Strategy and Cyberpower: From Tactics to Politics

The relationship between strategy and tactics is usually quite pithily summarized: strategy realized through tactics. The relationship between strategy and politics is also easily encapsulated: the threat or use of force for political purposes. The task of strategy is to make these two relationships profitable together. Yet the mutual interaction of these relationships is often ignored in order to highlight one or the other. This seems most particularly to be the case for cyberpower. Technical and tactical as well as strategic and policy literature abound on cyberpower.

This article addresses the gap in broad strokes and employs cyberpower as a foil with which to explore the relationship between tactics and politics. Cyberpower as an enabler is outside the direct scope of the tactical-strategic-political relationships, and this article will focus on cyberpower as an independent tool. After confirming the basic function of tactics and their relationship to strategy, the article will delve deeper into this relationship to appreciate its non-linearity. Cyberpower is identified as an excellent vehicle for exploring these non-linearities because of its unique nature as a medium among the four warfighting domains of land, air, sea, and space. It will be concluded that the non-linear character of the relationship between tactics and politics—ultimately, strategy itself—means that tactics may move beyond enabling or limiting strategy to the point that tactical feasibility may become apolitical in consequence. Politics may limit tactics, as much as tactics may limit strategy.

From Tactics, Onward

As Clausewitz argued, “tactics teaches the use of armed forces in the engagement; strategy, the use of engagements for the object of the war.”[i] Tactics enable strategy; as C.E. Callwell suggested in his work on small wars, “[s]trategy is not, however, the final arbiter in war. The battle-field decides”.[ii] Because tactics enable strategy, they also necessarily limit strategy—poor tactics do not enable as well as good tactics. As Wayne Hughes notes, “[s]trategy and tactics are best thought of as handmaidens, but if one must choose, it is probably more correct to say that tactics comes first, because they dictate the limits of strategy.”[iii] This is indeed true of all of the dimensions of strategy, not just tactics. Logistics, for example, has been called “the arbiter of opportunity”.[iv] Poor logistics, like poor tactics, restrict strategic performance. Yet tactics, unlike the other dimensions of strategy, have a more complex relationship with strategy and the politics that strategy serves because the innate adversarial aspect of war is necessarily present in both tactical and strategic arenas.

Although strategy directs the employment of power in adversarial situations for political ends, tactics are what actually make that power work. Tactics occur at the sharp end where violence rules and where strategy is made, or made to go awry. Power may achieve effect only when, tactics work well in the given political or strategic context. This does not necessitate tactical victory—one need only think of the battle between the vanguard of Greek city-states and the encroaching Persian Empire at Thermopylae. A delaying action was all that was required and a Greek defeat sufficed to achieve it. This indicates the relationship between tactics and strategy: a tactical defeat may provide a beneficial effect. Conversely, tactical victories may fail to deliver strategic success, as Clausewitz noted in his analysis of the culminating point of victory.[v] Pyrrhus would have agreed.

The relationship between tactics and strategy is hardly straightforward. Cyberpower is an excellent vehicle for examining this relationship in more detail for two reasons.

First, its nature differs from the four warfighting domains of land, sea, air, and space. Martin Libicki has suggested that cyberspace does not comprise an actual warfighting domain, and that considering it as such is counterproductive.[vi] It is man-made, but then so are cities, aircraft carriers, aircraft, and satellites. These, and other man-made objects, add depth to the rules or concerns of tactics and strategy without seriously changing them, and also correspond to the warfighting domains. Cyberspace relies upon computers, network cables, and satellites, all of which physically exist. Yet cyberspace means little without the data that flow back and forth across the myriad of networks. Data are integral to every major definition of cyberspace, although the hardware systems necessary to hold and transfer that information usually get shorter shrift.[vii] This means that unlike the warfighting domains, physical attack may not be executed exclusively within the medium of cyberspace, but also at it.

Second, as explained by Edward Luttwak, cyberspace compresses aspects of strategic hierarchy. In Luttwak’s formulation, the logic of strategy works on, and melds together, all levels of agency in war from the technological to the tactical, the operational, the strategic, and the grand strategic.[viii] Unlike on the sea, in the air, or in orbital space, in cyberspace technology and tactics are virtually synonymous. In the four warfighting domains, tactics adapt to and exploit technology while the human dimension remains constant. Soldiers on the ground execute the tactics using whatever technology is readily available and may make adjustments if the situation warrants. By contrast, the use of technology for cyberpower begins at the point of access to cyberspace. Thereon, most activity, including tactics, depends on pre-programmed software and the expertise to modify programs ad hoc and in the heat of the moment. A program thus simultaneously represents both a particular tactical capability and a specific tactical doctrine, for it combines with what is instead of how it is achieved. This results in an actual conflation of means and ways in strategy, creating what might be considered as pure a context as possible (short of the abstractions of nuclear strategy) for considering the relationship between tactics and strategy.

This relationship is necessarily important for a strategic understanding of cyberpower because, as established above, tactics dictate what strategy can or cannot achieve, albeit in a non-linear fashion. This is significant, given the focus of strategy as revised after the First World War. “[T]he definition of strategy which gained currency in the light of that war, and with increasing force as the twentieth century proceeded…[focused not] on the relationship between tactics and strategy, but on that between strategy and policy.”[ix] This change of emphasis is the foundation of the observation that “[a]ll too many works on cyberspace and cyberpower are focused on the technical, tactical, and operational aspects of operating in the cyber domain. These are undoubtedly important topics, but very few address the strategic purpose of cyberpower for the ends of policy.”[x]

In the face of such valid commentary it is possible to draw compelling conclusions about the strategic meaning of cyberpower by considering its context within the full history of strategic thought and practice.[xi] Yet ultimately such analyses are premised primarily upon analogy and an understanding of fundamental strategic theory. Danny Steed’s observation that strategists simply cannot yet know in detail the full range of the capability of cyberpower is equally compelling.[xii] These differing analyses arise from differing focuses on strategy’s dual relationships. The former emphasizes the link between strategy and policy, whereas the latter focuses on the connection between strategy and tactics. The deepest understanding of the strategic meaning of cyberpower must draw insight from both sets of relationships rather than only from one or the other.

To understand strategy’s relations with tactics and politics, one must understand “that the aim of war is some measure of control over the enemy.”[xiii] The psychologists John Thibaut and Harold Kelley in 1959 proposed two forms of control: fate control and behavior control. “If, by varying his behavior, A can affect B’s outcomes regardless of what B does, A has fate control over B.” Behavior control, by contrast, meant that “[i]f, by varying his behavior, A can make it desirable for B to vary his behavior too, then A has behavior control over B.” Moreover, “[f]ate control can be used to control behavior”, through repeated interaction of individual behaviors. However, the authors concluded that too frequent use of either form of power might be counterproductive for “[a]n individual’s power over another derives from the latter’s being dependent upon him.” Too frequent use of power to control another erodes that dependence.[xiv]

Fate control and behavior control correlate to two interpretations of politics, and how strategy may, through tactics, influence politics. Fate control corresponds to the idea of politics as simply who gets what, when, and how.[xv] Behavior control corresponds to the idea of politics as the psychology of wielding, and yielding to, power. Thibaut and Kelley established that unfortunately fate control may only be converted into behavior control through repeating particular actions and their consequences, a mode of operating generally unavailable to a strategist and one which may not necessarily work. Nevertheless, control in war breeds dependence: “It is the threat of damage, or of more damage to come, that can make someone yield or comply. It is latent violence that can influence someone’s choice—violence that can still be withheld or inflicted, or that a victim believes can be withheld or inflicted.”[xvi] This remains logically true, despite the failure of Rolling Thunder, but the devil is in the operational details.

In the arena of behavior control, cyberpower is necessarily disadvantaged compared to other forms of power. As a “specter of non-obvious warfare”, cyberpower may potentially cause great damage, but the significance of that damage is not immediately apparent.[xvii] The electrical grid may be compromised through cyberpower, millions would be without power. But what would it mean politically? Not only those directly afflicted, but those with the power to send and receive information would be left in ignorance of the cause. Is this an attack, or just another mass power failure? The millions bereft of power and their political representatives would be equally ignorant that some third party might have a limited form of fate control, and so this level of fate control would not be transformed into behavior control. The cause of the damage may be too obscure to change policy.

“The trouble is that there is a radical difference in nature between violence and political consequence… this dilemma of currency conversion is central to the difficulty of strategy.”[xviii] Strategy converts tactical action into political meaning; conversely it must also identify political or strategic weakness and transform it into tactical opportunity. Strategy thus forms a closed, two-way feedback loop in which definitive political effect gives meaning to all tactical action and is the prize to be won. Tactics shorn of ultimate political purpose result in meaningless bloodshed and damage. The conclusion follows that tactical feasibility does not necessarily represent strategic or political desirability. This is particularly, but not exclusively, the case for cyberpower given its non-obvious character as an instrument of policy.

Yet Schelling’s observation on the coercive value of latent force does not represent the whole truth. Damage already inflicted also matters, and may be directly relevant to the opponent’s ability to implement his policies. Thus strategic calculus changes if one abandons the desire to modify another’s behavior through fate control, merely to exercise that control for its own sake. This course of action assumes a significantly lower standard of effect in certain respects, as tactical consequences necessarily impact both power relationships and the opponent’s capabilities for implementing policy- regardless of unwavering political behavior and purpose. Regardless of the intentions of its creators, Stuxnet may be interpreted as an attempt at fate control by inflicting physical damage on Iranian centrifuges at Natanz. However, it was strategically unsuccessful as the damage was insufficient to endanger the Iranian nuclear program by overwhelming the reserve stockpile of centrifuges they had available.[xix] Emphasis on fate control opens the door to actions which are tactically plausible but politically irrelevant, multiplying the potential applications of cyberpower but not necessarily increasing one’s ability to achieve desired political effect.

Yet, as the Stuxnet case indicates, the circumstances in which such a strategy may be desirable are quite specific. Two conditions may be necessary for cyber attacks to be strategically worthwhile: first, there exist hard limits on the ability of the opponent to recover from a damaging attack. Secondly, the damage occurs in infrastructure critical to national security or in policies disagreeable to the attacker, such as the development of a nuclear energy sector with potential threshold capability for nuclear weapons. This is merely attrition by another, non-obvious, instrument—the logic is universal to all infliction of damage.

It is just as easy to overstate the potential of cyberpower as it is to dismiss. “Cyber can only be an enabler of physical effort. Stand-alone (a misnomer of ‘strategic’) cyber action is inherently grossly limited by its immateriality.”[xx] Yet with the ongoing rise of both computing and networking, immaterial programs now have direct control over material industrial processes. Moreover, when services and the stock market contribute significantly to a national economy, the economic basis of national power is itself partially founded on immaterial processes. Cyberpower for fate control has no lack of tactically feasible opportunities. In this sense, Steed is quite right in his suggestion that strategists still do not fully know of what cyberpower is capable, and probably will not without further praxis.

The strategist’s role, given what may actually be a glut of tactical opportunities within the cyber realm is to distinguish those which are politically desirable from those which are not. The relationship between strategy and politics is the arbiter of tactical actions that are worth the effort and costs and which are not. Even though it is the tactical-strategic relationship which establishes the boundaries of what is actually achievable on the ground, the desirability of any action may only be judged from strategy’s relationship with politics. Strategists who are relatively complacent about the potential of cyberpower are thus also on firm ground, albeit possibly not for entirely the right reasons. Not all potential targets of stand-alone cyber attack are politically desirable from either a fate or a behavior control perspective, and fewer still represent targets of actual political vulnerability.

Conclusion

The relationship between tactics and strategy is necessarily more complex than that summed up in the pithy remark that strategy is realized through tactics. However, this depth is sometimes overlooked because of the nature of the war-fighting domains. Cyberspace and cyberpower are best suited to exploring the tensions between tactics and strategy because of the relatively unbounded geographic nature of cyberspace as a medium for conveying its particular character of power to almost any networked target. This contrasts with the relatively and variably more restricted war-fighting domains of land, sea, air, and orbital space, in which courses of action tend to be much more constrained by physical geography, weather, hardware, and other variables.

Tactics necessarily enable, but also limit, strategic performance. Yet not all tactically feasible action is strategically necessary or politically desirable as it may not lead to change in the opponent’s policy, or to beneficial change in the adversarial power relationship. The expanding limits which cyberpower tactics set might thus exceed what strategy requires or even knows what to do with for political purposes, in stark contrast to the problem strategists faced a century ago during the First World War, when for years the limits of tactics hamstrung strategy and the consequent political effect.

Strategists today have yet to experience the tactical limits of cyberpower, and of what cyberpower may actually accomplish. Yet these unknown limits of cyberpower likely go beyond the boundaries of political desirability, as much of what cyberpower is tactically capable of is not instrumental for political purpose. The optimism in this thought is necessarily counterweighted by the observation that rationality comprises only one aspect of the Clausewitzian trinity. Passion inhibits reason, and chance may send it awry. The tactically possible still remains possible, even though it may be politically useless.