Cyber Warfare...Brought To You By J.C. Wylie

Future thinking about cyber operations is often analogized to early airpower doctrine. Like the early airpower theorists, Gregory Rattray also points out that cyberwar theorists also make the mistake of assuming that cyber operations capabilities will be standalone strategic weapons. The cyber weapon, in other words, is not always going to get through. More likely is cyber warfare operations and tactics augmenting regular operations and tactics. In other words, the difference is between an unrealistic vision of cyberwar and a very much plausible conception of cyberwarfare.

Naval warfare and special operations theory may present a better prism for viewing how cyber operations will play out. In his seapower classic Military Strategy: A Theory of Power Control, Rear Admiral J.C. Wylie argued that the aim of strategy was to gain some measure of control over the adversary. There were essentially two styles of strategy: sequential and cumulative. Sequential strategy utilizes force in discrete, linear packages. An land army on campaign sweeping through a territory destroys an enemy state layer by layer, division by division. Cumulative forms of strategy, on the other hand, build gradual and nonlinear pressure on an opponent.

The classic example is the relationship between the land war in the European Theater of Operations and the Combined Bomber Offensive. By tying down precious German resources, the Bomber Offensive amplified the strategic effect of the land campaigns. Airpower advocates were, of course, wrong that a strategic airpower offensive would on its own negate the need for a land campaign. But the Bomber Offensive cannot simply dismissed as a failure merely because it did not live up to its planners' strategic expectations.  In naval warfare, the Pacific Theater of operations paired a sequential strategy of advance through fortified island networks with the cumulative destruction of the Japanese merchant fleet by submarines. To go even farther back in military history, Winfield Scott's Anaconda Plan, which exploited Union strength on the rivers and the oceans, amplified the strategic effect of land operations in the Western and Eastern theaters of operation.

So how does Wylie fit into cyber operations? Well, first let's take a look at what Kings' College professor Thomas Rid has written about the characteristics of cyber weapons:

Cyber-weapons span a wide spectrum. That spectrum, we argue, reaches from generic but low-potential tools to specific but high-potential weaponry. To illustrate this polarity, we use a didactically helpful comparison. Low-potential 'cyber-weapons' resemble paintball guns: they may be mistaken for real weapons, are easily and commercially available, used by many to 'play,' and getting hit is highly visible -- but at closer inspection these 'weapons' will lose some of their threatening character. High-potential cyber-weapons could be compared with sophisticated fire-and-forget weapon systems such as modern anti-radiation missiles: they require specific target intelligence that is programmed into the weapon system itself, major investments for R&D, significant lead-time, and they open up entirely new tactics but also novel limitations. This distinction brings into relief a two-pronged hypothesis that stands in stark contrast to some of the debate's received wisdoms. Maximising the destructive potential of a cyber-weapon is likely to come with a double effect: it will significantly increase the resources, intelligence and time required to build and to deploy such weapons -- and more destructive potential will significantly decrease the number of targets, the risk of collateral damage and the coercive utility of cyber-weapons.

We also know that certain weapons are modular and customizable for multiple roles, the development and acquisition cycle (at least compared to certain air superiority platforms) is very agile, weapons utilize the target system itself as a means of inflicting coercive damage, and they are heavily customized to the target and difficult to utilize in a salvo capacity. Because of this, it is unlikely they can be utilized as a standalone strategic weapon.

DoD seems to realize this too. Take a look at this graf from an article on DARPA's Plan X: 

Cyberwarfare conjures images of smoking servers, downed electrical systems and exploding industrial plants, but military officials say cyberweapons are unlikely to be used on their own. Instead, they would support conventional attacks, by blinding an enemy to an impending airstrike, for example, or disabling a foe’s communications system during battle.

Yup, sounds cumulative. DoD's vision of cyber capabilities is explicitly based on the presumption that they amplify the capabilities of conventional attacks.

One vision of how cumulative strategy might be realized in a cyber context can be found in a distillation of cumulative strategy in the special operations community. James D. Kiras has argued in his work on special operations that the relationship between special operations forces and general purpose forces also demonstrates the intersection of cumulative and sequential strategy. Special operations forces use psychological and material attrition to raise cumulative costs of operating, enhancing the striking power of conventional forces. A group of commandos raising havoc in the enemy rear area disrupts the target's logistics and forces tactical dispersion, weakening the ability to win the fight in the forward edge of the battle area. Unlike the stereotype of attrition encountered in maneuver warfare literature, attrition can have nonlinear cumulative effects. The kind of damage inflicted by cumulative capabilities, be it naval forces, airpower, or special operations units, snowballs into a fearsome weapon.

Lukas Milevski has made the analogy that cyber operations have many of the same characteristics as special operations forces. High-risk special operations depend on significant amounts of target intelligence, surprise (the zero-day exploit), and are utilized against targets in which tailored and customizable means trump general purpose conventional power. Moreover, Milevski observes that utilizing an exploit against an important system also simultaneously ensures that the same vulnerability cannot be exploited readily again through exposure.  While Milevski is right to observe how the specialized nature of cyber operations generates a particular kind of cumulative pressure that augments sequential strategy, there is more to the Wyliean metaphor than simply special operations theory.

The routine conflation of intelligence exploitation systems with weapons is but one symptom of what NDU professor Sam Liles argues is a common confusion of information security (the protection of systems) and the optimization of networks with offensive warfare. Network-centric enhancement to make war or the ability to manage and provision a network, Liles observes, is not the same thing as waging war.  Liles also argues in another post that the real ream of cyberspace is the zone of command, control, coordination, data and cognition---a "seam" between the respective domains that US military doctrine (at times artificially) defines. Such a conception broadens not only our conception of cyberspace but also our idea of what our means of cyber operations may be. We aim to use the seam to achieve a measure of control over the adversary. Moreover, just as the purpose of operations on the sea is to effect events on land, cyber operations ultimately are a means of exploiting the seam cumulatively to amplify the conventional (sequential) campaign.

Finally, this paragraph also demonstrates once again that some of the better ideas about this subject were written fifteen years ago:

Another goal is the creation of a new, robust operating system capable of launching attacks and surviving counterattacks. Officials say this would be the cyberspace equivalent of an armored tank; they compare existing computer operating systems to sport-utility vehicles — well suited to peaceful highways but too vulnerable to work on battlefields. The architects of Plan X also hope to develop systems that could give commanders the ability to carry out speed-of-light attacks and counterattacks using preplanned scenarios that do not involve human operators manually typing in code — a process considered much too slow. Officials compare this to flying an airplane on autopilot along predetermined routes.

John Arquilla and David Ronfeldt originally conceived the role of cyber war not as a standalone strategic weapon but the integration of cyber tactics and operations into warfare as a whole. Hardened systems capable of surviving hits and giving back, at speeds faster than tactical operators can contemplate, as a means of amplifying conventional effects are well within the idea of warfare they predicted in their early works.

J.C. Wylie's works are, of course, an highly imperfect means of thinking about information power. But they offer a starting point as doctrine development, operational tests, and perhaps wartime employment further determine the American approach.