Pierluigi Paganini February 12, 2015

Cyber warfare is becoming the most progressive warfare domain after the Second World War. Which global actors benefit the most from this capability.

Cyber warfare is becoming the most progressive warfare domain after the Second World War. The progression of this concept brings us to the next milestone, to define which global actors benefit the most from this capability. The feasibility of offensive cyber warfare capability of the weaker states against states with stronger kinetic warfare capability grants them a strategic advantage and enables them to change the balance of power in their advantage. Offensive cyber warfare capability is a sound strategic balancing factor that potentially will be utilized by the rising/challenging hegemon against the hegemon. The attractiveness of cyber warfare for the weaker state is due to its low cost of development and deployment, its minimum visibility during development and mobilization as a weapon, attribution, globalization of information and global accessibility of technology and the fact that stronger states are more dependent on their critical cyber infrastructure.

Understanding the effectiveness of the strategic culture and utilization of cyber warfare capability by the challenging/rising hegemon against the hegemon will have consequences on U.S. national security doctrine. United States as one of the most “wired” states in the world shows a potential vulnerability against cyber-attacks. Globalization -fueled by technological advancement and spread of cyber space in physical space- is a manifestation of new means through which power is exercised and distributed. On the same token such power comes with a vulnerability that states such as North Korea and China are trying to separate themselves from by keeping their critical infrastructure isolated from internet reach. Cyber Warfare is a unique case, the more you have invested and expanded on your capabilities in cyberspace more vulnerable you are.

The exponential growth of internet and dependence of our critical infrastructure to cyber space (i.e. power grids, emails, emergency systems, reconnaissance networks, military communication, weapons and etc.) begs the question; can cyber warfare be the dominant dimension for interstate conflicts in the future?  Consequentially the next question that needs to be addressed is that in the context of international theory which group of states benefit the most strategically from offensive cyber warfare capability? This study argues that, considering the fact that a rising regional hegemon such as China does not have kinetic war (traditional weapons) capability that equates to the U.S. advanced military forces; offensive cyber warfare becomes a sound balancing factor against this asymmetric relationship.

One may argue that there is still a significant “digital gap” between haves (having strong technological and cyber capabilities) and have-nots, attributing a stronger cyber warfare capability to states with stronger military and technological advantage. However the difference between developing a strong cyber warfare capability and nuclear capability is substantial. It takes less economic, human and geo-political resources to develop cyber-attack capability than nuclear capability. This becomes a fundamental assumption in comparing nuclear capability and cyber war potential. Realist scholars argue that nuclear capability is the absolute form of military power that provides security for proliferated states.

Cyber war capability presents a different aspect of this argument, the strategic capability embedded in lack of attribution of the source of a cyber attack, secretive aspect of information operations and the fact that a large scale computer network attack (CNO) can be launched from a small facility with least amount of visibility allows for cyber warfare to be a viable front for challenging rising hegemons.

To understand the effectiveness of cyber warfare especially for states with a smaller conventional arms forces and less technologically advanced military one should study the basics of the asymmetric warfare. Cyber warfare capability provides an important strategic advantage in an asymmetric warfare to the weaker party. Realistically the perfectly symmetric warfare does not exist, particularly when the United States is involved. However cyber warfare may be more asymmetric than other strategic weapons. The U.S. economy and society are heavily networked; so is its military. On the other hand the attacker, by contrast, may have no targets of consequence, either because it is not particularly “wired”, because its digital assets are not networked to the outside world, or because such assets are not terribly important to its government. In the case of North Korea and US the asymmetric characteristics of the cyber warfare has major significance.For instance, the strategic culture of North Korean military by nature will allow for cyber warfare to become a central ability of the arms forces, due to its low cost of deployment, covert nature of the weapon and attribution. Highly asymmetric outcomes are possible when cyber warfare is utilized. A weaker challenging state like North Korea may mobilize enough clever people to do serious damage to a state that is richer and more high-tech but that is taking into account that the attacked state is more dependent on its information infrastructure. In the case of U.S. it is arguable that this requirement is satisfied and U.S. is one of the advanced states in the world that is moving towards full cyber capability. Similar aggression in conventional warfare would lead to crushing defeat of the smaller state by the hegemon.

One may argue that U.S. being a more wired state, and arguable the strongest state by far from its rivals in technology also holds a strong ground in cyber defense. But it is important to note that the inherent characteristic of the cyberspace favors the attacker, not the defender. Furthermore, unlike conventional or nuclear war, a cyber-attack is not always obvious. It may take years to identify an attack and by that time the source of attack may have been disappeared from the cyber space. Additionally, the responsibility for defending the nation against a cyber-attack spreads across many federal agencies and the private sector, which complicates congregating a coherent response to an attack. Internet has provided a uniform platform connecting public and private sector, making defense and deterrence a daunting task. Further, from a defensive perspective, it is difficult to imagine how to defend a space that has no boundaries. Also, based on its design, internet changes constantly, grants access to anyone, and exists virtually everywhere. Even so-called closed networks, such as those that are not connected to the Internet (i.e., air-gapped networks) are still at risk from the manual insertion of malware (by means of portable storage devices as in the case of Natanz Nuclear Plant in Iran); even wireless code insertion, transmitted over radio or radar frequencies, is easy to access and tamper with. Now that we have identified that defense is a complex algorithm that reduces its accuracy in cyber security let’s review the potential ramifications of a cyber-attack by a weaker state.

What makes cyber warfare effective and viable for the weaker state? In the current anarchic international system of governance, considering the fact that U.S. has by far the strongest conventional military force, what strategies can be used by weaker states to keep the balance of power?

Cyber warfare capability as a strategic weapon for countries such as North Korea seems to be the most viable option. The low cost of entry (for example, a personal computer connected to the Internet), and the ability to operate anonymously, and the problem with attributing an attacker to a cyber-attack are factors that makes cyberspace attractive to adversaries who know they cannot challenge the United States in a symmetrical contest. Potential adversaries, such as Iran and North Korea, are reportedly developing capabilities to attack or degrade U.S. civilian and military networks. “Moonlight Maze” and “Titan Rain” are examples of successful attacks against non-classified military systems which DOD officials claim were directed by other governments. According to the Defense Department’s annual report to Congress on China’s military ability, the Chinese military alongside states such as Iran and North Korea are enhancing their information operations and cyber offense capabilities.

In a kinetic warfare scenario, deterrence has an important role. Fear of retaliation makes the attacker to pause and think twice. In the case of cyber warfare deterrence has not been an effective strategy for the U.S. there are over 20 to 30 nations that have already established offensive cyber units so we apparently did not deter them. North Korea being one of these states has recently ramped up its investment on cyber warfare capability development. Also from a cost analysis standpoint the case for cyber deterrence generally rests on the assumption that cyber-attacks are cheap and that cyber-defense is expensive. As Martin Libick states:

“Just as nuclear era spawned policies of deterrence that, although elaborate, were successful or at least not challenged, today’s era needs a doctrine of cyber deterrence.”

The problem with deterrence is that countries are not equally vulnerable to cyber-attacks, thus cyber retaliations or balancing will not be the same as equalization of nuclear warfare capabilities.  The aim of deterrence is to create disincentives for starting or carrying out further hostile action however in the case of cyber-attack this notion is hard to achieve. Deterrence also requires the adversary to be able to distinguish between being punished from not being punished. In most realms this is not a problem, however for cyber warfare this is a major problem. The raw calculus of deterrence is fairly straightforward: The lower the odds of getting caught, the higher the penalty required convincing potential attackers that what they might achieve is not worth the cost. Unfortunately, the higher the penalty for any one cyber-attack, the greater the odds that the punishment will be viewed as uneven, this by nature can be contributed to the attribution problem inherently embedded in the cyber warfare capability.

Cyber warfare capability is a new arena in strategic studies and it surely requires thorough understanding of the technical and political elements of this phenomenon. Cyber space is not solely developed and defended by the sovereign states and many non-governmental stake holders are involved in deployment of this virtual world. It is imperative for the U.S. government and the international community to consider cyber warfare as a weapon for rogue states and those actors that need its capabilities to gain economic and political advantage against the dominant political structure.

About the Author

Artin Amirian is an IT infrastructure engineer with extensive education in Computer Science, Economics and International Political Economy. His graduate research has focused on cyber security policies, globalization of information technology and the implications of CNOs on national security. He currently directs the engineering department of TeraBand Technologies, a California Based IT design/integration firm and continues his research on the effect of information technology on national security. The following is an abstract from his next effort that is expected to be published by December 2015.