Photo: Personnel at the USAF component of Cyber Command
By Sebastian J. Bae, Columnist
Cyber warfare invokes images of rogue hackers stealing information or computer viruses crippling nations. Unsurprisingly, US cyber doctrine emphasizes network security and the weaponization of software. Yet, the victors in cyberspace will not be the states with the best technology, but those who effectively manipulate and control information. China and Russia have already demonstrated their ability to wage information warfare in the digital age – understanding cyberspace is a means to an end. Thus, to succeed in future conflicts, the US must recognize cyber warfare is the next evolution in information warfare, the timeless contest to control, manipulate, and leverage information.
The US mistakenly views cyber warfare as an extension of the Clausewitzian paradigm of warfare – a clash of wills through offensive and defensive capabilities. Joint Publication 3-12: Cyber Operations emphasizes the freedom of movement in cyberspace, the development of cyber firepower, and the protection of networks. This narrow focus on gaining the most advanced cyber capabilities confuses means and ways with strategic ends. David Fahrenkrug, a US Air Force Colonel specializing in cyber warfare, has argued “strategists working on cyberspace plans are simply cobbling together a variety of capabilities with little to no understanding of why.”[i]
Unlike the technology-centric US approach, China understands the central role of information control in cyber warfare. China recognized the Internet, particularly social media, provides political dissidents the means to orient and organize a political opposition, a lesson from the Arab Spring. Consequently, in 2014, the suspected state-sponsored cyber attacks during the Hong Kong protests censored access to social media platforms, undermining the ability of protestors to mobilize and coordinate. [ii] Instead of tanks, China leveraged information control to stamp out political unrest. Meanwhile, China continues to use cyber operations like Night Dragon, Titan Rain, and Byzantine Maze to gain information superiority over the US, whether in the form of stolen military technology or trade secrets.[iii] For instance, the thief of F-35 plans from Lockheed Martin has narrowed the military technological gap between the US and China.[iv] To China, cyberspace offers an effective, low cost opportunity to garner strategic advantage or shi, comprising one front in China’s wider pursuit of national comprehensive power.[v]
Likewise, during the 2008 Russian-Georgian War, as Russian troops flooded over the border and bombers flew sorties overheard, attacks by Russian patriotic hackers crippled the Georgian information infrastructure. A legion of botnets blockaded Georgia’s limited Internet infrastructure, while some Internet traffic was suspiciously redirected through Russian telecommunications firms. The information blackout denied public access to news and government websites, while disrupting military communications.[vi] The denial of service attacks specifically targeted the Georgian population’s ability to orient amidst the fog of war, producing panic and fear. The Russian cyber offensive sought to control the flow of information, shape perceptions, and steal and accumulate critical intelligence.[vii] The Russian-Georgian War demonstrates the exploitation, denial, and leveraging of information, i.e., controlling the flow of information, is the objective of information warfare.
“Engaging in disruptive cyberattacks alone is hardly a way to win wars,” but require the expert and strategic leveraging of information.[viii] Col. John Boyd famously argued, “Machines don’t fight wars, terrain doesn’t fight wars. Humans fight wars. You must get into the minds of humans. That’s where the battles are won.”[ix] According to Boyd, to prevail in war, one had to strive to see the world through the adversary’s eyes – to understand his beliefs, motives, and mind. Speed, ambiguity, deception, but most of the ability to unravel the adversary would be the hallmarks of future wars. With the advent of cyberspace, the ability to ‘enter the enemy’s mind’ is unprecedented as demonstrated by the Russo-Georgian War and Chinese information control. Through the control of information, cyberspace has enabled actors the ability not only to enter the enemy’s mind, but also to paralyze and inflict damage there. This is the heart of cyber warfare.
Information is increasingly the leading factor in gaining victory in wars of the modern era. During the First World War, airpower was limited as an observation tool, both in terms in technology and doctrine, yet, “like air warfare, cyberwar will only become more destructive over time.”[x] According to a former intelligence official, “This is how we order people to go to war. If you’re on the inside, you can change orders. You can say, ‘turn left’ instead of ‘turn right.’ You can say ‘go up’ instead of ‘go down.’”[xi] Admittedly, there are no specific cases where an actor has been able to directly manipulate the military force of the adversary, but the future may not be too far off. Consequently, to succeed in any future conflict, the US military needs to recognize the goal of cyber warfare is to control and exploit information better than its adversaries.
The technology-centric US approach conflates network security and advanced cyber weapons with achieving meaningful ends in cyberspace. Currently, the mission of US cyber doctrine is the protection of critical networks through layers of firewalls. The underlying assumption is if the network is secure, then the information will equally be secure. However, firewalls and static defenses are increasingly vulnerable as demonstrated by Chinese cyber espionage to Snowden-esque leaks. Instead, the US needs a dynamic approach towards cyber operations, employing adaptive defenses such as frequency hopping IPs, steganography, and cloud architectures.[xii] Most of all, the US must understand that information, not capabilities, is the objective in cyber warfare. Whether on the battlefield or cyberspace, the use of force in the absence of wider strategic understanding is meaningless. The victors in cyberspace will not be the states with the best technology, but those who effectively leverage information to confuse, deceive, and control the adversary.
Without a strategic overhaul in conceptualizing cyber warfare, the US will be unable to compete in cyberspace where information superiority will define success more than any other time in history. The first step in winning the cyber wars of the future will be understanding ends, ways, and means – a lesson the US could learn from China and Russia.
[i] David Fahrenkrug, “Cyberwar: In Need of a Theory,” Georgetown Journal of International Affairs, Feb. 10, 2014, http://journal.georgetown.edu/cyberwar-in-need-of-a-theory/
[ii] Parmy Olson, “The Largest Cyber Attack in History Has Been Hitting Hong Kong Sites,” Forbes, Nov. 20, 2014, http://www.forbes.com/sites/parmyolson/2014/11/20/the-largest-cyber-attack-in-history-has-been-hitting-hong-kong-sites/
[iii] Timothy L. Thomas, Three Faces of the Cyber Dragon, (Fort Leavenworth: Foreign Military Studies Office, 2012), 100, 125-127.
[iv] Adam Segal, “From TITAN RAIN to BYZANTINE HADES: Chinese Cyber Espionage,” in A Fierce Domain: Conflict in Cyberspace, 1986-2012. ed. Jason Healy, (Cyber Conflict Studies Association, 2013),165-167.
[v] Timothy L. Thomas, Three Faces of the Cyber Dragon, (Fort Leavenworth: Foreign Military Studies Office, 2012), 126-128.
[vi] John Arquilla, “Cyberwar is Already Upon Us,” Foreign Policy, http://foreignpolicy.com/2012/02/27/cyberwar-is-already-upon-us/
[vii] Andreas Hagen, “The Russo-Georgian War 2008,” in A Fierce Domain: Conflict in Cyberspace, 1986-2012. ed. Jason Healy, (Cyber Conflict Studies Association, 2013), 196.
[viii] John Arquilla, “Cyberwar is Already Upon Us,” Foreign Policy, http://foreignpolicy.com/2012/02/27/cyberwar-is-already-upon-us/
[ix] Douglas M. Johnston Jr., Religion, Terror, and Error, (NY: Praeger Security International, 2011), 6.
[x] John Arquilla, “Cyberwar is Already Upon Us,” Foreign Policy, http://foreignpolicy.com/2012/02/27/cyberwar-is-already-upon-us/
[xi] Ellen Nakashima, “Defense Official Discloses Cyberattack,” Washington Post, August 24, 2010, http://www.washingtonpost.com/wp-dyn/content/article/2010/08/24/AR2010082406495.html
[xii] David Fahrenkrug, “Cyberwar: In Need of a Theory,” Georgetown Journal of International Affairs, Feb. 10, 2014, http://journal.georgetown.edu/cyberwar-in-need-of-a-theory/