Cyber Power and Strategy – So What?

Cyber Power represents the latest vogue de jour of the Strategic Studies community; it has enjoyed ever growing academic attention since the Revolution in Military Affairs concept of the 1990s was rife. Yet, despite all the hyperbole, there remains a lack of strategic appreciation as to what Cyber Power can actually offer to those who must do strategy. The reasons for this are twofold: first, the true extent of Cyber capability has not yet been realised, it is still growing and developing. Second, there is a lack of experience utilising Cyber Power in the real world, for the intention of attaining political objectives, against the will of an opponent. What is to be proposed here is a basic framework for consideration, to open wider more genuine strategic debate on this increasingly important strategic dimension.

Before any framework is proposed, a basic understanding of strategy must be adopted and clearly articulated. That of Clausewitz will suffice. If strategy is ‘the use of the engagement for the object of the war’[i] then any strategic consideration of Cyber Power must keep in mind the ends for which the instrument is to be used, which to date has been a considerable lapse in this area. The political context in which Cyber Power is expected to be used as an instrument of strategy must be carefully considered. That this has not been the case largely as a result of the point made above, that there is not yet enough experience of is the use of Cyber Power with which to inform strategic debate.

With this in mind, what should be considered is that Cyber Power will never be used by nation states as a panacea. It will not suddenly render obsolete maritime power (by which the vast majority of physical trade is still carried), nor will it become so dominant that every other instrument in the strategic toolbox will be made redundant. Rather, what is more likely is that control of the Cyber domain will remain subject to virulent contestation by actors competing for advantage in what is a very young arena of strategic engagement. Each nation state (or, sub-state actor, terrorist group, even organised criminal gang etc.) will most likely be seeking ways of making Cyber Power suit the already established modus operandi of that particular strategic culture. This will mean actors experimenting with Cyber Power to discover exactly what Cyber capabilities can offer. Only then will the coercive ability of Cyber Power begin to be better understood. The political, social, and cultural context of the actor trying to make this capability work will, however, remain important in deciphering and observing exactly how Cyber Power manifests itself.

So, to the point, what can Cyber Power actually do? The answer that will be given here will be incomplete, for the simple reason that consideration as to what Cyber Power can do can only be gauged based on what has thus far been observed through experience. That limited experience presents five avenues of strategic application.

First, Cyber Power as an intelligence tool. Cyber Power greatly increases the scope of information that can be collected, as well as the speed with which it can be acquired. Much of the leg work of intelligence agencies is today done by privateers, or even host governments themselves, such as western governments who openly publish online a great many details, such as parliamentary reports. There is simply far more information available openly, which is easily accessible then there has ever been in human affairs. Whereas in the past, a government would need to send representatives to a foreign land in order to observe and report on the dealings within a country, now such information can be gathered via largely open means much more quickly through the mediums of Cyber Space. Consider for instance the Taliban, who no longer need to rely on estimates as to the casualties they inflict on NATO forces, they can simply go online to the relevant defence ministry website, who publish the details of every soldier killed on operations. Not only this, but an ever-increasing amount of communications, is conducted via some form of telecommunications technology, resulting in greater scope for electronic interception. The intelligence world has a very large stake in becoming a primary player in, or beneficiary of, Cyber Space.

Second is the only avenue of Cyber experience thus far with “hard” results, the idea of assault. Such Cyber Warfare tactics include hacking, introducing viruses (such as STUXNET), “bot nets” or worms etc, into the Critical National Infrastructure (CNI) of networked states.[ii] This is a particular avenue of approach which has dominated speculative writing on the matter, such as Carlin’s A Farewell to Arms,[iii] which inspired the popular movie Die Hard 4, in which a cyber attack paralysed the American CNI, from Federal buildings, to telecommunications assets, right down to traffic controls. If it was networked, it was shut down. Although CNI attacks are the main area of consideration with Cyber Power as Cyber Warfare, one must note that we remain largely in the realm of speculation. The only real experiences of such assaults have been the alleged forays by the Russians against some Eastern European nations, along with concrete evidence of such activity during their limited conflagration with Georgia. There has not yet been a real world Cyber attack on CNI proving that a nation’s “nervous system” can be paralysed. Still, the potential to wield coercive power against a networked opponent is truly daunting, and well worth further investigation.

Thirdly is utilising Cyber Space to optimise the components of one’s own hard power. The concepts of Network Centric Warfare and Revolutions in Military Affairs come to mind here; the advantages that networking one’s military can deliver are clearly desirable. By gaining the ability for military forces to deploy worldwide, maintain communications with host nations thousands of miles away, and even in combat itself Cyber Power helps to increase response times through the application of technology in the loop of “find, fix, and finish”.[iv] This represents s a proven capacity in optimising combat performances. Should this be doubted, simply consider the increasingly judicious use of Unmanned Aerial Vehicles (UAV) by the American military over Afghanistan and Pakistan, flown by remote pilot in the United States itself (a novel melding of Space and physical assets, connected through Cyber Space). Simply the ability to control assets in a theatre of operations from another continent, utilise local intelligence, and strike designated targets, can convey great advantages to the military that can best conceptualise and operationalise the Cyber means at their disposal.

Fourth is the flip side to number three; if one can greatly optimise one’s own military, then you can undermine a networked enemy’s capability by attacking the Cyber elements that underpin that network. The example of the Iranian nuclear program is illustrative; it is widely believed that Israeli and American efforts to undermine that program are increasingly being centred on Cyber attacks. Lacking the option of a physical attack on Iran at this time, or even covert operations, assaulting the networks that the Iranian program utilises appears an ever-increasingly attractive option. Or for another example consider China, who is believed to be working very hard to penetrate and compromise the Cyber elements which underpin American logistical apparatus for any Pacific ocean deployment, as a potential plan for reducing American combat effectiveness in any conflict.

The interaction between these avenues must be appreciated. Avenue two above could be used to optimise one’s own forces by using Cyber Power. However, within avenue three lies a recognisable the dialectic of the use of force, namely, that if Cyber Power can give one side an advantage, then the very element producing that advantage must be a target worth attacking for a thinking, reacting opponent.

Fifth, somewhat surprisingly perhaps, is that Cyber Power is a potent moral tool. By hugely accelerating the speed of communications, to the extent that 24 hours news channels exist en masse, as well as the proliferation of social networking sites like Twitter, there is no, or at least negligible delay in reportage of world events. If a soldier dies in Afghanistan, it is announced in Whitehall by the close of business the next day, at the latest. What this means is that the time span of any feedback loop is greatly reduced. Cyber Space enables not only a controlling government, but also an electorate, to obtain information about current operations very fast indeed. Governments can be pressured faster than they can construct adequate responses, news agencies can expose scandals faster, and even if detail is lacking, incessant 24-hour coverage can still put even the most hardened administrations under severe strain.

Operation Panther’s Claw in Afghanistan is a useful example; the results of the operation to secure Afghan elections in Helmand Province were not even clear, yet considerable public pressure was heaped on the British government at home because the spike in casualties was not only communicated back to Britain very quickly, but also because extensive media coverage of the repatriation of dead soldiers precipitated a negative public backlash in Britain. If readers want a more potent example of the capacity of Cyber Space to influence the moral dimension by lubricating the feedback loop, then only one word is needed at this stage: Wikileaks. Julian Assange has exploited several of the advantages that Cyber Space, and created a very powerful tool of exposure.[v] Wikileaks has caused yet more controversy by leaking some 250,000 diplomatic cables of the US Government in November 2010, and this following the previous bulk releases of files regarding civilian casualties in Iraq, and details of the conduct of operations in Afghanistan. The impact of Cyber Power in the moral realm of strategy has been sorely overlooked at this stage; the ongoing saga of Julian Assange and his creation should serve to focus attention towards this neglected area.

These five avenues of approach reflect the experience of what has been seen so far; they are not intended to be exhaustive nor exclusive, this author fully expects there to be other avenues in future. The simple argument here is that Cyber Power is not yet developed enough to show us additional avenues of application. And even if it is, then the actors wielding the instrument have not yet assimilated that capability into an operational tool of strategy.

At this stage, however, it is also important to consider what Cyber Power cannot do, and before these specifics are enumerated on, it is worth considering that Cyber Power is a somewhat strange notion of power in the traditional sense. If “power” is the ability for A to make B do something that B would not otherwise do, than Cyber Power is only power in as far as the other guy is networked. What this means is that Cyber’s “power” to coerce an enemy to fulfil one’s will is directly proportionate to how networked that enemy is, the more he is networked, the greater the strategic relevance, and coercive capacity, of Cyber Power. If he is not networked, then Cyber Power is not a meaningful tool of strategy in the case of that enemy. Consider again the Taliban, Western Cyber Power means very little against an opponent who, by virtue of their religious beliefs shun high technology, utilise the traditional advantages of exclusive tribal societies, and fight in a guerrilla manner recognisable to fellow irregulars throughout the ages. The Taliban do not use Cyber Space, and have few, if any, assets that are even vulnerable to the application of Cyber Power. Therefore, Western Cyber Power can do very little to coerce them into accepting their will. If, however, an actor is highly networked, such as a western state, then Cyber Power holds great coercive power over elements such as the CNI, or the national economy, and so forth.

This aside, Cyber Power cannot do two things: it cannot kill directly, and it cannot occupy. Regarding the first, some may counter with the assertion that paralysing an aircraft control system for civil airliners would result in death. This is probably, indeed very likely to be the case, but the fact remains that death and destruction would be an indirect consequence of utilising Cyber Power’s coercive ability. Its offensive capacity relies on causing paralysis to networked systems, which is the direct consequence. If one takes a closer look at the STUXNET attacks, it will be seen that the direct consequence of the attack was to manipulate the operating software of industrial plants into different programming actions, the indirect results of this were harmful effects to the industrial components which that software was operating.[vi] It does not hold the power of coercion that the knife, the gun, the warship, and the aircraft hold. The hard elements of military power kill directly; Cyber Power will only ever be able to coerce that which is networked, whereas hard military power will always be able to coerce anything that it can come to grips with.

Cyber Power also cannot occupy in the traditional sense. One can speculate that in the Cyber realm you can hack and invade the Cyber territory of others, but strategically this means little unless it serves the political purpose for which a war is being fought. It has to be said that it looks unlikely that wars will be fought simply to occupy another’s Cyber territory, if such a “territory” can even be said to truly exist. Clearly Cyber Power will never be able to exert physical influence in the physical world; it will instead influence the networked assets operating in the physical world. It cannot directly occupy, not like a soldier can dominate ground, not like an air force can harass the skies, and not like a navy can blockade a coast. Wylie issued his assumption over 40 years ago that the ‘ultimate determinant in war is the man on the scene with the gun. This man is the final power in war. He is control. He decides who wins.’[vii] Strategically speaking, Wylie remains totally correct, and probably always will, the strategic relevance of Cyber Power will always be directly proportionate to how networked one’s enemy is.

The relevance of hard physical assets, however, remains beyond question.

To conclude, the argument here is that a full strategic appreciation of Cyber Power is not only still lacking, but will remain lacking for some time, simply because the full capabilities of what Cyber Power can do has not yet been realised. There has simply not been enough experience of actors utilising Cyber means to attain desired political ends for the debate to be fully informed. Despite this state of affairs, three propositions as to where Cyber Power will be driven shall be issued.

Proposition one: Cyber piracy is currently leading the way. Organised criminals are currently the cutting edge of Cyber tactics; it is they who are showing us the “how” of Cyber Space. However, their contribution to strategic debate will always be limited to tactical input, for their ends are criminal, not political. Proposition two: much like the previous development of the railway networks, it can be fully expected that the commercial market and not the military will drive development of Cyber Power. It is market demand that has given growth to Cyber infrastructure; that same market will nurture, develop, and utilise Cyber infrastructures much more comprehensively, and quickly, than any military actor. Proposition three: after one and two above, strategic debate on the use of Cyber Power will remain largely theoretical until there is the experience of a war between two Cyber peers, both utilising Cyber means, for the advancement of political objectives.

Until there is a war between opponents who can attack and defend against each other with Cyber Power (be this a purely Cyber War utilising only Cyber means, or be it a war recognisable to conventional eyes simply incorporating Cyber elements), the world will remain in the realm of guesswork as to the strategic utility of Cyber Power.