has been established with, say, building codes). Very few organizations have the resources required to launch organized, well-funded, constantly-monitored information security infrastructures. Even those that do still suffer security breaches.

The Internet is an environment no one controls or understands right now. Government entities -- even those that control very powerful tools -- are subject to the same information security problems as everyone else, and there are no easy solutions. To introduce a new, powerful, distributed weapon without the knowledge or resources to fully control it, would be foolish. An offensive botnet itself would be an especially coveted target for attackers. In the current environment, there is a high risk that any offensive cybersecurity technology would be compromised, misused or abused.

A national cybersecurity strategy would be more effectively improved if our government and critical industries were to consistently implement effective security practices, such as routine patching, monitoring and two-factor authentication. Most security breaches result from known flaws or weak account management, and can easily be prevented with careful, routine maintenance and attention. These remedies aren't as exciting as offensive botnets, but safety isn't supposed to be exciting.