It’s Time to Begin Thinking About the Principles of Cyberwar
Steven Metz |Friday, July 31, 2015
For decades military strategists have studied and refined what they call the “principles of war.” Drawn from the long history of armed conflict, these guidelines encapsulate the things that often lead to battlefield success. They are not immutable laws—bold commanders sometimes ignore them and get away with it. But they reflect the accumulated wisdom of warfighting, including things like concentrating combat power at the decisive place and time; the value of directing every military operation toward a clearly defined, decisive and attainable objective; and the need to seize, retain and exploit the initiative, among others. Every budding military planner and strategist learns them.
|Cyber Flag 14-1 participants analyze an exercise scenario at Nellis Air Force Base.|
Yet while these principles apply to conventional warfighting, today the American military is grappling with a new form of conflict: cyberwar. As former U.S. government official Richard Clarke described it, cyberwar involves “actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption.” Since two of America’s most important potential adversaries—China and Russia—have extensive cyberwar capabilities, mastering this rapidly changing and extraordinarily complex form of conflict is vital for U.S. national security. So having an agreed-upon set of cyberwar principles would be useful to guide policymakers and develop cyberwarriors.
Some military writers have attempted to apply the traditional principles of war to cyberwar, but it seems more useful to start with a blank sheet of paper to begin discussion and debate about what should constitute the principles of cyberwar. As a first cut, I propose the following five for consideration.
First, focus on psychological objectives. Military planners often gravitate to physical rather than psychological goals largely because physical things are easier to measure, observe and calculate. There is little doubt when an enemy building or brigade is destroyed. It’s harder for strategists to know when they have attained a psychological objective. But in cyberwar, psychological objectives matter more than physical ones: What is done is less important than how specific audiences understand and respond. This means that cyberwarriors and planners need to possess not just technical skills, but also an understanding of mass psychology.
Second, timing matters. To achieve the desired psychological effect, pace and frequency are vital. Actions should be performed not simply when it’s easiest, but when they will maximize the psychological effect. This is where understanding psychology comes in: Cyberwarriors must not only take the right action, but sequence and pace them for maximum psychological effect.
Third, demonstrate the capability and willingness to retaliate both symmetrically and asymmetrically. To deter cyberattacks from other nations, the United States must have the technological capability to strike back in both the cyber-realm and other ways; it must have the political will to do so; and it must demonstrate both capability and will. The best deterrent is one that the potential enemies fear most, so American strategists must identify what this is for other nations that might launch cyberattacks against the United States. It might be a symmetric response, such as a cyber counterattack, or something asymmetric, such as increasing support for the regime’s opponents.
Fourth, adapt and adjust more quickly than opponents. Change in the conventional military realm often takes place slowly or at a modest pace, in part because new equipment and weapon systems must be developed, tested, built and deployed, then troops must be trained to use them. Adaptation and adjustment in cyberwar will take place must faster, often blindingly so. Political scientist Edward Luttwak wrote that part of the “paradoxical logic of strategy” is that what works today may not work tomorrow as opponents adapt and adjust. This is also true in cyberwar but with a greatly compressed time cycle.
To succeed, then, the United States must innovate, adapt and adjust with lightning speed. This will include not only devising new methods of attack and defense but also developing new concepts and organizations, often while engaged in conflict. This means that the U.S. military must identify and reward creativity and mental flexibility. Both should be weighed during the selection and promotion of cyberwarriors. In a very real sense, the cyberbattlefield will belong to the fast and the agile.
Fifth, identify national attribution thresholds and acceptable levels of collateral damage. One of the trickiest aspects of cyberattacks is that their source can be hidden. The United States might believe it was the target of a cyberattack and think that it knows who did it, but may not be sure. The same holds for collateral damage. Conventional military technology has made great strides in precision during the past few decades. Gone are the days when cities could be carpet-bombed to take out a vital factory. Precision is difficult to attain in cyberstrikes, though, unless the target is disconnected from the rest of the information grid. This will not be common. In many cases, cyberstrikes will have cascading, often unpredictable results throughout a nation and, even more importantly, across the globe. Cyberwar strategists and planners must know what policymakers consider to be acceptable in terms of standards of attribution and levels of collateral damage as they develop their own operations.
Ultimately, these five principles of cyberwar are just a start. After all, the principles of conventional war emerged from centuries of experience. Cyberwar is new, so its parameters and implications await discovery. This means that only lengthy discussion and debate can begin the process of identifying its most important principles. The sooner that American security experts get started, the better.
Steven Metz is the author of “Iraq and the Evolution of American Strategy.” His weekly WPR column, Strategic Horizons, appears every Friday. You can follow him on Twitter @steven_metz.