Defend forward and persistent engagement

In September 2018, the US Department of Defense cyber strategy wrote two words that changed the trade: defend forward. Cyber Command no longer just guards military networks; it goes after the adversary in its own, or in the infrastructure it borrows, outside US territory. The sister doctrine, persistent engagement, says the same thing over time: contact with the adversary is constant, below the threshold of war. A presidential memorandum of August 2018, NSPM-13, eased approvals. First reported use: according to the Washington Post in February 2019, Cyber Command cut the Internet Research Agency in St. Petersburg off from the internet starting on the day of the November 2018 midterm elections; Donald Trump confirmed it in July 2020 in an interview with the same paper. The UK followed with the National Cyber Force, set up in 2020. For insurance, the doctrine matters in two ways. It multiplies cyber operations by democratic states, which LMA 5564 to 5567 exclude like any others. And it often plays out on servers rented from third parties, hosting firms and cloud providers, which can end up as bystanding systems in an operation they know nothing about.