The Fifth Domain: Cyberspace and War

 

By Jose Cruz

NATO officially recognized cyberspace as a domain of operations in 2016 and, despite the claims by Clausewitzians that a cyber attack does not constitute an act of war, a cyber attack perpetrated against a member country can lead to the invocation of Article 5.[1] As explained by Thomas Rid in an article that appeared in the Journal of Strategic Studies on 5 Oct 2011, cyber attacks have failed to unleash devastation and mainly revolve around the activities of subversion, espionage, and sabotage.[2] Nevertheless, the fears that a knockout blow can be delivered through the cyber domain still occupy the minds of policy makers and military commanders. For example, Leon Panetta, the U.S. Secretary of Defense under President Barrack Obama, stated that cyber attacks have the potential to paralyze the nation and could be as destructive as the 9/11 attacks.[3] What’s more, in the U.S. Army’s “Multi-Domain Operations 2028” publication, Gen. Mark A. Milley, Chairman of the Joint Chiefs of Staff, warns of the need to effectively fight through multiple layers of stand off in the air, sea, land, space, and cyber environments.[4]  Rid’s comments still hold true eight years after they were made, however cyber capabilities have become more sophisticated and attacks have become more “frequent, complex, destructive, and coercive.”[5] As the theorist Douhet explains, in order for strategy to be effective, the means used to devise such strategy must be suited to the character and form of the future environment.[6] The role of cyber technology is changing the character of war and conflict, therefore future strategists must consider it as an important resource that can help achieve operational objectives and strategic effects.

French Army officer and military strategist Gen. André Beaufre stated that war is total.[7] This means that in order to increase the probability of success in war, we must effectively synchronize the use of all instruments of national power. According to the U.S. Army War College there are four instruments of national power: diplomatic, informational, military and economic.[9] The syntactic, physical, and semantic layers of cyberspace fall under the domain of information operations and have the potential to achieve strategic effects through the conduct of offensive cyber operations and countervalue cyber targeting.[10] Countervalue cyber strikes have as their aim the degradation, or destruction, of a state’s sources of national power. For example, in August 2012 Aramco, a Saudi corporation and one of the world’s largest oil producers, was targeted by the malware Shamoon, forcing the company to take its computer networks offline for months.[11] This attack not only forced the company to replace 50,000 of its hard drives at prices higher than market values, but it also affected its ability to process the sale transactions of the oil they were producing, forcing the company to give away oil for free in order to provide its customers with the oil they required.[12] Aramco was able to eventually replace its computer systems, improve its cybersecurity, and resume its business, but at a considerable cost. What would happen to a state that suffers a similar attack, but instead of having only one of its companies be at the receiving end of an attack, multiple companies, of different sizes, across multiple industries are targeted simultaneously? The probable end result of this large-scale cyber attack could paralyze, to quote Leon Panetta, the economy of the state that houses all of the companies under attack. Christopher Coker explains that the greatest power that we have over our enemies is to tap into their minds and aggravate their anxieties.[13] Large scale cyber violence, or the threat of it, can help us influence the outcome of conflict by exploiting these anxieties in a much more humane way than large scale conventional or nuclear attacks.

Countervalue cyber strikes can also be employed in the fight against nuclear proliferation by denying, or disrupting, our adversary’s attempts to acquire the technology necessary to build a nuclear bomb. These strikes can be conducted exclusively in the cyber domain, as the computer worm Stuxnet illustrated when it targeted the infrastructure of Iran’s enrichment program, or they can also be part of a multi-domain operation such as Operation Orchard.[14] During Operation Orchard, the Israeli Air Force successfully targeted a Syrian nuclear reactor site by utilizing their cyber capabilities in conjunction with more conventional assets.[15] During the initial phases of the operation, Israeli forces were able to defeat Syria’s air defense systems through a cyber attack, giving Israeli warplanes the opportunity to enter Syrian air space and conduct precision strikes against the site.[16] This operation demonstrated how the cyber domain can also be used to conduct counterforce targeting, the targeting of military forces and infrastructure in order to achieve tactical and operational objectives. This means that if cyber capabilities are properly integrated in multi-domain operations, they have the potential to act as a force multiplier and impose further complexity on the enemy by enlarging his battlefield.

Coker also argues that the anonymous character of cyber attacks is one of the advantages of conducting operations in the cyber domain. This anonymity permits states to compete with one another and improve their position relative to their adversaries without triggering a conventional conflict.[17] For example, NASA’s space vehicle blueprints were stolen in 2006 by hackers of unknown origin; a cyber attack on the Canadian Defence Research and Development agency in 2011 is thought to have originated in China, however it is unknown whether the hackers were Chinese or if they simply routed their attack through Chinese servers; and in 2012 a cyber attack conducted by an unknown entity collected information from government embassies, research firms, military installations, and energy providers of various Eastern European countries.[18] This anonymous characteristic of cyber operations also make them an ideal tool for the conduct of hybrid, or non-linear, warfare. In this type of warfare, cyber attacks can be used to target the communication networks of an adversary in order to undermine his political legitimacy, incite rebellion, and deny him the ability to coordinate an effective response against attack as was observed during Russia’s campaigns in Georgia and Ukraine.[19]

Society’s extensive presence in the cyber domain also has the potential to be exploited in order to achieve strategic effects. Kalev Leetaru explains that the algorithms used to deliver online content have made social media users more susceptible to misinformation, disinformation, and manipulation.[20] For example, a report prepared for the Committee On Foreign Relations of the U.S. Senate titled “Putin’s Asymmetric Assault on Democracy in Russia and Europe: Implications for U.S. National Security,” details how Russia has attempted to destabilize rivals through the spread of misinformation.[21] The spread of this misinformation was done through the use of bots or paid “trolls” that amplified a false story’s reach and profile, making those stories trend on social media platforms as a result.[22] The use of bots and paid trolls to influence segments of the population also reveals the fact that states are not the only actors that possess the ability to conduct cyber operations for strategic effects. According to Jared Cohen, ISIS “is the first terrorist group to hold both physical and digital territory.”[23] The online footprint of ISIS and their effective use of the cyber domain to deliver high quality content was not only able to harness support from those holding similar views, but the group was also able to increase its reach and recruit would be fighters from all around the globe. Studies on the subject indicate that the dissemination of fabricated information is likely to only reach a small portion of the population, and even a smaller fraction is likely to be influenced by it.[24] Nevertheless, jus as Colin Gray explains that “soldiers don’t have to fight impeccably to win,” neither do computer algorithms need to deliver “fake news” to the majority of the population to be effective. They simply need to reach and influence enough numbers to sustain recruitment requirements or to skew elections or national referendums. It is for this reason that cyber domain operations are likely to become more popular amongst fringe groups and revisionist states that seek to further advance their political objectives.

The nature of war and conflict has not changed. It will always impose suffering; it will always claim casualties; and it will always cause destruction. The character of war on the other hand has, and it will continue to do so as technology continues to enable us to invent new ways to apply force and violence. Coker argued that in order to better understand the character of future conflict and war we might have to be willing to put some distance between ourselves and Clausewitz.[25] To Clausewitz, an act of war constitutes an act of force that is used to compel our enemies to do our will.[26] He describes this act of “force” as a physical strike against our adversaries with the intended purpose to compel them to accept our political objectives. However, cyber attacks have demonstrated that virtual violence has the potential to be as compelling as physical violence. For example, the Shamoon malware proved that the destruction of the virtual infrastructure of important industries has the potential to be just as destructive as strategic bombing, and perhaps even more precise. What’s more, Stuxnet also proved how an attack conducted in the virtual world can lead to the damage of physical property, and Operation Orchard showcased how the virtual world can provide strategist with another avenue of approach that can be exploited to achieve operational objectives. The larger the footprint of technology in society and the military, the greater its contribution to strategy. Cyber space has increased the number of ecosystems our devices can operate in as well as the amount of interactions and applications they are able to perform.[27] This level of complexity has made our devices more vulnerable by increasing the number of entry ways and points of interaction that can be exploited.[28] Nevertheless, H.R. McMaster warns us of the need to be vigilant against “vampire fallacies” and an over reliance on new forms of technology that promise easier and cheaper wars.[29] As Rid remains us, to date there has not being a large scale cyber attack that has been able to deliver a “knockout blow.” Nevertheless, the cyber domain has proven to be a useful tool in helping accomplish policy objectives and has facilitated the application of force. The U.S. Department of Defence acknowledges this by stating that “the United States’ strategic competitors are conducting cyber-enabled campaigns to erode U.S. military advantages, threaten infrastructure, and reduce economic prosperity.”[30] It is for this reason that command and coordination centres, such as USCYBERCOM and CyOC, are being stood up at the national and international levels of governance in order to further develop doctrine and effectively coordinate responses against cyber threats.

[1] Laura Brent, “NATO’s Role In Cyberspace,” NATO Review Magazine.

[2] Thomas Rid, “Cyber War Will not Take Place,” Journal of Strategic Studies 35, 1(2012): 6.

[3] Jim Garamone, “Panetta Spells Out DOD Roles in Cyberdefense,” U.S. Department of Defense.

[4] U.S. Department of the Army, The U.S. Army in Multi-Domain Operations 2028.

[5] Brent, NATO’s Role In Cyberspace.

[6] Giulio Douhet, The Command of the Air ( Washington: Air Force History and Museum Program, 1998), 5.

[7] Hew Strachman, The Direction of War: Contemporary Strategy in Historical Perspective (Cambridge: Cambridge University Press, 2013), 34.

[8] U.S. Department of Defense, DoD Dictionary of Military and Associated Terms 2019.

[9] Commander Jeff Farlin, “Instruments of National Power: How America Earned Independence” (Strategy Research Project, United States Army War College, 2014), https://publications.armywarcollege.edu/pubs/87.pdf.

[10] Christopher Coker, Future War (Oxford: Polity Press, 2015), 62; Max Smeets, “The Strategic Promise of Offensive Cyber Operations,” Strategic Studies Quarterly 12, 3(2018): 93.

[11] Max Smeets, The Strategic Promise of Offensive Cyber Operations, 93; Jose Pagliery, “The Inside Story of the Biggest Hack in History,” CNN Business.

[12] Jose Pagliery, “The Inside Story of the Biggest Hack in History,” CNN Business.

[13] Christopher Coker, Future War, 107.

[14] Thomas Rid, “Cyber War Will not Take Place,” Journal of Strategic Studies 35, 1(2012): 19.

[15] Ibid.

[16] Ibid.

[17] Christopher Coker, Future War (Oxford: Polity Press, 2015), 102.

[18] Greg Weston, “Foreign Hackers Attack Canadian Government,” CBC News; NATO, “The History of Cyber Attacks – A Timeline,” NATO Review Magazine; Dave Lee, “Red October Cyber Attack Found by Russian Researches,” BBC News.

[19] Christopher Coker, Future War (Oxford: Polity Press, 2015), 105; Thomas Rid, “Cyber War Will Not Take Place,” Journal of Strategic Studies 35, 1(2012): 13.

[20] Kalev Leetaru, “The Rise of Fake News Coincides with Society Outsourcing Its Thinking to Algorithms,” Forbes News.

[21] Committee on Foreign Relations of the United States Senate, Putin’s Asymmetric Assault on Democracy in Russia and Europe: Implications for U.S. National Security.

[22] Ibid.

[23] Jared Cohen, “Digital Counterinsurgency: How to Marginalize the Islamic State Online,” Foreign Affairs.

[24] Krysten Crawford, “Stanford Study Examines Fake News and the 2016 Presidential Election,” Stanford News.

[25] Christopher Coker, Future War (Oxford: Polity Press, 2015), 103.

[26] Carl von Clausewitz, Beatrice Heuser, and Michael Howard, On War (Oxford: Oxford University Press 2007), 13.

[27] Nirav Shah, “The Security Risks Presented by Complex Networks,” Fortinet (blog), May 01,2018, https://www.fortinet.com/blog/business-and-technology/decrease-your-customers–network-complexity-for-increased-securi.html.

[28] Ibid.

[29] Lawrence Freedman, the Future of War: A History (Penguin, 2018), 279.

[30] U.S. Department of Defense, Summary of Cyber Strategy 2018.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s