Is America Really Ready for a Cyber War?
The United States faces new types of military threats that challenge traditional organization and strategy, including those emanating from the cyber domain. This challenge, however, can be made more solvable by using a well-known theory of warfare to provide a model upon which theorists of today can build an understanding of modern warfare. The most widespread framework with which cyber conflict is modeled is that of deterrence. As different as these two may seem, both are characterized by offense ascendancy and costly defense, providing the base for the borrowed theory. The theoretical and practical application of the deterrence model to cyberspace was included as a crucial component of the 2015 Department of Defense cyber manual, citing a key mission as contributing to “the development and implementation of a comprehensive cyber deterrence strategy to deter key state and non-state actors from conducting cyberattacks against U.S. interests.” While this way of thinking helps prepare for—and prevent—a large-scale cyber Pearl Harbor, it has significant limitations in regards to practical use. A better framework for this kind of activity is the irregular-conflict model.
Limits of the Deterrence Model
The fundamental-element-of-deterrence theory is the existence of a credible threat. Kinetic weaponry, like bombs and missiles, cause obvious and devastating consequences through methods which the populations of the world can understand and fear. In the cyber domain, attacks have not proven to hold this same psychological power, especially in that the most powerful cyber weapons we have are those our enemies know nothing about.
One of the key points of the deterrence model is the ability to assure retaliation. Though the difficulty of cyberattack attribution is no longer as large a hurdle as it once was, it is difficult to accurately identify all attack parameters within the accelerated time frame that the deterrence model demands.
The tremendous cost and specific requirements of large-weapons programs limit the types of actors capable of developing and deploying weapons whose main function is it to deter—not engage in—warfare. Though sophisticated cyber attacks, too, are more easily developed with the aid of the technological and fiscal superiority of developed states, anyone with access to the internet has access to basic, but effective, hacking tools. “The battlespace is open, accessible, nearly anonymous, and with an entry cost that appears affordable,” according to Daniel Hughes and Andrew Colarik of National Defense University Press. Access to higher order cyber tools requires time, equipment and practice, but this learning curve is a gentle slope in comparison to the steep development curve of sophisticated kinetic weaponry.
Irregular Cyber Model
Cyber conflict, specifically those activities that take place below a level which could necessitate significant retaliation, strongly resembles the model of irregular conflict. On irregular battlescapes, conflict is characterized by a lack of fixed lines blurring the separation between friendly and enemy, combatant and noncombatant. In cyberspace, this lack of distinction is just as—if not more—pronounced. There are no political borders in cyberspace, no uniformed enemy and no certainty that the next day’s circumstances won’t radically alter.
As Sun Tzu wrote in The Art of War, “Numerical weakness comes from having to prepare against possible attacks; numerical strength from compelling our adversary to make these preparations against us.” This principle can explain offense ascendency in cyberspace in that a defender must prepare and guard against large volumes of diverse attacks, of which, only a few need to successfully penetrate the network. Therefore, a defensive cyber strategy cannot rely on the ability to guarantee defense. This allows a numerically or otherwise weaker force to disproportionately increase their power relative to the enemy.
The objective of a cyber attack can be a combination of deterrence, denial, disruption, degradation and deception. The last three of these necessitate an invasive strategy, requiring practitioners to operate within areas of enemy control without detection. During the Vietnam War, Võ Nguyên Giáp championed the use of small units capable of operating in pockets deep in enemy-claimed territory. It was essential to this strategy that his soldiers be able to conceal themselves and capitalize fully on the element of surprise. In the battlefields of both cyber and irregular conflict, combatants attempt not to reach complete spatial ownership, but to maximize their freedom of movement and deny that of their enemy.