‘Cyberwar’ is not coming

The term cyberspace was coined by the science-fiction writer William Gibson in the 1982 short story ‘Burning Chrome’. Of his creation, Gibson later said “it seemed like an effective buzzword … evocative and essentially meaningless. It was suggestive but had no real semantic meaning, even for me.”[i] No one now would deny its buzzy qualities; even in an era of increasing fiscal austerity, attaching the prefix cyber to this or that policy or threat has the power of opening the public purse like no other. For instance, in the recent UK defence review cybersecurity was one of the few areas where increased funding was announced (the other, not coincidentally, was intelligence); in practically every other area of defence the funding arrows pointed sharply downward.

The title and foreword of Britain’s new National Security Strategy, A Strong Britain in an Age of Uncertainty, provides a perfect example of a paradoxical perception of physical security being matched by a sense of unconventional insecurity:

Britain today is both more secure and more vulnerable than in most of her long history. More secure, in the sense that we do not currently face, as we have so often in our past, a conventional threat of attack on our territory by a hostile power. But more vulnerable, because we are one of the most open societies, in a world that is more networked than ever before.[ii]

Nor is Britain peculiar in this sense; the same sentiment pervades American strategic writings such as the latest Quadrennial Defense Review and, no doubt, of most other major countries.[iii]

The word ‘cyberwar’ (or two words, ‘cyber war’, it depends who you ask) is evocative, to be sure, but what does it actually mean for strategists concerned with the balancing of ends, ways and means in conflict today? Not much. In fact, it is not just a meaningless neologism, but strategically a distracting and nonsensical one. Contemporary strategists who reckon that ‘cyberwar’ is a decisive new form of conflict are wrong.

The apprehension about cyber is natural and predictable. In the late 1960s Marshall McLuhan, drawing on Søren Kierkegaard’s 1844 book The Concept of Dread, observed that “wherever a new environment goes around an old one there is always new terror.” It is not hard to find evidence today of a ‘new terror’.[iv] It is splashed across the pages of newspapers and the covers of popular books where all manner of cyber-prefixed threats from ‘cyberespionage’ and ‘cyberterror’ to ‘cyberwar’ and even ‘cybergeddon’ are proclaimed; and these in turn engender other cyber-prefixed neologisms such as ‘cybersecurity’, ‘cyberpower’ and ‘cyberstrategy’ in response. Most of these neologisms need to die and none sooner than cyberwar. As strategists we should be demanding that our colleagues be more disciplined in their declaration of new prefixed war types.

Haven’t I seen you here before?

The present is always shaped by many forces, often deep historical processes — political, social, economic, demographic, climatic and so on; but there can be little doubt that this particular moment is powerfully affected by a recent and radical change in the modality of communications which many regard as the dawning of an ‘Information Age’. “The Web is shifting power in ways that we could never have imagined”, claimed a recent BBC television documentary on cyberspace called The Virtual Revolution:

With two billion people online the Web is holding governments to account, uncovering injustices, and accelerating globalisation. It’s providing us with new allegiances but it’s also reinventing warfare.[v]

Leave aside whether this is true — we shall come back to it — and wonder, haven’t we heard this before? Of course, repeatedly throughout the 20th century (especially in the first decades but actually still occasionally even today) the prophets of airpower made exactly the same claim. As Michael Sherry commented on early speculations about the “age of flight” in his masterful history The Rise of American Air Power:

Because prophecy necessarily leaped ahead of technology, it often read like fanciful or bloodless abstractions, as if designed, like science fiction, less to depict future dangers than to express current anxieties.[vi]

Writing in the shadow of the Great War’s ghastly yet indecisive slaughters, strategists such as J.F.C Fuller convinced themselves of the power of aerial warfare to deliver big results fast. In The Reformation of War he invited his readers to consider the consequences of a massive aerial attack:

London for several days will be one vast raving Bedlam… the government… will be swept away by an avalanche of terror… Thus may a war be fought in forty-eight hours and the losses of the winning side may be actually nil![vii]

Fuller’s imaginings succeeded in capturing brain-space amongst the most senior policy-makers. “The bomber will always get through…”, warned Stanley Baldwin in a famous House of Commons speech in November 1932 entitled ‘A Fear for the Future’.[viii] Thus twinned can be seen the belief not only in airpower’s puissance but an equally acute sense of the fragility of modern society and its vulnerability to attack. As the other great interwar British strategist Basil Liddell-Hart put it, air power enabled strikes to be conducted over top of a nation’s surface fortifications:

A nation’s nerve system, no longer covered by the flesh of its troops is now laid bare to attack, and, like the human nerves, the progress of civilization has rendered it far more sensitive than in earlier and more primitive times.[ix]

This is not to beg the question that airpower and ‘cyberpower’ are necessarily the same or equivalent things; rather it is to suggest we must walk a fine line between justified concern and interest-driven alarmism when it comes to the strategic evaluation of the cyber threat, and that this might be helped by observing some lessons from the stultifying 100-year debate over airpower.

The most pertinent of these is the fact that airpower never lived up to the dreams of its most enthusiastic boosters. No one would deny its enormous importance in modern warfare — indeed it is not far-fetched to say that “death from above” is practically the signature of the contemporary Western way of war; but what has never come to pass is the independent war-winning quality which the prophets of airpower claimed for the new means of war.

Almost as pertinent is the need to be cautious of generals whose expert claims for the new means must be regarded in light of their speakers’ needs for advantages in internal bureaucratic positioning vis-à-vis other services. For instance, in 1908 the science fiction author H.G. Wells in his book The War in the Air described the strategic impact of airpower essentially ambivalently: just five years after the first flight of the Wright brothers he already concluded that aerial warfare would be “at once enormously destructive and entirely indecisive.”[x] Contrast this with the utopian conclusion of William ‘Billy’ Mitchell, father of the United States Air Force (with the benefit of another two decades of study) that airpower was “a distinct move for the betterment of civilization, because wars will be decided quickly and not drag on for years.”[xi] Who was the clearer thinker?

Another wise thing would be to bear in mind Eliot Cohen’s sage observation that “air power is an unusually seductive form of military strength, in part because, like modern courtship, it appears to offer gratification without commitment.”[xii]

Would you like to come up and see my etchings?[xiii]

In fact, cyberpower is even sexier because it appears to offer something which airpower does not: anonymity, which is a function of the identity-obscuring architecture of cyberspace.[xiv] Undoubtedly this has scary implications; it is the key factor underpinning the hyperbolic ‘cyber-doomsday’ scenarios, which are scaring the wallets out of politicians’ pockets.

For instance, in Richard Clarke’s recent book Cyberwar he describes a cyberattack on the United States, which is utterly devastating ‘without a single terrorist or soldier ever appearing in this country.’[xv] Then in a further twist he adds the kicker, because of the inherent identity-obscuring effect of the Web “…we may never even know what hit us.”[xvi] Indubitably, this is a scary scenario. “Cyberspace is [the] nervous system—the control system of our country,” it says in American strategy.[xvii] If they screw with that we’re really screwed. However, is that not also the same thing that Liddell-Hart said about airpower?

Maybe what was untrue of airpower before may be true of cyberpower now; there is no sense in being Luddite about the effects of technology, but it is important, as strategists, not to fool ourselves with it either — which is what we are doing with the ‘attribution problem’. Not only is it scary it is also tempting, because it appears to solve an even more vexatious problem of war which has bothered generations of strategists beyond the ones today trying to make sense of information technology: escalation. The implicit logic goes as follows:

1. The identity of a cyber-attacker can be technically very difficult to ascertain;
2. retaliation, therefore, is complicated; and,
3. as a result, the inherent escalatory effect of war that has largely held back major war since 1945 might not be engaged.

The obvious way in which deterrence rapidly comes into question has occasionally fuelled comparison of cyberattacks to nuclear ones which are absurd; for as Martin Libicki points out the two are as different as ‘fire’ and ‘snowflakes’ — the former destroys cities and kills people whereas the latter merely disrupts and inconveniences them to a greater or lesser degree.[xviii] The appropriate comparison is to airpower. Cyberpower, however, is even more seductive than airpower, in part because, as the sex lives of countless online masturbators will attest, it offers gratification without physical connection of any sort, let alone commitment.

This is delusion — though it is not to diminish the ‘attribution problem’, which is quite obviously exploited by hackers and criminals who amaze with their speed in the technology race. Rather, it is to say that it is really something which pertains to those activities and not to war, unless one can conceive of one state using cyberpower alone to bend another to its will without declaring what it is. It may come afterwards, it may be implied or delivered secretly rather than openly but anonymity is as much a problem for the aggressor as it is the defender: one’s enemy needs to know whose thumb they are under so that they may surrender or render ‘cash payment’ in return, as Clausewitz put it.

This date will be more expensive than you thought

The ubiquity of digital networks and the prevalence of cheap consumer electronics are thought to be another strategic challenge of cyberspace. As it was put in a recent article in Joint Forces Quarterly,

One reason for the imminent and broad-based nature of the cyberspace challenge is the low buy-in cost compared to the vastly more complex and expensive appurtenances of air and space warfare…[xix]

Thus exposed is the characteristic fear of our age: pick your metaphor, Goliath versus David or Gulliver against the Lilliputians — our power may not avail us against a sneaky new type of kick in the balls. Actually, this is a very reasonable fear but it needs to be kept in perspective. Outside of Bible stories, God tends to favour the side with the bigger battalions, as Napoleon once wryly observed.

To be sure, the physical instruments of ‘cyberwar’ are dirt cheap. Stuxnet which targeted the Iranian nuclear programme accomplished relatively cleanly what a powerful air force might have struggled to do messily — and it fit that comfortably on to a thumb drive; but this intangibility belies its size and sophistication. Stuxnet is the Zeppelin bomber of today — complex and costly in its own right, but more important as a harbinger of greater complexity and cost to come. Its design required a large amount of very high-grade intelligence about its intended target in order to work. It was not, according to experts who have analysed it, the work of hackers on the cheap:

It had to be the work of someone who knew his way around the specific quirks of the Siemens controllers and had an intimate understanding of exactly how the Iranians had designed their enrichment operations. In fact, the Americans and the Israelis had a pretty good idea.[xx]

In short, as with all other weapons systems (with the exception of the hydrogen bomb, arguably) it required the combination of significant other resources in order to achieve strategic effect and for that effect to be sustained. Far from demonstrating a smoothing of the existing asymmetry of power amongst states it actually shows a reinforcement of that asymmetry: cyberpower rewards already powerful states with even more capability and, when push comes to shove, it would appear that Western powers have thought hard about cyberattack and are pretty good at it.

Again, a comparison to airpower is apt. Certainly, virtually unchallenged air supremacy and air-ground coordination has become more or less the sine qua non of the Western ‘way of war’; or what in his book Military Power Stephen Biddle described, in slightly different terms, as the ‘modern system’ of warfare—a system which, not incidentally, he claims was born in the tactical conditions of the First World War.[xxi] The advent of the ‘modern system’ caused a bifurcation of military power between armies that ‘got it’ and armies that did not — with the latter being soundly thrashed by the former even when they possessed the same, or similar, weapons and numerical superiority.

A similar thing is likely with respect to cyberpower. Armies which are able to defend their networks will accrue distinct advantages from ‘network-enabling’ them, while armies that do not possess such ability will not enjoy any such advantage — and they will be punished harshly for trying to ‘network-enable’ practically anything. It is worth recalling that the seminal 1993 article by John Arquilla and David Ronfeldt, ‘Cyberwar is Coming!’ which set off this debate, in contrast with the extant literature on cyberwar, was essentially tactical in orientation:

Small numbers of your light, highly mobile forces defeat and compel the surrender of large masses of heavily armed, dug-in enemy forces, with little loss of life on either side. Your forces can do this because they are well prepared, make room for manoeuvre, concentrate their firepower rapidly in unexpected places, and have superior command, control, and information systems that are decentralized to allow tactical initiatives, yet provide the central commanders with unparalleled intelligence and ‘topsight’ for strategic purposes.[xxii]

It was a vision about moving and shooting more adroitly than your opponent through the employment of better information systems — knowledge as power in a very literal and immediate sense. The literature on cyberwar would not lose much by rewinding to this initial conception and starting over. Military cyberpower is a real and important compliment to other military capabilities — it does not, as airpower did not, obviate those capabilities or change the objective nature of war. It is possible that we are as a species near to a genuine discontinuity, which some scientists have described as ‘The Singularity’ — the point at which human intelligence is surpassed by machine intelligence.[xxiii] After that happens, whether we merge with our digital offspring, are massacred by them, or kept as reverend ancestors, or much-loved pets, there is no point speculating about war (or anything else); until then, however, war will remain as it ever was — the collective action of one group of people to impose their will against the resistance of another. The focus of strategy must, therefore, be on understanding the human ends to which technological means are applied in ever-shifting shifting ways. Prefixed war types, which shift that focus onto the technology itself, are to be rejected.